immune-brain 5.3.0 → 5.5.1

package/plugins/immune-brain/runtime/assurance/run_continuation.ts

@@ -0,0 +1,284 @@
+// Read-only response continuation. Kernel/batch facts own every action and settlement.
+import { createHash } from "node:crypto";
+import type { StatusProjectionResult } from "./coordinator";
+import { captureGitWorkspaceSnapshot, pathMatchesScope } from "../workspace_scope";
+import { startableChildren } from "../unattended/batch_schedule";
+import { readAnyBatchRunState, isLaneBatchRecord } from "../unattended/batch_state";
+import { observeInitiative } from "../unattended/batch_plan";
+import { observeParentCompletion, observeNativeParent } from "../unattended/batch_git";
+import { projectTaskStatus } from "./coordinator";
+import { readActiveClaimTaskId } from "../unattended/batch_preflight";
+import { readTaskIntent } from "../kernel/intent";
+import { readSettledTaskEvidence, readTaskRecordRaw } from "../kernel/storage";
+
+export interface RunSessionIdentity {
+	workspace: string;
+	session_id: string;
+}
+export type RunBinding = RunSessionIdentity & (
+	| { kind: "task"; task_id: string; run_id: string }
+	| { kind: "parent"; initiative_slug: string; batch_id: string | null; plan_digest: string; final_verification?: string[]; blocked_native_tasks?: string[] }
+);
+export type ReviewContinuationState = "unobserved" | "ready" | "running" | "returned" | "rejected";
+export interface RunContinuationState {
+	binding: RunBinding;
+	progress_digest: string | null;
+	unchanged_observations: number;
+	boundary_id: string | null;
+}
+export interface TaskContinuationObservation extends RunSessionIdentity {
+	kind: "task";
+	boundary_id: string;
+	status: StatusProjectionResult;
+	/** Source byte digest, including unstaged scope edits; never a delivery proof. */
+	source_digest: string;
+	review: ReviewContinuationState;
+	recovery_action?: string;
+	/** A concrete failed/cancelled Host operation; it must never be auto-retried. */
+	host_failure?: string;
+}
+export interface ParentContinuationObservation extends RunSessionIdentity {
+	kind: "parent";
+	boundary_id: string;
+	initiative_slug: string;
+	batch_id: string | null;
+	plan_digest: string;
+	/** Includes dependency readiness, integrations, corrections and final verification. */
+	progress_digest: string;
+	all_required_integrated: boolean;
+	final_passed: boolean;
+	pending_repair: boolean;
+	runnable: boolean;
+	executors_running: boolean;
+	next_action: string;
+	blocked_reason?: string;
+	host_failure?: string;
+}
+export type RunContinuationDecision = {
+	action: "continue" | "wait" | "pause" | "settled" | "unbound";
+	reason: string;
+	next_action: string | null;
+	state: RunContinuationState;
+};
+
+export const UNCHANGED_CONTINUATION_LIMIT = 2;
+
+export function bindRun(binding: RunBinding): RunContinuationState {
+	if (!binding.workspace || !binding.session_id ||
+		(binding.kind === "task" ? !binding.task_id || !binding.run_id : !binding.initiative_slug || (binding.batch_id !== null && !binding.batch_id) || !binding.plan_digest))
+		throw new Error("run continuation requires an exact session and committed run identity");
+	if (binding.kind === "parent" && binding.blocked_native_tasks !== undefined &&
+		(!Array.isArray(binding.blocked_native_tasks) || !binding.blocked_native_tasks.every(id => typeof id === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(id))))
+		throw new Error("invalid failed native task observations");
+	return { binding, progress_digest: null, unchanged_observations: 0, boundary_id: null };
+}
+
+/** Suppress only this rejected gate; independently authorized branches remain runnable. */
+export async function parkFailedCriticalGate(binding: RunBinding, taskId: string | undefined): Promise<boolean> {
+	if (binding.kind !== "parent" || !taskId || readActiveClaimTaskId(binding.workspace) === taskId) return false;
+	const parent = await observeInitiative(binding.workspace, binding.initiative_slug);
+	if (!parent.tasks.some(task => task.task_id === taskId) || readTaskIntent(binding.workspace, taskId).intent.risk !== "critical") return false;
+	binding.blocked_native_tasks = [...new Set([...(binding.blocked_native_tasks ?? []), taskId])];
+	return true;
+}
+
+/** Explicit cancellation or a planning entry releases conversational continuation only. */
+export function releasesRunBinding(prompt: string, phase: "run" | "planner" | "brainstorm" | null): boolean {
+	return phase === "planner" || phase === "brainstorm" ||
+		/^(?:stop|cancel|pause)(?:\s+(?:execution|the task|this run))?[.!\s]*$/i.test(prompt.trim()) ||
+		/^(?:请)?(?:停止|取消|暂停)(?:执行|任务|本次运行|这个任务)?[。！!\s]*$/.test(prompt.trim());
+}
+
+function digest(value: unknown): string {
+	return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+
+export function scopedSourceDigest(root: string, scope: readonly string[]): string {
+	const snapshot = captureGitWorkspaceSnapshot(root);
+	if (!snapshot) throw new Error("cannot observe source progress without a Git workspace");
