immune-brain 5.3.0 → 5.5.1

package/plugins/immune-brain/runtime/kernel/validation.ts

@@ -12,6 +12,8 @@ import {
 	type FindingKind,
 	type FindingSource,
 	type FindingStatus,
+	type ReplanCause,
+	type ResidualRiskAcceptanceV1,
 	type TaskAction,
 	type ReviewAdvisoryFindingV1,
 	type TaskApprovalV2,
@@ -156,7 +158,10 @@ const FINDING_KINDS: FindingKind[] = [
 	"unresolved_user_decision",
 	"replan_required",
 ];
-const FINDING_STATUSES: FindingStatus[] = ["open", "resolved", "refuted"];
+const FINDING_STATUSES: FindingStatus[] = ["open", "resolved", "refuted", "accepted_risk"];
+const REPLAN_CAUSES: ReplanCause[] = ["budget_exhausted", "repeated_security_boundary"];
+/** Upper bound of one `authorize_rework` grant. */
+export const MAX_REWORK_GRANT_ROUNDS = 5;
 const FINDING_SOURCES: FindingSource[] = [
 	"execution",
 	"review",
@@ -240,6 +245,7 @@ export function parseFinding(
 			"anchor",
 			"evidence",
 			"counterevidence",
+			"replan_cause",
 		],
 		path,
 		violations,
@@ -267,6 +273,9 @@ export function parseFinding(
 					),
 				}
 			: {}),
+		...(item.replan_cause !== undefined
+			? { replan_cause: enumAt(item.replan_cause, REPLAN_CAUSES, `${path}.replan_cause`, violations) }
+			: {}),
 	};
 }
 
@@ -277,7 +286,7 @@ function parseHistoryV3(
 ): TaskHistoryEntryV3 {
 	const path = `record.history[${index}]`;
 	const item = objectAt(value, path, violations);
-	rejectUnknown(item, ["id", "at", "type", "from_state", "to_state", "reason", "authority"], path, violations);
+	rejectUnknown(item, ["id", "at", "type", "from_state", "to_state", "reason", "authority", "review_revision"], path, violations);
 	let authority: AuthorityAuditDescriptor | undefined;
 	if (item.authority !== undefined) {
 		const auth = objectAt(item.authority, `${path}.authority`, violations);
@@ -292,6 +301,11 @@ function parseHistoryV3(
 				: {}),
 		};
 	}
+	const reviewRevision = item.review_revision === undefined
+		? undefined
+		: parseReviewRevisionIdentity(item.review_revision, `${path}.review_revision`, violations);
+	if (reviewRevision && authority?.authority_kind !== "review")
+		violations.push(`${path}.review_revision is only valid on review-authored history`);
 	return {
 		id: stringAt(item.id, `${path}.id`, violations),
 		at: stringAt(item.at, `${path}.at`, violations),
@@ -300,6 +314,7 @@ function parseHistoryV3(
 		to_state: stringAt(item.to_state, `${path}.to_state`, violations),
 		reason: stringAt(item.reason, `${path}.reason`, violations),
 		...(authority ? { authority } : {}),
+		...(reviewRevision ? { review_revision: reviewRevision } : {}),
 	};
 }
 
