immune-brain 5.0.0 → 5.1.1

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -57,6 +57,9 @@ import {
 	type BatchRunReport,
 } from "../unattended/batch_runner";
 import { createBatchKernelPort } from "../unattended/batch_kernel_port";
+import type { LaneOffer } from "../unattended/batch_lanes";
+import { retireStaleBatch } from "../unattended/batch_disposition";
+import type { BatchLaneRunReport } from "../unattended/batch_state";
 import {
 	createBatchAuthorityRegistry,
 } from "../kernel/batch_authority";
@@ -66,7 +69,7 @@ import {
 import type {
 	InitiativeObservationReader,
 } from "../unattended/types";
-import { observeGithubInitiative } from "../github_issue_tracker";
+import { observeInitiative } from "../unattended/batch_plan";
 import {
 	confirmationRef,
 	enrollmentNonce,
@@ -106,42 +109,11 @@ function readTaskIntentForRecord(root: string, taskId: string) {
 	return readTaskIntent(root, taskId, currentPath);
 }
 
-function extractVerdictJson(input: unknown): Record<string, unknown> | null {
-	if (typeof input === "string") {
-		const cleaned = input.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("{") && line.endsWith("}")).join("");
-		if (!cleaned) return null;
-		try { return JSON.parse(cleaned) as Record<string, unknown>; } catch { return null; }
-	}
-	if (typeof input === "object" && input !== null && !Array.isArray(input)) return input as Record<string, unknown>;
-	return null;
-}
-
-function verdictFingerprint(raw: Record<string, unknown>): string {
-	return JSON.stringify({
-		contract: raw.contract ?? null,
-		role: raw.role ?? null,
-		task_id: raw.task_id ?? null,
-		snapshot_digest: raw.snapshot_digest ?? null,
-		decision: raw.decision ?? null,
-		approval: raw.approval ?? null,
-		findings: raw.findings ?? null,
-	});
-}
-
-const RELEASED_REVIEW_RECOVERY =
-	"Call advance_assurance to obtain a new Review reservation, then dispatch one fresh reviewer with the returned envelope unchanged";
-const RETAINED_REVIEW_RECOVERY =
-	"Wait for the dispatched reviewer to finish, then call submit_review again with its verdict; do not dispatch or continue another reviewer";
-const MISMATCH_REVIEW_RECOVERY =
-	"Resubmit the reviewer's verdict exactly as the reviewer returned it";
-
-function withReviewRecovery(
-	result: AssuranceSubmitReviewResult,
-	recovery_action: string,
-): AssuranceSubmitReviewResult {
-	if (result.state !== "blocked" || result.code === "verdict_invalid") return result;
-	return { ...result, recovery_action };
-}
+import {
+	extractVerdictJson,
+	submitMediatedReview,
+} from "../assurance/review_mediation";
+export { extractVerdictJson };
 
 export async function submitClaudeReview(
 	host: ClaudeReviewHost,
@@ -150,24 +122,8 @@ export async function submitClaudeReview(
 	taskId: string,
 	verdictInput: unknown,
 ): Promise<AssuranceSubmitReviewResult> {
-	if (verdictInput === undefined) throw new Error("verdict is required");
-	const observed = host.inspectReviewForTask(taskId);
-	if (!observed.ok) {
-		if (observed.release) return withReviewRecovery(coordinator.abandonReview(taskId, observed.reason), RELEASED_REVIEW_RECOVERY);
-		return { state: "blocked", reason: observed.reason, recovery_action: RETAINED_REVIEW_RECOVERY };
-	}
-	const parentValid = coordinator.isReviewVerdictValid(taskId, verdictInput);
-	if (!parentValid) return coordinator.submitReview(taskId, ctx, verdictInput);
-	const receiptValid = coordinator.isReviewVerdictValid(taskId, observed.receipt.result);
-	if (!receiptValid) {
-		return withReviewRecovery(coordinator.abandonReview(taskId, "reviewer receipt is not a valid verdict"), RELEASED_REVIEW_RECOVERY);
-	}
-	const parentJson = extractVerdictJson(verdictInput)!;
-	const receiptJson = extractVerdictJson(observed.receipt.result)!;
-	if (verdictFingerprint(parentJson) !== verdictFingerprint(receiptJson)) {
-		return { state: "blocked", reason: "parent verdict does not match reviewer receipt", recovery_action: MISMATCH_REVIEW_RECOVERY };
-	}
-	return coordinator.submitReview(taskId, ctx, verdictInput);
+	// ADR 0017: an omitted verdict applies the hook-observed reviewer receipt.
+	return submitMediatedReview(coordinator, ctx, taskId, verdictInput, () => host.inspectReviewForTask(taskId));
 }
 
