immune-brain 5.1.2 → 5.2.0

package/plugins/immune-brain/runtime/claude/interaction.ts

@@ -1,4 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
+import { PHASE_ENTRY_RECOVERY } from "../assurance/phase_entry";
 
 export const PRIVILEGED_OPERATIONS = [
 	"enroll",
@@ -17,7 +18,9 @@ export type NativeFailureCode =
 	| "user_cancelled"
 	| "correlation_missing"
 	| "unsupported_host"
-	| "workspace_changed";
+	| "workspace_changed"
+	| "run_entry_required"
+	| "phase_entry_required";
 
 const RECOVERY_ACTIONS: Record<NativeFailureCode, string> = {
 	interaction_not_opened: "retry through a fresh native gate in the current Host",
@@ -26,6 +29,7 @@ const RECOVERY_ACTIONS: Record<NativeFailureCode, string> = {
 	correlation_missing: "retry through a fresh native gate in the current Host",
 	unsupported_host: "upgrade to a supported Claude Code version and retry in the current Host",
 	workspace_changed: "review the current workspace and retry through a fresh native gate",
+	...PHASE_ENTRY_RECOVERY,
 };
 
 export class NativeAuthorityError extends Error {

package/plugins/immune-brain/runtime/claude/lane_guard.ts

@@ -3,10 +3,55 @@
 // runs, the same rule the Pi extension applies to `edit`/`write`. Bash is not
 // intercepted. Outside a Lane the hook answers nothing and the tool runs as
 // configured.
+//
+// Phase entry gate: UserPromptSubmit records which literal prompt entered
+// planning or execution; PreToolUse denies `enroll`, `start_unattended_batch`
+// and the three phase Skills without a matching entry, and otherwise leaves an
+// admission the tool handler consumes by tool-use id.
+import { lstatSync, rmSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
 import { laneWriteRefusal } from "../unattended/lane_workspace";
 import { activeTaskNotice } from "../assurance/active_task_notice";
+import { readAliasFile } from "../assurance/alias_file";
+import {
+	admitPhaseOperation,
+	NO_PHASE_ENTRY,
+	packagedPhaseSkill,
+	phaseEntryLogLine,
+	phaseRefusalMessage,
+	PHASE_ENTRY_RECOVERY,
+	recognizePhaseEntry,
+	reducePhaseEntryLog,
+	RUN_ENTRY_REQUIRED,
+	type AliasReader,
+	type PhaseEntryState,
+	type PhaseOperation,
+} from "../assurance/phase_entry";
+import { readActiveClaimTaskId } from "../unattended/batch_preflight";
+import { appendPrivate, cacheDir, ensurePrivateDir, ownedByUs, readPrivate, sessionHash } from "./review_host";
 
 const FILE_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+const GATED_MCP_TOOL = /^mcp__.*immune-brain.*__(enroll|start_unattended_batch)$/;
+
+export type GatedTool = "enroll" | "start_unattended_batch";
+
+/** Where the phase entry gate keeps its private files and finds user aliases. */
+export interface PhaseEntryLocations {
+	/** Parent of the private cache directory. Defaults to the OS temp directory. */
+	root?: string;
+	/** The user's home, for `~/.claude/commands`. */
+	home?: string;
+	/** The private store's append and read. Default to the real file operations. */
+	append?: typeof appendPrivate;
+	read?: typeof readPrivate;
+}
+
+function denyPreToolUse(reason: string): string {
+	return JSON.stringify({
+		hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason },
+	});
+}
 
 /** The hook's stdout for one PreToolUse payload, or null to stay silent. */
 export function laneGuardHookOutput(payload: Record<string, unknown>): string | null {
@@ -15,9 +60,7 @@ export function laneGuardHookOutput(payload: Record<string, unknown>): string |
 	const cwd = typeof payload.cwd === "string" && payload.cwd ? payload.cwd : process.cwd();
 	const refusal = laneWriteRefusal(cwd, input.file_path ?? input.notebook_path);
 	if (!refusal) return null;
-	return JSON.stringify({
-		hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: refusal },
-	});
+	return denyPreToolUse(refusal);
 }
 
