Index readiness review receipts

epiphany-core/src/bin/epiphany-repo-work-readiness-smoke.rs

@@ -536,6 +536,32 @@ fn run_smoke(args: Args) -> Result<Value> {
         &["swarmActionTuiRows"],
         "repo-work-readiness-review",
     )?;
+    let receipt_directory = cargo_json(
+        &manifest,
+        "epiphany-verse-query",
+        &[
+            "receipt-directory",
+            "--store",
+            path_str(&local_verse)?,
+            "--runtime-id",
+            "repo-work-readiness-smoke",
+        ],
+        &root,
+    )?;
+    require_receipt_directory_row(
+        &receipt_directory,
+        "repo-work-readiness-review",
+        "repo-work-readiness-review-repo-work-readiness",
+        "readiness-approved",
+        "present",
+    )?;
+    require_tui_row_contains(
+        &receipt_directory,
+        &["tuiRows"],
+        "repo-work-readiness-review",
+    )?;
+    require_tui_row_contains(&receipt_directory, &["tuiRows"], "artifact=present")?;
+    require_bool(&receipt_directory, &["privateStateExposed"], false)?;
 
     let summary = json!({
         "schemaVersion": "epiphany.repo_work_readiness_smoke.v0",
@@ -558,6 +584,8 @@ fn run_smoke(args: Args) -> Result<Value> {
         "gjallarLatestRepoWorkReadiness": gjallar["latestRepoWorkReadiness"],
         "gjallarRepoWorkReadinessReviewCount": gjallar["repoWorkReadinessReviewCount"],
         "gjallarLatestRepoWorkReadinessReview": gjallar["latestRepoWorkReadinessReview"],
+        "receiptDirectoryRowCount": receipt_directory["rowCount"],
+        "receiptDirectoryReadinessReviewRow": receipt_directory_row_value(&receipt_directory, "repo-work-readiness-review")?,
         "sightOnly": readiness["authority"]["sightOnly"],
         "readinessApprovalAuthorized": readiness["authority"]["readinessApprovalAuthorized"],
         "publicationAuthorized": readiness["authority"]["publicationAuthorized"],
@@ -774,6 +802,59 @@ fn require_tui_row_contains(value: &Value, path: &[&str], needle: &str) -> Resul
     }
 }
 
+fn receipt_directory_row_value<'a>(value: &'a Value, family: &str) -> Result<&'a Value> {
+    value
+        .get("rows")
+        .and_then(Value::as_array)
+        .and_then(|rows| {
+            rows.iter()
+                .find(|row| row.get("family").and_then(Value::as_str) == Some(family))
+        })
+        .ok_or_else(|| anyhow!("missing receipt-directory row {family:?}"))
+}
+
+fn require_receipt_directory_row(
+    value: &Value,
+    family: &str,
+    latest_id: &str,
+    status: &str,
+    artifact_status: &str,
+) -> Result<()> {
+    let row = receipt_directory_row_value(value, family)?;
+    let actual_latest_id = row
+        .get("latestId")
+        .and_then(Value::as_str)
+        .unwrap_or("<missing>");
+    let actual_status = row
+        .get("status")
+        .and_then(Value::as_str)
+        .unwrap_or("<missing>");
+    let actual_artifact_status = row
+        .get("artifactStatus")
+        .and_then(Value::as_str)
+        .unwrap_or("<missing>");
+    let actual_private = row
+        .get("privateStateExposed")
+        .and_then(Value::as_bool)
+        .unwrap_or(true);
+    let artifact_sha = row
+        .get("artifactSha256")
+        .and_then(Value::as_str)
+        .unwrap_or("none");
+    if actual_latest_id == latest_id
+        && actual_status == status
+        && actual_artifact_status == artifact_status
+        && artifact_sha != "none"
+        && !actual_private
+    {
+        Ok(())
+    } else {
+        Err(anyhow!(
+            "receipt-directory row {family:?} mismatch: latestId={actual_latest_id:?}, status={actual_status:?}, artifactStatus={actual_artifact_status:?}, artifactSha256={artifact_sha:?}, privateStateExposed={actual_private}"
+        ))
+    }
+}
+
 fn take_path(
     args: &mut std::iter::Peekable<impl Iterator<Item = String>>,
     flag: &str,

