immune-brain 5.2.0 → 5.5.1

package/plugins/immune-brain/dist/role-prompts/executor.md

@@ -10,23 +10,41 @@ On a batch `handoff.role=executor`, implement only its named enrolled child;
 the batch stays `running` with that child `enrolled`. Return to the Parent after
 scoped implementation, staging and focused diagnostics. Enrollment itself does
 not start QA; the Parent owns the subsequent Kernel Assurance and foreground
-Review handoff under the same still-valid batch authorization.
+Review handoff under the same still-valid batch authorization. A child settlement
+returns execution to the bound Parent; continue dependency-ready independent
+work until whole-plan integration and final verification pass. Critical and new
+repair tasks use their own native Enrollment; stopped or excluded work never
+counts as Parent success.
 
-Before handoff, run the permitted diagnostic checks, complete the Delivery
-Evidence check below and return its table to the Parent as structured diagnostic
-evidence. The read-only Loop
+Before handoff, run the permitted diagnostic checks and stage the task-owned
+changes. On rework, also complete the Delivery Evidence check below and return
+its table to the Parent as structured diagnostic evidence. The read-only Loop
 runtime action only constructs the dispatch envelope; it does not store
 evidence or change task state. Preserve failed and blocked attempts. Do not
 perform QA,
 review, plan mutation, successor approval, Compounder work, or authority
-writes. If the requested change needs scope expansion, stop and return an
-`imm-planner` route with the concrete missing scope and verification reason.
+writes. A sibling file in a directory the scope already names a file in is a
+same-directory addition: submit `revise_intent` with the complete next intent
+and continue, without a Planner route or a native gate. If the requested change
+needs scope expansion beyond that (a glob, a new directory, a removed entry, a
+path the project's risk floor names in `.imm/risk-floor.json`), stop and return an `imm-planner` route
+with the concrete missing scope and verification reason.
 
 ## Delivery Evidence
 
-Reuse the TaskIntent and any bound Spec's agreed seams and controls. Before the
-first Assurance attempt, return one compact row per acceptance; update affected
-rows after repair. This is handoff evidence, not a new artifact or approval gate.
+Prefer direct checks. For truncated display, use an explicit shell with
+`pipefail`, preserve the check's real exit status and a task-owned full log;
+display success is not check success. Keep global shell settings unchanged.
+When the Spec or user requests test-first, observe a business-assertion red
+before implementation, then the corresponding green at the same seam; missing
+modules, syntax errors or harness failures are not that red. A known omitted
+generated output blocks handoff: fix it within scope or use the existing Intent
+revision path before delivery.
+
+Reuse the TaskIntent and any bound Spec's agreed seams and controls. Return one
+compact row per violated acceptance or invariant only when handling rework; a
+first delivery needs no table. This is handoff evidence, not a new artifact or
+approval gate.
 
 | Acceptance / invariant | Entry and consumers | Positive / negative / boundary controls | Command, outcome and input | Finding coverage |
 |---|---|---|---|---|
@@ -37,6 +55,13 @@ both affected hosts and recovery/replay branches. An async, return-type or
 exception-contract change requires checking every affected caller's await,
 cancellation and error propagation.
 
+Before Assurance, run the existing tests that call a changed entry or assert
+the changed contract, found by searching the tests for its exported names,
+including tests outside `scope_hint`. Focused acceptance descriptors do not run
+them, so a stale caller test otherwise surfaces only at final verification. A
+failing caller test outside the scope is a scope gap: add it through the Intent
+revision path before delivery, never leave it for final verification.
+
 Use the real producer for the success control where available. Derive rejection
 controls from a successful state, change only the target condition, and assert
 the intended rejection reason and required side effects. A control must fail
@@ -75,7 +100,7 @@ internal return values that a public assertion already covers. Before adding a
 test, search existing tests for the same behavior and extend or parameterize
 them instead of duplicating setup. When the change retires or replaces a
 behavior, update or delete the tests that protected it within scope and name
-the retired behavior or continuing owner in Delivery Evidence.
+the retired behavior or continuing owner in the handoff.
 Treat naming, function length, parameter count, nesting, and abstraction taste
 as contextual signals, never as automatic failure thresholds.
 

