immune-brain 4.6.0 → 5.1.0

package/plugins/immune-brain/runtime/unattended/batch_plan.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { stableStringify } from "../canonical_json";
-import { observeGithubInitiative, type GithubInitiativeObservation } from "../github_issue_tracker";
+import { observeGithubInitiative } from "../github_issue_tracker";
+import { hasLocalInitiative, observeLocalInitiative } from "../local_initiative";
 import { readTaskTombstone } from "../kernel/backend_claim";
 import {
 	observeTaskIntent,
@@ -8,12 +9,14 @@ import {
 } from "../kernel/intent";
 import { readTaskRecordRaw } from "../kernel/storage";
 import { inspectSpecBinding, type SpecBindingInspection } from "../kernel/spec_binding";
+import { projectParallelGroups } from "./batch_schedule";
 import type {
 	BatchPlan,
 	BatchPlanBudget,
 	BatchPlanChild,
 	BatchPlanChildReason,
 	BatchPlanDigestChild,
+	InitiativeObservation,
 	InitiativeObservationReader,
 	ProjectBatchPlanInput,
 } from "./types";
@@ -57,12 +60,22 @@ function timestamp(value: unknown, name: string): { milliseconds: number; iso: s
 	return { milliseconds, iso: new Date(milliseconds).toISOString() };
 }
 
-function normalizeObservation(value: GithubInitiativeObservation, initiativeSlug: string): GithubInitiativeObservation {
-	if (!value || value.contract !== "immune_brain/github_initiative_observation/v1")
+/**
+ * The Initiative's carrier decides the reader: a Local carrier file owns its
+ * slug and is read with no GitHub operation; every other slug is a GitHub one.
+ */
+export const observeInitiative: InitiativeObservationReader = async (root, initiativeSlug) =>
+	hasLocalInitiative(root, initiativeSlug)
+		? observeLocalInitiative(root, initiativeSlug)
+		: observeGithubInitiative(root, initiativeSlug);
+
+function normalizeObservation(value: InitiativeObservation, initiativeSlug: string): InitiativeObservation {
+	const local = value?.contract === "immune_brain/local_initiative_observation/v1";
+	if (!value || (!local && value.contract !== "immune_brain/github_initiative_observation/v1"))
 		throw new Error("tracker returned an invalid Initiative observation contract");
 	if (value.initiative_id !== initiativeSlug)
 		throw new Error("tracker returned an observation for another Initiative");
-	if (!Number.isSafeInteger(value.issue_number) || value.issue_number <= 0)
+	if (!local && (!Number.isSafeInteger(value.issue_number) || value.issue_number <= 0))
 		throw new Error("tracker returned an invalid Initiative Issue number");
 	if (!Array.isArray(value.tasks)) throw new Error("tracker returned an invalid Initiative Task list");
 	const taskIds = new Set<string>();
@@ -71,7 +84,8 @@ function normalizeObservation(value: GithubInitiativeObservation, initiativeSlug
 		if (!task || typeof task !== "object") throw new Error(`tracker Task ${index} is invalid`);
 		if (!ID_PATTERN.test(task.task_id)) throw new Error(`tracker Task ${index} has an invalid task_id`);
 		if (!ID_PATTERN.test(task.slice_id)) throw new Error(`tracker Task ${index} has an invalid slice_id`);
-		if (!Number.isSafeInteger(task.issue_number) || task.issue_number <= 0)
+		const issueNumber = (task as { issue_number?: number }).issue_number;
+		if (!local && (!Number.isSafeInteger(issueNumber) || issueNumber! <= 0))
 			throw new Error(`tracker Task ${task.task_id} has an invalid Issue number`);
 		if (!Array.isArray(task.blocked_by) || task.blocked_by.some((id) => typeof id !== "string" || !ID_PATTERN.test(id)))
 			throw new Error(`tracker Task ${task.task_id} has invalid blocked_by dependencies`);
@@ -88,13 +102,15 @@ function normalizeObservation(value: GithubInitiativeObservation, initiativeSlug
 		const unknown = task.blocked_by.find((id) => !taskIds.has(id));
 		if (unknown) throw new Error(`tracker Task ${task.task_id} depends on unknown Task ${unknown}`);
 	}
-	return { ...value, tasks: tasks.sort((left, right) => compareIds(left.task_id, right.task_id)) };
+	return { ...value, tasks: tasks.sort((left, right) => compareIds(left.task_id, right.task_id)) } as InitiativeObservation;
 }
 
