immune-brain 4.6.0 → 5.0.0

package/plugins/immune-brain/runtime/claude/review_host.ts

@@ -149,9 +149,9 @@ export type AsyncAgentLaunch = { agentId: string; outputFile: string };
 /**
  * Recognise the launch receipt this Claude Code build returns for `Agent`.
  *
- * Every `Agent` call here runs asynchronously — `run_in_background: false` in
- * the dispatch envelope is not honoured, and there is no synchronous mode. The
- * tool result is therefore
+ * Every `Agent` call here runs asynchronously: this Host has no synchronous
+ * mode and no background switch, so the dispatch envelope carries nothing that
+ * would ask for one. The tool result is therefore
  * `{"isAsync":true,"status":"async_launched","agentId":…,"outputFile":…}`:
  * proof that a subagent started, never its answer. Treating it as the verdict
  * would settle Review on a receipt for starting the reviewer, so the launch
@@ -277,6 +277,12 @@ export class FileHookEventLog implements HookEventLog {
 
 interface PendingReview {
 	request: ReviewRequest;
+	/**
+	 * The prompt the Host asked the Parent to dispatch, marker line included.
+	 * Hook evidence carries Parent-authored text, so this is the only string a
+	 * dispatched prompt is ever compared against.
+	 */
+	dispatchPrompt: string;
 	initialCursors: Map<string, number>;
 	sessionCursors: Map<string, number>;
 	startEvent?: Extract<ClaudeHookEvent, { type: "SubagentStart" }>;
@@ -286,18 +292,39 @@ interface PendingReview {
 	error?: string;
 }
 
+/**
+ * The reserved dispatch prompt: the reservation marker line followed by the
+ * per-dispatch snapshot facts, byte for byte.
+ *
+ * One place builds it and one place compares against it, so the marker format
+ * cannot drift from what the binding rule accepts. The static instructions are
+ * deliberately absent: the dispatched reviewer definition carries them, and they
+ * are generated from one source by the plugin build.
+ */
+function reservedDispatchPrompt(
+	request: Pick<ReviewRequest, "operationId" | "taskId" | "snapshotPrompt">,
+): string {
+	return `<!-- immune-brain:operation_id=${request.operationId} task_id=${request.taskId} -->\n${request.snapshotPrompt}`;
+}
+
+/**
+ * Whether hook evidence carrying a prompt belongs to this reservation.
+ *
+ * The prompt is Parent-authored text, so the marker is not an acceptance path:
+ * a dispatch that keeps the matching `operation_id` and `task_id` marker but
+ * appends, truncates or rewrites the body does not bind and cannot settle. Only
+ * the exact reserved dispatch prompt does. Evidence with no prompt at all is
+ * judged by the identifiers the hook itself supplies.
+ */
+function bindsPrompt(prompt: string | undefined, pending: PendingReview): boolean {
+	return prompt === undefined || prompt === pending.dispatchPrompt;
+}
+
 function bindsStart(event: Extract<ClaudeHookEvent, { type: "SubagentStart" }>, pending: PendingReview): boolean {
 	if (event.taskId && event.taskId !== pending.request.taskId) return false;
-	if (event.prompt !== undefined) {
-		const match = /<!-- immune-brain:operation_id=([^\s]+)\s+task_id=([^\s]+)\s+-->/.exec(event.prompt);
-		if (match) {
-			if (match[1] !== pending.request.operationId || match[2] !== pending.request.taskId) return false;
-		} else if (event.prompt !== pending.request.prompt) {
-			return false;
-		}
-	}
+	if (!bindsPrompt(event.prompt, pending)) return false;
 	if (event.operationId) return event.operationId === pending.request.operationId;
-	return event.prompt !== undefined && event.prompt === pending.request.prompt;
+	return event.prompt !== undefined;
 }
 
