immune-brain 5.1.0 → 5.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "5.1.0",
+  "version": "5.1.2",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "5.1.0",
+  "version": "5.1.2",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -130,6 +130,8 @@ import {
 	type GithubTrackerResult,
 } from "../runtime/github_issue_tracker";
 import { reviewReworkFindings } from "../runtime/assurance/coordinator";
+import { laneWriteRefusal } from "../runtime/unattended/lane_workspace";
+import { activeTaskNotice } from "../runtime/assurance/active_task_notice";
 
 const LOOP_OWNERS = ["plan", "kernel", "brainstorm", "planner", "loop"] as const;
 const LOOP_TARGETS = [
@@ -371,8 +373,20 @@ export default function (
 		if (ctx.mode !== "tui") return;
 		await refreshTaskRail(ctx);
 	});
-	pi.on("tool_call", (event: { toolName?: string; input?: unknown }, ctx?: ExtensionContext) => {
+	pi.on("before_agent_start", async (event: { prompt?: string; systemPrompt?: string }, ctx?: ExtensionContext) => {
+		// Advisory only: an active Managed task is announced, never resumed.
+		const notice = await activeTaskNotice(ctx?.cwd ?? process.cwd());
+		if (!notice || typeof event.systemPrompt !== "string") return undefined;
+		return { systemPrompt: `${event.systemPrompt}\n\n${notice}` };
+	});
+	pi.on("tool_call", (event: { toolName?: string; input?: unknown; toolCallId?: string }, ctx?: ExtensionContext) => {
 		if (ctx) railContext = ctx;
+		const laneRefusal = laneEditRefusal(event, ctx?.cwd ?? process.cwd());
+		if (laneRefusal) return { block: true, reason: laneRefusal };
+		if (event.toolName === "Agent") {
+			// ADR 0017: correlate a reserved reviewer dispatch to its reservation.
+			progression.piReviewHost.observeReviewDispatch(event.input as { prompt?: unknown; subagent_type?: unknown } | undefined, event.toolCallId);
+		}
 		if (event.toolName === "imm_canary_enrollment" && ctx) {
 			const input = event.input as { task_id?: string } | undefined;
 			if (input?.task_id) presentTaskRail(ctx, {
@@ -385,7 +399,14 @@ export default function (
 	});
 	pi.on("tool_result", (event: unknown, ctx?: ExtensionContext) => {
 		if (ctx) railContext = ctx;
-		const result = event as { toolName?: string; details?: Record<string, unknown> };
+		const result = event as { toolName?: string; details?: Record<string, unknown>; toolCallId?: string; content?: Array<{ type?: string; text?: string }> };
+		if (result.toolName === "Agent" && result.toolCallId) {
+			// ADR 0017: record the reviewer's own result bytes for receipt-bound submission.
+			const text = Array.isArray(result.content)
+				? result.content.filter((part) => typeof part?.text === "string").map((part) => part.text as string).join("\n")
+				: "";
+			progression.piReviewHost.observeReviewResult(result.toolCallId, text);
+		}
 		if (result.toolName === "imm_canary_enrollment" && ctx) {
 			const taskId = typeof result.details?.task_id === "string" ? result.details.task_id : undefined;
 			if (taskId) presentTaskRailResult(ctx, taskId, result.details);
@@ -406,7 +427,7 @@ export default function (
 		promptGuidelines: [
 			"Only the exact enrolled canary task is routable; verify the active backend claim first via status.",
 			"After implementation and focused verification, freeze the artifacts, call advance_assurance, and consume its direct terminal result; do not poll or create a detached job.",
-			"When advance_assurance returns review_ready, invoke the foreground Agent from agent_params once, then pass its structured verdict to submit_review.",
+			"When advance_assurance returns review_ready, invoke the foreground Agent from agent_params once, then call submit_review: omit the verdict to apply the observed reviewer result, or relay its structured verdict exactly.",
 			"For a complete breaking revision, call approve_breaking_intent_revision with the complete next_intent directly; do not ask for chat pre-confirmation because the host opens the single native confirmation before applying it.",
 			"For a proven stale authority claim, call repair_authority_state directly; the Kernel revalidates and removes only the redundant claim without user interaction.",
 			"After awaiting_user, call request_authorization directly so the host opens the single native confirmation; do not ask for chat pre-confirmation or ask the user to copy or report a command.",
@@ -416,7 +437,7 @@ export default function (
 			action: Type.Union([
 				Type.Object({ op: Type.Literal("status") }),
 				Type.Object({ op: Type.Literal("advance_assurance") }),
-				Type.Object({ op: Type.Literal("submit_review"), verdict: Type.Unknown() }),
+				Type.Object({ op: Type.Literal("submit_review"), verdict: Type.Optional(Type.Unknown()) }),
 				Type.Object({ op: Type.Literal("request_authorization") }),
 				Type.Object({ op: Type.Literal("request_stop") }),
 				Type.Object({ op: Type.Literal("repair_authority_state") }),
@@ -549,7 +570,7 @@ export default function (
 						presentTaskRailResult(ctx, taskId, update.details as Record<string, unknown> | undefined);
 					})
 					: action.op === "submit_review"
-						? await progression.submitReview(taskId, ctx, action.verdict)
+						? await progression.submitMediated(taskId, ctx, action.verdict)
 						: action.op === "approve_breaking_intent_revision"
 							? await authorizeExactOperation(
 								taskId,
@@ -1151,6 +1172,16 @@ export function readTaskIntentForRecord(root: string, taskId: string): ReadTaskI
 	return readTaskIntent(root, taskId, currentPath);
 }
 
