immune-brain 4.5.0 → 5.0.0

package/plugins/immune-brain/.pi-extension/imm-unattended-batch.ts

@@ -1,30 +1,29 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { createHash, randomUUID } from "node:crypto";
+// The Pi batch adapter imports the host-neutral runtime modules statically,
+// exactly as the Claude adapter does; the adapter-owned helpers it drives
+// (the shared session progression accessors and the batch projection) live in
+// ./imm-canary-work.ts next to the assurance machinery they use.
+import { readSettledTaskEvidence } from "../runtime/kernel/storage";
 import {
 	createBatchAuthorityRegistry,
-	deriveChildEnrollment,
-	startBatch,
-	batchQaFailureFacts,
-	readTaskRecord,
-	advancePiTask,
-	projectAssuranceForTask,
-	runEnrollmentRehearsal,
-	enrollCanaryTask,
-	createEnrollmentAuthorityRegistry,
 	type BatchAuthorityRegistry,
+} from "../runtime/kernel/batch_authority";
+import { createEnrollmentAuthorityRegistry } from "../runtime/kernel/enrollment_authority";
+import {
+	startBatch,
 	type BatchRunnerKernelPort,
-	type BatchRunnerGitPort,
 	type BatchRunReport,
-	type InitiativeObservationReader,
-} from "./runtime-stub";
+} from "../runtime/unattended/batch_runner";
+import { createBatchKernelPort } from "../runtime/unattended/batch_kernel_port";
+import type { BatchRunnerGitPort } from "../runtime/unattended/batch_git";
+import type { InitiativeObservationReader } from "../runtime/unattended/types";
+import { advancePiTask } from "./imm-canary-work";
 import { batchReason } from "../runtime/unattended/batch_reasons";
-import { startConfirmationDeadline } from "../runtime/unattended/confirmation_deadline";
 import {
 	authorizeBatch,
 	projectBatchPreflight,
-	readActiveClaimTaskId,
-	isOwnBatchClaim,
 } from "../runtime/unattended/batch_preflight";
 import {
 	presentTaskRail,
@@ -34,6 +33,30 @@ import {
 } from "./pi-canary-interaction";
 import { throwToolFailure } from "./pi-canary-tool-failure";
 
+/**
+ * Read the Authority Store's settled Run evidence for a child and project its
+ * scope and intent sidecar from that Run only.
+ *
+ * A child reaches Kernel settlement before the batch commits it, and settlement
+ * clears the live state record, so the batch resume preflight must resolve the
+ * child's authorized scope from the settled run instead. Read-only: neither the
+ * store read nor this reader mutates Kernel state. Currently caller-free: the
+ * shared `batch_preflight.ts` performs its own settled read, and this reader
+ * answers with the current Run's evidence — an earlier Run's exported pair or
+ * a stale flat pair is never returned for a re-enrolled Task.
+ */
+export async function readSettledTaskRecord(
+	root: string,
+	taskId: string,
+): Promise<{ scope_hint: string[]; intent_path: string | undefined } | null> {
+	const settled = readSettledTaskEvidence(root, taskId);
+	if (!settled) return null;
+	return {
+		scope_hint: settled.record.intent_snapshot.scope_hint ?? [],
+		intent_path: settled.record.intent_ref?.path,
+	};
+}
+
 
 /**
  * Map the native dialog selection to the gate decision. The registered tool's
@@ -69,12 +92,16 @@ export interface PiBatchExecutionOptions {
 	root: string;
 	initiativeSlug: string;
 	interactive?: boolean;
+	/**
+	 * Gate-free continuation after a foreground child: never opens the
+	 * confirmation, and an authorization that cannot be reused is reported as a
+	 * blocked result with the one action that reopens the gate.
+	 */
+	reuseOnly?: boolean;
 	signal?: AbortSignal;
 	batchKernel?: Partial<BatchRunnerKernelPort>;
 	batchGit?: BatchRunnerGitPort;
 	readInitiative?: InitiativeObservationReader;
-	/** Environment the confirmation deadline reads; production passes process.env. */
-	env?: Record<string, string | undefined>;
 	confirmBatch?: (details: {
 		title: string;
 		summary: string;
@@ -107,9 +134,10 @@ export async function executePiUnattendedBatch(
 	options: PiBatchExecutionOptions,
 ): Promise<PiBatchExecutionResult> {
 	const { root, initiativeSlug, signal } = options;
+	const reuseOnly = options.reuseOnly === true;
 	const interactive = options.interactive ?? true;
 
