Separate feedback identity and approval

epiphany-core/src/bin/epiphany-repo-consensus-brief-family-smoke.rs

@@ -212,7 +212,7 @@ fn run_smoke(args: Args) -> Result<Value> {
     require_text(&brief_text, "status = \"draft\"")?;
     require_text(&brief_text, "converged = false")?;
     require_text(&brief_text, "conflicts_remaining = true")?;
-    require_text(&brief_text, "requires_human_or_persona_review = true")?;
+    require_text(&brief_text, "requires_additional_public_feedback = true")?;
     require_text(
         &brief_text,
         "recommended_next_safe_family = \"repo.task_card\"",

epiphany-core/src/bin/epiphany-repo-deployment-request-family-smoke.rs

@@ -247,7 +247,8 @@ fn run_smoke(args: Args) -> Result<Value> {
         "aftercare_audit = \"gamecult.idunn.deployment_aftercare_audit.v0\"",
     )?;
     require_text(&request_text, "requires_deployment_script_ref = true")?;
-    require_text(&request_text, "requires_script_hash_or_review_ref = true")?;
+    require_text(&request_text, "requires_script_hash = true")?;
+    require_text(&request_text, "requires_script_review_ref = true")?;
     require_text(&request_text, "requires_host_access_policy_ref = true")?;
     require_text(&request_text, "requires_secret_policy_ref = true")?;
     require_text(&request_text, "requires_rollback_plan = true")?;

epiphany-core/src/bin/epiphany-work.rs

@@ -3086,7 +3086,7 @@ fn derive_repo_consensus_brief_plan(
         "status = \"draft\"".to_string(),
         "converged = false".to_string(),
         "conflicts_remaining = true".to_string(),
-        "requires_human_or_persona_review = true".to_string(),
+        "requires_additional_public_feedback = true".to_string(),
         format!(
             "recommended_next_safe_family = {}",
             toml_basic_string(recommended_family)
@@ -5588,7 +5588,8 @@ fn derive_repo_deployment_request_plan(
         "requires_target_environment = true".to_string(),
         "requires_git_ref_or_branch = true".to_string(),
         "requires_deployment_script_ref = true".to_string(),
-        "requires_script_hash_or_review_ref = true".to_string(),
+        "requires_script_hash = true".to_string(),
+        "requires_script_review_ref = true".to_string(),
         "requires_host_access_policy_ref = true".to_string(),
         "requires_secret_policy_ref = true".to_string(),
         "requires_rollback_plan = true".to_string(),
@@ -13750,7 +13751,8 @@ aftercare_audit = "gamecult.idunn.deployment_aftercare_audit.v0"
 requires_target_environment = true
 requires_git_ref_or_branch = true
 requires_deployment_script_ref = true
-requires_script_hash_or_review_ref = true
+requires_script_hash = true
+requires_script_review_ref = true
 requires_host_access_policy_ref = true
 requires_secret_policy_ref = true
 requires_rollback_plan = true

epiphany-core/src/bin/epiphany_work/closure_contracts/operations.rs

@@ -481,7 +481,8 @@ pub(super) struct RepoDeploymentRequestPacket {
     pub(super) requires_target_environment: bool,
     pub(super) requires_git_ref_or_branch: bool,
     pub(super) requires_deployment_script_ref: bool,
-    pub(super) requires_script_hash_or_review_ref: bool,
+    pub(super) requires_script_hash: bool,
+    pub(super) requires_script_review_ref: bool,
     pub(super) requires_host_access_policy_ref: bool,
     pub(super) requires_secret_policy_ref: bool,
     pub(super) requires_rollback_plan: bool,
@@ -548,7 +549,8 @@ impl RepoDeploymentRequest {
         value.requires_target_environment
             && value.requires_git_ref_or_branch
             && value.requires_deployment_script_ref
-            && value.requires_script_hash_or_review_ref
+            && value.requires_script_hash
+            && value.requires_script_review_ref
             && value.requires_host_access_policy_ref
             && value.requires_secret_policy_ref
             && value.requires_rollback_plan

epiphany-core/src/bin/epiphany_work/closure_contracts/preparation.rs

@@ -18,7 +18,7 @@ impl RepoConsensusBrief {
         self.consensus.status == "draft"
             && !self.consensus.converged
             && self.consensus.conflicts_remaining
-            && self.consensus.requires_human_or_persona_review
+            && self.consensus.requires_additional_public_feedback
     }
     pub(super) fn has_imagination_route(&self) -> bool {
         let i = &self.imagination;
@@ -59,7 +59,7 @@ struct RepoConsensusState {
     status: String,
     converged: bool,
     conflicts_remaining: bool,
-    requires_human_or_persona_review: bool,
+    requires_additional_public_feedback: bool,
 }
 #[derive(Debug, Deserialize)]
 struct RepoConsensusImagination {

epiphany-core/src/bin/epiphany_work/closure_contracts/preparation_tests.rs

@@ -13,7 +13,7 @@ private_state_exposed = false
 status = "draft"
 converged = false
 conflicts_remaining = true
-requires_human_or_persona_review = true
+requires_additional_public_feedback = true
 [imagination]
 role = "consensus-discovery"
 candidate_actions_non_authoritative = true

notes/conceptual-substitution-audit-2026-07-12.md

@@ -1414,3 +1414,16 @@ request named Maintainer in `required_reviewers`, then accepted
 Both now require Maintainer review explicitly. Humans and Personas may still
 supply context or pressure through their own fields, but generic human input
 cannot satisfy a Maintainer receipt or doctrine-review obligation.
+
+## Social feedback is not review; identity is not approval
+
+Consensus Brief used `requires_human_or_persona_review` to mean that an
+unconverged Imagination draft needed more public input. The field now says
+`requires_additional_public_feedback`. Human and Persona contributions remain
+social evidence; Mind adoption and Bifrost publication remain the authority
+gates.
+
+Deployment requests accepted `script_hash_or_review_ref`, treating byte
+identity and approval as interchangeable. They now require both a script hash
+and a script-review reference. The hash binds the reviewed bytes; the review
+receipt carries judgment. Neither may impersonate the other.

notes/fresh-workspace-handoff.md

@@ -523,3 +523,9 @@ the Maintainer review request and doctrine update request now require explicit
 Maintainer review, matching their receipt contracts and reviewer topology.
 Continue auditing remaining OR-shaped fields, but distinguish legitimate input
 alternatives (for example token count or cost summary) from authority gates.
+
+Two further OR substitutions are cut. Consensus drafts require additional
+public feedback rather than "human or Persona review"; Mind/Bifrost remain the
+gates. Deployment requests require both script hash and script-review ref,
+because identity and approval are distinct proofs. Continue classifying the
+remaining OR-shaped fields by what invariant each alternative actually proves.

state/map.yaml

@@ -660,4 +660,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Continue the conceptual-substitution audit beyond owner strings. Maintainer review and doctrine review now require explicit Maintainer authority; generic human context cannot substitute for the named receipt. Next classify remaining OR-shaped fields as legitimate data alternatives or authority substitutions, then inspect status/receipt/scheduler/cache projections for observation-to-consequence leakage. Keep closure's zero-substring invariant.
+  next_action: Continue the OR-field and observation-to-consequence audit. Consensus now asks for additional public feedback without granting review authority; deployment requires both script identity hash and review receipt. Classify remaining alternatives by invariant, then inspect status/receipt/scheduler/cache projections for borrowed closure or effect authority. Keep closure's zero-substring invariant.