immune-brain 4.5.0 → 4.6.0

package/plugins/immune-brain/dist/imm-loop.md

@@ -130,11 +130,18 @@ The runtime owns no model invocation and adds no persisted execution lifecycle.
 After diagnostics pass, the Parent advances Kernel QA and dispatches any reserved
 foreground Review once using the exact returned `agent_params`, then submits its
 structured verdict. An open Review reservation stays with that Host invocation;
-batch re-entry waits for it rather than redispatching. On Kernel `done`, stage
-only that child's generated terminal audit evidence and call
-`start_unattended_batch` with the same slug. The driver reconciles settlement,
+batch re-entry waits for it rather than redispatching. When a batch child's
+foreground terminal mutation reaches Kernel `done`, the same tool call stages
+only that child's generated terminal audit evidence and re-enters the batch under
+the still-valid authorization, opening no gate. The driver reconciles settlement,
 adopts or creates the one scope-bound commit, then enrolls the next ready child
-under the still-valid authorization. Ordinary Executor handoff and below-limit
+or settles the batch as `completed`; the result carries the batch report as
+`batch`. A reserved Review, a parked child and a stopped child end where they do
+today and are never committed automatically. If the re-entry fails, the Kernel
+result is unchanged and `batch` carries one recovery action: call
+`start_unattended_batch` with the same slug, which is also how to continue by
+hand. A commit that fast-forwards the batch branch outside the runner is adopted,
+not attributed to a child; any other HEAD movement still fails closed. Ordinary Executor handoff and below-limit
 QA repair do not park the batch; genuine budget/authority stops remain fail-closed.
 
 Batch execution never pushes a ref, opens or updates a pull request, resolves a

package/plugins/immune-brain/dist/imm-planner.md

@@ -273,8 +273,21 @@ goal prose and never truncates a title. The tracker rereads every canonical
 TaskIntent for identity, risk, and acceptance IDs; projection fields and public
 summaries never widen TaskIntent scope or authority. It validates the complete dependency graph before
 remote writes, creates the Parent once, creates all Children, attaches every
-Child as a native Sub-issue, creates native `blocked_by` relations, and rereads
-the complete topology. Every Child carries `ready-for-agent`, blocked Children
+Child as a native Sub-issue, creates native `blocked_by` relations, and takes
+every Issue number from its own create response. The write flow is direct: one
+start-of-run read of the repository identity, the Issue listing, and the label
+listing, then one create per absent Issue in dependency order, one attach per
+Child, and one relation write per edge. No repository listing, attachment,
+dependency or ownership confirmation follows a write; one Issue-scoped read
+follows each create to resolve the database id the relation endpoints need,
+because `gh issue create` returns only the Issue URL. No cumulative deadline
+exists either; each call keeps its own per-call timeout and
+the caller's cancellation. Deduplication is start-only: a rerun of the same
+approved batch adopts whatever the start listing already carries and writes only
+the missing relations, so it never creates a duplicate Issue and never repeats a
+completed write. Concurrent edits made during a run are not detected in that
+run; they surface as drift at the start of the next run. Every Child carries
+`ready-for-agent`, blocked Children
 additionally carry `blocked`, and the Parent carries neither; the tracker never
 creates labels, so a repository missing a required label fails the batch closed
 before any remote write. The Child Agent Brief includes a direct Parent Issue link.
@@ -298,27 +311,39 @@ complete-decomposition decision; or `tracker_projection_failed` with the returne
 failure and exact retry action. A candidate Initiative or partial Issue set
 recorded only in the Spec or final summary is neither user confirmation nor a
 completed carrier outcome. Report `retryable_failure`, `permanent_failure`, or
-`ambiguous_remote_state` and the exact batch retry action. This does not invalidate
+`ambiguous_remote_state` and the exact batch retry action. A failure after the
+request may have landed is reported as uncertain with its confirmed steps, its
+pending steps, and one recovery action: rerun the same approved batch, whose
+start listing adopts whatever landed. This does not invalidate
 already-authored planning files, but it blocks `tracker_associated` and every
 Enrollment or execution handoff for that Initiative until the same complete
-batch succeeds. Do not infer opt-in from tracker output or Issue state, auto-close the Parent,
-import Issue state, create a TaskIntent from an Issue, or store Issue identity in
+batch succeeds. Do not infer opt-in from tracker output or Issue state, import Issue state, create a TaskIntent from an Issue, or store Issue identity in
 TaskIntent or TaskRecord. Existing Issue markers grant permission only for
 idempotent retry of that same approved Initiative; they never grant execution
 authority.
 