 export class ClaudeReviewHost implements AssuranceHostPort {
@@ -321,17 +348,19 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 		}
 		this.pending.set(request.operationId, {
 			request,
+			dispatchPrompt: reservedDispatchPrompt(request),
 			initialCursors,
 			sessionCursors,
 			consumed: false,
 		});
 		return {
 			id: request.operationId,
+			// Only parameters the Claude `Agent` tool accepts. The Host has no turn
+			// cap and no background switch, so `request.maxTurns` (which the Pi port
+			// forwards natively) has no receiver here and is not projected.
 			dispatch: {
 				name: CLAUDE_REVIEWER_AGENT,
-				prompt: `<!-- immune-brain:operation_id=${request.operationId} task_id=${request.taskId} -->\n${request.prompt}`,
-				max_turns: request.maxTurns,
-				run_in_background: false,
+				prompt: reservedDispatchPrompt(request),
 			},
 		};
 	}
@@ -434,6 +463,9 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 			if (event.toolName !== AGENT_TOOL) return;
 			if (!event.agentId || !event.operationId || event.operationId !== state.request.operationId) return;
 			if ("taskId" in event && event.taskId && event.taskId !== state.request.taskId) return;
+			// The `Agent` tool input is where this Host actually reports the
+			// dispatched prompt, so it is bound by the same exactness rule.
+			if (!bindsPrompt(event.prompt, state)) return;
 			if (state.startEvent && event.sessionId !== state.startEvent.sessionId) return;
 			if (state.startEvent && event.agentId !== state.startEvent.agentId) return;
 			if (state.stopEvent && event.sessionId !== state.stopEvent.sessionId) return;
@@ -458,7 +490,7 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 			}
 			if (state.stopEvent) {
 				if (state.stopEvent === event) return;
-				state.error = "duplicate SubagentStop observed for review reservation";
+				state.error = "duplicate SubagentStop observed for review reservation: a reviewer was continued after it finished; a reviewer cannot be continued and a fresh reviewer must be dispatched";
 				return;
 			}
 			state.stopEvent = event;