 /**
@@ -284,6 +240,7 @@ export interface ClaudeRuntimeOptions {
  */
 type ClaudeBatchStartResult =
 	| { state: "started"; batch_id: string; report: BatchRunReport }
+	| { state: "retired"; batch_id: string; report: BatchRunReport | BatchLaneRunReport }
 	| { state: "rejected"; reason: string; recovery_action: string }
 	| { state: "cancelled"; reason: string; recovery_action: string }
 	| { state: "blocked"; reason: string; recovery_action: string };
@@ -784,7 +741,7 @@ export class ClaudeRuntime {
 	async startUnattendedBatch(
 		initiativeSlug: string,
 		meta: ToolMeta,
-		options: { reuseOnly?: boolean } = {},
+		options: { reuseOnly?: boolean; max_parallel?: number; lane_offers?: LaneOffer[] } = {},
 	): Promise<ClaudeBatchStartResult> {
 		throwIfCancelled(meta.signal);
 		const reuseOnly = options.reuseOnly === true;
@@ -807,7 +764,7 @@ export class ClaudeRuntime {
 			root: this.cwd,
 			initiative_slug: initiativeSlug,
 			now,
-			readInitiative: this.readInitiative ?? observeGithubInitiative,
+			readInitiative: this.readInitiative ?? observeInitiative,
 		});
 		if (!preflight.ok) {
 			return {
@@ -830,7 +787,7 @@ export class ClaudeRuntime {
 			initiative_slug: initiativeSlug,
 			now,
 			projection: preflight.projection,
-			readInitiative: this.readInitiative ?? observeGithubInitiative,
+			readInitiative: this.readInitiative ?? observeInitiative,
 			nonce: enrollmentNonce(),
 			gate: async (facts) => {
 				// A continuation after a foreground child never opens a gate: when the
@@ -867,6 +824,15 @@ export class ClaudeRuntime {
 								reason: child.reason,
 							})),
 							budget: facts.budget,
+							...(options.max_parallel !== undefined
+								? {
+										lane_mode: {
+											max_parallel: options.max_parallel,
+											parallel_groups: facts.parallel_groups,
+											serialized: facts.scope_conflicts,
+										},
+									}
+								: {}),
 							...(facts.reuse_blockers.length > 0
 								? {
 										re_confirmation_required: facts.reuse_blockers,
@@ -971,6 +937,8 @@ export class ClaudeRuntime {
 			now,
 			kernel: kernelPort,
 			git: this.batchGit,
+			...(options.max_parallel !== undefined ? { max_parallel: options.max_parallel } : {}),
+			...(options.lane_offers !== undefined ? { lane_offers: options.lane_offers } : {}),
 		});
 
