GameCult/Epiphany
Archived
Watch
9
0
Fork
You've already forked Epiphany
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Map Idunn outward health authority

Browse source
This commit is contained in:
Meta Vens 2026-07-19 20:04:52 +01:00
commit 1cbb2f7f87
3 changed files with 45 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

43
notes/fresh-workspace-handoff.md
View file

@ -3494,3 +3494,46 @@ smoke. Modeling is mapping the separate move-period Discord operator nerve;
before July 22, essential status/sleep/wake/directive/review must not depend on
Starfire or improvised SSH, and Persona conversation must remain pressure
rather than Mind/Hands/release/deployment authority.
## Idunn outward managed-health authority mapped (2026-07-19)
The organizational posture is ordinary product behavior, not a special-case
experiment: Modeling persistently maps the authorized domain, Self derives
bounded pressure from that map and attributed organizational feedback,
Imagination may propose improvements and features without an instruction, and
the organization may converse with the repository Persona. Feedback remains
pressure; it cannot adopt Mind state or grant Hands, release, deployment, Wake,
or public-speech authority.
Odin commit `be8836f` closes generic signed-health ingress but deliberately
does not make the source deployable. The outward health seam must be a new
Idunn-owned statement derived from the current signed provider statement,
authenticated admission, exact root trust binding, and current deployment
lineage. Idunn signs a bounded monotonic projection with its own typed service
identity and writes only a dedicated public CultCache store. Its private
identity store and private operational/admission store remain physically
separate. A generic CultNet filtered-snapshot server serves the exact public
bytes; Odin is transport, never health authority.
Epiphany must query this surface without mutating a consumer cache, pin Idunn's
public trust anchor independently, and verify signature, strict schema,
freshness, replay order, requested daemon/contract/runtime, and exact current
release/deployment lineage locally. Both Epiphany and Bifrost projections are
required independently; one cannot mask the other. Unsigned diagnostics,
provider-signed packets, process/PID sight, coordinator readiness, and transport
success cannot fill a missing projection. Discord receives only the bounded
verified lowering.
The reusable substrate cut is: extract Epiphany's typed immutable identity
enrollment/signing machinery into CultNet with compile-time profiles; preserve
Epiphany's existing wire domains while giving Idunn a distinct profile; promote
the existing CultNet snapshot example loop into a generic read-only server.
Linux custody on Ygg is honestly only an
`os_installation_file_bound_cloneable_baseline` until a stronger protector is
added. Do not use a raw 32-byte Idunn key file or pretend the baseline is TPM
custody.
Next: finish contracts, identity, Idunn projection/publication, pure query, and
Epiphany verification; migrate both publishers and root bindings as one safe
deployment slice. Keep the canonical brake engaged and do not deploy the
partially migrated Odin source.

BIN
state/ledgers.msgpack
View file

Binary file not shown.

