immune-brain 5.1.2 → 5.3.0

package/plugins/immune-brain/dist/imm-brainstorm.md

@@ -1,6 +1,6 @@
 ---
 name: imm-brainstorm
-description: Use when the user explicitly requests Immune-Brain requirement clarification.
+description: Use when the user asks to clarify or explore requirements before Immune-Brain planning.
 ---
 
 # Immune-Brain: Brainstormer
@@ -138,7 +138,7 @@ Runtime helpers: `imm_core.buildBrainstormEnsembleRequest`, `imm_core.buildBrain
 
 A Brainstorm ensemble is optional advisory-only framing input, not a vote and not a child-owned decision. The default roles are clarify scope, divergent options, minimal solution, and risk review.
 
-All Brainstorm ensemble children are advisory-only with `tool_policy: no tools`; they do not edit code, write Specs, write Plans, mutate workflow state, or close QA. The parent `imm-brainstorm` owns final framing synthesis, Brainstorm manifest IDs, and decision-delta confirmation. Final Spec and Plan authority stays with `imm-planner`. Routine Managed enrollment uses the current Host's native confirmation bound to the TaskIntent revision, content hash, and preparation digest as the single authority gate; Enrollment validates descriptor structure without executing acceptance descriptors, deterministic QA executes them after implementation, and the routine task proceeds without a second human stop. A later authority-gate failure stays fail-closed in the current Host and reports exactly one same-Host recovery action; Brainstorm must never recommend another Host, worktree, or unmanaged implementation as a fallback.
+All Brainstorm ensemble children are advisory-only with `tool_policy: no tools`; they do not edit code, write Specs, write Plans, mutate workflow state, or close QA. The parent `imm-brainstorm` owns final framing synthesis, Brainstorm manifest IDs, and decision-delta confirmation. Final Spec and Plan authority stays with `imm-planner`. Neither Brainstorm nor the Planner invokes Enrollment: the user launches `imm-planner` after framing and `imm-run` after planning, and a confirmation of a framing or a plan starts neither. Routine Managed enrollment is the first step of an explicit `imm-run` entry and uses the current Host's native confirmation bound to the TaskIntent revision, content hash, and preparation digest as the single authority gate; Enrollment validates descriptor structure without executing acceptance descriptors, and deterministic QA executes them after implementation. A later authority-gate failure stays fail-closed in the current Host and reports exactly one same-Host recovery action; Brainstorm must never recommend another Host, worktree, or unmanaged implementation as a fallback.
 
 Pi's adapter may consume `brainstorm_ensemble` dispatch JSON to prepare advisory Pi subagent envelopes, but envelope construction is not child execution and does not transfer framing authority. Pi launches one foreground Agent at a time, consumes its direct result, and re-evaluates the remaining dispatch budget before launching another candidate. Runtime does not call any agent, poll or recover background work, mutate state, or own final Spec/Plan authority. Pi subagent children remain no-tools advisory candidates; the parent `imm-brainstorm` collects outputs before synthesis.
 
@@ -171,5 +171,5 @@ Default user-facing shape: `Conclusion -> Scope -> Next Action`. For the normal
 ## Next Action
 
 - Gate: The material frontier is empty; no required fact blocks the handoff; every material user decision is settled by a direct requirement, explicit answer, or adopted recommendation; and the result-only summary introduces no unconfirmed decision delta. **If any required clarification remains unanswered, you MUST NOT proceed to planning or suggest the next skill.** **If a decision delta is still unconfirmed, you MUST NOT proceed to planning, must not name a next skill, and should ask the user to confirm only that delta.**
-- If gates pass: suggest `imm-planner` with a one-line reason.
+- If gates pass: suggest `imm-planner` with a one-line reason and stop. The user launches it; Brainstorm never enters `imm-planner` or `imm-run` on its own and never invokes Enrollment.
 - If gates are not met: state which questions or decision deltas remain open; do not name a next skill and wait for the user's answer.

package/plugins/immune-brain/dist/imm-doc-prune.md

@@ -117,7 +117,8 @@ no persistent report, and no automatic commit.
 