 		// review-3 & review-batch-preflight-recovery-is-diagnostic: map rejected batch state to rejected result with same-Host recovery action
@@ -982,6 +950,85 @@ export class ClaudeRuntime {
 			report,
 		};
 	}
+
+	/**
+	 * The batch disposition. One explicit literal-user decision retires a record
+	 * the plan moved past: the terminal superseded state and its report preserve
+	 * every child state, recorded commit and the batch branch, and no child is
+	 * re-enrolled, handed off, or credited with delivery it never had.
+	 */
+	async retireStaleBatch(initiativeSlug: string, meta: ToolMeta): Promise<ClaudeBatchStartResult> {
+		throwIfCancelled(meta.signal);
+		const probe = probeHost(this.env, process.platform, this.hostVersion);
+		if (!probe.ok) throw new NativeAuthorityError("unsupported_host", probe.reason);
+		// The disposition always opens a gate, so it needs a confirmation port.
+		if (!this.requestConfirmation)
+			throw new NativeAuthorityError("interaction_not_opened", batchReason("confirmation_port_unavailable").reason);
+		const outcome = await retireStaleBatch<ClaudeBatchStartResult>({
+			root: this.cwd,
+			initiative_slug: initiativeSlug,
+			now: new Date().toISOString(),
+			gate: async (facts) => {
+				let confirmationResult: { decision: NativeDecision; requestId: string };
+				try {
+					confirmationResult = await this.requestConfirmation!({
+						operation: "retire_stale_batch",
+						initiativeSlug,
+						toolCallId: meta.toolCallId,
+						batchDisposition: {
+							batch_id: facts.batch_id,
+							batch_state: facts.batch_state,
+							batch_branch: facts.branch,
+							plan_digest: facts.plan_digest,
+							recorded_commits: facts.recorded_commits.length,
+							children: facts.children.map((child) => ({
+								task_id: child.task_id,
+								slice_id: child.slice_id,
+								state: child.state,
+								commit: child.commit,
+								lane_branch: child.lane_branch,
+							})),
+						},
+						signal: meta.signal,
+					});
+				} catch (err) {
+					if (meta.signal?.aborted)
+						return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
+					if (err instanceof NativeAuthorityError) {
+						if (err.reasonCode === "unsupported_host") throw err;
+						if (err.reasonCode === "user_cancelled") {
+							return {
+								kind: "host_rejection",
+								value: { state: "cancelled", reason: err.message, recovery_action: err.recoveryAction },
+							};
+						}
+						return {
+							kind: "host_rejection",
+							value: { state: "rejected", reason: err.message, recovery_action: err.recoveryAction },
+						};
+					}
+					return {
+						kind: "host_rejection",
+						value: batchReason("confirmation_failed", err instanceof Error ? err.message : String(err)),
+						};
+				}
+				if (confirmationResult.decision === "cancel" && meta.signal?.aborted)
+					return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
+				if (meta.signal?.aborted)
+					return { kind: "host_rejection", value: batchReason("cancelled_before_execution") };
+				if (confirmationResult.decision === "decline")
+					return { kind: "host_rejection", value: batchReason("confirmation_declined") };
+				if (confirmationResult.decision === "cancel")
+					return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
+				if (confirmationResult.decision !== "accept")
+					return { kind: "host_rejection", value: batchReason("confirmation_no_decision") };
+				return { kind: "confirmed", request_id: confirmationResult.requestId };
+			},
+		});
+		if (outcome.outcome === "host_rejection") return outcome.value;
+		if (outcome.outcome === "rejected") return outcome.rejection;
+		return { state: "retired", batch_id: outcome.batch_id, report: outcome.report };
+	}
 }
 
 export interface ToolMeta {

package/plugins/immune-brain/runtime/claude/mcp_server.ts

@@ -13,6 +13,7 @@ import {
 } from "./interaction";
 import { ClaudeReviewHost, FileHookEventLog, parseHookStdin } from "./review_host";
 import { ClaudeRuntime, type ToolMeta } from "./kernel_ports";
+import { parseLaneOffers, parseMaxParallel, resolveLaneParallel } from "../unattended/batch_lanes";
 import type { AssuranceCoordinatorPorts } from "../assurance/coordinator";
 