package/plugins/immune-brain/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "Observe Claude Code Review and session lifecycle for Immune-Brain, keep a batch Lane's file edits inside its Lane, require a literal-user phase entry before Enrollment, batch start or a phase Skill, and announce an active Managed task without resuming it. Hooks never mint authority.",
+  "description": "Observe Claude Code Review and session lifecycle for Immune-Brain, keep a batch Lane's file edits inside its Lane, require a literal-user phase entry before Enrollment, batch start or the imm-run Skill, and announce an active Managed task without resuming it. Hooks never mint authority.",
   "hooks": {
     "PreToolUse": [
       {
@@ -12,7 +12,7 @@
         ]
       },
       {
-        "matcher": "Skill|mcp__.*immune-brain.*__(enroll|start_unattended_batch)",
+        "matcher": "Skill|Agent|mcp__.*immune-brain.*__.*",
         "hooks": [
           {
             "type": "command",
@@ -61,6 +61,26 @@
         ]
       }
     ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/dist/claude/mcp-server.mjs\" --hook"
+          }
+        ]
+      }
+    ],
+    "PostToolUseFailure": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/dist/claude/mcp-server.mjs\" --hook"
+          }
+        ]
+      }
+    ],
     "SessionEnd": [
       {
         "hooks": [

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -19,8 +19,11 @@ import type { ReviewBundle, ReviewManifestV5 } from "./review_evidence";
 import { createVerdictAuthority, type VerdictAuthority } from "./verdict_authority";
 import type { ConfirmationReferenceSource } from "./host_port";
 import { buildRoleDelegationPacket, STATIC_REVIEW_RULES } from "../role_prompt_bridge";
-import type { AssuranceProjectionResult } from "../kernel/assurance_projection";
+import { projectAssurance, type AssuranceProjectionResult } from "../kernel/assurance_projection";
+import { taskStatusIdentity } from "../workspace_scope";
+import { pluginSourceSkewWarning, type PluginSourceSkewWarning } from "../plugin_source_skew";
 import type { TaskIntentIdentityToken } from "../kernel/intent_token_registry";
+import { scopeAdditionsFromHistory } from "../kernel/intent";
 import type { AssuranceHostPort, HostReviewReservation } from "./host_port";
 import type { GithubTrackerResult as GithubTrackerProjectionResult } from "../github_issue_tracker";
 import { isLaneWorkspaceForTask } from "../unattended/lane_workspace";
@@ -43,7 +46,12 @@ export interface TaskTombstone {
 }
 export interface TaskRecordRead {
 	revision?: string;
-	record?: { contract?: string; findings: Array<{ kind: string; status: string; id?: string; acceptance_id?: string | null }> } | null;
+	record?: {
+		contract?: string;
+		findings: Array<{ kind: string; status: string; id?: string; acceptance_id?: string | null }>;
+		/** Kernel history; Review disclosure reads `revise_intent` reasons from it. */
+		history?: Array<{ type: string; reason: string }>;
+	} | null;
 }
 export interface TaskIntentRead {
 	/**
@@ -159,9 +167,13 @@ export interface AssuranceVerdict {
 export function reviewReworkFindings(verdict: AssuranceVerdict): TaskFinding[] {
 	if (verdict.decision !== "rework" || !verdict.findings?.length)
 		throw new Error("review rework findings require a rework verdict");
+	// Advisory notes belong to a pass attestation; one that reached a rework
+	// verdict is a contract violation, never Executor work to filter away.
+	if (verdict.findings.some((finding) => finding.kind !== "blocking"))
+		throw new Error("review rework findings must all be blocking");
 	return verdict.findings.map((finding) => ({
 		id: finding.id,
-		kind: finding.kind,
+		kind: "blocking" as const,
 		status: "open" as const,
 		acceptance_id: finding.acceptance_id,
 		source: "review" as const,
@@ -221,6 +233,14 @@ export interface SnapshotDescriptor {
 	review_bundle_digest: string | null;
 	/** Present only when Review authority binds an immutable Git revision (v4). */
 	review_revision?: ReviewRevisionIdentity;
+	/**
+	 * Review round 3 and later: the paths the latest rework changed. `skipped`
+	 * means the prior revision was absent or unresolvable and the admission rule
+	 * does not apply to this round.
+	 */
+	review_delta?:
+		| { round: number; prior_review_commit: string; delta_paths: string[] }
+		| { round: number; skipped: "prior_review_revision_absent" | "prior_review_revision_unresolvable" };
 	root: string;
 }
 
@@ -257,6 +277,56 @@ export function qaDiagnosticMetadata(d: QaCheckDiagnostic): QaCheckDiagnostic {
 	return safe;
 }
 
