Record keyed Planning ownership cut

notes/epiphany-current-algorithmic-map.md

@@ -359,7 +359,8 @@ scheduler, route, notification, or interface contract.
 | `current_work.rs` | sealed Mind view plus exact family requests, jobs, results, and decisions | pure family-specific scheduling/continuation projections | Events, timestamps, role lanes, and thread revisions cannot create or suppress work. |
 | Body Modeling launch/acceptance owners | exact Body obligation, runtime attempt, sealed decision context, and semantic mutation | one job-bound lifecycle and keyed Mind/RepoModel commit | Baseline Body Modeling never reads or writes `EpiphanyThreadStateEntry`; Eyes is not its gate. |
 | Proposal Modeling launch/acceptance owners | immutable proposal request, exact launch binding and attempt, sealed decision context, and frontier mutation | one deterministic Launch/Wait/Review lifecycle and `Modeling.proposal_frontier` commit | Thread is creation provenance only; the aggregate launcher refuses proposal cargo. |
-| `coordinator_state_transaction.rs` and `EpiphanyThreadStateEntry` | legacy aggregate state and unmigrated family companions | obsolete aggregate commits for residual families only | This is a deletion target, not canonical Mind; it may not regain authority over migrated Body Modeling. |
+| frontier Planning/PlanMind launch and adoption owners | exact frontier/dependency versions, per-claim obligation guards, immutable candidate, exact attempts, and sealed decision contexts | deterministic Imagination/Mind lifecycle plus atomic adopted frontier and receipt | Imagination proposes; Mind alone adopts. Unrelated keyed writes merge, while frontier or claim-obligation drift conflicts. |
+| `coordinator_state_transaction.rs` and `EpiphanyThreadStateEntry` | legacy aggregate state and unmigrated reorientation/generic coordinator companions | obsolete aggregate commits for residual families only | This is a deletion target, not canonical Mind; it may not regain authority over migrated Body, Modeling, Research, Verification, or Planning families. |
 | `coordinator_acceptance.rs` | reviewed family result and its concrete admission owner | family-owned admission or residual legacy aggregate transaction | Body and Proposal delegate to their concrete acceptance owners; no duplicate semantic owner survives there. |
 | `thread_state_store.rs` | typed state entry | low-level CultCache codec/read access | Substrate, not policy; it exposes no production writer. |
 | `coordinator_service.rs` | state/runtime store paths and typed commands | state update, launch, accept, interrupt results | Facade routes typed work; it contains no policy or protocol mapping. |
@@ -5137,3 +5138,48 @@ audit cargo and cannot turn unrelated graph work into a conflict.
   change refuses admission with the copied store byte-identical. Core 559/559,
   OpenAI runtime 23/23, coordinator runtime 18/18, and both all-target checks
   pass.
+
+## Keyed frontier Planning and PlanMind lifecycle (2026-08-18)
+
+Exact `c9329ed6` removes Planning and PlanMind from aggregate coordinator
+behavior. `RepoFrontierPlanningRequest` v4 seals the exact current frontier and
+dependency documents plus each affected claim's obligation document. The full
+keyed RepoModel projection remains immutable audit cargo; it is not a global
+strong read. Request identity is runtime plus frontier semantic identity and
+contains no coordinator thread.
+
+- Owner: `project_current_work` derives Planning and PlanMind
+  Launch/Wait/Review; `launch_current_frontier_planning_work` and
+  `launch_current_frontier_plan_mind_work` publish deterministic attempts;
+  `commit_repo_frontier_plan_decision` alone adopts or refuses the candidate.
+- Inputs: exact frontier/dependency versions, per-claim obligation guards,
+  immutable Planning request, exact Imagination candidate/result, immutable
+  PlanMind request, exact Mind result, and both sealed decision contexts.
+- Outputs: one typed plan-decision receipt and, for adoption, one atomic
+  replacement of the exact frontier containing the adopted plan. Imagination
+  has proposal authority only; Mind owns adoption.
+- Derived state: complete RepoModel view, role boards, events, accepted-at
+  timestamps, latest-result slots, coordinator thread, and operator status are
+  audit or display projections only.
+- Forbidden writers: aggregate state patches, generic coordinator Planning or
+  PlanMind launch validators, role-lane terminality, accepted-at ordering, and
+  thread-derived identities cannot create, suppress, retry, review, or adopt a
+  plan.
+- Shared paths: operator, status, and Resident consume the same current-work
+  projection. Planning and PlanMind use family-specific requests and admission
+  rules while sharing only the pure Launch/Wait/Review vocabulary.
+- Cut line: old aggregate launch constructors and validators are deleted.
+  Planning failure review is a typed Self receipt. Terminal replay authenticates
+  the immutable request/result chain, then verifies the adopted consequence; it
+  does not demand that the frontier still have its pre-adoption value.
+- Concurrency guard: every RepoModel node has a keyed
+  `EpiphanyRepoModelClaimObligationsDocument`. Claim challenge admission updates
+  that document atomically with the challenge. Planning strongly reads the
+  exact guard, so a new external-evidence obligation and stale plan adoption
+  cannot both commit; unrelated graph identities still merge.
+- Verification: the capstone launches Imagination and Mind without persisted
+  thread state, seals both contexts, adopts and replays the exact candidate,
+  preserves an unrelated concurrent node, and makes a copied challenge state
+  reject the stale request and launch byte-identically. Core library 555/555,
+  OpenAI runtime 23/23, coordinator runtime 18/18, and core/OpenAI all-target
+  checks pass.