-function dependencyOrder(observation: GithubInitiativeObservation): GithubInitiativeObservation["tasks"] {
-	const remaining = new Map(observation.tasks.map((task) => [task.task_id, task]));
+type ObservedTask = { task_id: string; slice_id: string; blocked_by: string[] };
+
+function dependencyOrder(observation: InitiativeObservation): ObservedTask[] {
+	const remaining = new Map<string, ObservedTask>(observation.tasks.map((task) => [task.task_id, task]));
 	const done = new Set<string>();
-	const order: GithubInitiativeObservation["tasks"] = [];
+	const order: ObservedTask[] = [];
 	while (remaining.size) {
 		const ready = [...remaining.values()]
 			.filter((task) => task.blocked_by.every((id) => done.has(id)))
@@ -109,7 +125,7 @@ function dependencyOrder(observation: GithubInitiativeObservation): GithubInitia
 	return order;
 }
 
-function dependencyClosures(order: GithubInitiativeObservation["tasks"]): Map<string, string[]> {
+function dependencyClosures(order: ObservedTask[]): Map<string, string[]> {
 	const closures = new Map<string, string[]>();
 	for (const task of order) {
 		const closure = new Set<string>();
@@ -138,7 +154,7 @@ export async function projectBatchPlan(
 	root: string,
 	initiativeSlug: string,
 	input: ProjectBatchPlanInput,
-	readInitiative: InitiativeObservationReader = observeGithubInitiative,
+	readInitiative: InitiativeObservationReader = observeInitiative,
 ): Promise<BatchPlan> {
 	if (!ID_PATTERN.test(initiativeSlug)) throw new Error("initiative_slug is invalid");
 	if (!input || typeof input !== "object") throw new Error("batch plan input is required");
@@ -147,6 +163,7 @@ export async function projectBatchPlan(
 	const order = dependencyOrder(trackerObservation);
 	const closures = dependencyClosures(order);
 	const children: BatchPlanChild[] = [];
+	const scopeHints = new Map<string, string[]>();
 	for (const task of order) {
 		const blockedBy = closures.get(task.task_id)!;
 		const child = { task_id: task.task_id, slice_id: task.slice_id, blocked_by: blockedBy };
@@ -187,6 +204,7 @@ export async function projectBatchPlan(
 				});
 				continue;
 			}
+			scopeHints.set(task.task_id, [...read.intent.scope_hint]);
 			children.push({
 				...child,
 				status: "enrollable",
@@ -233,5 +251,12 @@ export async function projectBatchPlan(
 		enrollable,
 		plan_digest: planDigest,
 		budget: budget(input, enrollable.length),
+		...projectParallelGroups(
+			enrollable.map((child) => ({
+				task_id: child.task_id,
+				blocked_by: child.blocked_by,
+				scope_hint: scopeHints.get(child.task_id)!,
+			})),
+		),
 	};
 }

package/plugins/immune-brain/runtime/unattended/batch_preflight.ts

@@ -20,13 +20,13 @@ import { readBackendClaim } from "../kernel/backend_claim";
 import { computeBatchPlanDigest, type BatchAuthorizationBinding } from "../kernel/batch_authority";
 import { readGitHead } from "../kernel/pi_canary_prepare";
 import { readTaskIntent } from "../kernel/intent";
-import { localRunId, readAuditTaskPair, readTaskRecordRaw, readWorkspaceStateRaw, reconcileKernelAuthority } from "../kernel/storage";
+import { readTaskRecordRaw, readSettledTaskEvidence, readWorkspaceStateRaw, enrollmentEventIdFor, reconcileKernelAuthority } from "../kernel/storage";
+import type { TaskRecord } from "../kernel/types";
 import { pathMatchesScope } from "../workspace_scope";
 import { captureBatchReconfirmation, retainReconfirmation, ownUnpersistedBatchHead, type ReconfirmationSnapshot } from "./batch_reconfirmation";
 import { projectBatchPlan } from "./batch_plan";
 import { batchReason, type BatchReasonKey } from "./batch_reasons";
-import { isTerminalBatchState, readBatchRunState, type BatchRunStateRecord } from "./batch_state";
-import { readRunRowByTask, withKernelRead } from "../kernel/sqlite_store";
+import { isLaneBatchRecord, isTerminalBatchState, readAnyBatchRunState, type AnyBatchRunStateRecord, type BatchRunStateRecord } from "./batch_state";
 import type {
 	BatchPlanBudget,
 	BatchPlanChild,
@@ -50,7 +50,7 @@ export interface BatchPreflightProjection {
 	initiative_slug: string;
 	batch_branch: string;
 	is_resuming: boolean;
-	existing_batch: BatchRunStateRecord | null;
+	existing_batch: AnyBatchRunStateRecord | null;
 	base_head: string;
 	budget: BatchPlanBudget;
 	plan_digest: string;
@@ -59,6 +59,9 @@ export interface BatchPreflightProjection {
 	risk_by_task: Record<string, string>;
 	/** Children the plan excluded, in plan order. Empty on a resume. */
 	excluded: Array<{ task_id: string; slice_id: string; reason: string }>;
+	/** Start waves and serialized-by-scope children; empty on a resume. */
+	parallel_groups: string[][];
+	scope_conflicts: Array<{ task_id: string; overlaps_with: string[] }>;
 }
 
