immune-brain 5.2.0 → 5.5.1

package/plugins/immune-brain/runtime/kernel/intent.ts

@@ -24,6 +24,15 @@ import {
 	type TaskIntentV1,
 	type TaskRisk,
 } from "./types";
+import {
+	applyScopeRiskFloor,
+	changedPathRiskFloor,
+	NO_RISK_FLOOR,
+	raiseRisk,
+	readRiskFloor,
+	touchesChangedPathFloor,
+	type RiskFloor,
+} from "./risk_floor";
 import {
 	mintToken,
 	type TaskIntentIdentityToken,
@@ -33,91 +42,6 @@ import {
 export const INTENT_MAX_BYTES = 64 * 1024;
 export const INTENT_SIDECAR_RELATIVE_PREFIX = "docs/plans/";
 
-// Deterministic risk-tier floor: an intent whose scope_hint touches kernel or
-// authority runtime paths is forced to at least `material` regardless of the
-// tier the author declared, so self-graded `routine` can never buy weaker
-// gating over the paths where gating matters most. The floor is derived solely
-// from scope_hint, never from prose fields. The .pi-extension directory is the
-// human gate itself (enrollment confirmation, capability minting, and review
-// authorization), so a self-graded routine over it must not weaken gating over
-// the code that implements gating.
-export const RISK_FLOOR_SCOPE_PREFIXES = [
-	"plugins/immune-brain/runtime/kernel",
-	"plugins/immune-brain/runtime/authority_commit_receipts.ts",
-	"plugins/immune-brain/runtime/assurance",
-	"plugins/immune-brain/runtime/claude/interaction.ts",
-	"plugins/immune-brain/runtime/claude/capability.ts",
-	"plugins/immune-brain/runtime/claude/review_host.ts",
-	"plugins/immune-brain/runtime/claude/kernel_ports.ts",
-	"plugins/immune-brain/runtime/claude/mcp_server.ts",
-	"plugins/immune-brain/.pi-extension",
-] as const;
-
-// Concrete changed paths use a narrower, segment-safe prefix policy. Keep this
-// separate from the glob-aware scope_hint policy above: the two inputs have
-// different contracts and docs-only scope remains routine today.
-export const CHANGED_PATH_RISK_FLOOR_PREFIXES = [
-	...RISK_FLOOR_SCOPE_PREFIXES,
-	"docs/specs",
-	"docs/plans",
-] as const;
-
-function segmentMatches(e: string, s: string): boolean {
-	if (e === "*") return true;
-	if (!e.includes("*") && !e.includes("?")) return e === s;
-	const rx = new RegExp(
-		`^${e.split("*").map((p) => p.split("?").map((q) => q.replace(/[.\\+^${}()|[\]\\/]/g, "\\$&")).join(".")).join(".*")}$`,
-	);
-	return rx.test(s);
-}
-
-// Decide whether a scope entry can match the kernel/authority prefix itself,
-// any of its ancestor prefixes, or any descendant path beneath it. Glob `**`
-// spans zero or more segments, `*` matches one segment, `?` one character.
-// A match on any of those relations means the entry touches the floored path,
-// so a routine-declared intent cannot hide behind wildcard-leading patterns.
-function scopeEntryTouchesPrefixSegments(es: string[], ps: string[]): boolean {
-	const memo = new Map<string, boolean>();
-	const m = (pi: number, ei: number): boolean => {
-		const key = `${pi}:${ei}`;
-		const cached = memo.get(key);
-		if (cached !== undefined) return cached;
-		let result: boolean;
-		if (ei === es.length) {
-			result = true; // es matched a prefix of ps, ps itself, or a descendant
-		} else {
-			const e = es[ei];
-			if (e === "**") {
-				if (pi >= ps.length) result = true; // beyond ps, descendant always exists
-			else result = m(pi, ei + 1) || m(pi + 1, ei);
-			} else if (pi < ps.length && segmentMatches(e, ps[pi])) {
-				result = m(pi + 1, ei + 1);
-			} else if (pi >= ps.length) {
-				result = m(pi + 1, ei + 1); // remaining literal segments match descendant segments
-			} else {
-				result = false;
-			}
-		}
-		memo.set(key, result);
-		return result;
-	};
-	return m(0, 0);
-}
-
-function scopeEntryTouchesRiskFloorPaths(entry: string): boolean {
-	if (!entry) return false;
-	const es = entry.split("/");
-	return RISK_FLOOR_SCOPE_PREFIXES.some((prefix) =>
-		scopeEntryTouchesPrefixSegments(es, prefix.split("/")),
-	);
-}
-
-function riskFloorForScope(scopeHint: string[]): TaskRisk | null {
-	return scopeHint.some(scopeEntryTouchesRiskFloorPaths)
-		? "material"
-		: null;
-}
-
 const TASK_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const portablePathCollator = new Intl.Collator("und", {
 	usage: "search",
@@ -318,18 +242,16 @@ export function parseTaskIntentV1(raw: unknown): TaskIntentV1 {
 	const acceptance = (acceptanceRaw as unknown[]).map((item, index) =>
 		parseAcceptanceItemV1(item, index, []),
 	);
-	const declaredRisk = risk as TaskRisk;
-	const flooredRisk = riskFloorForScope(scopeHint);
+	// The declared risk is returned as written. The project's risk floor is
+	// applied where a risk is decided, by a caller that knows the project root
+	// (ADR 0023): `readTaskIntent`, `parseProjectTaskIntent`, `classifyTaskRisk`.
 	return {
 		contract: TASK_INTENT_CONTRACT_V1,
 		task_id: taskId,
 		goal,
 		acceptance,
 		scope_hint: scopeHint,
-		risk:
-			flooredRisk !== null && RISK_RANK[declaredRisk] < RISK_RANK[flooredRisk]
-				? flooredRisk
-				: declaredRisk,
+		risk: risk as TaskRisk,
 		revision,
 		owner: "user",
 	};
@@ -345,18 +267,27 @@ export function canonicalIntentHash(intent: unknown): string {
 
