immune-brain 5.2.0 → 5.5.1

package/plugins/immune-brain/runtime/commands/kernel.ts

@@ -24,9 +24,14 @@ import {
 import {
 	INTENT_MAX_BYTES,
 	canonicalIntentHash,
+	parseProjectTaskIntent,
 	parseTaskIntentV1,
-	RISK_FLOOR_SCOPE_PREFIXES,
 } from "../kernel/intent";
+import {
+	floorMatchingScopeEntries,
+	floorScopePrefixes,
+	readRiskFloor,
+} from "../kernel/risk_floor";
 import { inspectSpecBinding } from "../kernel/spec_binding";
 import { projectTask, resolveProjectedRisk } from "../kernel/completion";
 import { deriveAssuranceAuthorization } from "../kernel/assurance_projection";
@@ -39,7 +44,7 @@ import {
 import { inspectRoutingPolicy } from "../managed_task_routing_policy"
 import { projectLegacyAudit } from "../kernel/legacy_audit";
 import { inspectStorageLayout } from "../kernel/storage_paths";
-import { migrateLegacyLayout } from "../kernel/storage_layout_migration";
+import { commitPendingMigrationDiff, migrateAndCommitLegacyLayout } from "../kernel/storage_layout_migration";
 import { readBackendClaim } from "../kernel/backend_claim";
 import { inspectEnrollmentGitBase, type EnrollmentGitBase } from "../assurance/enrollment_git_base";
 import { probeKernelStore } from "../kernel";
@@ -158,26 +163,6 @@ const RISK_ORDER: Record<TaskRisk, number> = {
 	critical: 2,
 };
 
-function matchingFloorEntries(intent: TaskIntentV1): string[] {
-	return intent.scope_hint.filter((entry) => {
-		try {
-			const trial = parseTaskIntentV1({
-				contract: intent.contract,
-				task_id: intent.task_id,
-				goal: intent.goal,
-				acceptance: intent.acceptance,
-				scope_hint: [entry],
-				risk: "routine",
-				revision: intent.revision,
-				owner: "user",
-			});
-			return trial.risk !== "routine";
-		} catch {
-			return false;
-		}
-	});
-}
-
 function readWorkspaceOwner(root: string): string | null {
 	try {
 		return readWorkspaceStateRaw(root).state.current_working;
@@ -204,10 +189,12 @@ function runInspect(root: string): KernelExecution {
 				: null,
 			workspace: { current_working: workspace },
 		};
+		const floor = readRiskFloor(root);
 		const idleRisk = {
 			declared: null as TaskRisk | null,
 			resolved: null as TaskRisk | null,
-			floor_prefixes: [...RISK_FLOOR_SCOPE_PREFIXES],
+			floor_prefixes: floorScopePrefixes(floor),
+			floor_invalid: floor.invalid,
 			floor_applied: false,
 			matching_scope_entries: [] as string[],
 		};
@@ -265,7 +252,7 @@ function runInspect(root: string): KernelExecution {
 			if (raw.risk !== "routine" && raw.risk !== "material" && raw.risk !== "critical")
 				throw new Error(`intent.risk is unreadable for ${claim.task_id}`);
 			declared = raw.risk;
-			intent = parseTaskIntentV1(raw);
+			intent = parseProjectTaskIntent(root, raw, record.intent_snapshot);
 			if (canonicalIntentHash(intent) !== record.intent_ref.content_hash)
 				throw new Error("TaskIntent sidecar does not match TaskRecord content hash");
 		} catch (error) {
@@ -280,11 +267,11 @@ function runInspect(root: string): KernelExecution {
 		}
 		const diffHash = identity.diff_hash;
 		const changedPaths = identity.changed_paths;
-		const decision = projectTask(intent, record, diffHash, record.intent_ref.content_hash, changedPaths);
+		const decision = projectTask(intent, record, diffHash, record.intent_ref.content_hash, changedPaths, floor);
 		const openUserDecisionCount = record.findings.filter(
 			(finding) => finding.kind === "unresolved_user_decision" && finding.status === "open",
 		).length;
-		const resolved = resolveProjectedRisk(intent, changedPaths);
+		const resolved = resolveProjectedRisk(intent, changedPaths, floor);
 		return {
 			result: jsonResult({
 				contract: "assurance_kernel/inspect/v1",
@@ -303,7 +290,7 @@ function runInspect(root: string): KernelExecution {
 						diff_hash: diffHash,
 						lifecycle: record.lifecycle,
 						artifact_state: record.artifact_state,
-						risk: resolveProjectedRisk(intent, changedPaths),
+						risk: resolved,
 						next_obligation: decision.next_obligation,
 						fresh_acceptance_ids: decision.fresh_acceptance_ids,
 						missing_acceptance_ids: decision.missing_acceptance_ids,
@@ -325,9 +312,10 @@ function runInspect(root: string): KernelExecution {
 				risk: {
 					declared,
 					resolved,
-					floor_prefixes: [...RISK_FLOOR_SCOPE_PREFIXES],
+					floor_prefixes: floorScopePrefixes(floor),
+					floor_invalid: floor.invalid,
 					floor_applied: RISK_ORDER[resolved] > RISK_ORDER[declared],
-					matching_scope_entries: matchingFloorEntries(intent),
+					matching_scope_entries: floorMatchingScopeEntries(intent.scope_hint, floor),
 				},
 				unobservable: UNOBSERVABLE,
 			}),
@@ -474,31 +462,16 @@ function runIntentAuthor(args: string[], root: string): KernelExecution {
 		};
 	}
 