 export type BatchPreflightOutcome =
@@ -109,8 +112,8 @@ export function findResumableBatchSlugForTask(root: string, taskId: string): str
 	for (const file of readdirSync(batchesDir)) {
 		if (!file.endsWith(".json")) continue;
 		try {
-			const record = JSON.parse(readFileSync(join(batchesDir, file), "utf8")) as BatchRunStateRecord;
-			if (record?.contract !== "assurance_kernel/batch_run_state/v1") continue;
+			const record = JSON.parse(readFileSync(join(batchesDir, file), "utf8")) as AnyBatchRunStateRecord;
+			if (record?.contract !== "assurance_kernel/batch_run_state/v1" && record?.contract !== "assurance_kernel/batch_run_state/v2") continue;
 			if (record.batch_state !== "running" && record.batch_state !== "needs_human") continue;
 			if (record.children.some((child) => child.task_id === taskId && (child.state === "enrolled" || child.state === "settled")))
 				return record.initiative_slug;
@@ -128,7 +131,7 @@ export function findResumableBatchSlugForTask(root: string, taskId: string): str
  */
 export type BatchRecordLookup =
 	| { corrupt: true; path: string }
-	| { corrupt: false; record: BatchRunStateRecord }
+	| { corrupt: false; record: AnyBatchRunStateRecord }
 	| null;
 
