diff --git a/epiphany-core/src/bin/epiphany-repo-work-readiness-smoke.rs b/epiphany-core/src/bin/epiphany-repo-work-readiness-smoke.rs index f5ebb215..c4be225d 100644 --- a/epiphany-core/src/bin/epiphany-repo-work-readiness-smoke.rs +++ b/epiphany-core/src/bin/epiphany-repo-work-readiness-smoke.rs @@ -536,6 +536,32 @@ fn run_smoke(args: Args) -> Result { &["swarmActionTuiRows"], "repo-work-readiness-review", )?; + let receipt_directory = cargo_json( + &manifest, + "epiphany-verse-query", + &[ + "receipt-directory", + "--store", + path_str(&local_verse)?, + "--runtime-id", + "repo-work-readiness-smoke", + ], + &root, + )?; + require_receipt_directory_row( + &receipt_directory, + "repo-work-readiness-review", + "repo-work-readiness-review-repo-work-readiness", + "readiness-approved", + "present", + )?; + require_tui_row_contains( + &receipt_directory, + &["tuiRows"], + "repo-work-readiness-review", + )?; + require_tui_row_contains(&receipt_directory, &["tuiRows"], "artifact=present")?; + require_bool(&receipt_directory, &["privateStateExposed"], false)?; let summary = json!({ "schemaVersion": "epiphany.repo_work_readiness_smoke.v0", @@ -558,6 +584,8 @@ fn run_smoke(args: Args) -> Result { "gjallarLatestRepoWorkReadiness": gjallar["latestRepoWorkReadiness"], "gjallarRepoWorkReadinessReviewCount": gjallar["repoWorkReadinessReviewCount"], "gjallarLatestRepoWorkReadinessReview": gjallar["latestRepoWorkReadinessReview"], + "receiptDirectoryRowCount": receipt_directory["rowCount"], + "receiptDirectoryReadinessReviewRow": receipt_directory_row_value(&receipt_directory, "repo-work-readiness-review")?, "sightOnly": readiness["authority"]["sightOnly"], "readinessApprovalAuthorized": readiness["authority"]["readinessApprovalAuthorized"], "publicationAuthorized": readiness["authority"]["publicationAuthorized"], @@ -774,6 +802,59 @@ fn require_tui_row_contains(value: &Value, path: &[&str], needle: &str) -> Resul } } +fn receipt_directory_row_value<'a>(value: &'a Value, family: &str) -> Result<&'a Value> { + value + .get("rows") + .and_then(Value::as_array) + .and_then(|rows| { + rows.iter() + .find(|row| row.get("family").and_then(Value::as_str) == Some(family)) + }) + .ok_or_else(|| anyhow!("missing receipt-directory row {family:?}")) +} + +fn require_receipt_directory_row( + value: &Value, + family: &str, + latest_id: &str, + status: &str, + artifact_status: &str, +) -> Result<()> { + let row = receipt_directory_row_value(value, family)?; + let actual_latest_id = row + .get("latestId") + .and_then(Value::as_str) + .unwrap_or(""); + let actual_status = row + .get("status") + .and_then(Value::as_str) + .unwrap_or(""); + let actual_artifact_status = row + .get("artifactStatus") + .and_then(Value::as_str) + .unwrap_or(""); + let actual_private = row + .get("privateStateExposed") + .and_then(Value::as_bool) + .unwrap_or(true); + let artifact_sha = row + .get("artifactSha256") + .and_then(Value::as_str) + .unwrap_or("none"); + if actual_latest_id == latest_id + && actual_status == status + && actual_artifact_status == artifact_status + && artifact_sha != "none" + && !actual_private + { + Ok(()) + } else { + Err(anyhow!( + "receipt-directory row {family:?} mismatch: latestId={actual_latest_id:?}, status={actual_status:?}, artifactStatus={actual_artifact_status:?}, artifactSha256={artifact_sha:?}, privateStateExposed={actual_private}" + )) + } +} + fn take_path( args: &mut std::iter::Peekable>, flag: &str, diff --git a/epiphany-core/src/bin/epiphany-verse-query.rs b/epiphany-core/src/bin/epiphany-verse-query.rs index 24eb1444..8aea09e4 100644 --- a/epiphany-core/src/bin/epiphany-verse-query.rs +++ b/epiphany-core/src/bin/epiphany-verse-query.rs @@ -129,6 +129,8 @@ const WRAPPER_BIFROST_PUBLICATION_COMMAND: &str = const WRAPPER_BIFROST_LEDGER_COMMAND: &str = "tools/epiphany_local_run.ps1 -Mode bifrost-ledger"; const WRAPPER_RECEIPT_DIRECTORY_COMMAND: &str = "tools/epiphany_local_run.ps1 -Mode receipt-directory"; +const WRAPPER_REPO_WORK_READINESS_REVIEW_COMMAND: &str = + "tools/epiphany_local_run.ps1 -Mode repo-work-readiness-review"; const DIRECT_IDUNN_DEPLOYMENT_AFTERCARE_AUDIT_COMMAND: &str = "epiphany-work deployment-aftercare-audit --workspace --local-verse-store --idunn-deployment-receipt-ref latest --aftercare-audit-receipt-ref latest"; const WRAPPER_SERVICE_TICK_COMMAND: &str = "tools/epiphany_local_run.ps1 -Mode service-tick"; const WRAPPER_SERVICE_POLICY_DIRECTORY_COMMAND: &str = @@ -221,7 +223,16 @@ fn run_cli() -> Result<()> { &args.store, args.runtime_id.clone(), )?; - let report = receipt_directory_report(&context, &lifecycle_receipts); + let latest_repo_work_readiness_review = + load_latest_epiphany_cultmesh_repo_work_readiness_review( + &args.store, + args.runtime_id.clone(), + )?; + let report = receipt_directory_report( + &context, + &lifecycle_receipts, + latest_repo_work_readiness_review.as_ref(), + ); println!