package/plugins/immune-brain/runtime/claude/role_agents.ts

@@ -0,0 +1,83 @@
+import type { InternalRole } from "../role_prompt_bridge";
+
+/**
+ * Claude plugin agent definitions for the read-only internal roles.
+ *
+ * A native definition is the strictest boundary the Host can express for these
+ * roles: `Read, Grep, Glob` grants no write, shell or dispatch tool, while the
+ * Pi mapping leaves the same boundary as prompt text. `INTERNAL_ROLE_PROMPTS`
+ * declares `no tools` or `read-only tools` for every role here; a native
+ * definition cannot express an empty allowlist without inheriting every tool,
+ * so read-only-without-shell is what ships.
+ *
+ * The bodies are generated from the matching `runtime/prompts/` source by
+ * `scripts/build-claude-plugin.ts`, never maintained by hand.
+ */
+export interface ClaudeReadonlyRoleAgent {
+	/** The plugin-qualified agent type the Claude `Agent` tool accepts. */
+	readonly agent: string;
+	/** Repository-relative definition the plugin build generates. */
+	readonly definition: string;
+	/** The role prompt source the definition body is generated from. */
+	readonly prompt: string;
+	/** Frontmatter `description`: when the Host may select this agent. */
+	readonly description: string;
+}
+
+export const CLAUDE_READONLY_ROLE_AGENTS = {
+	qa: {
+		agent: "immune-brain:immune-brain-qa",
+		definition: "plugins/immune-brain/agents/immune-brain-qa.md",
+		prompt: "plugins/immune-brain/runtime/prompts/qa.md",
+		description:
+			"Immune-Brain QA authority. Judges recorded execution evidence against one active target and returns one decision.",
+	},
+	"ui-review": {
+		agent: "immune-brain:immune-brain-ui-review",
+		definition: "plugins/immune-brain/agents/immune-brain-ui-review.md",
+		prompt: "plugins/immune-brain/runtime/prompts/ui-review.md",
+		description:
+			"Immune-Brain UI Review authority. Read-only review of a bounded UI change surface and its evidence.",
+	},
+	"advisory-reviewer": {
+		agent: "immune-brain:immune-brain-advisory-reviewer",
+		definition: "plugins/immune-brain/agents/immune-brain-advisory-reviewer.md",
+		prompt: "plugins/immune-brain/runtime/prompts/advisory-reviewer.md",
+		description:
+			"Immune-Brain advisory reviewer for one explicit lens. Read-only advice; synthesis stays with the coordinating Parent.",
+	},
+} as const satisfies Record<string, ClaudeReadonlyRoleAgent>;
+
+/** The read-only roles that ship a generated native definition. */
+export type ClaudeReadonlyRole = keyof typeof CLAUDE_READONLY_ROLE_AGENTS;
+
+export const CLAUDE_READONLY_ROLES = Object.keys(
+	CLAUDE_READONLY_ROLE_AGENTS,
+) as ClaudeReadonlyRole[];
+
+/** The tool allowlist every generated read-only definition declares. */
+export const CLAUDE_READONLY_TOOLS = ["Read", "Grep", "Glob"] as const;
+
+/**
+ * The read-only internal roles that ship no definition because the Host already
+ * provides the agent. `arch-explorer` is architecture discovery: Claude's own
+ * `Explore` agent is the read-only research agent, and shipping a second
+ * definition would fork a boundary the Host owns.
+ */
+export const CLAUDE_HOST_PROVIDED_ROLE_AGENTS = {
+	"arch-explorer": { agent: "Explore" },
+} as const satisfies Record<string, { agent: string }>;
+
+/**
+ * Roles that are not dispatched as native Claude agents.
+ *
+ * `code-review` ships its own definition with a wider allowlist (it must run
+ * read-only Git commands), so it is not part of this table. The remaining roles
+ * write: `executor`, `test-fixer` and `pr-fix` mutate the workspace, and
+ * `compounder` writes learning storage. A write-capable role stays bounded by
+ * its dispatch envelope and the Parent, not by an agent definition.
+ */
+export const CLAUDE_NATIVE_AGENT_ROLES = new Set<InternalRole>([
+	...CLAUDE_READONLY_ROLES,
+	...(Object.keys(CLAUDE_HOST_PROVIDED_ROLE_AGENTS) as InternalRole[]),
+]);

package/plugins/immune-brain/runtime/commands/kernel.ts

@@ -29,7 +29,7 @@ import {
 import { inspectSpecBinding } from "../kernel/spec_binding";
 import { projectTask, resolveProjectedRisk } from "../kernel/completion";
 import { deriveAssuranceAuthorization } from "../kernel/assurance_projection";
-import { taskDiffIdentity, taskRevisionIdentity } from "../workspace_scope";
+import { taskDeliveryIdentity } from "../workspace_scope";
 import type { TaskIntentV1, TaskRisk } from "../kernel/types";
 import {
 	canonicalDescriptorBytes,
@@ -273,10 +273,7 @@ function runInspect(root: string): KernelExecution {
 		const workspaceState = readWorkspaceStateRaw(root);
 		let identity;
 		try {
-			identity =
-				record.contract === "assurance_kernel/task_record/v4"
-					? taskRevisionIdentity(root, intent.scope_hint, record.git_base_head, intent.task_id)
-					: taskDiffIdentity(root, intent.scope_hint, intent.task_id);
+			identity = taskDeliveryIdentity(root, record);
 		} catch (error) {
 			return sourceFailure("inspect", error);
 		}
@@ -571,7 +568,7 @@ function runIntentAuthor(args: string[], root: string): KernelExecution {
 				"rejected",
 				"kernel_owner_active",
 				null,
-				"Route to imm-loop instead of authoring a new draft.",
+				"Route to imm-run instead of authoring a new draft.",
 			),
 		};
 	if (owner.v3)