+/**
+ * In a batch Lane, an `edit` or `write` whose resolved target is outside the
+ * Lane is refused before it runs; `bash` is not intercepted.
+ */
+export function laneEditRefusal(event: { toolName?: string; input?: unknown }, cwd: string): string | null {
+	if (event.toolName !== "edit" && event.toolName !== "write") return null;
+	const input = (event.input ?? {}) as { path?: unknown; file_path?: unknown };
+	return laneWriteRefusal(cwd, input.path ?? input.file_path);
+}
+
 async function markGithubTaskTerminal(
 	root: string,
 	input: { task_id: string; phase: "done" | "stopped"; terminal_event_id: string },
@@ -1509,6 +1540,7 @@ async function enrichAssuranceResult(
 function nextActionForAssuranceResult(result: Record<string, unknown>, taskState: AssuranceTaskState): string {
 	const derived = result.recovery as { next_action: string } | undefined;
 	if (derived) return derived.next_action;
+	if (typeof result.recovery_action === "string") return result.recovery_action;
 	const recovery = recoveryActionForAssuranceFailure(
 		"error" in taskState ? taskState.error : result.reason,
 	);

package/plugins/immune-brain/.pi-extension/imm-unattended-batch.ts

@@ -15,17 +15,23 @@ import {
 	startBatch,
 	type BatchRunnerKernelPort,
 	type BatchRunReport,
+	type BatchTrackerPort,
 } from "../runtime/unattended/batch_runner";
 import { createBatchKernelPort } from "../runtime/unattended/batch_kernel_port";
 import type { BatchRunnerGitPort } from "../runtime/unattended/batch_git";
 import type { InitiativeObservationReader } from "../runtime/unattended/types";
 import { advancePiTask } from "./imm-canary-work";
 import { batchReason } from "../runtime/unattended/batch_reasons";
-import { parseLaneOffers, parseMaxParallel, resolveLaneParallel, type LaneOffer } from "../runtime/unattended/batch_lanes";
+import { parseFinalVerification } from "../runtime/unattended/batch_final_verification";
+import { parseLaneRevision, REVISION_DELEGATION_TEXT, type LaneRevisionRequest } from "../runtime/unattended/batch_delegation";
+import { createBatchTrackerPort, laneRuntimeContractRefusal, parseLaneInstruction, type LaneInstructionRequest, parseLaneOffers, parseMaxParallel, resolveLaneParallel, type LaneOffer } from "../runtime/unattended/batch_lanes";
 import {
 	authorizeBatch,
 	projectBatchPreflight,
 } from "../runtime/unattended/batch_preflight";
+import { retireStaleBatch, type StaleBatchFacts } from "../runtime/unattended/batch_disposition";
+import type { BatchLaneRunReport } from "../runtime/unattended/batch_state";
+
 import {
 	presentTaskRail,
 	renderStructuredCall,
@@ -67,8 +73,9 @@ export async function readSettledTaskRecord(
  * is the testable unit, and the direct-execution suites cover the decision
  * outcomes (decline -> rejected, cancel/Escape -> cancelled) with zero writes.
  */
-export function mapDialogSelection(selected: string | undefined): "accept" | "decline" | "cancel" {
+export function mapDialogSelection(selected: string | undefined): "accept" | "accept_delegate" | "decline" | "cancel" {
 	if (selected === "confirm") return "accept";
+	if (selected === "confirm_delegate") return "accept_delegate";
 	if (selected === "decline") return "decline";
 	return "cancel";
 }
@@ -104,8 +111,16 @@ export interface PiBatchExecutionOptions {
 	max_parallel?: number;
 	/** Lane mode: Lanes someone else created, offered to the batch. */
 	lane_offers?: LaneOffer[];
+	/** Lane mode: the project's full verification commands, run once every child is integrated. */
+	final_verification?: string[];
+	/** Lane mode: one instruction for an idle Lane session, recorded before it is sent. */
+	lane_instruction?: LaneInstructionRequest;
+	/** Lane mode, ADR 0018: one breaking Intent revision the coordinator approves under the batch's grant. */
+	lane_revision?: LaneRevisionRequest;
 	batchKernel?: Partial<BatchRunnerKernelPort>;
 	batchGit?: BatchRunnerGitPort;
+	/** Lane mode: closes an integrated child's Issue; defaults to the GitHub projection. */
+	batchTracker?: BatchTrackerPort;
 	readInitiative?: InitiativeObservationReader;
 	confirmBatch?: (details: {
 		title: string;
@@ -113,7 +128,9 @@ export interface PiBatchExecutionOptions {
 		details: string;
 		planDigest: string;
 		signal?: AbortSignal;
-	}) => Promise<"accept" | "decline" | "cancel">;
+		/** ADR 0018: offer the opt-in delegation choice (lane mode only). */
+		offerRevisionDelegation?: boolean;
+	}) => Promise<"accept" | "accept_delegate" | "decline" | "cancel">;
 }
 