+/**
+ * What a failed `prepare` stage ran under, plus the end of its stderr; for an
+ * in-place run that found the working directory different from the frozen
+ * tree, the differing in-scope paths. It travels only in the direct Assurance
+ * Tool result: it is not part of `QaCheckDiagnostic` and is never persisted
+ * (no TaskRecord, finding, audit evidence, batch state or tracker projection).
+ */
+export type QaDeliveryConditions =
+	| { delivery: "working_directory" }
+	| { delivery: "isolated_materialization"; worktree_node_modules: "absent" };
+export interface QaPrepareObservation {
+	conditions: QaDeliveryConditions;
+	declared_timeout_ms: number;
+	stderr_tail: string;
+	drift_paths?: string[];
+}
+export const QA_DRIFT_PATH_LIMIT = 64;
+export const QA_PREPARE_STDERR_TAIL_BYTES = 2048;
+export const QA_PREPARE_REPRODUCTION_NOTE = "a reproduction in the live worktree is not equivalent: this run used an isolated delivery with no worktree node_modules";
+export const QA_DRIFT_NOTE = "in-scope tracked content of the working directory differs from the frozen snapshot; see prepare_observation.drift_paths";
+const QA_PREPARE_REASONS: QaPreparationReason[] = ["timeout", "nonzero_exit", "output_limit"];
+// Control characters other than newline and tab: C0, DEL and C1.
+const QA_TAIL_CONTROL = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/g;
+/** The last bytes of stderr, whole UTF-8 characters only, without terminal control sequences. */
+export function qaPrepareStderrTail(stderr: string): string {
+	const bytes = Buffer.from(stderr, "utf8");
+	let start = Math.max(0, bytes.length - QA_PREPARE_STDERR_TAIL_BYTES);
+	// Do not begin inside a multi-byte character.
+	while (start < bytes.length && (bytes[start]! & 0xc0) === 0x80) start++;
+	return bytes.subarray(start).toString("utf8").replace(QA_TAIL_CONTROL, "");
+}
+export function qaPrepareObservation(declaredTimeoutMs: number, stderr: string,
+	delivery: QaDeliveryConditions["delivery"] = "working_directory", driftPaths?: string[]): QaPrepareObservation {
+	return {
+		conditions: delivery === "isolated_materialization" ? { delivery, worktree_node_modules: "absent" } : { delivery: "working_directory" },
+		declared_timeout_ms: declaredTimeoutMs,
+		stderr_tail: qaPrepareStderrTail(stderr),
+		...(driftPaths ? { drift_paths: driftPaths.slice(0, QA_DRIFT_PATH_LIMIT).map(path => path.replace(QA_TAIL_CONTROL, "").slice(0, 512)) } : {}),
+	};
+}
+/** The Tool boundary never spreads arbitrary executor fields. */
+export function qaPrepareObservationMetadata(o: QaPrepareObservation): QaPrepareObservation {
+	const delivery = o.conditions?.delivery;
+	if (!Number.isSafeInteger(o.declared_timeout_ms) || o.declared_timeout_ms < 0 || typeof o.stderr_tail !== "string"
+		|| (delivery !== "working_directory" && delivery !== "isolated_materialization")
+		|| (o.drift_paths !== undefined && (!Array.isArray(o.drift_paths) || o.drift_paths.some(path => typeof path !== "string"))))
+		throw new Error("invalid QA prepare observation");
+	return qaPrepareObservation(o.declared_timeout_ms, o.stderr_tail, delivery, o.drift_paths);
+}
+
 export interface QaVerificationProgressInput {
 	index: number;
 	total: number;
@@ -267,13 +337,18 @@ export interface QaVerificationProgressInput {
 }
 
 export class QaPreparationError extends Error {
+	/** Present for a `prepare` stage ending in timeout, nonzero exit or output limit, and for in-place drift. */
+	public readonly prepare_observation?: QaPrepareObservation;
 	constructor(public readonly stage: QaCheckDiagnostic["stage"], public readonly acceptance_ids: string[], public readonly reason: QaPreparationReason,
-		public readonly diagnostics: QaCheckDiagnostic[] = []) {
+		public readonly diagnostics: QaCheckDiagnostic[] = [], prepareObservation?: QaPrepareObservation) {
 		if (!QA_STAGES.includes(stage) || !QA_OUTCOMES.includes(reason)) throw new Error("invalid QA preparation classification");
 		const safe = diagnostics.map(qaDiagnosticMetadata);
 		if (Buffer.byteLength(JSON.stringify(safe)) > 16_384) throw new QaPreparationError("prepare", [], "execution_metadata_limit_exceeded");
 		super(`QA ${stage} failed (${reason}); affected checks=${acceptance_ids.length}`);
 		this.diagnostics = safe;
+		if (prepareObservation && ((stage === "prepare" && QA_PREPARE_REASONS.includes(reason))
+			|| (reason === "protected_input_or_output_drift" && prepareObservation.drift_paths)))
+			this.prepare_observation = qaPrepareObservationMetadata(prepareObservation);
 		this.name = "QaPreparationError";
 	}
 }
@@ -291,6 +366,38 @@ export interface AssuranceRecovery {
 	next_action: string;
 }
 