epiphany-core/src/bin/epiphany-verse-query.rs

@@ -129,6 +129,8 @@ const WRAPPER_BIFROST_PUBLICATION_COMMAND: &str =
 const WRAPPER_BIFROST_LEDGER_COMMAND: &str = "tools/epiphany_local_run.ps1 -Mode bifrost-ledger";
 const WRAPPER_RECEIPT_DIRECTORY_COMMAND: &str =
     "tools/epiphany_local_run.ps1 -Mode receipt-directory";
+const WRAPPER_REPO_WORK_READINESS_REVIEW_COMMAND: &str =
+    "tools/epiphany_local_run.ps1 -Mode repo-work-readiness-review";
 const DIRECT_IDUNN_DEPLOYMENT_AFTERCARE_AUDIT_COMMAND: &str = "epiphany-work deployment-aftercare-audit --workspace <repo> --local-verse-store <store> --idunn-deployment-receipt-ref latest --aftercare-audit-receipt-ref latest";
 const WRAPPER_SERVICE_TICK_COMMAND: &str = "tools/epiphany_local_run.ps1 -Mode service-tick";
 const WRAPPER_SERVICE_POLICY_DIRECTORY_COMMAND: &str =
@@ -221,7 +223,16 @@ fn run_cli() -> Result<()> {
                 &args.store,
                 args.runtime_id.clone(),
             )?;
-            let report = receipt_directory_report(&context, &lifecycle_receipts);
+            let latest_repo_work_readiness_review =
+                load_latest_epiphany_cultmesh_repo_work_readiness_review(
+                    &args.store,
+                    args.runtime_id.clone(),
+                )?;
+            let report = receipt_directory_report(
+                &context,
+                &lifecycle_receipts,
+                latest_repo_work_readiness_review.as_ref(),
+            );
             println!(
                 "{}",
                 serde_json::to_string_pretty(&json!({
@@ -2495,6 +2506,7 @@ fn run_cli() -> Result<()> {
                     &args.store,
                     args.runtime_id.clone(),
                 )?,
+                None,
             );
             if !degraded_receipt_directory.rows.iter().any(|row| {
                 row.family == "daemon-poke"
@@ -2575,6 +2587,7 @@ fn run_cli() -> Result<()> {
                     &args.store,
                     args.runtime_id.clone(),
                 )?,
+                None,
             );
             if !restored_receipt_directory.rows.iter().any(|row| {
                 row.family == "daemon-poke"
@@ -2934,7 +2947,7 @@ fn run_cli() -> Result<()> {
                 &args.store,
                 args.runtime_id.clone(),
             )?;
-            let receipt_directory = receipt_directory_report(&context, &lifecycle_receipts);
+            let receipt_directory = receipt_directory_report(&context, &lifecycle_receipts, None);
             if receipt_directory.status != "ok"
                 || receipt_directory.private_state_exposed
                 || !receipt_directory.attention_route_rows.is_empty()
@@ -3156,7 +3169,7 @@ fn run_cli() -> Result<()> {
                     &args.store,
                     args.runtime_id.clone(),
                 )?;
-                receipt_directory_report(&context, &lifecycle_receipts)
+                receipt_directory_report(&context, &lifecycle_receipts, None)
             };
             if service_overview.service_lifecycle_recommended_wrapper_mode
                 != "cluster-service-execution-audit"
@@ -7421,6 +7434,7 @@ fn load_swarm_overview_report(args: &Args) -> Result<SwarmOverviewReport> {
 fn receipt_directory_report(
     context: &EpiphanyLocalVerseContext,
     lifecycle_receipts: &[EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry],
+    latest_repo_work_readiness_review: Option<&EpiphanyCultMeshRepoWorkReadinessReviewEntry>,
 ) -> ReceiptDirectoryReport {
     let mut rows = Vec::new();
     let mut tui_rows = Vec::new();
@@ -7948,6 +7962,42 @@ fn receipt_directory_report(
                 .unwrap_or(false),
         },
     );
+    let readiness_review_artifact_ref = latest_repo_work_readiness_review
+        .map(|review| review.readiness_review_receipt_ref.clone())
+        .unwrap_or_else(|| "none".to_string());
+    let readiness_review_artifact_status =
+        operator_artifact_status(&readiness_review_artifact_ref).to_string();
+    push_receipt_directory_row(
+        &mut rows,
+        &mut tui_rows,
+        ReceiptDirectoryRow {
+            family: "repo-work-readiness-review".to_string(),
+            owner: "Maintainer/Soul/Mind/Bifrost".to_string(),
+            document_kind: "epiphany.cultmesh.repo_work_readiness_review.v0".to_string(),
+            latest_id: latest_repo_work_readiness_review
+                .map(|review| review.review_id.clone())
+                .unwrap_or_else(|| "missing".to_string()),
+            status: latest_repo_work_readiness_review
+                .map(|review| review.status.clone())
+                .unwrap_or_else(|| "missing".to_string()),
+            route: latest_repo_work_readiness_review
+                .map(|review| review.readiness_receipt_ref.clone())
+                .unwrap_or_else(|| "none".to_string()),
+            service_id: "none".to_string(),
+            service_route: "none".to_string(),
+            follow_up_command: WRAPPER_REPO_WORK_READINESS_REVIEW_COMMAND.to_string(),
+            artifact_ref: readiness_review_artifact_ref.clone(),
+            artifact_status: readiness_review_artifact_status.clone(),
+            artifact_sha256: operator_artifact_sha256(
+                &readiness_review_artifact_ref,
+                &readiness_review_artifact_status,
+            ),
+            present: latest_repo_work_readiness_review.is_some(),
+            private_state_exposed: latest_repo_work_readiness_review
+                .map(|review| review.private_state_exposed)
+                .unwrap_or(false),
+        },
+    );
     for row in service_lifecycle_receipt_directory_rows(
         lifecycle_receipts,
         context.latest_daemon_service_lifecycle_receipt.as_ref(),