@@ -488,13 +503,46 @@ function parseAttestationV3(
 	};
 }
 
+function parseResidualRiskAcceptance(
+	value: unknown,
+	path: string,
+	violations: string[],
+): ResidualRiskAcceptanceV1 {
+	const item = objectAt(value, path, violations);
+	rejectUnknown(
+		item,
+		["intent_revision", "intent_content_hash", "diff_hash", "finding_ids", "reason", "actor_id", "accepted_at"],
+		path,
+		violations,
+	);
+	const intentContentHash = stringAt(item.intent_content_hash, `${path}.intent_content_hash`, violations);
+	if (!SHA256_HEX.test(intentContentHash)) violations.push(`${path}.intent_content_hash must be sha256:<64 hex>`);
+	const diffHash = stringAt(item.diff_hash, `${path}.diff_hash`, violations);
+	if (!SHA256_HEX.test(diffHash)) violations.push(`${path}.diff_hash must be sha256:<64 hex>`);
+	const reason = stringAt(item.reason, `${path}.reason`, violations);
+	if (reason.trim() === "") violations.push(`${path}.reason must be non-empty`);
+	const findingIds = arrayAt(item.finding_ids, `${path}.finding_ids`, violations).map((entry, index) =>
+		stringAt(entry, `${path}.finding_ids[${index}]`, violations),
+	);
+	if (findingIds.length === 0) violations.push(`${path}.finding_ids must name at least one finding`);
+	return {
+		intent_revision: positiveInteger(item.intent_revision, `${path}.intent_revision`, violations),
+		intent_content_hash: intentContentHash,
+		diff_hash: diffHash,
+		finding_ids: findingIds,
+		reason,
+		actor_id: stringAt(item.actor_id, `${path}.actor_id`, violations),
+		accepted_at: stringAt(item.accepted_at, `${path}.accepted_at`, violations),
+	};
+}
+
 export function parseTaskRecordAtVersion(raw: unknown, version: 3 | 4): TaskRecordV3 | TaskRecordV4 {
 	const violations: string[] = [];
 	const value = objectAt(raw, "record", violations);
 	rejectUnknown(
 		value,
 		["contract", "task_id", "intent_snapshot", "intent_ref", "lifecycle", "artifact_state", "baseline", "attestations", "findings", "history",
-			...(version === 4 ? ["git_base_head"] : [])],
+			...(version === 4 ? ["git_base_head", "review_round_budget_extension", "residual_risk_acceptance"] : [])],
 		"record",
 		violations,
 	);
@@ -551,6 +599,28 @@ export function parseTaskRecordAtVersion(raw: unknown, version: 3 | 4): TaskReco
 	}
 	const findings = arrayAt(value.findings, "record.findings", violations).map((item, index) => parseFinding(item, index, violations));
 	const history = arrayAt(value.history, "record.history", violations).map((item, index) => parseHistoryV3(item, index, violations));
+	for (const [index, finding] of findings.entries()) {
+		const path = `record.findings[${index}]`;
+		if (finding.replan_cause !== undefined && finding.kind !== "replan_required")
+			violations.push(`${path}.replan_cause is only valid on a replan_required finding`);
+		if (finding.status === "accepted_risk" && (finding.kind !== "blocking" || finding.source !== "review"))
+			violations.push(`${path} accepted_risk requires a blocking Review finding`);
+	}
+	let budgetExtension: number | undefined;
+	if (value.review_round_budget_extension !== undefined) {
+		budgetExtension = positiveInteger(value.review_round_budget_extension, "record.review_round_budget_extension", violations);
+	}
+	const residualRiskAcceptance = value.residual_risk_acceptance === undefined
+		? undefined
+		: parseResidualRiskAcceptance(value.residual_risk_acceptance, "record.residual_risk_acceptance", violations);
+	if (findings.some((finding) => finding.status === "accepted_risk") && residualRiskAcceptance === undefined)
+		violations.push("record.residual_risk_acceptance is required while a finding is accepted_risk");
+	if (residualRiskAcceptance) {
+		for (const id of residualRiskAcceptance.finding_ids) {
+			if (!findings.some((finding) => finding.id === id && finding.status === "accepted_risk"))
+				violations.push(`record.residual_risk_acceptance.finding_ids names ${id}, which is not accepted_risk`);
+		}
+	}
 	uniqueIds(attestations, "record.attestations", violations);
 	uniqueIds(findings, "record.findings", violations);
 	uniqueIds(history, "record.history", violations);
@@ -613,6 +683,8 @@ export function parseTaskRecordAtVersion(raw: unknown, version: 3 | 4): TaskReco
 		artifact_state: artifactState as TaskRecordV3["artifact_state"],
 		baseline,
 		...(version === 4 ? { git_base_head: gitBaseHead } : {}),
+		...(version === 4 && budgetExtension !== undefined ? { review_round_budget_extension: budgetExtension } : {}),
+		...(version === 4 && residualRiskAcceptance !== undefined ? { residual_risk_acceptance: residualRiskAcceptance } : {}),
 		attestations,
 		findings,
 		history,
@@ -664,6 +736,7 @@ const ACTION_V2_TYPES = [
 	"complete",
 	"stop",
 	"authorize_rework",
+	"accept_residual_risk",
 	"resolve_user_decision",
 ] as const;
 