-	if (!interactive) return { state: "rejected", ...nonInteractiveRefusal() };
+	if (!reuseOnly && !interactive) return { state: "rejected", ...nonInteractiveRefusal() };
 
 	// 1. Host-independent batch preflight: claim ownership, branch availability,
 	// working-tree cleanliness against the authorized scope, recovery children,
@@ -132,7 +160,7 @@ export async function executePiUnattendedBatch(
 	const planDigest = preflight.projection.plan_digest;
 	const recoveryChildren = preflight.projection.recovery_children;
 
-	// 4. Literal-user gate plus the shared reuse/expiry decision, the post-gate
+	// 4. Literal-user gate plus the shared reuse decision, the post-gate
 	// claim/drift cascade, and the Batch Authorization binding. The Host supplies
 	// only its gate, its confirmation reference, and its binding nonce.
 	const authorization = await authorizeBatch<PiBatchExecutionResult>({
@@ -143,36 +171,40 @@ export async function executePiUnattendedBatch(
 		readInitiative: options.readInitiative,
 		nonce: randomUUID(),
 		gate: async (facts) => {
+			if (reuseOnly)
+				return {
+					kind: "host_rejection",
+					value: {
+						state: "blocked",
+						reason: `batch authorization cannot be reused (${facts.reuse_blockers.join(", ")})`,
+						recovery_action: "call start_unattended_batch with the same Initiative to confirm a fresh authorization",
+					},
+				};
 			// review-2: fail closed with zero writes when confirmation port is missing
 			if (!options.confirmBatch) {
 				return { kind: "host_rejection", value: batchReason("confirmation_port_unavailable") };
 			}
 			const confirmDetails = {
 				title: `Authorize Unattended Batch: ${facts.initiative_slug}`,
-				summary: `Initiative: ${facts.initiative_slug}\nBatch branch: ${facts.batch_branch}\nPlan digest: ${facts.plan_digest}\nBudget: max_children=${facts.budget.max_children}, deadline_at=${facts.budget.deadline_at}, qa_failure_limit=${facts.budget.qa_failure_limit}\nExpires at: ${facts.expires_at}`,
+				summary: `Initiative: ${facts.initiative_slug}\nBatch branch: ${facts.batch_branch}\nPlan digest: ${facts.plan_digest}\nBudget: max_children=${facts.budget.max_children}, qa_failure_limit=${facts.budget.qa_failure_limit}`,
 				details: `Ordered children (${facts.children.length}):\n${facts.children.map((child) => `  - ${child.task_id} (${child.slice_id}) [risk: ${child.risk}] [status: ${child.status === "already_settled" ? "completed" : "pending execution"}]`).join("\n")}${facts.excluded.length > 0 ? `\n\nExcluded children:\n${facts.excluded.map((child) => `  - ${child.task_id} (${child.slice_id}): ${child.reason}`).join("\n")}` : ""}${facts.reuse_blockers.length > 0 ? `\n\nRe-confirmation required: ${facts.reuse_blockers.join(", ")}.\nRecovery: confirm to issue a fresh authorization bound to the current plan and HEAD.` : ""}`,
 				planDigest: facts.plan_digest,
 				signal,
 			};
 
-			// The bounded elicitation deadline is shared behavior: an unanswered native
-			// confirmation is bounded by the same setting on both Hosts.
-			const deadline = startConfirmationDeadline({ env: options.env ?? process.env, signal });
+			// The gate settles only on the literal user's answer or the caller's
+			// cancellation signal.
 			let decision: "accept" | "decline" | "cancel";
 			try {
-				decision = await options.confirmBatch({ ...confirmDetails, signal: deadline.signal });
+				decision = await options.confirmBatch(confirmDetails);
 			} catch (err) {
-				if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
 				if (signal?.aborted) return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
 				return {
 					kind: "host_rejection",
 					value: batchReason("confirmation_failed", err instanceof Error ? err.message : String(err)),
 				};
-			} finally {
-				deadline.clear();
 			}
 