+The Planner never closes the Parent. The terminal projection of a Child does: when
+`mark-terminal` closes a Child as completed and every Slice Child of that Initiative
+is closed as completed, the tracker closes the Parent as completed; an open, stopped
+or parked Child keeps it open.
+
 For amending an already-published Initiative, the same
 `imm-tracker publish-initiative --stdin --json` operation accepts an optional
 `amendment` input after the literal user approves the changed pending frontier.
 Provide the complete approved pending Tasks plus the complete read-only
 historical Child list, each binding the observed `issue_number`, title, body,
-and state at approval. The tracker verifies every bound Issue against that
-baseline before any write, updates only approved pending briefs, converges the
-exact approved pending `blocked_by` set, creates newly added pending Children,
-and preserves historical Children byte-for-byte with their native Sub-issue
-links and dependency relations. Omitted membership, baseline drift, or a
-stopped historical prerequisite fails closed with zero or bounded mutations
-and an exact retry action; the strict no-amendment default is unchanged.
+and state at approval. The amendment uses the same direct write flow: one start
+listing (plus Issue-scoped Sub-issue and `blocked_by` reads) verifies every bound
+Issue against its baseline, then the Parent is edited at most once, each approved
+pending brief is edited at most once, newly added pending Children are created as
+in ordinary publication, and each pending Child's `blocked_by` set is converged
+to the approved set. Historical Children are never written and keep their
+byte-exact content, native Sub-issue links and dependency relations. No read
+follows a write and no closing recheck runs, so baseline drift that appears after
+the start listing is not detected in that run; it surfaces at the start of the
+next run. Omitted membership, baseline drift present at start, and a stopped
+historical prerequisite fail closed before any write with an exact retry action;
+the strict no-amendment default is unchanged.
 
 ### Verification Descriptor Discipline
 

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -316,7 +316,10 @@ export interface ForegroundToolUpdate {
 	details: Record<string, unknown>;
 }
 
+/** Wall-clock milliseconds spent per advance stage; the stage names are the progress stages. */
+export interface AssuranceTimings { total_ms: number; stage_ms: Record<string, number> }
 type AssuranceRecoveryFields = {
+	timings?: AssuranceTimings;
 	diagnostics?: QaCheckDiagnostic[];
 	environment_failure?: boolean;
 	recovery?: AssuranceRecovery;
@@ -404,12 +407,23 @@ export interface AssuranceCoordinatorPorts {
 	qaOnAuthorityCommit?: () => void;
 	qaAfterAuthorityCommit?: () => Promise<void>;
 	qaJobTimeoutMs?: number;
+	/** Attach per-stage `timings` to advance results. Defaults to IMM_ASSURANCE_TIMINGS=1. */
+	reportTimings?: boolean;
+	/** Overrides QA_MAX_IDENTICAL_FAILURES; tests only. */
+	qaMaxIdenticalFailures?: number;
 }
 