-	// Storage-layout gate (BR-REQ-005/006): a stateful mutation recovers or
-	// migrates first and then STOPS without authoring. Kernel transaction
-	// markers recover under the store lock; the one-release migrator replays
-	// its frozen manifest under both locks. The original authoring is retried
-	// only after the affected migration diff is committed.
-	try {
-		probeKernelStore(root);
-	} catch (error) {
-		return {
-			result: errorResult(
-				"layout_recovery_failed",
-				`Kernel transaction recovery failed before authoring: ${error instanceof Error ? error.message : String(error)}`,
-				1,
-			),
-			journal: journalFor(
-				"intent",
-				null,
-				"rejected",
-				"source_invalid",
-				null,
-				"Resolve the pending Kernel transaction marker before retrying.",
-			),
-		};
+	// Pending diffs may be committed; conversion stays on the explicit command.
+	let layout = inspectStorageLayout(root);
+	if (layout.layout === "migration_uncommitted") {
+		try {
+			commitPendingMigrationDiff(root);
+			layout = inspectStorageLayout(root);
+		} catch (error) {
+			return sourceFailure("intent", error);
+		}
 	}
-	const layout = inspectStorageLayout(root);
 	if (layout.layout === "migration_blocked_active") {
 		return {
 			result: errorResult(
@@ -532,7 +505,7 @@ function runIntentAuthor(args: string[], root: string): KernelExecution {
 				"rejected",
 				"source_invalid",
 				null,
-				"Run imm-kernel migrate --storage-layout, commit the affected paths, then retry intent author.",
+				"Run imm-kernel migrate --storage-layout, then retry intent author.",
 			),
 		};
 	}
@@ -549,11 +522,17 @@ function runIntentAuthor(args: string[], root: string): KernelExecution {
 				"rejected",
 				"source_invalid",
 				null,
-				"Commit the migration diff or resolve the layout condition before authoring.",
+				"Resolve the reported layout condition before retrying authoring.",
 			),
 		};
 	}
 