 export const MCP_PROTOCOL_VERSION = "2025-06-18";
@@ -21,12 +22,13 @@ export const TOOLS = [
 	{ name: "status", description: "Read the Kernel Assurance Projection for an exact task.", privileged: false },
 	{ name: "enroll", description: "Enroll a Git-tracked TaskIntent after native confirmation.", privileged: true },
 	{ name: "advance_assurance", description: "Advance frozen Assurance through deterministic QA and Review reservation.", privileged: false },
-	{ name: "submit_review", description: "Submit the Parent-mediated Review verdict bound to the correlated receipt.", privileged: false },
+	{ name: "submit_review", description: "Submit the Review verdict; omit the verdict to apply the correlated reviewer receipt, or relay the reviewer's structured verdict for fingerprint comparison.", privileged: false },
 	{ name: "request_authorization", description: "Apply exact literal-user authorization.", privileged: true },
 	{ name: "revise_intent", description: "Apply a compatible TaskIntent revision.", privileged: false },
 	{ name: "approve_breaking_intent_revision", description: "Approve a breaking TaskIntent revision.", privileged: true },
 	{ name: "stop", description: "Stop the active task with literal-user authority.", privileged: true },
 	{ name: "start_unattended_batch", description: "Start an unattended serial batch run for an Initiative after native confirmation.", privileged: true },
+	{ name: "retire_stale_batch", description: "Retire an Initiative's parked or drifted batch record to the terminal superseded state after native confirmation.", privileged: true },
 	{ name: "repair_authority_state", description: "Repair a proven recoverable stale backend claim.", privileged: false },
 	{ name: "resolve_finding", description: "Resolve one open blocking or advisory finding whose cause is fixed and verified.", privileged: false },
 	{ name: "refute_finding", description: "Refute one open finding by binding the fresh passing QA attestation that contradicts it.", privileged: false },
@@ -39,8 +41,24 @@ export function listMcpTools() {
 		inputSchema: {
 			type: "object",
 			properties: {
-				...(tool.name === "start_unattended_batch"
-					? { initiative_slug: { type: "string" } }
+				...(tool.name === "start_unattended_batch" || tool.name === "retire_stale_batch"
+					? {
+						initiative_slug: { type: "string" },
+						...(tool.name === "start_unattended_batch"
+							? {
+									max_parallel: { type: "integer", minimum: 1 },
+									lane_offers: {
+										type: "array",
+										items: {
+											type: "object",
+											properties: { task_id: { type: "string" }, path: { type: "string" } },
+											required: ["task_id", "path"],
+											additionalProperties: false,
+										},
+									},
+								}
+							: {}),
+						}
 					: {
 						task_id: { type: "string" },
 						...(tool.name === "approve_breaking_intent_revision" || tool.name === "revise_intent" ? { next_intent: { type: "object" } } : {}),
@@ -50,17 +68,15 @@ export function listMcpTools() {
 						...(tool.name === "refute_finding" ? { finding_id: { type: "string" }, attestation_id: { type: "string" } } : {}),
 					}),
 			},
-			required: tool.name === "start_unattended_batch"
+			required: tool.name === "start_unattended_batch" || tool.name === "retire_stale_batch"
 				? ["initiative_slug"]
-				: tool.name === "submit_review"
-					? ["task_id", "verdict"]
-					: tool.name === "resolve_finding"
-						? ["task_id", "finding_id"]
-						: tool.name === "refute_finding"
-							? ["task_id", "finding_id", "attestation_id"]
-							: tool.name === "revise_intent"
-								? ["task_id", "next_intent"]
-								: ["task_id"],
+				: tool.name === "resolve_finding"
+					? ["task_id", "finding_id"]
+					: tool.name === "refute_finding"
+						? ["task_id", "finding_id", "attestation_id"]
+						: tool.name === "revise_intent"
+							? ["task_id", "next_intent"]
+							: ["task_id"],
 		},
 		annotations: tool.privileged ? privilegedAnnotations() : { readOnlyHint: tool.name === "status" },
 	}));
@@ -135,7 +151,33 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 					interactive: meta.interactive ?? options.interactive ?? negotiatedInteractive,
 					signal: meta.signal,
 				};
-				return runtime.startUnattendedBatch(initiativeSlug, toolMeta);
+				const laneOffers = parseLaneOffers(args.lane_offers);
+				// A lane_offers-only call resumes the recorded lane batch; refused before any gate otherwise.
+				const maxParallel = resolveLaneParallel(options.cwd ?? process.cwd(), initiativeSlug, parseMaxParallel(args.max_parallel), laneOffers);
+				return runtime.startUnattendedBatch(initiativeSlug, toolMeta, {
+					...(maxParallel !== undefined ? { max_parallel: maxParallel } : {}),
+					...(laneOffers !== undefined ? { lane_offers: laneOffers } : {}),
+				});
+			}
+			if (name === "retire_stale_batch") {
+				const initiativeSlug = String(args.initiative_slug ?? "");
+				if (!initiativeSlug) throw new Error("initiative_slug is required");
+				if ("native_decision" in args) throw new Error("native_decision cannot be supplied in tool arguments");
+				if (!negotiatedVersion) throw new NativeAuthorityError("unsupported_host", "Claude Code version is unavailable");
+				if (!negotiatedInteractive) {
+					throw new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable");
+				}
+				const probe = probeHost(options.env ?? process.env, process.platform, negotiatedVersion);
+				if (!probe.ok) throw new NativeAuthorityError("unsupported_host", probe.reason);
+				const toolMeta: ToolMeta = {
+					sessionId: meta.sessionId ?? connectionId,
+					toolCallId: meta.toolCallId ?? `call-${name}`,
+					taskId: initiativeSlug,
+					initiativeSlug,
+					interactive: meta.interactive ?? options.interactive ?? negotiatedInteractive,
+					signal: meta.signal,
+				};
+				return runtime.retireStaleBatch(initiativeSlug, toolMeta);
 			}
 			const taskId = String(args.task_id ?? "");
 			if (!taskId) throw new Error("task_id is required");
@@ -164,8 +206,8 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 			if (name === "enroll") return runtime.enroll(taskId, toolMeta);
 			if (name === "advance_assurance") return runtime.advance(taskId, toolMeta.signal, toolMeta);
 			if (name === "submit_review") {
-				if (!Object.hasOwn(args, "verdict")) throw new Error("verdict is required");
-				return runtime.submitReview(taskId, args.verdict, toolMeta);
+				// ADR 0017: an absent verdict is the receipt-bound submission.
+				return runtime.submitReview(taskId, Object.hasOwn(args, "verdict") ? args.verdict : undefined, toolMeta);
 			}
 			if (name === "revise_intent") {
 				if (!Object.hasOwn(args, "next_intent")) throw new Error("next_intent is required");
@@ -362,6 +404,34 @@ async function writeReply(output: Writable, reply: JsonRpc): Promise<void> {
 }
 