 export const QA_MIN_JOB_TIMEOUT_SECONDS = 15 * 60;
 export const QA_MAX_JOB_TIMEOUT_SECONDS = 60 * 60;
 export const QA_JOB_OVERHEAD_SECONDS = 2 * 60;
 export const QA_JOB_TIMEOUT_SECONDS = QA_MIN_JOB_TIMEOUT_SECONDS;
+/**
+ * A QA run that fails before attestation writes no authority, so the Kernel
+ * would happily rerun the same descriptors forever. After this many identical
+ * failures on the same snapshot (record revision, intent hash, diff hash) the
+ * coordinator refuses to rerun until the snapshot changes.
+ */
+export const QA_MAX_IDENTICAL_FAILURES = 2;
 export const REVIEW_PREPARATION_TIMEOUT_MS = 30_000;
 export const REVIEW_DISPATCH_TIMEOUT_MS = 120_000;
 export const REVIEW_VERDICT_VALIDATION_TIMEOUT_MS = 30_000;
@@ -705,6 +719,8 @@ export class AssuranceCoordinator {
 	private readonly operationControllers = new Map<string, { operationId: string; controller: AbortController }>();
 	private readonly reviewReservations = new Map<string, ReviewReservation>();
 	private readonly rejectedReviewOperations = new Map<string, { operationId: string; reason: string }>();
+	private readonly qaFailureStreaks = new Map<string, { key: string; count: number }>();
+	private readonly qaAttemptKeys = new Map<string, string>();
 	private readonly unknownOperations = new Map<string, { operation: "qa" | "review"; operationId: string; reason: string }>();
 	private readonly sessionInvocations = new Set<InvocationToken>();
 	private sessionActive = true;
@@ -731,6 +747,8 @@ export class AssuranceCoordinator {
 			this.removeEvidence(reservation);
 		}
 		this.reviewReservations.clear();
+		this.qaFailureStreaks.clear();
+		this.qaAttemptKeys.clear();
 		for (const invocation of [...this.sessionInvocations]) this.closeSessionInvocation(invocation);
 	}
 
@@ -762,7 +780,19 @@ export class AssuranceCoordinator {
 
 	async advance(taskId: string, ctx: HostContext, signal?: AbortSignal, onUpdate?: (update: ForegroundToolUpdate) => void): Promise<AssuranceAdvanceResult> {
 		const checks = new Map<string, QaCheckDiagnostic>();
+		const started = performance.now();
+		const stageMs: Record<string, number> = {};
+		let stage = "preparing";
+		let stageStarted = started;
+		const closeStage = (now: number) => { stageMs[stage] = (stageMs[stage] ?? 0) + Math.round(now - stageStarted); };
 		const result = await this.advanceOnce(taskId, ctx, signal, update => {
+			const next = update.details.stage;
+			if (typeof next === "string" && next !== stage) {
+				const now = performance.now();
+				closeStage(now);
+				stage = next;
+				stageStarted = now;
+			}
 			const diagnostic = update.details.diagnostic as QaCheckDiagnostic | undefined;
 			if (diagnostic) {
 				checks.set(diagnostic.descriptor_ref, diagnostic);
@@ -772,8 +802,25 @@ export class AssuranceCoordinator {
 			}
 			onUpdate?.(update);
 		});
+		this.recordQaAttempt(taskId, result);
 		const diagnostics = result.diagnostics ?? [...checks.values()];
-		return this.withRecovery(taskId, ctx, diagnostics.length ? { ...result, diagnostics } : result);
+		const enriched = diagnostics.length ? { ...result, diagnostics } : result;
+		if (!(this.ports.reportTimings ?? process.env.IMM_ASSURANCE_TIMINGS === "1")) return this.withRecovery(taskId, ctx, enriched);
+		const finished = performance.now();
+		closeStage(finished);
+		return this.withRecovery(taskId, ctx, { ...enriched, timings: { total_ms: Math.round(finished - started), stage_ms: stageMs } });
+	}
+
+	private recordQaAttempt(taskId: string, result: AssuranceAdvanceResult): void {
+		const key = this.qaAttemptKeys.get(taskId);
+		this.qaAttemptKeys.delete(taskId);
+		if (!key || result.state === "cancelled") return;
+		if (result.state !== "failed" || result.operation !== "qa") {
+			this.qaFailureStreaks.delete(taskId);
+			return;
+		}
+		const streak = this.qaFailureStreaks.get(taskId);
+		this.qaFailureStreaks.set(taskId, { key, count: streak?.key === key ? streak.count + 1 : 1 });
 	}
 
