diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 5baf3cbd..65b530b7 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -5,7 +5,7 @@ Epiphany's ordinary organizational product path is now deployed on Yggdrasil, not merely proven in local smoke. Bifrost authorized each exact upstream release and Idunn produced successful deployment receipts for Epiphany -`b0e8b427e41138a462a8464424d37574d21a8c8d`, Bifrost +`714187812f778160882e204ea4f369423578a195`, Bifrost `225859bd7ec3339944841ebbfc67b421eb405727` with CultLib `693df0901d75cfd8e3a0a5225e270011eeddb0be`, and VoidBot `74abfed109e1d793034796e5eff1562b0aa6c8de`. @@ -24,6 +24,11 @@ Resident readiness is active and release-authenticated with `qwen3-embedding:0.6b` at 100% GPU placement on the GTX 1080; both Modeling semantic projectors point at the Ygg-local Qdrant/Ollama path. +The Epiphany release id is +`sha256-4ad609a797afbc4e7a06251463c0a52faf760880892b6fe6cb7f9ff239e4c460` +with witness +`sha256-0e4bd42640352b932af8c0395efd473dfc9e799c3020a1774fc86bc7d5f39342`. + The next proof is organizational interaction, not another deployment: use Discord to request `/epiphany status` and submit ordinary repository feedback to the Epiphany Persona, then verify only operator-safe typed projections and @@ -51,12 +56,15 @@ operator-authored. `gamecult-authority-backup.timer` now seals one validated, SHA-256-addressed, root-only recovery archive daily with 14-day retention. The exact Epiphany, -Idunn, Bifrost, and VoidBot state writers are briefly frozen or paused while -the archive is opened. Missing writers fail the run, and publication is refused +Bifrost, and VoidBot state writers are briefly frozen or paused while the +archive is opened. Idunn is deliberately not frozen: live proof showed +freeze/thaw leaves its process alive while killing its RUDP receiver. Missing +writers fail the run, and publication is refused unless every quiesced writer is confirmed active and thawed/unpaused. Strict -snapshot `20260719T170438Z` passed checksum and tar traversal, contains Bifrost release -authority plus Idunn state/config/provenance, and all writers were active and -unpaused afterward. The earlier incomplete snapshot was deleted. Release +snapshot `20260719T173400Z` passed checksum and tar traversal while Idunn kept +accepting provider health. It contains Bifrost release authority plus Idunn +config/trust/provenance; Idunn's live observation/command state is excluded and +reconstructed from providers after restore. Older unsafe snapshots were deleted. Release trees, logs, media, RAG/vector projections, and Qdrant remain excluded. This is local logical-corruption recovery on clean two-disk RAID1, not off-host backup. @@ -68,6 +76,13 @@ mode, and systemd reports the sealed unit/drop-in loaded with no pending reload. Verification owns no lifecycle or deployment action. The final Ygg checker requires this proof and passes with the brake engaged. +Restarting Idunn to repair the frozen RUDP nerve also proved that Docker moves +the package builder outside Idunn's systemd cgroup: the interrupted build +container survived beside the retry. The exact orphan was stopped and its +worktree removed. Ops commit `391842e` gives every future Epiphany packager a +CID file and force-removes that exact container in the actuator EXIT trap; the +installed Idunn manifest already contains the correction. + The host reports a pending reboot for installed kernel `6.8.0-136`; it still runs `6.8.0-134`. No reboot was performed or authorized. Schedule that as an explicit operator maintenance window before departure if desired; deployment diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 54c40c31..0d081c5b 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 40c6093e..659d701f 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -13,7 +13,7 @@ experiment: idunn_observation_actuation_split: "Odin commit a17b0b6 makes continuous target observation/evaluation/publication the target loop's sole authority and runs deploy/restart consequences separately under one per-target actuation reservation. Manual and automatic consequences share the reservation; automatic work is dropped rather than queued stale while occupied; durable current-request/result CAS is unchanged. Live deployment then exposed that signed Epiphany health admission read the root-owned pinned trust anchor through a writer-locking store path; the deployed successor replaces only that read with an atomic read-only snapshot. Ygg now root-seals Idunn runtime provenance for exact canonical Odin commit 15a744c826f0aa2e8cc322a6543ea8a9afcd852a, digest-pinned Rust image, build artifact, installed binary/actuator/unit/sudoers/drop-in with exact root-owned safe modes, systemd loaded-path/no-reload proof, and live PID executable. The final readiness checker requires that non-actuating proof and passes with the canonical brake engaged." release_publication_ownership: "epiphany-core/src/packaged_release.rs constructs and verifies immutable package bytes and witnesses. Application-owned store publication is distinct from Bifrost release approval and Idunn deployment: packaging proves what artifact