+export interface StatusProjectionWarning {
+	code: "unstaged_scope_paths" | PluginSourceSkewWarning["code"];
+	paths: string[];
+	message: string;
+}
+export type StatusProjectionResult = AssuranceProjectionResult & { warnings?: StatusProjectionWarning[] };
+/**
+ * The read-only status projection both Hosts return from their status Tool.
+ * Unstaged or untracked in-scope paths, and a loaded plugin build that differs
+ * from this workspace's own plugin source, come back as warnings beside the
+ * projection instead of replacing it. Every path that freezes a snapshot or
+ * binds authority keeps projecting through the refusing delivery identity.
+ */
+export async function projectTaskStatus(root: string, taskId: string, loadedFrom?: string): Promise<StatusProjectionResult> {
+	let unstaged: string[] = [];
+	const result = await projectAssurance(root, taskId, (dir, record) => {
+		const identity = taskStatusIdentity(dir, record);
+		unstaged = identity.unstaged_scope_paths;
+		return identity;
+	});
+	const warnings: StatusProjectionWarning[] = [];
+	if (!result.error && unstaged.length > 0) warnings.push({
+		code: "unstaged_scope_paths",
+		paths: unstaged,
+		message: `task scope contains unstaged or untracked changes: ${unstaged.join(", ")}; advance_assurance refuses until they are staged or removed`,
+	});
+	// Reported beside errors too: a stale loaded build is the likely cause of one.
+	const skew = pluginSourceSkewWarning(root, loadedFrom);
+	if (skew) warnings.push(skew);
+	return warnings.length === 0 ? result : { ...result, warnings };
+}
+
 /** Observation only; fresh Kernel facts remain the sole owner of the obligation. */
 export function deriveAssuranceRecovery(taskId: string, fresh: AssuranceProjectionResult,
 	result: { state?: string; environment_failure?: boolean; diagnostics?: QaCheckDiagnostic[]; reason?: string },
@@ -332,6 +439,8 @@ export interface AssuranceTimings { total_ms: number; stage_ms: Record<string, n
 type AssuranceRecoveryFields = {
 	timings?: AssuranceTimings;
 	diagnostics?: QaCheckDiagnostic[];
+	/** Direct Tool result only; never persisted (see `QaPrepareObservation`). */
+	prepare_observation?: QaPrepareObservation;
 	environment_failure?: boolean;
 	recovery?: AssuranceRecovery;
 	recovery_error?: "fresh_kernel_projection_unavailable";
@@ -467,6 +576,22 @@ export function snapshotDigest(snapshot: SnapshotDescriptor): string {
 	return `sha256:${createHash("sha256").update(JSON.stringify(snapshot)).digest("hex")}`;
 }
 
