immune-brain 5.1.0 → 5.1.1

package/plugins/immune-brain/dist/docs/reference/subagent-dispatch-protocol.md

@@ -118,9 +118,11 @@ Agent defaults to the current Pi session model. Only an explicit Parent requirem
 selects another Pi-configured model through host-native `Agent.model`. Kernel
 Review returns a complete foreground `Agent` envelope with empty `name`, `model`,
 `thinking`, `resume`, and `schedule` fields so Pi Host resolves the Review agent
-configuration. The Parent may use any compatible foreground Agent adapter and
-submits the resulting structured verdict directly; lifecycle event matching is
-not part of the local authority contract.
+configuration. A compatible foreground Agent adapter must expose the reserved
+dispatch and its paired result to the host's receipt observer. The Parent submits
+without a verdict to apply those observed bytes; a provided verdict must match
+the correlated receipt. Dispatch/result correlation is part of the local authority
+contract.
 
 ## Pi Agent Invocation
 
@@ -144,12 +146,12 @@ Pi `Agent` has no `readonly` parameter; the empty tool policy, child type, and p
 
 1. Planning、repository exploration、specialist advisory Review 和 work probe 必须 foreground 执行。Parent launches one child at a time，消费 direct terminal result，并在每个结果后 re-evaluates the remaining dispatch budget；不得把多个 foreground Agent 假定为并发 batch。
 2. 普通 interactive advisory 不建立 acknowledgement deadline、后台 progress UI、completion push 或 late-notification recovery。活跃 Agent 使用 Pi 原生 foreground Tool row、host cancellation 和 steer。Footer 保持严格为空；No defined-value `setStatus` call is allowed。
-3. Kernel Assurance runs in the foreground Tool call. `advance_assurance` awaits deterministic QA, emits bounded native updates, and returns `review_ready` with foreground `Agent` parameters. The Parent invokes a reviewer, reads its direct result, and passes the structured verdict to `submit_review`. `request_authorization` is the only literal-user confirmation path. AbortSignal cancellation before authority commit and snapshot/CAS revalidation remain mandatory.
+3. Kernel Assurance runs in the foreground Tool call. `advance_assurance` awaits deterministic QA, emits bounded native updates, and returns `review_ready` with foreground `Agent` parameters. The Parent invokes a reviewer, then calls `submit_review`: omitting the verdict applies the host-observed reviewer receipt, or the Parent may relay the reviewer's structured verdict for fingerprint comparison. `request_authorization` is the only literal-user confirmation path. AbortSignal cancellation before authority commit and snapshot/CAS revalidation remain mandatory.
 4. Kernel Assurance chat uses native Tool rendering only. It does not publish completion messages or wake a later parent turn; the direct Tool result is the continuation boundary. `awaiting_user` remains valid until the host-built authorization operation is confirmed and the immutable snapshot is revalidated.
 5. Child 不得再次派发 child，nested delegation 一律禁止。Parent 保留综合与最终判断责任。
 6. Kernel authority Review 对每个 immutable snapshot 恰好一个 primary reviewer，turn 预算按 workload 缩放（Quick 12 / Standard 16 / Heavy 24），并使用该 snapshot 对应的 Quick/Standard/Heavy 执行档位；不存在从 initial dispatch 起算的单一端到端总预算。Reviewer 必须先验证 immutable v5 manifest 的 `base_head`、`review_commit`、单一 parent、`review_tree` 与 `manifest_digest`，再用只读 Git 命令从 synthetic revision 获取源码；manifest 只有 metadata，不复制 source bytes，也不枚举 neighborhood files。审查只围绕 acceptance assertions 与 `changed_paths`，未变更路径只有在 acceptance、changed caller 或同一 state machine 直接需要时按需读取并注明理由；Reviewer 不探索无关 repository paths。对 settlement-class change，Reviewer 必须先枚举 immutable revision 内每条 terminal、cancellation、timeout 与 race path，再对全部路径给出判断；finding summary 必须以受影响路径开头。每个 acceptance 的执行结果已由 deterministic QA 在 review 前验证并内嵌于 manifest 的 `outcomes` 字段（acceptance_id -> {status, summary}）；Reviewer 不得重跑 descriptor，也不得把本地没有测试运行当作 finding——Review 只审 revision provenance、代码正确性、回归、安全与缺失测试。除该 reviewer 外，同一触发点最多两个相互独立的 advisory/discovery children；它们只能并行读，不能写 workflow state、关闭 QA 或产生 authority。
 7. Foreground assurance never sleeps, polls, or schedules a completion callback. One Tool call owns QA; one Parent turn obtains and submits the reviewer verdict. User authorization is reserved for unresolved decisions, explicit stop, and breaking Intent revisions; no risk tier adds a generic final confirmation.
-8. `submit_review` validates the verdict contract, task identity, immutable snapshot digest, and fresh record/Intent/workspace/diff revisions before applying Review authority. Malformed verdicts are retryable without rebuilding evidence. Stale verdicts leave the TaskRecord unchanged and release the stale reservation. Local execution trusts the Parent to relay the reviewer verdict and does not require Agent lifecycle receipts.
+8. `submit_review` validates the verdict contract, task identity, immutable snapshot digest, and fresh record/Intent/workspace/diff revisions before applying Review authority. An omitted verdict applies the host-observed reviewer receipt bytes (ADR 0017); a relayed verdict must fingerprint-match the observed receipt. Malformed verdicts are retryable without rebuilding evidence. Stale verdicts leave the TaskRecord unchanged and release the stale reservation. Each host adapter observes its own reviewer receipt edge — the Claude host via the dispatch hook log, the Pi host via the generic `Agent` tool events correlated by the reserved prompt digest — and a submission with no recorded receipt fails closed.
 9. The assurance Tool checks the immutable snapshot before each phase and returns a terminal structured state directly: `cancelled`, `rework`, `review_ready`, `awaiting_user`, `blocked`, or `settlement_unknown`. The commit boundary is non-cancellable. No silent task, status timer, completion notification, or result retrieval path is permitted.
 