 /**
@@ -31,3 +74,137 @@ export async function activeTaskHookOutput(payload: Record<string, unknown>): Pr
 	if (!notice) return null;
 	return JSON.stringify({ hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext: notice } });
 }
+
+function entryLogPath(sessionId: string, root: string): string {
+	return join(cacheDir(root), `${sessionHash(sessionId)}.entry`);
+}
+
+function admissionPath(toolUseId: string, root: string): string {
+	return join(cacheDir(root), `${sessionHash(toolUseId)}.admit`);
+}
+
+function sessionIdOf(payload: Record<string, unknown>): string {
+	return typeof payload.session_id === "string" ? payload.session_id : "";
+}
+
+function cwdOf(payload: Record<string, unknown>): string {
+	return typeof payload.cwd === "string" && payload.cwd ? payload.cwd : process.cwd();
+}
+
+/** Project aliases first, then the user's, as Claude Code resolves commands. */
+function claudeAliasReader(cwd: string, home: string): AliasReader {
+	return (name) => {
+		for (const dir of [join(cwd, ".claude", "commands"), join(home, ".claude", "commands")]) {
+			const body = readAliasFile(join(dir, `${name}.md`));
+			if (body !== null) return body;
+		}
+		return null;
+	};
+}
+
+/** The session's entry state: none recorded yet, or null when the store is unreadable. */
+export function readPhaseEntryState(sessionId: string, root = tmpdir(), read: typeof readPrivate = readPrivate): PhaseEntryState | null {
+	if (!sessionId) return null;
+	const path = entryLogPath(sessionId, root);
+	try {
+		lstatSync(path);
+	} catch (error) {
+		return (error as NodeJS.ErrnoException).code === "ENOENT" ? NO_PHASE_ENTRY : null;
+	}
+	if (!ensurePrivateDir(cacheDir(root))) return null;
+	let text: string | undefined;
+	try { text = read(path); } catch { return null; }
+	return text === undefined ? null : reducePhaseEntryLog(text);
+}
+
+/** Removes one of our private files. Never follows a link or touches another owner's file. */
+function dropPrivate(path: string): void {
+	try {
+		const stat = lstatSync(path);
+		if (ownedByUs(stat) && stat.isFile()) rmSync(path, { force: true });
+	} catch { /* already gone, or not ours to remove */ }
+}
+
+/**
+ * UserPromptSubmit: record whether this literal prompt entered a phase. Every
+ * prompt is recorded so "the latest prompt" is decidable later. A prompt that
+ * could not be recorded drops the log: an earlier entry must not outlive a
+ * prompt the store never saw, so the session is back to no entry.
+ */
+export function recordPhaseEntryPrompt(payload: Record<string, unknown>, locations: PhaseEntryLocations = {}): boolean {
+	if (payload.hook_event_name !== "UserPromptSubmit") return false;
+	const sessionId = sessionIdOf(payload);
+	if (!sessionId) return false;
+	const root = locations.root ?? tmpdir();
+	const prompt = typeof payload.prompt === "string" ? payload.prompt : "";
+	const entry = recognizePhaseEntry(prompt, claudeAliasReader(cwdOf(payload), locations.home ?? homedir()));
+	const path = entryLogPath(sessionId, root);
+	const recorded = (locations.append ?? appendPrivate)(path, cacheDir(root), phaseEntryLogLine(entry));
+	if (!recorded) dropPrivate(path);
+	return recorded;
+}
+
+function gatedOperation(payload: Record<string, unknown>): PhaseOperation | null {
+	const toolName = String(payload.tool_name ?? "");
+	if (toolName === "Skill") {
+		const input = (payload.tool_input ?? {}) as { skill?: unknown };
+		const skill = typeof input.skill === "string" ? packagedPhaseSkill(input.skill) : null;
+		return skill ? { kind: "skill", skill } : null;
+	}
+	const mcp = GATED_MCP_TOOL.exec(toolName);
+	return mcp ? { kind: "tool", name: mcp[1] as GatedTool } : null;
+}
+
+/**
+ * PreToolUse for a gated tool: deny without a matching entry; for the two MCP
+ * tools, otherwise write the admission the handler consumes. Any other tool
+ * answers null and runs as configured.
+ */
+export function phaseEntryGateHookOutput(payload: Record<string, unknown>, locations: PhaseEntryLocations = {}): string | null {
+	if (payload.hook_event_name !== "PreToolUse") return null;
+	const operation = gatedOperation(payload);
+	if (!operation) return null;
+	const root = locations.root ?? tmpdir();
+	let state: PhaseEntryState | null = null;
+	try { state = readPhaseEntryState(sessionIdOf(payload), root, locations.read); } catch { /* an unreadable store refuses */ }
+	let activeClaim = false;
+	try { activeClaim = readActiveClaimTaskId(cwdOf(payload)) !== null; } catch { /* unreadable authority is no claim */ }
+	const admission = admitPhaseOperation(operation, state, { activeClaim });
+	if (!admission.ok) return denyPreToolUse(phaseRefusalMessage(admission));
+	if (operation.kind === "skill") return null;
+	const toolUseId = typeof payload.tool_use_id === "string" ? payload.tool_use_id : "";
+	let recorded = false;
+	try {
+		recorded = toolUseId !== ""
+			&& (locations.append ?? appendPrivate)(admissionPath(toolUseId, root), cacheDir(root), `${JSON.stringify({ v: 1, operation: operation.name })}\n`);
+	} catch { /* an admission that could not be written refuses */ }
+	if (recorded) return null;
+	return denyPreToolUse(
+		`${RUN_ENTRY_REQUIRED}: the admission for this ${operation.name} call could not be recorded; recovery: ${PHASE_ENTRY_RECOVERY[RUN_ENTRY_REQUIRED]}`,
+	);
+}
+
+/**
+ * Tool side: take the admission the hook wrote for this exact call. One use;
+ * absent, unreadable or written for another operation all refuse. The hook may
+ * run more than once for one call (two enabled copies of the plugin), so
+ * repeated identical admissions count as one.
+ */
+export function consumePhaseAdmission(toolUseId: string, operation: GatedTool, root = tmpdir()): boolean {
+	if (!toolUseId || !ensurePrivateDir(cacheDir(root))) return false;
+	const path = admissionPath(toolUseId, root);
+	let text: string | undefined;
+	try { text = readPrivate(path); } catch { return false; }
+	if (text === undefined) return false;
+	dropPrivate(path);
+	const lines = text.split("\n").filter(Boolean);
+	if (lines.length === 0) return false;
+	return lines.every((line) => {
+		try {
+			const record = JSON.parse(line) as { v?: unknown; operation?: unknown } | null;
+			return record?.v === 1 && record.operation === operation;
+		} catch {
+			return false;
+		}
+	});
+}