 export function findExistingActiveBatch(root: string, initiativeSlug: string): BatchRecordLookup {
@@ -144,8 +147,8 @@ export function findExistingActiveBatch(root: string, initiativeSlug: string): B
 			// initiative as batchless could authorize a parallel run.
 			return { corrupt: true, path: file };
 		}
-		const candidate = record as BatchRunStateRecord;
-		if (candidate?.contract !== "assurance_kernel/batch_run_state/v1") continue;
+		const candidate = record as AnyBatchRunStateRecord;
+		if (candidate?.contract !== "assurance_kernel/batch_run_state/v1" && candidate?.contract !== "assurance_kernel/batch_run_state/v2") continue;
 		if (candidate.initiative_slug !== initiativeSlug) continue;
 		const validStates = new Set([
 			"prepared",
@@ -166,7 +169,7 @@ export function findExistingActiveBatch(root: string, initiativeSlug: string): B
 		}
 		if (isTerminalBatchState(candidate.batch_state)) continue;
 		try {
-			const record = readBatchRunState(root, file.slice(0, -5));
+			const record = readAnyBatchRunState(root, file.slice(0, -5));
 			if (record) return { corrupt: false, record };
 		} catch {
 			// Reuse the state owner's full validation before offering a renewal.
@@ -181,10 +184,10 @@ export function findExistingActiveBatch(root: string, initiativeSlug: string): B
  * not a batch to resume. Its branch and commit lineage may be reused by a new,
  * explicitly confirmed run, while its record and terminal report stay intact.
  */
-export function findSettledBatchRecord(root: string, initiativeSlug: string): BatchRunStateRecord | null {
+export function findSettledBatchRecord(root: string, initiativeSlug: string): AnyBatchRunStateRecord | null {
 	const batchesDir = join(root, ".imm", "state", "batches");
 	if (!existsSync(batchesDir)) return null;
-	let newest: BatchRunStateRecord | null = null;
+	let newest: AnyBatchRunStateRecord | null = null;
 	for (const file of readdirSync(batchesDir).sort()) {
 		if (!file.endsWith(".json")) continue;
 		let record: unknown;
@@ -194,8 +197,8 @@ export function findSettledBatchRecord(root: string, initiativeSlug: string): Ba
 			// The active lookup already fails closed on an unreadable record.
 			continue;
 		}
-		const candidate = record as BatchRunStateRecord;
-		if (candidate?.contract !== "assurance_kernel/batch_run_state/v1") continue;
+		const candidate = record as AnyBatchRunStateRecord;
+		if (candidate?.contract !== "assurance_kernel/batch_run_state/v1" && candidate?.contract !== "assurance_kernel/batch_run_state/v2") continue;
 		if (candidate.initiative_slug !== initiativeSlug) continue;
 		if (!isTerminalBatchState(candidate.batch_state)) continue;
 		if (typeof candidate.batch_id !== "string" || typeof candidate.base_head !== "string") continue;
@@ -294,7 +297,7 @@ export function expectedBatchHead(record: {
  */
 export function isOwnBatchClaim(
 	root: string,
-	existingBatch: BatchRunStateRecord,
+	existingBatch: AnyBatchRunStateRecord,
 	taskId: string,
 	batchBranch: string,
 ): boolean {
@@ -317,10 +320,11 @@ export function isOwnBatchClaim(
 	if (!childInBatch || !(childInBatch.state === "enrolled" || childInBatch.state === "needs_human")) {
 		return false;
 	}
-	let rec: Record<string, any> | null = null;
+	let rec: TaskRecord | null = null;
 	try {
-		const run = withKernelRead(root, (db) => readRunRowByTask(db, taskId));
-		rec = run ? (JSON.parse(run.record_json) as Record<string, any>) : null;
+		// Through the store read: the record is identity-validated against its
+		// run instead of being parsed from a raw row.
+		rec = readTaskRecordRaw(root, taskId).record;
 	} catch {
 		return false;
 	}
@@ -329,7 +333,7 @@ export function isOwnBatchClaim(
 		.concat(Array.isArray(existingBatch.commits) ? existingBatch.commits : [])
 		.concat((existingBatch.adopted_heads ?? []).map((adoption) => adoption.to));
 	if (!lineageHeads.includes(rec.git_base_head)) return false;
-	if (claim.enrollment_event_id !== `enroll-${taskId}-${claim.created_at}`) return false;
+	if (claim.enrollment_event_id !== enrollmentEventIdFor(taskId, claim.created_at)) return false;
 	const createdAt = Date.parse(claim.created_at);
 	if (!Number.isFinite(createdAt) || createdAt > Date.parse(existingBatch.updated_at)) return false;
 	if (claim.task_id !== taskId || claim.lifecycle_status !== "active") return false;
@@ -355,16 +359,13 @@ function authorizedScopeOf(root: string, taskId: string, state: string): string[
 		// fallback below
 	}
 	if (scope.length === 0 && state === "settled") {
-		// A settled child has no live state record; its authority is the immutable
-		// terminal audit pair. Read-only, so a refusal still writes nothing.
+		// A settled child has no live state record; the Authority Store's settled
+		// Run read is its authority. Read-only, so a refusal still writes nothing.
 		try {
-			const localRun = localRunId(root, taskId);
-			const settled = readAuditTaskPair(root, taskId, localRun ?? undefined);
-			const snapshot = (settled?.record as { intent_snapshot?: { scope_hint?: string[] } } | null | undefined)
-				?.intent_snapshot;
+			const settled = readSettledTaskEvidence(root, taskId);
+			const snapshot = settled?.record.intent_snapshot;
 			scope = snapshot?.scope_hint ?? [];
-			recordedIntentPath = recordedIntentPath ?? (settled?.record as { intent_ref?: { path?: string } } | null | undefined)
-				?.intent_ref?.path;
+			recordedIntentPath = recordedIntentPath ?? settled?.record.intent_ref?.path;
 		} catch {
 			// fallback below
 		}
@@ -409,6 +410,8 @@ interface PlanSurface {
 	recovery_children: BatchPlanChild[];
 	risk_by_task: Record<string, string>;
 	excluded: Array<{ task_id: string; slice_id: string; reason: string }>;
+	parallel_groups: string[][];
+	scope_conflicts: Array<{ task_id: string; overlaps_with: string[] }>;
 }
 
 type PlanSurfaceOutcome =
@@ -424,7 +427,7 @@ async function projectPlanSurface(input: {
 	root: string;
 	initiative_slug: string;
 	is_resuming: boolean;
-	existing_batch: BatchRunStateRecord | null;
+	existing_batch: AnyBatchRunStateRecord | null;
 	now: string;
 	readInitiative?: InitiativeObservationReader;
 }): Promise<PlanSurfaceOutcome> {
@@ -432,6 +435,8 @@ async function projectPlanSurface(input: {
 	let recoveryChildren: BatchPlanChild[] = [];
 	let planDigest: string;
 	let excluded: Array<{ task_id: string; slice_id: string; reason: string }> = [];
+	let parallelGroups: string[][] = [];
+	let scopeConflicts: Array<{ task_id: string; overlaps_with: string[] }> = [];
 	const riskByTask = new Map<string, string>();
 	// Only an active run supplies children and budget; a terminal record supplies
 	// branch provenance, never the plan or authorization of the next run.
@@ -471,7 +476,8 @@ async function projectPlanSurface(input: {
 				// Keep the risk captured by the authoritative read above; a stale
 				// reconstructed path must never fabricate a risk later.
 				riskByTask.set(c.task_id, read.intent?.risk ?? "material");
-				const isDone = c.state === "committed" || c.state === "settled";
+				// A lane child integrated or released is already on the batch branch.
+				const isDone = ["committed", "settled", "integrated", "released"].includes(c.state);
 				return {
 					task_id: c.task_id,
 					slice_id: c.slice_id,
@@ -510,6 +516,8 @@ async function projectPlanSurface(input: {
 			return { ok: false, key: "empty_enrollable_set", detail: "" };
 