 ## Result Synthesis
@@ -165,6 +167,6 @@ Parent workflow role 必须：
 
 普通 advisory/discovery 的每次启动都消耗一个 candidate budget slot；失败、取消、timeout 或 result_untrusted 均丢弃该输出且不得自动重试。Parent 仅在剩余候选仍独立有用且 evidence budget 仍需要时继续，否则转 solo/fail-closed fallback，并记录 `dispatch_failed` 或 `child_timeout`。Read-only eligibility 与 Pi 的 one-foreground-child 调度限制是两回事：只读调查可同时存在多个待派发候选，但实际执行仍逐个 foreground child 串行消费，不得把多个 foreground Agent 假定为并发 batch。该规则不改变 Kernel authority Review 的显式恢复协议。Child 永远不获得实现、Plan write、workflow mutation 或 QA closure authority。
 
-If Kernel Review dispatch fails, the Parent does not call `submit_review`; the existing Review reservation and immutable evidence remain available for a later foreground retry. A malformed verdict may be corrected and resubmitted. A stale snapshot, explicit release, successful settlement, or session shutdown removes the reservation and evidence. There is no retry counter, dispatch receipt state machine, or provider-specific recovery path.
+If Kernel Review dispatch fails, the Parent does not call `submit_review`; the existing Review reservation and immutable evidence remain available for a later foreground retry. A malformed verdict may be corrected and resubmitted. A stale snapshot, explicit release, successful settlement, or session shutdown removes the reservation and evidence. There is no retry counter or provider-specific recovery path; the only dispatch record is the receipt a host adapter binds to the reservation for receipt-bound submission.
 
 This protocol is provider- and host-adapter-agnostic for local execution.

package/plugins/immune-brain/dist/imm-planner.md

@@ -175,7 +175,10 @@ and clarification. It does not apply to Enrolled Intent Revision.
 Before authoring a TaskIntent, trace each expected behavior from its public or
 runtime entry point through existing imports and callers to the highest focused
 behavioral tests. Include generated or packaged mirrors and every owner of the
-same state machine. Record the concrete paths in the Spec's discovery evidence when the work is
+same state machine. For configuration changes, follow deployment copies and
+integration assertions; for runtime changes, include the generated Claude bundle
+when it inlines that runtime and the required release changeset. Resolve these
+paths from the build and test references before Enrollment. Record the concrete paths in the Spec's discovery evidence when the work is
 complex; simple TaskIntent-only work records them in `scope_hint`.
 Do not author while a referenced sibling is unresolved. Use the smallest
 coherent module directory for ordinary implementation scope. Keep Kernel,

package/plugins/immune-brain/dist/role-prompts/code-review.md

@@ -53,6 +53,16 @@ seam, or a seam silently replaced by a different one, is a finding carrying
 named, its absence is not a finding: candidates written before this rule carries
 no defect for lacking one.
 
+Before pass, enumerate the immutable change set and read each complete per-file
+diff, including deletions. Page bounded reads until every hunk is visible; a
+truncated aggregate output or summary is incomplete coverage. Trace changed
+high-risk behavior through its callers and state owner, and inspect a concrete
+negative case against the embedded acceptance. If immutable evidence remains
+unavailable or incomplete, report the concrete acceptance coverage gap in a
+rework finding with required evidence. `inspected_paths` declares coverage; it
+does not itself prove tool reading. Judge quality by evidence, not elapsed time
+or tool-call count.
+
 A required check that is skipped, that matches zero tests, or whose prerequisite
 is absent does not prove the acceptance; do not accept it as evidence. Full
 suite coverage reported at a coarse pass count is not per-invariant evidence.