+	return digest(Object.entries(snapshot.dirty_files).filter(([path]) => scope.some(entry => pathMatchesScope(path, entry))));
+}
+
+function finalProgress(report: import("../unattended/batch_final_verification").FinalVerificationReport | undefined): unknown {
+	return report ? { passed: report.passed, head: report.head,
+		results: report.results.map(result => ({ command: result.command, passed: result.passed, exit_code: result.exit_code, signal: result.signal })) } : null;
+}
+
+export async function observeParentRun(binding: RunBinding & { kind: "parent" },
+	boundaryId: string, review: ReviewContinuationState = "unobserved",
+	recoveryAction?: string): Promise<ParentContinuationObservation> {
+	const root = binding.workspace;
+	if (binding.batch_id === null) {
+		const facts = await observeNativeParent(root, binding.initiative_slug, undefined, binding.blocked_native_tasks);
+		if (!facts || facts.plan_digest !== binding.plan_digest) throw new Error("native Parent plan identity changed");
+		let nextAction = ["verify", "repair"].includes(facts.action) ?
+			`Call start_unattended_batch for ${binding.initiative_slug} with final_verification ${JSON.stringify(binding.final_verification ?? facts.native?.final_verification.results.map(result => result.command) ?? [])}; if it fails, diagnose and canonically prepare/validate the stable original-goal repair before fresh native Enrollment` : facts.next_action;
+		let runnable = ["verify", "repair", "integrate"].includes(facts.action) || (facts.action === "enroll" && facts.task_id !== null);
+		let running = false;
+		let taskProgress: unknown = null;
+		if (facts.action === "drive" && facts.task_id) {
+			const status = await projectTaskStatus(root, facts.task_id);
+			const task = readTaskRecordRaw(root, facts.task_id).record;
+			if (status.error || !task || !status.projection.run_id) throw new Error(status.error ?? "native Parent has no exact child run");
+			const source = scopedSourceDigest(root, task.intent_snapshot.scope_hint);
+			const decision = decideRunContinuation(bindRun({ kind: "task", workspace: root, session_id: binding.session_id,
+				task_id: facts.task_id, run_id: status.projection.run_id }), { kind: "task", workspace: root, session_id: binding.session_id,
+				boundary_id: boundaryId, status, source_digest: source, review, recovery_action: recoveryAction });
+			runnable = decision.action === "continue"; running = decision.action === "wait";
+			nextAction = decision.next_action ?? decision.reason; taskProgress = decision.state.progress_digest;
+		}
+		if (facts.action === "repair" && (facts.native?.repair_tasks?.length ?? 0) >= 2) {
+			runnable = false; nextAction = "Parent coordinator correction budget exhausted; request a user decision";
+		}
+		return { kind: "parent", workspace: root, session_id: binding.session_id, boundary_id: boundaryId,
+			initiative_slug: binding.initiative_slug, batch_id: null, plan_digest: facts.plan_digest,
+			progress_digest: digest({ proof: facts.proof, action: facts.action, repair_tasks: facts.native?.repair_tasks,
+				final: finalProgress(facts.native?.final_verification), taskProgress }),
+			all_required_integrated: facts.proof.missing_task_ids.length === 0, final_passed: facts.proof.final_passed,
+			pending_repair: facts.action === "repair", runnable, executors_running: running,
+			next_action: nextAction, blocked_reason: facts.proof.reason ?? undefined };
+	}
+	const record = readAnyBatchRunState(root, binding.batch_id);
+	if (!record || record.initiative_slug !== binding.initiative_slug || record.plan_digest !== binding.plan_digest)
+		throw new Error("Parent continuation has no matching persisted batch identity");
+	const plan = await observeInitiative(root, binding.initiative_slug);
+	const completion = await observeParentCompletion(root, binding.initiative_slug, plan.tasks.map(child => child.task_id));
+	let runnable = false;
+	let running = false;
+	let nextAction = `Call start_unattended_batch for ${binding.initiative_slug} to consume the current authorized handoff`;
+	let childProgress: unknown = null;
+	const activeTask = readActiveClaimTaskId(root);
+	const nativeTask = activeTask && !record.children.some(child => child.task_id === activeTask) &&
+		(plan.tasks.some(child => child.task_id === activeTask) || record.repair_tasks?.some(task => task.task_id === activeTask));
+	const activeChild = nativeTask ? { task_id: activeTask } : record.children.find(child => child.state === "enrolled" || child.state === "settled");
+	if (activeChild && (!isLaneBatchRecord(record) || nativeTask)) {
+		const status = await projectTaskStatus(root, activeChild.task_id);
+		if (status.error) throw new Error(status.error);
+		if (status.projection.lifecycle === "active" && status.projection.run_id) {
+			const task = readTaskRecordRaw(root, activeChild.task_id).record;
+			if (!task) throw new Error("Parent's active child has no TaskRecord");
