immune-brain 4.5.0 → 5.0.0

package/plugins/immune-brain/runtime/kernel/enrollment.ts

@@ -1,7 +1,10 @@
-// P2B0 canary enrollment core. NOT exported from kernel/index.ts.
-// Atomically creates TaskRecord v3 + workspace working claim + backend claim
-// for one confirmed canary task. Requires a valid EnrollmentCapability.
-// No CLI, runtime route, or production issuer exists in P2B0.
+// Canary enrollment core. NOT exported from kernel/index.ts.
+// Atomically creates TaskRecord v4 + workspace working claim + backend claim
+// for one confirmed canary task through a valid EnrollmentCapability.
+// Production callers go through the single `enrollTask` entry (D3): it issues
+// the capability, rehearses zero-write, runs the optional caller checkpoint,
+// then commits. `runEnrollmentRehearsal` stays exported as a zero-write
+// precheck for tests and diagnostics only.
 
 import { readRunRowByTask, withKernelRead } from "./sqlite_store";
 import { readTaskIntent } from "./intent";
@@ -15,11 +18,13 @@ import type {
 	BatchAuthorizationBinding,
 } from "./batch_authority";
 import type { BackendClaim } from "./backend_claim";
+import { assertBatchLineageOrigin } from "./batch_authority";
 import { preparePiCanary, readGitHead } from "./pi_canary_prepare";
-import { writeEnrollmentBaseline } from "../workspace_scope";
+import { dirtyScopePaths, writeEnrollmentBaseline } from "../workspace_scope";
 import { enrollmentRequestDigest } from "./run_identity";
 import {
 	commitEnrollmentLocked,
+	enrollmentEventIdFor,
 	readCommittedEnrollmentResult,
 	readTaskRecordRaw,
 	readWorkspaceStateRaw,
@@ -52,6 +57,48 @@ export interface EnrollCanaryInput {
 	now: string;
 }
 
+/**
+ * A rehearsal that is not ready rejects through this single typed error so the
+ * "Kernel enrollment rehearsal failed" message is produced in exactly one place
+ * (deepen-authority-seams D3). Callers that decorate it — the Pi enroll Tool
+ * appends its empty-initial-commit note — read `message` or `blockers`.
+ */
+export class EnrollmentRehearsalError extends Error {
+	readonly blockers: readonly string[];
+	constructor(blockers: readonly string[]) {
+		super(`Kernel enrollment rehearsal failed: ${blockers.join("; ")}`);
+		this.name = "EnrollmentRehearsalError";
+		this.blockers = blockers;
+	}
+}
+
+/**
+ * The one Enrollment entry's request. The entry issues the capability for this
+ * binding itself, so a caller supplies the binding, not a pre-issued capability.
+ */
+export interface EnrollmentEntryRequest {
+	binding: EnrollmentCapabilityBinding;
+	/** Present only for a batch-derived child enrollment. */
+	batch?: EnrollBatchContext;
+	now: string;
+	/**
+	 * Optional caller checkpoint run after a ready rehearsal and before the
+	 * commit. Declining cancels the Enrollment with zero Kernel writes; once the
+	 * commit has started, cancellation has no effect.
+	 */
+	checkpoint?: () => boolean;
+}
+
+/** The same request with a mandatory checkpoint: the entry yields a discriminated outcome. */
+export interface EnrollmentEntryRequestWithCheckpoint extends EnrollmentEntryRequest {
+	checkpoint: () => boolean;
+}
+
+/** The entry's outcome when a checkpoint is supplied: enrolled, or cancelled. */
+export type EnrollmentEntryOutcome =
+	| { outcome: "enrolled"; result: EnrollCanaryResult }
+	| { outcome: "cancelled" };
+
 export interface EnrollCanaryResult {
 	record: TaskRecord;
 	backend_claim: BackendClaim;
@@ -163,6 +210,20 @@ function runEnrollmentPreconditionChecks<T>(
 		} catch (error) {
 			fail(`git base: ${error instanceof Error ? error.message : String(error)}`, error);
 		}
+		// In-scope dirt present now would be recorded in the Enrollment baseline as
+		// user dirt and withheld from every later task snapshot, so the task could
+		// never deliver it. Refuse before the capability is consumed.
+		if (intent && gitBaseHead) {
+			try {
+				const dirty = dirtyScopePaths(root, intent.intent.scope_hint, input.task_id);
+				if (dirty.length > 0) {
+					const message = `task scope is already dirty before Enrollment: ${dirty.join(", ")}; commit, stash or revert these paths first`;
+					fail(message, new Error(message));
+				}
+			} catch (error) {
+				fail(`scope: ${error instanceof Error ? error.message : String(error)}`, error);
+			}
+		}
 
