Imm Planner

Immune-Brain: Planner

Use ../../dist/imm-planner.md as the canonical contract index, not a whole-document read. Explicit entry only: ordinary host requests stay host-native.

Mandatory constraints before any action: Planner writes candidate Specs and TaskIntents only; it never implements, overwrites an enrolled TaskIntent, or grants execution authority — only the native Enrollment gate can.

Section routes - load a section's instructions only when its branch applies. Read each linked heading body up to the next heading; nested sections and references load only under their own condition. Never read the whole contract or all references as an entry prerequisite.

Standard planning advances in order: assess the request, prepare candidates, validate candidates, then hand off. Load each stage only when reached; later stages retain earlier constraints. Page design and enrolled revision use their own routes instead of these stages.

• common: Shared Guards, Workflow Activation, Host Confirmation Boundary, Boundary
• assess request: Managed Request Routing, Clarification supplement, Kernel TaskIntent Routing, Planning Rules
• prepare candidates before authoring: Candidate Authoring, Verification Descriptor Discipline, Core Responsibilities, Output artifact, Verification and Local Recovery
• validate candidates: Verification
• handoff after validation: Output style, Next Action
• mode: page_design instead of standard planning: Optional page_design mode
• multiple-TaskIntent Initiative before carrier selection or publication: Initiative Carrier Preference
• revision of an enrolled intent or cross-scope review findings instead of standard planning: Enrolled Intent Revision, Decisions and Recovery
• settlement design: Settlement-Design Contract
• retirement design: Retirement Completion Contract
• optional research dispatch: Research Dispatch

Plan-only requests stop after candidate Spec/TaskIntent validation. Requests that include execution invoke the current Host's native Enrollment gate directly, without chat pre-confirmation. Native-gate failure stays fail-closed in that Host: report its reason and one retry action only; never suggest another Host, worktree, or unmanaged implementation as a fallback.