@@ -849,16 +922,33 @@ export function parseTaskAction(raw: unknown): TaskAction {
 			};
 			break;
 		}
-		case "complete":
-		case "authorize_rework": {
+		case "complete": {
 			rejectUnknown(value, [...ACTION_BASE_FIELDS], "action", violations);
 			action = { ...base, type: base.type };
 			break;
 		}
+		case "authorize_rework": {
+			rejectUnknown(value, [...ACTION_BASE_FIELDS, "rounds"], "action", violations);
+			let rounds: number | undefined;
+			if (value.rounds !== undefined) {
+				rounds = positiveInteger(value.rounds, "action.rounds", violations);
+				if (rounds > MAX_REWORK_GRANT_ROUNDS)
+					violations.push(`action.rounds must be an integer from 1 to ${MAX_REWORK_GRANT_ROUNDS}`);
+			}
+			action = { ...base, type: "authorize_rework", ...(rounds !== undefined ? { rounds } : {}) };
+			break;
+		}
+		case "accept_residual_risk": {
+			rejectUnknown(value, [...ACTION_BASE_FIELDS, "reason"], "action", violations);
+			const reason = stringAt(value.reason, "action.reason", violations);
+			if (reason.trim() === "") violations.push("accept_residual_risk requires a non-empty reason");
+			action = { ...base, type: "accept_residual_risk", reason };
+			break;
+		}
 		case "request_rework": {
 			rejectUnknown(
 				value,
-				[...ACTION_BASE_FIELDS, "findings"],
+				[...ACTION_BASE_FIELDS, "findings", "review_revision"],
 				"action",
 				violations,
 			);
@@ -869,7 +959,15 @@ export function parseTaskAction(raw: unknown): TaskAction {
 			).map((item, index) => parseFinding(item, index, violations));
 			if (findings.length === 0)
 				violations.push("action.findings must contain at least one finding");
-			action = { ...base, type: "request_rework", findings };
+			const reviewRevision = value.review_revision === undefined
+				? undefined
+				: parseReviewRevisionIdentity(value.review_revision, "action.review_revision", violations);
+			action = {
+				...base,
+				type: "request_rework",
+				findings,
+				...(reviewRevision ? { review_revision: reviewRevision } : {}),
+			};
 			break;
 		}
 		case "stop": {
@@ -961,6 +1059,37 @@ export function assertTaskRecordUpdateV3(
 			violations.push("only artifact transitions may change intent_ref path");
 	}
 
+	// The budget extension grows only by an authorize_rework grant, and the
+	// residual-risk acceptance changes only by accept_residual_risk.
+	const previousExtension = previous.review_round_budget_extension ?? 0;
+	const expectedExtension = previousExtension +
+		(action.type === "authorize_rework" ? (action.rounds ?? 1) : 0);
+	if ((next.review_round_budget_extension ?? 0) !== expectedExtension)
+		violations.push("review_round_budget_extension changes only by an authorize_rework grant");
+	if (action.type === "accept_residual_risk") {
+		const acceptance = next.residual_risk_acceptance;
+		const newlyAccepted = next.findings
+			.filter((item) => item.status === "accepted_risk" &&
+				previous.findings.find((prior) => prior.id === item.id)?.status !== "accepted_risk")
+			.map((item) => item.id)
+			.sort();
+		if (!acceptance)
+			violations.push("accept_residual_risk must record residual_risk_acceptance");
+		else if (
+			acceptance.diff_hash !== action.diff_hash ||
+			acceptance.intent_revision !== next.intent_snapshot.revision ||
+			acceptance.intent_content_hash !== next.intent_ref.content_hash ||
+			acceptance.reason !== action.reason ||
+			acceptance.actor_id !== action.actor_id ||
+			JSON.stringify([...acceptance.finding_ids].sort()) !== JSON.stringify(newlyAccepted)
+		)
+			violations.push("residual_risk_acceptance must bind the accepting action and the findings it accepted");
+	} else if (
+		JSON.stringify(next.residual_risk_acceptance ?? null) !==
+		JSON.stringify(previous.residual_risk_acceptance ?? null)
+	)
+		violations.push("residual_risk_acceptance changes only by accept_residual_risk");
+
 	// Attestations and history are append-only.
 	if (next.attestations.length < previous.attestations.length)
 		violations.push("attestations are append-only");
@@ -978,6 +1107,7 @@ export function assertTaskRecordUpdateV3(
 			: action.type === "resolve_user_decision"
 				? [action.finding_id]
 			: action.type === "authorize_rework" ||
+				  action.type === "accept_residual_risk" ||
 				  action.type === "approve_breaking_intent_revision"
 				? previous.findings
 					.filter((item) => item.kind === "replan_required" && item.status === "open")
@@ -1013,6 +1143,16 @@ export function assertTaskRecordUpdateV3(
 					)) &&
 				withoutFields(prior, ["status"]) === withoutFields(current, ["status"])
 			) &&
+			!(
+				// accept_residual_risk moves an open blocking Review finding to
+				// accepted_risk and changes nothing else about it.
+				action.type === "accept_residual_risk" &&
+				prior.kind === "blocking" &&
+				prior.source === "review" &&
+				prior.status === "open" &&
+				current.status === "accepted_risk" &&
+				withoutFields(prior, ["status"]) === withoutFields(current, ["status"])
+			) &&
 			!(
 				action.type === "refute_finding" &&
 				prior.id === action.finding_id &&