 		const state: EnrollmentPreconditionState = {
 			validated,
@@ -240,7 +301,105 @@ export function runEnrollmentRehearsal(
 }
 
 function enrollmentEventId(taskId: string, now: string): string {
-	return `enroll-${taskId}-${now}`;
+	return enrollmentEventIdFor(taskId, now);
+}
+
+/**
+ * The single Enrollment entry (deepen-authority-seams D3): issues the
+ * capability for the supplied binding, runs the zero-write rehearsal, calls the
+ * optional caller checkpoint, and commits. A rehearsal that is not ready
+ * rejects with its blockers in the one shared message and writes nothing; a
+ * declined checkpoint cancels with zero writes; once commit has started,
+ * cancellation has no effect. Replay of a lost Enrollment keeps today's
+ * behavior because the commit step is the unchanged durable operation.
+ */
+/**
+ * A request that supplies no checkpoint, or one that is `undefined`. Only such
+ * a request is guaranteed to return the plain result: the entry has no caller
+ * window in which it could cancel.
+ */
+export interface EnrollmentEntryRequestWithoutCheckpoint extends EnrollmentEntryRequest {
+	checkpoint?: undefined;
+}
+
+/**
+ * The one Cancellation boundary. Between the readiness decision and the
+ * caller checkpoint the entry yields once, so a cancellation already queued by
+ * the host (a microtask, an already-resolved signal) is observed by the
+ * checkpoint instead of losing the race against the synchronous step that
+ * follows. Zero writes either way.
+ */
+const CANCELLATION_BOUNDARY = Promise.resolve();
+
+export async function enrollTask(
+	root: string,
+	registry: EnrollmentAuthorityRegistry,
+	request: EnrollmentEntryRequestWithCheckpoint,
+): Promise<EnrollmentEntryOutcome>;
+export async function enrollTask(
+	root: string,
+	registry: EnrollmentAuthorityRegistry,
+	request: EnrollmentEntryRequestWithoutCheckpoint,
+): Promise<EnrollCanaryResult>;
+/**
+ * The general interface shape, whose checkpoint is optional: the caller can
+ * still hold it back, so the return has to stay the full union. Without this
+ * overload a value typed `EnrollmentEntryRequest` matches neither of the two
+ * above and the call does not compile, even though the runtime answers it.
+ */
+export async function enrollTask(
+	root: string,
+	registry: EnrollmentAuthorityRegistry,
+	request: EnrollmentEntryRequest,
+): Promise<EnrollCanaryResult | EnrollmentEntryOutcome>;
+export async function enrollTask(
+	root: string,
+	registry: EnrollmentAuthorityRegistry,
+	request: EnrollmentEntryRequest,
+): Promise<EnrollCanaryResult | EnrollmentEntryOutcome> {
+	const { binding, batch, now, checkpoint } = request;
+	// (1) Issue the capability for the supplied binding.
+	const capability = registry.issue(binding);
+	const input: EnrollCanaryInput = {
+		task_id: binding.task_id,
+		intent_path: binding.intent_path,
+		intent_revision: binding.intent_revision,
+		preparation_digest: binding.preparation_digest,
+		capability,
+		capability_binding: binding,
+		...(batch ? { batch } : {}),
+		now,
+	};
+	// Replay of a lost Enrollment: the exact request already committed here, so
+	// the durable operation is the only correct answer. This must precede the
+	// rehearsal, whose precondition checks would otherwise report the now-existing
+	// TaskRecord and workspace owner as blockers and make the durable replay
+	// unreachable. A request committed for a different binding throws, so the
+	// divergent-request refusal is preserved.
+	const { eventId, digest } = digestForEnrollment(input);
+	const committed = readCommittedEnrollmentResult(root, input.task_id, eventId, digest);
+	if (committed) {
+		const result: EnrollCanaryResult = {
+			record: committed.record,
+			backend_claim: committed.claim,
+			workspace: { revision: "", state: committed.workspace },
+		};
+		return checkpoint ? { outcome: "enrolled", result } : result;
+	}
+	// (2) Rehearse: not ready rejects with the blockers and writes nothing.
+	const rehearsal = runEnrollmentRehearsal(root, input, capability, registry);
+	if (!rehearsal.rehearsed || rehearsal.evidence.outcome !== "ready")
+		throw new EnrollmentRehearsalError(rehearsal.evidence.blockers);
+	// The boundary: a cancellation the host queued while the rehearsal ran is
+	// delivered here, before the checkpoint can start the commit.
+	await CANCELLATION_BOUNDARY;
+	// (3) Optional caller checkpoint: declining cancels before any write.
+	if (checkpoint && !checkpoint()) return { outcome: "cancelled" };
+	// (4) Commit; not cancellable from here. Without a caller checkpoint the
+	// entry is the plain durable operation the replay of a lost Enrollment
+	// already handles inside `enrollCanaryTask`.
+	const result = enrollCanaryTask(root, input, registry);
+	return checkpoint ? { outcome: "enrolled", result } : result;
 }
 