package/plugins/immune-brain/runtime/claude/mcp_server.ts

@@ -12,7 +12,7 @@ import {
 	type NativeConfirmationPort,
 } from "./interaction";
 import { ClaudeReviewHost, FileHookEventLog, parseHookStdin } from "./review_host";
-import { activeTaskHookOutput, laneGuardHookOutput } from "./lane_guard";
+import { activeTaskHookOutput, consumePhaseAdmission, laneGuardHookOutput, phaseEntryGateHookOutput, recordPhaseEntryPrompt, type GatedTool } from "./lane_guard";
 import { ClaudeRuntime, type ToolMeta } from "./kernel_ports";
 import { parseLaneInstruction, parseLaneOffers, parseMaxParallel, resolveLaneParallel } from "../unattended/batch_lanes";
 import { parseFinalVerification } from "../unattended/batch_final_verification";
@@ -118,6 +118,11 @@ export interface McpRuntimeOptions {
 	batchKernel?: Partial<import("../unattended/batch_runner").BatchRunnerKernelPort>;
 	batchGit?: import("../unattended/batch_git").BatchRunnerGitPort;
 	readInitiative?: import("../unattended/types").InitiativeObservationReader;
+	/**
+	 * Takes the admission the PreToolUse hook wrote for one `enroll` or
+	 * `start_unattended_batch` call. Defaults to the private file store.
+	 */
+	consumePhaseAdmission?: (toolCallId: string, operation: GatedTool) => boolean;
 }
 