package/plugins/immune-brain/runtime/kernel/application.ts

@@ -9,6 +9,7 @@ import {
 	type MutationAuthorityRegistry,
 } from "./authority_port";
 import { asTaskDiffSnapshot } from "./completion";
+import { taskDeliveryIdentity } from "../workspace_scope";
 import { canonicalIntentHash, readTaskIntent } from "./intent";
 import {
 	inspectIntentTokenPair,
@@ -51,8 +52,9 @@ export interface ApplyTaskActionInput {
 	/** Paired mutation authority registry that must recognize every supplied capability. */
 	registry: MutationAuthorityRegistry;
 	capability?: MutationAuthorityCapabilityV2;
-	/** Trusted injected diff provider; the action's diff_hash is only an expectation. */
-	diffProvider: (root: string, record: TaskRecord) => string | { diff_hash: string; changed_paths?: readonly string[] };
+	/** Trusted injected diff provider; the action's diff_hash is only an expectation.
+	 * Defaults to the shared delivery identity selector when omitted. */
+	diffProvider?: (root: string, record: TaskRecord) => string | { diff_hash: string; changed_paths?: readonly string[] };
 	/**
 	 * Terminal commit mode: record + workspace + active-claim removal + task
 	 * tombstone converge through one recoverable terminal transaction marker
@@ -71,7 +73,8 @@ export interface ApplyTaskActionInput {
 export function applyTaskAction(
 	input: ApplyTaskActionInput,
 ): StoredTaskMutationV3 {
-	const { root, task_id, prior_intent_token, registry, capability, diffProvider } = input;
+	const { root, task_id, prior_intent_token, registry, capability } = input;
+	const diffProvider = input.diffProvider ?? taskDeliveryIdentity;
 	return withKernelStoreLock(root, () => {
 		const current = readTaskRecordRaw(root, task_id);
 		if (!current.record)

package/plugins/immune-brain/runtime/kernel/assurance_projection.ts

@@ -2,9 +2,9 @@
 // projection that binds a task's backend claim, TaskRecord v3, workspace,
 // attestations, findings, and completion facts into one closed result.
 //
-// This module is deliberately INTERNAL to the Kernel runtime: it is imported
-// by the Pi extension only through the structural runtime-stub adapter and is
-// never re-exported from ./index.ts. Hosts consume the projection without
+// This module is deliberately INTERNAL to the Kernel runtime: both host
+// adapters import it statically and it is never re-exported from ./index.ts.
+// Hosts consume the projection without
 // reconstructing evidence/approval freshness or authorization readiness.
 //
 // It does not know about Pi session state, pending native Review verdicts,
@@ -13,13 +13,15 @@
 
 import { readBackendClaim, readTaskTombstone } from "./backend_claim";
 import {
-	readTaskRecord,
+	readTaskRecordRaw,
 	readAuditTaskPair,
+	localRunId,
 	readCommittedRecord,
 	readWorkspaceStateRaw,
 	reconcileKernelAuthority,
 } from "./storage";
 import { projectTask, resolveProjectedRisk } from "./completion";
+import { taskDeliveryIdentity } from "../workspace_scope";
 import type { AssuranceObligation, TaskIntentV1, TaskRecord, TaskRecordV3 } from "./types";
 import type { TaskRecordV2 } from "./legacy_task_record";
 