+			const source = scopedSourceDigest(root, task.intent_snapshot.scope_hint);
+			const taskBinding = bindRun({ kind: "task", workspace: root, session_id: binding.session_id,
+				task_id: activeChild.task_id, run_id: status.projection.run_id });
+			const decision = decideRunContinuation(taskBinding, { kind: "task", workspace: root, session_id: binding.session_id,
+				boundary_id: boundaryId, status, source_digest: source, review, recovery_action: recoveryAction });
+			runnable = decision.action === "continue";
+			running = decision.action === "wait";
+			nextAction = decision.next_action ?? decision.reason;
+			childProgress = decision.state.progress_digest;
+		} else if (status.projection.lifecycle === "done") runnable = true;
+	} else {
+		const live = isLaneBatchRecord(record) ? record.children.filter(child => ["lane_admitted", "enrolled", "settled", "lane_committed"].includes(child.state)) : [];
+		running = live.length > 0;
+		const schedule = plan.tasks.map(task => ({ task_id: task.task_id, blocked_by: task.blocked_by,
+			scope_hint: readTaskIntent(root, task.task_id).intent.scope_hint,
+			state: completion.integrated_task_ids.includes(task.task_id) ? "committed" as const :
+				record.children.find(child => child.task_id === task.task_id)?.state ?? "needs_human" as const }));
+		runnable = record.batch_state === "running" && (startableChildren(schedule, isLaneBatchRecord(record) ? record.max_parallel : 1).length > 0 ||
+			live.length > 0);
+		if (running && runnable) nextAction = `Supervise the observed Lane Executor handoff for ${binding.initiative_slug}; use the Host's live-session wait/observation before resuming the batch, rather than repeatedly observing an unchanged batch`;
+	}
+	if (!activeChild && !running) {
+		for (const child of plan.tasks) {
+			if (binding.blocked_native_tasks?.includes(child.task_id)) continue;
+			if (record.children.some(candidate => candidate.task_id === child.task_id) || completion.integrated_task_ids.includes(child.task_id)) continue;
+			const intent = readTaskIntent(root, child.task_id);
+			if (intent.intent.risk !== "critical") continue;
+			if (readSettledTaskEvidence(root, child.task_id)?.proof.terminal_lifecycle === "done") {
+				runnable = true; nextAction = `Call start_unattended_batch for ${binding.initiative_slug} to integrate the settled critical Slice and resume the intact ordinary batch authorization`; break;
+			}
+			if (child.blocked_by.every(id => completion.integrated_task_ids.includes(id))) {
+				runnable = true; nextAction = `Invoke native single-task Enrollment for critical Slice ${child.task_id}; it consumes no ordinary batch slot. Drive its Loop to settlement, then resume Parent ${binding.initiative_slug}`; break;
+			}
+		}
+	}
+	const failedFinal = record.final_verification_result?.passed === false && plan.tasks.every(child => completion.integrated_task_ids.includes(child.task_id));
+	const pendingRepair = record.repair_tasks?.some(task => !completion.integrated_task_ids.includes(task.task_id));
+	const exhausted = failedFinal && !activeChild && !pendingRepair && (record.repair_tasks?.length ?? 0) >= 2;
+	if (failedFinal && !activeChild) nextAction = pendingRepair
+		? `Call start_unattended_batch for ${binding.initiative_slug} to integrate the settled repair and run recorded final verification again`
+		: "Diagnose final verification, call prepareFinalRepairCandidate with the original goal, diagnosed minimum scope, recorded failure and spent repair count; canonically author/validate its stable candidate, then request fresh native Enrollment. Preserve settled deliveries";
+	if (exhausted) nextAction = "Parent coordinator correction budget exhausted; resolve the final failure with a user decision before further repair Enrollment";
+	return { kind: "parent", workspace: root, session_id: binding.session_id, boundary_id: boundaryId,
+		initiative_slug: record.initiative_slug, batch_id: record.batch_id, plan_digest: record.plan_digest,
+		progress_digest: digest({ children: record.children.map(child => ({ task_id: child.task_id, state: child.state, commit: child.commit })),
+			commits: record.commits, completion, childProgress, final: finalProgress(record.final_verification_result) }), all_required_integrated: completion.missing_task_ids.length === 0,
+		final_passed: completion.final_passed, pending_repair: failedFinal, runnable: !exhausted && (runnable || (failedFinal && !activeChild)),
+		executors_running: running, next_action: nextAction, blocked_reason: completion.reason ?? undefined };
+}
+
+export function decideRunContinuation(previous: RunContinuationState,
+	observation: TaskContinuationObservation | ParentContinuationObservation): RunContinuationDecision {
+	const result = (action: RunContinuationDecision["action"], reason: string, next_action: string | null,
+		state = previous): RunContinuationDecision => ({ action, reason, next_action, state });
+	const binding = previous.binding;