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -350,6 +350,18 @@ export type AssuranceSubmitReviewResult = AssuranceRecoveryFields & (
 	| { state: "settlement_unknown"; operation: "qa" | "review"; operation_id: string; reason: string }
 	| { state: "blocked"; reason: string; code?: "verdict_invalid"; recovery_action?: string });
 
+/**
+ * ADR 0017: optional metadata a host adapter supplies alongside the verdict
+ * input. The coordinator threads it opaquely; it never resolves verdict sources.
+ */
+export interface ReviewSubmissionOptions {
+	/** sha256 over the reviewer's own result bytes, bound into the review attestation. */
+	reviewer_verdict_sha256?: string;
+	/** Synchronous host check immediately before the reservation is consumed. */
+	validateReceipt?: () => string | null;
+	receiptRecoveryAction?: string;
+}
+
 export type ActiveAssuranceState =
 	| { state: "running"; operation: "qa"; operation_id: string; deadline_seconds: number }
 	| { state: "review_ready"; operation: "review"; operation_id: string }
@@ -559,7 +571,10 @@ function parseVerdictEvidence(value: unknown, index: number): FindingEvidence {
 export function parseAssuranceVerdict(input: unknown, snapshot: SnapshotDescriptor): AssuranceVerdict {
 	let raw: Record<string, unknown>;
 	if (typeof input === "string") {
-		const cleaned = input.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("{") && line.endsWith("}")).join("");
+		// Agent transport prefixes a status line to the strict JSON verdict.
+		const first = input.indexOf("{");
+		const last = input.lastIndexOf("}");
+		const cleaned = first >= 0 && last >= first ? input.slice(first, last + 1) : "";
 		if (!cleaned) throw new Error("reviewer returned no strict JSON verdict");
 		try { raw = JSON.parse(cleaned) as Record<string, unknown>; } catch { throw new Error("reviewer verdict is not valid JSON"); }
 	} else if (typeof input === "object" && input !== null && !Array.isArray(input)) {
@@ -1192,11 +1207,11 @@ export class AssuranceCoordinator {
 		}
 	}
 
-	async submitReview(taskId: string, ctx: HostContext, verdictInput: unknown): Promise<AssuranceSubmitReviewResult> {
-		return this.withRecovery(taskId, ctx, await this.submitReviewOnce(taskId, ctx, verdictInput));
+	async submitReview(taskId: string, ctx: HostContext, verdictInput: unknown, options?: ReviewSubmissionOptions): Promise<AssuranceSubmitReviewResult> {
+		return this.withRecovery(taskId, ctx, await this.submitReviewOnce(taskId, ctx, verdictInput, options));
 	}
 
-	private async submitReviewOnce(taskId: string, ctx: HostContext, verdictInput: unknown): Promise<AssuranceSubmitReviewResult> {
+	private async submitReviewOnce(taskId: string, ctx: HostContext, verdictInput: unknown, options?: ReviewSubmissionOptions): Promise<AssuranceSubmitReviewResult> {
 		const unknown = this.unknownOperations.get(taskId);
 		if (unknown) return { state: "settlement_unknown", operation: unknown.operation, operation_id: unknown.operationId, reason: unknown.reason };
 		const rejected = this.rejectedReviewOperations.get(taskId);
@@ -1233,6 +1248,8 @@ export class AssuranceCoordinator {
 			reservation.verdictCorrectionRequired = true;
 			return { state: "blocked", code: "verdict_invalid", reason: boundedAssuranceError(error) };
 		}
+		const receiptError = options?.validateReceipt?.();
+		if (receiptError) return { state: "blocked", reason: receiptError, ...(options?.receiptRecoveryAction ? { recovery_action: options.receiptRecoveryAction } : {}) };
 		const invocation = this.openInvocation(taskId);
 		this.releaseReviewReservation(taskId, reservation);
 		try {
@@ -1242,6 +1259,7 @@ export class AssuranceCoordinator {
 				verdict,
 				invocation,
 				actorId: "parent-mediated-review",
+				...(options?.reviewer_verdict_sha256 ? { reviewer_verdict_sha256: options.reviewer_verdict_sha256 } : {}),
 			});
 		} catch (error) {
 			const reason = boundedAssuranceError(error);