 	private async withRecovery<T extends AssuranceAdvanceResult | AssuranceSubmitReviewResult>(taskId: string, ctx: HostContext, enriched: T): Promise<T> {
@@ -947,7 +994,13 @@ export class AssuranceCoordinator {
 				// Preparation counts against the same ceiling as the checks, so the
 				// aggregate clock starts before the first prepared group runs. A host
 				// may only tighten the derived budget, never raise it past the ceiling.
-				const declaredQaJobMs = deriveQaJobTimeoutMs(assurance.descriptors.values());
+				const qaKey = `${assurance.snapshot.record_revision}|${assurance.snapshot.intent_content_hash}|${assurance.snapshot.diff_hash}`;
+					const streak = this.qaFailureStreaks.get(taskId);
+					const maxFailures = this.ports.qaMaxIdenticalFailures ?? QA_MAX_IDENTICAL_FAILURES;
+					if (streak?.key === qaKey && streak.count >= maxFailures)
+						return { state: "blocked", reason: `deterministic QA already failed ${streak.count} times on this exact snapshot; change the workspace diff or intent, or restart the session after fixing the environment, before retrying` };
+					this.qaAttemptKeys.set(taskId, qaKey);
+					const declaredQaJobMs = deriveQaJobTimeoutMs(assurance.descriptors.values());
 				const qaJobTimeoutMs = Math.min(declaredQaJobMs, this.ports.qaJobTimeoutMs ?? declaredQaJobMs);
 				const qaJobDeadline = setTimeout(() => {
 					qaJobBudgetExceeded = true;

package/plugins/immune-brain/runtime/assurance/review_evidence.ts

@@ -463,6 +463,10 @@ function publishInput(
 	const recomputed = `sha256:${createHash("sha256").update(JSON.stringify(snapshot)).digest("hex")}`;
 	if (recomputed !== input.expectedDiffHash)
 		throw new Error("review task revision does not match assurance snapshot");
+	// A revision whose tree equals the base carries nothing to review; reserving
+	// Review for it would settle QA outcomes against bytes it does not contain.
+	if (Object.keys(snapshot.changed_paths).length === 0)
+		throw new Error("review revision carries no task change; stage the task's in-scope work before Review");
 	return { snapshot, revision: publishReviewRevision(snapshot.repository_root, snapshot, recomputed, input.taskId) };
 }
 

package/plugins/immune-brain/runtime/claude/interaction.ts

@@ -81,8 +81,7 @@ export interface NativeConfirmationInput {
 		batch_branch: string;
 		children: Array<{ task_id: string; slice_id: string; risk?: string }>;
 		excluded: Array<{ task_id: string; slice_id: string; reason: string }>;
-		budget: { max_children: number; deadline_at: string; qa_failure_limit: number };
-		expires_at: string;
+		budget: { max_children: number; qa_failure_limit: number };
 	};
 	signal?: AbortSignal;
 }

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -44,7 +44,6 @@ import { preparePiCanary, revalidatePiCanary } from "../kernel/pi_canary_prepare
 import { runDeterministicQa } from "../assurance/qa";
 import { taskDiffIdentity, taskRevisionIdentity } from "../workspace_scope";
 import { batchReason } from "../unattended/batch_reasons";
-import { startConfirmationDeadline } from "../unattended/confirmation_deadline";
 import { deriveAuthorizationOperation } from "../authorization_operation";
 import { LITERAL_USER_ACTOR_ID, canonicalActorId } from "../kernel/actor_identity";
 import {
@@ -59,6 +58,7 @@ import {
 	projectBatchPreflight,
 	readActiveClaimTaskId,
 	isOwnBatchClaim,
+	findResumableBatchSlugForTask,
 } from "../unattended/batch_preflight";
 import {
 	startBatch,
@@ -391,7 +391,6 @@ async function mintCapability(
 		diff_hash: input.diff_hash,
 		actor_id: input.actor_id,
 		confirmation_ref: input.confirmation_ref,
-		expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
 		findings_digest: input.action_kind === "request_rework"
 			? findingsDigestV2(input.findings as TaskFinding[])
 			: null,
@@ -587,7 +586,6 @@ export class ClaudeRuntime {
 				preparation_digest: preparation.digest,
 				actor_id: LITERAL_USER_ACTOR_ID,
 				confirmation_ref: gate.confirmation_ref,
-				expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
 				nonce,
 			};
 			const capability = this.enrollmentRegistry.issue(binding);
@@ -611,20 +609,65 @@ export class ClaudeRuntime {
 		}
 	}
 