 export type PiBatchExecutionResult =
@@ -145,7 +162,7 @@ export async function executePiUnattendedBatch(
 	if (!reuseOnly && !interactive) return { state: "rejected", ...nonInteractiveRefusal() };
 
 	// A lane_offers-only call resumes the recorded lane batch; refused before any gate otherwise.
-	const resolvedParallel = resolveLaneParallel(root, initiativeSlug, options.max_parallel, options.lane_offers);
+	const resolvedParallel = resolveLaneParallel(root, initiativeSlug, options.max_parallel, options.lane_offers, options.lane_instruction ?? options.lane_revision);
 	if (resolvedParallel !== undefined) options = { ...options, max_parallel: resolvedParallel };
 
 	// 1. Host-independent batch preflight: claim ownership, branch availability,
@@ -168,6 +185,12 @@ export async function executePiUnattendedBatch(
 	const budget = preflight.projection.budget;
 	const planDigest = preflight.projection.plan_digest;
 	const recoveryChildren = preflight.projection.recovery_children;
+	// A new lane batch whose Lane runtime cannot read the coordinator's Kernel
+	// contracts is refused before the gate opens; a match adds nothing.
+	if (options.max_parallel !== undefined && !isResuming) {
+		const contractRefusal = laneRuntimeContractRefusal(root);
+		if (contractRefusal) return batchReason("batch_run_rejected", contractRefusal);
+	}
 