notes/epiphany-repo-swarm-mvp-contract.md

@@ -1686,6 +1686,26 @@ chain through the review receipt with sixteen satisfied rows. Wrapper proof
 `tools/epiphany_local_run.ps1 -Mode repo-work-readiness-review` and prints the
 same approval boundary at the operator mouth.
 
+The readiness-review adoption receipt is now indexed by the compact receipt
+directory too. `epiphany-verse-query receipt-directory` reads the latest
+`epiphany.cultmesh.repo_work_readiness_review.v0` row from local Verse and
+publishes the `repo-work-readiness-review` family with owner
+`Maintainer/Soul/Mind/Bifrost`, status `readiness-approved`, the readiness
+receipt as route, the review receipt artifact ref/SHA-256, the follow-up wrapper
+`tools/epiphany_local_run.ps1 -Mode repo-work-readiness-review`, and
+`privateStateExposed=false`. The wrapper `receipt-directory` mode now respects
+explicit `-LocalVerseStore` / `-LocalVerseRuntimeId` read targets for this row
+while still writing operator run receipts to the operator store. Native proof
+`.epiphany-smoke\repo-work-readiness-20260621-115547` reports
+`receiptDirectoryReadinessReviewRow.family=repo-work-readiness-review`,
+`latestId=repo-work-readiness-review-repo-work-readiness`,
+`artifactStatus=present`, and SHA-256
+`ba50bce3aa2af320a71977bde9d47108154665802dd527dd30bf8c4ab28bba5e`;
+wrapper proof `local-20260621-125756-748-03710f48` prints the same row from the
+repo-local Verse target. This is public-proof indexing only: it grants no
+durable-state commit, publication, PR, merge, upstream sync, deployment, service
+lifecycle, Hands action, cross-body mutation, or private-state authority.
+
 Bifrost public-proof publication transport is now the closure after local
 proof sight. `epiphany-verse-query bifrost-public-proof --public-proof-id <id>
 --ledger-entry-id <id> --review-receipt <id> --credit-receipt <id>` selects an
@@ -1942,7 +1962,7 @@ temptation wearing clean robes.
 | Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan`, `repo-work-service-runbook`, `repo-work-service-launch`, and `repo-work-service-audit` write Idunn lifecycle receipts/artifacts for the same queue-run command and prove non-mutating launch/readiness closure. | Keep any future queue-run service install/start mutation behind Idunn and explicit elevated operator authority. |
 | Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. |
 | Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, refuses missing/tampered/non-affirmative Mind adoption proof, runs known safe-family content assertions, optionally gates on model-authored closure verdicts, can require verification output to cite declared changed paths with `--require-source-grounding`, writes Soul/Modeling/Mind receipts, admits a compact typed repo map entry into `.epiphany/state/repo-work-map.msgpack`, and mirrors that admitted fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0`. | Keep extending closure toward source-grounded semantic review and richer semantic map lenses, while preserving deterministic local closure for simple mechanical work. |
-| Repo work sight/review | `overview` emits compact proof rows, an `epiphany.repo_work_intake_consensus_readback.v0` from the accept/plan chain, and typed `epiphany.cultmesh.repo_work_overview.v0` event documents plus a latest key; `readiness` now emits `epiphany.repo_work_readiness_report.v0` and mirrors `epiphany.cultmesh.repo_work_readiness.v0` over the MVP proof rows, including Soul's safe-family planning matrix readback, Idunn repo-work service audit validation, Odin/Gjallar tool-directory validation, Bifrost/GitHub publication receipt-chain validation, and upstream-main sync receipt plus git ancestry validation while still granting no readiness