 export function createMcpRuntime(options: McpRuntimeOptions = {}) {
@@ -139,6 +144,14 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 	let negotiatedVersion: string | undefined;
 	let negotiatedInteractive = false;
 	const connectionId = randomUUID();
+	const consumeAdmission = options.consumePhaseAdmission ?? ((toolCallId: string, operation: GatedTool) => consumePhaseAdmission(toolCallId, operation));
+	// The phase entry gate, before any preparation or native dialog. The hook
+	// decided on the session's literal entry; no admission for this exact call
+	// means no hook saw it, which refuses.
+	const requireRunEntry = (operation: GatedTool, toolCallId: string) => {
+		if (consumeAdmission(toolCallId, operation)) return;
+		throw new NativeAuthorityError("run_entry_required", `${operation} needs a literal-user imm-run entry in this session`);
+	};
 	return {
 		runtime,
 		host,
@@ -164,6 +177,7 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 				}
 				const probe = probeHost(options.env ?? process.env, process.platform, negotiatedVersion);
 				if (!probe.ok) throw new NativeAuthorityError("unsupported_host", probe.reason);
+				requireRunEntry(name, meta.toolCallId ?? `call-${name}`);
 				const toolMeta: ToolMeta = {
 					sessionId: meta.sessionId ?? connectionId,
 					toolCallId: meta.toolCallId ?? `call-${name}`,
@@ -230,7 +244,10 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 				interactive: meta.interactive ?? options.interactive ?? negotiatedInteractive,
 				signal: meta.signal,
 			};
-			if (name === "enroll") return runtime.enroll(taskId, toolMeta);
+			if (name === "enroll") {
+				requireRunEntry(name, meta.toolCallId ?? `call-${name}`);
+				return runtime.enroll(taskId, toolMeta);
+			}
 			if (name === "advance_assurance") return runtime.advance(taskId, toolMeta.signal, toolMeta);
 			if (name === "submit_review") {
 				// ADR 0017: an absent verdict is the receipt-bound submission.
@@ -737,11 +754,12 @@ async function runHook(): Promise<void> {
 	let payload: Record<string, unknown> | null = null;
 	try { payload = JSON.parse(raw) as Record<string, unknown>; } catch { payload = null; }
 	if (payload?.hook_event_name === "PreToolUse") {
-		const decision = laneGuardHookOutput(payload);
+		const decision = laneGuardHookOutput(payload) ?? phaseEntryGateHookOutput(payload);
 		if (decision) process.stdout.write(`${decision}\n`);
 		return;
 	}
 	if (payload?.hook_event_name === "UserPromptSubmit") {
+		recordPhaseEntryPrompt(payload);
 		const notice = await activeTaskHookOutput(payload);
 		if (notice) process.stdout.write(`${notice}\n`);
 		return;

package/plugins/immune-brain/runtime/claude/review_host.ts

@@ -76,21 +76,21 @@ export class MemoryHookEventLog implements HookEventLog {
 
 const CACHE_DIR = "immune-brain-claude";
 
-function sessionHash(sessionId: string): string {
+export function sessionHash(sessionId: string): string {
 	return createHash("sha256").update(sessionId).digest("hex");
 }
 
-function cacheDir(root: string): string {
+export function cacheDir(root: string): string {
 	return join(root, CACHE_DIR);
 }
 
-function ownedByUs(stat: { uid: number; isSymbolicLink(): boolean }): boolean {
+export function ownedByUs(stat: { uid: number; isSymbolicLink(): boolean }): boolean {
 	if (stat.isSymbolicLink()) return false;
 	const uid = process.getuid?.();
 	return uid === undefined || stat.uid === uid;
 }
 
-function ensurePrivateDir(dir: string): boolean {
+export function ensurePrivateDir(dir: string): boolean {
 	try {
 		const existing = lstatSync(dir);
 		return existing.isDirectory() && ownedByUs(existing) && (existing.mode & 0o777) === 0o700;
@@ -106,7 +106,7 @@ function ensurePrivateDir(dir: string): boolean {
 	}
 }
 
-function appendPrivate(path: string, dir: string, line: string): boolean {
+export function appendPrivate(path: string, dir: string, line: string): boolean {
 	if (!ensurePrivateDir(dir)) return false;
 	const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK;
 	let fd: number;
@@ -122,7 +122,7 @@ function appendPrivate(path: string, dir: string, line: string): boolean {
 	}
 }
 
-function readPrivate(path: string, maxBytes = Number.POSITIVE_INFINITY): string | undefined {
+export function readPrivate(path: string, maxBytes = Number.POSITIVE_INFINITY): string | undefined {
 	let fd: number;
 	try { fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); } catch { return; }
 	try {

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -1,2 +1,2 @@
 // Generated by scripts/plugin_versioning.ts from the root package.json.
-export const PLUGIN_VERSION = "5.1.2" as const;
+export const PLUGIN_VERSION = "5.2.0" as const;

package/plugins/immune-brain/runtime/prompts/code-review.md

@@ -26,6 +26,11 @@ material task-local maintenance risks. Pure naming, length, complexity
 thresholds, formatting, and design preference are not findings and must not
 cause style-only rework.
 