 function digestForEnrollment(input: EnrollCanaryInput): {
@@ -332,24 +491,19 @@ export function enrollCanaryTask(
 
 			// A batch-derived enrollment must still stand on the lineage the
 			// literal user confirmed: child N's base is the commit child N-1
-			// produced on the batch branch, and child 1's base is base_head.
+			// produced on the batch branch, and child 1's base is base_head or a
+			// fast-forward of it the runner adopted.
 			// expected_head is caller-supplied, so anchor its origin here rather
 			// than trusting the caller's own assertion: before this batch has
 			// consumed any slot it has created no commit, so the only lineage
-			// value it can hold is the confirmed base_head.
+			// value it can hold descends from the confirmed base_head.
 			if (input.batch) {
 				const batch = input.batch.registry.inspect(
 					input.batch.capability,
 					input.batch.binding,
-					Date.parse(input.now),
 				);
-				if (
-					input.batch.registry.consumedChildren(input.batch.capability).length === 0 &&
-					input.batch.expected_head !== batch.base_head
-				)
-					throw new Error(
-						`batch_head_lineage_broken: the first child must enroll on the confirmed base_head ${batch.base_head}, not ${input.batch.expected_head}`,
-					);
+				if (input.batch.registry.consumedChildren(input.batch.capability).length === 0)
+					assertBatchLineageOrigin(root, batch.base_head, input.batch.expected_head);
 				if (checks.gitBaseHead !== input.batch.expected_head)
 					throw new Error(
 						`batch_head_lineage_broken: expected ${input.batch.expected_head}, found ${checks.gitBaseHead}`,
@@ -364,7 +518,6 @@ export function enrollCanaryTask(
 					input.batch.capability,
 					input.batch.binding,
 					input.task_id,
-					Date.parse(input.now),
 				);
 
 			// Set by beforeLock above, which throws when the repository has no

package/plugins/immune-brain/runtime/kernel/enrollment_authority.ts

@@ -7,7 +7,7 @@ import { createCapabilityRegistry } from "./capability_registry";
 export const ENROLLMENT_CAPABILITY_BRAND = Symbol.for("assurance-kernel.enrollment-capability-brand");
 