 	// 4. Literal-user gate plus the shared reuse decision, the post-gate
 	// claim/drift cascade, and the Batch Authorization binding. The Host supplies
@@ -195,15 +218,16 @@ export async function executePiUnattendedBatch(
 			}
 			const confirmDetails = {
 				title: `Authorize Unattended Batch: ${facts.initiative_slug}`,
-				summary: `Initiative: ${facts.initiative_slug}\nBatch branch: ${facts.batch_branch}\nPlan digest: ${facts.plan_digest}\nBudget: max_children=${facts.budget.max_children}, qa_failure_limit=${facts.budget.qa_failure_limit}${options.max_parallel !== undefined ? `\nLane mode: max_parallel=${options.max_parallel}` : ""}`,
+				summary: `Initiative: ${facts.initiative_slug}\nBatch branch: ${facts.batch_branch}\nPlan digest: ${facts.plan_digest}\nBudget: max_children=${facts.budget.max_children}, qa_failure_limit=${facts.budget.qa_failure_limit}${options.max_parallel !== undefined ? `\nLane mode: max_parallel=${options.max_parallel}` : ""}${options.max_parallel !== undefined && options.final_verification ? `\nFinal verification: ${options.final_verification.join("; ")}` : ""}`,
 				details: `Ordered children (${facts.children.length}):\n${facts.children.map((child) => `  - ${child.task_id} (${child.slice_id}) [risk: ${child.risk}] [status: ${child.status === "already_settled" ? "completed" : "pending execution"}]`).join("\n")}${facts.excluded.length > 0 ? `\n\nExcluded children:\n${facts.excluded.map((child) => `  - ${child.task_id} (${child.slice_id}): ${child.reason}`).join("\n")}` : ""}${options.max_parallel !== undefined ? `\n\nParallel groups (${facts.parallel_groups.length}):\n${facts.parallel_groups.map((group) => `  - ${group.join(", ")}`).join("\n")}${facts.scope_conflicts.length > 0 ? `\n\nSerialized by overlapping scope:\n${facts.scope_conflicts.map((c) => `  - ${c.task_id} after ${c.overlaps_with.join(", ")}`).join("\n")}` : ""}` : ""}${facts.reuse_blockers.length > 0 ? `\n\nRe-confirmation required: ${facts.reuse_blockers.join(", ")}.\nRecovery: confirm to issue a fresh authorization bound to the current plan and HEAD.` : ""}`,
 				planDigest: facts.plan_digest,
 				signal,
+				...(options.max_parallel !== undefined ? { offerRevisionDelegation: true } : {}),
 			};
 
 			// The gate settles only on the literal user's answer or the caller's
 			// cancellation signal.
-			let decision: "accept" | "decline" | "cancel";
+			let decision: "accept" | "accept_delegate" | "decline" | "cancel";
 			try {
 				decision = await options.confirmBatch(confirmDetails);
 			} catch (err) {
@@ -220,10 +244,14 @@ export async function executePiUnattendedBatch(
 			if (decision === "decline") {
 				return { kind: "host_rejection", value: batchReason("confirmation_declined") };
 			}
-			if (decision !== "accept") {
+			if (decision !== "accept" && decision !== "accept_delegate") {
 				return { kind: "host_rejection", value: batchReason("confirmation_no_decision") };
 			}
-			return { kind: "confirmed", request_id: randomUUID() };
+			return {
+				kind: "confirmed",
+				request_id: randomUUID(),
+				...(decision === "accept_delegate" && options.max_parallel !== undefined ? { delegate_revisions: true } : {}),
+			};
 		},
 		confirmationRef: ({ batch_id, request_id }) =>
 			piConfirmationRef({
@@ -289,7 +317,16 @@ export async function executePiUnattendedBatch(
 		now,
 		kernel: kernelPort,
 		git: options.batchGit,
-		...(options.max_parallel !== undefined ? { max_parallel: options.max_parallel } : {}),
+		...(options.max_parallel !== undefined
+			? {
+					max_parallel: options.max_parallel,
+					tracker: options.batchTracker ?? createBatchTrackerPort(root, initiativeSlug),
+					...(options.final_verification ? { final_verification: options.final_verification } : {}),
+					...(options.lane_instruction ? { lane_instruction: options.lane_instruction } : {}),
+					...(options.lane_revision ? { lane_revision: options.lane_revision } : {}),
+					...(authorization.revision_delegation !== undefined ? { revision_delegation: authorization.revision_delegation } : {}),
+				}
+			: {}),
 		...(options.lane_offers !== undefined ? { lane_offers: options.lane_offers } : {}),
 	});
 