+Test-suite growth is advisory, never blocking: note a delivered test that
+duplicates an existing assertion, asserts only private implementation, or
+leaves a test protecting behavior the change retired. Weakened or missing
+tests for an acceptance remain blocking under the rules above.
+
 When a finding repeats an acceptance id or anchor that already produced rework in
 this task, do not file it as a fresh single-trigger defect. Name the invariant
 class it belongs to and state in `evidence.trigger` why the previously accepted

package/plugins/immune-brain/runtime/prompts/executor.md

@@ -68,6 +68,14 @@ mock or hard-coded success, swallowed unexpected errors, missing validation at
 external trust boundaries, invented dependencies or APIs, unauthorized
 observable behavior changes, and production paths without a current caller.
 Do not weaken tests or hide an incomplete result to make Verification pass.
+
+Keep the test suite lean. Each added test pins one acceptance invariant or
+finding case at its public seam; do not mirror private calls, mock order or
+internal return values that a public assertion already covers. Before adding a
+test, search existing tests for the same behavior and extend or parameterize
+them instead of duplicating setup. When the change retires or replaces a
+behavior, update or delete the tests that protected it within scope and name
+the retired behavior or continuing owner in Delivery Evidence.
 Treat naming, function length, parameter count, nesting, and abstraction taste
 as contextual signals, never as automatic failure thresholds.
 

package/plugins/immune-brain/skills/BASELINE.md

@@ -108,7 +108,7 @@ An existing grant for one of these never inherits another: a stage-only
 instruction stays stage-only, a commit is not push or publication authority,
 and a valid batch capability commits only its own scope-bounded child.
 
-Routine Managed enrollment uses one current-Host native confirmation bound to the TaskIntent content hash after Planner validation. Explicit Plan-only requests stop with candidate artifacts and do not invoke Enrollment; execution-bearing requests open the native gate directly without chat pre-confirmation. Enrollment validates intent, Git ownership, scope, workspace claim, and final authority preconditions without executing acceptance descriptors; deterministic QA executes them after implementation. The routine task proceeds from that single confirmation through enrollment, execution, and QA without a second human stop. Do not request confirmation for local in-scope edits, local verification, ordinary Direct rework, scoped diff review, or completion reporting. Managed evidence, QA, Review, and completion authority remain governed by their Managed contracts; R2 does not weaken them. Managed native-authority failures fail closed with one stable reason and exactly one same-Host recovery action; never offer a Pi, Direct Path, cross-Host/worktree, unmanaged, or automatic-retry fallback.
+Routine Managed enrollment is the first step of an explicit `imm-run` entry and uses one current-Host native confirmation bound to the TaskIntent content hash after Planner validation. Planner and Brainstorm stop with candidate artifacts and never invoke Enrollment, whether or not the request also asks for execution; explicit Plan-only requests stop the same way. `imm-run` opens the native gate directly without chat pre-confirmation. Enrollment validates intent, Git ownership, scope, workspace claim, and final authority preconditions without executing acceptance descriptors; deterministic QA executes them after implementation. Once the user has entered `imm-run`, the routine task proceeds from that single confirmation through enrollment, execution, and QA with no further confirmation. Do not request confirmation for local in-scope edits, local verification, ordinary Direct rework, scoped diff review, or completion reporting. Managed evidence, QA, Review, and completion authority remain governed by their Managed contracts; R2 does not weaken them. Managed native-authority failures fail closed with one stable reason and exactly one same-Host recovery action; never offer a Pi, Direct Path, cross-Host/worktree, unmanaged, or automatic-retry fallback.
 
 For an unborn symbolic Git HEAD, the same Enrollment confirmation discloses an empty root commit. After approval, the Host creates that commit without staging project content or changing the index/worktree, then revalidates ownership and rehearses Enrollment against the new base. Git identity uses existing environment/config values with an explicit automation fallback, never config writes. Decline or pre-initialization cancellation leaves HEAD unborn; if later Enrollment fails or is cancelled, report the remaining commit. Invalid Git refs are errors, not initialization candidates.
 

package/plugins/immune-brain/skills/imm-brainstorm/SKILL.md

@@ -25,7 +25,8 @@ or all references as an entry prerequisite.
 - requested framing document: [Output Language Policy](../../dist/BASELINE.md#output-language-policy)
 
 When framing discusses later execution, describe Enrollment only as the
-current Host's native gate. A failed Managed authority interaction stays
+current Host's native gate, opened as the first step of a user-launched
+`imm-run`. Brainstorm stops after framing; the user launches `imm-planner`. A failed Managed authority interaction stays
 fail-closed: report one same-Host recovery action, never another Host,
 worktree, or unmanaged implementation.
 