 This Skill may modify or delete approved documentation, explicit translation
 or generated mirrors, documentation sync manifests, and tests whose only
-behavior is asserting document existence or obsolete wording. It must stop
+behavior is asserting document existence or obsolete wording; test structure and
+behavioral coverage belong to `imm-test-prune`. It must stop
 when completion requires runtime behavior, business-test semantics, package
 exports, public API, credentials, network writes, Git history rewriting, or
 any Managed authority mutation.

package/plugins/immune-brain/dist/imm-planner.md

@@ -1,6 +1,6 @@
 ---
 name: imm-planner
-description: Use when the user explicitly requests Immune-Brain Spec and TaskIntent planning.
+description: Use when the user asks for an Immune-Brain Spec, Plan, or TaskIntent for a repository change.
 ---
 
 # Immune-Brain: Planner
@@ -9,24 +9,24 @@ This skill adheres to the **[BASELINE.md](BASELINE.md)**.
 
 ## Managed Request Routing
 
-`imm-planner` is entered explicitly by the user for a clear repository mutation.
-Ordinary host input does not invoke this Skill through natural-language routing.
+`imm-planner` starts on the user's request for a Spec, Plan, or TaskIntent for a
+repository change, by slash command or in natural language. A request that asks
+for none of these stays host-native, and `imm-run` starts only from a
+literal-user entry. A model-entered Planner outside an enrolled task ends the
+session's run entry, so Enrollment needs a fresh `imm-run` entry.
 An active Assurance projection remains authoritative and is resumed only through
-an explicit `imm-run` entry; explicit Planner entry owns planning and the later
-native Enrollment gate.
-
-Plan-only output remains non-authoritative. Planner creates or validates a
-candidate Spec/TaskIntent. Planner may request the native Enrollment gate;
-only that gate grants execution authority. Explicit Plan-only requests stop after returning the
-planning artifacts. A later literal-user request to start Enrollment is a
-non-authoritative execution trigger: invoke the native Enrollment gate directly,
-without asking for chat pre-confirmation. For a clear mutation request that
-already includes execution, invoke that gate as soon as the candidate is
-validated and Git-tracked. Literal-user confirmation in the current Host's
-native gate remains the authority boundary. A gate failure preserves candidate
-artifacts and reports its reason plus exactly one same-Host recovery action; it
-must never recommend another Host, worktree, Direct Path, unmanaged
-implementation, or automatic retry. Fast-Track may compress the same phases but
+an explicit `imm-run` entry; Planner entry owns planning only.
+
+Planner output remains non-authoritative. Planner creates or validates a
+candidate Spec/TaskIntent and never invokes the native Enrollment gate;
+only that gate grants execution authority, and it opens only as the first step
+of a literal-user `imm-run` entry. Every Planner request stops after returning
+the validated planning artifacts, including a request that also asks for
+execution: report the candidate and name a literal-user `imm-run` entry as the
+only next step. A design confirmation, a generic continuation, or a request to
+start Enrollment received inside the Planner is not an `imm-run` entry and
+opens no gate. Literal-user confirmation in the current Host's
+native gate remains the authority boundary. Fast-Track may compress the same phases but
 cannot bypass that boundary, QA, Review, authorization, or completion.
 
 ## Clarification supplement
@@ -119,13 +119,12 @@ Enrollment.
 
 Host identity is implicit and never a planning input. The production boundary
 that turns a Git-tracked TaskIntent draft into managed execution authority is
-the current Host's native Enrollment gate. Invoke that Host integration
-directly when the route is ready; do not ask for chat pre-confirmation. The
-single literal-user decision is bound to the TaskIntent revision, content hash,
-and preparation digest. Enrollment validates the intent, Git ownership, scope,
-workspace claim, and final authority preconditions without executing acceptance
-descriptors. A routine task proceeds from that single confirmation through
-enrollment, execution and QA without a second human stop.
+the current Host's native Enrollment gate. `imm-run` invokes that Host
+integration as the first step of a literal-user entry; the Planner never does.
+The single literal-user decision is bound to the TaskIntent revision, content
+hash, and preparation digest. Enrollment validates the intent, Git ownership,
+scope, workspace claim, and final authority preconditions without executing
+acceptance descriptors.
 
 **Automatic policy activation**
 
@@ -327,11 +326,9 @@ prompt digests never belong in this external handoff. If
 Local mode performs zero GitHub operations.
 