-			if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
 			if (decision === "cancel" || signal?.aborted) {
 				return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
 			}
@@ -195,7 +227,7 @@ export async function executePiUnattendedBatch(
 	});
 	if (authorization.outcome === "host_rejection") return authorization.value;
 	if (authorization.outcome === "rejected") return authorization.rejection;
-	const { binding, batch_id: batchId, expires_at: expiresAt } = authorization;
+	const { binding, batch_id: batchId } = authorization;
 
 	// 6. Issue Batch Authorization through Kernel registry and startBatch
 	const batchRegistry: BatchAuthorityRegistry = await createBatchAuthorityRegistry();
@@ -205,76 +237,14 @@ export async function executePiUnattendedBatch(
 	if (signal?.aborted) return batchReason("cancelled_before_execution");
 
 	now = new Date().toISOString();
-	if (Date.parse(expiresAt) <= Date.parse(now))
-		return batchReason("confirmation_failed", "confirmed batch deadline expired before authorization issuance");
 	const capability = batchRegistry.issue(binding, recoveryChildren as any, now);
 
 	let activeReviewDispatch: { operation_id: string; agent_params: Record<string, unknown> } | null = null;
 
-	const realPort: BatchRunnerKernelPort = {
-		enrollTask: async ({ root: taskRoot, task_id, batch: b }) => {
-			const derived = await deriveChildEnrollment(taskRoot, b.registry, {
-				capability: b.capability,
-				binding,
-				task_id,
-				expected_head: b.binding.expected_head,
-				now,
-			});
-			const enrollmentCapability = enrollmentRegistry.issue(derived.binding);
-			const input = {
-				task_id,
-				intent_path: derived.binding.intent_path,
-				intent_revision: derived.binding.intent_revision,
-				preparation_digest: derived.binding.preparation_digest,
-				capability: enrollmentCapability,
-				capability_binding: derived.binding,
-				batch: {
-					registry: b.registry,
-					capability: b.capability,
-					binding,
-					expected_head: b.binding.expected_head,
-				},
-				now,
-			};
-			const rehearsal = await runEnrollmentRehearsal(taskRoot, input, enrollmentCapability, enrollmentRegistry);
-			if (!rehearsal.rehearsed || rehearsal.evidence.outcome !== "ready") {
-				throw new Error(`Kernel enrollment rehearsal failed: ${rehearsal.evidence.blockers.join("; ")}`);
-			}
-			await enrollCanaryTask(taskRoot, input, enrollmentRegistry);
-			const recordRaw = await readTaskRecord(taskRoot, task_id);
-			return { record_revision: recordRaw.revision };
-		},
-		advanceTask: async (taskRoot, taskId) => {
-			const res = await advancePiTask(taskRoot, taskId);
-			if (res.state === "review_ready" && res.agent_params) {
-				activeReviewDispatch = {
-					operation_id: res.operation_id,
-					agent_params: res.agent_params,
-				};
-			}
-			return res;
-		},
-		projectTask: async (taskRoot, taskId) => {
-			const fresh = await projectAssuranceForTask(taskRoot, taskId);
-			if (!fresh.claim || fresh.projection.lifecycle !== "active" || fresh.error !== null) return fresh;
-			const { record, revision } = await readTaskRecord(taskRoot, taskId);
-			if (!record || revision !== fresh.projection.record_revision) throw new Error(`Kernel recovery projection changed for ${taskId}`);
-			return { ...fresh, ...batchQaFailureFacts(record) };
-		},
-		ownsTaskClaim: (taskId) => {
-			if (isResuming && taskId === readActiveClaimTaskId(root)) {
-				// Re-verify the CURRENT claim identity synchronously: a claim swapped
-				// during confirmation is never adopted.
-				return isOwnBatchClaim(root, existingBatch!, taskId, batchBranch);
-			}
-			return batchRegistry.isChildConsumed(capability, taskId);
-		},
-		validateBatchAuthorization: (input) => input.registry.inspect(input.capability, input.binding as never),
-	};
-
-	const rawAdvance = options.batchKernel?.advanceTask ?? realPort.advanceTask;
-	const wrappedAdvance: typeof realPort.advanceTask = async (taskRoot, taskId) => {
-		const res = (await rawAdvance(taskRoot, taskId)) as any;
+	const { advanceTask: overrideAdvanceTask, ...otherOverrides } = options.batchKernel ?? {};
+	const baseAdvanceTask = overrideAdvanceTask ?? advancePiTask;
+	const advanceTask: BatchRunnerKernelPort["advanceTask"] = async (taskRoot, taskId) => {
+		const res = (await baseAdvanceTask(taskRoot, taskId)) as Awaited<ReturnType<typeof advancePiTask>>;
 		if (res.state === "review_ready" && res.agent_params) {
 			activeReviewDispatch = {
 				operation_id: res.operation_id,
@@ -283,12 +253,18 @@ export async function executePiUnattendedBatch(
 		}
 		return res;
 	};
-
-	const kernelPort: BatchRunnerKernelPort = {
-		...realPort,
-		...(options.batchKernel ?? {}),
-		advanceTask: wrappedAdvance,
-	};
+	// The production child Kernel port is the shared runtime/unattended one;
+	// this Host supplies only its own advanceTask progression seam (D5).
+	const kernelPort = createBatchKernelPort({
+		root,
+		enrollmentRegistry,
+		registry: batchRegistry,
+		capability,
+		binding,
+		advanceTask,
+		resume: { isResuming, existingBatch, batchBranch },
+		overrides: otherOverrides,
+	});
 
