immune-brain 4.5.0 → 4.6.0

package/plugins/immune-brain/runtime/unattended/batch_preflight.ts

@@ -23,7 +23,7 @@ import { readTaskIntent } from "../kernel/intent";
 import { localRunId, readAuditTaskPair, readTaskRecordRaw, readWorkspaceStateRaw, reconcileKernelAuthority } from "../kernel/storage";
 import { pathMatchesScope } from "../workspace_scope";
 import { captureBatchReconfirmation, retainReconfirmation, ownUnpersistedBatchHead, type ReconfirmationSnapshot } from "./batch_reconfirmation";
-import { DEFAULT_DEADLINE_MS, projectBatchPlan } from "./batch_plan";
+import { projectBatchPlan } from "./batch_plan";
 import { batchReason, type BatchReasonKey } from "./batch_reasons";
 import { isTerminalBatchState, readBatchRunState, type BatchRunStateRecord } from "./batch_state";
 import { readRunRowByTask, withKernelRead } from "../kernel/sqlite_store";
@@ -98,6 +98,29 @@ export function readActiveClaimTaskId(root: string): string | null {
 	return workspace.state.current_working || (claim?.lifecycle_status === "active" ? claim.task_id : null);
 }
 
+/**
+ * The initiative whose resumable batch holds `taskId` as an in-flight child, or
+ * null. Read-only; a Host uses it to re-enter the batch after a foreground
+ * child settles, and anything unreadable simply means there is nothing to continue.
+ */
+export function findResumableBatchSlugForTask(root: string, taskId: string): string | null {
+	const batchesDir = join(root, ".imm", "state", "batches");
+	if (!existsSync(batchesDir)) return null;
+	for (const file of readdirSync(batchesDir)) {
+		if (!file.endsWith(".json")) continue;
+		try {
+			const record = JSON.parse(readFileSync(join(batchesDir, file), "utf8")) as BatchRunStateRecord;
+			if (record?.contract !== "assurance_kernel/batch_run_state/v1") continue;
+			if (record.batch_state !== "running" && record.batch_state !== "needs_human") continue;
+			if (record.children.some((child) => child.task_id === taskId && (child.state === "enrolled" || child.state === "settled")))
+				return record.initiative_slug;
+		} catch {
+			continue;
+		}
+	}
+	return null;
+}
+
 /**
  * The batch record for this initiative, or a corruption marker. A terminal
  * record (completed, budget_stopped, failed, rejected) is not active: returning
@@ -182,10 +205,78 @@ export function findSettledBatchRecord(root: string, initiativeSlug: string): Ba
 	return newest;
 }
 