 The batch result includes an execution recommendation: the first unblocked Task,
-a stable dependency order, and parallel groups. For a plan-only request, report
-that recommendation and stop. For a request that includes execution, invoke the
-native Enrollment gate for the recommended first TaskIntent after successful
-publication; do not ask for another chat confirmation. GitHub selection never
-bypasses Enrollment.
+a stable dependency order, and parallel groups. Report that recommendation and
+stop; the user enrolls the recommended first TaskIntent through a literal-user
+`imm-run` entry. GitHub selection never bypasses Enrollment.
 
 Tracker output is observation, never authority. Before the Planner returns, its
 GitHub carrier outcome must be exactly one of: `tracker_associated` after the
@@ -435,7 +432,7 @@ it, and structural Enrollment readiness is not proof that a descriptor executed.
 - **Planning granularity**: Keep a coherent outcome together when acceptance, risk, rollback, and authority can settle together. Use the TaskIntent decomposition rules below for independent outcomes. File count, tokens, compactions, elapsed time, and review rounds are evidence for judgment, not universal gates.
 - **Historical artifacts**: v3 prose Plan mutation is retired. `imm-plan` is a read-only validator for archived Plans; create no new Roadmap, Phase, successor Plan, or State Ledger.
 - **Risk-Triggered Exploration**: Before authoring a TaskIntent, resolve only unknowns that could change scope, design, or verification using targeted read-only probes. Internal `arch-explorer` and explicit-lens `advisory-reviewer` roles return evidence without writing the Spec, TaskIntent, or workflow state. Stop probing when outcome, scope, and verification are concrete. Do not use retired Plan termination flags to classify discovery failures.
-- **Simplicity**: Apply the BASELINE Workflow Activation gate first. Non-mutating host-native work creates no Planner artifact. Explicit Immune-Brain Skill entry starts this Planner phase; ordinary host input does not invoke it through natural-language routing. Create one coherent outcome instead of expanding ceremony.
+- **Simplicity**: Apply the BASELINE Workflow Activation gate first. Non-mutating host-native work creates no Planner artifact. The user's request for a Spec, Plan, or TaskIntent, by slash command or in natural language, starts this Planner phase; other host input stays host-native. Create one coherent outcome instead of expanding ceremony.
 - **Design-Depth Classification**: Classify change design risk with the smallest sufficient tier: **Low risk** (copy, configuration, trivial rename, or contained local fix) may omit a separate Technical Design; **Medium risk** (non-trivial single-module behavior or internal contract) records affected components, decisions, invariants, failure behavior, and verification implications; **High risk** (cross-module/API/data-flow/state-machine, security, migration, concurrency, architecture ownership, cross-runtime/package-contract, or persisted-state work) records boundaries, interfaces or flow, alternatives, invariants, rollback/compatibility, and verification implications. Medium and High risk require Technical Design in the Spec. Do not classify a change as Low risk when it has a contract, ownership, security, persistence, compatibility, or multi-component concern. Every new or revised Spec records `**Design risk**: Low|Medium|High` with an adjacent rationale.
 - **Design-view selection**: For Medium and High risk, select every materially relevant technical-design view from architecture layers, service/component interfaces, data flow, state transitions, and temporal sequence. Record a short `Design views` statement naming the selected views and why any omitted view cannot affect the design. Do not write empty architecture, interface, data-flow, state, or sequence sections. Low risk remains concise and may omit Technical Design. When a selected view is recorded, also record its required decision content: architecture layers need layer responsibilities, dependency direction, ownership, and prohibited coupling; service/component interfaces need inputs, outputs, errors, compatibility/versioning, and caller/callee ownership; data flow needs source, transformations, validation, destination, and failure handling; state transitions need states, legal transitions, trigger, invariant, terminal ownership, and recovery; temporal sequence needs ordered interactions, authority at each point, interruption behavior, and idempotency.
 - **Technical Design Authority**: The Spec is the single Technical Design baseline. TaskIntent acceptance and scope reference the applicable design decisions or invariants without copying Technical Design prose. If discovery invalidates the baseline, stop execution and return to Planner to update the Spec and decide whether `replan` is required. TaskIntent and Initiative text do not duplicate Technical Design prose or become a prose Plan substitute.
@@ -520,7 +517,7 @@ states principles; enumeration of cases belongs in tests.
 