package/plugins/immune-brain/runtime/assurance/review_mediation.ts

@@ -0,0 +1,107 @@
+// Host-neutral Review submission mediation (ADR 0017).
+//
+// Both host adapters resolve the verdict source before the shared submit path:
+// the Parent's relayed bytes when provided, or the host-observed reviewer
+// receipt when the verdict is omitted. The Parent keeps exclusive trigger
+// authority; only the transcription step is optional. The coordinator itself
+// stays single-verdict-input and never knows where the bytes came from.
+
+import { createHash } from "node:crypto";
+import type { AssuranceCoordinator, AssuranceSubmitReviewResult, HostContext } from "./coordinator";
+
+export function extractVerdictJson(input: unknown): Record<string, unknown> | null {
+	if (typeof input === "string") {
+		// Agent transport prefixes a status line to the strict JSON verdict.
+		const first = input.indexOf("{");
+		const last = input.lastIndexOf("}");
+		const cleaned = first >= 0 && last >= first ? input.slice(first, last + 1) : "";
+		if (!cleaned) return null;
+		try { return JSON.parse(cleaned) as Record<string, unknown>; } catch { return null; }
+	}
+	if (typeof input === "object" && input !== null && !Array.isArray(input)) return input as Record<string, unknown>;
+	return null;
+}
+
+function verdictFingerprint(raw: Record<string, unknown>): string {
+	return JSON.stringify({
+		contract: raw.contract ?? null,
+		role: raw.role ?? null,
+		task_id: raw.task_id ?? null,
+		snapshot_digest: raw.snapshot_digest ?? null,
+		decision: raw.decision ?? null,
+		approval: raw.approval ?? null,
+		findings: raw.findings ?? null,
+	});
+}
+
+/** sha256 over the reviewer's own result bytes, bound into the review attestation. */
+export function digestOfReviewerBytes(bytes: string): string {
+	return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+
+/** The host-observation shape both adapters supply; mirrors ClaudeReviewHost's. */
+export type ReviewObservation =
+	| { ok: true; receipt: { actorId: string; result: string } }
+	| { ok: false; release: boolean; reason: string };
+
+const RELEASED_REVIEW_RECOVERY =
+	"Call advance_assurance to obtain a new Review reservation, then dispatch one fresh reviewer with the returned envelope unchanged";
+const RETAINED_REVIEW_RECOVERY =
+	"Wait for the dispatched reviewer to finish, then call submit_review again with its verdict; do not dispatch or continue another reviewer";
+const MISMATCH_REVIEW_RECOVERY =
+	"Resubmit without a verdict to apply the observed reviewer receipt, or resubmit the reviewer's verdict exactly as the reviewer returned it";
+
+function withReviewRecovery(
+	result: AssuranceSubmitReviewResult,
+	recovery_action: string,
+): AssuranceSubmitReviewResult {
+	if (result.state !== "blocked" || result.code === "verdict_invalid") return result;
+	return { ...result, recovery_action };
+}
+
+export async function submitMediatedReview(
+	coordinator: AssuranceCoordinator,
+	ctx: HostContext,
+	taskId: string,
+	verdictInput: unknown,
+	inspect: () => ReviewObservation,
+): Promise<AssuranceSubmitReviewResult> {
+	// Preserve uncertain authority settlement before inspecting a released receipt.
+	if (coordinator.active(taskId)?.state === "settlement_unknown") {
+		return coordinator.submitReview(taskId, ctx, verdictInput);
+	}
+	const observed = inspect();
+	if (!observed.ok) {
+		if (observed.release) return withReviewRecovery(coordinator.abandonReview(taskId, observed.reason), RELEASED_REVIEW_RECOVERY);
+		return { state: "blocked", reason: observed.reason, recovery_action: RETAINED_REVIEW_RECOVERY };
+	}
+	const receiptBytes = observed.receipt.result;
+	const options = {
+		receiptRecoveryAction: RETAINED_REVIEW_RECOVERY,
+		reviewer_verdict_sha256: digestOfReviewerBytes(receiptBytes),
+		validateReceipt: () => {
+			const current = inspect();
+			if (!current.ok) return current.reason;
+			return current.receipt.actorId === observed.receipt.actorId && current.receipt.result === receiptBytes
+				? null : "reviewer receipt changed during submission";
+		},
+	};
+	if (verdictInput === undefined) {
+		// ADR 0017: the host-observed reviewer bytes are the submission.
+		if (!coordinator.isReviewVerdictValid(taskId, receiptBytes)) {
+			return withReviewRecovery(coordinator.abandonReview(taskId, "reviewer receipt is not a valid verdict"), RELEASED_REVIEW_RECOVERY);
+		}
+		return coordinator.submitReview(taskId, ctx, receiptBytes, options);
+	}
+	const parentValid = coordinator.isReviewVerdictValid(taskId, verdictInput);
+	if (!parentValid) return coordinator.submitReview(taskId, ctx, verdictInput);
+	if (!coordinator.isReviewVerdictValid(taskId, receiptBytes)) {
+		return withReviewRecovery(coordinator.abandonReview(taskId, "reviewer receipt is not a valid verdict"), RELEASED_REVIEW_RECOVERY);
+	}
+	const parentJson = extractVerdictJson(verdictInput);
+	const receiptJson = extractVerdictJson(receiptBytes);
+	if (!parentJson || !receiptJson || verdictFingerprint(parentJson) !== verdictFingerprint(receiptJson)) {
+		return { state: "blocked", reason: "parent verdict does not match reviewer receipt", recovery_action: MISMATCH_REVIEW_RECOVERY };
+	}
+	return coordinator.submitReview(taskId, ctx, verdictInput, options);
+}