package/plugins/immune-brain/skills/imm-planner/SKILL.md

@@ -42,11 +42,11 @@ own routes instead of these stages.
 - retirement design: [Retirement Completion Contract](../../dist/imm-planner.md#retirement-completion-contract)
 - optional research dispatch: [Research Dispatch](../../dist/imm-planner.md#research-dispatch)
 
-Plan-only requests stop after candidate TaskIntent validation, plus Spec validation when the work is complex. Requests
-that include execution invoke the current Host's native Enrollment gate
-directly, without chat pre-confirmation. Native-gate failure stays fail-closed
-in that Host: report its reason and one retry action only; never suggest
-another Host, worktree, or unmanaged implementation as a fallback.
+Every request stops after candidate TaskIntent validation, plus Spec validation when the work is complex; Plan-only requests stop there too. The Planner
+never invokes the current Host's native Enrollment gate, even when the request also asks for
+execution: report the candidate and name a literal-user `imm-run` entry as the
+only next step. Never suggest another Host, worktree, or unmanaged
+implementation as a fallback.
 
 Before that handoff, confirm complete mapping of every upstream item and
 required phase with each Slice's result and the remaining gap; reject a plan

package/plugins/immune-brain/skills/imm-run/SKILL.md

@@ -11,7 +11,8 @@ ordinary host input never resumes a Managed owner implicitly.
 
 Mandatory constraints before any action: verify the active backend claim,
 TaskIntent, and TaskRecord via `imm_kernel_canary` `status` first; invalid or
-contradictory projections fail closed. Resume only from those authority facts:
+contradictory projections fail closed. With no active claim, the first step
+is the native Enrollment gate for the validated candidate, invoked once. Resume only from those authority facts:
 a compaction heading, HANDOFF summary, or Issue state is prose, never authority.
 All Managed authority gates use the
 current Host's native interaction. A failed gate stays fail-closed and

package/plugins/immune-brain/skills/imm-test-prune/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: imm-test-prune
+description: Use when the user explicitly requests Immune-Brain audit or pruning of redundant, bloated, or orphaned tests.
+---
+
+# Immune-Brain: Test Prune
+
+Use [`../../dist/imm-test-prune.md`](../../dist/imm-test-prune.md) as the canonical
+contract index, not a whole-document read. This is a
+standalone host-native maintenance entry, not a Managed Path continuation
+and not an `imm-run` internal-role dispatch.
+
+Mandatory constraints: audit is read-only. Mutation requires exact hash-bound
+manifest approval and immediate revalidation. Preserve active Managed ownership;
+use only the repository's own test and coverage commands; never install
+dependencies, weaken a live assertion, change production source, or commit.
+Interruption requires a fresh scan.
+
+Section routes - load a section's instructions only when its branch applies.
+Read each linked heading body up to the next heading; nested sections and
+references load only under their own condition. Never read the whole contract
+or all references as an entry prerequisite.
+
+- common: [Authority Boundary](../../dist/imm-test-prune.md#authority-boundary), [Invocation](../../dist/imm-test-prune.md#invocation)
+- audit or manifest preparation: [Inventory and Manifest](../../dist/imm-test-prune.md#inventory-and-manifest)
+- approved mutation before any edit: [Mutation Envelope](../../dist/imm-test-prune.md#mutation-envelope), [Approved Mutation](../../dist/imm-test-prune.md#approved-mutation)
+- completion: [Verify and Report](../../dist/imm-test-prune.md#verify-and-report)
+- recovery or deletion recoverability: [Recovery](../../dist/imm-test-prune.md#recovery)

package/plugins/immune-brain/skills/registry.yaml

@@ -56,6 +56,15 @@ skills:
     output_artifacts: [maintain_report]
     next_actions: []
     boundary: Minimize tracked agent-instruction context after explicit manifest approval; no Managed authority mutation, contract installation, or reference-document creation.
+  - name: imm-test-prune
+    path: skills/imm-test-prune/SKILL.md
+    role: execute
+    title: Test Prune
+    role_class: repair
+    canonical: true
+    output_artifacts: [test_prune_report]
+    next_actions: []
+    boundary: Audit and prune redundant tests after explicit manifest approval; no Managed authority mutation, production-source change, or assertion weakening.
   - name: imm-retro
     path: skills/imm-retro/SKILL.md
     role: execute