GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Complete authenticated Epiphany operator bridge

Browse source
This commit is contained in:
Meta Vens 2026-07-19 13:12:04 +01:00
commit e0e612c69c
17 changed files with 383 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/bridge.md
View file

@ -196,9 +196,9 @@ The command is a dry-run shape probe for public surfaces that are real enough to
VoidBot remains the Discord observer and mention scheduler. A Face registry entry may opt into a remote `remotePersonaFeedbackTarget`; only then does VoidBot insert an immutable typed `voidbot.discord.persona_feedback_event.v0` observation into the dedicated `BIFROST_PERSONA_FEEDBACK_OBSERVATION_STORE_PATH`. This is an observation inbox, never an actuator queue. Insert collisions must contain exactly equal content. Its canonical path and physical file identity must differ from the outbound Discord-command provider store and all Bifrost-private state. Local Persona mention handling is committed first; observation export runs independently with three bounded idempotent attempts and cannot suppress the local response path.
Discord operator control is a separate authority. VoidBot may insert only a strict `voidbot.discord.epiphany_operator_request.v0` document containing one of `status`, `sleep`, `wake`, or `directive`, a fixed target runtime, Discord provenance, and a positive expiry of at most 60 seconds. Bifrost independently requires the exact configured Discord owner and the existing guild/actor link with a Heimdall actor reference. It derives the Rust field-order packet tuple, hashes its canonical MessagePack bytes, and signs the exact `BifrostOperatorCommandAdmission` tuple for purpose `bifrost.operator-command.delivery.v0` with a dedicated operator Ed25519 seed. The feedback seed is not reused.
Discord operator control is a separate authority. VoidBot may insert only a strict `voidbot.discord.epiphany_operator_request.v0` document containing one of `status`, `sleep`, `wake`, or `directive`, a fixed target runtime, Discord provenance, and a positive expiry of at most 60 seconds. Bifrost independently requires the exact configured Discord owner and the exact persisted guild/actor mapping from its private actor-link store. The actor link is the admitted mapping authority; its Heimdall reference remains provenance until a signed live Heimdall claim surface exists and is not represented as authorization. Bifrost derives the Rust field-order packet tuple, hashes its canonical MessagePack bytes, and signs the exact `BifrostOperatorCommandAdmission` tuple for purpose `bifrost.operator-command.delivery.v0` with a dedicated operator Ed25519 seed. The feedback seed is not reused.
Bifrost does not mount an Epiphany store and has no argv or shell escape hatch. Operator execution crosses a narrow authenticated transport port. The live CultNet RUDP request/reply adapter is still required; configuration deliberately has no localhost default. Until that adapter exists, admission fails closed. A returned `epiphany.operator_command.result.v0` must arrive under the configured Epiphany transport identity and match command id, packet digest, and target runtime. Bifrost never manufactures success. Ordinary Persona messages remain `feedback_only` and cannot enter this path.
Bifrost does not mount an Epiphany store and has no argv or shell escape hatch. One supervised worker serializes requests across the CultNet RUDP boundary and requires the trusted Epiphany executor anchor. Success requires a host-signed `epiphany.operator_command.sealed_result.v0` whose payload digest, command id, packet digest, target runtime, completion time, and executor identity verify exactly; a transport acknowledgement is not success. Admissions and sealed results are persisted in the typed Bifrost operator ledger. Permanent pre-admission refusals are separately terminalized there, while transport failures remain retryable. An expired request cannot mint a new admission, but an exact admission already durably recorded before expiry may be retransmitted to recover Epiphany's one idempotent result without depending on mutable actor-link or signer state. The worker publishes a separate immutable Discord-delivery projection bound to the original request digest and interaction id; it exposes only bounded result/refusal fields and sealed-result fingerprints, never raw signatures or private state. VoidBot reads that outbox and owns Discord response/checkpoint state. Bifrost never manufactures success. Ordinary Persona messages remain `feedback_only` and cannot enter this path.
Bifrost admits an observation only when guild, channel, target runtime, canonical repository, Persona, producer, and producer runtime match a preconfigured `bifrost.persona_feedback.target_binding.v0` document in Bifrost's private provider store. That binding also owns source visibility, data classification, and the delivery-store target. Bifrost never infers public visibility from Discord identifiers. It classifies the author using its own `bifrost.discord.actor_link.v0` state: a match yields `linked_governance_feedback`; absence yields `unlinked_social_feedback`. Neither class grants adoption, work, release, or deployment authority.

4
docs/verse-service-contract.md
View file

@ -55,7 +55,9 @@ Required witness path for the hosted service:
Bifrost publishes under these CultMesh namespaces:
The operator bridge additionally advertises `commands/epiphany-operator` and `receipts/epiphany-operator`. The command endpoint consumes strict VoidBot inbox documents and emits dedicated Bifrost-signed admissions; the receipt endpoint exposes only Epiphany-origin, command-bound results. The transport adapter is intentionally unresolved until a live authenticated CultNet RUDP request/reply implementation is installed on Yggdrasil.
The operator bridge additionally advertises `commands/epiphany-operator` and `receipts/epiphany-operator`. The command endpoint consumes strict VoidBot inbox documents and emits dedicated Bifrost-signed admissions. Bifrost sends each admission as a typed `cultnet.document_put_raw.v0` document over reliable ordered UDP and waits for the correlated application receipt; transport acknowledgement alone is never success. The receipt endpoint exposes only `epiphany.operator_command.sealed_result.v0`: an exact, bounded result whose payload digest and command, packet, runtime, completion time, and executor identity are covered by the trusted Epiphany host's Ed25519 signature. Missing, late, malformed, foreign-key, replay-colliding, or incorrectly bound results fail closed.
One supervised `tools/epiphany-operator-worker.mjs serve` process owns this route. It reads the dedicated VoidBot request inbox and Bifrost's persisted actor-link mapping, serializes commands through one RUDP client authority, and persists admissions, sealed results, and non-retryable terminal refusals in `.bifrost/epiphany-operator-ledger.cc`. It then publishes one immutable `bifrost.discord.epiphany_operator_delivery.v0` document per request to `.bifrost/epiphany-operator-discord-deliveries.cc`; Bifrost owns publication and VoidBot owns correlation plus the ephemeral Discord response. The delivery binds the original request digest and interaction coordinates to either the verified sealed-result payload/signature/provider digests or a terminal refusal code, and never contains raw signature material or private state. The exact configured Discord owner plus that persisted actor mapping are the current admission authority; any Heimdall reference on the link is provenance, not a substituted capability claim. The worker requires an explicit raw MessagePack Epiphany executor trust anchor and an explicit `rudp://` endpoint. There is no shell, argv, direct Epiphany-store, localhost, identity-string, or transport-ack fallback.
- `gamecult.bifrost.service` for service registration, health, build/version,
schema catalog, and command capability discovery.