From 24b92dcdee9cc6f0a68290bf108affd4dd65ad99 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Thu, 18 Jun 2026 16:21:28 +0100 Subject: [PATCH] Expose runbook aftercare in lifecycle receipts --- .../src/bin/epiphany-daemon-supervisor.rs | 32 +++++++++++++++++- notes/fresh-workspace-handoff.md | 6 ++-- state/agents.msgpack | Bin 15751 -> 15751 bytes state/ledgers.msgpack | Bin 256739 -> 257221 bytes state/map.yaml | 6 ++-- tools/epiphany_local_run.ps1 | 4 +-- 6 files changed, 39 insertions(+), 9 deletions(-) diff --git a/epiphany-core/src/bin/epiphany-daemon-supervisor.rs b/epiphany-core/src/bin/epiphany-daemon-supervisor.rs index 5f857453..b5a5308e 100644 --- a/epiphany-core/src/bin/epiphany-daemon-supervisor.rs +++ b/epiphany-core/src/bin/epiphany-daemon-supervisor.rs @@ -1255,10 +1255,19 @@ fn cluster_windows_service_execution_runbook(args: Args) -> Result<()> { "cluster-service-audit", ]; let final_audit_mode = "cluster-service-execution-audit"; + let step_failure_policy = "continue-after-step-failure"; + let continue_after_step_failure = true; + let nonzero_exit_fails_step = true; + let exits_nonzero_after_final_audit = true; + let final_audit_runs_in_finally = true; let mut service_args = vec![ format!("runbookPath={}", runbook_path.display()), format!("tryModes={}", try_modes.join(",")), format!("finally={final_audit_mode}"), + format!("stepFailurePolicy={step_failure_policy}"), + format!("continueAfterStepFailure={continue_after_step_failure}"), + format!("nonzeroExitFailsStep={nonzero_exit_fails_step}"), + format!("exitsNonzeroAfterFinalAudit={exits_nonzero_after_final_audit}"), ]; if let Some(reason) = &args.reason { service_args.push(format!("reason={reason}")); @@ -1295,7 +1304,11 @@ fn cluster_windows_service_execution_runbook(args: Args) -> Result<()> { "runbookPath": runbook_path, "runbookTryModes": try_modes, "finalAuditMode": final_audit_mode, - "finalAuditRunsInFinally": true, + "finalAuditRunsInFinally": final_audit_runs_in_finally, + "stepFailurePolicy": step_failure_policy, + "continueAfterStepFailure": continue_after_step_failure, + "nonzeroExitFailsStep": nonzero_exit_fails_step, + "exitsNonzeroAfterFinalAudit": exits_nonzero_after_final_audit, "privateStateExposed": written.private_state_exposed, }))? ); @@ -1490,9 +1503,20 @@ fn windows_service_execution_runbook(args: Args) -> Result<()> { "service-status", "service-execution-audit", ]; + let final_audit_mode = "service-execution-audit"; + let step_failure_policy = "continue-after-step-failure"; + let continue_after_step_failure = true; + let nonzero_exit_fails_step = true; + let exits_nonzero_after_final_audit = true; + let final_audit_runs_in_finally = true; let mut service_args = vec![ format!("runbookPath={}", runbook_path.display()), format!("modes={}", modes.join(",")), + format!("finally={final_audit_mode}"), + format!("stepFailurePolicy={step_failure_policy}"), + format!("continueAfterStepFailure={continue_after_step_failure}"), + format!("nonzeroExitFailsStep={nonzero_exit_fails_step}"), + format!("exitsNonzeroAfterFinalAudit={exits_nonzero_after_final_audit}"), ]; if let Some(reason) = &args.reason { service_args.push(format!("reason={reason}")); @@ -1529,6 +1553,12 @@ fn windows_service_execution_runbook(args: Args) -> Result<()> { "receiptId": written.receipt_id, "runbookPath": runbook_path, "runbookModes": modes, + "finalAuditMode": final_audit_mode, + "finalAuditRunsInFinally": final_audit_runs_in_finally, + "stepFailurePolicy": step_failure_policy, + "continueAfterStepFailure": continue_after_step_failure, + "nonzeroExitFailsStep": nonzero_exit_fails_step, + "exitsNonzeroAfterFinalAudit": exits_nonzero_after_final_audit, "privateStateExposed": written.private_state_exposed, }))? ); diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 74dbd4b1..1ce6f839 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -46,7 +46,7 @@ remembers doctrine; the branch remembers the blade. - `epiphany-daemon-supervisor policy --daemon-id --restart-command [--restart-arg ...]