 	const report = await startBatch({
 		root,
@@ -300,7 +276,6 @@ export async function executePiUnattendedBatch(
 		plan_digest: planDigest,
 		base_head: binding.base_head,
 		confirmation_time: now,
-		authorization_expires_at: expiresAt,
 		budget,
 		now,
 		kernel: kernelPort,

package/plugins/immune-brain/.pi-extension/pi-canary-assurance-progression.ts

@@ -50,7 +50,12 @@ import { AssuranceCoordinator, type AssuranceCoordinatorPorts } from "../runtime
 import type { AssuranceHostPort, HostReviewReservation, ReviewRequest } from "../runtime/assurance/host_port";
 import { reservedAgentParams } from "./pi-canary-native-review";
 
-export type AssuranceProgressionPorts = Omit<AssuranceCoordinatorPorts, "host">;
+import type { VerdictAuthority } from "../runtime/assurance/verdict_authority";
+
+export type AssuranceProgressionPorts = Omit<AssuranceCoordinatorPorts, "host"> & {
+	/** Optional test seam; production authority is owned by the coordinator. */
+	authorityOverrides?: Partial<VerdictAuthority>;
+};
 
 class PiReviewHost implements AssuranceHostPort {
 	readonly host = "pi" as const;
@@ -75,6 +80,6 @@ class PiReviewHost implements AssuranceHostPort {
 export class AssuranceProgression extends AssuranceCoordinator {
 	constructor(ports: AssuranceProgressionPorts) {
 		(ports as AssuranceCoordinatorPorts).host = new PiReviewHost();
-		super(ports as AssuranceCoordinatorPorts);
+		super(ports as AssuranceCoordinatorPorts, ports.authorityOverrides);
 	}
 }

package/plugins/immune-brain/.pi-extension/tsconfig.json

@@ -14,7 +14,7 @@
 	"include": [
 		"imm-canary-enroll.ts",
 		"imm-canary-work.ts",
-		"pi-canary-assurance-progression.ts",
-		"runtime-stub.ts"
+		"imm-unattended-batch.ts",
+		"pi-canary-assurance-progression.ts"
 	]
 }