 const RISK_RANK: Record<TaskRisk, number> = { routine: 0, material: 1, critical: 2 };
 
+/**
+ * A candidate intent parsed for one project: the strict parse, then that
+ * project's scope floor. Every caller that turns candidate JSON into an intent
+ * the Kernel will hash or record uses this, so the recorded risk and the risk
+ * `readTaskIntent` later reads back agree.
+ */
+export function parseProjectTaskIntent(root: string, raw: unknown, recordedIntent?: TaskIntentV1): TaskIntentV1 {
+	const parsed = parseTaskIntentV1(raw);
+	// An enrolled revision keeps its recorded risk; today's policy only changes gating.
+	if (recordedIntent && parsed.revision === recordedIntent.revision &&
+		raiseRisk(recordedIntent.risk, parsed.risk) === recordedIntent.risk)
+		return { ...parsed, risk: recordedIntent.risk };
+	return applyScopeRiskFloor(parsed, readRiskFloor(root));
+}
+
 export function classifyTaskRisk(
 	changedPaths: readonly string[],
 	declaredRisk: TaskRisk,
+	floor: RiskFloor = NO_RISK_FLOOR,
 ): TaskRisk {
-	const pathFloor = changedPaths.some((path) =>
-		CHANGED_PATH_RISK_FLOOR_PREFIXES.some(
-			(prefix) => path === prefix || path.startsWith(`${prefix}/`),
-		),
-	)
-		? "material"
-		: "routine";
-	return RISK_RANK[declaredRisk] >= RISK_RANK[pathFloor] ? declaredRisk : pathFloor;
+	return raiseRisk(declaredRisk, changedPathRiskFloor(changedPaths, floor));
 }
 
 function contentHashWithoutRevision(intent: TaskIntentV1): string {
@@ -364,19 +295,99 @@ function contentHashWithoutRevision(intent: TaskIntentV1): string {
 	return canonicalIntentHash(rest);
 }
 