 /**
- * The three fields every capability binding shares, whichever authority issues
+ * The two fields every capability binding shares, whichever authority issues
  * it. `nonce` is deliberately not part of this base: the enrollment and batch
  * bindings carry it for their own replay digest, while `CapabilityBindingV2`
  * uses `action_digest` instead and has no `nonce` field at all.
@@ -15,7 +15,6 @@ export const ENROLLMENT_CAPABILITY_BRAND = Symbol.for("assurance-kernel.enrollme
 export interface BaseCapabilityBinding {
 	actor_id: string;
 	confirmation_ref: string;
-	expires_at: string;
 }
 
 export interface EnrollmentCapabilityBinding extends BaseCapabilityBinding {
@@ -36,7 +35,6 @@ export interface ValidatedEnrollment {
 	actor_id: string;
 	confirmation_ref: string;
 	issued_at: string;
-	expires_at: string;
 	nonce: string;
 }
 
@@ -44,8 +42,8 @@ export interface EnrollmentAuthorityRegistry {
 	readonly brand: symbol;
 	/** Issue one capability bound to an exact binding. Library primitive. */
 	issue(binding: EnrollmentCapabilityBinding, issuedAt?: string): object;
-	inspect(capability: object, expected: EnrollmentCapabilityBinding, now?: number): ValidatedEnrollment;
-	consume(capability: object, expected: EnrollmentCapabilityBinding, now?: number): ValidatedEnrollment;
+	inspect(capability: object, expected: EnrollmentCapabilityBinding): ValidatedEnrollment;
+	consume(capability: object, expected: EnrollmentCapabilityBinding): ValidatedEnrollment;
 	isConsumed(capability: object): boolean;
 }
 
@@ -53,18 +51,15 @@ export function createEnrollmentAuthorityRegistry(): EnrollmentAuthorityRegistry
 	return createCapabilityRegistry<EnrollmentCapabilityBinding, EnrollmentCapabilityBinding, ValidatedEnrollment>(
 		ENROLLMENT_CAPABILITY_BRAND,
 		{
-			validateBinding(binding, issuedAt) {
+			validateBinding(binding) {
 				const missing: string[] = [];
 				for (const [key, value] of Object.entries(binding)) {
 					if (value === undefined || value === null || value === "") missing.push(key);
 				}
 				if (missing.length > 0)
 					throw new Error(`enrollment capability binding is incomplete: ${missing.join(", ")}`);
-				if (Number.isNaN(Date.parse(binding.expires_at)) || Date.parse(binding.expires_at) <= Date.parse(issuedAt))
-					throw new Error("enrollment capability must have a future expiry");
 			},
-			validateAndProject(state, expected, now) {
-				if (Date.parse(state.expires_at) <= now) throw new Error("enrollment capability has expired");
+			validateAndProject(state, expected) {
 				for (const key of Object.keys(expected) as Array<keyof EnrollmentCapabilityBinding>) {
 					if (state[key] !== expected[key])
 						throw new Error(`enrollment capability ${key} mismatch`);
@@ -78,7 +73,6 @@ export function createEnrollmentAuthorityRegistry(): EnrollmentAuthorityRegistry
 					actor_id: state.actor_id,
 					confirmation_ref: state.confirmation_ref,
 					issued_at: state.issued_at,
-					expires_at: state.expires_at,
 					nonce: state.nonce,
 				};
 			},

package/plugins/immune-brain/runtime/kernel/index.ts

@@ -10,7 +10,9 @@ export * from "./completion";
 export {
 	readWorkspaceStateRaw,
 	readTaskRecordRaw,
-	readTaskRecord,
+	readSettledRunEvidence,
+	readSettledTaskEvidence,
+	enrollmentEventIdFor,
 	readSecureProjectFile,
 	commitTaskRecordLocked,
 	withKernelStoreLock,

package/plugins/immune-brain/runtime/kernel/storage.ts

@@ -56,7 +56,7 @@ import {
 	stateDatabasePath,
 } from "./storage_paths";
 import { canonicalRecordHash } from "./reducer";
-import { parseTaskRecord } from "./validation";
+import { KernelInvariantError, parseTaskRecord } from "./validation";
 import { parseTaskRecordV2, parseTaskRecordV3, type TaskRecordV2 } from "./legacy_task_record";
 import {
 	assertRunBinding,
@@ -101,6 +101,7 @@ import type {
 	StoredTaskMutationV3,
 	V3AuthorityObservation,
 } from "./types";
+import { TASK_RECORD_CONTRACT_V4 } from "./types";
 
 export {
 	KernelSchemaError,
@@ -898,13 +899,33 @@ export function readWorkspaceStateRaw(root: string): {
 	};
 }
 