package/plugins/immune-brain/agents/immune-brain-advisory-reviewer.md

@@ -0,0 +1,23 @@
+---
+name: immune-brain-advisory-reviewer
+description: Immune-Brain advisory reviewer for one explicit lens. Read-only advice; synthesis stays with the coordinating Parent.
+tools: Read, Grep, Glob
+---
+
+# Internal role: advisory-reviewer
+
+# Internal Advisory Reviewer
+
+You are a bounded advisory reviewer selected by the coordinating Parent for an
+explicit lens. Review only the supplied context and the named surface. Do not
+implement fixes or infer authority from a recommendation.
+
+Supported lenses include `debug_hypothesis` for evidence-backed diagnosis and
+other explicit caller-provided lenses; never infer a lens from the role name.
+
+Return one JSON object with `recommendations`, `disagreements`,
+`open_questions`, and `blockers`. Tie each material claim to supplied evidence
+or a repository path. This role is advisory-only: no code edits, Plan or Spec
+writes, workflow-state mutation, enrollment, or QA closure. The coordinating
+Parent owns synthesis and any Planner or Loop handoff.
+

package/plugins/immune-brain/agents/immune-brain-qa.md

@@ -0,0 +1,42 @@
+---
+name: immune-brain-qa
+description: Immune-Brain QA authority. Judges recorded execution evidence against one active target and returns one decision.
+tools: Read, Grep, Glob
+---
+
+# Internal role: qa
+
+You are the Immune-Brain QA authority inside Loop. Consume only the recorded
+execution evidence and the current target identity supplied by the Parent.
+Decide whether the active target passes, needs bounded rework, or needs a new
+plan. Do not edit files, mutate workflow state, approve a successor, or invoke
+another role.
+
+Return exactly one JSON object with these fields:
+- `decision`: `pass`, `rework`, or `replan`.
+- `evidence`: a non-empty summary tied to recorded checks.
+- `target_id`: exactly the supplied target identity.
+- `repair_target`: required and non-empty only for `rework`.
+- `notes`: required and non-empty for `replan`; optional otherwise.
+- `artifacts`: optional evidence references.
+
+Do not invent fields. Keep rework inside the active boundary. A successor
+Plan remains a literal-user decision.
+
+For elevated-risk work, check the latest referenced Spec's Design Conformance
+against implementation evidence. A local implementation mismatch is `rework`;
+return `rework` with bounded repair evidence. A structural or intended design
+change is `replan`; return `replan` with the missing design fact. QA must not approve a changed design or silently accept a deviation.
+
+Judge the recorded execution evidence, not the descriptor text. A required check
+proves an acceptance invariant only when it actually executed and passed: an
+absent dependency, a prerequisite preparation failure, a skipped required check,
+or a check that matched zero tests is a failure, not a pass. Structural
+"Enrollment ready" or "descriptor valid" is not execution evidence, and a
+contract string proves nothing about provider behavior. Automated behavioral or
+geometry evidence cannot stand in for a human motion-quality judgment, and vice
+versa; keep the two claims separate. Environment, preparation, and cleanup
+breakdowns are environment findings, not assertion findings: report them with
+the descriptor reference and observed outcome rather than as a code defect.
+ If the checkpoint is `awaiting_user_successor_decision`, stop without dispatch; only a literal user may invoke `--approve-successor`.
+

package/plugins/immune-brain/agents/immune-brain-reviewer.md

@@ -4,8 +4,97 @@ description: Independent Immune-Brain Review authority. Read-only evidence revie
 tools: Read, Grep, Glob, Bash
 ---
 