( "{}", serde_json::to_string_pretty(&json!({ @@ -2495,6 +2506,7 @@ fn run_cli() -> Result<()> { &args.store, args.runtime_id.clone(), )?, + None, ); if !degraded_receipt_directory.rows.iter().any(|row| { row.family == "daemon-poke" @@ -2575,6 +2587,7 @@ fn run_cli() -> Result<()> { &args.store, args.runtime_id.clone(), )?, + None, ); if !restored_receipt_directory.rows.iter().any(|row| { row.family == "daemon-poke" @@ -2934,7 +2947,7 @@ fn run_cli() -> Result<()> { &args.store, args.runtime_id.clone(), )?; - let receipt_directory = receipt_directory_report(&context, &lifecycle_receipts); + let receipt_directory = receipt_directory_report(&context, &lifecycle_receipts, None); if receipt_directory.status != "ok" || receipt_directory.private_state_exposed || !receipt_directory.attention_route_rows.is_empty() @@ -3156,7 +3169,7 @@ fn run_cli() -> Result<()> { &args.store, args.runtime_id.clone(), )?; - receipt_directory_report(&context, &lifecycle_receipts) + receipt_directory_report(&context, &lifecycle_receipts, None) }; if service_overview.service_lifecycle_recommended_wrapper_mode != "cluster-service-execution-audit" @@ -7421,6 +7434,7 @@ fn load_swarm_overview_report(args: &Args) -> Result { fn receipt_directory_report( context: &EpiphanyLocalVerseContext, lifecycle_receipts: &[EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry], + latest_repo_work_readiness_review: Option<&EpiphanyCultMeshRepoWorkReadinessReviewEntry>, ) -> ReceiptDirectoryReport { let mut rows = Vec::new(); let mut tui_rows = Vec::new(); @@ -7948,6 +7962,42 @@ fn receipt_directory_report( .unwrap_or(false), }, ); + let readiness_review_artifact_ref = latest_repo_work_readiness_review + .map(|review| review.readiness_review_receipt_ref.clone()) + .unwrap_or_else(|| "none".to_string()); + let readiness_review_artifact_status = + operator_artifact_status(&readiness_review_artifact_ref).to_string(); + push_receipt_directory_row( + &mut rows, + &mut tui_rows, + ReceiptDirectoryRow { + family: "repo-work-readiness-review".to_string(), + owner: "Maintainer/Soul/Mind/Bifrost".to_string(), + document_kind: "epiphany.cultmesh.repo_work_readiness_review.v0".to_string(), + latest_id: latest_repo_work_readiness_review + .map(|review| review.review_id.clone()) + .unwrap_or_else(|| "missing".to_string()), + status: latest_repo_work_readiness_review + .map(|review| review.status.clone()) + .unwrap_or_else(|| "missing".to_string()), + route: latest_repo_work_readiness_review + .map(|review| review.readiness_receipt_ref.clone()) + .unwrap_or_else(|| "none".to_string()), + service_id: "none".to_string(), + service_route: "none".to_string(), + follow_up_command: WRAPPER_REPO_WORK_READINESS_REVIEW_COMMAND.to_string(), + artifact_ref: readiness_review_artifact_ref.clone(), + artifact_status: readiness_review_artifact_status.clone(), + artifact_sha256: operator_artifact_sha256( + &readiness_review_artifact_ref, + &readiness_review_artifact_status, + ), + present: latest_repo_work_readiness_review.is_some(), + private_state_exposed: latest_repo_work_readiness_review + .map(|review| review.private_state_exposed) + .unwrap_or(false), + }, + ); for row in service_lifecycle_receipt_directory_rows( lifecycle_receipts, context.latest_daemon_service_lifecycle_receipt.as_ref(), diff --git a/notes/epiphany-repo-swarm-mvp-contract.md b/notes/epiphany-repo-swarm-mvp-contract.md index 308197b5..1c5d8df9 100644 --- a/notes/epiphany-repo-swarm-mvp-contract.md +++ b/notes/epiphany-repo-swarm-mvp-contract.md @@ -1686,6 +1686,26 @@ chain through the review receipt with sixteen satisfied rows. Wrapper proof `tools/epiphany_local_run.ps1 -Mode repo-work-readiness-review` and prints the same approval boundary at the