approval; `readiness-review` consumes that ready sight receipt and four Maintainer/Soul/Mind/Bifrost review refs to write `epiphany.repo_work_readiness_review_receipt.v0` with readiness approval only, not action authority; the CultMesh TUI rows include compact `CONSENSUS` and `REPO-WORK-READINESS` readbacks showing Persona/public feedback ids, Imagination consensus route, public/candidate ref counts, safe family, readiness gaps, and authority denials without private payloads; `close` mirrors Mind-admitted map facts as `epiphany.cultmesh.repo_work_map_entry.v0`; Gjallar enumerates overview history, readiness rows, map rows, semantic rows, closure rows, family lens rows, path lens rows, branch lens rows, stage lens rows, gate lens rows, and public-proof rows without private-state exposure; Persona's Eve surface and Eve connection readbacks expose peer-readable gate/blocker/next-action rows; `queue-run` consumes the same overview queue for branch-local scheduler pulses. | Deepen Bifrost-first external work accounting and semantic map readback without moving action authority out of Hands/Self/Bifrost. |
+| Repo work sight/review | `overview` emits compact proof rows, an `epiphany.repo_work_intake_consensus_readback.v0` from the accept/plan chain, and typed `epiphany.cultmesh.repo_work_overview.v0` event documents plus a latest key; `readiness` now emits `epiphany.repo_work_readiness_report.v0` and mirrors `epiphany.cultmesh.repo_work_readiness.v0` over the MVP proof rows, including Soul's safe-family planning matrix readback, Idunn repo-work service audit validation, Odin/Gjallar tool-directory validation, Bifrost/GitHub publication receipt-chain validation, and upstream-main sync receipt plus git ancestry validation while still granting no readiness approval; `readiness-review` consumes that ready sight receipt and four Maintainer/Soul/Mind/Bifrost review refs to write `epiphany.repo_work_readiness_review_receipt.v0` with readiness approval only, not action authority, mirrors `epiphany.cultmesh.repo_work_readiness_review.v0`, and is indexed by `receipt-directory` as `repo-work-readiness-review` with review artifact status/SHA-256 and private-state seal; the CultMesh TUI rows include compact `CONSENSUS`, `REPO-WORK-READINESS`, and readiness-review readbacks showing Persona/public feedback ids, Imagination consensus route, public/candidate ref counts, safe family, readiness gaps, readiness approval, and authority denials without private payloads; `close` mirrors Mind-admitted map facts as `epiphany.cultmesh.repo_work_map_entry.v0`; Gjallar enumerates overview history, readiness rows, readiness-review rows, map rows, semantic rows, closure rows, family lens rows, path lens rows, branch lens rows, stage lens rows, gate lens rows, and public-proof rows without private-state exposure; Persona's Eve surface and Eve connection readbacks expose peer-readable gate/blocker/next-action rows; `queue-run` consumes the same overview queue for branch-local scheduler pulses. | Deepen Bifrost-first external work accounting and semantic map readback without moving action authority out of Hands/Self/Bifrost. |
 | Publication | `publish` routes Bifrost/GitHub receipts from closure or explicit Soul/Mind refs. | Keep publication Bifrost-owned; do not let scheduler publish. |
 | Upstream main sync | `sync` proves the published commit is contained by upstream main after explicit merge/sync authority. | Treat upstream-main sync as a required final proof for published work. |
 | Daemon survival | Idunn service lifecycle receipts and runbooks exist outside repo-work tick authority. | Preserve Idunn as lifecycle owner; repo swarm may request or inspect service state, not impersonate daemon keeping. |

