Let autonomous promotion await thread state

epiphany-core/src/runtime_spine.rs

@@ -3887,9 +3887,10 @@ pub fn promote_autonomous_direction_options_for_modeling(
     let mut opening = runtime_spine_cache(runtime_store)?;
     opening.pull_all_backing_stores()?;
     let identity = require_identity(&opening)?;
-    let thread = opening
-        .get::<crate::EpiphanyThreadStateEntry>(crate::THREAD_STATE_KEY)?
-        .ok_or_else(|| anyhow!("autonomous proposal promotion requires thread state"))?;
+    let Some(thread) = opening.get::<crate::EpiphanyThreadStateEntry>(crate::THREAD_STATE_KEY)?
+    else {
+        return Ok(Vec::new());
+    };
     let model = opening
         .get::<crate::EpiphanyMemoryGraphEntry>(crate::MEMORY_GRAPH_KEY)?
         .ok_or_else(|| anyhow!("autonomous proposal promotion requires admitted Modeling map"))?
@@ -9399,6 +9400,32 @@ pub(crate) mod tests {
         assert!(!public_surface.contains("put_repo_frontier_plan_adoption"));
     }
 
+    #[test]
+    fn autonomous_direction_promotion_waits_for_thread_without_mutation() -> Result<()> {
+        let root = tempfile::tempdir()?;
+        let store = root.path().join("cold-autonomous-promotion.cc");
+        initialize_runtime_spine(
+            &store,
+            RuntimeSpineInitOptions {
+                runtime_id: "cold-autonomous-runtime".into(),
+                display_name: "Cold autonomous runtime".into(),
+                created_at: "2026-07-19T10:00:00Z".into(),
+            },
+        )?;
+        let before = std::fs::read(&store)?;
+        assert!(
+            promote_autonomous_direction_options_for_modeling(
+                &store,
+                "GameCult/Epiphany",
+                root.path().to_str().expect("UTF-8 workspace"),
+                "2026-07-19T10:00:01Z",
+            )?
+            .is_empty()
+        );
+        assert_eq!(std::fs::read(&store)?, before);
+        Ok(())
+    }
+
     #[test]
     fn autonomous_direction_option_is_atomically_bound_and_selected_for_modeling() -> Result<()> {
         let root = tempfile::tempdir()?;

notes/fresh-workspace-handoff.md

@@ -3198,3 +3198,30 @@ The autonomous organizational bridge is committed and pushed at `fc733675`.
 Next commit this certification state, cross only that exact successor through
 Bifrost and Idunn under the brake, then prove Persona/Discord replay and tamper
 boundaries plus Starfire-independent operation before granting any wake.
+
+## Autonomous successor refused; cold-start owner corrected (2026-07-19)
+
+Bifrost authorized and Idunn attempted exact successor
+`2d21c48d7425c3d6d692e506e1981f92991d82ac`. Idunn correctly refused final
+admission: `epiphany-swarm.service` restart-looped with `autonomous proposal
+promotion requires thread state`. The deploy process was terminated and
+rollback restored exact 36f source, active release symlink, release environment,
+supervisor, and Heartbeat. Resident Self is intentionally stopped until the
+corrected successor crosses; this prevents durable proposal pressure from
+retriggering the old binary's fault. The all-scope brake remains engaged.
+
+The fault belonged to promotion intake. Absent thread state during cold start
+means no proposal is eligible yet; it is not corrupt state. Promotion now
+returns an empty result without writing when the thread is absent. Present but
+malformed authority still fails. A focused byte-identity negative test passes,
+and the complete core library proof is 579 passed, zero failed, one ignored.
+
+Separately, `gamecult-ops` commit `584b94c` moves clone/build/package/verify
+before the service stop. Packaging failures can no longer blind the active
+body; the remaining outage begins only at canonical Body mutation/promotion.
+
+Next: commit/push this correction and state, revoke refused 2d authority,
+authorize only the corrected exact commit, install/use the ops cut, and deploy
+through Idunn under the brake. Admission requires all three units active with
+no restart growth and exact signed health. Then run the Starfire-offline
+Persona/Discord feedback rehearsal. No host reboot is authorized.