@@ -244,7 +246,9 @@ function projectFromRecord(
 /**
  * One closed read-only projection for a task. The injected diffProvider keeps
  * this module free of git/worktree concerns; hosts supply it from their own
- * task-scope diff implementation.
+ * task-scope diff implementation. When no provider is supplied the shared
+ * delivery identity selector (workspace_scope.taskDeliveryIdentity) computes
+ * it; a supplied provider still overrides it (I5).
  *
  * Error semantics:
  * - no authority facts          -> error null, claim null, empty projection
@@ -257,7 +261,7 @@ function projectFromRecord(
 export async function projectAssurance(
 	root: string,
 	taskId: string,
-	diffProvider: (root: string, record: TaskRecord) => TaskDiffSnapshot,
+	diffProvider: (root: string, record: TaskRecord) => TaskDiffSnapshot = taskDeliveryIdentity,
 ): Promise<AssuranceProjectionResult> {
 	const fail = (
 		error: string,
@@ -303,7 +307,7 @@ export async function projectAssurance(
 		}
 		let read;
 		try {
-			read = await readTaskRecord(root, taskId);
+			read = await readTaskRecordRaw(root, taskId);
 		} catch (error) {
 			if (!terminalOwner || !(error instanceof Error) || !error.message.startsWith("TaskRecord v2")) throw error;
 			return fail(error instanceof Error ? error.message : String(error));
@@ -332,7 +336,10 @@ export async function projectAssurance(
 					},
 				};
 			}
-			const auditPair = await readAuditTaskPair(root, taskId);
+			// Run-aware: with a local run row the store already answered above;
+			// without one (a fresh clone or pre-run-layout evidence) only the
+			// resolved pair may serve, never another run's directory by drift.
+			const auditPair = await readAuditTaskPair(root, taskId, localRunId(root, taskId) ?? undefined);
 			if (!auditPair) return fail(`task ${taskId} has no terminal audit pair`, claim);
 			const workspace = await readWorkspaceStateRaw(root);
 			if (auditPair.record.contract === "assurance_kernel/task_record/v2")

package/plugins/immune-brain/runtime/kernel/canary_application.ts

@@ -14,6 +14,7 @@ import {
 } from "./authority_port";
 import { applyTaskAction } from "./application";
 import { asTaskDiffSnapshot } from "./completion";
+import { taskDeliveryIdentity } from "../workspace_scope";
 import { readTaskIntent } from "./intent";
 import {
 	inspectIntentTokenPair,
@@ -67,8 +68,9 @@ export interface CanaryExecuteInput {
 	task_id: string;
 	operation: CanaryOperation;
 	prior_intent_token: TaskIntentIdentityToken;
-	/** Trusted injected diff provider; the application derives the diff identity. */
-	diffProvider: (root: string, record: TaskRecord) => string | { diff_hash: string; changed_paths?: readonly string[] };
+	/** Trusted injected diff provider; the application derives the diff identity.
+	 * Defaults to the shared delivery identity selector when omitted. */
+	diffProvider?: (root: string, record: TaskRecord) => string | { diff_hash: string; changed_paths?: readonly string[] };
 	now?: string;
 }
 
@@ -313,7 +315,7 @@ export function createCanaryApplication(
 				record: current.record,
 			};
 		});
-		const diffHash = asTaskDiffSnapshot(input.diffProvider(input.root, snapshot.record)).diff_hash;
+		const diffHash = asTaskDiffSnapshot((input.diffProvider ?? taskDeliveryIdentity)(input.root, snapshot.record)).diff_hash;
 		if (operation.op === "stop" && !("capability" in operation))
 			throw new KernelInvariantError(["stop requires user authority capability"]);
 		const hasBoundSpec = boundSpecPath(snapshot.intent_snapshot) !== undefined;

package/plugins/immune-brain/runtime/kernel/enrollment.ts

@@ -1,7 +1,10 @@
-// P2B0 canary enrollment core. NOT exported from kernel/index.ts.
-// Atomically creates TaskRecord v3 + workspace working claim + backend claim
-// for one confirmed canary task. Requires a valid EnrollmentCapability.
-// No CLI, runtime route, or production issuer exists in P2B0.
+// Canary enrollment core. NOT exported from kernel/index.ts.
+// Atomically creates TaskRecord v4 + workspace working claim + backend claim
+// for one confirmed canary task through a valid EnrollmentCapability.
+// Production callers go through the single `enrollTask` entry (D3): it issues
+// the capability, rehearses zero-write, runs the optional caller checkpoint,
+// then commits. `runEnrollmentRehearsal` stays exported as a zero-write
+// precheck for tests and diagnostics only.
 