+function isConcreteScopeEntry(entry: string): boolean {
+	return !entry.includes("*") && !entry.includes("?");
+}
+
+function scopeEntryParent(entry: string): string {
+	const slash = entry.lastIndexOf("/");
+	return slash < 0 ? "" : entry.slice(0, slash);
+}
+
+/**
+ * The entries a same-directory additive scope revision adds, or null when the
+ * delta is anything else (ADR 0021). Additive means the next scope contains
+ * every previous entry; same-directory means each added entry is a concrete
+ * path whose parent directory already holds a concrete previous entry, outside
+ * every path the project's risk floor names, and not an ancestor of any
+ * previous entry. The check is purely textual: it cannot tell a file from a
+ * directory written without a trailing slash, so each Host also refuses a
+ * directory in the worktree (see `assertScopeAdditionsAreFiles`).
+ */
+export function sameDirectoryScopeAdditions(
+	previous: readonly string[],
+	next: readonly string[],
+	floor: RiskFloor = NO_RISK_FLOOR,
+): string[] | null {
+	const prior = new Set(previous);
+	const retained = new Set(next);
+	if (previous.some((entry) => !retained.has(entry))) return null;
+	const added = next.filter((entry) => !prior.has(entry));
+	const anchors = new Set(previous.filter(isConcreteScopeEntry).map(scopeEntryParent));
+	for (const entry of added) {
+		if (!isConcreteScopeEntry(entry) || touchesChangedPathFloor(entry, floor)) return null;
+		if (!anchors.has(scopeEntryParent(entry))) return null;
+		if (previous.some((existing) => existing.startsWith(`${entry}/`))) return null;
+	}
+	return added;
+}
+
+/** The previous concrete entries that anchor an added entry's directory. */
+export function scopeAdditionAnchors(
+	previous: readonly string[],
+	added: readonly string[],
+): string[] {
+	const parents = new Set(added.map(scopeEntryParent));
+	return previous.filter(
+		(entry) => isConcreteScopeEntry(entry) && parents.has(scopeEntryParent(entry)),
+	);
+}
+
+// The revise_intent history entry carries the paths a compatible scope revision
+// added, one `scope_added:<path>` line each, so Review can name them without a
+// TaskRecord field (ADR 0021, D5).
+const SCOPE_ADDED_PREFIX = "scope_added:";
+
+export function scopeAdditionsReasonLines(added: readonly string[]): string[] {
+	return added.map((entry) => `${SCOPE_ADDED_PREFIX}${entry}`);
+}
+
+export function scopeAdditionsFromHistory(
+	history: ReadonlyArray<{ type: string; reason: string }>,
+): string[] {
+	const added: string[] = [];
+	for (const entry of history) {
+		if (entry.type !== "revise_intent") continue;
+		for (const line of entry.reason.split("\n"))
+			if (line.startsWith(SCOPE_ADDED_PREFIX)) added.push(line.slice(SCOPE_ADDED_PREFIX.length));
+	}
+	return [...new Set(added)].sort();
+}
+
 export function classifyIntentRevision(
 	previous: TaskIntentV1,
 	next: TaskIntentV1,
+	floor: RiskFloor = NO_RISK_FLOOR,
 ): "unchanged" | "compatible" | "breaking" {
 	if (contentHashWithoutRevision(previous) === contentHashWithoutRevision(next))
 		return "unchanged";
 
+	const scopeChanged =
+		JSON.stringify(previous.scope_hint) !== JSON.stringify(next.scope_hint);
+	// Narrowing removes authority: a next scope made only of previous entries
+	// needs no confirmation. An empty scope is not a narrowing, and any added
+	// entry is classified by the same-directory rule below, as before.
+	const priorScope = new Set(previous.scope_hint);
+	const scopeNarrowed =
+		next.scope_hint.length > 0 && next.scope_hint.every((entry) => priorScope.has(entry));
 	const breaking =
 		previous.contract !== next.contract ||
 		previous.task_id !== next.task_id ||
 		previous.owner !== next.owner ||
 		previous.goal !== next.goal ||
-		JSON.stringify(previous.scope_hint) !== JSON.stringify(next.scope_hint) ||
+		(scopeChanged &&
+			!scopeNarrowed &&
+			sameDirectoryScopeAdditions(previous.scope_hint, next.scope_hint, floor) === null) ||
 		RISK_RANK[next.risk] < RISK_RANK[previous.risk] ||
 		previous.acceptance.some((prior) => {
 			const current = next.acceptance.find((item) => item.id === prior.id);
@@ -387,6 +398,48 @@ export function classifyIntentRevision(
 	return next.revision > previous.revision ? "compatible" : "breaking";
 }
 