 		budget = plan.budget;
+		parallelGroups = plan.parallel_groups;
+		scopeConflicts = plan.scope_conflicts;
 		const enrollableChildById = new Map(plan.enrollable.map((c) => [c.task_id, c]));
 		recoveryChildren = plan.children
 			.filter((c) => c.status === "enrollable")
@@ -546,6 +554,8 @@ async function projectPlanSurface(input: {
 				[...riskByTask.entries()].sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
 			),
 			excluded,
+			parallel_groups: parallelGroups,
+			scope_conflicts: scopeConflicts,
 		},
 	};
 }
@@ -562,8 +572,8 @@ export async function projectBatchPreflight(
 	if (found?.corrupt)
 		return reject("batch_state_unreadable", found.path);
 	// Settled records retain branch provenance; only active records are resumed.
-	const activeRecord: BatchRunStateRecord | null = found ? found.record : null;
-	const existingBatch: BatchRunStateRecord | null = activeRecord ?? findSettledBatchRecord(root, initiativeSlug);
+	const activeRecord: AnyBatchRunStateRecord | null = found ? found.record : null;
+	const existingBatch: AnyBatchRunStateRecord | null = activeRecord ?? findSettledBatchRecord(root, initiativeSlug);
 	const isResuming = activeRecord !== null;
 	const batchBranch = `imm/${initiativeSlug}`;
 
@@ -647,7 +657,7 @@ export async function projectBatchPreflight(
 	if (!planSurface.ok)
 		return reject(planSurface.key, planSurface.detail);
 	let reconfirmation: ReconfirmationSnapshot | undefined;
-	if (activeRecord && activeRecord.plan_digest !== planSurface.surface.plan_digest) {
+	if (activeRecord && !isLaneBatchRecord(activeRecord) && activeRecord.plan_digest !== planSurface.surface.plan_digest) {
 		try { reconfirmation = await captureBatchReconfirmation(root, activeRecord, planSurface.surface.recovery_children); }
 		catch { return reject("plan_projection_failed", "batch plan reconfirmation is not eligible"); }
 	}
@@ -663,6 +673,8 @@ export async function projectBatchPreflight(
 		recovery_children: planSurface.surface.recovery_children,
 		risk_by_task: planSurface.surface.risk_by_task,
 		excluded: planSurface.surface.excluded,
+		parallel_groups: planSurface.surface.parallel_groups,
+		scope_conflicts: planSurface.surface.scope_conflicts,
 	};
 	if (reconfirmation) Object.defineProperty(projection, "reconfirmation", { value: reconfirmation });
 	return { ok: true, projection };
@@ -685,8 +697,8 @@ export interface BatchDriftProjection {
 export async function projectBatchDrift(options: BatchPreflightOptions): Promise<BatchDriftProjection> {
 	const { root, initiative_slug: initiativeSlug, readInitiative } = options;
 	const found = findExistingActiveBatch(root, initiativeSlug);
-	const activeRecord: BatchRunStateRecord | null = found && !found.corrupt ? found.record : null;
-	const existingBatch: BatchRunStateRecord | null = activeRecord ?? findSettledBatchRecord(root, initiativeSlug);
+	const activeRecord: AnyBatchRunStateRecord | null = found && !found.corrupt ? found.record : null;
+	const existingBatch: AnyBatchRunStateRecord | null = activeRecord ?? findSettledBatchRecord(root, initiativeSlug);
 	const isResuming = activeRecord !== null;
 	const batchBranch = `imm/${initiativeSlug}`;
 	const activeClaimTaskId = readActiveClaimTaskId(root);
@@ -729,6 +741,9 @@ export interface BatchConfirmationFacts {
 	reuse_blockers: string[];
 	children: Array<{ task_id: string; slice_id: string; risk: string; status: BatchPlanChildStatus }>;
 	excluded: Array<{ task_id: string; slice_id: string; reason: string }>;
+	/** Start waves and the children that serialize because their scopes overlap. */
+	parallel_groups: string[][];
+	scope_conflicts: Array<{ task_id: string; overlaps_with: string[] }>;
 }
 