package/plugins/immune-brain/runtime/assurance/verdict_authority.ts

@@ -272,6 +272,8 @@ export interface VerdictApplicationInput {
  verdict: AssuranceVerdict;
  invocation: InvocationToken;
  actorId: string;
+ /** ADR 0017: sha256 over the reviewer's own result bytes, bound only on review attestations. */
+ reviewer_verdict_sha256?: string;
  hooks?: { beforeCommit?: () => Promise<void>; onCommit?: () => void; afterCommit?: () => Promise<void> };
 }
 export interface VerdictAuthority {
@@ -310,6 +312,7 @@ export function createVerdictAuthority(options: {
     diff_hash: snapshot.diff_hash, actor_id: actorId, summary: verdict.approval!.summary,
     ...(snapshot.role === "review" && snapshot.review_revision ? { review_revision: snapshot.review_revision } : {}),
     ...(snapshot.role === "review" && advisories.length ? { advisory_findings: advisories } : {}),
+    ...(snapshot.role === "review" && input.reviewer_verdict_sha256 ? { reviewer_verdict_sha256: input.reviewer_verdict_sha256 } : {}),
    } : undefined;
    const op = verdict.decision === "rework" ? "request_rework" : "record_approval";
    const payload = approval ? { approval } : { findings };

package/plugins/immune-brain/runtime/claude/interaction.ts

@@ -6,6 +6,7 @@ export const PRIVILEGED_OPERATIONS = [
 	"approve_breaking_intent_revision",
 	"stop",
 	"start_unattended_batch",
+	"retire_stale_batch",
 ] as const;
 
 export type PrivilegedOperation = (typeof PRIVILEGED_OPERATIONS)[number];
@@ -89,6 +90,15 @@ export interface NativeConfirmationInput {
 			serialized: Array<{ task_id: string; overlaps_with: string[] }>;
 		};
 	};
+	/** Present only for a batch disposition: the record the user is asked to retire. */
+	batchDisposition?: {
+		batch_id: string;
+		batch_state: string;
+		batch_branch: string;
+		plan_digest: string;
+		recorded_commits: number;
+		children: Array<{ task_id: string; slice_id: string; state: string; commit: string | null; lane_branch: string | null }>;
+	};
 	signal?: AbortSignal;
 }
 

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -58,6 +58,8 @@ import {
 } from "../unattended/batch_runner";
 import { createBatchKernelPort } from "../unattended/batch_kernel_port";
 import type { LaneOffer } from "../unattended/batch_lanes";
+import { retireStaleBatch } from "../unattended/batch_disposition";
+import type { BatchLaneRunReport } from "../unattended/batch_state";
 import {
 	createBatchAuthorityRegistry,
 } from "../kernel/batch_authority";
@@ -107,42 +109,11 @@ function readTaskIntentForRecord(root: string, taskId: string) {
 	return readTaskIntent(root, taskId, currentPath);
 }
 
-function extractVerdictJson(input: unknown): Record<string, unknown> | null {
-	if (typeof input === "string") {
-		const cleaned = input.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("{") && line.endsWith("}")).join("");
-		if (!cleaned) return null;
-		try { return JSON.parse(cleaned) as Record<string, unknown>; } catch { return null; }
-	}
-	if (typeof input === "object" && input !== null && !Array.isArray(input)) return input as Record<string, unknown>;
-	return null;
-}
-
-function verdictFingerprint(raw: Record<string, unknown>): string {
-	return JSON.stringify({
-		contract: raw.contract ?? null,
-		role: raw.role ?? null,
-		task_id: raw.task_id ?? null,
-		snapshot_digest: raw.snapshot_digest ?? null,
-		decision: raw.decision ?? null,
-		approval: raw.approval ?? null,
-		findings: raw.findings ?? null,
-	});
-}
-
-const RELEASED_REVIEW_RECOVERY =
-	"Call advance_assurance to obtain a new Review reservation, then dispatch one fresh reviewer with the returned envelope unchanged";
-const RETAINED_REVIEW_RECOVERY =
-	"Wait for the dispatched reviewer to finish, then call submit_review again with its verdict; do not dispatch or continue another reviewer";
-const MISMATCH_REVIEW_RECOVERY =
-	"Resubmit the reviewer's verdict exactly as the reviewer returned it";
-
-function withReviewRecovery(
-	result: AssuranceSubmitReviewResult,
-	recovery_action: string,
-): AssuranceSubmitReviewResult {
-	if (result.state !== "blocked" || result.code === "verdict_invalid") return result;
-	return { ...result, recovery_action };
-}
+import {
+	extractVerdictJson,
+	submitMediatedReview,
+} from "../assurance/review_mediation";
+export { extractVerdictJson };
 