+/**
+ * The Host-side half of the same-directory rule (ADR 0021, D4). The classifier
+ * is pure and cannot tell a file from a directory, so before a Host submits a
+ * compatible scope revision it refuses one whose added entries, or the previous
+ * entries that anchor them, are directories in the worktree.
+ */
+export function assertScopeAdditionsAreFiles(
+	root: string,
+	previous: readonly string[],
+	next: readonly string[],
+): void {
+	const added = sameDirectoryScopeAdditions(previous, next, readRiskFloor(root));
+	if (!added || added.length === 0) return;
+	for (const entry of [...added, ...scopeAdditionAnchors(previous, added)]) {
+		let isDirectory = false;
+		try {
+			isDirectory = statSync(join(root, entry)).isDirectory();
+		} catch {
+			// An absent or unreadable entry is not a directory.
+		}
+		if (isDirectory)
+			throw new Error(
+				`scope entry ${entry} is a directory, so adding it is not a same-directory file addition; name concrete files, or widen with a glob entry such as ${entry}/** through approve_breaking_intent_revision`,
+			);
+	}
+}
+
+/**
+ * The record as if the next intent's scope were already in force. A revision is
+ * prepared, checked and bound against the scope it asks for, not the scope it
+ * replaces (ADR 0021, D6).
+ */
+export function withNextScope<R extends { intent_snapshot: { scope_hint: string[] } }>(
+	record: R,
+	nextScope: readonly string[],
+): R {
+	return {
+		...record,
+		intent_snapshot: { ...record.intent_snapshot, scope_hint: [...nextScope] },
+	};
+}
+
 // ---------------------------------------------------------------------------
 // Opaque file identity token.
 // ---------------------------------------------------------------------------
@@ -545,6 +598,8 @@ function readTaskIntentSource(
 	root: string,
 	taskId: string,
 	requestedPath?: string,
+	requireTracked = true,
+	recordedIntent?: TaskIntentV1,
 ): TaskIntentReadSource {
 	validateTaskId(taskId);
 
@@ -568,7 +623,7 @@ function readTaskIntentSource(
 	const fileIdentity = pathIdentities[pathIdentities.length - 1];
 
 	// Git tracking is an ownership convention, not user authentication.
-	try {
+	if (requireTracked) try {
 		execFileSync(
 			"git",
 			["ls-files", "--error-unmatch", "--", sidecarPath],
@@ -615,7 +670,7 @@ function readTaskIntentSource(
 	const sourceBytesSha256 = sha256Hex(bytes);
 	let intent: TaskIntentV1;
 	try {
-		intent = parseTaskIntentV1(JSON.parse(bytes.toString("utf8")));
+		intent = parseProjectTaskIntent(canonicalRoot, JSON.parse(bytes.toString("utf8")), recordedIntent);
 	} catch (error) {
 		throw new TaskIntentObservationError(
 			"invalid",
@@ -649,12 +704,21 @@ function readTaskIntentSource(
 	};
 }
 
+/** Validate the active sidecar before Enrollment can commit its untracked preconditions. */
+export function observeEnrollmentTaskIntent(root: string, taskId: string): ObservedTaskIntent {
+	const { identity: _identity, ...observed } = readTaskIntentSource(
+		root, taskId, `${INTENT_SIDECAR_RELATIVE_PREFIX}${taskId}.intent.json`, false,
+	);
+	return observed;
+}
+
 export function observeTaskIntent(
 	root: string,
 	taskId: string,
 	requestedPath?: string,
+	recordedIntent?: TaskIntentV1,
 ): ObservedTaskIntent {
-	const { identity: _identity, ...observed } = readTaskIntentSource(root, taskId, requestedPath);
+	const { identity: _identity, ...observed } = readTaskIntentSource(root, taskId, requestedPath, true, recordedIntent);
 	return observed;
 }
 