 /**
@@ -792,7 +807,7 @@ export async function authorizeBatch<HostRejection>(
 	// ADR-0005 Decision 1: a resume of an intact, still-binding authorization
 	// reuses it instead of opening a second native gate. Anything that no longer
 	// binds falls through to the gate below, which names the reason.
-	const ownsUnpersistedHead = isResuming && existingBatch !== null && existingBatch.plan_digest === planDigest &&
+	const ownsUnpersistedHead = isResuming && existingBatch !== null && !isLaneBatchRecord(existingBatch) && existingBatch.plan_digest === planDigest &&
 		expectedBatchHead(existingBatch) !== baseHead && ownUnpersistedBatchHead(root, existingBatch, baseHead);
 	// A fast-forward on the batch branch is the user's own work: the runner adopts
 	// it, so it neither blocks reuse nor counts as moved provenance.
@@ -832,6 +847,8 @@ export async function authorizeBatch<HostRejection>(
 			status: child.status,
 		})),
 		excluded: projection.excluded,
+		parallel_groups: projection.parallel_groups,
+		scope_conflicts: projection.scope_conflicts,
 	};
 
 	let requestId: string | null = null;
@@ -858,7 +875,7 @@ export async function authorizeBatch<HostRejection>(
 	if (drift.plan_digest !== planDigest)
 		return { outcome: "rejected", rejection: batchRejection("plan_changed", drift.plan_digest) };
 	if (drift.base_head === null) return { outcome: "rejected", rejection: batchRejection("repository_became_unreadable") };
-	if (drift.base_head !== baseHead || (ownsUnpersistedHead && !ownUnpersistedBatchHead(root, existingBatch!, baseHead)))
+	if (drift.base_head !== baseHead || (ownsUnpersistedHead && !ownUnpersistedBatchHead(root, existingBatch as BatchRunStateRecord, baseHead)))
 		return { outcome: "rejected", rejection: batchRejection("head_moved", drift.base_head) };
 