+export type BatchLineage =
+	| { kind: "equal"; head: string }
+	| { kind: "fast_forward"; head: string }
+	| { kind: "broken"; message: string };
+
+/**
+ * Classify live HEAD against the batch's recorded head. `fast_forward` is HEAD
+ * on the same batch branch with the recorded head as an ancestor and every
+ * recorded child commit still reachable: the user's own commit, adopted rather
+ * than refused. Anything else is the fatal `batch_head_lineage_broken`.
+ */
+export function classifyBatchLineage(input: {
+	root: string;
+	branch: string;
+	expectedHead: string;
+	childCommits: readonly string[];
+	/** When set, a fast-forward carrying this batch's own trailer is refused. */
+	batchId?: string;
+}): BatchLineage {
+	const { root, branch, expectedHead, childCommits } = input;
+	const run = (args: string[]) =>
+		spawnSync("git", ["-C", root, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+	const broken = (reason: string): BatchLineage => ({
+		kind: "broken",
+		message: `batch_head_lineage_broken: ${reason}`,
+	});
+	const branchResult = run(["symbolic-ref", "--short", "HEAD"]);
+	const currentBranch = branchResult.stdout.trim();
+	if (branchResult.status !== 0 || currentBranch !== branch)
+		return broken(`current branch ${currentBranch} does not match expected branch ${branch}`);
+	const headResult = run(["rev-parse", "HEAD"]);
+	const head = headResult.stdout.trim();
+	if (headResult.status !== 0 || !head) return broken("current HEAD is unreadable");
+	if (head !== expectedHead && run(["merge-base", "--is-ancestor", expectedHead, head]).status !== 0)
+		return broken(`current HEAD ${head} does not descend from expected batch head ${expectedHead}`);
+	for (const commit of childCommits) {
+		if (run(["merge-base", "--is-ancestor", commit, head]).status !== 0)
+			return broken(`recorded commit ${commit} is no longer reachable from HEAD`);
+	}
+	if (head === expectedHead) return { kind: "equal", head };
+	// Only the runner writes this batch's trailer, and every commit it recorded
+	// is already in childCommits: a fast-forward claiming it is an impersonation
+	// (or an unverified own commit), never the user's own work.
+	if (input.batchId) {
+		const claimed = run([
+			"log",
+			"--fixed-strings",
+			`--grep=Immune-Brain-Batch: ${input.batchId}`,
+			"--format=%H",
+			`${expectedHead}..${head}`,
+		]);
+		const claimant = claimed.stdout.split(/\s+/).find(Boolean);
+		if (claimed.status !== 0 || claimant)
+			return broken(`commit ${claimant ?? head} claims batch ${input.batchId} without recorded evidence`);
+	}
+	return { kind: "fast_forward", head };
+}
+
 /** The HEAD a resumable batch must still sit on: its last child commit, or its base. */
-export function expectedBatchHead(record: { base_head: string; commits?: unknown }): string {
+export function expectedBatchHead(record: {
+	base_head: string;
+	commits?: unknown;
+	adopted_heads?: ReadonlyArray<{ from: string; to: string }>;
+}): string {
 	const commits = Array.isArray(record.commits) ? (record.commits as string[]) : [];
-	return commits.length > 0 ? commits[commits.length - 1]! : record.base_head;
+	let head = commits.length > 0 ? commits[commits.length - 1]! : record.base_head;
+	// An adoption is keyed by the head it moved from, so one recorded before the
+	// last child commit can never resurface as the expected head.
+	for (const adoption of record.adopted_heads ?? []) {
+		if (adoption.from === head) head = adoption.to;
+	}
+	return head;
 }
 
 /**
@@ -234,9 +325,9 @@ export function isOwnBatchClaim(
 		return false;
 	}
 	if (!rec) return false;
-	const lineageHeads = [existingBatch.base_head].concat(
-		Array.isArray(existingBatch.commits) ? existingBatch.commits : [],
-	);
+	const lineageHeads = [existingBatch.base_head]
+		.concat(Array.isArray(existingBatch.commits) ? existingBatch.commits : [])
+		.concat((existingBatch.adopted_heads ?? []).map((adoption) => adoption.to));
 	if (!lineageHeads.includes(rec.git_base_head)) return false;
 	if (claim.enrollment_event_id !== `enroll-${taskId}-${claim.created_at}`) return false;
 	const createdAt = Date.parse(claim.created_at);
@@ -347,11 +438,11 @@ async function projectPlanSurface(input: {
 	let budget: BatchPlanBudget;
 
 	if (isResuming && existingBatch) {
-		// Candidate only: renewal uses the same default window as a fresh plan,
-		// while preserving the confirmed count limits and the persisted record.
-		budget = { ...existingBatch.budget };
-		if (Date.parse(budget.deadline_at) <= Date.parse(now))
-			budget.deadline_at = new Date(Date.parse(now) + DEFAULT_DEADLINE_MS).toISOString();
+		// A resume keeps the confirmed count limits of the persisted record.
+		budget = {
+			max_children: existingBatch.budget.max_children,
+			qa_failure_limit: existingBatch.budget.qa_failure_limit,
+		};
 		try {
 			recoveryChildren = existingBatch.children.map((c) => {
 				const intentPath = `docs/plans/${c.task_id}.intent.json`;
@@ -635,7 +726,6 @@ export interface BatchConfirmationFacts {
 	batch_branch: string;
 	plan_digest: string;
 	budget: BatchPlanBudget;
-	expires_at: string;
 	reuse_blockers: string[];
 	children: Array<{ task_id: string; slice_id: string; risk: string; status: BatchPlanChildStatus }>;
 	excluded: Array<{ task_id: string; slice_id: string; reason: string }>;
@@ -656,7 +746,6 @@ export type BatchAuthorizationOutcome<HostRejection> =
 			batch_id: string;
 			reuse_authorization: boolean;
 			reuse_blockers: string[];
-			expires_at: string;
 			binding: BatchAuthorizationBinding;
 	  }
 	| { outcome: "rejected"; rejection: BatchPreflightRejection }
@@ -678,7 +767,7 @@ export interface BatchAuthorizationOptions<HostRejection> {
 