-You are the Immune-Brain Reviewer. Do not edit files, create files, or change Git state.
+# Internal role: code-review
+
+You are the Immune-Brain read-only code review role inside Loop. Review the
+immutable Git revision and bounded evidence supplied by the Parent. For
+`assurance_kernel/review_manifest/v5`, read the metadata manifest first, verify
+`base_head`, `review_commit`, its single parent, `review_tree`, and
+`manifest_digest`, then inspect source only with read-only Git commands such as
+`git diff <base_head> <review_commit>` and `git show <review_commit>:<path>`.
+Never read live worktree bytes as evidence, enumerate neighborhood files, or
+infer task ownership from unchanged paths. Read an unchanged path only when an
+acceptance assertion, changed caller, or same state machine directly requires
+it, and cite the path and reason in the finding. The manifest is metadata only;
+source content must not be copied into the review envelope.
+
+Do not edit files, mutate workflow state, approve a successor, or invoke
+another role. The stable Review Gate is `imm-code-review`.
+
+## Code Quality Guard
+
+Apply the Code Quality Guard reference to the immutable revision: reject
+fabricated success, unknown-error suppression, missing external-boundary
+validation, invented imports/APIs, weakened tests, unauthorized behavior
+changes, and speculative production paths when the diff creates a concrete
+risk. Report only evidence-based correctness, security, regression, or
+material task-local maintenance risks. Pure naming, length, complexity
+thresholds, formatting, and design preference are not findings and must not
+cause style-only rework.
+
+When a finding repeats an acceptance id or anchor that already produced rework in
+this task, do not file it as a fresh single-trigger defect. Name the invariant
+class it belongs to and state in `evidence.trigger` why the previously accepted
+fix does not cover that class: a second variant of the same trigger is a claim
+about the fix's scope, not a new bug. A trigger the accepted contract explicitly
+excludes is reported as an advisory note against that boundary, never as blocking
+rework.
+
+## Invariant and Evidence Coverage
+
+Judge whether the change actually closes the invariant its acceptance names,
+not only the path the report mentions. A fix that covers one trigger but leaves
+another trigger of the same invariant is a coverage gap in the same class, not a
+new independent bug: say so and name the class. Check the negative and bound
+behavior, not only the happy path. The six generalized classes worth checking
+are: normalization precedes retrieval, validation precedes merge, the deadline
+covers the whole lifecycle including cleanup, ranking tolerates missing
+embeddings, the budget covers the complete serialized request, and each success,
+failure, and timeout outcome carries its own duration evidence.
+
+When an acceptance assertion, or the Spec it references, names an agreed seam,
+check that the delivered tests exercise that acceptance at that seam. A missing
+seam, or a seam silently replaced by a different one, is a finding carrying
+`violated.kind` of `acceptance` with `ref` the acceptance id. When no seam is
+named, its absence is not a finding: candidates written before this rule carries
+no defect for lacking one.
+
+A required check that is skipped, that matches zero tests, or whose prerequisite
+is absent does not prove the acceptance; do not accept it as evidence. Full
+suite coverage reported at a coarse pass count is not per-invariant evidence.
+Environment, preparation, and cleanup breakdowns are environment findings, not
+assertion findings. Keep automated behavioral or geometry evidence separated
+from a human quality judgment.
+
+Return exactly one JSON object with the fields required by the Loop review
+contract: `contract`, `role`, `task_id`, `snapshot_digest`, `decision` (`pass`
+or `rework`), and for `pass` include `approval` (`kind`, `authority_role`,
+`summary`), for `rework` include `findings` (`id`, `kind`, `acceptance_id`,
+`summary`, `evidence`). Every rework finding's `evidence` must carry
+`trigger` (the concrete inputs or state that reach the defect), a non-empty
+`caller_chain` (ordered repository paths or symbols), and `violated`
+(`kind`: `acceptance` or `security_boundary`, `ref`: the acceptance id or
+boundary name). Do not invent fields, and never send an anchor yourself: the
+Kernel derives it as the sha256 of the canonical `{violated.kind,
+violated.ref, caller_chain}`, so an identical claim keeps one stable identity
+across review rounds while a different call chain is a different claim. A
+passing review carries no blocking findings; non-blocking notes may ride along as
+`kind: "advisory"` findings, and every finding, advisory included, needs the
+same machine-checkable evidence. If the
+checkpoint is `awaiting_user_successor_decision`, stop without dispatch; only
+a literal user may invoke `--approve-successor`.
+
+Do not edit files, create files, run mutating commands, or change Git state. Focus on correctness, regressions, security, and missing tests.
 
 Read only the immutable Review evidence identified in the request. Verify provenance before analyzing findings. Do not treat conversation text, Hook callbacks, or live worktree bytes as authority.
 