` writes durable local Verse restart policy as `epiphany.cultmesh.daemon_restart_policy.v0` with command/args/cwd/cooldown/backoff/attempt state, reconcile cadence, stale-heartbeat threshold, and last scheduled pulse. `epiphany-daemon-supervisor reconcile --daemon-id ` loads that policy when no override command is supplied, refuses under a matching `daemon.lifecycle_poke` brake before launching anything, refuses during cooldown/backoff, writes daemon poke intent/receipt documents, updates daemon status to `ready` or `down` from the command exit, and updates policy attempt state. `epiphany-daemon-supervisor tick [--daemon-id ]` is an explicit scheduler pulse: it scans durable policies, records ready/noop pulses, skips before the configured interval, marks stale heartbeat status degraded, routes restarts through the same brake/cooldown/poke receipt path, and writes latest `epiphany.cultmesh.daemon_scheduler_receipt.v0`. `epiphany-daemon-supervisor serve` runs that same pulse on `--loop-interval-seconds`, with bounded `--max-iterations` proof mode or unbounded service mode. `epiphany-daemon-supervisor service-plan`/`install-service` writes a planned local Verse `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` for the `serve` command; `service-launch`/`start-service` spawns that loop through the current executable or `--service-command`, can `--wait-child` for bounded proof, and records command/args/cwd, scheduler id, daemon selector, pid/exit/status, artifact ref, and private-state guard; `service-runbook` writes a PowerShell operator runbook artifact for the same `serve` command and records it as a lifecycle receipt without spawning; `windows-service-install`/`service-install-plan` writes a Windows `sc.exe create` install script for that same `serve` command and records a lifecycle receipt, with optional `--execute-install` reserved for explicit elevated authority; `windows-service-status`, `windows-service-reconcile`, `windows-service-execution-readiness`, `windows-service-execution-audit`, `windows-service-execution-runbook`, `windows-service-start`, and `windows-service-stop` query/request/audit/document the Windows service manager path and record lifecycle receipts for missing/running/stopped/query-failed, in-sync/drift/missing/query-failed, elevated-ready/not-elevated, complete/incomplete, runbook written, start/stop planned, execution-refused-not-elevated, or start/stop requested/failed outcomes. `tools/epiphany_local_run.ps1 -Mode service-runbook`, `-Mode service-install-plan`, `-Mode service-install-execute`, `-Mode service-status`, `-Mode service-reconcile`, `-Mode service-execution-readiness`, `-Mode service-execution-runbook`, `-Mode service-execution-audit`, `-Mode service-start-plan`, `-Mode service-stop-plan`, `-Mode service-start-execute`, and `-Mode service-stop-execute` wrap the artifact/status/reconcile/readiness/runbook/audit/control-plan/execution paths with operator run intent/receipt and final local Verse context. Service lifecycle actions check the local Verse swarm brake before spawning, writing runbook/install artifacts, querying service-manager state, reconciling service policy, checking execution readiness, auditing execution receipts, planning control, or requesting start/stop. The local wrapper builds/checks this binary with the other Epiphany operator tools. Installed-service status reconciliation has now been proved read-only against the real Windows `EventLog` service: `service-status` wrote `daemon-service-lifecycle-receipt-windows-eventlog-proof-windows-service-status` with status `running`, exit code `0`, and `privateStateExposed=false`. The new read-only policy reconciliation path was also proved: direct missing-service reconcile wrote `missing`, direct real-service reconcile wrote `drift`, brake engagement refused before query with exit `1`, and wrapper `service-reconcile` wrote `daemon-service-lifecycle-receipt-windows-eventlog-reconcile-proof-windows-service-reconcile` with status `drift`, exit code `0`, artifact ref `service-manager://windows/EventLog/reconcile`, and `privateStateExposed=false`. Start/stop now plan by default unless `--execute-control`/`--execute-service-control` is passed: direct start/stop wrote `start-planned`/`stop-planned` with `executed=false`, wrapper `service-start-plan` and `service-stop-plan` wrote local Verse receipts against `EventLog`, and brake engagement refused the plan path before any control action. Explicit execution is also elevation-gated before mutation: non-elevated `--execute-control` and `--execute-install` wrote `execution-refused-not-elevated` lifecycle receipts with `executed=false`, and a matching brake still refuses before the elevation check. Execution readiness is queryable without mutation: direct and wrapper `windows-service-execution-readiness` wrote `not-elevated` receipts for `EventLog`, with `privateStateExposed=false`, and brake engagement refused readiness as lifecycle activity. The explicit wrapper execution modes have also been proved in this non-elevated shell: `service-install-execute`, `service-start-execute`, and `service-stop-execute` reached the elevation gate, wrote `execution-refused-not-elevated` receipts, and did not mutate Windows services. Execution audit is now the post-run proof target: it scans service lifecycle receipts through CultMesh typed enumeration, writes its own audit receipt, and returns `complete` only when the sealed `windows-service-execution-runbook` witness plus elevated-ready/install/start/status/reconcile/stop effect receipts are present, successful, and sealed. `service-execution-audit-smoke` proves both sides without touching Windows services: synthetic complete sealed receipts produce `complete`, then a drifted reconcile receipt produces `incomplete`. Live wrapper audit `local-20260618-133559-466-6644f26f` reported the runbook witness `written`/OK while six elevated effect receipts remained missing. This is a durable policy-backed process-owner seam; the remaining scar is an actual elevated install/start/stop execution proof under operator authority followed by a `complete` audit receipt. - `tools/epiphany_local_run.ps1 -Mode service-execution-runbook` writes a non-mutating `#Requires -RunAsAdministrator` PowerShell artifact that sequences `service-execution-readiness`, `service-install-execute`, `service-start-execute`, `service-status`, `service-reconcile`, `service-stop-execute`, final `service-status`, and `service-execution-audit` through the existing typed wrapper modes, then asks `epiphany-daemon-supervisor windows-service-execution-runbook` to seal the artifact as a `written` lifecycle receipt. The artifact now uses `Invoke-EpiphanyRunbookStep` so each step resets `$LASTEXITCODE`, catches thrown/nonzero failures, keeps running to gather more lifecycle receipts, runs `service-execution-audit` in `finally`, and exits nonzero only after the audit if any step failed. Latest proof `local-20260618-160641-685-331af57c` generated and parsed the artifact with `privateStateExposed=false`; the next elevated scar is to run it under explicit operator authority and preserve its effect receipts. - `tools/epiphany_local_run.ps1 -Mode service-tick` is now the first-class local wrapper for one daemon-supervisor scheduler pulse. It runs through operator run intent/receipt, agent-state SoA refresh, local Verse brake preflight, and `epiphany-daemon-supervisor tick`, while restart authority remains in durable per-daemon policies. Proof seeded one disabled Persona policy as inert metadata, then wrapper artifact `local-20260618-075902-006-e2915574` wrote scheduler receipt `daemon-scheduler-receipt-epiphany-daemon-supervisor-0` with `tickComplete`, `outcomeCount=1`, `skippedCount=1`, `restartedCount=0`, `refusedCount=0`, and `privateStateExposed=false`. -- `epiphany-cluster-daemon` is the first real per-cluster daemon heartbeat body. It runs as a narrow Rust binary parameterized by daemon id, publishes typed `epiphany.cultmesh.daemon_status.v0` heartbeats into `.epiphany-run\cultmesh\local-verse.ccmp`, can run once or loop, and exposes no private state. Durable restart policies for Self, Hands, Persona, Imagination, Eyes, Modeling, and Soul now invoke `epiphany-cluster-daemon heartbeat`, not the generic `epiphany-verse-query daemon-status` debug writer. A degraded proof via `service-tick` showed the supervisor invoking all seven daemon bodies and restoring ready liveness with sealed receipts; follow-up service tick no-ops when heartbeats are fresh. `epiphany-daemon-supervisor cluster-service-runbook` and `tools/epiphany_local_run.ps1 -Mode cluster-service-runbook` write a non-mutating service runbook plus `daemon_service_lifecycle` receipt for all seven organ daemon `epiphany-cluster-daemon serve` commands. `epiphany-daemon-supervisor