@@ -662,7 +726,8 @@ export function readTaskIntent(
 	root: string,
 	taskId: string,
 	requestedPath?: string,
+	recordedIntent?: TaskIntentV1,
 ): ReadTaskIntentResult {
-	const { identity, ...observed } = readTaskIntentSource(root, taskId, requestedPath);
+	const { identity, ...observed } = readTaskIntentSource(root, taskId, requestedPath, true, recordedIntent);
 	return { ...observed, token: mintToken(identity) };
 }

package/plugins/immune-brain/runtime/kernel/reducer.ts

@@ -4,11 +4,13 @@
 
 import { createHash } from "node:crypto";
 import { completionDecision } from "./completion";
+import { NO_RISK_FLOOR, type RiskFloor } from "./risk_floor";
 import { anchorForEvidence, isFreshPassingQaAttestation, refutationIdentity, refutationIsLive } from "./refutation";
 import {
 	REDUCED_MUTATION_BRAND,
 	type AuthorityAuditDescriptor,
 	type ReducedTaskMutation,
+	type ReviewRevisionIdentityV1,
 	type TaskAction,
 	type TaskFinding,
 	type TaskIntentRefV3,
@@ -22,7 +24,12 @@ import {
 	parseTaskAction,
 	parseTaskRecord,
 } from "./validation";
-import { classifyIntentRevision, canonicalIntentHash } from "./intent";
+import {
+	canonicalIntentHash,
+	classifyIntentRevision,
+	sameDirectoryScopeAdditions,
+	scopeAdditionsReasonLines,
+} from "./intent";
 import { assertValidSpecBinding } from "./spec_binding";
 
 const RISK_RANK: Record<TaskIntentV1["risk"], number> = {
@@ -132,6 +139,7 @@ function appendHistory(
 	from: string,
 	detail: string | null,
 	audit: AuthorityAuditDescriptor | null,
+	reviewRevision?: ReviewRevisionIdentityV1,
 ): void {
 	if (record.history.some((entry) => entry.id === action.event_id))
 		throw new KernelInvariantError([
@@ -145,6 +153,7 @@ function appendHistory(
 		to_state: string;
 		reason: string;
 		authority?: AuthorityAuditDescriptor;
+		review_revision?: ReviewRevisionIdentityV1;
 	} = {
 		id: action.event_id,
 		at: action.at,
@@ -160,6 +169,7 @@ function appendHistory(
 		),
 	};
 	if (audit) entry.authority = { ...audit };
+	if (reviewRevision) entry.review_revision = { ...reviewRevision };
 	record.history.push(entry as (typeof record.history)[number]);
 }
 
@@ -178,6 +188,7 @@ function hasPrivilegedKind(action: TaskAction): boolean {
 		action.type === "approve_breaking_intent_revision" ||
 		action.type === "request_rework" ||
 		action.type === "authorize_rework" ||
+		action.type === "accept_residual_risk" ||
 		action.type === "stop" ||
 		action.type === "resolve_user_decision"
 	);
@@ -207,15 +218,22 @@ export function findingsDigestV2(findings: TaskFinding[]): string {
 /**
  * Rework rounds one Review run may demand before the Kernel pauses the task for
  * a human decision. Ordinary defects return to execution without a user gate,
- * but an unbounded repair/review cycle is not progress either.
+ * but an unbounded repair/review cycle is not progress either. The literal user
+ * may extend it with `authorize_rework` rounds; the grant is cumulative and
+ * persisted as `review_round_budget_extension`.
  */
 export const REVIEW_REWORK_ROUND_BUDGET = 5;
 