 export function elicitationParams(input: NativeConfirmationInput) {
+	if (input.operation === "retire_stale_batch") {
+		const d = input.batchDisposition;
+		const details = [
+			`Operation: retire_stale_batch`,
+			`Initiative: ${input.initiativeSlug}`,
+			d ? `Batch: ${d.batch_id}` : null,
+			d ? `Batch state: ${d.batch_state}` : null,
+			d ? `Batch branch: ${d.batch_branch}` : null,
+			d ? `Plan digest: ${d.plan_digest}` : null,
+			d ? `Recorded child commits: ${d.recorded_commits}` : null,
+			d
+				? `Children (${d.children.length}):\n${d.children
+						.map(
+							(child) =>
+								`  - ${child.task_id} (${child.slice_id}) [state: ${child.state}]${child.commit ? ` [commit: ${child.commit}]` : " [no commit]"}${child.lane_branch ? ` [lane: ${child.lane_branch}]` : ""}`,
+						)
+						.join("\n")}`
+				: null,
+			"Retiring writes this record to the terminal superseded state. Child states, recorded commits and the batch branch are preserved as evidence; nothing is deleted and no batch trailer or approval is manufactured.",
+			"A child without a commit was never executed by this batch: it carries no delivery evidence, and the retired authorization is never reused for a revised plan.",
+			"After retiring, run each remaining child with imm-run under its own authorization, or start a new batch for this Initiative.",
+		].filter(Boolean);
+		return {
+			mode: "form",
+			message: `Retire this stale batch record for ${input.initiativeSlug}?\n\n${details.join("\n")}`,
+			requestedSchema: { type: "object", properties: {} },
+		};
+	}
 	if (input.operation === "start_unattended_batch") {
 		const b = input.batchDetails;
 		const details = [
@@ -372,6 +442,9 @@ export function elicitationParams(input: NativeConfirmationInput) {
 			b?.children ? `Ordered children (${b.children.length}):\n${b.children.map((c) => `  - ${c.task_id} (${c.slice_id}) [risk: ${c.risk ?? "unknown"}]`).join("\n")}` : null,
 			b?.excluded && b.excluded.length > 0 ? `Excluded children (${b.excluded.length}):\n${b.excluded.map((e) => `  - ${e.task_id} (${e.slice_id}): ${e.reason}`).join("\n")}` : null,
 			b?.budget ? `Budget: max_children=${b.budget.max_children}, qa_failure_limit=${b.budget.qa_failure_limit}` : null,
+			b?.lane_mode ? `Lane mode: max_parallel=${b.lane_mode.max_parallel}` : null,
+			b?.lane_mode ? `Parallel groups (${b.lane_mode.parallel_groups.length}):\n${b.lane_mode.parallel_groups.map((group) => `  - ${group.join(", ")}`).join("\n")}` : null,
+			b?.lane_mode && b.lane_mode.serialized.length > 0 ? `Serialized by overlapping scope (${b.lane_mode.serialized.length}):\n${b.lane_mode.serialized.map((c) => `  - ${c.task_id} after ${c.overlaps_with.join(", ")}`).join("\n")}` : null,
 		].filter(Boolean);
 		return {
 			mode: "form",