+	try {
+		probeKernelStore(root);
+	} catch (error) {
+		return sourceFailure("intent", error);
+	}
+
 	// Existing managed ownership rejects before opening the destination.
 	const owner = intentActiveOwner(root);
 	if (owner.kernel)
@@ -632,7 +611,7 @@ function runIntentAuthor(args: string[], root: string): KernelExecution {
 	}
 	let intent: ReturnType<typeof parseTaskIntentV1>;
 	try {
-		intent = parseTaskIntentV1(parsed);
+		intent = parseProjectTaskIntent(root, parsed);
 	} catch (error) {
 		return {
 			result: errorResult(
@@ -1086,7 +1065,7 @@ function runIntentValidate(args: string[], root: string): KernelExecution {
 	// Strict parse + verification eligibility per acceptance item.
 	let intent: ReturnType<typeof parseTaskIntentV1>;
 	try {
-		intent = parseTaskIntentV1(parsed);
+		intent = parseProjectTaskIntent(root, parsed);
 	} catch (error) {
 		return {
 			result: jsonResult(
@@ -1331,7 +1310,7 @@ function executeKernelCommand(args: string[], root: string): KernelExecution {
 						reason: layout.reason,
 						next_action:
 							layout.layout === "migration_required"
-								? "run the one-release migration through the next stateful mutation and commit the affected diff"
+								? "run imm-kernel migrate --storage-layout, then retry legacy audit"
 								: "resolve the reported layout condition before legacy audit",
 					},
 				}),
@@ -1418,58 +1397,17 @@ function runStorageLayoutMigration(root: string): KernelExecution {
 				"Resolve the reported layout condition, then rerun imm-kernel migrate --storage-layout.",
 			),
 		};
-	const migration = migrateLegacyLayout(root);
-	if (migration.outcome === "migrated")
+	const migration = migrateAndCommitLegacyLayout(root);
+	if (migration.outcome === "migrated" || migration.outcome === "already_migrated")
 		return {
 			result: jsonResult({
 				contract: "assurance_kernel/migration_completed/v1",
 				operation: "storage layout migration",
+				layout: "ready",
 				affected_paths: migration.affected_paths,
-				next_action: "commit the affected migration paths, then retry the original command",
-			}),
-			journal: journalFor(
-				"migrate",
-				null,
-				"escalated",
-				"migration_ambiguous",
-				null,
-				"Commit the affected migration paths, then retry the original command.",
-			),
-		};
-	if (migration.outcome === "migration_uncommitted")
-		return {
-			result: jsonResult({
-				contract: "assurance_kernel/migration_pending_commit/v1",
-				operation: "storage layout migration",
-				affected_paths: migration.affected_paths,
-				reason: migration.reason,
-				next_action: "commit the preserved audit evidence, then rerun imm-kernel migrate --storage-layout",
-			}),
-			journal: journalFor(
-				"migrate",
-				null,
-				"escalated",
-				"migration_ambiguous",
-				null,
-				"Commit the preserved audit evidence, then rerun imm-kernel migrate --storage-layout.",
-			),
-		};
-	if (migration.outcome === "already_migrated")
-		return {
-			result: jsonResult({
-				contract: "assurance_kernel/migration_completed/v1",
-				operation: "storage layout migration",
-				affected_paths: [],
 				next_action: "retry the original command",
 			}),
-			journal: journalFor(
-				"migrate",
-				null,
-				"ok",
-				"command_ok",
-				null,
-				"Retry the original command.",
-			),
+			journal: journalFor("migrate", null, "ok", "command_ok", null, "Retry the original command."),
 		};
 	return {
 		result: errorResult(

package/plugins/immune-brain/runtime/github_issue_tracker.ts

@@ -1,6 +1,7 @@
-import { spawn } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { basename, relative, resolve, sep } from "node:path";
+import { observeLocalInitiative } from "./local_initiative";
 import { readTaskIntent } from "./kernel/intent";
 
 const CONTRACT = "immune_brain/github_issue_tracker_result/v1" as const;
@@ -877,6 +878,49 @@ async function readBlockedByIds(
 	}
 }
 