 ## Planning Rules
 
-- **Entry Contract**: Use when Spec/TaskIntent planning is needed. An already enrolled owner remains on its current Kernel authority and resumes only through explicit `imm-run`; a validated candidate still needs native Enrollment.
+- **Entry Contract**: Use when Spec/TaskIntent planning is needed. An already enrolled owner remains on its current Kernel authority and resumes only through explicit `imm-run`; a validated candidate still needs native Enrollment, which only an explicit `imm-run` entry opens.
 - **Output Language Gate**: Before writing or revising any Spec or Plan, read the project output language policy from `AGENTS.md`, `IMMUNE.md`, or Immune-Brain plugin config. Default Spec and Plan prose to English unless the current user request, project instructions, or host/user preference contains an explicit document-language instruction. A reply-language instruction does not change document language. Keep schema fields, CLI commands, file paths, code identifiers, enum values, JSON keys, and canonical terms such as `Step`, `Plan`, `Spec`, `Verification`, `Discovery cache`, and `Devil's Advocate Audit` literal.
 - **Clarification Supplement**: If an upstream `imm-brainstorm` manifest exists, verify that every `BR-Q-*` item is resolved and every confirmed framing decision is represented; must not repeat, reopen, or rewrite confirmed decisions. Ask only a focused omission, repository-conflict, or invalidated-assumption delta tied to concrete evidence. Resolve a local delta here; return to `imm-brainstorm` when it reopens multiple product branches or changes the overall goal or Scope. Finalization requires no unresolved supplement and no unconfirmed decision introduced by Planner.
 - **Planning Bootstrap**: When no upstream `imm-brainstorm` manifest exists, preserve Direct Planner entry by resolving repository facts and deriving ordinary technical choices. An already-clear request takes the zero-question fast path to a non-blocking correction summary. Discovery of an unresolved user-owned goal, user, scope, behavior, compatibility preference, risk acceptance, or success criterion returns to `imm-brainstorm`; Planner does not convert product uncertainty into a silent assumption or duplicate Brainstorm's interview.
@@ -601,7 +598,7 @@ optional advisory dispatch fails, continue inline and record the reason.
 
 - **Allowed**: Write a TaskIntent. Add a Spec only for complex work. Activate an absent routing policy under Kernel TaskIntent Routing. Initiative planning carriers and necessary domain vocabulary.
 - **Blocked**: Implementation edits, direct Kernel-store writes, enrolled intent overwrites, and QA/Review decisions.
-- **Workflow guard**: Execution continues through native Enrollment and explicit `imm-run`. Planner owns design and decomposition, not execution authority.
+- **Workflow guard**: Execution starts only from a literal-user `imm-run` entry, whose first step is native Enrollment. Planner owns design and decomposition, never Enrollment or execution authority.
 
 ## Output artifact
 
@@ -649,11 +646,10 @@ a State Ledger. Keep historical Plan validation strictly read-only.
 - Validate every candidate through `imm-kernel intent validate <path> --json` after authoring and staging. Require `valid: true` and `enrollment_ready: true` before Enrollment. When `git_base_initialization_required: true`, report that the existing native Enrollment confirmation includes an empty root commit; leave initialization to the Host. An invalid `git_base` blocks Enrollment and requires Git repair.
 - For complex work, verify Spec design metadata, document language, reference closure, concrete descriptor paths, and complete Brainstorm traceability before handoff. Simple TaskIntent-only work verifies those properties on the Intent.
 - Enrollment validates descriptor structure only. Deterministic QA owns descriptor execution after implementation; planning does not run the acceptance suite.
-- Managed execution handoff is Git-tracked TaskIntent author/validate plus current-Host native Enrollment. Do not sync a v3 State Ledger or invoke a missing dispatcher.
+- Managed execution handoff is Git-tracked TaskIntent author/validate; current-Host native Enrollment follows in `imm-run`. Do not sync a v3 State Ledger or invoke a missing dispatcher.
 