 /**
  * The one authorization flow both Host adapters call after the shared
- * preflight: ADR-0005's reuse/expiry decision, the literal-user gate, the
+ * preflight: ADR-0005's reuse decision, the literal-user gate, the
  * post-gate claim/drift cascade, and the BatchAuthorizationBinding. A Host
  * supplies its gate, its confirmation reference, and its nonce; every decision
  * below stays Host-independent.
@@ -696,10 +785,6 @@ export async function authorizeBatch<HostRejection>(
 	} = projection;
 	const existingBatch = projection.existing_batch;
 
-	// ADR-0005 Decision 1: one Batch Authorization spans the work it authorizes,
-	// so its expiry is the deadline the literal user confirmed rather than a fixed
-	// window that lapses while a child is parked on a foreground Review.
-	const isExistingExpired = isResuming && Date.parse(existingBatch!.authorization_expires_at) <= Date.now();
 	const branchBefore = spawnSync("git", ["-C", root, "branch", "--show-current"], { encoding: "utf8" });
 	if (branchBefore.status !== 0)
 		return { outcome: "rejected", rejection: batchRejection("repository_became_unreadable") };
@@ -709,20 +794,29 @@ export async function authorizeBatch<HostRejection>(
 	// binds falls through to the gate below, which names the reason.
 	const ownsUnpersistedHead = isResuming && existingBatch !== null && existingBatch.plan_digest === planDigest &&
 		expectedBatchHead(existingBatch) !== baseHead && ownUnpersistedBatchHead(root, existingBatch, baseHead);
+	// A fast-forward on the batch branch is the user's own work: the runner adopts
+	// it, so it neither blocks reuse nor counts as moved provenance.
+	const fastForwardsRecordedHead = isResuming && existingBatch !== null && existingBatch.branch === batchBranch &&
+		expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead &&
+		classifyBatchLineage({
+			root,
+			branch: batchBranch,
+			expectedHead: expectedBatchHead(existingBatch),
+			childCommits: existingBatch.commits,
+			batchId: existingBatch.batch_id,
+		}).kind === "fast_forward";
 	if (isResuming && existingBatch && !existingBatch.commits.length && existingBatch.children[0]?.state === "settled" &&
-		expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead)
+		expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead && !fastForwardsRecordedHead)
 		return { outcome: "rejected", rejection: batchRejection("head_moved", "first unpersisted commit provenance is invalid") };
 	const reuseBlockers: string[] = [];
 	if (isResuming && existingBatch) {
-		if (isExistingExpired) reuseBlockers.push("batch_authorization_expired");
-		if (Date.parse(existingBatch.budget.deadline_at) <= Date.now()) reuseBlockers.push("batch_budget_expired");
 		if (existingBatch.batch_state !== "running") reuseBlockers.push("batch_not_running");
 		if (existingBatch.plan_digest !== planDigest) reuseBlockers.push("batch_plan_digest_changed");
 		if (existingBatch.branch !== batchBranch) reuseBlockers.push("batch_branch_changed");
-		if (expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead) reuseBlockers.push("batch_head_lineage_moved");
+		if (expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead && !fastForwardsRecordedHead)
+				reuseBlockers.push("batch_head_lineage_moved");
 	}
 	const reuseAuthorization = isResuming && reuseBlockers.length === 0;
-	const expiresAt = reuseAuthorization ? existingBatch!.authorization_expires_at : budget.deadline_at;
 
 	const batchId = isResuming && existingBatch ? existingBatch.batch_id : `batch-${initiativeSlug}-${randomUUID()}`;
 	const facts: BatchConfirmationFacts = {
@@ -730,7 +824,6 @@ export async function authorizeBatch<HostRejection>(
 		batch_branch: batchBranch,
 		plan_digest: planDigest,
 		budget,
-		expires_at: expiresAt,
 		reuse_blockers: reuseBlockers,
 		children: projection.recovery_children.map((child) => ({
 			task_id: child.task_id,
@@ -777,8 +870,8 @@ export async function authorizeBatch<HostRejection>(
 	if (finalClaimTaskId && !finalOwnClaim)
 		return { outcome: "rejected", rejection: batchRejection("claim_appeared_during_confirmation", finalClaimTaskId) };
 