state/map.yaml

@@ -9,7 +9,7 @@ experiment:
   coordinator_grounding_loop: "Cold start is owned by one typed UserObjectiveIntake that atomically seeds thread state and refuses objective replacement; a missing checkpoint routes to Modeling rather than a fictional prepareCheckpoint actuator. Explicit local-Verse path authority flows into launch context without sibling-path inference. Eyes and Modeling receive bounded source tools. Accepted CRRC regather findings hand source gathering to Eyes instead of recursively relaunching the continuity judge. Runtime/display/coordinator reads share the canonical typed role and reorient result readers. Failed or completed-unreviewable role outputs may be explicitly superseded by a typed review receipt; JSON null is not a state patch. Provider output schema is formatting guidance only, while canonical typed ingress and Mind remain admission authority. Modeling's provider schema now describes tagged patch operations, closed node/edge/profile vocabularies, canonical node/edge fields, anchors, code refs, observations, evidence, frontier items, and Body-basis echo. Live dogfood has accepted one code-grounded Eyes result, but no current Body-grounded Modeling admission yet: the latest Modeling run used eleven source-tool rounds then failed at the provider request boundary before publishing typed output."
   modeling_admission_dogfood: "Source-grounded Modeling now completes with typed Body-basis ingress and substantial RepoModel node/edge proposals, proving the source/tool/output path. Mind first refused an ordinary Evolution patch that attempted unrequested frontier mutation, then refused a nodes/edges-only patch whose invented workspace-derived domain and Active lifecycle violated the canonical aggregate. Both were superseded through typed admission-rejection review. Modeling launch context now carries the current model revision/hash and exact existing domain ids plus legal repo lifecycles; Evolution mutates nodes/edges only and frontier mutation remains request-bound. A fresh run against the post-fix Body is still required before repository readiness can join."
   resident_direction_pressure: "Resident Self no longer invents Body drift from a current RepoModel hash. In epiphany-core/src/resident_self.rs, admitted-model-direction-consideration is emitted only for the exact current admitted model revision/hash and unique admission receipt when no terminal direction consideration exists. The request is typed and Imagination remains proposal-only. Attributed organizational feedback may add separate pressure but is not required for the resident swarm to inspect its admitted map and suggest direction."
-  autonomous_frontier_bridge: "Accepted normal product path. An immutable deployment-configured repository-domain binding joins the runtime/swarm/workspace and exact Body binding; it labels organizational jurisdiction but does not impersonate authenticated Git-remote identity. Epiphany atomically persists an Imagination direction result with its exact worker result, binds promotion to the exact worker launch/result, current admitted model receipt, runtime/thread, repository domain, and canonical Body Git root, then lets Self create one inert proposal and Modeling-selection request under preserved-authority CAS. Counterfeit companions, generic Imagination intake, alien workspaces/domains, causal time reversal, and replay substitution are refused without writes. Proposal Modeling may recommend only Imagination and carries no adopted plan; ordinary Evolution cannot mutate frontier state. The hostile full-chain proof rejects a proposal-citing Modeling result that attempts direct Hands routing, leaves the store byte-identical, and grants no Hands authority. Explicit Mind adoption remains the only route from proposal/planning into Hands. Full core proof: 578 passed, zero failed, one ignored; all binaries compile."