+export async function assertIsolatedTaskPrerequisites(root: string, taskId: string,
+	transport?: GhTransport): Promise<void> {
+	const directory = resolve(root, "docs/initiatives");
+	const local = existsSync(directory) ? readdirSync(directory, { withFileTypes: true })
+		.filter(entry => entry.isFile() && /^[A-Za-z0-9][A-Za-z0-9._-]*\.md$/.test(entry.name))
+		// Only a file that names this Task can own it; an unrelated or malformed Initiative file must
+		// not block Enrollment, while a malformed file that does name it still fails closed below.
+		.filter(entry => readFileSync(resolve(directory, entry.name), "utf8").includes(taskId))
+		.map(entry => observeLocalInitiative(root, entry.name.slice(0, -3)))
+		.filter(parent => parent.tasks.some(task => task.task_id === taskId)) : [];
+	if (local.length > 1) throw new Error("Slice has ambiguous Local Initiative ownership");
+	if (local.length === 1) {
+		const parent = local[0]!;
+		const child = parent.tasks.find(task => task.task_id === taskId)!;
+		if (child.blocked_by.length) {
+			const { observeParentCompletion } = await import("./unattended/batch_git");
+			const proof = await observeParentCompletion(root, parent.initiative_id, child.blocked_by);
+			if (proof.missing_task_ids.length) throw new Error(`Isolated Slice prerequisites are not integrated: ${proof.missing_task_ids.join(", ")}; execute only this Slice after its prerequisites are delivered`);
+		}
+		return;
+	}
+	if (!transport) {
+		const remotes = spawnSync("git", ["-C", root, "remote"], { encoding: "utf8" });
+		if (remotes.status !== 0) throw new Error("cannot verify repository carrier before Slice Enrollment");
+		if (!remotes.stdout.trim()) return;
+	}
+	const gh = transport ?? createGhTransport();
+	const source = await snapshot(resolve(root), gh, "create-initiative");
+	if ("contract" in source) throw new Error(source.message);
+	const task = taskLookup(source.issues, source.repository.id, taskId);
+	if (task.kind === "missing") return;
+	if (task.kind === "ambiguous") throw new Error(task.message);
+	const initiative = ownershipMarkerValue(task.issue.body, "initiative-id");
+	if (!initiative) throw new Error("Task Issue has no unique Initiative identity");
+	const observation = await observeGithubInitiative(root, initiative, gh);
+	const child = observation.tasks.find(candidate => candidate.task_id === taskId);
+	if (!child) throw new Error("Task Issue is absent from its Parent topology");
+	if (!child.blocked_by.length) return;
+	const { observeParentCompletion } = await import("./unattended/batch_git");
+	const proof = await observeParentCompletion(root, initiative, child.blocked_by);
+	if (proof.missing_task_ids.length) throw new Error(`Isolated Slice prerequisites are not integrated: ${proof.missing_task_ids.join(", ")}; execute only this Slice after its prerequisites are delivered`);
+}
+
 export async function observeGithubInitiative(
 	root: string,
 	initiativeId: string,
@@ -1669,6 +1713,20 @@ async function closeParentWhenComplete(
 	if (sliceChildren.length === 0
 		|| !sliceChildren.every((candidate) => candidate.state === "closed" && candidate.state_reason === "completed"))
 		return childResult;
+	const sliceIds = [...parent.body.matchAll(/<!-- immune-brain:slice-id=([^>]+) -->/g)].map(match => match[1]!);
+	if (sliceIds.length !== sliceChildren.length || new Set(sliceIds).size !== sliceIds.length ||
+		sliceChildren.some(candidate => !sliceIds.includes(ownershipMarkerValue(candidate.body, "slice-id") ?? "")))
+		return retry("required Slice topology does not match the Parent", "ambiguous_remote_state");
+	const taskIds = sliceChildren.map(candidate => ownershipMarkerValue(candidate.body, "task-id"));
+	if (taskIds.some(id => !id)) return retry("required Slice has no Task identity", "ambiguous_remote_state");
+	try {
+		const { observeParentCompletion } = await import("./unattended/batch_git");
+		const completion = await observeParentCompletion(root, initiativeId, taskIds as string[]);
+		if (!completion.complete) return result(operation.op, childResult.status,
+			`${childResult.message}; Parent #${parentNumber} remains open: ${completion.reason}`, child.issue);
+	} catch (error) {
+		return retry(`local completion proof could not be verified: ${error instanceof Error ? error.message : String(error)}`);
+	}
 	const close = await gh.run(["issue", "close", String(parentNumber), "--repo", source.repository.name_with_owner, "--reason", "completed"], { cwd: root });
 	const confirmed = await readParent();
 	if ("contract" in confirmed) return confirmed;