-function recordFromRun(run: KernelRunRow): TaskRecord {
-	const record = parseTaskRecord(JSON.parse(run.record_json) as Record<string, unknown>);
+/**
+ * The record a settled run carries, for a run of any historical contract.
+ *
+ * A migrated store preserves the terminal record bytes it was imported with:
+ * a genuine legacy v3 record is settled evidence the same way a live v4 one
+ * is, so the settled read parses both and validates nothing less. A record
+ * satisfying neither parser is unreadable and fails closed.
+ */
+function settledRecordFromRun(run: KernelRunRow): TaskRecord | TaskRecordV3 {
+	let record: TaskRecord | TaskRecordV3;
+	try {
+		record = parseTaskRecord(JSON.parse(run.record_json) as Record<string, unknown>);
+	} catch {
+		record = parseTaskRecordV3(JSON.parse(run.record_json) as Record<string, unknown>);
+	}
 	if (record.task_id !== run.task_id)
 		throw new KernelStoreSecurityError("task record identity is inconsistent with its run");
 	return record;
 }
 
+function recordFromRun(run: KernelRunRow): TaskRecord {
+	const record = settledRecordFromRun(run);
+	if (record.contract !== TASK_RECORD_CONTRACT_V4)
+		throw new KernelInvariantError([`a live run must hold a v4 record, found ${record.contract}`]);
+	return record;
+}
+
 export function readTaskRecordRaw(
 	root: string,
 	taskId: string,
@@ -948,6 +969,93 @@ export function readCommittedRecord(
 	return read ?? null;
 }
 