+export interface ReviewPromptOptions {
+	/**
+	 * Paths added by compatible scope revisions, derived from Kernel history.
+	 * The user confirmed none of them, so Review is told to treat each as task
+	 * work and to check it against the goal (ADR 0021).
+	 */
+	selfServedScopeAdditions?: readonly string[];
+}
+
+function selfServedScopeLines(added: readonly string[] | undefined): string[] {
+	if (!added?.length) return [];
+	return [
+		`Self-served scope additions (added by compatible Intent revisions with no user confirmation; judge each against the goal and its acceptance, not as pre-approved): ${added.join(", ")}`,
+	];
+}
+
 /**
  * The per-dispatch Review facts: which evidence to read, which revision it pins,
  * what the acceptances assert, and the exact verdict shapes.
@@ -476,7 +601,20 @@ export function snapshotDigest(snapshot: SnapshotDescriptor): string {
  * dispatched agent carries no instructions (Pi) gets `buildReviewPrompt`, which
  * prepends both.
  */
-export function buildReviewSnapshotPrompt(snapshot: SnapshotDescriptor, evidencePath?: string): string {
+function reviewDeltaLines(delta: SnapshotDescriptor["review_delta"]): string[] {
+	if (!delta) return [];
+	if ("skipped" in delta)
+		return [`Review round ${delta.round}: no rework delta is available (${delta.skipped}); the delta admission rule does not apply to this round.`];
+	return [
+		`Review round ${delta.round}: review only the latest rework delta and its direct interactions. Prior reviewed commit ${delta.prior_review_commit}; delta_paths: ${delta.delta_paths.length ? delta.delta_paths.join(", ") : "(none)"}. A blocking finding must have a caller_chain path in delta_paths or violated.kind "security_boundary"; otherwise it is advisory on a pass verdict.`,
+	];
+}
+
+export function buildReviewSnapshotPrompt(
+	snapshot: SnapshotDescriptor,
+	evidencePath?: string,
+	options: ReviewPromptOptions = {},
+): string {
 	if (snapshot.role !== "review") throw new Error("native review prompt requires review role");
 	const acceptance = snapshot.acceptance.map((item) => `- ${item.id}: ${item.assertion}`).join("\n");
 	const digest = snapshotDigest(snapshot);
@@ -501,11 +639,13 @@ export function buildReviewSnapshotPrompt(snapshot: SnapshotDescriptor, evidence
 		revision
 			? `Intent revision ${snapshot.intent_revision} (hash ${snapshot.intent_content_hash}), diff ${snapshot.diff_hash}, review revision ${revision.review_commit} (base ${revision.base_head}, tree ${revision.review_tree}, manifest ${revision.manifest_digest}), state ${snapshot.lifecycle}:${snapshot.artifact_state}.`
 			: `Intent revision ${snapshot.intent_revision} (hash ${snapshot.intent_content_hash}), diff ${snapshot.diff_hash}, review bundle ${snapshot.review_bundle_digest}, state ${snapshot.lifecycle}:${snapshot.artifact_state}.`,
+		...selfServedScopeLines(options.selfServedScopeAdditions),
+		...reviewDeltaLines(snapshot.review_delta),
 		"Acceptance assertions:", acceptance,
 		`PASS shape: {"contract":"assurance_kernel/assurance_verdict/v2","role":"review","task_id":"${snapshot.task_id}","snapshot_digest":"${digest}","decision":"pass","approval":{"kind":"review","authority_role":"reviewer","summary":"<one line>","inspected_paths":["<every changed path of the reviewed change set>"]}}`,
 		`A pass verdict may carry non-blocking notes as findings, but every one of them must set kind "advisory"; a blocking finding is a rework verdict and must omit approval: {"contract":"assurance_kernel/assurance_verdict/v2","role":"review","task_id":"${snapshot.task_id}","snapshot_digest":"${digest}","decision":"pass","approval":{"kind":"review","authority_role":"reviewer","summary":"<one line>","inspected_paths":["<every changed path of the reviewed change set>"]},"findings":[{"id":"review-1","kind":"advisory","acceptance_id":"<id|null>","summary":"<one line>","evidence":{"trigger":"<concrete inputs or state>","caller_chain":["<path-or-symbol>"],"violated":{"kind":"acceptance|security_boundary","ref":"<acceptance id or boundary>"}}}]}`,
-		`REWORK shape: {"contract":"assurance_kernel/assurance_verdict/v2","role":"review","task_id":"${snapshot.task_id}","snapshot_digest":"${digest}","decision":"rework","findings":[{"id":"review-1","kind":"blocking|advisory","acceptance_id":"<id|null>","summary":"<one line>","evidence":{"trigger":"<concrete inputs or state>","caller_chain":["<path-or-symbol>"],"violated":{"kind":"acceptance|security_boundary","ref":"<acceptance id or boundary>"}}}]}`,
-		`REWORK verdicts must omit the approval field entirely; do not emit "approval": null.`,
+		`REWORK shape: {"contract":"assurance_kernel/assurance_verdict/v2","role":"review","task_id":"${snapshot.task_id}","snapshot_digest":"${digest}","decision":"rework","findings":[{"id":"review-1","kind":"blocking","acceptance_id":"<id|null>","summary":"<one line>","evidence":{"trigger":"<concrete input or state → observable wrong result>","caller_chain":["<path-or-symbol>"],"violated":{"kind":"acceptance|security_boundary","ref":"<acceptance id or boundary>"}}}]}`,
+		`REWORK verdicts must omit the approval field entirely; do not emit "approval": null. A rework carries only blocking findings, at least one; a note that blocks nothing is an advisory finding on a pass verdict, never on rework.`,
 	].join("\n");
 }
 
@@ -514,7 +654,11 @@ export function buildReviewSnapshotPrompt(snapshot: SnapshotDescriptor, evidence
  * rules, and the per-dispatch facts. Dispatched by a Host whose agent carries no
  * instructions of its own.
  */
-export function buildReviewPrompt(snapshot: SnapshotDescriptor, evidencePath?: string): string {
+export function buildReviewPrompt(
+	snapshot: SnapshotDescriptor,
+	evidencePath?: string,
+	options: ReviewPromptOptions = {},
+): string {
 	if (snapshot.role !== "review") throw new Error("native review prompt requires review role");
 	const digest = snapshotDigest(snapshot);
 	const rolePacket = buildRoleDelegationPacket({
@@ -529,7 +673,7 @@ export function buildReviewPrompt(snapshot: SnapshotDescriptor, evidencePath?: s
 	return [
 		rolePacket.prompt,
 		...STATIC_REVIEW_RULES,
-		buildReviewSnapshotPrompt(snapshot, evidencePath),
+		buildReviewSnapshotPrompt(snapshot, evidencePath, options),
 	].join("\n");
 }
 