+export function effectiveReviewRoundBudget(record: TaskRecord): number {
+	return REVIEW_REWORK_ROUND_BUDGET + (record.review_round_budget_extension ?? 0);
+}
+
 export function reduceTask(
 	recordRaw: TaskRecord,
 	actionRaw: TaskAction,
 	authorityAudit: AuthorityAuditDescriptor | null = null,
 	changedPaths?: readonly string[],
+	floor: RiskFloor = NO_RISK_FLOOR,
 ): ReducedTaskMutation {
 	const previous = parseTaskRecord(recordRaw);
 	assertKernelInvariantsV3(previous.intent_snapshot, previous);
@@ -474,6 +492,7 @@ export function reduceTask(
 			const revisionClass = classifyIntentRevision(
 				record.intent_snapshot,
 				action.next_intent,
+				floor,
 			);
 			if (action.type === "revise_intent" && revisionClass !== "compatible")
 				throw new KernelInvariantError([
@@ -507,6 +526,16 @@ export function reduceTask(
 				throw new KernelInvariantError([
 					"next intent ref must match the next intent",
 				]);
+			// A compatible scope revision is self-served: the user confirmed nothing,
+			// so the added paths ride in this entry's reason for Review to name.
+			const selfServedAdditions =
+				action.type === "revise_intent"
+					? sameDirectoryScopeAdditions(
+						record.intent_snapshot.scope_hint,
+						action.next_intent.scope_hint,
+						floor,
+					) ?? []
+					: [];
 			record.intent_snapshot = { ...action.next_intent };
 			record.intent_ref = { ...action.next_intent_ref };
 			if (action.type === "approve_breaking_intent_revision") {
@@ -516,7 +545,16 @@ export function reduceTask(
 				}
 				if (record.artifact_state === "frozen") record.artifact_state = "active";
 			}
-			appendHistory(record, action, from, `intent_revision_${record.intent_snapshot.revision}`, authorityAudit);
+			appendHistory(
+				record,
+				action,
+				from,
+				[
+					`intent_revision_${record.intent_snapshot.revision}`,
+					...scopeAdditionsReasonLines(selfServedAdditions),
+				].join("\n"),
+				authorityAudit,
+			);
 			break;
 		}
 		case "request_rework": {
@@ -541,6 +579,23 @@ export function reduceTask(
 					"request_rework requires review, qa, or user authority",
 				]);
 			const round = reviewRound(record);
+			// The reviewed revision is audit data for the next round's delta, not
+			// authority: it is legal only on Review rework and, on a v4 record, must
+			// name the Enrollment base exactly as an approval does. Its absence is a
+			// legacy record and never blocks.
+			if (action.review_revision) {
+				if (authorityAudit.authority_kind !== "review")
+					throw new KernelInvariantError([
+						`${authorityAudit.authority_kind} rework cannot carry a review revision`,
+					]);
+				if (
+					record.contract === "assurance_kernel/task_record/v4" &&
+					action.review_revision.base_head !== record.git_base_head
+				)
+					throw new KernelInvariantError([
+						"review_revision.base_head must equal the Enrollment git_base_head",
+					]);
+			}
 			// An anchor is authority: it decides whether this claim inherits an
 			// existing refutation. The Kernel recomputes it from the finding's own
 			// evidence, so a caller cannot bind one claim's identity to another
@@ -622,7 +677,7 @@ export function reduceTask(
 			const parkForReplan =
 				authorityAudit.authority_kind === "review" &&
 				(disputed !== undefined ||
-					(hasEffectiveBlockingNow && effectiveBlockingRounds >= REVIEW_REWORK_ROUND_BUDGET));
+					(hasEffectiveBlockingNow && effectiveBlockingRounds >= effectiveReviewRoundBudget(record)));
 			if (!parkForReplan) {
 				record.artifact_state = "active";
 				record.intent_ref.path = `docs/plans/${record.task_id}.intent.json`;
@@ -660,10 +715,14 @@ export function reduceTask(
 					acceptance_id: disputed?.acceptance_id ?? null,
 					source: "kernel" as const,
 					review_round: round,
+					replan_cause:
+						disputed !== undefined
+							? ("repeated_security_boundary" as const)
+							: ("budget_exhausted" as const),
 					summary:
 						disputed !== undefined
 							? "Review returned the same security boundary twice; a durable replan is required."