-	async advance(taskId: string, signal?: AbortSignal) {
-		return this.withTerminalTracker(
+	async advance(taskId: string, signal?: AbortSignal, meta?: ToolMeta) {
+		return this.closeOutBatchChild(
 			taskId,
-			await this.coordinator.advance(taskId, { cwd: this.cwd }, signal),
+			await this.withTerminalTracker(taskId, await this.coordinator.advance(taskId, { cwd: this.cwd }, signal)),
+			meta,
 		);
 	}
 
-	async submitReview(taskId: string, verdictInput: unknown) {
-		return this.withTerminalTracker(
+	async submitReview(taskId: string, verdictInput: unknown, meta?: ToolMeta) {
+		return this.closeOutBatchChild(
 			taskId,
-			await submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput),
+			await this.withTerminalTracker(
+				taskId,
+				await submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput),
+			),
+			meta,
 		);
 	}
 
+	/**
+	 * Gate-free closeout: a batch child that reached Kernel `done` in the
+	 * foreground re-enters the batch in the same call, reusing its authorization.
+	 * Only `done` continues; a stopped child, a parked child and a live Review
+	 * obligation end where they do today. The continuation is transport: the
+	 * Kernel result is returned unchanged, and any failure is reported beside it
+	 * with one retry action, never thrown into a path that could read as "the
+	 * mutation did not happen".
+	 */
+	private async closeOutBatchChild<T>(taskId: string, result: T, meta?: ToolMeta): Promise<T> {
+		if (!meta || result === null || typeof result !== "object") return result;
+		const lifecycle = (result as { record?: { lifecycle?: unknown } }).record?.lifecycle;
+		if ((result as { state?: unknown }).state !== "completed" && lifecycle !== "done") return result;
+		let slug: string | null;
+		try {
+			slug = findResumableBatchSlugForTask(this.cwd, taskId);
+		} catch {
+			return result;
+		}
+		if (!slug) return result;
+		try {
+			// The batch commit takes exactly the scope envelope plus this task's own
+			// audit evidence, and its preflight refuses unstaged changes: stage only
+			// that evidence, the step an Executor otherwise does by hand.
+			if (existsSync(join(this.cwd, ".imm", "audit", taskId)))
+				execFileSync("git", ["-C", this.cwd, "add", "--", `.imm/audit/${taskId}`], { stdio: "ignore" });
+			const batch = await this.startUnattendedBatch(slug, meta, { reuseOnly: true });
+			return { ...(result as object), batch } as T;
+		} catch (error) {
+			return {
+				...(result as object),
+				batch: {
+					state: "rejected",
+					reason: `batch continuation failed: ${error instanceof Error ? error.message : String(error)}`,
+					recovery_action: "call start_unattended_batch with the same Initiative to continue the batch",
+				},
+			} as T;
+		}
+	}
+
 	/**
 	 * Post-settlement GitHub tracker projection: the same shared step the Pi Host
 	 * runs, so an opted-in terminal projection no longer depends on which Host
@@ -987,15 +1030,18 @@ export class ClaudeRuntime {
 	async startUnattendedBatch(
 		initiativeSlug: string,
 		meta: ToolMeta,
+		options: { reuseOnly?: boolean } = {},
 	): Promise<ClaudeBatchStartResult> {
 		throwIfCancelled(meta.signal);
+		const reuseOnly = options.reuseOnly === true;
 		const probe = probeHost(this.env, process.platform, this.hostVersion);
 		if (!probe.ok) throw new NativeAuthorityError("unsupported_host", probe.reason);
+		// A reuse-only continuation never opens a gate, so it needs no confirmation port.
 		const interactive = meta.interactive ?? this.interactive;
-		if (!interactive) throw new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable");
+		if (!reuseOnly && !interactive) throw new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable");
 		// The text is table-owned; only the form (a thrown native error rather than
 		// a returned envelope) is this Host's.
-		if (!this.requestConfirmation)
+		if (!reuseOnly && !this.requestConfirmation)
 			throw new NativeAuthorityError("interaction_not_opened", batchReason("confirmation_port_unavailable").reason);
 