+  autonomous_frontier_bridge: "Accepted normal product path. An immutable deployment-configured repository-domain binding joins the runtime/swarm/workspace and exact Body binding; it labels organizational jurisdiction but does not impersonate authenticated Git-remote identity. Epiphany atomically persists an Imagination direction result with its exact worker result, binds promotion to the exact worker launch/result, current admitted model receipt, runtime/thread, repository domain, and canonical Body Git root, then lets Self create one inert proposal and Modeling-selection request under preserved-authority CAS. A missing thread is ordinary cold-start absence: promotion returns no requests and leaves the store byte-identical; contradictory present state remains fatal. Counterfeit companions, generic Imagination intake, alien workspaces/domains, causal time reversal, and replay substitution are refused without writes. Proposal Modeling may recommend only Imagination and carries no adopted plan; ordinary Evolution cannot mutate frontier state. The hostile full-chain proof rejects a proposal-citing Modeling result that attempts direct Hands routing, leaves the store byte-identical, and grants no Hands authority. Explicit Mind adoption remains the only route from proposal/planning into Hands. Full core proof: 579 passed, zero failed, one ignored; all binaries compile."
   idunn_observation_actuation_split: "Odin commit a17b0b6 makes continuous target observation/evaluation/publication the target loop's sole authority and runs deploy/restart consequences separately under one per-target actuation reservation. Manual and automatic consequences share the reservation; automatic work is dropped rather than queued stale while occupied; durable current-request/result CAS is unchanged. Live deployment then exposed that signed Epiphany health admission read the root-owned pinned trust anchor through a writer-locking store path. Odin commit 64bb679 replaces only that trust-anchor read with an atomic read-only snapshot and proves a read-only directory creates no sibling lock; 50/50 Idunn tests pass. Ygg certification awaits installation of that exact verifier and a clean braked retry."
   release_publication_ownership: "epiphany-core/src/packaged_release.rs constructs and verifies immutable package bytes and witnesses. Application-owned store publication is distinct from Bifrost release approval and Idunn deployment: packaging proves what artifact exists; downstream applications own their typed publication, while Bifrost and Idunn own crossing and deployment consequences."
   verifier_read_purity: "Verifier/status reads do not acquire writer authority merely to inspect provider state. epiphany-core/src/persona_feedback_admission.rs reads a provider-owned snapshot through pull_all_read_only_snapshot without taking the provider lock. Status derives from immutable/provider snapshots; mutation locks belong only to the owning writer transaction."
@@ -796,6 +796,7 @@ current_status:
   - Candidate `86d702002acee8321438f32fb9cf69a29a667d70` built and sealed immutable release `sha256-da19a70a7e8c0229cd59b292bf5867fd1e97fa40643ab772e918c5d49dd7ff22` with witness `sha256-62c65d813837dd4a939e941d798d0842ee5f6c77cddaa645f2c47a18b7c3ec44`. Its first package attempt lost the builder's narrow release-root ownership to a predecessor cleanup race and published nothing; the retry crossed packaging and started all three braked services. Projection and Heartbeat stayed active, but resident Self exposed a second cold-start fatal path in feedback-driven Imagination consideration (`consideration requires thread state`). The Idunn transaction was terminated through rollback; services are inactive and no deployment or active-release witness exists. The package remains immutable evidence only.
   - Feedback-driven Imagination consideration now shares the cold-runtime prerequisite semantics of admitted-model direction: absent thread state yields no request yet, preserves admitted feedback for later ingestion, and performs no write. Resident Self skips only that not-yet-constructible request and will retry it on a later pulse. The causal feedback smoke explicitly requires its fixture thread and all binaries compile. This is prerequisite absence, not feedback loss, Mind adoption, or action authority.
   - Exact state-boundary commit `36f687eaa34153a166b5860087c28f8847244823` is deployed on Yggdrasil through Bifrost authority `release:GameCult/Epiphany:refs/heads/main:36f687eaa34153a166b5860087c28f8847244823` and Idunn request `manual:redeploy:yggdrasil-epiphany:manual:redeploy:yggdrasil-epiphany:unix:1784452916`. Release `sha256-a9afe96abf5b104da3d25bf5e11b967de546c57a230fa155b3cbb98c3b176385` and witness `sha256-f6b4c68054ce9566002e46d49e8773924d3518afdd02798e1a09f1778359d3c2` passed signed active health admission and produced `deployment.env` at 2026-07-19T09:23:14Z. Idunn, supervisor, Heartbeat, and resident Self are active with zero restarts; the full typed check passes; the all-scope deployment brake remains engaged. The live proof required Odin verifier `64bb679`, which reads the root-owned pinned Epiphany identity without creating a writer lock; `/etc/gamecult/idunn/epiphany-health-identity.ccmp.lock` is absent.