@@ -305,6 +342,69 @@ export async function executePiUnattendedBatch(
 	};
 }
 
+export type PiRetireStaleBatchResult =
+	| { state: "retired"; batch_id: string; report: BatchRunReport | BatchLaneRunReport }
+	| { state: "rejected" | "cancelled" | "blocked"; reason: string; recovery_action: string };
+
+/**
+ * The gate text for one batch disposition. Every fact rendered is the record's
+ * own evidence: what it delivered, what it never executed, and what retiring
+ * does and does not claim. Nothing here is a readiness certificate.
+ */
+function retireConfirmationDetails(facts: StaleBatchFacts): {
+	title: string;
+	summary: string;
+	details: string;
+} {
+	return {
+		title: `Retire Stale Batch: ${facts.initiative_slug}`,
+		summary: `Batch: ${facts.batch_id}\nState: ${facts.batch_state}\nBatch branch: ${facts.branch}\nPlan digest: ${facts.plan_digest}\nRecorded child commits: ${facts.recorded_commits.length}\nConfirmed at: ${facts.confirmation_time}`,
+		details: `Children (${facts.children.length}):\n${facts.children
+			.map(
+				(child) =>
+					`  - ${child.task_id} (${child.slice_id}) [state: ${child.state}]${child.commit ? ` [commit: ${child.commit}]` : " [no commit]"}${child.lane_branch ? ` [lane: ${child.lane_branch}]` : ""}`,
+			)
+			.join("\n")}\n\nRetiring writes this record to the terminal superseded state. Child states, recorded commits and the batch branch are preserved as evidence; nothing is deleted and no batch trailer or approval is manufactured.\n\nA child without a commit was never executed by this batch: it carries no delivery evidence, and the retired authorization is never reused for a revised plan.\n\nAfter retiring, run each remaining child with imm-run under its own authorization, or start a new batch for this Initiative.`,
+	};
+}
+
+export async function executePiRetireStaleBatch(options: {
+	root: string;
+	initiativeSlug: string;
+	signal?: AbortSignal;
+	confirmBatch: (details: { title: string; summary: string; details: string; signal?: AbortSignal }) => Promise<"accept" | "decline" | "cancel">;
+}): Promise<PiRetireStaleBatchResult> {
+	const { root, initiativeSlug, signal } = options;
+	const outcome = await retireStaleBatch({
+		root,
+		initiative_slug: initiativeSlug,
+		now: new Date().toISOString(),
+		gate: async (facts) => {
+			const details = retireConfirmationDetails(facts);
+			let decision: "accept" | "decline" | "cancel";
+			try {
+				decision = await options.confirmBatch({ ...details, signal });
+			} catch (err) {
+				if (signal?.aborted) return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
+				return {
+					kind: "host_rejection",
+					value: batchReason("confirmation_failed", err instanceof Error ? err.message : String(err)),
+				};
+			}
+			if (decision === "cancel" || signal?.aborted)
+				return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
+			if (decision === "decline")
+				return { kind: "host_rejection", value: batchReason("confirmation_declined") };
+			if (decision !== "accept")
+				return { kind: "host_rejection", value: batchReason("confirmation_no_decision") };
+			return { kind: "confirmed", request_id: randomUUID() };
+		},
+	});
+	if (outcome.outcome === "host_rejection") return outcome.value;
+	if (outcome.outcome === "rejected") return outcome.rejection;
+	return { state: "retired", batch_id: outcome.batch_id, report: outcome.report };
+}
+
 /**
  * Injectable seams for the batch Tool. Production passes nothing and gets the
  * real Initiative reader, Kernel port and Git port; tests drive the registered
@@ -337,10 +437,21 @@ export default function (
 			lane_offers: Type.Optional(Type.Array(
 				Type.Object({ task_id: Type.String(), path: Type.String() }, { additionalProperties: false }),
 			)),
+			final_verification: Type.Optional(Type.Array(Type.String(), { minItems: 1, maxItems: 8 })),
+			lane_instruction: Type.Optional(Type.Object({
+				task_id: Type.String(),
+				kind: Type.Optional(Type.Union([Type.Literal("instruction"), Type.Literal("correction")])),
+				text: Type.String(),
+				session_state: Type.Union([Type.Literal("idle"), Type.Literal("working"), Type.Literal("blocked"), Type.Literal("done")]),
+			}, { additionalProperties: false })),
+			lane_revision: Type.Optional(Type.Object({
+				task_id: Type.String(),
+				next_intent: Type.Object({}, { additionalProperties: true }),
+			}, { additionalProperties: false })),
 		}, { additionalProperties: false }),
 		execute: async (
 			_toolCallId: string,
-			params: { initiative_slug: string; max_parallel?: number; lane_offers?: Array<{ task_id: string; path: string }> },
+			params: { initiative_slug: string; max_parallel?: number; lane_offers?: Array<{ task_id: string; path: string }>; final_verification?: string[]; lane_instruction?: unknown; lane_revision?: unknown },
 			signal: AbortSignal | undefined,
 			_onUpdate: unknown,
 			ctx: ExtensionContext,
@@ -361,12 +472,18 @@ export default function (
 
 			const maxParallel = parseMaxParallel(params.max_parallel);
 			const laneOffers = parseLaneOffers(params.lane_offers);
+			const finalVerification = parseFinalVerification(params.final_verification);
+			const laneInstruction = parseLaneInstruction(params.lane_instruction);
+			const laneRevision = parseLaneRevision(params.lane_revision);
 