+	if (binding.workspace !== observation.workspace || binding.session_id !== observation.session_id)
+		return result("unbound", "Host session or workspace changed", null);
+	if (binding.kind !== observation.kind)
+		return result("pause", "run observation does not match the bound entry", null);
+	if (observation.host_failure)
+		return result("pause", observation.host_failure, null);
+
+	let progressDigest: string;
+	let nextAction: string;
+	let wait = false;
+	if (binding.kind === "parent" && observation.kind === "parent") {
+		if (binding.initiative_slug !== observation.initiative_slug || binding.batch_id !== observation.batch_id || binding.plan_digest !== observation.plan_digest)
+			return result("pause", "batch identity changed; reread its authorized plan", null);
+		if (observation.all_required_integrated && observation.final_passed && !observation.pending_repair)
+			return result("settled", "every required delivery is integrated and final verification passed", null);
+		if (!observation.runnable && !observation.executors_running)
+			return result("pause", observation.blocked_reason ?? "no executable Parent work remains", observation.next_action);
+		progressDigest = observation.progress_digest;
+		nextAction = observation.next_action;
+		wait = !observation.runnable && observation.executors_running;
+	} else if (binding.kind === "task" && observation.kind === "task") {
+		const { status } = observation;
+		const p = status.projection;
+		if (status.error || status.task_id !== binding.task_id || p.run_id !== binding.run_id)
+			return result("pause", status.error ?? "Kernel task/run identity changed", null);
+		if (p.lifecycle === "done" && p.completion_ready && status.claim === null)
+			return result("settled", "Kernel terminal settlement confirmed", null);
+		if (p.lifecycle === "stopped" && status.claim === null)
+			return result("pause", "Kernel task stopped", null);
+		if (status.claim?.task_id !== binding.task_id || status.claim.lifecycle_status !== "active" || p.lifecycle !== "active")
+			return result("pause", "Kernel authority is missing or contradictory", null);
+		if (p.unresolved_user_decision_ids.length || p.replan_required_ids.length || p.open_user_decision_count ||
+			p.next_obligation === "resolve_user_decision" || p.next_obligation === "revise_intent" || p.authorization.state !== "none" || p.authorization.blocked)
+			return result("pause", "Kernel requires a concrete user decision or authorization", "Use the existing native authorization operation");
+		progressDigest = digest({ lifecycle: p.lifecycle, artifact_state: p.artifact_state, intent_content_hash: p.intent_content_hash,
+			diff_hash: p.diff_hash, next_obligation: p.next_obligation, fresh_acceptance_ids: [...p.fresh_acceptance_ids].sort(),
+			fresh_approval_kinds: [...p.fresh_approval_kinds].sort(), blocking_finding_ids: [...p.blocking_finding_ids].sort(),
+			source_digest: observation.source_digest, review: observation.review });
+		if (p.next_obligation === "run_review") {
+			switch (observation.review) {
+				case "ready": nextAction = "Invoke the exact reserved foreground reviewer once"; break;
+				case "running": nextAction = "Await the observed foreground reviewer; do not dispatch another"; wait = true; break;
+				case "returned": nextAction = "Call submit_review immediately with the observed verdict before editing"; break;
+				case "rejected":
+					if (!observation.recovery_action) return result("pause", "Review submission failed without an observed recovery action", null);
+					nextAction = observation.recovery_action; break;
+				case "unobserved": nextAction = "Call advance_assurance to recover or prepare the current Review reservation"; break;
+			}
+		} else if (status.warnings?.some(warning => warning.code === "unstaged_scope_paths")) {
+			nextAction = "Finish the in-scope implementation and stage task-owned changes before advance_assurance";
+		} else {
+			switch (p.next_obligation) {
+				case "submit_assurance": case "run_qa": nextAction = "Complete in-scope implementation and focused checks, then call advance_assurance"; break;
+				case "resolve_findings": nextAction = "Repair the open findings, verify, resolve them and call advance_assurance"; break;
+				case "complete": nextAction = "Call advance_assurance to finish Kernel settlement"; break;
+				default: return result("pause", "Kernel has no actionable obligation", null);
+			}
+		}
+	} else {
+		return result("pause", "run observation does not match the bound entry", null);
+	}
+	if (previous.boundary_id === observation.boundary_id)
+		return result("wait", "duplicate Host boundary", null);
+	const unchanged = wait ? previous.unchanged_observations : previous.progress_digest === progressDigest ? previous.unchanged_observations + 1 : 0;
+	const state = { ...previous, progress_digest: progressDigest, unchanged_observations: unchanged, boundary_id: observation.boundary_id };
+	// Running reviewers/executors progress through their own supervised exit boundary.