 ## Next Action
 
-- Gate: Reference closure and clarification are complete; every upstream `BR-*` item is represented; no unresolved user decision remains; Planner-introduced decision deltas are confirmed; the candidate is Git-tracked and validates with `valid: true` and `enrollment_ready: true`; each acceptance has concrete focused verification. Plan-only requests stop here.
-- If gates pass: for Kernel-managed work, invoke the current Host's native Enrollment Tool directly without chat pre-confirmation. Its single literal-user gate binds the TaskIntent revision, content hash, and preparation digest, validates Enrollment preconditions without executing acceptance descriptors, and enrolls the task to continue through `imm-run`.
-- If the native gate fails: preserve candidate artifacts and report the stable reason plus exactly one same-Host recovery action. Do not suggest another Host, worktree, Direct Path, unmanaged implementation, or automatic retry.
+- Gate: Reference closure and clarification are complete; every upstream `BR-*` item is represented; no unresolved user decision remains; Planner-introduced decision deltas are confirmed; the candidate is Git-tracked and validates with `valid: true` and `enrollment_ready: true`; each acceptance has concrete focused verification. Plan-only requests stop here, and so does every other Planner request.
+- If gates pass: report the validated candidate (and, for an Initiative, the recommended first Task) and name a literal-user `imm-run` entry as the only next step. Do not invoke the current Host's native Enrollment Tool: Enrollment is the first step of `imm-run`, and a confirmation of the plan is not that entry.
 - If gates are not met: state which validation failures, unresolved verification paths, or material decision deltas remain; do not name a next skill.

package/plugins/immune-brain/dist/imm-run.md

@@ -20,6 +20,17 @@ Host's `status` projection first and verify the exact active backend claim,
 TaskIntent, and TaskRecord. Invalid or contradictory projections fail closed. A
 candidate TaskIntent is not Enrollment authority.
 
+Enrollment is the first step of an explicit `imm-run` entry and belongs to no
+other Skill. When the entry finds no active claim, resolve the validated
+candidate the user named (or the Planner's recommended first Task when the entry
+names none and exactly one candidate fits), then invoke the current Host's
+native Enrollment gate once, without chat pre-confirmation, and continue from
+the returned projection. Planner and Brainstorm never open that gate; a
+confirmation given to either is not this entry. A gate failure preserves the
+candidate and reports its stable reason plus exactly one same-Host recovery
+action; never recommend another Host, worktree, Direct Path, unmanaged
+implementation, or automatic retry.
+
 Before the first Enrollment of a candidate TaskIntent, confirm the Planner
 returned `tracker_associated` — but only when the candidate belongs to an
 identified GitHub-carried Initiative. Standalone TaskIntents and Local
@@ -60,9 +71,9 @@ Before a child dispatch, read the [Subagent Dispatch Protocol](docs/reference/su
 Never load an internal role as a public Skill or spawn another loop process;
 the only exception is a Lane's Executor Host under
 [Lane Executor Supervision](#lane-executor-supervision).
-The standalone `imm-pr-fix`, `imm-doc-prune`, and `imm-doc-slim` are host-native
-maintenance entries, never dispatched as the Loop role. Internal `test-fixer`
-and `pr-fix` repairs remain bounded by the enrolled TaskIntent.
+The standalone `imm-pr-fix`, `imm-doc-prune`, `imm-doc-slim`, and `imm-test-prune`
+are host-native maintenance entries, never dispatched as the Loop role. Internal
+`test-fixer` and `pr-fix` repairs remain bounded by the enrolled TaskIntent.
 