 	// The drift projection's own claim read happened before its plan read; this

package/plugins/immune-brain/runtime/unattended/batch_reconfirmation.ts

@@ -3,9 +3,9 @@ import { spawnSync } from "node:child_process";
 import { computeBatchPlanDigest, type BatchPlanChild as DigestChild } from "../kernel/batch_authority";
 import { canonicalIntentHash, parseTaskIntentV1, readTaskIntent } from "../kernel/intent";
 import { projectAssurance } from "../kernel/assurance_projection";
-import { localRunId, readAuditTaskPair, readSecureProjectBytes, readWorkspaceStateRaw } from "../kernel/storage";
-import { readRunRowByTask, withKernelRead } from "../kernel/sqlite_store";
-import { taskRevisionIdentity, taskCommitRevisionIdentity, pathMatchesScope } from "../workspace_scope";
+import { readAuditTaskPair, readSecureProjectBytes, readSettledRunEvidence, enrollmentEventIdFor, readWorkspaceStateRaw, type SettledRunEvidence } from "../kernel/storage";
+import { auditRunDirPath, auditRunRecordPath, auditRunTerminalProofPath, batchCommitEvidencePath, batchStatePath } from "../kernel/storage_paths";
+import { taskDeliveryIdentity, taskCommitRevisionIdentity, pathMatchesScope } from "../workspace_scope";
 import { projectTask } from "../kernel/completion";
 import { isTerminalBatchState, type BatchRunStateRecord } from "./batch_state";
 import type { BatchPlanChild } from "./types";
@@ -31,7 +31,7 @@ export function ownUnpersistedBatchHead(root: string, record: BatchRunStateRecor
 			record.children[0]?.state !== "settled" || record.children.some(c => c.commit !== null)) return false;
 		const task = record.children[0].task_id;
 		if (!id.test(task)) return false;
-		const evidence = JSON.parse(decode(readSecureProjectBytes(root, `.imm/state/batches/commits/${record.batch_id}-${task}.json`)));
+		const evidence = JSON.parse(decode(readSecureProjectBytes(root, batchCommitEvidencePath(record.batch_id, task))));
 		if (evidence.contract !== "assurance_kernel/batch_commit_evidence/v1" || evidence.batch_id !== record.batch_id ||
 			evidence.task_id !== task || evidence.commit !== head || evidence.parent_head !== record.base_head) return false;
 		if (git(root, ["symbolic-ref", "--short", "HEAD"]).trim() !== record.branch) return false;
@@ -39,18 +39,19 @@ export function ownUnpersistedBatchHead(root: string, record: BatchRunStateRecor
 		if (parents.length !== 1 || parents[0] !== record.base_head) return false;
 		const metadata = git(root, ["show", "-s", "--format=%an%x00%s%x00%(trailers:key=Immune-Brain-Batch,valueonly)", head]).split("\0");
 		if (metadata[0] !== batchAuthor || !metadata[1]?.startsWith(`imm(${task}):`) || metadata[2]?.trim() !== record.batch_id) return false;
-		const run = localRunId(root, task);
-		if (!run || !id.test(run)) return false;
+		const settled = readSettledRunEvidence(root, task);
+		if (!settled || settled.lifecycle !== "done") return false;
+		const run = settled.run_id;
+		if (!id.test(run)) return false;
 		const pair = readAuditTaskPair(root, task, run);
 		if (!pair || pair.record.contract !== "assurance_kernel/task_record/v4" || pair.record.lifecycle !== "done" || pair.proof.terminal_lifecycle !== "done") return false;
-		const local = withKernelRead(root, db => readRunRowByTask(db, task));
-		if (!local || local.run_id !== run || local.state !== "done" || !matchesLocalProof(local.terminal_proof_json, pair.proof)) return false;
+		if (!matchesLocalProof(settled.proof_json, pair.proof)) return false;
 		for (const file of ["task-record.json", "terminal-proof.json"]) {
-			const path = `.imm/audit/${task}/${run}/${file}`;
+			const path = `${auditRunDirPath(task, run)}/${file}`;
 			if (!readSecureProjectBytes(root, path).equals(Buffer.from(git(root, ["show", `${head}:${path}`])))) return false;
 		}
 		const paths = git(root, ["diff-tree", "--no-commit-id", "--name-only", "--no-renames", "-z", "-r", head]).split("\0").filter(Boolean);
-		if (!paths.length || paths.some(path => !path.startsWith(`.imm/audit/${task}/${run}/`) &&
+		if (!paths.length || paths.some(path => !path.startsWith(`${auditRunDirPath(task, run)}/`) &&
 			!pair.record.intent_snapshot.scope_hint.some(s => pathMatchesScope(path, s)))) return false;
 		const identity = taskCommitRevisionIdentity(root, pair.record.intent_snapshot.scope_hint, pair.record.git_base_head, head);
 		if (!projectTask(pair.record.intent_snapshot, pair.record, identity.diff_hash, pair.record.intent_ref.content_hash, identity.changed_paths).complete) return false;
@@ -85,7 +86,7 @@ export async function captureBatchReconfirmation(root: string, record: BatchRunS
 	const assertNoCommitEvidence = () => {
 		for (const child of record.children) {
 			if (!id.test(child.task_id)) refuse();
-			const path = `.imm/state/batches/commits/${record.batch_id}-${child.task_id}.json`;
+			const path = batchCommitEvidencePath(record.batch_id, child.task_id);
 			let missing = false;
 			try { readSecureProjectBytes(root, path); }
 			catch (error) {
@@ -96,13 +97,13 @@ export async function captureBatchReconfirmation(root: string, record: BatchRunS
 		}
 	};
 	assertNoCommitEvidence();
-	const statePath = `.imm/state/batches/${record.batch_id}.json`;
+	const statePath = batchStatePath(record.batch_id);
 	const stateBytes = readSecureProjectBytes(root, statePath);
 	if (JSON.stringify(JSON.parse(decode(stateBytes))) !== JSON.stringify(record)) refuse();
 	const files = new Map<string, Buffer>();
 	const capture = (path: string) => { const bytes = readSecureProjectBytes(root, path); files.set(path, bytes); return bytes; };
 	const oldChildren: DigestChild[] = [];
-	const changed: Array<{ task: string; run: string; identity: string; local: string }> = [];
+	const changed: Array<{ task: string; run: string; identity: string; settled: string }> = [];