+  - Successor `2d21c48d7425c3d6d692e506e1981f92991d82ac` was refused by live Yggdrasil admission. Its resident Self restart-looped because autonomous proposal promotion treated absent thread state as fatal. Idunn published failed health and did not admit the candidate. Rollback restored the exact 36f source, active release symlink, environment, supervisor, and Heartbeat; resident Self is deliberately stopped until the corrected successor is deployed so durable proposal pressure cannot retrigger the old fault. The owner-level correction makes missing thread state an inert, byte-identical no-work result while retaining errors for malformed present authority. The negative test and full 579/0/1 library proof pass. The deployment pipeline also has an ops-side cut at `gamecult-ops` commit `584b94c`: build/package/verify now precede service stop, so a packaging failure cannot blind the active body.
   - Exact successor `aa3d2330062a34145cb70b527e02fa00215eac1b` passed local proof but was revoked before deployment because live packaging repeated `Permission denied` when creating a random staging directory directly under the shared root-owned release directory. This disproved the predecessor-cleanup race hypothesis. The builder's long-lived ownership lease over `/srv/epiphany/app/releases` was the incoherent boundary; no package, service, or witness was published from this attempt.
   - Release construction is now generation-scoped. The packager creates its random staging sibling beneath the exact source-commit directory, then atomically renames to the final release id within that same directory, preserving canonical absolute witness paths. Idunn keeps the shared release root root-owned and grants `epiphany-builder` only the exact commit directory during construction; cleanup removes only nested staging and seals that generation root-owned. Candidate `03e1afd24546a7ca37e900c47ca26ae257b14161` proved this boundary by sealing immutable release `sha256-fe7f25ff60d84ae9316d7b4aa2833bd5d1b65189c9d08cc64e903a83d8f35268`; its first app publication could not traverse the still builder-owned 0750 generation parent. Cleanup sealed the parent and an automatic exact-package retry started all three services. The actuator must seal the exact generation parent root-owned 0755 before app-owned publication, not only during cleanup.
   - Candidate `03e1afd24546a7ca37e900c47ca26ae257b14161` was not deployed. Projection and Heartbeat were healthy and braked, but resident Self opened the shared resident store as if every row belonged to its schema catalog and rejected the legitimate `epiphany.resident_cognition.provider_readiness` row. The exact process group was terminated, all three services were stopped, `active-release.env` was removed, and no deployment witness exists. Resident Self now constructs an owner-filtered typed view from raw envelopes, admits only its six owned document families, rejects duplicate owned identities, and preserves foreign readiness rows during writes. Full core proof passes 572/572 with one ignored.
@@ -805,4 +806,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "Treat deployed braked 36f as the certified resident baseline. Autonomous organizational bridge commit fc733675 is pushed and locally proved: Modeling map -> exact direction result -> Imagination proposal -> Self selection -> proposal-bounded Modeling -> Imagination planning -> explicit Mind adoption -> Hands. Commit this live certification state, authorize only that exact successor through Bifrost, and let Idunn deploy it under the still-engaged all-scope brake. Then prove Persona/Discord organizational feedback replay/tamper boundaries and Starfire-independent Discord operation before any wake grant. Conversation/proposal alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."
+  next_action: "Commit and push the cold-start promotion correction plus this failure evidence. Revoke the refused 2d Bifrost authority, authorize only the corrected exact successor, install/use the ops deployment cut at 584b94c, and let Idunn deploy under the still-engaged all-scope brake. Require all three services to remain active with zero restart growth and exact signed health before calling the resident body restored. Then run the Starfire-offline Persona/Discord organizational-feedback rehearsal. Conversation/proposal alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."