 			const result = await executePiUnattendedBatch({
 				root: ctx.cwd,
 				initiativeSlug,
 				...(maxParallel !== undefined ? { max_parallel: maxParallel } : {}),
 				...(laneOffers !== undefined ? { lane_offers: laneOffers } : {}),
+				...(finalVerification !== undefined ? { final_verification: finalVerification } : {}),
+				...(laneInstruction !== undefined ? { lane_instruction: laneInstruction } : {}),
+				...(laneRevision !== undefined ? { lane_revision: laneRevision } : {}),
 				interactive: ctx.mode === "tui",
 				signal,
 				readInitiative: dependencies.readInitiative,
@@ -395,6 +512,9 @@ export default function (
 							signal: details.signal,
 							actions: [
 								{ value: "confirm", label: "Authorize batch run", description: "Start the unattended serial batch run" },
+								...(details.offerRevisionDelegation
+									? [{ value: "confirm_delegate", label: "Authorize and delegate in-Lane revisions", description: REVISION_DELEGATION_TEXT }]
+									: []),
 								{ value: "decline", label: "Decline batch", description: "Reject this batch authorization; repository and authority stay unchanged" },
 								{ value: "cancel", label: "Cancel", description: "Leave repository and authority unchanged" },
 							],
@@ -439,4 +559,104 @@ export default function (
 			);
 		},
 	});
+	// The batch disposition: one explicit literal-user decision that closes a
+	// batch the plan moved past, preserving its evidence instead of leaving the
+	// record parked forever or deleting it by hand. Grants no handoff.
+	pi.registerTool({
+		name: "retire_stale_batch",
+		label: "Retire stale batch",
+		description: "Retire an Initiative's parked or drifted batch record to the terminal superseded state after native confirmation.",
+		promptSnippet: "Retire stale batch: invoke once in foreground after the stale batch record is inspected.",
+		promptGuidelines: [
+			"Call only after inspecting the batch record; execute once in the foreground and consume the direct terminal result.",
+			"Do not run this Tool in background, poll for completion, or issue a cancel subcommand.",
+		],
+		parameters: Type.Object({
+			initiative_slug: Type.String({ pattern: "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }),
+		}, { additionalProperties: false }),
+		execute: async (
+			_toolCallId: string,
+			params: { initiative_slug: string },
+			signal: AbortSignal | undefined,
+			_onUpdate: unknown,
+			ctx: ExtensionContext,
+		) => {
+			const { initiative_slug: initiativeSlug } = params;
+			if (ctx.mode !== "tui") {
+				const refusal = nonInteractiveRefusal();
+				throwToolFailure({
+					tool: "imm_canary_enrollment",
+					task_id: initiativeSlug,
+					operation: "retire_stale_batch",
+					state: "blocked",
+					code: "unsupported_host",
+					message: refusal.reason,
+					next_action: refusal.recovery_action,
+				});
+			}
+
+			const result = await executePiRetireStaleBatch({
+				root: ctx.cwd,
+				initiativeSlug,
+				signal,
+				confirmBatch: async (details) => {
+					presentTaskRail(ctx, {
+						task_id: initiativeSlug,
+						state: "Approval required",
+						result: details.title,
+						next: "Review batch record evidence",
+					});
+					const selected = await requestAuthorityDialog(
+						pi,
+						ctx,
+						{
+							attention_id: randomUUID(),
+						task_id: initiativeSlug,
+							reason: "enrollment",
+							label: details.title,
+						},
+						{
+							title: details.title,
+							summary: details.summary,
+							details: details.details,
+							signal: details.signal,
+							actions: [
+								{ value: "confirm", label: "Retire batch record", description: "Write the terminal superseded state and its report" },
+								{ value: "decline", label: "Keep batch parked", description: "Leave the batch record and its authorization unchanged" },
+								{ value: "cancel", label: "Cancel", description: "Leave repository and authority unchanged" },
+							],
+						},
+					);
+					const mapped = mapDialogSelection(selected);
+					return mapped === "accept_delegate" ? "accept" : mapped;
+				},
+			});
+
+			if (result.state !== "retired") {
+				throwToolFailure({
+					tool: "imm_canary_enrollment",
+					task_id: initiativeSlug,
+					operation: "retire_stale_batch",
+					state: result.state === "blocked" ? "blocked" : "failed",
+					code: `batch_${result.state}`,
+					message: result.reason,
+					next_action: result.recovery_action,
+				});
+			}
+			return {
+				content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
+				details: result,
+			};
+		},
+		renderCall(args, theme) {
+			const params = args as { initiative_slug?: string };
+			return renderStructuredCall("retire_stale_batch", "retire", params.initiative_slug, theme);
+		},
+		renderResult(result, _options, theme) {
+			return renderStructuredResult(
+				result as Parameters<typeof renderStructuredResult>[0],
+				theme,
+			);
+		},
+	});
 }