package/plugins/immune-brain/runtime/kernel/application.ts

@@ -11,6 +11,7 @@ import {
 import { asTaskDiffSnapshot } from "./completion";
 import { taskDeliveryIdentity } from "../workspace_scope";
 import { canonicalIntentHash, readTaskIntent } from "./intent";
+import { readRiskFloor } from "./risk_floor";
 import {
 	inspectIntentTokenPair,
 	consumeIntentToken,
@@ -98,7 +99,7 @@ export function applyTaskAction(
 			]);
 
 		// Fresh secure reread of the sidecar inside the same lock.
-		const freshRead = readTaskIntent(root, task_id, current.record.intent_ref.path);
+		const freshRead = readTaskIntent(root, task_id, current.record.intent_ref.path, current.record.intent_snapshot);
 		const { prior: priorIdentity, current: currentIdentity } =
 			inspectIntentTokenPair(prior_intent_token, freshRead.token);
 		if (
@@ -161,6 +162,7 @@ export function applyTaskAction(
 			action.type === "approve_breaking_intent_revision" ||
 			action.type === "request_rework" ||
 			action.type === "authorize_rework" ||
+			action.type === "accept_residual_risk" ||
 			action.type === "stop" ||
 			action.type === "resolve_user_decision";
 
@@ -201,6 +203,7 @@ export function applyTaskAction(
 			action,
 			inspectedAudit ? (inspectedAudit.audit as AuthorityAuditDescriptor) : null,
 			trustedDiff.changed_paths,
+			readRiskFloor(root),
 		);
 		if (!isReducedMutation(mutation))
 			throw new KernelInvariantError(["reducer returned an invalid mutation"]);