 export async function submitClaudeReview(
 	host: ClaudeReviewHost,
@@ -151,24 +122,8 @@ export async function submitClaudeReview(
 	taskId: string,
 	verdictInput: unknown,
 ): Promise<AssuranceSubmitReviewResult> {
-	if (verdictInput === undefined) throw new Error("verdict is required");
-	const observed = host.inspectReviewForTask(taskId);
-	if (!observed.ok) {
-		if (observed.release) return withReviewRecovery(coordinator.abandonReview(taskId, observed.reason), RELEASED_REVIEW_RECOVERY);
-		return { state: "blocked", reason: observed.reason, recovery_action: RETAINED_REVIEW_RECOVERY };
-	}
-	const parentValid = coordinator.isReviewVerdictValid(taskId, verdictInput);
-	if (!parentValid) return coordinator.submitReview(taskId, ctx, verdictInput);
-	const receiptValid = coordinator.isReviewVerdictValid(taskId, observed.receipt.result);
-	if (!receiptValid) {
-		return withReviewRecovery(coordinator.abandonReview(taskId, "reviewer receipt is not a valid verdict"), RELEASED_REVIEW_RECOVERY);
-	}
-	const parentJson = extractVerdictJson(verdictInput)!;
-	const receiptJson = extractVerdictJson(observed.receipt.result)!;
-	if (verdictFingerprint(parentJson) !== verdictFingerprint(receiptJson)) {
-		return { state: "blocked", reason: "parent verdict does not match reviewer receipt", recovery_action: MISMATCH_REVIEW_RECOVERY };
-	}
-	return coordinator.submitReview(taskId, ctx, verdictInput);
+	// ADR 0017: an omitted verdict applies the hook-observed reviewer receipt.
+	return submitMediatedReview(coordinator, ctx, taskId, verdictInput, () => host.inspectReviewForTask(taskId));
 }
 
 /**
@@ -285,6 +240,7 @@ export interface ClaudeRuntimeOptions {
  */
 type ClaudeBatchStartResult =
 	| { state: "started"; batch_id: string; report: BatchRunReport }
+	| { state: "retired"; batch_id: string; report: BatchRunReport | BatchLaneRunReport }
 	| { state: "rejected"; reason: string; recovery_action: string }
 	| { state: "cancelled"; reason: string; recovery_action: string }
 	| { state: "blocked"; reason: string; recovery_action: string };
@@ -994,6 +950,85 @@ export class ClaudeRuntime {
 			report,
 		};
 	}
+
+	/**
+	 * The batch disposition. One explicit literal-user decision retires a record
+	 * the plan moved past: the terminal superseded state and its report preserve
+	 * every child state, recorded commit and the batch branch, and no child is
+	 * re-enrolled, handed off, or credited with delivery it never had.
+	 */
+	async retireStaleBatch(initiativeSlug: string, meta: ToolMeta): Promise<ClaudeBatchStartResult> {
+		throwIfCancelled(meta.signal);
+		const probe = probeHost(this.env, process.platform, this.hostVersion);
+		if (!probe.ok) throw new NativeAuthorityError("unsupported_host", probe.reason);
+		// The disposition always opens a gate, so it needs a confirmation port.
+		if (!this.requestConfirmation)
+			throw new NativeAuthorityError("interaction_not_opened", batchReason("confirmation_port_unavailable").reason);
+		const outcome = await retireStaleBatch<ClaudeBatchStartResult>({
+			root: this.cwd,
+			initiative_slug: initiativeSlug,
+			now: new Date().toISOString(),
+			gate: async (facts) => {
+				let confirmationResult: { decision: NativeDecision; requestId: string };
+				try {
+					confirmationResult = await this.requestConfirmation!({
+						operation: "retire_stale_batch",
+						initiativeSlug,
+						toolCallId: meta.toolCallId,
+						batchDisposition: {
+							batch_id: facts.batch_id,
+							batch_state: facts.batch_state,
+							batch_branch: facts.branch,
+							plan_digest: facts.plan_digest,
+							recorded_commits: facts.recorded_commits.length,
+							children: facts.children.map((child) => ({
+								task_id: child.task_id,
+								slice_id: child.slice_id,
+								state: child.state,
+								commit: child.commit,
+								lane_branch: child.lane_branch,
+							})),
+						},
+						signal: meta.signal,
+					});
+				} catch (err) {
+					if (meta.signal?.aborted)
+						return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
+					if (err instanceof NativeAuthorityError) {
+						if (err.reasonCode === "unsupported_host") throw err;
+						if (err.reasonCode === "user_cancelled") {
+							return {
+								kind: "host_rejection",
+								value: { state: "cancelled", reason: err.message, recovery_action: err.recoveryAction },
+							};
+						}
+						return {
+							kind: "host_rejection",
+							value: { state: "rejected", reason: err.message, recovery_action: err.recoveryAction },
+						};
+					}
+					return {
+						kind: "host_rejection",
+						value: batchReason("confirmation_failed", err instanceof Error ? err.message : String(err)),
+						};
+				}
+				if (confirmationResult.decision === "cancel" && meta.signal?.aborted)
+					return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
+				if (meta.signal?.aborted)
+					return { kind: "host_rejection", value: batchReason("cancelled_before_execution") };
+				if (confirmationResult.decision === "decline")
+					return { kind: "host_rejection", value: batchReason("confirmation_declined") };
+				if (confirmationResult.decision === "cancel")
+					return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
+				if (confirmationResult.decision !== "accept")
+					return { kind: "host_rejection", value: batchReason("confirmation_no_decision") };
+				return { kind: "confirmed", request_id: confirmationResult.requestId };
+			},
+		});
+		if (outcome.outcome === "host_rejection") return outcome.value;
+		if (outcome.outcome === "rejected") return outcome.rejection;
+		return { state: "retired", batch_id: outcome.batch_id, report: outcome.report };
+	}
 }
 