package/plugins/immune-brain/.pi-extension/pi-canary-assurance-progression.ts

@@ -46,9 +46,10 @@ export type {
 	ReviewTimingProfile,
 } from "../runtime/assurance/coordinator";
 
-import { AssuranceCoordinator, type AssuranceCoordinatorPorts } from "../runtime/assurance/coordinator";
+import { AssuranceCoordinator, type AssuranceCoordinatorPorts, type HostContext, type AssuranceSubmitReviewResult } from "../runtime/assurance/coordinator";
 import type { AssuranceHostPort, HostReviewReservation, ReviewRequest } from "../runtime/assurance/host_port";
-import { reservedAgentParams } from "./pi-canary-native-review";
+import { submitMediatedReview, type ReviewObservation } from "../runtime/assurance/review_mediation";
+import { reservedAgentParams, promptDigest } from "./pi-canary-native-review";
 
 import type { VerdictAuthority } from "../runtime/assurance/verdict_authority";
 
@@ -57,9 +58,18 @@ export type AssuranceProgressionPorts = Omit<AssuranceCoordinatorPorts, "host">
 	authorityOverrides?: Partial<VerdictAuthority>;
 };
 
+interface RecordedReviewReceipt {
+	taskId: string;
+	promptDigest: string;
+	toolCallId?: string;
+	result?: string;
+	error?: string;
+}
+
 class PiReviewHost implements AssuranceHostPort {
 	readonly host = "pi" as const;
 	private readonly pending = new Set<string>();
+	private readonly receipts = new Map<string, RecordedReviewReceipt>();
 
 	prepareReview(request: ReviewRequest): HostReviewReservation {
 		const params = reservedAgentParams({
@@ -69,17 +79,70 @@ class PiReviewHost implements AssuranceHostPort {
 			max_turns: request.maxTurns,
 		});
 		this.pending.add(request.operationId);
+		this.receipts.set(request.operationId, { taskId: request.taskId, promptDigest: promptDigest(params.prompt) });
 		return { id: request.operationId, dispatch: params };
 	}
 
 	releaseReview(reservation: HostReviewReservation): void {
 		this.pending.delete(reservation.id);
+		this.receipts.delete(reservation.id);
+	}
+
+	/** Extension event seam: correlate one observed `Agent` dispatch to its reservation (ADR 0017). */
+	observeReviewDispatch(input: { prompt?: unknown; subagent_type?: unknown } | undefined, toolCallId: string | undefined): void {
+		if (typeof input?.prompt !== "string") return;
+		for (const record of this.receipts.values()) {
+			if (record.promptDigest !== promptDigest(input.prompt)) continue;
+			if (input.subagent_type !== "Review") {
+				record.error = "the reserved reviewer prompt was dispatched with a different Agent type";
+				return;
+			}
+			if (record.toolCallId !== undefined && record.toolCallId !== toolCallId) {
+				record.error = "the reserved reviewer was dispatched more than once";
+				return;
+			}
+			record.toolCallId = toolCallId;
+			return;
+		}
+	}
+
+	/** Extension event seam: store the observed reviewer result bytes (ADR 0017). */
+	observeReviewResult(toolCallId: string | undefined, bytes: string): void {
+		if (!toolCallId) return;
+		for (const record of this.receipts.values()) {
+			if (record.toolCallId !== toolCallId) continue;
+			if (record.result === undefined) record.result = bytes;
+			else if (record.result !== bytes) record.error = "the reserved reviewer returned conflicting result bytes";
+			return;
+		}
+	}
+
+	inspectReview(taskId: string): ReviewObservation {
+		for (const record of this.receipts.values()) {
+			if (record.taskId !== taskId) continue;
+			if (record.error) return { ok: false, release: false, reason: record.error };
+			if (record.toolCallId === undefined)
+				return { ok: false, release: false, reason: "the reserved foreground Agent was not observed in this session" };
+			if (record.result === undefined)
+				return { ok: false, release: false, reason: "the reserved foreground reviewer has not returned its result yet; wait for it, then call submit_review again" };
+			return { ok: true, receipt: { actorId: "pi-review-agent", result: record.result } };
+		}
+		return { ok: false, release: true, reason: "the reserved foreground Agent was not observed in this session" };
 	}
 }
 