package/plugins/immune-brain/runtime/claude/role_agents.ts

@@ -73,9 +73,10 @@ export const CLAUDE_HOST_PROVIDED_ROLE_AGENTS = {
  *
  * `code-review` ships its own definition with a wider allowlist (it must run
  * read-only Git commands), so it is not part of this table. The remaining roles
- * write: `executor`, `test-fixer` and `pr-fix` mutate the workspace, and
- * `compounder` writes learning storage. A write-capable role stays bounded by
- * its dispatch envelope and the Parent, not by an agent definition.
+ * write: `executor`, `test-fixer` and `pr-fix` mutate the workspace,
+ * `compounder` writes learning storage, and `lane-steward` supplies and
+ * releases a separate working tree. A write-capable role stays bounded by its
+ * dispatch envelope and the Parent, not by an agent definition.
  */
 export const CLAUDE_NATIVE_AGENT_ROLES = new Set<InternalRole>([
 	...CLAUDE_READONLY_ROLES,

package/plugins/immune-brain/runtime/kernel/assurance_projection.ts

@@ -21,6 +21,7 @@ import {
 	reconcileKernelAuthority,
 } from "./storage";
 import { projectTask, resolveProjectedRisk } from "./completion";
+import { inspectSpecBinding } from "./spec_binding";
 import { taskDeliveryIdentity } from "../workspace_scope";
 import type { AssuranceObligation, TaskIntentV1, TaskRecord, TaskRecordV3 } from "./types";
 import type { TaskRecordV2 } from "./legacy_task_record";
@@ -236,7 +237,9 @@ function projectFromRecord(
 		independence_violations: decision.independence_violations,
 		open_user_decision_count: openUserDecisionCount,
 		completion_ready: decision.complete,
-		authorization: deriveAssuranceAuthorization({
+		authorization: !inspectSpecBinding(intent).ok
+			? { state: "none", blocked: "invalid Spec binding requires a valid breaking intent revision" }
+			: deriveAssuranceAuthorization({
 			next_obligation: decision.next_obligation,
 			open_user_decision_count: openUserDecisionCount,
 		}),

package/plugins/immune-brain/runtime/kernel/canary_application.ts

@@ -26,7 +26,7 @@ import {
 	type BackendClaim,
 } from "./backend_claim";
 import { canonicalIntentHash } from "./intent";
-import { boundSpecPath, readBoundActiveSpec } from "./spec_binding";
+import { assertValidSpecBinding, boundSpecPath, readBoundActiveSpec } from "./spec_binding";
 import { parseTaskRecord } from "./validation";
 import type { TaskIntentIdentityToken } from "./intent_token_registry";
 import {
@@ -208,6 +208,7 @@ export function createCanaryApplication(
 			const current = readTaskRecordRaw(input.root, input.task_id);
 			if (!current.record)
 				throw new KernelInvariantError([`task ${input.task_id} has no TaskRecord v3`]);
+			assertValidSpecBinding(current.record.intent_snapshot);
 			const workspace = readWorkspaceStateRaw(input.root);
 			if (current.record.artifact_state === "frozen")
 				return { revision: current.revision, record: current.record, workspace };
@@ -318,7 +319,13 @@ export function createCanaryApplication(
 		const diffHash = asTaskDiffSnapshot((input.diffProvider ?? taskDeliveryIdentity)(input.root, snapshot.record)).diff_hash;
 		if (operation.op === "stop" && !("capability" in operation))
 			throw new KernelInvariantError(["stop requires user authority capability"]);
-		const hasBoundSpec = boundSpecPath(snapshot.intent_snapshot) !== undefined;
+		// Only a capability-bound breaking revision may recover an invalid prior
+		// binding. Validate the replacement before any authority write.
+		if (operation.op === "approve_breaking_intent_revision") assertValidSpecBinding(operation.next_intent);
+		else assertValidSpecBinding(snapshot.intent_snapshot);
+		const hasBoundSpec = operation.op === "approve_breaking_intent_revision"
+			? boundSpecPath(operation.next_intent) !== undefined
+			: boundSpecPath(snapshot.intent_snapshot) !== undefined;
 		if (operation.op === "complete" && hasBoundSpec && snapshot.record.artifact_state !== "frozen")
 			throw new KernelInvariantError(["complete requires frozen planning artifacts"]);
 		const artifactTransition =