 export interface ToolMeta {

package/plugins/immune-brain/runtime/claude/mcp_server.ts

@@ -22,12 +22,13 @@ export const TOOLS = [
 	{ name: "status", description: "Read the Kernel Assurance Projection for an exact task.", privileged: false },
 	{ name: "enroll", description: "Enroll a Git-tracked TaskIntent after native confirmation.", privileged: true },
 	{ name: "advance_assurance", description: "Advance frozen Assurance through deterministic QA and Review reservation.", privileged: false },
-	{ name: "submit_review", description: "Submit the Parent-mediated Review verdict bound to the correlated receipt.", privileged: false },
+	{ name: "submit_review", description: "Submit the Review verdict; omit the verdict to apply the correlated reviewer receipt, or relay the reviewer's structured verdict for fingerprint comparison.", privileged: false },
 	{ name: "request_authorization", description: "Apply exact literal-user authorization.", privileged: true },
 	{ name: "revise_intent", description: "Apply a compatible TaskIntent revision.", privileged: false },
 	{ name: "approve_breaking_intent_revision", description: "Approve a breaking TaskIntent revision.", privileged: true },
 	{ name: "stop", description: "Stop the active task with literal-user authority.", privileged: true },
 	{ name: "start_unattended_batch", description: "Start an unattended serial batch run for an Initiative after native confirmation.", privileged: true },
+	{ name: "retire_stale_batch", description: "Retire an Initiative's parked or drifted batch record to the terminal superseded state after native confirmation.", privileged: true },
 	{ name: "repair_authority_state", description: "Repair a proven recoverable stale backend claim.", privileged: false },
 	{ name: "resolve_finding", description: "Resolve one open blocking or advisory finding whose cause is fixed and verified.", privileged: false },
 	{ name: "refute_finding", description: "Refute one open finding by binding the fresh passing QA attestation that contradicts it.", privileged: false },
@@ -40,20 +41,24 @@ export function listMcpTools() {
 		inputSchema: {
 			type: "object",
 			properties: {
-				...(tool.name === "start_unattended_batch"
+				...(tool.name === "start_unattended_batch" || tool.name === "retire_stale_batch"
 					? {
 						initiative_slug: { type: "string" },
-						max_parallel: { type: "integer", minimum: 1 },
-						lane_offers: {
-							type: "array",
-							items: {
-								type: "object",
-								properties: { task_id: { type: "string" }, path: { type: "string" } },
-								required: ["task_id", "path"],
-								additionalProperties: false,
-							},
-						},
-					}
+						...(tool.name === "start_unattended_batch"
+							? {
+									max_parallel: { type: "integer", minimum: 1 },
+									lane_offers: {
+										type: "array",
+										items: {
+											type: "object",
+											properties: { task_id: { type: "string" }, path: { type: "string" } },
+											required: ["task_id", "path"],
+											additionalProperties: false,
+										},
+									},
+								}
+							: {}),
+						}
 					: {
 						task_id: { type: "string" },
 						...(tool.name === "approve_breaking_intent_revision" || tool.name === "revise_intent" ? { next_intent: { type: "object" } } : {}),
@@ -63,17 +68,15 @@ export function listMcpTools() {
 						...(tool.name === "refute_finding" ? { finding_id: { type: "string" }, attestation_id: { type: "string" } } : {}),
 					}),
 			},
-			required: tool.name === "start_unattended_batch"
+			required: tool.name === "start_unattended_batch" || tool.name === "retire_stale_batch"
 				? ["initiative_slug"]
-				: tool.name === "submit_review"
-					? ["task_id", "verdict"]
-					: tool.name === "resolve_finding"
-						? ["task_id", "finding_id"]
-						: tool.name === "refute_finding"
-							? ["task_id", "finding_id", "attestation_id"]
-							: tool.name === "revise_intent"
-								? ["task_id", "next_intent"]
-								: ["task_id"],
+				: tool.name === "resolve_finding"
+					? ["task_id", "finding_id"]
+					: tool.name === "refute_finding"
+						? ["task_id", "finding_id", "attestation_id"]
+						: tool.name === "revise_intent"
+							? ["task_id", "next_intent"]
+							: ["task_id"],
 		},
 		annotations: tool.privileged ? privilegedAnnotations() : { readOnlyHint: tool.name === "status" },
 	}));
@@ -156,6 +159,26 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 					...(laneOffers !== undefined ? { lane_offers: laneOffers } : {}),
 				});
 			}
+			if (name === "retire_stale_batch") {
+				const initiativeSlug = String(args.initiative_slug ?? "");
+				if (!initiativeSlug) throw new Error("initiative_slug is required");
+				if ("native_decision" in args) throw new Error("native_decision cannot be supplied in tool arguments");
+				if (!negotiatedVersion) throw new NativeAuthorityError("unsupported_host", "Claude Code version is unavailable");
+				if (!negotiatedInteractive) {
+					throw new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable");
+				}
+				const probe = probeHost(options.env ?? process.env, process.platform, negotiatedVersion);
+				if (!probe.ok) throw new NativeAuthorityError("unsupported_host", probe.reason);
+				const toolMeta: ToolMeta = {
+					sessionId: meta.sessionId ?? connectionId,
+					toolCallId: meta.toolCallId ?? `call-${name}`,
+					taskId: initiativeSlug,
+					initiativeSlug,
+					interactive: meta.interactive ?? options.interactive ?? negotiatedInteractive,
+					signal: meta.signal,
+				};
+				return runtime.retireStaleBatch(initiativeSlug, toolMeta);
+			}
 			const taskId = String(args.task_id ?? "");
 			if (!taskId) throw new Error("task_id is required");
 			if ("native_decision" in args) throw new Error("native_decision cannot be supplied in tool arguments");
@@ -183,8 +206,8 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 			if (name === "enroll") return runtime.enroll(taskId, toolMeta);
 			if (name === "advance_assurance") return runtime.advance(taskId, toolMeta.signal, toolMeta);
 			if (name === "submit_review") {
-				if (!Object.hasOwn(args, "verdict")) throw new Error("verdict is required");
-				return runtime.submitReview(taskId, args.verdict, toolMeta);
+				// ADR 0017: an absent verdict is the receipt-bound submission.
+				return runtime.submitReview(taskId, Object.hasOwn(args, "verdict") ? args.verdict : undefined, toolMeta);
 			}
 			if (name === "revise_intent") {
 				if (!Object.hasOwn(args, "next_intent")) throw new Error("next_intent is required");
@@ -381,6 +404,34 @@ async function writeReply(output: Writable, reply: JsonRpc): Promise<void> {
 }
 