 ## Execution Loop
 

package/plugins/immune-brain/dist/imm-test-prune.md

@@ -0,0 +1,233 @@
+---
+name: imm-test-prune
+description: Use when the user explicitly requests Immune-Brain audit or pruning of redundant, bloated, or orphaned tests.
+---
+
+# Immune-Brain: Test Prune
+
+Reduce test-suite bloat in one Git repository. The Skill works through explicit
+invocation, a comprehensive test inventory, evidence-based candidate narrowing,
+one exact user-approved manifest, and bounded test-only mutation that never
+weakens a live guarantee. It is language- and runner-agnostic: it uses the
+target repository's own test, coverage, and static-check commands. This is a
+standalone host-native maintenance entry, not a Managed Path continuation and
+not an `imm-run` internal-role dispatch.
+
+## Authority Boundary
+
+This Skill restructures and prunes tests without creating or mutating
+TaskIntent, TaskRecord, Kernel, Spec, or Plan authority. An already active
+Managed task remains owned by `imm-run`. Read-only inventory and manifest
+production remain available.
+
+Classify each of the following candidates as `BLOCKED_ACTIVE_SCOPE` and
+continue auditing unaffected candidates:
+- a candidate overlapping the active TaskIntent `scope_hint`;
+- a candidate named by an active acceptance descriptor's verification `argv`.
+
+If the routing owner or scope cannot be read reliably, fail closed for
+mutation. This Skill does not invoke `imm-doc-prune`. Tests whose only behavior
+is asserting document existence or wording remain that Skill's job and are
+reported as `DEFER_DOC_PRUNE`.
+
+## Invocation
+
+Requires explicit invocation: `imm-test-prune` or `/imm-test-prune`. Ordinary
+"is this test redundant?" questions and routine test maintenance during a
+change stay host-native and do not enter this Skill.
+
+- `imm-test-prune audit`: read-only. Produce the manifest and stop.
+- `imm-test-prune`: produce the manifest, then wait for exact manifest
+  approval before any mutation.
+- An optional path argument narrows inventory to the named test files or
+  directories. The evidence rules still read the whole repository.
+
+No automatic invocation. No daemon, no cron, no CI gate, no allowlist, no
+runtime, no persistent report, no dependency installation, and no automatic
+commit.
+
+## Ordered Pruning Protocol
+
+### Inventory and Manifest
+
+1. **Establish repository safety.** Mutation requires a Git worktree. A
+   non-Git repository or an untracked candidate is audit-only. For each
+   candidate, record:
+   - path;
+   - blob/content hash;
+   - tracked status;
+   - candidate-local worktree status;
+   - line count;
+   - test-case count.
+
+   Unrelated dirty files do not block the run; a dirty candidate is `BLOCKED`.
+
+2. **Discover the repository's commands.** Read existing scripts, task files,
+   CI configuration, and runner configuration to identify the following,
+   without installing anything:
+   - the test command;
+   - its single-file and single-test selection syntax;
+   - its coverage command and report format;
+   - the static checks a contributor runs locally.
+
+   Record the result as the coverage capability:
+   - `isolated`: coverage can be collected for one selected test;
+   - `file`: coverage can be collected only for one test file;
+   - `unavailable`: no coverage tool is already configured or installed, or
+     collection fails.
+
+   Never add a coverage tool, plugin, or configuration to obtain coverage.
+
+3. **Record the baseline.** Run the discovered test command over the
+   inventoried scope once and record pass/fail per file and wall time. A file
+   already failing at baseline is `BLOCKED` for mutation and reported. This
+   Skill never repairs or deletes a failing test to make the suite green. When
+   coverage capability is not `unavailable`, also record baseline line
+   coverage for the source files the candidates exercise.
+
+4. **Inventory tests and support code.** Enumerate tracked test files,
+   fixtures, helpers, and snapshots. Exclude dependency, vendor, build-output,
+   and cache trees.
+
+5. **Classify test roles.**
+   - behavior: asserts runtime or public-surface behavior;
+   - documentation contract: asserts document existence, wording, links, or
+     sections;
+   - packaging and mirror consistency: asserts that registries, generated
+     output, and packaged copies agree;
+   - historical evidence: protects readers of frozen or archived records;
+   - `UNCLASSIFIED`: grouped, not interrogated file by file.
+
+   Historical-evidence and packaging-consistency tests are `KEEP` unless the
+   protected reader or consumer is proven retired.
+
+6. **Mechanically narrow candidates.**
+   - Find structurally identical cases that differ only in literal inputs.
+   - Find repeated setup blocks across cases or files.
+   - Find hard-coded lists that duplicate a canonical registry or manifest.
+   - Find assertions whose subject (symbol, path, command, or public surface)
+     no longer exists in current source.