-	// Confirmation cannot adopt a changed record or extend its displayed window
-	// after the user answers. Re-read the clock and branch after the async checks.
+	// Confirmation cannot adopt a changed record after the user answers. Re-read
+	// the record and branch after the async checks.
 	if (isResuming) {
 		const current = findExistingActiveBatch(root, initiativeSlug);
 		if (!current || current.corrupt || JSON.stringify(current.record) !== JSON.stringify(existingBatch))
@@ -787,8 +880,6 @@ export async function authorizeBatch<HostRejection>(
 	const branchAfter = spawnSync("git", ["-C", root, "branch", "--show-current"], { encoding: "utf8" });
 	if (branchAfter.status !== 0 || branchAfter.stdout !== branchBefore.stdout)
 		return { outcome: "rejected", rejection: batchRejection("confirmation_failed", "Git branch moved after native confirmation") };
-	if (Date.parse(expiresAt) <= Date.now())
-		return { outcome: "rejected", rejection: batchRejection("confirmation_failed", "confirmed batch deadline expired before authorization issuance") };
 
 	if (projection.reconfirmation) {
 		try { projection.reconfirmation.assertUnchanged(); }
@@ -803,16 +894,14 @@ export async function authorizeBatch<HostRejection>(
 		budget,
 		actor_id: LITERAL_USER_ACTOR_ID,
 		confirmation_ref: options.confirmationRef({ batch_id: batchId, request_id: requestId }),
-		expires_at: expiresAt,
 		nonce: options.nonce,
 	};
-	if (projection.reconfirmation) retainReconfirmation(binding.nonce, binding.expires_at, projection.reconfirmation);
+	if (projection.reconfirmation) retainReconfirmation(binding.nonce, projection.reconfirmation);
 	return {
 		outcome: "authorized",
 		batch_id: batchId,
 		reuse_authorization: reuseAuthorization,
 		reuse_blockers: reuseBlockers,
-		expires_at: expiresAt,
 		binding,
 	};
 }

package/plugins/immune-brain/runtime/unattended/batch_reasons.ts

@@ -24,7 +24,6 @@ export type BatchReasonKey =
 	| "empty_enrollable_set"
 	| "plan_projection_failed"
 	| "confirmation_port_unavailable"
-	| "confirmation_timed_out"
 	| "confirmation_cancelled"
 	| "confirmation_declined"
 	| "confirmation_no_decision"
@@ -115,11 +114,6 @@ export const BATCH_REASONS: Readonly<Record<BatchReasonKey, BatchReasonSpec>> =
 		reason: "native confirmation port is unavailable",
 		recovery_action: "retry through a fresh native gate in the current Host",
 	},
-	confirmation_timed_out: {
-		state: "rejected",
-		reason: "native confirmation timed out waiting for user interaction",
-		recovery_action: "retry through a fresh native gate in the current Host",
-	},
 	confirmation_cancelled: {
 		state: "cancelled",
 		reason: "native interaction cancelled",

package/plugins/immune-brain/runtime/unattended/batch_reconfirmation.ts

@@ -67,17 +67,16 @@ export interface ReconfirmationSnapshot {
 }
 
 // Ephemeral captured observations, not authority: the runner independently
-// validates the native capability. Entries expire and are discarded on application.
-const confirmations = new Map<string, { snapshot: ReconfirmationSnapshot; expires: number }>();
-export function retainReconfirmation(nonce: string, expires: string, snapshot: ReconfirmationSnapshot): void {
-	for (const [key, value] of confirmations) if (value.expires <= Date.now()) confirmations.delete(key);
+// validates the native capability. Entries are discarded on application.
+const confirmations = new Map<string, ReconfirmationSnapshot>();
+export function retainReconfirmation(nonce: string, snapshot: ReconfirmationSnapshot): void {
 	if (confirmations.has(nonce)) refuse();
-	confirmations.set(nonce, { snapshot, expires: Date.parse(expires) });
+	confirmations.set(nonce, snapshot);
 }
 export function takeReconfirmation(nonce: string): ReconfirmationSnapshot {
 	const found = confirmations.get(nonce); confirmations.delete(nonce);
-	if (!found || found.expires <= Date.now()) refuse();
-	return found.snapshot;
+	if (!found) refuse();
+	return found;
 }
 
 export async function captureBatchReconfirmation(root: string, record: BatchRunStateRecord, children: BatchPlanChild[]): Promise<ReconfirmationSnapshot> {