package/plugins/immune-brain/runtime/kernel/completion.ts

@@ -1,5 +1,5 @@
 import { classifyTaskRisk } from "./intent";
-import { archivePath, boundSpecPath } from "./spec_binding";
+import { archivePath, boundSpecPath, inspectSpecBinding } from "./spec_binding";
 import type {
 	ApprovalKind,
 	CompletionDecision,
@@ -49,6 +49,8 @@ export function resolveProjectedRisk(
 	intent: TaskIntentV1,
 	changedPaths: readonly string[] = [],
 ): TaskIntentV1["risk"] {
+	// Invalid bindings have no trusted planning-path exclusions.
+	if (!inspectSpecBinding(intent).ok) return classifyTaskRisk(changedPaths, intent.risk);
 	const excluded = ownSidecarPaths(intent);
 	return classifyTaskRisk(
 		changedPaths.filter((path) => !excluded.has(path)),
@@ -182,6 +184,27 @@ export function projectTask(
 	currentIntentContentHash: string,
 	changedPaths: readonly string[] = [],
 ): TaskProjectionV3 {
+	if (record.lifecycle === "active" && !inspectSpecBinding(intent).ok) {
+		assertKernelInvariantsV3(intent, record);
+		return {
+			contract: "assurance_kernel/projection/v3",
+			task_id: record.task_id,
+			intent_revision: intent.revision,
+			lifecycle: record.lifecycle,
+			artifact_state: record.artifact_state,
+			blocked: true,
+			next_obligation: "revise_intent",
+			complete: false,
+			fresh_acceptance_ids: [],
+			missing_acceptance_ids: intent.acceptance.map((item) => item.id),
+			stale_attestation_ids: record.attestations.map((item) => item.id),
+			missing_approval_kinds: REQUIRED_ATTESTATIONS[resolveProjectedRisk(intent, changedPaths)],
+			blocking_finding_ids: record.findings.filter((item) => item.kind === "blocking" && item.status !== "resolved").map((item) => item.id),
+			unresolved_user_decision_ids: record.findings.filter((item) => item.kind === "unresolved_user_decision" && item.status === "open").map((item) => item.id),
+			replan_required_ids: record.findings.filter((item) => item.kind === "replan_required" && item.status === "open").map((item) => item.id),
+			independence_violations: [],
+		};
+	}
 	const decision = completionDecision(
 		intent,
 		record,

package/plugins/immune-brain/runtime/kernel/reducer.ts

@@ -23,6 +23,7 @@ import {
 	parseTaskRecord,
 } from "./validation";
 import { classifyIntentRevision, canonicalIntentHash } from "./intent";
+import { assertValidSpecBinding } from "./spec_binding";
 
 const RISK_RANK: Record<TaskIntentV1["risk"], number> = {
 	routine: 0,
@@ -431,15 +432,24 @@ export function reduceTask(
 			const reviewRevision = approval.review_revision;
 			if (reviewRevision && approval.kind !== "review")
 				throw new KernelInvariantError(["review_revision is only valid on review approvals"]);
+			if (approval.reviewer_verdict_sha256 && approval.kind !== "review")
+				throw new KernelInvariantError(["reviewer_verdict_sha256 is only valid on review approvals"]);
 			if (approval.kind === "review") {
 				if (!reviewRevision)
 					throw new KernelInvariantError(["v4 review approval requires review_revision"]);
 				if (reviewRevision.base_head !== record.git_base_head)
 					throw new KernelInvariantError(["review_revision.base_head must equal the Enrollment git_base_head"]);
 			}
-			const { review_revision: storedReviewRevision, ...approvalWithoutRevision } = approval;
+				// Re-emit the optional review-only fields in the strict parser's emission
+			// order so a written attestation stays byte-identical to its parse roundtrip.
+			const {
+				review_revision: storedReviewRevision,
+				advisory_findings: storedAdvisoryFindings,
+				reviewer_verdict_sha256: storedReviewerDigest,
+				...approvalWithoutExtras
+			} = approval;
 			record.attestations.push({
-				...approvalWithoutRevision,
+				...approvalWithoutExtras,
 				acceptance_results: approval.kind === "qa"
 					? record.intent_snapshot.acceptance.map((item) => ({
 						acceptance_id: item.id,
@@ -448,12 +458,15 @@ export function reduceTask(
 					}))
 					: [],
 				...(storedReviewRevision ? { review_revision: storedReviewRevision } : {}),
+				...(storedAdvisoryFindings ? { advisory_findings: storedAdvisoryFindings } : {}),
+				...(storedReviewerDigest ? { reviewer_verdict_sha256: storedReviewerDigest } : {}),
 			});
 			appendHistory(record, action, from, approval.id, authorityAudit);
 			break;
 		}
 		case "revise_intent":
 		case "approve_breaking_intent_revision": {
+			assertValidSpecBinding(action.next_intent);
 			if (record.lifecycle !== "active")
 				throw new KernelInvariantError([
 					`cannot revise intent while lifecycle is ${record.lifecycle}`,