+/** The one definition of the enrollment Run-id convention: `enroll-<task>-<created_at>`. */
+export function enrollmentEventIdFor(taskId: string, createdAt: string): string {
+	validateTaskId(taskId);
+	return `enroll-${taskId}-${createdAt}`;
+}
+
+/**
+ * The Authority Store's answer to "the settled Run of this Task": this
+ * worktree's run row, its identity-validated record, its proof, whether its
+ * audit pair is exported, and the raw bytes for byte-exact comparison. Run
+ * resolution and proof matching happen behind this read, so a Task with
+ * several Runs never yields another Run's evidence, and an active Task or a
+ * Task with no Run reads as null.
+ */
+export interface SettledRunEvidence {
+	contract: "assurance_kernel/settled_run_evidence/v1";
+	task_id: string;
+	run_id: string;
+	created_at: string;
+	enrollment_event_id: string;
+	lifecycle: "done" | "stopped";
+	/** The settled record, which may be a migrated historical v3. */
+	record: TaskRecord | TaskRecordV3;
+	/** canonicalRecordHash(record): the record's canonical CAS identity. */
+	record_revision: string;
+	/** revisionForContent(record_json): the identity the proof binds. */
+	record_revision_raw: string;
+	/** The store's raw record bytes; equal to the exported audit record. */
+	record_json: string;
+	proof: TaskTombstone;
+	/** The store's raw proof bytes; equal to the exported audit proof. */
+	proof_json: string;
+	audit_exported: boolean;
+}
+
+export function readSettledRunEvidence(root: string, taskId: string): SettledRunEvidence | null {
+	validateTaskId(taskId);
+	const read = withKernelRead(root, (db) => {
+		const run = readRunRowByTask(db, taskId);
+		if (!run || run.state === "active") return null;
+		// A settled run always carries the proof its settlement committed; a
+		// store missing it is corrupt and must never project as a settled task.
+		if (run.terminal_proof_json === null)
+			throw new KernelStoreSecurityError(
+				`task ${taskId} is ${run.state} without a committed terminal proof`,
+			);
+		const record = settledRecordFromRun(run);
+		const record_revision = canonicalRecordHash(record as TaskRecord);
+		// The proof binds the raw committed bytes, not the canonical
+		// re-serialization: a store migrated from the prior runtime keeps
+		// historical record bytes whose serialization need not be canonical.
+		const record_revision_raw = revisionForContent(run.record_json);
+		const proof = parseTaskTombstone(
+			JSON.parse(run.terminal_proof_json) as Record<string, unknown>,
+		);
+		if (proof.task_id !== taskId)
+			throw new KernelStoreSecurityError("settled run proof identity is inconsistent");
+		if (proof.final_record_hash !== record_revision_raw)
+			throw new KernelStoreSecurityError("settled run proof does not match its task record");
+		// Three independent facts of one settlement must agree before the
+		// read answers: the run row's state, the record's own lifecycle, and
+		// the proof's terminal lifecycle. A store that disagrees with itself
+		// is corrupt evidence and must fail closed rather than project a
+		// settled task whose record is still live.
+		if (record.lifecycle !== run.state || proof.terminal_lifecycle !== run.state)
+			throw new KernelStoreSecurityError(
+				`settled run facts disagree: run state ${run.state}, record lifecycle ${record.lifecycle}, proof terminal ${proof.terminal_lifecycle}`,
+			);
+		return {
+			contract: "assurance_kernel/settled_run_evidence/v1" as const,
+			task_id: taskId,
+			run_id: run.run_id,
+			created_at: run.created_at,
+			enrollment_event_id: run.enrollment_event_id,
+			lifecycle: run.state as "done" | "stopped",
+			record,
+			record_revision,
+			record_revision_raw,
+			record_json: run.record_json,
+			proof,
+			proof_json: run.terminal_proof_json,
+			audit_exported: run.audit_exported_at !== null,
+		};
+	});
+	return read ?? null;
+}
+
 /**
  * Read the immutable terminal audit pair for one task:
  * `.imm/audit/<task-id>/task-record.json` plus `terminal-proof.json`.
@@ -1023,13 +1131,6 @@ export function readAuditTaskPair(
 	return { recordRevision, record, proof };
 }
 
-export function readTaskRecord(
-	root: string,
-	taskId: string,
-): { revision: string; record: TaskRecord | null } {
-	return readTaskRecordRaw(root, taskId);
-}
-
 // ---------------------------------------------------------------------------
 // Audit export: deterministic, idempotent, retryable, never authority.
 // ---------------------------------------------------------------------------
@@ -1073,6 +1174,60 @@ function convergePendingRelocations(root: string, db: DatabaseSync): void {
 	}
 }
 