operator mouth. +The readiness-review adoption receipt is now indexed by the compact receipt +directory too. `epiphany-verse-query receipt-directory` reads the latest +`epiphany.cultmesh.repo_work_readiness_review.v0` row from local Verse and +publishes the `repo-work-readiness-review` family with owner +`Maintainer/Soul/Mind/Bifrost`, status `readiness-approved`, the readiness +receipt as route, the review receipt artifact ref/SHA-256, the follow-up wrapper +`tools/epiphany_local_run.ps1 -Mode repo-work-readiness-review`, and +`privateStateExposed=false`. The wrapper `receipt-directory` mode now respects +explicit `-LocalVerseStore` / `-LocalVerseRuntimeId` read targets for this row +while still writing operator run receipts to the operator store. Native proof +`.epiphany-smoke\repo-work-readiness-20260621-115547` reports +`receiptDirectoryReadinessReviewRow.family=repo-work-readiness-review`, +`latestId=repo-work-readiness-review-repo-work-readiness`, +`artifactStatus=present`, and SHA-256 +`ba50bce3aa2af320a71977bde9d47108154665802dd527dd30bf8c4ab28bba5e`; +wrapper proof `local-20260621-125756-748-03710f48` prints the same row from the +repo-local Verse target. This is public-proof indexing only: it grants no +durable-state commit, publication, PR, merge, upstream sync, deployment, service +lifecycle, Hands action, cross-body mutation, or private-state authority. + Bifrost public-proof publication transport is now the closure after local proof sight. `epiphany-verse-query bifrost-public-proof --public-proof-id --ledger-entry-id --review-receipt --credit-receipt ` selects an @@ -1942,7 +1962,7 @@ temptation wearing clean robes. | Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan`, `repo-work-service-runbook`, `repo-work-service-launch`, and `repo-work-service-audit` write Idunn lifecycle receipts/artifacts for the same queue-run command and prove non-mutating launch/readiness closure. | Keep any future queue-run service install/start mutation behind Idunn and explicit elevated operator authority. | | Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. | | Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, refuses missing/tampered/non-affirmative Mind adoption proof, runs known safe-family content assertions, optionally gates on model-authored closure verdicts, can require verification output to cite declared changed paths with `--require-source-grounding`, writes Soul/Modeling/Mind receipts, admits a compact typed repo map entry into `.epiphany/state/repo-work-map.msgpack`, and mirrors that admitted fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0`. | Keep extending closure toward source-grounded semantic review and richer semantic map lenses, while preserving deterministic local closure for simple mechanical work. | -| Repo work sight/review | `overview` emits compact proof rows, an `epiphany.repo_work_intake_consensus_readback.v0` from the accept/plan chain, and typed `epiphany.cultmesh.repo_work_overview.v0` event documents plus a latest key; `readiness` now emits `epiphany.repo_work_readiness_report.v0` and mirrors `epiphany.cultmesh.repo_work_readiness.v0` over the MVP proof rows, including Soul's safe-family planning matrix readback, Idunn repo-work service audit validation, Odin/Gjallar tool-directory validation, Bifrost/GitHub publication receipt-chain validation, and upstream-main sync receipt plus git ancestry validation while still granting no readiness approval; `readiness-review` consumes that ready sight receipt and four Maintainer/Soul/Mind/Bifrost review refs to write `epiphany.repo_work_readiness_review_receipt.v0` with readiness approval only, not action authority; the CultMesh TUI rows include compact `CONSENSUS` and `REPO-WORK-READINESS` readbacks showing Persona/public feedback ids, Imagination consensus route, public/candidate ref counts, safe family, readiness gaps, and authority denials without private payloads; `close` mirrors Mind-admitted map facts as `epiphany.cultmesh.repo_work_map_entry.v0`; Gjallar enumerates overview history, readiness rows, map rows, semantic rows, closure rows, family lens rows, path lens rows, branch lens rows, stage lens rows, gate lens rows, and public-proof rows without private-state exposure; Persona's Eve surface and Eve connection readbacks expose peer-readable