notes/fresh-workspace-handoff.md

@@ -173,6 +173,7 @@ remembers doctrine; the branch remembers the blade.
 - 2026-06-21: Repo deployment handoff/readback now has first-class local wrappers. `tools/epiphany_local_run.ps1 -Mode repo-deployment-config-audit`, `-Mode repo-deployment-runbook`, and `-Mode repo-deployment-aftercare-audit` invoke the existing Rust `epiphany-work` deployment audit, operator runbook, and aftercare audit surfaces, adding compact summaries for Idunn readiness, the exact operator `git push` route, runbook SHA-256, CultMesh receipt refs, and authority denials. Wrapper proofs `local-20260621-110141-130-fa8f91d7`, `local-20260621-110200-679-a03614ce`, and `local-20260621-110219-492-c870e2da` against `.epiphany-smoke\repo-deployment-config-family-20260620-223203\repo-body` reported `ready-for-idunn-review`, `ready-for-operator-git-push`, and complete Idunn aftercare with deployment/git-push/service/Hands/private-state authority false. These wrappers do not SSH, deploy, or run `git push`; they are the operator/Idunn handoff and aftercare sight rite.
 - 2026-06-21: Repo-work readiness now includes the family-friendly safe-family planning depth row, receipt-shaped Idunn/tool-directory validation, Bifrost/GitHub publication receipt-chain validation, and upstream-main sync receipt/ancestry validation. `epiphany-work readiness` inspects `closureReview.familyAssertions.safeFamilyPlanning` from the close receipt and satisfies `safe-family-planning` only for Soul-owned `epiphany.repo_work_safe_family_planning_readback.v0` over `repo.planning_brief` with all expected candidate families, requirements, gates, matrix groups, matrix controls, closure proofs, authority denials, and private-state seal intact. It satisfies `idunn-lifecycle` only from `epiphany.repo_work_service_audit.v0` with complete Idunn-owned repo-work service proof, zero missing/failed checks, no service-manager mutation, no elevation requirement, and private-state seal; satisfies `tool-directory` only from `epiphany.cultmesh.daemon_tool_directory.v0` with nonempty globally available receipt-gated daemon tools, ready hosts, invoke command hints, and private-state seal; satisfies `bifrost-publication` only when the local publish artifact matches latest repo-local CultMesh Bifrost body-change and GitHub publication receipts; and satisfies `upstream-main-sync` only when `epiphany.repo_work_sync_receipt.v0` proves nonempty merge/sync authority receipts, matching publish/Bifrost/GitHub/Hands ids, private-state seal, and live git ancestry that the published commit is contained by the named upstream ref. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-110524` now runs the readiness proof through `repo-planning-brief` cargo, sealed Idunn/tool artifacts, real `epiphany-work publish`, disposable upstream-main merge proof, and `epiphany-work sync`, proving all sixteen rows satisfied with `status=ready`, `missingRequiredCount=0`, `syncStatus=upstream-main-synced`, and `upstreamMainSynced=true`. Wrapper proof `local-20260621-120641-609-72d32f64` prints the same no-gap row without granting readiness, scheduling, Hands, publication, deployment, service lifecycle, durable state commit, cross-body mutation, or private-state authority.
 - 2026-06-21: Repo-work readiness review/adoption now has an explicit typed gate. `epiphany-work readiness-review` consumes a ready `epiphany.repo_work_readiness_report.v0`, requires Maintainer, Soul, Mind, and Bifrost review receipt refs, refuses unless `missingRequiredCount=0` and every readiness row is satisfied, and writes `epiphany.repo_work_readiness_review_receipt.v0` with `status=readiness-approved`, `readinessApprovalAuthorized=true`, `readinessAdopted=true`, and durable-state/publication/PR/merge/upstream-sync/deployment/service/Hands/cross-body/private-state authority all false. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-111411` proves the full ready chain plus review receipt with sixteen satisfied rows. Wrapper proof `local-20260621-121829-442-d011af09` proves `tools/epiphany_local_run.ps1 -Mode repo-work-readiness-review` prints the same approval boundary at the operator mouth.