exists; downstream applications own their typed publication, while Bifrost and Idunn own crossing and deployment consequences." verifier_read_purity: "Verifier/status reads do not acquire writer authority merely to inspect provider state. epiphany-core/src/persona_feedback_admission.rs reads a provider-owned snapshot through pull_all_read_only_snapshot without taking the provider lock. Status derives from immutable/provider snapshots; mutation locks belong only to the owning writer transaction." - unattended_yggdrasil_continuity: "Yggdrasil owns unattended continuity without Starfire. Epiphany, its operator/heartbeat/Self units, Idunn, VoidBot, Docker, WireGuard, the backup timer, and SSH socket activation are enabled at boot. Containers use restart-unless-stopped. The packaged Codex credential is a cold-start seed only: systemd cp --update=none preserves runtime-owned refreshed auth across service restarts, chmod 0600 preserves Codex's in-place refresh ability, and readiness requires canonical auth.json with private owner read/write; legacy credentials.json cannot impersonate it. A root-only daily timer requires every named Epiphany/Idunn/Bifrost/VoidBot state writer, briefly quiesces them, writes one validated SHA-256-sealed authority archive atomically under /var/backups/gamecult-authority, and refuses publication unless every writer is confirmed active and thawed/unpaused. It includes Bifrost release authority and Idunn state/config/provenance, excludes releases, logs, media, RAG/vectors, and Qdrant as derived state, retains 14 days, and has no restore actuator. The strict live snapshot is 20260719T170438Z; the earlier incomplete snapshot was deleted. RAID1 is clean. This is local logical-corruption recovery, not off-host disaster backup. Kernel 6.8.0-136 is installed while 6.8.0-134 is running; reboot remains an explicit operator action and is not authorized by deployment or verification." + unattended_yggdrasil_continuity: "Yggdrasil owns unattended continuity without Starfire. Epiphany, its operator/heartbeat/Self units, Idunn, VoidBot, Docker, WireGuard, the backup timer, and SSH socket activation are enabled at boot. Containers use restart-unless-stopped. The packaged Codex credential is a cold-start seed only: systemd cp --update=none preserves runtime-owned refreshed auth across service restarts, chmod 0600 preserves Codex's in-place refresh ability, and deployed readiness requires canonical auth.json with private owner read/write; legacy credentials.json cannot impersonate it. A root-only daily timer requires every named Epiphany/Bifrost/VoidBot state writer, briefly quiesces them, writes one validated SHA-256-sealed authority archive atomically under /var/backups/gamecult-authority, and refuses publication unless every writer is confirmed active and thawed/unpaused. Idunn is never frozen: freeze/thaw leaves its process alive but kills RUDP physiology. The archive retains Idunn config/trust/provenance while live observation/command state is reconstructed from providers and Bifrost release authority. It excludes releases, logs, media, RAG/vectors, and Qdrant as derived state, retains 14 days, and has no restore actuator. Live snapshot 20260719T173400Z passed checksum/traversal while Idunn continued accepting RUDP health; older unsafe snapshots were deleted. RAID1 is clean. This is local logical-corruption recovery, not off-host disaster backup. Kernel 6.8.0-136 is installed while 6.8.0-134 is running; reboot remains an explicit operator action and is not authorized by deployment or verification." resident_readiness_ownership: "Resident cognition readiness is a join, not one store pretending to own the organism. epiphany-core/src/resident_readiness.rs derives readiness from separately owned provider readiness, packaged release identity/witness, runtime/Verse observations, Mind state, and brake state. Each source remains authoritative for its own fact; the readiness projection is read-derived and grants no cognition or action authority." sleep_brake_semantics: "An engaged swarm brake is sleep mode, not daemon death. Resident services may remain supervised, publish liveness/health, refresh leases, and expose read-only operator sight. The brake blocks cognition launches, scheduling that creates cognitive work, Hands consequences, publication, and deployment action." swarm_brake_authority: "The only physical brake truth is the runtime-scoped CultMesh key epiphany-local/swarm-brake. Observation uses swarm-brake-status and is byte-pure; mutation uses swarm-brake-set and requires explicit engaged/released status, canonical document id epiphany/swarm-brake, actor, and reason. Legacy swarm-brake/brake commands refuse. The stable owner is epiphany.swarm-brake; command actors are provenance, not owners. Release refuses absent or foreign/legacy identity. Idunn alone may adopt an already-engaged legacy head into the canonical identity during deployment, without any released interval. Discord Sleep preserves foreign brakes; Wake releases only the exact canonical owner. Resident readiness reads the same key, and deployment admission requires brakeEngaged=true before service restart."