 		// 1. Host-independent batch preflight: claim ownership, branch
@@ -1022,7 +1068,7 @@ export class ClaudeRuntime {
 		const budget = preflight.projection.budget;
 		const planDigest = preflight.projection.plan_digest;
 		const recoveryChildren = preflight.projection.recovery_children;
-		// 5. Literal-user gate plus the shared reuse/expiry decision, the post-gate
+		// 5. Literal-user gate plus the shared reuse decision, the post-gate
 		// claim/drift cascade, and the Batch Authorization binding. The Host supplies
 		// only its gate, its confirmation reference, and its binding nonce.
 		const authorization = await authorizeBatch<ClaudeBatchStartResult>({
@@ -1033,9 +1079,19 @@ export class ClaudeRuntime {
 			readInitiative: this.readInitiative ?? observeGithubInitiative,
 			nonce: enrollmentNonce(),
 			gate: async (facts) => {
-				// review-4: the bounded elicitation deadline is shared behavior now, so
-				// both Hosts bound an unanswered confirmation by the same setting.
-				const deadline = startConfirmationDeadline({ env: this.env, signal: meta.signal });
+				// A continuation after a foreground child never opens a gate: when the
+				// authorization cannot be reused, the user re-enters the batch tool.
+				if (reuseOnly)
+					return {
+						kind: "host_rejection",
+						value: {
+							state: "blocked",
+							reason: `batch authorization cannot be reused (${facts.reuse_blockers.join(", ")})`,
+							recovery_action: "call start_unattended_batch with the same Initiative to confirm a fresh authorization",
+						},
+					};
+				// The gate settles only on the literal user's answer or the caller's
+				// cancellation signal.
 				let confirmationResult: { decision: NativeDecision; requestId: string };
 				try {
 					confirmationResult = await this.requestConfirmation!({
@@ -1057,7 +1113,6 @@ export class ClaudeRuntime {
 								reason: child.reason,
 							})),
 							budget: facts.budget,
-							expires_at: facts.expires_at,
 							...(facts.reuse_blockers.length > 0
 								? {
 										re_confirmation_required: facts.reuse_blockers,
@@ -1065,10 +1120,9 @@ export class ClaudeRuntime {
 									}
 								: {}),
 						},
-						signal: deadline.signal,
+						signal: meta.signal,
 					});
 				} catch (err) {
-					if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
 					if (meta.signal?.aborted)
 						return { kind: "host_rejection", value: batchReason("cancelled_before_execution") };
 					if (err instanceof NativeAuthorityError) {
@@ -1088,13 +1142,8 @@ export class ClaudeRuntime {
 						kind: "host_rejection",
 						value: batchReason("confirmation_failed", err instanceof Error ? err.message : String(err)),
 					};
-				} finally {
-					deadline.clear();
 				}
 
-				// A transport that answers "cancel" on abort is still a timeout, not a user
-				// decision: the Host that owns the transport reports which one it was.
-				if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
 				if (confirmationResult.decision === "cancel" && meta.signal?.aborted)
 					return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
 				if (meta.signal?.aborted)
@@ -1122,14 +1171,12 @@ export class ClaudeRuntime {
 		});
 		if (authorization.outcome === "host_rejection") return authorization.value;
 		if (authorization.outcome === "rejected") return authorization.rejection;
-		const { binding, batch_id: batchId, expires_at: expiresAt } = authorization;
+		const { binding, batch_id: batchId } = authorization;
 