+/** Settled task evidence: the terminal record and proof of a task's own run. */
+export interface SettledTaskEvidence {
+	/** The run that owns this evidence; `null` for the legacy flat layout. */
+	runId: string | null;
+	record: TaskRecordV2 | TaskRecordV3 | TaskRecord;
+	recordRevision: string;
+	proof: TaskTombstone;
+}
+
+/**
+ * The settled evidence of a task, read run-aware.
+ *
+ * One read decides which of three worlds this worktree is in, because a
+ * decision made from two reads can be stale between them:
+ *
+ * - **absent** (no Kernel store, or no row for the task): a pre-store terminal
+ *   or a repository fixture, whose single flat audit pair is this worktree's
+ *   evidence. This is the only world where the flat layout is read at all.
+ * - **active**: the task's run is in flight, so it has no settled evidence; an
+ *   exported or fetched pair of the same task is another run's and never
+ *   answers while this worktree's own run is live.
+ * - **terminal**: the task's own terminal run, read run-scoped; until its
+ *   export exists the evidence is unreadable (fail closed), never another run's.
+ *
+ * A settlement committed between two reads cannot turn the terminal world into
+ * the absent one, because the world is decided before any pair is resolved.
+ */
+export function readSettledTaskEvidence(root: string, taskId: string): SettledTaskEvidence | null {
+	validateTaskId(taskId);
+	const localRun = withKernelRead(root, (db) => readRunRowByTask(db, taskId));
+	if (!localRun) {
+		const legacy = readAuditTaskPair(root, taskId);
+		if (!legacy) return null;
+		return {
+			runId: null,
+			record: legacy.record as SettledTaskEvidence["record"],
+			recordRevision: legacy.recordRevision,
+			proof: legacy.proof,
+		};
+	}
+	if (localRun.state === "active") return null;
+	const settled = readSettledRunEvidence(root, taskId);
+	if (!settled) return null;
+	return {
+		runId: settled.run_id,
+		record: settled.record,
+		// The pair identity is the raw committed bytes the proof binds; the
+		// canonical revision stays available on the run evidence for callers
+		// that need the TaskRecord's canonical CAS identity.
+		recordRevision: settled.record_revision_raw,
+		proof: settled.proof,
+	};
+}
+
 // ---------------------------------------------------------------------------
 // Journal.
 // ---------------------------------------------------------------------------
@@ -1755,7 +1910,11 @@ export function reconcileKernelAuthority(
 	const legacy = projected ? null : retiredFileStoreDiagnostic(root, null, taskId);
 	if (legacy) return conflictProjection(taskId, legacy);
 	try {
-		const audit = readAuditTaskPair(root, taskId);
+		// Run-aware: when this worktree's store carries the task's run, only that
+		// run's own evidence may classify the task; the resolved/flat fallback
+		// below serves only pre-run-layout evidence of a task with no local run.
+		const localRun = localRunId(root, taskId);
+		const audit = readAuditTaskPair(root, taskId, localRun ?? undefined);
 		if (audit)
 			return {
 				contract: "assurance_kernel/authority_projection/v1",

package/plugins/immune-brain/runtime/kernel/storage_paths.ts

@@ -212,6 +212,19 @@ export function auditTerminalProofPath(taskId: string): string {
 	return `${auditTaskDirPath(taskId)}/terminal-proof.json`;
 }
 
+/** Unattended batch run state: `.imm/state/batches/<batch-id>.json`. */
+export function batchStatePath(batchId: string): string {
+	if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(batchId))
+		throw new Error(`invalid batch identity: ${batchId}`);
+	return `${BATCH_STATE_RELATIVE}/${batchId}.json`;
+}
+
+/** Durable batch child commit evidence: `.imm/state/batches/commits/<batch-id>-<task-id>.json`. */
+export function batchCommitEvidencePath(batchId: string, taskId: string): string {
+	validateTaskId(taskId);
+	return `${BATCH_STATE_RELATIVE}/commits/${batchId}-${taskId}.json`;
+}
+
 /** Historical v3 machine evidence root under the tracked audit store. */
 export function legacyV3Path(...segments: string[]): string {
 	for (const segment of segments)

package/plugins/immune-brain/runtime/kernel/types.ts

@@ -265,7 +265,8 @@ export interface AuthorityAuditDescriptor {
 	actor_id: string;
 	confirmation_ref: string;
 	issued_at: string;
-	expires_at: string;
+	/** Read-only: history written before authority lost its clock still carries it. Never written. */
+	expires_at?: string;
 }
 
 export interface TaskActionBase {

package/plugins/immune-brain/runtime/kernel/validation.ts

@@ -287,7 +287,9 @@ function parseHistoryV3(
 			actor_id: stringAt(auth.actor_id, `${path}.authority.actor_id`, violations),
 			confirmation_ref: stringAt(auth.confirmation_ref, `${path}.authority.confirmation_ref`, violations),
 			issued_at: stringAt(auth.issued_at, `${path}.authority.issued_at`, violations),
-			expires_at: stringAt(auth.expires_at, `${path}.authority.expires_at`, violations),
+			...(auth.expires_at !== undefined
+				? { expires_at: stringAt(auth.expires_at, `${path}.authority.expires_at`, violations) }
+				: {}),
 		};
 	}
 	return {