@@ -642,9 +786,46 @@ export function parseAssuranceVerdict(input: unknown, snapshot: SnapshotDescript
 	if (!Array.isArray(raw.findings) || raw.findings.length === 0) throw new Error("rework verdict findings are invalid");
 	if (raw.approval !== undefined && raw.approval !== null) throw new Error("rework verdict must omit approval");
 	const findings = parseVerdictFindings(raw.findings, snapshot);
+	// The verdict bytes stay the Reviewer's: a Review rework that mixes in
+	// advisory notes, or blocks on nothing, is rejected for resubmission and
+	// never demoted, filtered or synthesized here.
+	if (snapshot.role === "review") {
+		const outOfDelta = outOfDeltaBlockingFindings(findings, snapshot);
+		if (outOfDelta.length > 0)
+			throw new Error(`review round ${snapshot.review_delta!.round} admits a blocking finding only when a caller_chain path is in the rework delta or it is a security_boundary violation; finding(s) ${outOfDelta.map((finding) => finding.id).join(", ")} are outside the delta (${(snapshot.review_delta as { delta_paths: string[] }).delta_paths.join(", ") || "no changed paths"}); resubmit each as an advisory finding on a pass verdict, or justify it with violated.kind "security_boundary"`);
+		const advisory = findings.filter((finding) => finding.kind === "advisory");
+		if (advisory.length > 0 || !findings.some((finding) => finding.kind === "blocking"))
+			throw new Error(`review rework verdict must contain only blocking findings and at least one: ${advisory.length > 0 ? `advisory finding(s) ${advisory.map((finding) => finding.id).join(", ")} are not allowed on rework; ` : "it has no blocking finding; "}resubmit decision "pass" with approval.inspected_paths listing every reviewed changed path when nothing blocks, carrying any non-blocking notes as advisory findings`);
+	}
 	return { contract: "assurance_kernel/assurance_verdict/v2", role: snapshot.role, task_id: snapshot.task_id, snapshot_digest: snapshotDigest(snapshot), decision: "rework", findings };
 }
 
+/**
+ * Review round 3 and later admits a blocking finding only when it touches the
+ * latest rework delta or crosses a security boundary. The rule is skipped, never
+ * blocking, when no delta was computed for the round.
+ */
+function outOfDeltaBlockingFindings(
+	findings: ReturnType<typeof parseVerdictFindings>,
+	snapshot: SnapshotDescriptor,
+): Array<{ id: string }> {
+	const delta = snapshot.review_delta;
+	if (!delta || !("delta_paths" in delta)) return [];
+	const changed = new Set(delta.delta_paths);
+	return findings.filter((finding) => {
+		if (finding.kind !== "blocking") return false;
+		const evidence = (finding as { evidence?: { violated: { kind: string }; caller_chain: string[] } }).evidence;
+		if (!evidence) return false;
+		if (evidence.violated.kind === "security_boundary") return false;
+		return !evidence.caller_chain.some((entry) => changed.has(callerChainPath(entry)));
+	});
+}
+
+/** The path component of a caller_chain entry: drops a `:line`, `#symbol` or `(` suffix. */
+function callerChainPath(entry: string): string {
+	return entry.trim().replace(/^\.\//, "").split(/[:#(\s]/, 1)[0] ?? "";
+}
+
 /**
  * Parse one verdict's findings. Review findings carry evidence and derive their
  * anchor here so a capability minted for one anchor set cannot be spent on
@@ -1151,11 +1332,17 @@ export class AssuranceCoordinator {
 			try {
 				ensureOperationLive();
 				const workload = classifyReviewWorkload(review.snapshot, review.reviewManifest ?? review.reviewBundle!);
+				// Derived from Kernel history on every dispatch; nothing is stored.
+				const promptOptions: ReviewPromptOptions = {
+					selfServedScopeAdditions: scopeAdditionsFromHistory(
+						(await this.ports.readTaskRecord(ctx.cwd, taskId)).record?.history ?? [],
+					),
+				};
 				hostReservation = this.ports.host.prepareReview({
 					taskId,
 					operationId,
-					prompt: buildReviewPrompt(review.snapshot, evidence.path),
-					snapshotPrompt: buildReviewSnapshotPrompt(review.snapshot, evidence.path),
+					prompt: buildReviewPrompt(review.snapshot, evidence.path, promptOptions),
+					snapshotPrompt: buildReviewSnapshotPrompt(review.snapshot, evidence.path, promptOptions),
 					evidencePath: evidence.path,
 					maxTurns: reviewTurnBudget(workload),
 				});
@@ -1182,8 +1369,11 @@ export class AssuranceCoordinator {
 				return { state: "failed", operation: "qa", operation_id: operationId, reason: `${phase}: ${boundedAssuranceError(error)}`,
 					recovery_error: "fresh_kernel_projection_unavailable" };
 			if (error instanceof QaPreparationError && !authorityCommitted && !authorityBoundaryStarted && !aborted())
-				return { state: "failed", operation: "qa", operation_id: operationId, reason: error.message,
-					environment_failure: true, diagnostics: error.diagnostics.map(qaDiagnosticMetadata) };
+				return { state: "failed", operation: "qa", operation_id: operationId,
+					reason: error.prepare_observation?.drift_paths ? `${error.message}; ${QA_DRIFT_NOTE}`
+						: error.prepare_observation?.conditions.delivery === "isolated_materialization" ? `${error.message}; ${QA_PREPARE_REPRODUCTION_NOTE}` : error.message,
+					environment_failure: true, diagnostics: error.diagnostics.map(qaDiagnosticMetadata),
+					...(error.prepare_observation ? { prepare_observation: qaPrepareObservationMetadata(error.prepare_observation) } : {}) };
 			if (phase === "verifying" && !authorityCommitted && !authorityBoundaryStarted && !aborted() && !(error instanceof VerificationAbortedError))
 				return { state: "failed", operation: "qa", operation_id: operationId,
 					reason: "QA execution failed before attestation (execution_failed)", environment_failure: true };