package/plugins/immune-brain/runtime/loop_contract.ts

@@ -56,6 +56,10 @@ export interface LoopRoute {
 export function resolveLoopRoute(input: {
 	ownership: LoopRouteOwnership;
 	target: LoopRouteTarget;
+	/**
+	 * A scope change that is not a same-directory file addition. The owner adds a
+	 * sibling file itself with `revise_intent` (ADR 0021) and stays in the Loop.
+	 */
 	scope_expansion?: boolean;
 }): LoopRoute {
 	if (input.scope_expansion) return { entry: "imm-run", next: "imm-planner" };
@@ -189,6 +193,7 @@ export function buildLoopAction(input: {
 	ownership: LoopRouteOwnership;
 	target: LoopRouteTarget;
 	context?: RoleDelegationContext;
+	/** See `resolveLoopRoute`: a same-directory file addition is not one. */
 	scope_expansion?: boolean;
 	kernel_operation?: Extract<LoopAction, { next: "imm_kernel_canary" }>["tool"]["operation"];
 }): LoopAction {

package/plugins/immune-brain/runtime/plan_core.ts

@@ -665,7 +665,7 @@ function validateSpecDesign(spec: ParsedSpecDesign | null): {
 			warnings: [
 				{
 					code: "spec_design_metadata_missing",
-					message: `${spec.path} uses the legacy design contract; add Design risk, Diagram decision, and Diagram reason when revising it.`,
+					message: `${spec.path} uses the legacy design contract; add Design risk (and Diagram decision with Diagram reason only when a diagram is required) when revising it.`,
 					field: "design_metadata",
 				},
 			],
@@ -679,13 +679,20 @@ function validateSpecDesign(spec: ParsedSpecDesign | null): {
 	if (!risk || !["low", "medium", "high"].includes(risk)) {
 		errors.push("Referenced Spec Design risk must be Low, Medium, or High.");
 	}
-	if (!decision || !["required", "not_required"].includes(decision)) {
-		errors.push(
-			"Referenced Spec Diagram decision must be required or not_required.",
-		);
-	}
-	if (!spec.diagram_reason) {
-		errors.push("Referenced Spec is missing Diagram reason.");
+	// A Spec that needs no diagram records neither diagram field; once either
+	// field is present the pair must be complete.
+	const diagramFieldsRecorded = Boolean(
+		spec.diagram_decision || spec.diagram_reason,
+	);
+	if (diagramFieldsRecorded) {
+		if (!decision || !["required", "not_required"].includes(decision)) {
+			errors.push(
+				"Referenced Spec Diagram decision must be required or not_required.",
+			);
+		}
+		if (!spec.diagram_reason) {
+			errors.push("Referenced Spec is missing Diagram reason.");
+		}
 	}
 	if (["medium", "high"].includes(risk || "") && !spec.has_technical_design) {
 		errors.push(