gate/blocker/next-action rows; `queue-run` consumes the same overview queue for branch-local scheduler pulses. | Deepen Bifrost-first external work accounting and semantic map readback without moving action authority out of Hands/Self/Bifrost. | +| Repo work sight/review | `overview` emits compact proof rows, an `epiphany.repo_work_intake_consensus_readback.v0` from the accept/plan chain, and typed `epiphany.cultmesh.repo_work_overview.v0` event documents plus a latest key; `readiness` now emits `epiphany.repo_work_readiness_report.v0` and mirrors `epiphany.cultmesh.repo_work_readiness.v0` over the MVP proof rows, including Soul's safe-family planning matrix readback, Idunn repo-work service audit validation, Odin/Gjallar tool-directory validation, Bifrost/GitHub publication receipt-chain validation, and upstream-main sync receipt plus git ancestry validation while still granting no readiness approval; `readiness-review` consumes that ready sight receipt and four Maintainer/Soul/Mind/Bifrost review refs to write `epiphany.repo_work_readiness_review_receipt.v0` with readiness approval only, not action authority, mirrors `epiphany.cultmesh.repo_work_readiness_review.v0`, and is indexed by `receipt-directory` as `repo-work-readiness-review` with review artifact status/SHA-256 and private-state seal; the CultMesh TUI rows include compact `CONSENSUS`, `REPO-WORK-READINESS`, and readiness-review readbacks showing Persona/public feedback ids, Imagination consensus route, public/candidate ref counts, safe family, readiness gaps, readiness approval, and authority denials without private payloads; `close` mirrors Mind-admitted map facts as `epiphany.cultmesh.repo_work_map_entry.v0`; Gjallar enumerates overview history, readiness rows, readiness-review rows, map rows, semantic rows, closure rows, family lens rows, path lens rows, branch lens rows, stage lens rows, gate lens rows, and public-proof rows without private-state exposure; Persona's Eve surface and Eve connection readbacks expose peer-readable gate/blocker/next-action rows; `queue-run` consumes the same overview queue for branch-local scheduler pulses. | Deepen Bifrost-first external work accounting and semantic map readback without moving action authority out of Hands/Self/Bifrost. | | Publication | `publish` routes Bifrost/GitHub receipts from closure or explicit Soul/Mind refs. | Keep publication Bifrost-owned; do not let scheduler publish. | | Upstream main sync | `sync` proves the published commit is contained by upstream main after explicit merge/sync authority. | Treat upstream-main sync as a required final proof for published work. | | Daemon survival | Idunn service lifecycle receipts and runbooks exist outside repo-work tick authority. | Preserve Idunn as lifecycle owner; repo swarm may request or inspect service state, not impersonate daemon keeping. | diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 80d93e01..5ea563ea 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -173,6 +173,7 @@ remembers doctrine; the branch remembers the blade. - 2026-06-21: Repo deployment handoff/readback now has first-class local wrappers. `tools/epiphany_local_run.ps1 -Mode repo-deployment-config-audit`, `-Mode repo-deployment-runbook`, and `-Mode repo-deployment-aftercare-audit` invoke the existing Rust `epiphany-work` deployment audit, operator runbook, and aftercare audit surfaces, adding compact summaries for Idunn readiness, the exact operator `git push` route, runbook SHA-256, CultMesh receipt refs, and authority denials. Wrapper proofs `local-20260621-110141-130-fa8f91d7`, `local-20260621-110200-679-a03614ce`, and `local-20260621-110219-492-c870e2da` against `.epiphany-smoke\repo-deployment-config-family-20260620-223203\repo-body` reported `ready-for-idunn-review`, `ready-for-operator-git-push`, and complete Idunn aftercare with deployment/git-push/service/Hands/private-state authority false. These wrappers do not SSH, deploy, or run `git push`; they are the operator/Idunn handoff and aftercare sight rite. - 2026-06-21: Repo-work readiness now includes the family-friendly safe-family planning depth row, receipt-shaped Idunn/tool-directory validation, Bifrost/GitHub publication receipt-chain validation, and upstream-main sync receipt/ancestry validation. `epiphany-work