notes/epiphany-fork-implementation-plan.md

@@ -19,8 +19,8 @@ earned OpenAI-compatible authentication or model-transport capability.
   status surfaces still retain a legacy persisted `EpiphanyThreadStateEntry`;
   that aggregate is an obsolete live authority and currently blocks fresh keyed
   stores from coordinating. Body, Proposal, frontier-verdict Modeling,
-  Research, and Verification have been removed from that authority; planning,
-  reorientation, and generic coordinator presence remain.
+  Research, Verification, and Planning/PlanMind have been removed from that
+  authority; reorientation and generic coordinator presence remain.
 - Native binaries expose coordinator, status, state, runtime, memory, daemon,
   Persona, repo-work, and Verse operations.
 - CultCache stores typed state and receipts; CultMesh/CultNet carry typed local
@@ -256,14 +256,21 @@ Cut in this order:
    refuses byte-identically, and replay is stable. Generic launch/acceptance,
    accepted-at/latest-result selection, dynamic telemetry prompts, and
    model-authored causal IDs no longer own this family.
-   Migrate planning and reorientation next from
-   aggregate state patches and generic role lanes to family-owned current-work
-   projections, exact job identities, `MindMutation` plans, and exact commit
-   receipts. Reuse pure invariant primitives, not a generic mutable registry.
-10. Delete `EpiphanyThreadStateEntry`, `coordinator_state_transaction`, global
+10. **Frontier Planning and PlanMind landed at `c9329ed6`:** the Planning
+   request seals exact frontier/dependency versions plus per-claim obligation
+   guards. Current-work owns deterministic Imagination and Mind attempts;
+   Imagination authors a typed candidate, while Mind alone adopts it through a
+   sealed PlanMind request and family-owned frontier mutation. Claim challenge
+   admission atomically updates the target claim-obligation document, so stale
+   planning conflicts without turning unrelated graph writes into a global
+   head. Thread provenance, generic coordinator validators/constructors,
+   aggregate role lanes, and accepted-at/latest-result behavior no longer own
+   this family. Migrate reorientation next with the same exact-document
+   doctrine, without a generic mutable registry.
+11. Delete `EpiphanyThreadStateEntry`, `coordinator_state_transaction`, global
    expected revisions, aggregate update APIs, and all source references from
    production. Refuse old writable stores; add no dual reader or migrator.
-11. Replay fresh-store concurrency and decision-context acceptance. Only then
+12. Replay fresh-store concurrency and decision-context acceptance. Only then
    restart Model Atlas Gate 1 from a new external root.
 