package/plugins/immune-brain/runtime/plugin_source_skew.ts

@@ -0,0 +1,58 @@
+// Read-only observation for working on Immune-Brain with Immune-Brain: when
+// the workspace is this plugin's own source repository but the Host loaded the
+// plugin from somewhere else (an installed package or cache), tool behavior
+// follows the loaded build, not the workspace changes. The plugin version does
+// not move during development, so the generated Claude bundle stands in for
+// the build: every runtime change regenerates it under the build parity check.
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { runningRuntimeSource } from "./kernel/runtime_contracts";
+
+const WORKSPACE_PLUGIN_DIR = join("plugins", "immune-brain");
+const PLUGIN_MANIFEST = join(".claude-plugin", "plugin.json");
+const BUILD_PROXY = join("dist", "claude", "mcp-server.mjs");
+const MAX_LEVELS = 8;
+
+export interface PluginSourceSkewWarning {
+	code: "loaded_plugin_differs_from_workspace";
+	paths: string[];
+	message: string;
+}
+
+function pluginRootAbove(dir: string): string | null {
+	let current = dir;
+	for (let level = 0; level < MAX_LEVELS; level++) {
+		if (existsSync(join(current, PLUGIN_MANIFEST))) return current;
+		const parent = dirname(current);
+		if (parent === current) return null;
+		current = parent;
+	}
+	return null;
+}
+
+function sameBuild(a: string, b: string): boolean {
+	const left = join(a, BUILD_PROXY), right = join(b, BUILD_PROXY);
+	if (!existsSync(left) || !existsSync(right)) return false;
+	if (statSync(left).size !== statSync(right).size) return false;
+	return readFileSync(left).equals(readFileSync(right));
+}
+
+/** Null unless `root` is the plugin source repository and the loaded plugin is a different, differing build. */
+export function pluginSourceSkewWarning(root: string, loadedFrom: string = runningRuntimeSource()): PluginSourceSkewWarning | null {
+	try {
+		const workspace = join(root, WORKSPACE_PLUGIN_DIR);
+		if (!existsSync(join(workspace, PLUGIN_MANIFEST))) return null;
+		const loaded = pluginRootAbove(loadedFrom);
+		if (!loaded) return null;
+		const workspaceReal = realpathSync(workspace), loadedReal = realpathSync(loaded);
+		if (workspaceReal === loadedReal || sameBuild(loadedReal, workspaceReal)) return null;
+		return {
+			code: "loaded_plugin_differs_from_workspace",
+			paths: [loadedReal, workspaceReal],
+			message: `this Host runs Immune-Brain from ${loadedReal}, whose build differs from the workspace plugin ${workspaceReal}; tools follow the loaded build, so reload the Host with the workspace plugin before relying on workspace runtime changes`,
+		};
+	} catch {
+		// An observation never blocks status.
+		return null;
+	}
+}

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -1,2 +1,2 @@
 // Generated by scripts/plugin_versioning.ts from the root package.json.
-export const PLUGIN_VERSION = "5.3.0" as const;
+export const PLUGIN_VERSION = "5.5.1" as const;

package/plugins/immune-brain/runtime/prompts/code-review.md

@@ -46,6 +46,27 @@ cite the acceptance whose principle it violates as `acceptance_id` and
 to be written into the acceptance text; a missing literal clause is not itself a
 finding and does not call for an Intent revision.
 
+## Trigger and Threat Model
+
+`evidence.trigger` must read "concrete input or state → observable wrong
+result". A finding that cannot name the wrong result is not blocking. Judge
+against the threat model and supported environment declared in the Spec or
+TaskIntent goal: a defect that needs an attacker, input source, repository
+format, encoding, or platform outside that declaration is advisory. When
+nothing is declared, assume inputs come from the repository's own tooling and
+the user's trusted workspace. `security_boundary` means a security, data-loss,
+or authority boundary the change actually crosses.
+
+From Review round 3 the manifest carries `prior_review_commit` and
+`delta_paths`: the paths the latest rework changed. Review that delta and its
+direct interactions. A blocking finding is admitted only when at least one
+`caller_chain` entry names a path in `delta_paths`, or `violated.kind` is
+`security_boundary`; an edge case that already existed in round 1 is advisory
+unless it crosses a security, data-loss, or authority boundary. A verdict that
+blocks outside the delta is rejected for resubmission. When the manifest carries
+`delta_skipped` instead, no delta exists for the round and this rule does not
+apply.
+
 ## Invariant and Evidence Coverage
 