readiness` inspects `closureReview.familyAssertions.safeFamilyPlanning` from the close receipt and satisfies `safe-family-planning` only for Soul-owned `epiphany.repo_work_safe_family_planning_readback.v0` over `repo.planning_brief` with all expected candidate families, requirements, gates, matrix groups, matrix controls, closure proofs, authority denials, and private-state seal intact. It satisfies `idunn-lifecycle` only from `epiphany.repo_work_service_audit.v0` with complete Idunn-owned repo-work service proof, zero missing/failed checks, no service-manager mutation, no elevation requirement, and private-state seal; satisfies `tool-directory` only from `epiphany.cultmesh.daemon_tool_directory.v0` with nonempty globally available receipt-gated daemon tools, ready hosts, invoke command hints, and private-state seal; satisfies `bifrost-publication` only when the local publish artifact matches latest repo-local CultMesh Bifrost body-change and GitHub publication receipts; and satisfies `upstream-main-sync` only when `epiphany.repo_work_sync_receipt.v0` proves nonempty merge/sync authority receipts, matching publish/Bifrost/GitHub/Hands ids, private-state seal, and live git ancestry that the published commit is contained by the named upstream ref. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-110524` now runs the readiness proof through `repo-planning-brief` cargo, sealed Idunn/tool artifacts, real `epiphany-work publish`, disposable upstream-main merge proof, and `epiphany-work sync`, proving all sixteen rows satisfied with `status=ready`, `missingRequiredCount=0`, `syncStatus=upstream-main-synced`, and `upstreamMainSynced=true`. Wrapper proof `local-20260621-120641-609-72d32f64` prints the same no-gap row without granting readiness, scheduling, Hands, publication, deployment, service lifecycle, durable state commit, cross-body mutation, or private-state authority. - 2026-06-21: Repo-work readiness review/adoption now has an explicit typed gate. `epiphany-work readiness-review` consumes a ready `epiphany.repo_work_readiness_report.v0`, requires Maintainer, Soul, Mind, and Bifrost review receipt refs, refuses unless `missingRequiredCount=0` and every readiness row is satisfied, and writes `epiphany.repo_work_readiness_review_receipt.v0` with `status=readiness-approved`, `readinessApprovalAuthorized=true`, `readinessAdopted=true`, and durable-state/publication/PR/merge/upstream-sync/deployment/service/Hands/cross-body/private-state authority all false. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-111411` proves the full ready chain plus review receipt with sixteen satisfied rows. Wrapper proof `local-20260621-121829-442-d011af09` proves `tools/epiphany_local_run.ps1 -Mode repo-work-readiness-review` prints the same approval boundary at the operator mouth. +- 2026-06-21: Repo-work readiness review/adoption is now indexed by receipt-directory for public/operator proof. `epiphany-verse-query receipt-directory` adds the `repo-work-readiness-review` row from latest `epiphany.cultmesh.repo_work_readiness_review.v0`, with owner `Maintainer/Soul/Mind/Bifrost`, route to the readiness receipt, review artifact status/SHA-256, follow-up `tools/epiphany_local_run.ps1 -Mode repo-work-readiness-review`, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-readiness-20260621-115547` reported row `latestId=repo-work-readiness-review-repo-work-readiness`, status `readiness-approved`, artifact SHA-256 `ba50bce3aa2af320a71977bde9d47108154665802dd527dd30bf8c4ab28bba5e`; wrapper proof `local-20260621-125756-748-03710f48` proved `receipt-directory` now honors explicit `-LocalVerseStore` / `-LocalVerseRuntimeId` for repo-local readback while operator receipts still write to the operator store. - 2026-06-20: Mind now has explicit repo-work safe-family and requested-path guards before branch-local Hands authority. `adopt --from-plan` treats unsupported plan-derived safe-family labels as refused interpreter decisions, writes `epiphany.repo_work_mind_adoption_decision.v0` with `status=refused-unsupported-safe-family`, keeps `actionItemAccepted=false` and `safeFamilyRecognized=false`, grants no Hands/durable-state/service/publication/cross-body/private-state authority, and writes no normal adoption receipt. It also compares the sorted action-item `requestedPaths` against the sorted plan action `changedPaths`; mismatches write `status=refused-requested-path-mismatch`, keep `safeFamilyRecognized=true` but `requestedPathsMatchPlan=false`, point the next gate at `imagination.replan_with_matching_requested_paths`, and grant no Hands/durable-state/service/publication/cross-body/private-state authority. Focused smokes `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425` and `.epiphany-smoke\repo-mind-path-guard-20260620-194239` prove both refusal paths; earlier positive smokes `.epiphany-smoke\repo-planning-facets-20260620-190916` and `.epiphany-smoke\closure-model-gate-20260620-190916` prove recognized planning facets and closure model gates still pass. Current remaining repo-swarm MVP organs are deeper interpreter semantics beyond adoption refusal, more useful repo-owned configuration/action families, richer closure depth, and Idunn-owned queue-run service lifecycle under explicit operator authority. - 2026-06-20: Mind now also refuses plan-derived repo work that is not evidence-ready. `derive-plan` embeds verification asks in the Imagination action-item receipt, `adopt --from-plan` records verification asks and planning evidence needs in `epiphany.repo_work_mind_interpretation.v0`, and empty verification asks or evidence needs write `status=refused-missing-evidence-needs` with next gate `imagination.replan_with_explicit_soul_evidence_needs`. The refusal grants no Hands, durable-state, service, publication, cross-body, or private-state authority and writes no adoption receipt. Focused proof `.epiphany-smoke\repo-mind-evidence-guard-20260620-224426` tampers both arrays empty and proves the refusal; regression `.epiphany-smoke\repo-planning-facets-20260620-224428` proves normal planning facets still close through Soul/Modeling/Mind. - 2026-06-20: `repo-eve-surface` is now live as repo-owned Eve/CultUI surface contract cargo. `epiphany-work derive-plan --action-family repo-eve-surface` writes `.epiphany/eve-surfaces/.toml` with safe family `repo.eve_surface`, compact agent TUI and GUI lowering contracts, local/public Verse routing, Odin discovery, provider-owned surface identity, Persona/human collaboration flags, feedback routing to Imagination, and denials for renderer ownership, rendering/state/publication/service/cross-body authority, private Verse rummaging, and private-state exposure. Soul closure assertions inspect schema, family, summary, surface routing, Verse routing, CultUI contracts, collaboration route, authority seals, and private-state seal. Focused smoke `.epiphany-smoke\repo-eve-surface-family-20260620-165927` ran init -> online -> accept -> repo-eve-surface derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/eve-surfaces/repo-eve-surface-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `hasCultUiContracts=true`, `hasVerseRouting=true`, `odinDiscoverable=true`, `feedbackRoutesToImagination=true`, `rendererOwnsTruth=false`, `renderingAuthority=false`, `stateAuthority=false`, `publicationAuthority=false`, `serviceLifecycleAuthority=false`, `crossBodyMutationAuthority=false`, `privateVerseRummaging=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 5355d147..79482afc 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index e9a89756..8a9bbb02 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -649,5 +649,5 @@ current_status: - `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness. - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. - last_completed_repo_swarm_cut: Repo-work readiness review sight is now typed and visible. `epiphany-work readiness-review` still consumes a ready `epiphany.repo_work_readiness_report.v0` and requires Maintainer, Soul, Mind, and Bifrost review refs before writing `epiphany.repo_work_readiness_review_receipt.v0`; it now also mirrors approved review receipts into local Verse as `epiphany.cultmesh.repo_work_readiness_review.v0`. Gjallar/swarm-overview/triage project `REPO-WORK-READINESS-REVIEW` rows and a non-mutating `repo-work-readiness-review` action row with readiness approval true and durable-state, publication, merge, upstream-sync, deployment, service lifecycle, Hands, and private-state authority false. Native proof `.epiphany-smoke\repo-work-readiness-20260621-113714` shows `gjallarRepoWorkReadinessReviewCount=1`; wrapper