 Do not preserve the aggregate for compatibility, manufacture a bootstrap

notes/fresh-workspace-handoff.md

@@ -12,7 +12,7 @@ effects, receipts, Mind admission, brakes, external consequence gates, and
 terminal commit. Focused core and OpenAI-runtime Persona suites pass.
 
 The five-day shakedown remains paused. The active branch includes exact
-`fc5d1a4a` on `codex/epiphany-shakedown-live`: the keyed Mind foundation, federated Model Atlas
+`c9329ed6` on `codex/epiphany-shakedown-live`: the keyed Mind foundation, federated Model Atlas
 vertical slice, ordinary Modeling authoring path, durable publisher identity,
 fresh seven-organ Mind bootstrap, and atomic RepoModel projection bootstrap are
 landed. Historical aggregate RepoModel and partial Gate stores are evidence
@@ -22,8 +22,8 @@ or repair path can restore their authority.
 This is not yet the full Concurrent Mind cut. Persisted
 `EpiphanyThreadStateEntry`, its coordinator transaction, and multiple
 unmigrated launch/acceptance/status readers remain live production authorities.
-Baseline Body, Proposal, frontier-verdict Modeling, frontier Research, and
-frontier Verification are no longer among them:
+Baseline Body, Proposal, frontier-verdict Modeling, frontier Research,
+frontier Verification, and frontier Planning/PlanMind are no longer among them:
 keyed Mind owns their work projections, operator and Resident launch, exact job-bound
 continuation, review, and semantic admission. Research is driven only by an explicit
 external-evidence obligation; accepted Eyes state, timestamps, generic regather, and
@@ -57,7 +57,7 @@ canonical Eve schema IDs without dependency semantics. Eve exact `b597dab` and
 `gamecult.eve.surface.v1` retained tree for GUI and TUI.
 
 Verification is green at the latest ownership cut: Epiphany core library
-559/559, OpenAI runtime 23/23, coordinator runtime 18/18, and core/OpenAI
+555/555, OpenAI runtime 23/23, coordinator runtime 18/18, and core/OpenAI
 all-target checks pass.
 An unfiltered core package run also exposed two pre-existing
 `epiphany-hands-action` fixture failures: those fixtures omit the exact
@@ -69,8 +69,8 @@ still reaches an older feature-gated workspace-coverage recovery smoke whose
 already-absent API predates this slice; no compatibility shim was added.
 
 These are implementation and isolated proof claims. They are not sustained
-Starfire dogfood. Planning, reorientation, and final aggregate deletion are the
-next source rites; only then may Gate 1 use separate real stores and
+Starfire dogfood. Reorientation and final aggregate deletion are the next
+source rites; only then may Gate 1 use separate real stores and
 identities; keep impact ingress absent while ordinary Modeling seeds facts and
 publishers/projector establish signed sight; then engage all three Atlas brakes
 and prove later organ cycles are held while the last Eve projection remains
@@ -419,9 +419,22 @@ original receipt. Generic Verification launch/acceptance, accepted-at/latest
 selection, dynamic telemetry prompt mutation, and model-authored causal IDs are
 gone.
 