+- 2026-06-21: Repo-work readiness review/adoption is now indexed by receipt-directory for public/operator proof. `epiphany-verse-query receipt-directory` adds the `repo-work-readiness-review` row from latest `epiphany.cultmesh.repo_work_readiness_review.v0`, with owner `Maintainer/Soul/Mind/Bifrost`, route to the readiness receipt, review artifact status/SHA-256, follow-up `tools/epiphany_local_run.ps1 -Mode repo-work-readiness-review`, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-readiness-20260621-115547` reported row `latestId=repo-work-readiness-review-repo-work-readiness`, status `readiness-approved`, artifact SHA-256 `ba50bce3aa2af320a71977bde9d47108154665802dd527dd30bf8c4ab28bba5e`; wrapper proof `local-20260621-125756-748-03710f48` proved `receipt-directory` now honors explicit `-LocalVerseStore` / `-LocalVerseRuntimeId` for repo-local readback while operator receipts still write to the operator store.
 - 2026-06-20: Mind now has explicit repo-work safe-family and requested-path guards before branch-local Hands authority. `adopt --from-plan` treats unsupported plan-derived safe-family labels as refused interpreter decisions, writes `epiphany.repo_work_mind_adoption_decision.v0` with `status=refused-unsupported-safe-family`, keeps `actionItemAccepted=false` and `safeFamilyRecognized=false`, grants no Hands/durable-state/service/publication/cross-body/private-state authority, and writes no normal adoption receipt. It also compares the sorted action-item `requestedPaths` against the sorted plan action `changedPaths`; mismatches write `status=refused-requested-path-mismatch`, keep `safeFamilyRecognized=true` but `requestedPathsMatchPlan=false`, point the next gate at `imagination.replan_with_matching_requested_paths`, and grant no Hands/durable-state/service/publication/cross-body/private-state authority. Focused smokes `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425` and `.epiphany-smoke\repo-mind-path-guard-20260620-194239` prove both refusal paths; earlier positive smokes `.epiphany-smoke\repo-planning-facets-20260620-190916` and `.epiphany-smoke\closure-model-gate-20260620-190916` prove recognized planning facets and closure model gates still pass. Current remaining repo-swarm MVP organs are deeper interpreter semantics beyond adoption refusal, more useful repo-owned configuration/action families, richer closure depth, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - 2026-06-20: Mind now also refuses plan-derived repo work that is not evidence-ready. `derive-plan` embeds verification asks in the Imagination action-item receipt, `adopt --from-plan` records verification asks and planning evidence needs in `epiphany.repo_work_mind_interpretation.v0`, and empty verification asks or evidence needs write `status=refused-missing-evidence-needs` with next gate `imagination.replan_with_explicit_soul_evidence_needs`. The refusal grants no Hands, durable-state, service, publication, cross-body, or private-state authority and writes no adoption receipt. Focused proof `.epiphany-smoke\repo-mind-evidence-guard-20260620-224426` tampers both arrays empty and proves the refusal; regression `.epiphany-smoke\repo-planning-facets-20260620-224428` proves normal planning facets still close through Soul/Modeling/Mind.
 - 2026-06-20: `repo-eve-surface` is now live as repo-owned Eve/CultUI surface contract cargo. `epiphany-work derive-plan --action-family repo-eve-surface` writes `.epiphany/eve-surfaces/<item>.toml` with safe family `repo.eve_surface`, compact agent TUI and GUI lowering contracts, local/public Verse routing, Odin discovery, provider-owned surface identity, Persona/human collaboration flags, feedback routing to Imagination, and denials for renderer ownership, rendering/state/publication/service/cross-body authority, private Verse rummaging, and private-state exposure. Soul closure assertions inspect schema, family, summary, surface routing, Verse routing, CultUI contracts, collaboration route, authority seals, and private-state seal. Focused smoke `.epiphany-smoke\repo-eve-surface-family-20260620-165927` ran init -> online -> accept -> repo-eve-surface derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/eve-surfaces/repo-eve-surface-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `hasCultUiContracts=true`, `hasVerseRouting=true`, `odinDiscoverable=true`, `feedbackRoutesToImagination=true`, `rendererOwnsTruth=false`, `renderingAuthority=false`, `stateAuthority=false`, `publicationAuthority=false`, `serviceLifecycleAuthority=false`, `crossBodyMutationAuthority=false`, `privateVerseRummaging=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.