 import { readRunRowByTask, withKernelRead } from "./sqlite_store";
 import { readTaskIntent } from "./intent";
@@ -21,6 +24,7 @@ import { dirtyScopePaths, writeEnrollmentBaseline } from "../workspace_scope";
 import { enrollmentRequestDigest } from "./run_identity";
 import {
 	commitEnrollmentLocked,
+	enrollmentEventIdFor,
 	readCommittedEnrollmentResult,
 	readTaskRecordRaw,
 	readWorkspaceStateRaw,
@@ -53,6 +57,48 @@ export interface EnrollCanaryInput {
 	now: string;
 }
 
+/**
+ * A rehearsal that is not ready rejects through this single typed error so the
+ * "Kernel enrollment rehearsal failed" message is produced in exactly one place
+ * (deepen-authority-seams D3). Callers that decorate it — the Pi enroll Tool
+ * appends its empty-initial-commit note — read `message` or `blockers`.
+ */
+export class EnrollmentRehearsalError extends Error {
+	readonly blockers: readonly string[];
+	constructor(blockers: readonly string[]) {
+		super(`Kernel enrollment rehearsal failed: ${blockers.join("; ")}`);
+		this.name = "EnrollmentRehearsalError";
+		this.blockers = blockers;
+	}
+}
+
+/**
+ * The one Enrollment entry's request. The entry issues the capability for this
+ * binding itself, so a caller supplies the binding, not a pre-issued capability.
+ */
+export interface EnrollmentEntryRequest {
+	binding: EnrollmentCapabilityBinding;
+	/** Present only for a batch-derived child enrollment. */
+	batch?: EnrollBatchContext;
+	now: string;
+	/**
+	 * Optional caller checkpoint run after a ready rehearsal and before the
+	 * commit. Declining cancels the Enrollment with zero Kernel writes; once the
+	 * commit has started, cancellation has no effect.
+	 */
+	checkpoint?: () => boolean;
+}
+
+/** The same request with a mandatory checkpoint: the entry yields a discriminated outcome. */
+export interface EnrollmentEntryRequestWithCheckpoint extends EnrollmentEntryRequest {
+	checkpoint: () => boolean;
+}
+
+/** The entry's outcome when a checkpoint is supplied: enrolled, or cancelled. */
+export type EnrollmentEntryOutcome =
+	| { outcome: "enrolled"; result: EnrollCanaryResult }
+	| { outcome: "cancelled" };
+
 export interface EnrollCanaryResult {
 	record: TaskRecord;
 	backend_claim: BackendClaim;
@@ -255,7 +301,105 @@ export function runEnrollmentRehearsal(
 }
 