 export function elicitationParams(input: NativeConfirmationInput) {
+	if (input.operation === "retire_stale_batch") {
+		const d = input.batchDisposition;
+		const details = [
+			`Operation: retire_stale_batch`,
+			`Initiative: ${input.initiativeSlug}`,
+			d ? `Batch: ${d.batch_id}` : null,
+			d ? `Batch state: ${d.batch_state}` : null,
+			d ? `Batch branch: ${d.batch_branch}` : null,
+			d ? `Plan digest: ${d.plan_digest}` : null,
+			d ? `Recorded child commits: ${d.recorded_commits}` : null,
+			d
+				? `Children (${d.children.length}):\n${d.children
+						.map(
+							(child) =>
+								`  - ${child.task_id} (${child.slice_id}) [state: ${child.state}]${child.commit ? ` [commit: ${child.commit}]` : " [no commit]"}${child.lane_branch ? ` [lane: ${child.lane_branch}]` : ""}`,
+						)
+						.join("\n")}`
+				: null,
+			"Retiring writes this record to the terminal superseded state. Child states, recorded commits and the batch branch are preserved as evidence; nothing is deleted and no batch trailer or approval is manufactured.",
+			"A child without a commit was never executed by this batch: it carries no delivery evidence, and the retired authorization is never reused for a revised plan.",
+			"After retiring, run each remaining child with imm-run under its own authorization, or start a new batch for this Initiative.",
+		].filter(Boolean);
+		return {
+			mode: "form",
+			message: `Retire this stale batch record for ${input.initiativeSlug}?\n\n${details.join("\n")}`,
+			requestedSchema: { type: "object", properties: {} },
+		};
+	}
 	if (input.operation === "start_unattended_batch") {
 		const b = input.batchDetails;
 		const details = [

package/plugins/immune-brain/runtime/kernel/assurance_projection.ts

@@ -21,6 +21,7 @@ import {
 	reconcileKernelAuthority,
 } from "./storage";
 import { projectTask, resolveProjectedRisk } from "./completion";
+import { inspectSpecBinding } from "./spec_binding";
 import { taskDeliveryIdentity } from "../workspace_scope";
 import type { AssuranceObligation, TaskIntentV1, TaskRecord, TaskRecordV3 } from "./types";
 import type { TaskRecordV2 } from "./legacy_task_record";
@@ -236,7 +237,9 @@ function projectFromRecord(
 		independence_violations: decision.independence_violations,
 		open_user_decision_count: openUserDecisionCount,
 		completion_ready: decision.complete,
-		authorization: deriveAssuranceAuthorization({
+		authorization: !inspectSpecBinding(intent).ok
+			? { state: "none", blocked: "invalid Spec binding requires a valid breaking intent revision" }
+			: deriveAssuranceAuthorization({
 			next_obligation: decision.next_obligation,
 			open_user_decision_count: openUserDecisionCount,
 		}),