package/plugins/immune-brain/runtime/kernel/assurance_projection.ts

@@ -21,7 +21,9 @@ import {
 	reconcileKernelAuthority,
 } from "./storage";
 import { projectTask, resolveProjectedRisk } from "./completion";
+import { readRiskFloor, type RiskFloor } from "./risk_floor";
 import { inspectSpecBinding } from "./spec_binding";
+import { MAX_REWORK_GRANT_ROUNDS } from "./validation";
 import { taskDeliveryIdentity } from "../workspace_scope";
 import type { AssuranceObligation, TaskIntentV1, TaskRecord, TaskRecordV3 } from "./types";
 import type { TaskRecordV2 } from "./legacy_task_record";
@@ -41,6 +43,90 @@ export interface AssuranceAuthorizationReadiness {
 	state: "resolve_user_decision" | "authorize_rework" | "none";
 	/** Non-null only when Kernel facts prove the authorization is blocked. */
 	blocked: string | null;
+	/**
+	 * Present only with state "authorize_rework": the exits the literal user may
+	 * choose at the open replan boundary. Both Hosts render exactly these and map
+	 * each to one Kernel action, so the offer cannot drift between them.
+	 */
+	exits?: ReworkExitsReadiness;
+}
+
+export interface ReworkExitsReadiness {
+	/** `authorize_rework` with `rounds` in this inclusive range. */
+	grant_rounds: { min: number; max: number };
+	/** `accept_residual_risk`; offered only when the boundary is a budget exhaustion. */
+	accept_residual_risk: boolean;
+	/** `approve_breaking_intent_revision`; always available. */
+	replan: true;
+	/** The open blocking Review findings the user would be accepting. */
+	findings: Array<{ id: string; summary: string }>;
+}
+
+/** The one exit the literal user picked at the replan boundary. */
+export type ReworkChoice =
+	| { exit: "grant_rounds"; rounds: number }
+	| { exit: "accept_residual_risk"; reason: string }
+	| { exit: "replan" };
+
+/**
+ * Parse a Host's form content into a choice. Both Hosts call this, so what is
+ * accepted cannot drift between them. Unknown keys, an exit the boundary does not
+ * offer, an out-of-range grant and a blank reason all yield null.
+ */
+export function parseReworkChoice(exits: ReworkExitsReadiness, content: unknown): ReworkChoice | null {
+	if (typeof content !== "object" || content === null || Array.isArray(content)) return null;
+	const fields = content as Record<string, unknown>;
+	const allowed = new Set(["exit", "rounds", "reason"]);
+	if (Object.keys(fields).some((key) => !allowed.has(key))) return null;
+	if (fields.exit === "replan") return { exit: "replan" };
+	if (fields.exit === "grant_rounds") {
+		const rounds = fields.rounds ?? exits.grant_rounds.min;
+		if (!Number.isInteger(rounds)) return null;
+		const value = rounds as number;
+		if (value < exits.grant_rounds.min || value > exits.grant_rounds.max) return null;
+		return { exit: "grant_rounds", rounds: value };
+	}
+	if (fields.exit === "accept_residual_risk") {
+		if (!exits.accept_residual_risk) return null;
+		const reason = typeof fields.reason === "string" ? fields.reason.trim() : "";
+		return reason ? { exit: "accept_residual_risk", reason } : null;
+	}
+	return null;
+}
+
+/** The exits as the lines both Hosts show, so the offer reads the same everywhere. */
+export function reworkExitLines(exits: ReworkExitsReadiness): string[] {
+	return [
+		`Exit grant_rounds: grant ${exits.grant_rounds.min}-${exits.grant_rounds.max} more Review round(s)`,
+		...(exits.accept_residual_risk
+			? ["Exit accept_residual_risk: accept the open Review findings below as residual risk (a reason is required)"]
+			: []),
+		"Exit replan: revise the Intent through approve_breaking_intent_revision",
+		...(exits.findings.length > 0
+			? [`Open blocking Review findings (${exits.findings.length}):`, ...exits.findings.map((finding) => `  - ${finding.id}: ${finding.summary}`)]
+			: []),
+	];
+}
+
+export function deriveReworkExits(record: Pick<TaskRecord, "findings">): ReworkExitsReadiness {
+	const boundaries = record.findings.filter(
+		(finding) => finding.kind === "replan_required" && finding.status === "open",
+	);
+	const findings = record.findings
+		.filter(
+			(finding) =>
+				finding.kind === "blocking" && finding.source === "review" && finding.status === "open",
+		)
+		.map((finding) => ({ id: finding.id, summary: finding.summary }));
+	return {
+		grant_rounds: { min: 1, max: MAX_REWORK_GRANT_ROUNDS },
+		accept_residual_risk:
+			boundaries.length > 0 &&
+			boundaries.every((finding) => finding.replan_cause === "budget_exhausted") &&
+			findings.length > 0,
+		replan: true,
+		findings,
+	};
 }
 
 export interface AssuranceProjection {
@@ -84,6 +170,7 @@ export interface AssuranceProjectionResult {
 export function deriveAssuranceAuthorization(input: {
 	next_obligation: AssuranceObligation;
 	open_user_decision_count: number;
+	exits?: ReworkExitsReadiness;
 }): AssuranceAuthorizationReadiness {
 	if (input.open_user_decision_count === 1)
 		return { state: "resolve_user_decision", blocked: null };
@@ -93,7 +180,11 @@ export function deriveAssuranceAuthorization(input: {
 			blocked: `resolve-user-decision requires exactly one open user decision; found ${input.open_user_decision_count}`,
 		};
 	if (input.next_obligation === "revise_intent")
-		return { state: "authorize_rework", blocked: null };
+		return {
+			state: "authorize_rework",
+			blocked: null,
+			...(input.exits ? { exits: input.exits } : {}),
+		};
 	return { state: "none", blocked: null };
 }
 