package/plugins/immune-brain/runtime/assurance/delivery_workspace.ts

@@ -118,7 +118,8 @@ function assertNoEscapingSymlinks(root: string, dir = root): void {
 
 
 export function writeDeliveryTree(sourceRoot: string, snapshot: GitTaskRevisionSnapshot): string {
-	const indexDirectory = mkdtempSync(join(tmpdir(), "imm-delivery-index-"));
+	// Inside the Git directory: a task QA run creates nothing outside the repository.
+	const indexDirectory = mkdtempSync(join(git(sourceRoot, ["rev-parse", "--absolute-git-dir"]), "imm-delivery-index-"));
 	try {
 		git(sourceRoot, ["read-tree", snapshot.base_tree], {
 			GIT_INDEX_FILE: join(indexDirectory, "index"),

package/plugins/immune-brain/runtime/assurance/enrollment_git_base.ts

@@ -1,6 +1,10 @@
 import { execFileSync, spawnSync } from "node:child_process";
+import { observeEnrollmentTaskIntent } from "../kernel/intent";
+import { inspectSpecBinding } from "../kernel/spec_binding";
+import { dirtyScopePaths } from "../workspace_scope";
+import { commitWorkflowPaths, identityEnv, type WorkflowCommitResult } from "./workflow_autocommit";
 import { preparePiCanary, readGitHead, revalidatePiCanary, type PiCanaryPreparation, type PiCanaryPrepareInput } from "../kernel/pi_canary_prepare";
-import { withKernelStoreLock } from "../kernel/storage";
+import { reconcileKernelAuthority, withKernelStoreLock } from "../kernel/storage";
 
 export type EnrollmentGitBase = { state: "committed"; head: string } | { state: "unborn"; branch: string };
 
@@ -28,18 +32,100 @@ export function enrollmentGitBaseNotice(base: EnrollmentGitBase): string | undef
 		: undefined;
 }
 