+	if (!wait && unchanged >= UNCHANGED_CONTINUATION_LIMIT)
+		return result("pause", "no substantive progress across continuation boundaries", nextAction, state);
+	return result(wait ? "wait" : "continue", wait ? "observed foreground work is still running" : "authorized work remains", nextAction, state);
+}

package/plugins/immune-brain/runtime/assurance/verdict_authority.ts

@@ -13,7 +13,7 @@ import type { TaskRecord, TaskApprovalV2 } from "../kernel/types";
 import { captureGitTaskSnapshot } from "../workspace_scope";
 import { parseVerificationDescriptor } from "../verification_descriptor";
 import type { VerificationDescriptor } from "./verification";
-import { captureReviewBundle, captureReviewManifest, type ReviewBundle, type ReviewManifestV5, type ReviewRevision } from "./review_evidence";
+import { captureReviewBundle, captureReviewManifest, REVIEW_DELTA_FROM_ROUND, type ReviewBundle, type ReviewDeltaInput, type ReviewManifestV5, type ReviewRevision } from "./review_evidence";
 import { reviewReworkFindings, reviewAdvisoryRecords, type SnapshotDescriptor, type AssuranceRole, type AssuranceVerdict, type HostContext } from "./coordinator";
 import type { InvocationToken } from "./invocations";
 import type { ConfirmationReferenceSource } from "./host_port";
@@ -37,6 +37,7 @@ export interface SnapshotDescriptorInput {
 	acceptance: Array<{ id: string; assertion: string; verification: string }>;
 	dirty_files?: string[];
 	review_bundle_digest?: string | null;
+	review_delta?: SnapshotDescriptor["review_delta"];
 	/** Present only when Review authority binds an immutable Git revision (v4). */
 	review_revision?: {
 		contract: "assurance_kernel/review_revision_identity/v1";
@@ -68,11 +69,34 @@ export function buildSnapshot(input: SnapshotDescriptorInput): SnapshotDescripto
 		dirty_files: [...(input.dirty_files ?? [])].sort(),
 		review_bundle_digest: input.review_bundle_digest ?? null,
 		...(input.review_revision ? { review_revision: input.review_revision } : {}),
+		...(input.review_delta ? { review_delta: input.review_delta } : {}),
 		root: resolve(input.root),
 	};
 }
 
 
+/**
+ * The Review round the next dispatch opens and the revision the previous round
+ * analyzed. Both ensureReviewRevision and the snapshot read it through here so
+ * the manifest digest they bind cannot diverge. A record with no persisted
+ * prior revision yields `prior: null`, which skips the delta rule.
+ */
+function reviewDeltaInput(record: TaskRecord): ReviewDeltaInput {
+	const round = Math.max(
+		0,
+		...record.findings.filter((item) => item.source === "review").map((item) => item.review_round ?? 0),
+	) + 1;
+	const prior = [...record.history]
+		.reverse()
+		.find((entry) => entry.type === "request_rework" && entry.reason.split("\n")[0] === `review_round_${round - 1}`);
+	return {
+		round,
+		prior: prior?.review_revision
+			? { review_commit: prior.review_revision.review_commit, review_tree: prior.review_revision.review_tree }
+			: null,
+	};
+}
+
 export async function ensureReviewRevision(
 	root: string,
 	taskId: string,
@@ -103,6 +127,7 @@ export async function ensureReviewRevision(
 		// write that exact summary, so the submit-time digest comparison held by
 		// coincidence rather than by construction.