 export class AssuranceProgression extends AssuranceCoordinator {
+	readonly piReviewHost: PiReviewHost;
+
 	constructor(ports: AssuranceProgressionPorts) {
-		(ports as AssuranceCoordinatorPorts).host = new PiReviewHost();
+		const host = new PiReviewHost();
+		(ports as AssuranceCoordinatorPorts).host = host;
 		super(ports as AssuranceCoordinatorPorts, ports.authorityOverrides);
+		this.piReviewHost = host;
+	}
+
+	/** ADR 0017: verdict-source resolution happens here, before the shared submit path. */
+	submitMediated(taskId: string, ctx: HostContext, verdictInput: unknown): Promise<AssuranceSubmitReviewResult> {
+		return submitMediatedReview(this, ctx, taskId, verdictInput, () => this.piReviewHost.inspectReview(taskId));
 	}
 }

package/plugins/immune-brain/agents/immune-brain-reviewer.md

@@ -40,6 +40,13 @@ about the fix's scope, not a new bug. A trigger the accepted contract explicitly
 excludes is reported as an advisory note against that boundary, never as blocking
 rework.
 
+A defect that lies inside the TaskIntent goal and `scope_hint` is a blocking
+finding even when no acceptance assertion names its exact case word for word:
+cite the acceptance whose principle it violates as `acceptance_id` and
+`violated.ref`. Ask for the fix and a test that pins the case, never for the case
+to be written into the acceptance text; a missing literal clause is not itself a
+finding and does not call for an Intent revision.
+
 ## Invariant and Evidence Coverage
 
 Judge whether the change actually closes the invariant its acceptance names,
@@ -59,6 +66,24 @@ seam, or a seam silently replaced by a different one, is a finding carrying
 named, its absence is not a finding: candidates written before this rule carries
 no defect for lacking one.
 
+When the Spec referenced by an acceptance maps an `automated` user scenario to
+it, check that the delivered tests at that acceptance's agreed seam assert the
+scenario's `Then`: a scenario whose observable result is asserted nowhere is a
+finding carrying `violated.kind` of `acceptance` with `ref` the acceptance id.
+A `manual` scenario, and an acceptance with no mapped scenario, produce no such
+finding. This adds no finding kind and no verdict branch: it is the same
+`acceptance` finding the seam rule above already defines.
+
+Before pass, enumerate the immutable change set and read each complete per-file
+diff, including deletions. Page bounded reads until every hunk is visible; a
+truncated aggregate output or summary is incomplete coverage. Trace changed
+high-risk behavior through its callers and state owner, and inspect a concrete
+negative case against the embedded acceptance. If immutable evidence remains
+unavailable or incomplete, report the concrete acceptance coverage gap in a
+rework finding with required evidence. `inspected_paths` declares coverage; it
+does not itself prove tool reading. Judge quality by evidence, not elapsed time
+or tool-call count.
+
 A required check that is skipped, that matches zero tests, or whose prerequisite
 is absent does not prove the acceptance; do not accept it as evidence. Full
 suite coverage reported at a coarse pass count is not per-invariant evidence.
@@ -96,5 +121,5 @@ Every rework finding must carry machine-checkable provenance: evidence.trigger (
 
 A pass verdict's approval must carry `inspected_paths`: an array of unique repository-relative path strings listing every path of the reviewed change set (changed_paths for a Git review revision, dirty_files for a bundle), deleted paths included; an empty change set is listed as an empty array. A path may be listed only after its diff was read. A pass that omits any changed path, lists a path outside the change set, or duplicates a path is rejected as a correctable invalid verdict.
 
-A dispatched reviewer is never continued or re-prompted, including through SendMessage. The reserved prompt is dispatched verbatim. A blocked `submit_review` is recovered only through its returned `recovery_action`.
+A dispatched reviewer is never continued or re-prompted, including through SendMessage. The reserved prompt is dispatched verbatim. The host binds this reviewer's final result bytes to the reservation, so a Parent may submit them without transcribing them. A blocked `submit_review` is recovered only through its returned `recovery_action`.