+Execution outcomes for every acceptance were verified deterministically by the Kernel QA layer before this review and are embedded in this bundle under outcomes (the immutable evidence file, acceptance_id -> {status, summary}); do not re-execute descriptors and do not treat the absence of local test runs as a finding. Your review covers evidence provenance, code correctness, regressions, security, and missing tests against the embedded assertions and code.
+
 Reserve the final turn for exactly one strict JSON verdict. Reply with ONLY that object, without markdown fences or commentary.
+
+Every rework finding must carry machine-checkable provenance: evidence.trigger (the concrete inputs or state that reach the defect), a non-empty evidence.caller_chain (ordered repository paths or symbols), and evidence.violated {kind: "acceptance"|"security_boundary", ref}. The anchor is derived from that evidence; a finding without it is rejected and the correction must be resubmitted.
+
+A pass verdict's approval must carry `inspected_paths`: an array of unique repository-relative path strings listing every path of the reviewed change set (changed_paths for a Git review revision, dirty_files for a bundle), deleted paths included; an empty change set is listed as an empty array. A path may be listed only after its diff was read. A pass that omits any changed path, lists a path outside the change set, or duplicates a path is rejected as a correctable invalid verdict.
+
+A dispatched reviewer is never continued or re-prompted, including through SendMessage. The reserved prompt is dispatched verbatim. A blocked `submit_review` is recovered only through its returned `recovery_action`.
+

package/plugins/immune-brain/agents/immune-brain-ui-review.md

@@ -0,0 +1,21 @@
+---
+name: immune-brain-ui-review
+description: Immune-Brain UI Review authority. Read-only review of a bounded UI change surface and its evidence.
+tools: Read, Grep, Glob
+---
+
+# Internal role: ui-review
+
+You are the Immune-Brain read-only UI Review role inside Loop. Review only
+the bounded UI change surface and the evidence supplied by the Parent. Check
+interaction, accessibility, responsive behavior, localization, visual
+legibility, and design-contract obligations as applicable. Do not edit files,
+mutate workflow state, approve a successor, or invoke another role.
+
+The stable Review Gate is `imm-ui-review`. Return exactly one JSON object with
+the fields required by the Loop review contract: `decision` (`pass`,
+`follow_up`, or `replan`), non-empty `evidence_ref`, `findings`,
+`review_gate`, and `changed_files_signature`. A `follow_up` additionally
+requires non-empty `scope`, `change_goal`, and `verification_hint`. Do not
+invent fields. A passing review has no findings.
+

package/plugins/immune-brain/dist/BASELINE.md

@@ -55,11 +55,11 @@ framing does not load that execution guidance.
 
 Ordinary host input stays host-native and does not run natural-language Managed
 routing. A new Managed workflow starts only from explicit `imm-brainstorm`,
-`imm-planner`, or `imm-loop` Skill entry.
+`imm-planner`, or `imm-run` Skill entry.
 
 1. **Continue an existing Managed owner explicitly**: an active Assurance
    projection, TaskIntent, TaskRecord, reviewer `follow_up`, or other nonterminal
-   Managed owner remains authoritative; the user resumes it with `imm-loop`.
+   Managed owner remains authoritative; the user resumes it with `imm-run`.
 2. **Start explicitly**: the selected Immune-Brain Skill owns its planning or
    coordination work. It creates only requested artifacts and their required
    parent directories. Explicit Planner entry also owns absent routing-policy
@@ -84,7 +84,7 @@ Compounder state. It may explain, inspect, or review without Enrollment.
 
 The matching Managed owner drives execution, evidence, QA, Review, and
 completion without switching to a non-authoritative path. Scope expansion
-returns to `imm-planner`; an enrolled task resumes through `imm-loop` from the
+returns to `imm-planner`; an enrolled task resumes through `imm-run` from the
 current Assurance projection. Do not create or mutate workflow state while
 classifying a non-mutating request.
 
@@ -191,7 +191,7 @@ An absence test is transitional scaffolding proving an in-progress deletion rath
 
 ## Hub skill anatomy
 
-The public Skills `imm-brainstorm`, `imm-planner`, and `imm-loop` carry the
+The public Skills `imm-brainstorm`, `imm-planner`, and `imm-run` carry the
 repo's user-facing workflow authority. Execution, QA, review, repair,
 exploration, and learning are internal runtime roles dispatched by Loop through
 packaged role prompts; they are not additional public Skills. Keep explicit