-function identityEnv(root: string): NodeJS.ProcessEnv {
-	const configured = (key: string): string => {
-		const result = spawnSync("git", ["config", "--get", key], { cwd: root, encoding: "utf8" });
-		if (result.status !== 0 && result.status !== 1) throw new Error(`Cannot read Git identity: ${key}`);
-		return result.stdout?.trim() ?? "";
-	};
-	const name = configured("user.name") || "Immune-Brain Enrollment";
-	const email = configured("user.email") || "enrollment@immune-brain.local";
-	return { ...process.env,
-		GIT_AUTHOR_NAME: process.env.GIT_AUTHOR_NAME || name, GIT_AUTHOR_EMAIL: process.env.GIT_AUTHOR_EMAIL || email,
-		GIT_COMMITTER_NAME: process.env.GIT_COMMITTER_NAME || name, GIT_COMMITTER_EMAIL: process.env.GIT_COMMITTER_EMAIL || email,
-	};
+/** Subject of the commit Enrollment makes for its own preconditions. */
+export function enrollmentPreconditionSubject(taskId: string): string {
+	return `chore(imm): commit Enrollment preconditions for ${taskId}`;
+}
+
+/**
+ * The paths Enrollment commits for `taskId`, empty when no precondition would
+ * fail. On a committed HEAD an untracked TaskIntent is the one failing state:
+ * the set is then the task's own TaskIntent and the Spec its binding names.
+ * In-scope dirt is not committed on a committed HEAD — the confirmed
+ * Enrollment gate claims it as task work (host-owned-environment D8), and a
+ * staged TaskIntent over a clean scope fails nothing and yields no commit. The
+ * `unbornScope` form is the exception: there the empty root commit is what
+ * makes the Planner's staged and untracked in-scope edits dirty, and the
+ * disclosure could not list them because no HEAD existed to compare against,
+ * so the commit carries them. The TaskIntent is read from the worktree file,
+ * tracked or not. Returns null when no set can be derived (no sidecar, an
+ * invalid one, an unborn HEAD); the ordinary Enrollment checks then report
+ * that condition themselves.
+ */
+export function enrollmentCommittablePaths(root: string, taskId: string, unbornScope = false): string[] | null {
+	const intentPath = `docs/plans/${taskId}.intent.json`;
+	try {
+		if (inspectEnrollmentGitBase(root).state !== "committed") return null;
+		const { intent } = observeEnrollmentTaskIntent(root, taskId);
+		const binding = inspectSpecBinding(intent);
+		if (!binding.ok) return null;
+		const dirtyScope = unbornScope ? dirtyScopePaths(root, intent.scope_hint, taskId) : [];
+		const untrackedIntent = spawnSync("git", ["ls-files", "--error-unmatch", "--", intentPath], { cwd: root }).status === 1;
+		if (dirtyScope.length === 0 && !untrackedIntent) return [];
+		return [...new Set([intentPath, ...(binding.binding ? [binding.binding.active] : []), ...dirtyScope])];
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Read-only. True when no Kernel owner would refuse a fresh Enrollment of
+ * `taskId`: the authority projection is unowned (or carries only historical
+ * audit evidence with no local run), and no backend claim, TaskRecord or
+ * workspace owner exists. An unreadable owner state does not admit.
+ */
+function freshEnrollmentAdmitted(root: string, taskId: string): boolean {
+	try {
+		const authority = reconcileKernelAuthority(root, taskId);
+		if (authority.state !== "unowned" && !(authority.state === "terminal_owner" && authority.owner_run_id === null))
+			return false;
+		const owners = preparePiCanary(root, { task_id: taskId, now: new Date().toISOString() });
+		return !owners.backend_claim.present && !owners.task_record_v3?.present && owners.workspace.current_working === null;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Commit the Enrollment committable set when a precondition would fail, so the
+ * preparation that follows binds the resulting HEAD. A clean set makes no
+ * commit, and neither does an Enrollment an owner check would refuse anyway:
+ * an owned workspace keeps its owner's undelivered work uncommitted. A refused
+ * commit throws with Git's message.
+ */
+export function commitEnrollmentPreconditions(root: string, taskId: string, signal?: AbortSignal, unbornScope = false): WorkflowCommitResult {
+	return withKernelStoreLock(root, () => {
+		const paths = enrollmentCommittablePaths(root, taskId, unbornScope);
+		if (!paths || paths.length === 0 || !freshEnrollmentAdmitted(root, taskId)) return { committed: false };
+		return commitWorkflowPaths(root, { paths, subject: enrollmentPreconditionSubject(taskId), signal });
+	});
+}
+
+/** A preparation's owner facts, without the fields a new Git base legitimately moves. */
+const withoutGit = ({ digest, git_base_head, git_error, ...owners }: PiCanaryPreparation) => owners;
+
+/**
+ * Unborn-HEAD path only, called after `initializeEnrollmentGitBase`: the scope
+ * could not be compared with an unborn HEAD, so commit it now that a base
+ * exists, in-scope edits included. The re-preparation must equal the confirmed
+ * one in everything but the Git base, exactly as the empty base commit
+ * requires; a TaskIntent or owner changed while the commit ran is refused, not
+ * enrolled.
+ */
+export function commitUnbornEnrollmentPreconditions(
+	root: string, input: PiCanaryPrepareInput, confirmed: PiCanaryPreparation, signal?: AbortSignal,
+): { result: WorkflowCommitResult; preparation: PiCanaryPreparation } {
+	const result = commitEnrollmentPreconditions(root, input.task_id, signal, true);
+	if (!result.committed) return { result, preparation: confirmed };
+	const current = preparePiCanary(root, input);
+	if (current.git_base_head !== result.commit || JSON.stringify(withoutGit(current)) !== JSON.stringify(withoutGit(confirmed)))
+		throw new Error(`Workspace changed during the Enrollment precondition commit; retry Enrollment${preconditionCommitNote(result)}`);
+	return { result, preparation: current };
+}
+
+/** Suffix naming a precondition commit that outlives a failed or declined Enrollment. */
+export function preconditionCommitNote(result: WorkflowCommitResult): string {
+	return result.committed ? `; Enrollment precondition commit ${result.commit} remains` : "";
 }
 
 /** Called only after native confirmation. Never stages files or writes Git config. */
@@ -70,7 +156,6 @@ export function initializeEnrollmentGitBase(
 			git(root, ["update-ref", "--no-deref", base.branch, commit, "0".repeat(commit.length)]);
 			created = commit;
 			const current = preparePiCanary(root, input);
-			const withoutGit = ({ digest, git_base_head, git_error, ...owners }: PiCanaryPreparation) => owners;
 			if (git(root, ["symbolic-ref", "--no-recurse", "HEAD"]) !== base.branch || current.git_base_head !== commit
 				|| JSON.stringify(withoutGit(current)) !== JSON.stringify(withoutGit(previous)))
 				throw new Error("Workspace changed during empty Git base initialization; retry Enrollment");