diff --git a/epiphany-core/src/bin/epiphany-heartbeat-store.rs b/epiphany-core/src/bin/epiphany-heartbeat-store.rs index aa348e0f..f46b420f 100644 --- a/epiphany-core/src/bin/epiphany-heartbeat-store.rs +++ b/epiphany-core/src/bin/epiphany-heartbeat-store.rs @@ -699,6 +699,11 @@ fn run_smoke(agent_store: &Path) -> Result { let validation_errors = validate_agent_memory_store(&temp_agent_store)?; let status = heartbeat_status_projection(&store_path, &artifact_dir, 1.0, 8)?; + if status["status"] != "loaded" || status["schedulerStatus"] != "active" { + anyhow::bail!( + "heartbeat status must distinguish loaded state from active scheduler physiology" + ); + } let routine = run_void_routine_store( &store_path, &artifact_dir, diff --git a/epiphany-core/src/heartbeat_state/heartbeat_projection.rs b/epiphany-core/src/heartbeat_state/heartbeat_projection.rs index 318e9e23..d648780a 100644 --- a/epiphany-core/src/heartbeat_state/heartbeat_projection.rs +++ b/epiphany-core/src/heartbeat_state/heartbeat_projection.rs @@ -34,6 +34,7 @@ pub fn heartbeat_status_projection( "schema_version": HEARTBEAT_STATUS_SCHEMA_VERSION, "ok": true, "status": "missing", + "schedulerStatus": "missing", "stateFile": null, "storeFile": store_path, "cultCacheStore": cultcache_status(store_path), @@ -48,6 +49,19 @@ pub fn heartbeat_status_projection( })); }; let cognition = load_heartbeat_cognition_entry(store_path)?; + let scheduler_status = if state.participants.is_empty() { + "unconfigured" + } else if state.participants.iter().all(|participant| { + participant.status == "active" + && participant + .pending_turn + .as_ref() + .is_none_or(|turn| turn.status == "running") + }) { + "active" + } else { + "attention" + }; let history: Vec<_> = state .history .iter() @@ -62,7 +76,8 @@ pub fn heartbeat_status_projection( Ok(serde_json::json!({ "schema_version": HEARTBEAT_STATUS_SCHEMA_VERSION, "ok": true, - "status": "ready", + "status": "loaded", + "schedulerStatus": scheduler_status, "stateFile": null, "storeFile": store_path, "cultCacheStore": cultcache_status(store_path), diff --git a/notes/conceptual-substitution-audit-2026-07-12.md b/notes/conceptual-substitution-audit-2026-07-12.md index 91ce9320..a66ac3e2 100644 --- a/notes/conceptual-substitution-audit-2026-07-12.md +++ b/notes/conceptual-substitution-audit-2026-07-12.md @@ -1449,3 +1449,18 @@ cost ref or unavailable reason, review duration, and review-event count. Fields are optional on the stored v0 shape so older receipts remain readable, but missing legacy dimensions make `receiptProof=incomplete`. Receipt IDs and a free-text metrics summary can no longer counterfeit measurement completeness. + +## Readable heartbeat state is not scheduler readiness + +The heartbeat status projection returned `status=ready` whenever the state +document could be loaded. That proved storage presence and deserialization, not +that any participant was configured, active, or free of a non-running pending +turn. The cache had quietly inherited the scheduler's authority. + +The projection now reports `status=loaded` for readable state and exposes a +separate `schedulerStatus`. Missing state is `missing`; an empty participant set +is `unconfigured`; active participants whose pending turns are running are +`active`; all other loaded physiology is `attention`. The native heartbeat +smoke asserts the distinction at the emitted projection layer. State loading +owns readability. Participant physiology derives scheduler status. Presence +alone owns no readiness verdict. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 0ce56c57..b6cd68fc 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -547,3 +547,11 @@ four typed dimensions; old receipts deserialize with absent optional fields but remain incomplete. A negative projection test proves a receipt with IDs and summary but no token evidence cannot report complete proof. Continue with scheduler/cache projections that derive consequential status from presence. + +The first scheduler substitution is cut. `heartbeat_status_projection` no +longer translates a readable state document into `status=ready`. It reports +store state as `missing` or `loaded` and derives separate scheduler physiology +as `unconfigured`, `active`, or `attention` from participants and pending-turn +state. The focused library suite, all-bin check, and native heartbeat smoke pass. +Continue through cache/freshness projections; do not let existence, successful +decode, or a latest mirror impersonate current consequence authority. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 0cb78644..56b70a59 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 12124b35..e34563af 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -660,4 +660,4 @@ current_status: - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - next_action: Continue the observation-to-consequence audit. Bifrost metrics receipts and accounting projections now require typed token, cost-availability, review-duration, and event-count evidence; legacy/missing dimensions remain readable but incomplete. Next inspect scheduler and cache projections for consequential status derived from presence, freshness, or free-text summaries. Keep closure's zero-substring invariant. + next_action: Continue the observation-to-consequence audit. Heartbeat projection now separates readable store state (`missing`/`loaded`) from participant-derived scheduler physiology (`unconfigured`/`active`/`attention`); state presence no longer emits readiness. Next inspect cache and latest-mirror projections for consequential status derived from existence, decode success, freshness assumptions, or free-text summaries. Keep closure's zero-substring invariant.