cluster-service-install-plan` and `tools/epiphany_local_run.ps1 -Mode cluster-service-install-plan` write a non-mutating Windows install script plus lifecycle receipt for seven distinct per-organ Windows services. `tools/epiphany_local_run.ps1 -Mode cluster-service-install-execute` requests execution through the same typed path and, in non-elevated shells, writes `execution-refused-not-elevated` with `executed=false` instead of mutating services. `epiphany-daemon-supervisor cluster-service-audit` and wrapper `-Mode cluster-service-audit` read Windows service-manager state for those seven expected service names; current local proof reports seven missing services and `status=incomplete`. `epiphany-daemon-supervisor cluster-service-start`/`cluster-service-stop` and wrapper modes `cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, and `cluster-service-stop-execute` record lifecycle receipts for all seven expected services; plan modes emit seven planned rows, and execute modes refuse without elevation before mutation. `cluster-service-execution-runbook` writes the admin-gated elevated wrapper sequence starting with cluster-native readiness, then uses `Invoke-EpiphanyRunbookStep` so each install/start/audit/stop step resets `$LASTEXITCODE`, catches thrown/nonzero failures, keeps running to gather more lifecycle receipts, and always runs `cluster-service-execution-audit` from `finally`; the wrapper asks `epiphany-daemon-supervisor cluster-service-execution-runbook` to seal the generated artifact as a typed `daemon_service_lifecycle` receipt with action `cluster-windows-service-execution-runbook`, status `written`, final audit metadata, and `privateStateExposed=false`. Its JSON exposes `runbookTryModes`, `finalAuditMode`, and `finalAuditRunsInFinally=true`, and the compact operator line prints `finalAuditInFinally=True`. Latest proof `local-20260618-160627-557-66b23361` generated and parsed the robust cluster artifact. Cluster execution audit now requires that runbook witness before considering the elevated readiness/install/start/audit/stop effect chain. Current live audit remains correctly `incomplete` until an elevated operator run produces successful effect receipts. `tools/epiphany_local_run.ps1` builds and requires `epiphany-cluster-daemon` for service modes. +- `epiphany-cluster-daemon` is the first real per-cluster daemon heartbeat body. It runs as a narrow Rust binary parameterized by daemon id, publishes typed `epiphany.cultmesh.daemon_status.v0` heartbeats into `.epiphany-run\cultmesh\local-verse.ccmp`, can run once or loop, and exposes no private state. Durable restart policies for Self, Hands, Persona, Imagination, Eyes, Modeling, and Soul now invoke `epiphany-cluster-daemon heartbeat`, not the generic `epiphany-verse-query daemon-status` debug writer. A degraded proof via `service-tick` showed the supervisor invoking all seven daemon bodies and restoring ready liveness with sealed receipts; follow-up service tick no-ops when heartbeats are fresh. `epiphany-daemon-supervisor cluster-service-runbook` and `tools/epiphany_local_run.ps1 -Mode cluster-service-runbook` write a non-mutating service runbook plus `daemon_service_lifecycle` receipt for all seven organ daemon `epiphany-cluster-daemon serve` commands. `epiphany-daemon-supervisor cluster-service-install-plan` and `tools/epiphany_local_run.ps1 -Mode cluster-service-install-plan` write a non-mutating Windows install script plus lifecycle receipt for seven distinct per-organ Windows services. `tools/epiphany_local_run.ps1 -Mode cluster-service-install-execute` requests execution through the same typed path and, in non-elevated shells, writes `execution-refused-not-elevated` with `executed=false` instead of mutating services. `epiphany-daemon-supervisor cluster-service-audit` and wrapper `-Mode cluster-service-audit` read Windows service-manager state for those seven expected service names; current local proof reports seven missing services and `status=incomplete`. `epiphany-daemon-supervisor cluster-service-start`/`cluster-service-stop` and wrapper modes `cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, and `cluster-service-stop-execute` record lifecycle receipts for all seven expected services; plan modes emit