 		// review-1: verify cancellation signal right before authority issuance and startBatch
 		if (meta.signal?.aborted) return batchReason("cancelled_before_execution");
 
 		now = new Date().toISOString();
-		if (Date.parse(expiresAt) <= Date.parse(now))
-			return batchReason("confirmation_failed", "confirmed batch deadline expired before authorization issuance");
 		const capability = this.batchRegistry.issue(binding, recoveryChildren as any, now);
 
 		const basePort = this.createBatchKernelPort(this.batchRegistry, capability, binding);
@@ -1153,7 +1200,6 @@ export class ClaudeRuntime {
 			plan_digest: planDigest,
 			base_head: binding.base_head,
 			confirmation_time: now,
-			authorization_expires_at: expiresAt,
 			budget,
 			now,
 			kernel: kernelPort,

package/plugins/immune-brain/runtime/claude/mcp_server.ts

@@ -160,10 +160,10 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 				signal: meta.signal,
 			};
 			if (name === "enroll") return runtime.enroll(taskId, toolMeta);
-			if (name === "advance_assurance") return runtime.advance(taskId, toolMeta.signal);
+			if (name === "advance_assurance") return runtime.advance(taskId, toolMeta.signal, toolMeta);
 			if (name === "submit_review") {
 				if (!Object.hasOwn(args, "verdict")) throw new Error("verdict is required");
-				return runtime.submitReview(taskId, args.verdict);
+				return runtime.submitReview(taskId, args.verdict, toolMeta);
 			}
 			if (name === "revise_intent") {
 				if (!Object.hasOwn(args, "next_intent")) throw new Error("next_intent is required");
@@ -369,8 +369,7 @@ export function elicitationParams(input: NativeConfirmationInput) {
 			input.planDigest ? `Plan digest: ${input.planDigest}` : null,
 			b?.children ? `Ordered children (${b.children.length}):\n${b.children.map((c) => `  - ${c.task_id} (${c.slice_id}) [risk: ${c.risk ?? "unknown"}]`).join("\n")}` : null,
 			b?.excluded && b.excluded.length > 0 ? `Excluded children (${b.excluded.length}):\n${b.excluded.map((e) => `  - ${e.task_id} (${e.slice_id}): ${e.reason}`).join("\n")}` : null,
-			b?.budget ? `Budget: max_children=${b.budget.max_children}, deadline_at=${b.budget.deadline_at}, qa_failure_limit=${b.budget.qa_failure_limit}` : null,
-			b?.expires_at ? `Expires at: ${b.expires_at}` : null,
+			b?.budget ? `Budget: max_children=${b.budget.max_children}, qa_failure_limit=${b.budget.qa_failure_limit}` : null,
 		].filter(Boolean);
 		return {
 			mode: "form",

package/plugins/immune-brain/runtime/claude/review_host.ts

@@ -169,12 +169,21 @@ export function parseAsyncAgentLaunch(result: string): AsyncAgentLaunch | null {
 	return { agentId, outputFile };
 }
 
+const HANDBACK_TOOL = "SubagentHandback";
+
 /**
  * Extract the reviewer's terminal message from its own transcript.
  *
  * Each record carries the `agentId` that wrote it, so the caller's independently
  * observed id is matched per record rather than trusted for the file as a whole;
  * a transcript that interleaves another agent cannot contribute its text.
+ *
+ * A subagent ends its run either with an assistant text message or, on Hosts
+ * that hand the report back through a tool, with a `SubagentHandback` call whose
+ * `input.message` is that same report and which leaves no text block behind.
+ * Both are the reviewer's own record in its own transcript, so whichever the
+ * observed agent wrote last is its result — across records and across the
+ * ordered content blocks of a single record.
  */
 export function readAgentTranscriptResult(transcript: string, agentId: string): string | null {
 	let last: string | null = null;
@@ -192,6 +201,12 @@ export function readAgentTranscriptResult(transcript: string, agentId: string):
 			if (!block || typeof block !== "object") continue;
 			const part = block as Record<string, unknown>;
 			if (part.type === "text" && typeof part.text === "string") text += part.text;
+			if (part.type === "tool_use" && part.name === HANDBACK_TOOL && part.input && typeof part.input === "object") {
+				const report = (part.input as Record<string, unknown>).message;
+				// Blocks are ordered, so text before the report is a preamble and
+				// only text written after it can supersede it.
+				if (typeof report === "string" && report.trim()) { last = report; text = ""; }
+			}
 		}
 		if (text.trim()) last = text;
 	}