4
state/map.yaml
View file

@ -18,7 +18,7 @@ experiment:
sleep_brake_semantics: "An engaged swarm brake is sleep mode, not daemon death. Resident services may remain supervised, publish liveness/health, refresh leases, and expose read-only operator sight. The brake blocks cognition launches, scheduling that creates cognitive work, Hands consequences, publication, and deployment action."
swarm_brake_authority: "The only physical brake truth is the runtime-scoped CultMesh key epiphany-local/swarm-brake. Observation uses swarm-brake-status and is byte-pure; mutation uses swarm-brake-set and requires explicit engaged/released status, canonical document id epiphany/swarm-brake, actor, and reason. Legacy swarm-brake/brake commands refuse. The stable owner is epiphany.swarm-brake; command actors are provenance, not owners. Release refuses absent or foreign/legacy identity. Idunn alone may adopt an already-engaged legacy head into the canonical identity during deployment, without any released interval. Discord Sleep preserves foreign brakes; Wake releases only the exact canonical owner. Resident readiness reads the same key, and deployment admission requires brakeEngaged=true before service restart."
discord_mind_review_owner: "The typed Discord operator core routes Reviews/Review into the canonical frontier-plan Mind owner, not a parallel queue. Reviews exposes only bounded request/candidate/model/frontier identities. Exact Adopt/Refuse/Hold revalidates immutable Imagination and current RepoModel bindings; Hold/Refuse are terminal inert receipts; Adopt alone uses the existing RepoModel CAS and creates no Hands authority, Substrate grant, Persona speech, Bifrost release, or Idunn deployment. Decision provenance is typed as Mind worker or authenticated operator command/admission/packet/actor; downstream RepoModel provenance is typed as worker result or frontier-plan decision, with Option absence instead of empty sentinels. Replay time derives from immutable issuance, machine faults are not terminal refusals, CultCache v0 decision tuples decode explicitly, and signed v0 deliveries may drain only the original four commands. The v1 Epiphany/Bifrost/VoidBot chain is deployed on Yggdrasil behind an engaged canonical brake; the remaining proof is operator-safe Discord interaction, not schema or deployment work."
discord_status_truth: "The deployed Status command reads a narrow coordinator snapshot and the independently owned swarm brake. It namespaces the coordinator fields as coordinator-snapshot/<status>, coordinator-state/<status>, and coordinator-action/<action>; VoidBot labels them Coordinator snapshot and Coordinator action. It explicitly refuses to call them deployment/provider readiness and does not authenticate or compose packaged-release, resident-readiness, Idunn, or Bifrost health. Audit found no usable Idunn/Bifrost ingress: generic idunn.daemon_health.v1 is typed but unsigned, trusts self-declared publication source/transport, and has no authenticated Idunn outward projection. Odin branch codex/ygg-organizational-idunn commit be8836f now verifies generic signed health against an exact root trust binding, atomically admits statement+judgment+health under monotonic CAS, rejoins current trust on managed reads, and quarantines unsigned packets under a diagnostic-only type/key that cannot reset continuity or suppress recovery. The source is intentionally not deployed until publishers, root bindings, and Idunn's signed outward projection migrate. PID sight, generic ready strings, caller booleans, and unsigned typed health are forbidden substitutes."
discord_status_truth: "The deployed Status command reads a narrow coordinator snapshot and the independently owned swarm brake. It namespaces the coordinator fields as coordinator-snapshot/<status>, coordinator-state/<status>, and coordinator-action/<action>; VoidBot labels them Coordinator snapshot and Coordinator action. It explicitly refuses to call them deployment/provider readiness and does not authenticate or compose packaged-release, resident-readiness, Idunn, or Bifrost health. Audit found no usable Idunn/Bifrost ingress: generic idunn.daemon_health.v1 is typed but unsigned, trusts self-declared publication source/transport, and has no authenticated Idunn outward projection. Odin branch codex/ygg-organizational-idunn commit be8836f now verifies generic signed health against an exact root trust binding, atomically admits statement+judgment+health under monotonic CAS, rejoins current trust on managed reads, and quarantines unsigned packets under a diagnostic-only type/key that cannot reset continuity or suppress recovery. The outward owner map is now explicit: Idunn alone derives a bounded signed managed-health projection from the current provider statement + admission + root binding + deployment lineage; it signs with a separately stored typed service identity and writes only a dedicated public CultCache store. A generic CultNet snapshot server carries exact bytes from that public store. Epiphany pins the Idunn public trust anchor and locally verifies signature, freshness, replay monotonicity, requested daemon/contract, and release/deployment lineage before lowering bounded status to Discord. Odin transports bytes but never recreates health truth. Private Idunn state, unsigned diagnostics, PID sight, generic ready strings, caller booleans, and provider signatures cannot substitute. The source is intentionally not deployable until Epiphany and Bifrost publishers, root bindings, Idunn projection, public query, and consumer verification migrate together."
status: active
phase: phase_6_reflection_boundary
premise: >
@ -812,4 +812,4 @@ current_status:
- Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
- Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
- Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
next_action: "Run the operator-safe organizational interaction proof from Discord: request /epiphany status and submit ordinary repository feedback to the Epiphany Persona, then inspect only typed projections and receipts. Keep the canonical deployment brake engaged and do not test Wake. Verify feedback becomes attributed pressure for Self/Imagination without Mind adoption, Hands authority, Persona auto-speech, Bifrost release, or Idunn deployment. No Starfire dependency or host reboot is authorized."
next_action: "Complete the authenticated outward managed-health path before claiming deployment/provider health in Discord Status: land the generic CultNet service identity, Idunn-signed public projection, dedicated public CultCache snapshot surface, Epiphany read-only verifier, and Epiphany/Bifrost signed-health publisher migration with root-owned trust bindings. Then deploy through Bifrost/Idunn under the engaged brake and run the operator-safe Discord Status plus ordinary Persona-feedback proof. Do not test Wake or reboot the host."