 		outcomes: qaOutcomes(record),
+		delta: reviewDeltaInput(record),
 	});
 	return {
 		contract: "assurance_kernel/review_revision/v1",
@@ -182,6 +207,7 @@ export async function buildAssuranceSnapshot(
 				artifactState: projection.projection.artifact_state,
 				risk: intent.risk,
 				outcomes: qaOutcomes(record.record),
+				delta: reviewDeltaInput(record.record),
 			})
 		: null;
 	const taskSnapshot = !reviewBundle && !reviewManifest
@@ -221,6 +247,7 @@ export async function buildAssuranceSnapshot(
 							manifest_digest: reviewManifest.manifest_digest,
 						}
 						: undefined,
+				review_delta: reviewManifest ? reviewDeltaOf(reviewManifest, record.record) : undefined,
 		}),
 		descriptors,
 		reviewBundle,
@@ -228,6 +255,17 @@ export async function buildAssuranceSnapshot(
 	};
 }
 
+function reviewDeltaOf(
+	manifest: ReviewManifestV5,
+	record: TaskRecord,
+): SnapshotDescriptor["review_delta"] {
+	const { round } = reviewDeltaInput(record);
+	if (round < REVIEW_DELTA_FROM_ROUND) return undefined;
+	return manifest.delta_paths
+		? { round, prior_review_commit: manifest.prior_review_commit!, delta_paths: manifest.delta_paths }
+		: { round, skipped: manifest.delta_skipped ?? "prior_review_revision_absent" };
+}
+
 function qaOutcomes(
 	record: TaskRecord,
 ): Record<string, { status: "passed" | "failed" | "blocked"; summary: string }> {
@@ -301,7 +339,7 @@ export function createVerdictAuthority(options: {
    recoverKernelStoreFollowUps(ctx.cwd, snapshot.task_id);
    const record = readTaskRecordRaw(ctx.cwd, snapshot.task_id).record;
    if (!record) throw new Error("TaskRecord disappeared before authority application");
-   const priorIntentToken = readTaskIntent(ctx.cwd, snapshot.task_id, record.intent_ref.path).token;
+   const priorIntentToken = readTaskIntent(ctx.cwd, snapshot.task_id, record.intent_ref.path, record.intent_snapshot).token;
    const now = new Date().toISOString();
    const findings = verdict.decision === "rework" ? reviewReworkFindings(verdict) : [];
    const advisories = verdict.decision === "pass" ? reviewAdvisoryRecords(verdict) : [];
@@ -316,7 +354,11 @@ export function createVerdictAuthority(options: {
    } : undefined;
    const op = verdict.decision === "rework" ? "request_rework" : "record_approval";
    const payload = approval ? { approval } : { findings };
-   const action = capabilityActionFor({ op, task_id: snapshot.task_id, at: now, actor_id: actorId, ...payload });
+   // Only a Review-authored rework persists the revision it analyzed; the next
+   // round derives its delta from it. QA rework never carries one.
+   const reworkRevision = verdict.decision === "rework" && snapshot.role === "review" && snapshot.review_revision
+    ? { review_revision: snapshot.review_revision } : {};
+   const action = capabilityActionFor({ op, task_id: snapshot.task_id, at: now, actor_id: actorId, ...payload, ...reworkRevision });
    const capability = registry.issue({
     authority_kind: snapshot.role, task_id: snapshot.task_id,
     ...(snapshot.run_id ? { run_id: snapshot.run_id } : {}),
@@ -332,7 +374,7 @@ export function createVerdictAuthority(options: {
    // then afterCommit. A thrown hook never undoes the committed transition.
    const settlement = (async () => app.execute({ root: ctx.cwd, task_id: snapshot.task_id,
     operation: approval ? { op: "record_approval", capability, approval, actor_id: actorId }
-     : { op: "request_rework", capability, findings, actor_id: actorId }, prior_intent_token: priorIntentToken, now }))();
+     : { op: "request_rework", capability, findings, actor_id: actorId, ...reworkRevision }, prior_intent_token: priorIntentToken, now }))();
    let hookFailed = false;
    let hookError: unknown;
    try { hooks.onCommit?.(); } catch (error) { hookFailed = true; hookError = error; }

package/plugins/immune-brain/runtime/assurance/verification.ts

@@ -3,7 +3,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { execFileSync, spawn } from "node:child_process";
 import { accessSync, constants, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { delimiter, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { VERIFICATION_DESCRIPTOR_BOUNDS, VerificationDescriptorError, type VerificationCommand } from "../verification_descriptor";
+import { VERIFICATION_DESCRIPTOR_BOUNDS, VerificationDescriptorError, parseVerificationDescriptor, type VerificationCommand, type VerificationDescriptor } from "../verification_descriptor";
 export * from "../verification_descriptor";
 
 export interface ExecutableIdentity {
@@ -15,8 +15,6 @@ export interface ExecutableIdentity {
 }
 export interface FrozenCommand {
 	entry: ExecutableIdentity;
-	interpreter: ExecutableIdentity | null;
-	interpreter_args: string[];
 }
 export interface VerificationResult {
 	exit_code: number;
@@ -54,6 +52,21 @@ export function verificationPath(): string {
 	return (process.env.PATH ?? "").split(delimiter).filter(path => isAbsolute(path)).join(delimiter);
 }
 
+// A hosting process that carries one of these would point a command's Git calls
+// at its own repository instead of the delivery materialization. Every other
+// variable, including Git identity and transport settings, is user environment.