@@ -145,8 +236,10 @@ function projectHistoricalTerminal(
 	};
 }
 
-function projectHistoricalTerminalV3(
-	record: TaskRecordV3,
+// Terminal proof validates historical settlement, not the caller's live checkout.
+// Current integrated delivery remains independently checked by the batch boundary.
+function projectSettledTerminal(
+	record: TaskRecordV3 | TaskRecord,
 	recordRevision: string,
 	workspaceRevision: string,
 ): AssuranceProjection {
@@ -201,6 +294,7 @@ function projectFromRecord(
 	recordRevision: string,
 	workspaceRevision: string,
 	snapshot: TaskDiffSnapshot,
+	floor: RiskFloor,
 ): AssuranceProjection {
 	const intent: TaskIntentV1 = record.intent_snapshot;
 	const decision = projectTask(
@@ -209,6 +303,7 @@ function projectFromRecord(
 		snapshot.diff_hash,
 		record.intent_ref.content_hash,
 		snapshot.changed_paths,
+		floor,
 	);
 	const approvalKinds = freshApprovalKinds(record, record.intent_ref.content_hash, snapshot.diff_hash);
 	const openUserDecisionCount = record.findings.filter(
@@ -224,7 +319,7 @@ function projectFromRecord(
 		diff_hash: snapshot.diff_hash,
 		lifecycle: record.lifecycle,
 		artifact_state: record.artifact_state,
-		risk: resolveProjectedRisk(intent, snapshot.changed_paths),
+		risk: resolveProjectedRisk(intent, snapshot.changed_paths, floor),
 		next_obligation: decision.next_obligation,
 		fresh_acceptance_ids: decision.fresh_acceptance_ids,
 		missing_acceptance_ids: decision.missing_acceptance_ids,
@@ -242,6 +337,7 @@ function projectFromRecord(
 			: deriveAssuranceAuthorization({
 			next_obligation: decision.next_obligation,
 			open_user_decision_count: openUserDecisionCount,
+			exits: deriveReworkExits(record),
 		}),
 	};
 }
@@ -329,12 +425,7 @@ export async function projectAssurance(
 					error: null,
 					claim: null,
 					projection: {
-						...projectFromRecord(
-							committed.record,
-							committed.revision,
-							workspace.revision,
-							diffProvider(root, committed.record),
-						),
+						...projectSettledTerminal(committed.record, committed.revision, workspace.revision),
 						run_id: committedRunId,
 					},
 				};
@@ -353,20 +444,12 @@ export async function projectAssurance(
 					claim: null,
 					projection: projectHistoricalTerminal(auditPair.record, auditPair.recordRevision, workspace.revision),
 				};
-			if (auditPair.record.contract === "assurance_kernel/task_record/v3")
-				return {
-					contract: "assurance_kernel/assurance_projection/v1",
-					task_id: taskId,
-					error: null,
-					claim: null,
-					projection: projectHistoricalTerminalV3(auditPair.record, auditPair.recordRevision, workspace.revision),
-				};
 			return {
 				contract: "assurance_kernel/assurance_projection/v1",
 				task_id: taskId,
 				error: null,
 				claim: null,
-				projection: projectFromRecord(auditPair.record, auditPair.recordRevision, workspace.revision, diffProvider(root, auditPair.record)),
+				projection: projectSettledTerminal(auditPair.record, auditPair.recordRevision, workspace.revision),
 			};
 		}
 		if (read.record.task_id !== taskId)
@@ -381,7 +464,7 @@ export async function projectAssurance(
 			error: null,
 			claim,
 			projection: {
-				...projectFromRecord(read.record, read.revision, workspace.revision, snapshot),
+				...projectFromRecord(read.record, read.revision, workspace.revision, snapshot, readRiskFloor(root)),
 				run_id: reconcileKernelAuthority(root, taskId).owner_run_id,
 			},
 		};