seven planned rows, and execute modes refuse without elevation before mutation. `cluster-service-execution-runbook` writes the admin-gated elevated wrapper sequence starting with cluster-native readiness, then uses `Invoke-EpiphanyRunbookStep` so each install/start/audit/stop step resets `$LASTEXITCODE`, catches thrown/nonzero failures, keeps running to gather more lifecycle receipts, and always runs `cluster-service-execution-audit` from `finally`; the wrapper asks `epiphany-daemon-supervisor cluster-service-execution-runbook` to seal the generated artifact as a typed `daemon_service_lifecycle` receipt with action `cluster-windows-service-execution-runbook`, status `written`, final audit metadata, step-failure policy metadata, and `privateStateExposed=false`. Its JSON and typed receipt args expose `runbookTryModes`, `finalAuditMode`, `finalAuditRunsInFinally=true`, `stepFailurePolicy=continue-after-step-failure`, `continueAfterStepFailure=true`, `nonzeroExitFailsStep=true`, and `exitsNonzeroAfterFinalAudit=true`, and the compact operator line prints those same aftercare facts. Latest proof `local-20260618-161632-376-436227d8` generated and parsed the robust cluster artifact. Cluster execution audit now requires that runbook witness before considering the elevated readiness/install/start/audit/stop effect chain. Current live audit remains correctly `incomplete` until an elevated operator run produces successful effect receipts. `tools/epiphany_local_run.ps1` builds and requires `epiphany-cluster-daemon` for service modes. - `epiphany-verse-query restart-policy-directory` and `tools/epiphany_local_run.ps1 -Mode service-policy-directory` are the compact scheduler coverage sight rite. They report each daemon's durable restart-policy coverage as `ENABLED`, `DISABLED`, or `MISSING` through a narrow CultMesh restart-policy directory loader without writing policies or commands. Disabled policies count as recovery attention, not harmless coverage. Live wrapper artifact `local-20260618-083356-582-d50d6b2b` returned `status=ok`, seven daemons, seven covered policies, seven enabled policies, zero disabled, zero missing, zero attention rows, and `privateStateExposed=false`. This is real daemon heartbeat coverage, not yet an installed per-organ OS service. - `epiphany-verse-query poke-down-daemons` and `tools/epiphany_local_run.ps1 -Mode swarm-poke-down` are the current typed "if a service is down, poke it" reflex. They inspect local Verse daemon status rows, write daemon poke intent/receipt documents for every non-ready daemon, respect the same `daemon.lifecycle_poke` swarm brake as single-daemon poke, include target display name/body domain/private Verse id/Eve surface metadata from cluster topology in the operator-safe poke summary, and expose no private state. Verified: live local Verse had seven ready daemons and produced a no-op operator receipt with `pokedDaemonCount=0`; a temp degraded Hands store produced one topology-aware poke receipt; a temp lifecycle brake refused the batch poke; and `epiphany-verse-query smoke` now source-proves the ready no-op plus degraded single-poke path. - CultMesh now carries the CultCache SoA ergonomic instead of forcing callers to bypass the mesh node. `CultMeshNode::soa()` returns typed SoA tables for registered documents; the CultMesh crate proves the generic path, and Epiphany's agent-state summary test proves local Verse can project sealed `epiphany.cultmesh.agent_state_soa_summary.v0` rows through SoA columns. The seven-row persisted agent-state SoA remains owned by the agent memory store and mirrored into local Verse only as a private-state-sealed summary. `epiphany-verse-query agent-state-report` and `tools/epiphany_local_run.ps1 -Mode agent-state-soa` now expose that mirrored summary as compact TUI/JSON rows from CultMesh SoA columns without full local Verse serialization; live wrapper proof returned `agents=7`, `summaryRows=2` for id/latest projections, and `privateStateExposed=False`. @@ -61,7 +61,7 @@ remembers doctrine; the branch remembers the blade. - Public doctrine source `https://gamecult.org/Blog/purge-the-heretek-from-our-daemonic-swarm` sharpens the current swarm audit: Odin sees but must not own, Gjallar-like surface publishers must produce their own