-							: `Review exhausted its ${REVIEW_REWORK_ROUND_BUDGET}-round rework budget; a durable replan is required.`,
+							: `Review exhausted its ${effectiveReviewRoundBudget(record)}-round rework budget; a durable replan is required.`,
 				};
 				if (findingIds.has(boundary.id))
 					throw new KernelInvariantError([
@@ -671,7 +730,14 @@ export function reduceTask(
 					]);
 				record.findings.push(boundary);
 			}
-			appendHistory(record, action, from, `review_round_${round}`, authorityAudit);
+			appendHistory(
+				record,
+				action,
+				from,
+				`review_round_${round}`,
+				authorityAudit,
+				action.review_revision,
+			);
 			break;
 		}
 		case "authorize_rework": {
@@ -691,11 +757,74 @@ export function reduceTask(
 					"authorize_rework requires an open replan boundary",
 				]);
 			for (const finding of open) finding.status = "resolved";
+			// The grant is cumulative so the budget is a single derivable number;
+			// a legacy caller without `rounds` grants exactly one further round.
+			record.review_round_budget_extension =
+				(record.review_round_budget_extension ?? 0) + (action.rounds ?? 1);
 			record.artifact_state = "active";
 			record.intent_ref.path = `docs/plans/${record.task_id}.intent.json`;
 			appendHistory(record, action, from, open.map((finding) => finding.id).join(","), authorityAudit);
 			break;
 		}
+		case "accept_residual_risk": {
+			// A parked record has already restored its artifacts for replan, so the
+			// exit cannot require a frozen snapshot; the open budget boundary below
+			// is the real gate and completion re-freezes through the normal path.
+			if (record.lifecycle !== "active")
+				throw new KernelInvariantError([
+					`cannot accept residual risk while lifecycle is ${record.lifecycle}`,
+				]);
+			if (authorityAudit?.authority_kind !== "user")
+				throw new KernelInvariantError([
+					"accept_residual_risk requires literal-user authority",
+				]);
+			const boundaries = record.findings.filter(
+				(finding) => finding.kind === "replan_required" && finding.status === "open",
+			);
+			// Only a budget exhaustion offers this exit. A boundary without a
+			// recorded cause predates the field and a repeated security boundary is
+			// a dispute about the design: both stay replan or stop only.
+			if (
+				boundaries.length === 0 ||
+				boundaries.some((finding) => finding.replan_cause !== "budget_exhausted")
+			)
+				throw new KernelInvariantError([
+					"accept_residual_risk requires an open replan boundary caused by budget exhaustion",
+				]);
+			if (record.findings.some((finding) => finding.kind === "unresolved_user_decision" && finding.status === "open"))
+				throw new KernelInvariantError([
+					"accept_residual_risk cannot settle a task with an open user decision",
+				]);
+			const accepted = record.findings.filter(
+				(finding) =>
+					finding.kind === "blocking" &&
+					finding.source === "review" &&
+					finding.status === "open",
+			);
+			if (accepted.length === 0)
+				throw new KernelInvariantError([
+					"accept_residual_risk requires at least one open blocking Review finding",
+				]);
+			for (const finding of boundaries) finding.status = "resolved";
+			for (const finding of accepted) finding.status = "accepted_risk";
+			record.residual_risk_acceptance = {
+				intent_revision: record.intent_snapshot.revision,
+				intent_content_hash: record.intent_ref.content_hash,
+				diff_hash: diffHash,
+				finding_ids: accepted.map((finding) => finding.id),
+				reason: action.reason,
+				actor_id: action.actor_id,
+				accepted_at: action.at,
+			};
+			appendHistory(
+				record,
+				action,
+				from,
+				`accepted_risk:${accepted.map((finding) => finding.id).join(",")}\n${action.reason}`,
+				authorityAudit,
+			);
+			break;
+		}
 		case "complete": {
 			if (record.lifecycle !== "active" || record.artifact_state !== "frozen")
 				throw new KernelInvariantError([
@@ -709,6 +838,7 @@ export function reduceTask(
 				diffHash,
 				record.intent_ref.content_hash,
 				changedPaths,
+				floor,
 			);
 			if (!decision.complete)
 				throw new KernelInvariantError([