proof `local-20260621-123904-738-cc48a47c` prints `repoWorkReadinessReviewRows` with `privateStateExposed=False`. - next_action: Continue repo-swarm MVP work from `notes/epiphany-repo-swarm-mvp-contract.md`. Useful next cuts are either a receipt-directory/public-proof projection for readiness-review if operator/public proof needs that index, deeper Bifrost-first external-work accounting if ledger/publication readback needs more cargo, another useful repo-owned safe action family if the review loop needs more cargo, or explicit elevated/operator Idunn execution proof only when the human grants that authority. Persona-to-Imagination consensus readback, Mind-owned interpreter brief cargo, safe-family planning depth and closure, Gjallar closure/readiness/readiness-review rows, Bifrost ledger accounting rows, readiness wrapper mouth, repo deployment handoff/readback wrappers, readiness deployment-aftercare closure, readiness Idunn/tool-directory receipt validation, readiness Bifrost/GitHub publication-chain validation, readiness upstream-main sync validation, and readiness review/adoption receipt validation are sealed; preserve Idunn service lifecycle ownership, Bifrost publication/upstream-main ownership, Mind durable-state admission, and existing CultMesh/Odin/Eve tool directories. Windows service install/start/deployment execution still requires explicit elevated operator authority. + last_completed_repo_swarm_cut: Repo-work readiness review proof is now visible in both Gjallar and receipt-directory. `epiphany-work readiness-review` consumes a ready `epiphany.repo_work_readiness_report.v0`, requires Maintainer, Soul, Mind, and Bifrost review refs, writes `epiphany.repo_work_readiness_review_receipt.v0`, and mirrors approved review receipts into local Verse as `epiphany.cultmesh.repo_work_readiness_review.v0`. Gjallar/swarm-overview/triage project `REPO-WORK-READINESS-REVIEW` rows and a non-mutating action row with readiness approval true but durable-state, publication, merge, upstream-sync, deployment, service lifecycle, Hands, and private-state authority false. `epiphany-verse-query receipt-directory` now indexes the same review as `repo-work-readiness-review` with review artifact status/SHA-256 and private-state seal, and wrapper `receipt-directory` honors explicit repo-local Verse read targets. Native proof `.epiphany-smoke\repo-work-readiness-20260621-115547` reported `latestId=repo-work-readiness-review-repo-work-readiness`, `artifactStatus=present`, SHA-256 `ba50bce3aa2af320a71977bde9d47108154665802dd527dd30bf8c4ab28bba5e`; wrapper proof `local-20260621-125756-748-03710f48` printed the row from the repo-local Verse target. + next_action: Continue repo-swarm MVP work from `notes/epiphany-repo-swarm-mvp-contract.md`. Useful next cuts are deeper Bifrost-first external-work accounting if ledger/publication readback needs more cargo, another useful repo-owned safe action family if needed, or explicit elevated/operator Idunn execution proof only when the human grants that authority. Persona-to-Imagination consensus readback, Mind-owned interpreter brief cargo, safe-family planning depth and closure, Gjallar closure/readiness/readiness-review rows, receipt-directory readiness-review indexing, Bifrost ledger accounting rows, readiness wrapper mouth, repo deployment handoff/readback wrappers, readiness deployment-aftercare closure, readiness Idunn/tool-directory receipt validation, readiness Bifrost/GitHub publication-chain validation, readiness upstream-main sync validation, and readiness review/adoption receipt validation are sealed; preserve Idunn service lifecycle ownership, Bifrost publication/upstream-main ownership, Mind durable-state admission, and existing CultMesh/Odin/Eve tool directories. Windows service install/start/deployment execution still requires explicit elevated operator authority. diff --git a/tools/epiphany_local_run.ps1 b/tools/epiphany_local_run.ps1 index f2966e87..c2804d14 100644 --- a/tools/epiphany_local_run.ps1 +++ b/tools/epiphany_local_run.ps1 @@ -905,7 +905,7 @@ if ($Mode -eq "receipt-directory") { -FilePath $verseQueryExe ` -Arguments @( "receipt-directory", - "--store", $localVerseStore, + "--store", $localVerseReadStore, "--runtime-id", $LocalVerseRuntimeId ) ` -WorkingDirectory $Root `