+   - Find orphaned fixtures and helpers with no remaining importer.
+   - Find tests that assert private implementation detail where a
+     public-surface assertion already covers the same behavior.
+
+7. **Apply evidence rules.** Age, file length, test count, and intermittent
+   failure alone never prove a test redundant.
+
+   `DELETE` requires one of the following:
+   - **Retirement**: the protected behavior is retired, with the retiring
+     commit or a current owner showing it removed.
+   - **Subsumption**: a named surviving test covers the same behavior with
+     equal or stronger assertions, and coverage evidence supports it. With
+     `isolated` or `file` capability, the surviving test's covered lines must
+     be a superset of the removed test's covered lines. Collect this only for
+     candidate entries, at the finest available granularity.
+
+   Line coverage is necessary, not sufficient: the assertion comparison is
+   still required.
+
+   A subsumption claim is `UNVERIFIED` and not mutable when any of these holds:
+   - coverage capability is `unavailable`;
+   - collection fails;
+   - repeated runs disagree.
+
+   A `MERGE` that drops any case follows the same subsumption rule. `MERGE` and
+   `PARAMETERIZE` that keep every distinct input and assertion need no coverage
+   evidence.
+
+   `RELAX_TO_STRUCTURE` is allowed only where the asserted text is not a
+   machine contract consumed by code, a host, or a packaged surface.
+
+8. **Produce one exact manifest.** State the discovered commands and coverage
+   capability first. Classify each entry as one of:
+   - `MERGE`
+   - `PARAMETERIZE`
+   - `EXTRACT_HELPER`
+   - `DERIVE_FROM_SOURCE`
+   - `RELAX_TO_STRUCTURE`
+   - `DELETE`
+   - `KEEP`
+   - `BLOCKED`
+   - `BLOCKED_ACTIVE_SCOPE`
+   - `DEFER_DOC_PRUNE`
+   - `UNVERIFIED`
+
+   Each entry includes:
+   - evidence;
+   - the exact file, case, or helper action;
+   - for every `DELETE`, the retirement proof, or the surviving owner with its
+     coverage evidence;
+   - the expected change in case count and line count;
+   - the candidate hash.
+
+   Group `UNCLASSIFIED` files.
+
+9. **Gate mutation.** `audit` mode stops after the manifest. Mutation mode
+   also stops until the literal user approves exact manifest entries (for
+   example, "all recommendations except 4 and 7"). Broad approval such as
+   "clean up the tests" is insufficient. Interruption starts a fresh scan; no
+   manifest is persisted.
+
+### Approved Mutation
+
+10. **Revalidate and mutate minimally.** Before each approved change, re-read
+    the candidate bytes, Git status, importers, and active scope. Drift blocks
+    that item. Apply one manifest entry at a time, then run that entry's
+    focused tests before the next. A failing focused check stops further
+    mutation and leaves the inspectable diff.
+
+## Mutation Envelope
+
+This Skill may modify, merge, parameterize, or delete approved test files,
+fixtures, helpers, and snapshots, and may add shared helpers beside the
+repository's existing test helpers. It must stop when completion requires
+changing any of the following:
+- production source;
+- public API;
+- package exports;
+- registries or generated output;
+- dependencies, lockfiles, or coverage configuration;
+- credentials or network writes;
+- Git history;
+- any Managed authority mutation.
+
+**Never weaken a live guarantee.** Never do any of the following to make a
+check pass or to reduce counts:
+- skip, focus, or mark a test pending;
+- loosen an assertion's strength (exact to partial, equality to existence,
+  specific error to any error);
+- widen a timeout;
+- delete a negative assertion that still guards a live boundary.
+
+Snapshot updates are allowed only for cases whose structure the approved entry
+changed, never as a blanket refresh.
+
+## Verify and Report
+
+11. **Verify and report.**
+    - Re-run every touched test file plus the baseline scope, the discovered
+      static checks, and `git diff --check`.
+    - The baseline pass set must be preserved: every previously passing
+      behavior keeps a passing owner.
+    - When coverage capability is not `unavailable`, re-collect line coverage
+      for the baseline's source files. Any decrease blocks the run: name the
+      responsible entry and leave the diff for the user. Report coverage as
+      unavailable rather than inferring it.
+    - This Skill does not commit.
+    - Report only these sections:
+      - `Changed` (with entry IDs);
+      - `Deleted` (each with its retirement proof, or its surviving owner and
+        coverage evidence);
+      - `Blocked`;
+      - `Deferred to imm-doc-prune`;
+      - `Unverified`;
+      - `Delta` (case count, line count, wall time, and line coverage before
+        and after, or `coverage unavailable`);
+      - `Verification`;
+      - `Recovery: git log -- <path>`.
+
+## Recovery
+
+Git history is the archive for removed tests. Every `DELETE` entry reports
+`Recovery: git log -- <path>`. Untracked, dirty, baseline-failing, or non-Git
+candidates are never mutated.