+const GIT_REPOSITORY_BINDINGS: ReadonlySet<string> = new Set([
+	"GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY",
+	"GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_COMMON_DIR", "GIT_NAMESPACE", "GIT_PREFIX",
+]);
+
+function verificationEnvironment(path: string, processToken: string): Record<string, string> {
+	const env: Record<string, string> = {};
+	for (const [name, value] of Object.entries(process.env))
+		if (value !== undefined && !GIT_REPOSITORY_BINDINGS.has(name)) env[name] = value;
+	return { ...env, PATH: path, IMM_VERIFICATION_PROCESS_TOKEN: processToken };
+}
+
 function toolPath(name: string, path: string): string {
 	for (const dir of path.split(delimiter).filter(isAbsolute)) {
 		const candidate = join(dir, name);
@@ -77,42 +90,19 @@ export function resolveVerificationCommand(root: string, command: VerificationCo
 	insideVerificationRoot(root, resolve(root, command.cwd));
 	const entry = identity(command.executable.startsWith("./")
 		? insideVerificationRoot(root, resolve(root, command.executable)) : toolPath(command.executable, path));
-	const prefix = readFileSync(entry.path).subarray(0, 512).toString("utf8");
-	let interpreter: ExecutableIdentity | null = null;
-	let interpreter_args: string[] = [];
-	if (prefix.startsWith("#!")) {
-		const lineEnd = prefix.indexOf("\n");
-		if (lineEnd < 0) throw new VerificationDescriptorError("verification interpreter declaration is unbounded");
-		const parts = prefix.slice(2, lineEnd).trim().split(/\s+/);
-		const name = parts.shift()!;
-		if (!isAbsolute(name)) throw new VerificationDescriptorError("verification interpreter must be absolute");
-		if (name === "/usr/bin/env" || name === "/bin/env") {
-			if (parts.length !== 1 || !/^[A-Za-z0-9_][A-Za-z0-9_.+-]*$/.test(parts[0]!))
-				throw new VerificationDescriptorError("verification interpreter resolution is ambiguous; use a direct interpreter command");
-			interpreter = identity(toolPath(parts[0]!, path));
-		} else {
-			if (parts.length > 1) throw new VerificationDescriptorError("verification interpreter arguments are ambiguous");
-			interpreter = identity(name);
-			interpreter_args = parts;
-		}
-		if (readFileSync(interpreter.path).subarray(0, 2).toString() === "#!")
-			throw new VerificationDescriptorError("verification interpreter is itself a script; resolve the host tool explicitly");
-	}
-	return { entry, interpreter, interpreter_args };
+	return { entry };
 }
 
 export function assertCommandIdentity(frozen: FrozenCommand): void {
-	for (const item of [frozen.entry, frozen.interpreter]) {
-		if (item && JSON.stringify(identity(item.invocation_path)) !== JSON.stringify(item))
-			throw new VerificationDescriptorError("verification executable identity changed");
-	}
+	if (JSON.stringify(identity(frozen.entry.invocation_path)) !== JSON.stringify(frozen.entry))
+		throw new VerificationDescriptorError("verification executable identity changed");
 }
 
 export async function runFixedVerification(
 	root: string,
 	command: VerificationCommand,
 	frozen: FrozenCommand,
-	options: { signal?: AbortSignal; home: string; path: string; _processScanner?: string; _procRoot?: string } ,
+	options: { signal?: AbortSignal; path: string; _processScanner?: string; _procRoot?: string },
 ): Promise<VerificationResult> {
 	if (options.signal?.aborted) throw new VerificationAbortedError();
 	if (process.platform === "win32") throw new VerificationDescriptorError("fixed verification process-group isolation requires a POSIX host");
@@ -129,12 +119,9 @@ export async function runFixedVerification(
 		let stdout = Buffer.alloc(0), stderr = Buffer.alloc(0), captured = 0;
 		let aborted = false, timed_out = false, output_limited = false, settled = false;
 		const processToken = randomBytes(24).toString("hex");
-		const args = frozen.interpreter
-			? [...frozen.interpreter_args, frozen.entry.path, ...command.argv] : command.argv;
-		const child = spawn(frozen.interpreter?.invocation_path ?? frozen.entry.invocation_path, args, {