-Map and migrate frontier Planning and PlanMind next onto their exact frontier,
-candidate, decision-context, and keyed Mind authorities. Continue with
-reorientation, then delete the aggregate schema/transaction. Run the source
+Exact `c9329ed6` completes frontier Planning and PlanMind. The Planning request
+seals the exact frontier/dependency documents and per-claim obligation guards;
+current-work owns deterministic Imagination and Mind launches; and the terminal
+candidate plus PlanMind decision context are the only model-authored inputs to
+Mind adoption. Claim challenges now replace the exact per-node obligation
+document in the same transaction as the challenge, so a concurrent challenge
+physically conflicts with stale plan adoption while unrelated graph documents
+still merge. Plan adoption writes only the exact frontier and receipt. Replay
+authenticates the immutable request/result chain and the already-adopted
+consequence rather than requiring the obsolete pre-adoption frontier. Generic
+Planning/PlanMind launch constructors and validators, role-lane failure review,
+thread-derived request identity, and aggregate coordinator routing are gone.
+
+Map and migrate reorientation next onto exact keyed freshness and continuity
+obligations, sealed decision contexts, deterministic attempts, and family-owned
+Mind mutations. Then delete the aggregate schema/transaction. Run the source
 guards and fresh-store concurrency/decision-context suite. Only after that may
 Model Atlas Gate 1 restart from a new external root. Keep the current fresh and
 partial roots read-only; do not release scheduling, register operational

state/map.yaml

@@ -38,9 +38,9 @@ invariants:
   - Evidence and git retain history; this map retains only state that changes future decisions.
 