 function enrollmentEventId(taskId: string, now: string): string {
-	return `enroll-${taskId}-${now}`;
+	return enrollmentEventIdFor(taskId, now);
+}
+
+/**
+ * The single Enrollment entry (deepen-authority-seams D3): issues the
+ * capability for the supplied binding, runs the zero-write rehearsal, calls the
+ * optional caller checkpoint, and commits. A rehearsal that is not ready
+ * rejects with its blockers in the one shared message and writes nothing; a
+ * declined checkpoint cancels with zero writes; once commit has started,
+ * cancellation has no effect. Replay of a lost Enrollment keeps today's
+ * behavior because the commit step is the unchanged durable operation.
+ */
+/**
+ * A request that supplies no checkpoint, or one that is `undefined`. Only such
+ * a request is guaranteed to return the plain result: the entry has no caller
+ * window in which it could cancel.
+ */
+export interface EnrollmentEntryRequestWithoutCheckpoint extends EnrollmentEntryRequest {
+	checkpoint?: undefined;
+}
+
+/**
+ * The one Cancellation boundary. Between the readiness decision and the
+ * caller checkpoint the entry yields once, so a cancellation already queued by
+ * the host (a microtask, an already-resolved signal) is observed by the
+ * checkpoint instead of losing the race against the synchronous step that
+ * follows. Zero writes either way.
+ */
+const CANCELLATION_BOUNDARY = Promise.resolve();
+
+export async function enrollTask(
+	root: string,
+	registry: EnrollmentAuthorityRegistry,
+	request: EnrollmentEntryRequestWithCheckpoint,
+): Promise<EnrollmentEntryOutcome>;
+export async function enrollTask(
+	root: string,
+	registry: EnrollmentAuthorityRegistry,
+	request: EnrollmentEntryRequestWithoutCheckpoint,
+): Promise<EnrollCanaryResult>;
+/**
+ * The general interface shape, whose checkpoint is optional: the caller can
+ * still hold it back, so the return has to stay the full union. Without this
+ * overload a value typed `EnrollmentEntryRequest` matches neither of the two
+ * above and the call does not compile, even though the runtime answers it.
+ */
+export async function enrollTask(
+	root: string,
+	registry: EnrollmentAuthorityRegistry,
+	request: EnrollmentEntryRequest,
+): Promise<EnrollCanaryResult | EnrollmentEntryOutcome>;
+export async function enrollTask(
+	root: string,
+	registry: EnrollmentAuthorityRegistry,
+	request: EnrollmentEntryRequest,
+): Promise<EnrollCanaryResult | EnrollmentEntryOutcome> {
+	const { binding, batch, now, checkpoint } = request;
+	// (1) Issue the capability for the supplied binding.
+	const capability = registry.issue(binding);
+	const input: EnrollCanaryInput = {
+		task_id: binding.task_id,
+		intent_path: binding.intent_path,
+		intent_revision: binding.intent_revision,
+		preparation_digest: binding.preparation_digest,
+		capability,
+		capability_binding: binding,
+		...(batch ? { batch } : {}),
+		now,
+	};
+	// Replay of a lost Enrollment: the exact request already committed here, so
+	// the durable operation is the only correct answer. This must precede the
+	// rehearsal, whose precondition checks would otherwise report the now-existing
+	// TaskRecord and workspace owner as blockers and make the durable replay
+	// unreachable. A request committed for a different binding throws, so the
+	// divergent-request refusal is preserved.
+	const { eventId, digest } = digestForEnrollment(input);
+	const committed = readCommittedEnrollmentResult(root, input.task_id, eventId, digest);
+	if (committed) {
+		const result: EnrollCanaryResult = {
+			record: committed.record,
+			backend_claim: committed.claim,
+			workspace: { revision: "", state: committed.workspace },
+		};
+		return checkpoint ? { outcome: "enrolled", result } : result;
+	}
+	// (2) Rehearse: not ready rejects with the blockers and writes nothing.
+	const rehearsal = runEnrollmentRehearsal(root, input, capability, registry);
+	if (!rehearsal.rehearsed || rehearsal.evidence.outcome !== "ready")
+		throw new EnrollmentRehearsalError(rehearsal.evidence.blockers);
+	// The boundary: a cancellation the host queued while the rehearsal ran is
+	// delivered here, before the checkpoint can start the commit.
+	await CANCELLATION_BOUNDARY;
+	// (3) Optional caller checkpoint: declining cancels before any write.
+	if (checkpoint && !checkpoint()) return { outcome: "cancelled" };
+	// (4) Commit; not cancellable from here. Without a caller checkpoint the
+	// entry is the plain durable operation the replay of a lost Enrollment
+	// already handles inside `enrollCanaryTask`.
+	const result = enrollCanaryTask(root, input, registry);
+	return checkpoint ? { outcome: "enrolled", result } : result;
 }
 
 function digestForEnrollment(input: EnrollCanaryInput): {

package/plugins/immune-brain/runtime/kernel/index.ts

@@ -10,7 +10,9 @@ export * from "./completion";
 export {
 	readWorkspaceStateRaw,
 	readTaskRecordRaw,
-	readTaskRecord,
+	readSettledRunEvidence,
+	readSettledTaskEvidence,
+	enrollmentEventIdFor,
 	readSecureProjectFile,
 	commitTaskRecordLocked,
 	withKernelStoreLock,