 Judge whether the change actually closes the invariant its acceptance names,
@@ -95,7 +116,7 @@ contract: `contract`, `role`, `task_id`, `snapshot_digest`, `decision` (`pass`
 or `rework`), and for `pass` include `approval` (`kind`, `authority_role`,
 `summary`), for `rework` include `findings` (`id`, `kind`, `acceptance_id`,
 `summary`, `evidence`). Every rework finding's `evidence` must carry
-`trigger` (the concrete inputs or state that reach the defect), a non-empty
+`trigger` (the concrete input or state that reaches the defect and the observable wrong result it produces), a non-empty
 `caller_chain` (ordered repository paths or symbols), and `violated`
 (`kind`: `acceptance` or `security_boundary`, `ref`: the acceptance id or
 boundary name). Do not invent fields, and never send an anchor yourself: the
@@ -104,6 +125,9 @@ violated.ref, caller_chain}`, so an identical claim keeps one stable identity
 across review rounds while a different call chain is a different claim. A
 passing review carries no blocking findings; non-blocking notes may ride along as
 `kind: "advisory"` findings, and every finding, advisory included, needs the
-same machine-checkable evidence. If the
+same machine-checkable evidence. Advisory notes are archived on a pass and never
+become Executor work. A rework carries only `kind: "blocking"` findings, at
+least one: the coordinator rejects a rework with an advisory finding or without
+a blocking one, so submit `pass` with `inspected_paths` when nothing blocks. If the
 checkpoint is `awaiting_user_successor_decision`, stop without dispatch; only
 a literal user may invoke `--approve-successor`.

package/plugins/immune-brain/runtime/prompts/executor.md

@@ -10,23 +10,41 @@ On a batch `handoff.role=executor`, implement only its named enrolled child;
 the batch stays `running` with that child `enrolled`. Return to the Parent after
 scoped implementation, staging and focused diagnostics. Enrollment itself does
 not start QA; the Parent owns the subsequent Kernel Assurance and foreground
-Review handoff under the same still-valid batch authorization.
+Review handoff under the same still-valid batch authorization. A child settlement
+returns execution to the bound Parent; continue dependency-ready independent
+work until whole-plan integration and final verification pass. Critical and new
+repair tasks use their own native Enrollment; stopped or excluded work never
+counts as Parent success.
 
-Before handoff, run the permitted diagnostic checks, complete the Delivery
-Evidence check below and return its table to the Parent as structured diagnostic
-evidence. The read-only Loop
+Before handoff, run the permitted diagnostic checks and stage the task-owned
+changes. On rework, also complete the Delivery Evidence check below and return
+its table to the Parent as structured diagnostic evidence. The read-only Loop
 runtime action only constructs the dispatch envelope; it does not store
 evidence or change task state. Preserve failed and blocked attempts. Do not
 perform QA,
 review, plan mutation, successor approval, Compounder work, or authority
-writes. If the requested change needs scope expansion, stop and return an
-`imm-planner` route with the concrete missing scope and verification reason.
+writes. A sibling file in a directory the scope already names a file in is a
+same-directory addition: submit `revise_intent` with the complete next intent
+and continue, without a Planner route or a native gate. If the requested change
+needs scope expansion beyond that (a glob, a new directory, a removed entry, a
+path the project's risk floor names in `.imm/risk-floor.json`), stop and return an `imm-planner` route
+with the concrete missing scope and verification reason.
 
 ## Delivery Evidence
 
-Reuse the TaskIntent and any bound Spec's agreed seams and controls. Before the
-first Assurance attempt, return one compact row per acceptance; update affected
-rows after repair. This is handoff evidence, not a new artifact or approval gate.
+Prefer direct checks. For truncated display, use an explicit shell with
+`pipefail`, preserve the check's real exit status and a task-owned full log;
+display success is not check success. Keep global shell settings unchanged.
+When the Spec or user requests test-first, observe a business-assertion red
+before implementation, then the corresponding green at the same seam; missing
+modules, syntax errors or harness failures are not that red. A known omitted
+generated output blocks handoff: fix it within scope or use the existing Intent
+revision path before delivery.
+
+Reuse the TaskIntent and any bound Spec's agreed seams and controls. Return one
+compact row per violated acceptance or invariant only when handling rework; a
+first delivery needs no table. This is handoff evidence, not a new artifact or
+approval gate.
 
 | Acceptance / invariant | Entry and consumers | Positive / negative / boundary controls | Command, outcome and input | Finding coverage |
 |---|---|---|---|---|
@@ -37,6 +55,13 @@ both affected hosts and recovery/replay branches. An async, return-type or
 exception-contract change requires checking every affected caller's await,
 cancellation and error propagation.
 