package/plugins/immune-brain/dist/registry.yaml

@@ -56,6 +56,15 @@ skills:
     output_artifacts: [maintain_report]
     next_actions: []
     boundary: Minimize tracked agent-instruction context after explicit manifest approval; no Managed authority mutation, contract installation, or reference-document creation.
+  - name: imm-test-prune
+    path: skills/imm-test-prune/SKILL.md
+    role: execute
+    title: Test Prune
+    role_class: repair
+    canonical: true
+    output_artifacts: [test_prune_report]
+    next_actions: []
+    boundary: Audit and prune redundant tests after explicit manifest approval; no Managed authority mutation, production-source change, or assertion weakening.
   - name: imm-retro
     path: skills/imm-retro/SKILL.md
     role: execute

package/plugins/immune-brain/dist/role-prompts/code-review.md

@@ -26,6 +26,11 @@ material task-local maintenance risks. Pure naming, length, complexity
 thresholds, formatting, and design preference are not findings and must not
 cause style-only rework.
 
+Test-suite growth is advisory, never blocking: note a delivered test that
+duplicates an existing assertion, asserts only private implementation, or
+leaves a test protecting behavior the change retired. Weakened or missing
+tests for an acceptance remain blocking under the rules above.
+
 When a finding repeats an acceptance id or anchor that already produced rework in
 this task, do not file it as a fresh single-trigger defect. Name the invariant
 class it belongs to and state in `evidence.trigger` why the previously accepted

package/plugins/immune-brain/dist/role-prompts/executor.md

@@ -68,6 +68,14 @@ mock or hard-coded success, swallowed unexpected errors, missing validation at
 external trust boundaries, invented dependencies or APIs, unauthorized
 observable behavior changes, and production paths without a current caller.
 Do not weaken tests or hide an incomplete result to make Verification pass.
+
+Keep the test suite lean. Each added test pins one acceptance invariant or
+finding case at its public seam; do not mirror private calls, mock order or
+internal return values that a public assertion already covers. Before adding a
+test, search existing tests for the same behavior and extend or parameterize
+them instead of duplicating setup. When the change retires or replaces a
+behavior, update or delete the tests that protected it within scope and name
+the retired behavior or continuing owner in Delivery Evidence.
 Treat naming, function length, parameter count, nesting, and abstraction taste
 as contextual signals, never as automatic failure thresholds.
 

package/plugins/immune-brain/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "Observe Claude Code Review and session lifecycle for Immune-Brain, keep a batch Lane's file edits inside its Lane, and announce an active Managed task without resuming it. Hooks never mint authority.",
+  "description": "Observe Claude Code Review and session lifecycle for Immune-Brain, keep a batch Lane's file edits inside its Lane, require a literal-user phase entry before Enrollment, batch start or the imm-run Skill, and announce an active Managed task without resuming it. Hooks never mint authority.",
   "hooks": {
     "PreToolUse": [
       {
@@ -10,6 +10,15 @@
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/dist/claude/mcp-server.mjs\" --hook"
           }
         ]
+      },
+      {
+        "matcher": "Skill|mcp__.*immune-brain.*__(enroll|start_unattended_batch)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/dist/claude/mcp-server.mjs\" --hook"
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [

package/plugins/immune-brain/runtime/assurance/alias_file.ts

@@ -0,0 +1,24 @@
+// Reads one user command alias for phase entry recognition. An alias may be a
+// symlink, so the size bound is taken from the opened file, never from the link.
+
+import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
+
+export const MAX_ALIAS_BYTES = 64 * 1024;
+
+/** The alias body, or null when it is absent, not a regular file, or over the bound. */
+export function readAliasFile(path: string, maxBytes = MAX_ALIAS_BYTES): string | null {
+	let fd: number;
+	try { fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK); } catch { return null; }
+	try {
+		const stat = fstatSync(fd);
+		if (!stat.isFile() || stat.size > maxBytes) return null;
+		// One byte past the bound: a file that grew after the stat is refused too.
+		const buf = Buffer.alloc(maxBytes + 1);
+		const read = readSync(fd, buf, 0, buf.length, 0);
+		return read > maxBytes ? null : buf.toString("utf8", 0, read);
+	} catch {
+		return null;
+	} finally {
+		closeSync(fd);
+	}
+}