 	let scope: string[] | null = null;
 	const workspace = readWorkspaceStateRaw(root);
 	if (workspace.state.current_working !== null) refuse();
@@ -121,11 +122,11 @@ export async function captureBatchReconfirmation(root: string, record: BatchRunS
 		if (currentHash !== tracked.content_hash || currentHash !== child.intent_content_hash || current.revision !== child.intent_revision) refuse();
 		if (currentHash === oldHash) continue;
 		if (scope !== null || previous.state === "pending" || previous.state === "skipped_blocked" || current.revision <= old.revision || current.goal !== old.goal || current.owner !== old.owner) refuse();
-		const run = localRunId(root, child.task_id);
-		if (!run || !id.test(run)) refuse();
-		const local = withKernelRead(root, db => readRunRowByTask(db, child.task_id));
-		if (!local || local.run_id !== run || local.state !== "done" || local.enrollment_event_id !== `enroll-${child.task_id}-${local.created_at}` ||
-			Date.parse(local.created_at) > Date.parse(record.updated_at)) refuse();
+		const settled = readSettledRunEvidence(root, child.task_id);
+		if (!settled || settled.lifecycle !== "done") refuse();
+		const run = settled.run_id;
+		if (!id.test(run) || settled.enrollment_event_id !== enrollmentEventIdFor(child.task_id, settled.created_at) ||
+			Date.parse(settled.created_at) > Date.parse(record.updated_at)) refuse();
 		const pair = readAuditTaskPair(root, child.task_id, run);
 		if (!pair || pair.record.contract !== "assurance_kernel/task_record/v4") refuse();
 		const r = pair.record;
@@ -133,22 +134,22 @@ export async function captureBatchReconfirmation(root: string, record: BatchRunS
 			r.git_base_head !== record.base_head || pair.proof.terminal_lifecycle !== "done") refuse();
 		const terminal = r.history.at(-1);
 		if (terminal?.type !== "complete" || terminal.from_state !== "active:frozen" || terminal.to_state !== "done:frozen" || terminal.id !== pair.proof.terminal_event_id) refuse();
-		const recordPath = `.imm/audit/${child.task_id}/${run}/task-record.json`;
-		const proofPath = `.imm/audit/${child.task_id}/${run}/terminal-proof.json`;
-		if (!capture(recordPath).equals(Buffer.from(local.record_json))) refuse();
+		const recordPath = auditRunRecordPath(child.task_id, run);
+		const proofPath = auditRunTerminalProofPath(child.task_id, run);
+		if (!capture(recordPath).equals(Buffer.from(settled.record_json))) refuse();
 		const capturedProof = JSON.parse(decode(capture(proofPath)));
-		if (!matchesLocalProof(local.terminal_proof_json, capturedProof) || !matchesLocalProof(local.terminal_proof_json, pair.proof)) refuse();
-		const identity = taskRevisionIdentity(root, r.intent_snapshot.scope_hint, r.git_base_head, r.task_id);
+		if (!matchesLocalProof(settled.proof_json, capturedProof) || !matchesLocalProof(settled.proof_json, pair.proof)) refuse();
+		const identity = taskDeliveryIdentity(root, r);
 		const projection = await projectAssurance(root, child.task_id, (cwd, task) => {
 			if (task.contract !== "assurance_kernel/task_record/v4" || !task.git_base_head) refuse();
-			return taskRevisionIdentity(cwd, task.intent_snapshot.scope_hint, task.git_base_head, task.task_id);
+			return taskDeliveryIdentity(cwd, task);
 		});
 		if (projection.error || projection.claim || projection.projection.run_id !== run || projection.projection.lifecycle !== "done" ||
 			!projection.projection.completion_ready || projection.projection.intent_content_hash !== currentHash || projection.projection.diff_hash !== identity.diff_hash ||
 			!projection.projection.fresh_approval_kinds.includes("qa") ||
 			(projection.projection.risk !== "routine" && !projection.projection.fresh_approval_kinds.includes("review"))) refuse();
 		scope = r.intent_snapshot.scope_hint;
-		changed.push({ task: child.task_id, run, identity: JSON.stringify(identity), local: JSON.stringify(local) });
+		changed.push({ task: child.task_id, run, identity: JSON.stringify(identity), settled: JSON.stringify(settled) });
 	}
 	if (computeBatchPlanDigest(oldChildren) !== record.plan_digest || changed.length !== 1 || scope === null) refuse();
 	const confirmedScope = scope;
@@ -161,7 +162,7 @@ export async function captureBatchReconfirmation(root: string, record: BatchRunS
 	for (const entry of entries) {
 		const code = entry.slice(0, 2), path = entry.slice(3);
 		if (code[1] !== " " || !["A", "M", "D"].includes(code[0]!) ||
-			(!path.startsWith(`.imm/audit/${owner.task}/${owner.run}/`) &&
+			(!path.startsWith(`${auditRunDirPath(owner.task, owner.run)}/`) &&
 			!confirmedScope.some(s => pathMatchesScope(path, s)))) refuse();
 	}
 	const flagsBytes = git(root, ["ls-files", "-v"]);
@@ -172,11 +173,15 @@ export async function captureBatchReconfirmation(root: string, record: BatchRunS
 	if (head() !== record.base_head || branch() !== record.branch) refuse();
 	const assertDeliveryUnchanged = () => {
 		for (const c of changed) {
+			let settled: SettledRunEvidence | null;
+			try {
+				settled = readSettledRunEvidence(root, c.task);
+			} catch { refuse(); }
+			if (!settled || settled.run_id !== c.run || JSON.stringify(settled) !== c.settled) refuse();
 			const pair = readAuditTaskPair(root, c.task, c.run);
 			if (!pair || pair.record.contract !== "assurance_kernel/task_record/v4" || !pair.record.git_base_head) refuse();
-			const local = withKernelRead(root, db => readRunRowByTask(db, c.task));
-			const diff = taskRevisionIdentity(root, pair.record.intent_snapshot.scope_hint, pair.record.git_base_head, c.task);
-			if (localRunId(root, c.task) !== c.run || JSON.stringify(local) !== c.local || JSON.stringify(diff) !== c.identity) refuse();
+			const diff = taskDeliveryIdentity(root, pair.record);
+			if (JSON.stringify(diff) !== c.identity) refuse();
 		}
 	};
 	const assertUnchanged = () => {