+		const child = spawn(frozen.entry.invocation_path, command.argv, {
 			cwd, shell: false, detached: true,
-			env: { PATH: options.path, HOME: options.home, TMPDIR: options.home, XDG_CACHE_HOME: options.home,
-				IMM_VERIFICATION_PROCESS_TOKEN: processToken },
+			env: verificationEnvironment(options.path, processToken),
 			stdio: ["ignore", "pipe", "pipe"],
 		});
 		const killGroup = () => {
@@ -282,3 +269,64 @@ export function findingsDigest(findings: Array<{ id: string; kind: string; accep
 	const normalized = findings.map(f => JSON.stringify({ acceptance_id: f.acceptance_id, id: f.id, kind: f.kind, summary: f.summary }));
 	return `sha256:${createHash("sha256").update(`[${normalized.join(",")}]`).digest("hex")}`;
 }
+
+export const QA_BASELINE_PATH = "docs/agents/qa-baseline.json";
+export const QA_BASELINE_CONTRACT = "assurance_kernel/qa_baseline/v1";
+const QA_BASELINE_MAX_BYTES = 262_144;
+const QA_BASELINE_MAX_CHECKS = 16;
+
+export interface QaBaselineCheck {
+	id: string;
+	descriptor: VerificationDescriptor;
+}
+export interface QaBaseline {
+	/** Tree of the Enrollment `base_head`, the one a pre-existing failure is rerun against. */
+	tree: string;
+	checks: QaBaselineCheck[];
+}
+
+function baselineGit(root: string, args: string[]): string {
+	const env: Record<string, string> = {};
+	for (const [name, value] of Object.entries(process.env))
+		if (value !== undefined && !GIT_REPOSITORY_BINDINGS.has(name)) env[name] = value;
+	return execFileSync("git", ["-C", root, ...args], {
+		encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: QA_BASELINE_MAX_BYTES * 2,
+		env: { ...env, GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0" },
+	});
+}
+
+/**
+ * Read the project QA baseline from the Enrollment `base_head` tree, never from
+ * the delivery, so a task cannot weaken its own baseline. An absent file adds
+ * no checks; an unreadable commit or an invalid file fails closed.
+ */
+export function readQaBaseline(root: string, baseHead: string): QaBaseline {
+	if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(baseHead))
+		throw new VerificationDescriptorError("qa baseline base_head has an invalid identity");
+	const tree = baselineGit(root, ["rev-parse", `${baseHead}^{tree}`]).trim();
+	if (!baselineGit(root, ["ls-tree", "--name-only", tree, "--", QA_BASELINE_PATH]).trim()) return { tree, checks: [] };
+	const text = baselineGit(root, ["cat-file", "blob", `${tree}:${QA_BASELINE_PATH}`]);
+	if (Buffer.byteLength(text) > QA_BASELINE_MAX_BYTES)
+		throw new VerificationDescriptorError("qa baseline exceeds the byte bound");
+	let value: unknown;
+	try { value = JSON.parse(text); }
+	catch { throw new VerificationDescriptorError("qa baseline is not valid JSON"); }
+	if (!value || typeof value !== "object" || Array.isArray(value)
+		|| Object.keys(value).some(key => key !== "contract" && key !== "checks")
+		|| (value as { contract?: unknown }).contract !== QA_BASELINE_CONTRACT
+		|| !Array.isArray((value as { checks?: unknown }).checks)
+		|| (value as { checks: unknown[] }).checks.length > QA_BASELINE_MAX_CHECKS)
+		throw new VerificationDescriptorError("qa baseline contract is invalid");
+	const seen = new Set<string>();
+	const checks = (value as { checks: unknown[] }).checks.map((item): QaBaselineCheck => {
+		const check = item as Record<string, unknown> | null;
+		if (!check || typeof check !== "object" || Array.isArray(check)
+			|| Object.keys(check).some(key => key !== "id" && key !== "verification")
+			|| typeof check.id !== "string" || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(check.id) || seen.has(check.id)
+			|| !check.verification || typeof check.verification !== "object" || Array.isArray(check.verification))
+			throw new VerificationDescriptorError("qa baseline check is invalid");
+		seen.add(check.id);
+		return { id: check.id, descriptor: parseVerificationDescriptor(JSON.stringify(check.verification)) };
+	});
+	return { tree, checks };
+}