+Before Assurance, run the existing tests that call a changed entry or assert
+the changed contract, found by searching the tests for its exported names,
+including tests outside `scope_hint`. Focused acceptance descriptors do not run
+them, so a stale caller test otherwise surfaces only at final verification. A
+failing caller test outside the scope is a scope gap: add it through the Intent
+revision path before delivery, never leave it for final verification.
+
 Use the real producer for the success control where available. Derive rejection
 controls from a successful state, change only the target condition, and assert
 the intended rejection reason and required side effects. A control must fail
@@ -75,7 +100,7 @@ internal return values that a public assertion already covers. Before adding a
 test, search existing tests for the same behavior and extend or parameterize
 them instead of duplicating setup. When the change retires or replaces a
 behavior, update or delete the tests that protected it within scope and name
-the retired behavior or continuing owner in Delivery Evidence.
+the retired behavior or continuing owner in the handoff.
 Treat naming, function length, parameter count, nesting, and abstraction taste
 as contextual signals, never as automatic failure thresholds.
 

package/plugins/immune-brain/runtime/unattended/batch_delegation.ts

@@ -13,6 +13,7 @@ import { projectAssurance } from "../kernel/assurance_projection";
 import { createMutationAuthorityRegistry, digestOfAction, type CapabilityBindingV2 } from "../kernel/authority_port";
 import { capabilityActionFor, createCanaryApplication } from "../kernel/canary_application";
 import { canonicalIntentHash, classifyIntentRevision, parseTaskIntentV1, readTaskIntent } from "../kernel/intent";
+import type { RiskFloor } from "../kernel/risk_floor";
 import { boundSpecPath } from "../kernel/spec_binding";
 import { readTaskRecordRaw, recoverKernelStoreFollowUps } from "../kernel/storage";
 import type { TaskIntentV1 } from "../kernel/types";
@@ -69,8 +70,8 @@ export function parseLaneRevision(value: unknown): LaneRevisionRequest | undefin
  * TaskIntent as the batch authorized it; `current` is the Lane's enrolled one.
  * Null means covered.
  */
-export function delegatedRevisionRefusal(authorized: TaskIntentV1, current: TaskIntentV1, next: TaskIntentV1): string | null {
-	if (classifyIntentRevision(current, next) !== "breaking") return "only a breaking revision needs this approval; apply a compatible one with revise_intent";
+export function delegatedRevisionRefusal(authorized: TaskIntentV1, current: TaskIntentV1, next: TaskIntentV1, floor: RiskFloor): string | null {
+	if (classifyIntentRevision(current, next, floor) !== "breaking") return "only a breaking revision needs this approval; apply a compatible one with revise_intent";
 	if (next.revision <= current.revision) return "the revision number must increase";
 	if (next.goal !== authorized.goal || next.owner !== authorized.owner || next.task_id !== authorized.task_id)
 		return "goal, owner and task identity are outside the delegation";
@@ -99,7 +100,8 @@ export function applyDelegatedIntentRevision(input: {
 	return (async () => {
 		const { lane_root: root, task_id: taskId, next_intent: nextIntent, now } = input;
 		recoverKernelStoreFollowUps(root, taskId);
-		const prior = readTaskIntent(root, taskId, readTaskRecordRaw(root, taskId).record?.intent_ref.path);
+		const record = readTaskRecordRaw(root, taskId).record;
+		const prior = readTaskIntent(root, taskId, record?.intent_ref.path, record?.intent_snapshot);
 		const before = await projectAssurance(root, taskId, taskDeliveryIdentity);
 		if (before.error || before.claim?.task_id !== taskId || before.projection.lifecycle !== "active")
 			throw new Error(`the Lane does not hold an active run of ${taskId}`);