package/plugins/immune-brain/runtime/kernel/spec_binding.ts

@@ -57,6 +57,12 @@ export function readBoundActiveSpec(
 	}
 }
 
+/** Validate a candidate before it can replace enrolled authority. */
+export function assertValidSpecBinding(intent: TaskIntentV1): void {
+	const binding = inspectSpecBinding(intent);
+	if (!binding.ok) throw new KernelInvariantError([binding.message]);
+}
+
 export interface BoundSpec {
 	active: string;
 	archive: string;

package/plugins/immune-brain/runtime/kernel/storage.ts

@@ -53,6 +53,7 @@ import {
 	FILE_STORE_CLAIM_RELATIVE,
 	FILE_STORE_TRANSACTIONS_RELATIVE,
 	FILE_STORE_WORKSPACE_RELATIVE,
+	inspectRetiredStateResidue,
 	stateDatabasePath,
 } from "./storage_paths";
 import { canonicalRecordHash } from "./reducer";
@@ -262,7 +263,7 @@ function isRetiredFileProvablySuperseded(
 /**
  * Refuse mutation while the retired `.imm/state/*.json` file store (or the
  * pre-cutover `.imm/tasks` layout) still holds authority. The check is bounded
- * to `existsSync` paths so it can run on every locked mutation.
+ * to retired paths so it can run on every locked mutation.
  */
 function assertNoRetiredFileStore(
 	root: string,
@@ -270,11 +271,19 @@ function assertNoRetiredFileStore(
 	taskId?: string | null,
 ): void {
 	const canonical = canonicalRoot(root);
+	let residue: ReturnType<typeof inspectRetiredStateResidue>;
+	try {
+		residue = inspectRetiredStateResidue(canonical);
+	} catch (error) {
+		throw new KernelStoreSecurityError(
+			`retired file-store residue is invalid: ${error instanceof Error ? error.message : String(error)}`,
+		);
+	}
 	// Real authority in the retired store: must be imported, never ignored.
 	const retired: Array<[string, string]> = [
 		[".imm/tasks", "pre-cutover task store"],
 		[".imm/workspace.json", "pre-cutover workspace owner"],
-		[".imm/state/tasks", "task records"],
+		...(residue.task_entries.length > 0 ? [[".imm/state/tasks", "task records"] as [string, string]] : []),
 	];
 	for (const [path, label] of retired) {
 		if (existsSync(resolve(canonical, path)))
@@ -293,6 +302,7 @@ function assertNoRetiredFileStore(
 	];
 	for (const [path, label] of derived) {
 		const full = resolve(canonical, path);
+		if (path === FILE_STORE_WORKSPACE_RELATIVE && residue.workspace_owner === null) continue;
 		if (!existsSync(full)) continue;
 		if (db === undefined || typeof taskId !== "string" || taskId.length === 0)
 			throw new KernelStoreSecurityError(
@@ -325,10 +335,16 @@ function retiredFileStoreConflict(
 	taskId: string | null,
 ): string | null {
 	const canonical = canonicalRoot(root);
+	let residue: ReturnType<typeof inspectRetiredStateResidue>;
+	try {
+		residue = inspectRetiredStateResidue(canonical);
+	} catch (error) {
+		return `retired file-store residue is invalid: ${error instanceof Error ? error.message : String(error)}`;
+	}
 	const authority: Array<[string, string]> = [
 		[".imm/tasks", "pre-cutover task store"],
 		[".imm/workspace.json", "pre-cutover workspace owner"],
-		[".imm/state/tasks", "task records"],
+		...(residue.task_entries.length > 0 ? [[".imm/state/tasks", "task records"] as [string, string]] : []),
 	];
 	for (const [path, label] of authority)
 		if (existsSync(resolve(canonical, path)))
@@ -340,7 +356,7 @@ function retiredFileStoreConflict(
 			[FILE_STORE_WORKSPACE_RELATIVE, "workspace owner"],
 		];
 		for (const [path, label] of derived)
-			if (existsSync(resolve(canonical, path)))
+			if ((path !== FILE_STORE_WORKSPACE_RELATIVE || residue.workspace_owner !== null) && existsSync(resolve(canonical, path)))
 				return `retired file-store authority is present (${label}: ${path}); import it with the supported migration before mutating this worktree`;
 	}
 	const transactions = resolve(canonical, FILE_STORE_TRANSACTIONS_RELATIVE);