state/map.yaml

@@ -649,5 +649,5 @@ current_status:
   - `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness.
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
-  last_completed_repo_swarm_cut: Repo-work readiness review sight is now typed and visible. `epiphany-work readiness-review` still consumes a ready `epiphany.repo_work_readiness_report.v0` and requires Maintainer, Soul, Mind, and Bifrost review refs before writing `epiphany.repo_work_readiness_review_receipt.v0`; it now also mirrors approved review receipts into local Verse as `epiphany.cultmesh.repo_work_readiness_review.v0`. Gjallar/swarm-overview/triage project `REPO-WORK-READINESS-REVIEW` rows and a non-mutating `repo-work-readiness-review` action row with readiness approval true and durable-state, publication, merge, upstream-sync, deployment, service lifecycle, Hands, and private-state authority false. Native proof `.epiphany-smoke\repo-work-readiness-20260621-113714` shows `gjallarRepoWorkReadinessReviewCount=1`; wrapper proof `local-20260621-123904-738-cc48a47c` prints `repoWorkReadinessReviewRows` with `privateStateExposed=False`.
-  next_action: Continue repo-swarm MVP work from `notes/epiphany-repo-swarm-mvp-contract.md`. Useful next cuts are either a receipt-directory/public-proof projection for readiness-review if operator/public proof needs that index, deeper Bifrost-first external-work accounting if ledger/publication readback needs more cargo, another useful repo-owned safe action family if the review loop needs more cargo, or explicit elevated/operator Idunn execution proof only when the human grants that authority. Persona-to-Imagination consensus readback, Mind-owned interpreter brief cargo, safe-family planning depth and closure, Gjallar closure/readiness/readiness-review rows, Bifrost ledger accounting rows, readiness wrapper mouth, repo deployment handoff/readback wrappers, readiness deployment-aftercare closure, readiness Idunn/tool-directory receipt validation, readiness Bifrost/GitHub publication-chain validation, readiness upstream-main sync validation, and readiness review/adoption receipt validation are sealed; preserve Idunn service lifecycle ownership, Bifrost publication/upstream-main ownership, Mind durable-state admission, and existing CultMesh/Odin/Eve tool directories. Windows service install/start/deployment execution still requires explicit elevated operator authority.
+  last_completed_repo_swarm_cut: Repo-work readiness review proof is now visible in both Gjallar and receipt-directory. `epiphany-work readiness-review` consumes a ready `epiphany.repo_work_readiness_report.v0`, requires Maintainer, Soul, Mind, and Bifrost review refs, writes `epiphany.repo_work_readiness_review_receipt.v0`, and mirrors approved review receipts into local Verse as `epiphany.cultmesh.repo_work_readiness_review.v0`. Gjallar/swarm-overview/triage project `REPO-WORK-READINESS-REVIEW` rows and a non-mutating action row with readiness approval true but durable-state, publication, merge, upstream-sync, deployment, service lifecycle, Hands, and private-state authority false. `epiphany-verse-query receipt-directory` now indexes the same review as `repo-work-readiness-review` with review artifact status/SHA-256 and private-state seal, and wrapper `receipt-directory` honors explicit repo-local Verse read targets. Native proof `.epiphany-smoke\repo-work-readiness-20260621-115547` reported `latestId=repo-work-readiness-review-repo-work-readiness`, `artifactStatus=present`, SHA-256 `ba50bce3aa2af320a71977bde9d47108154665802dd527dd30bf8c4ab28bba5e`; wrapper proof `local-20260621-125756-748-03710f48` printed the row from the repo-local Verse target.
+  next_action: Continue repo-swarm MVP work from `notes/epiphany-repo-swarm-mvp-contract.md`. Useful next cuts are deeper Bifrost-first external-work accounting if ledger/publication readback needs more cargo, another useful repo-owned safe action family if needed, or explicit elevated/operator Idunn execution proof only when the human grants that authority. Persona-to-Imagination consensus readback, Mind-owned interpreter brief cargo, safe-family planning depth and closure, Gjallar closure/readiness/readiness-review rows, receipt-directory readiness-review indexing, Bifrost ledger accounting rows, readiness wrapper mouth, repo deployment handoff/readback wrappers, readiness deployment-aftercare closure, readiness Idunn/tool-directory receipt validation, readiness Bifrost/GitHub publication-chain validation, readiness upstream-main sync validation, and readiness review/adoption receipt validation are sealed; preserve Idunn service lifecycle ownership, Bifrost publication/upstream-main ownership, Mind durable-state admission, and existing CultMesh/Odin/Eve tool directories. Windows service install/start/deployment execution still requires explicit elevated operator authority.

tools/epiphany_local_run.ps1

@@ -905,7 +905,7 @@ if ($Mode -eq "receipt-directory") {
         -FilePath $verseQueryExe `
         -Arguments @(
             "receipt-directory",
-            "--store", $localVerseStore,
+            "--store", $localVerseReadStore,
             "--runtime-id", $LocalVerseRuntimeId
         ) `
         -WorkingDirectory $Root `