 current_status:
-  summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, and frontier Verification lifecycles are landed on codex/epiphany-shakedown-live, but the broader Concurrent Mind cut is not. Keyed Mind now owns these families' work discovery, deterministic launch, exact job-bound continuation, review, and semantic admission without persisted thread state. EpiphanyThreadStateEntry and its coordinator transaction remain obsolete production authorities for planning, reorientation, generic coordinator presence, and residual status paths. Fresh Gate preflight proved publisher identity, fresh organ Mind, atomic RepoModel projection bootstrap, and both semantic partitions, then correctly stopped when status called a ready keyed Mind missing without the legacy aggregate. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 is paused behind deletion of the remaining aggregate authority.
+  summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, and frontier Planning/PlanMind lifecycles are landed on codex/epiphany-shakedown-live, but the broader Concurrent Mind cut is not. Keyed Mind now owns these families' work discovery, deterministic launch, exact job-bound continuation, review, and semantic admission without persisted thread state. EpiphanyThreadStateEntry and its coordinator transaction remain obsolete production authorities for reorientation, generic coordinator presence, and residual status paths. Fresh Gate preflight proved publisher identity, fresh organ Mind, atomic RepoModel projection bootstrap, and both semantic partitions, then correctly stopped when status called a ready keyed Mind missing without the legacy aggregate. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 is paused behind deletion of the remaining aggregate authority.
   public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
-  latest_phase: Exact fc5d1a4a migrates frontier Verification onto one deterministic current-work lifecycle rooted in the exact Hands consequence and RepoFrontierVerificationRequest. The Hands commit atomically publishes its receipt and request; launch seals the exact request, route, frontier, Hands authority/intent/review/receipts, reasoning basis, and terminal decision context. Soul.verification admission atomically writes a keyed Verification audit, Soul verdict, deterministic frontier-Modeling request, and Mind commit receipt. The complete RepoModel view is audit cargo; exact frontier and Hands documents are strong authority. A terminal decision survives later state changes, disjoint keyed writes merge, an exact-frontier change refuses admission byte-identically, and exact replay returns the original receipt. Generic coordinator launch/acceptance, accepted-at/latest-result selection, aggregate Soul prerequisites, dynamic Verification telemetry prompts, and model-authored request/route identity are deleted. Launch/Wait/Review now share the truthful EpiphanyAgentPassContinuationAction vocabulary without a mutable registry. Core library 559/559, OpenAI runtime 23/23, coordinator runtime 18/18, and core/OpenAI all-target checks pass. Gate 1 remains paused behind planning, reorientation, and final aggregate deletion.
+  latest_phase: Exact c9329ed6 migrates frontier Planning and PlanMind onto one deterministic current-work lifecycle. Planning requests seal the exact frontier/dependency documents and per-claim obligation guards; Imagination produces a typed candidate, and Mind alone may adopt it through an exact PlanMind request, sealed decision context, and family-owned frontier mutation. Request identity excludes thread provenance. Unrelated keyed graph writes merge; an exact frontier or claim-obligation change refuses stale work; plan adoption and its receipt publish atomically; exact replay authenticates the immutable request/result chain and the already-adopted consequence without demanding the obsolete pre-adoption state. Claim challenges now atomically update per-node obligation documents, closing the planning-versus-new-challenge race without a global model head. Generic coordinator Planning/PlanMind launch validators, aggregate launch constructors, role-lane failure reviews, and thread-state routing are deleted for this family. Core library 555/555, OpenAI runtime 23/23, coordinator runtime 18/18, and core/OpenAI all-target checks pass. Gate 1 remains paused behind reorientation and final aggregate deletion.
   operational_state:
     local_worktree: clean_at_latest_documentation_handoff
     operator_wireguard: restored
@@ -73,8 +73,8 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
-  unresolved_authority: Persisted EpiphanyThreadStateEntry and coordinator_state_transaction remain live production authorities for planning, reorientation, and generic coordinator families, including status presence and residual result selection. They own none of the migrated Modeling, Research, or Verification families, and the dormant claim-repair carrier family no longer exists. The residual aggregate still contradicts concurrent keyed Mind and blocks fresh organisms. Model Atlas code and isolated proofs remain accepted, but Gate 1 signed sight/brake acceptance, autonomous cascade, partition exercise, and sustained physiology remain unproven. Operational registration in gamecult-ops remains forbidden. Historical shakedown evidence remains valid; c011 and partial Gate roots remain untouched/read-only. One completed Discord consequence remains blocked by the absent Yggdrasil credential.
-  next_action: Map and migrate the planning family from aggregate role lanes and thread-state decisions onto exact frontier Planning and PlanMind requests, candidates, sealed decision contexts, and family-owned keyed Mind mutations. Imagination may propose futures but only Mind may adopt a plan; exact frontier/dependency documents and the adopted candidate are strong authority, while unrelated keyed changes merge. Delete accepted-at/latest-slot/thread revision behavior and any request identity that still includes thread provenance. Then migrate reorientation; finally delete EpiphanyThreadStateEntry, coordinator_state_transaction, global expected revisions, and every residual behavioral reader/writer. Refuse old writable stores and prove fresh concurrent/restart behavior before restarting Model Atlas Gate 1. Do not add a compatibility aggregate, dual reader, bootstrap thread, migrator, or generic work registry.
+  unresolved_authority: Persisted EpiphanyThreadStateEntry and coordinator_state_transaction remain live production authorities for reorientation and generic coordinator families, including status presence and residual result selection. They own none of the migrated Modeling, Research, Verification, or Planning families, and the dormant claim-repair carrier family no longer exists. The residual aggregate still contradicts concurrent keyed Mind and blocks fresh organisms. Model Atlas code and isolated proofs remain accepted, but Gate 1 signed sight/brake acceptance, autonomous cascade, partition exercise, and sustained physiology remain unproven. Operational registration in gamecult-ops remains forbidden. Historical shakedown evidence remains valid; c011 and partial Gate roots remain untouched/read-only. One completed Discord consequence remains blocked by the absent Yggdrasil credential.
+  next_action: Map and migrate reorientation from aggregate checkpoint, role-lane, accepted-at, and thread-state decisions onto an exact keyed continuity obligation, sealed reorientation projection, deterministic attempt, typed terminal decision or pass failure, and family-owned Mind mutation. Resume or regather must be derived from exact Body/Mind freshness documents and continuity receipts, not a latest result slot or global revision. Then delete EpiphanyThreadStateEntry, coordinator_state_transaction, global expected revisions, aggregate update APIs, and every residual behavioral reader/writer. Refuse old writable stores and prove fresh concurrent/restart behavior before restarting Model Atlas Gate 1. Do not add a compatibility aggregate, dual reader, bootstrap thread, migrator, or generic work registry.
 
 active_subgoals:
   - Delete persisted thread-state authority and complete the concurrent keyed Mind cut before any further operational Gate run.