witnesses, Idunn-like ledgers must advance instead of freezing old wounds, and Bifrost is the ledger gate for cross-repo purification receipts rather than transcript archaeology. - `tools/epiphany_local_run.ps1` now stamps local run ids as `local-YYYYMMDD-HHMMSS-fff-` instead of second-resolution ids, so concurrent operator rites get separate artifact roots and run receipts. Verified: `collaboration-feedback` and `bifrost-publication` launched in parallel in the same second and completed as `local-20260618-064814-171-dc0b8dd9` and `local-20260618-064814-149-2946d675`. - `epiphany-verse-query tool-directory` and `tools/epiphany_local_run.ps1 -Mode tool-directory` are the compact read-only daemon tool directory. The report reads the same local Verse capability records used by `invoke-tool`, annotates them with host daemon readiness, and returns TUI rows plus direct `invocationCommand` and wrapper `wrapperInvocationCommand=tools/epiphany_local_run.ps1 -Mode tool-invoke -ToolCapabilityId -ToolRequestingAgentId -ToolRequestingClusterId `. Verified: fresh proof store returned sixteen globally available, receipt-gated, private-state-sealed tools with `hostReadyCount=16`, `hostAttentionCount=0`, including `READY | Hands | repo-action | submitHandsActionIntent | epiphany.cluster.hands.tool.repo-action | eve://epiphany/hands`; smoke source-proves the compact Hands row and command hints; wrapper mode produced `tools=16`, `hostReady=16`, `hostAttention=0`, `privateStateExposed=False`. -- `epiphany-verse-query swarm-overview` and `tools/epiphany_local_run.ps1 -Mode swarm-overview` are the one-command compact global-agent sight rite. It composes narrow cluster topology, liveness, Odin/Eve surface, daemon tool, restart-policy coverage, receipt-directory service-lifecycle attention, and the shared core service-execution audit report; returns seven agents/daemons, seven clusters, seven private Verse ids, seven Eve surfaces, one public Persona discussion surface, sixteen globally invokable receipt-gated tools, command hints for topology/liveness/surfaces/tools/receipts/poke/connect/invoke/Bifrost-ledger/service-policy-directory/service-execution-audit, sealed `toolHostAttentionRows`/TUI rows for blocked daemon-hosted capabilities, sealed `serviceLifecycleAttentionRows`/TUI rows copied from the receipt directory, explicit `serviceLifecycleRecommended*` fields for service-manager follow-up, ordered `swarmActionRows`/TUI rows with authority/effect/mutation/elevation metadata plus sealed `operatorArtifactRef`, `operatorArtifactStatus`, and `completionAuditWrapper*` pointers for operator-runbook rows, `serviceExecutionFailedCheckRows`/TUI rows naming the failed sealed execution checks, and `privateStateExposed=false`; and avoids full local Verse serialization. `epiphany-verse-query` now defaults to `.epiphany-run\cultmesh\local-verse.ccmp`, matching the wrapper and daemon supervisor. Verified: live overview artifact `local-20260618-155606-611-19701102` returned `status=attention`, `liveness=ready`, `recovery=attention`, `agents=7`, `clusters=7`, `privateVerses=7`, `surfaces=7`, `tools=16`, `nonReady=0`, `toolHostAttentionCount=0`, `policyMissing=0`, `recommended=cluster-service-execution-audit`, `serviceRecommended=cluster-service-execution-audit`, `swarmActionCount=2`, readback row `40:service-lifecycle:cluster-service-execution-audit:attention:mutates=False:elevated=False:artifactStatus=none:audit=none:artifact=none`, elevated row `50:service-execution-authority:operator-elevated-runbook:operator-authority-required:mutates=True:elevated=True:artifactStatus=present:audit=cluster-service-execution-audit:artifact=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-132257-139-26213a29\epiphany-cluster-daemon-services-execution-runbook.ps1`, lifecycle routes `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit` and `epiphany-daemon-supervisor-service::windows-service-execution-audit`, and `serviceExecutionFailedChecks=cluster-windows-service-execution-readiness=not-elevated; cluster-windows-service-install=planned; cluster-windows-service-start=execution-refused-not-elevated; cluster-windows-service-execution-audit=incomplete; cluster-windows-service-stop=execution-refused-not-elevated` with `privateStateExposed=False`. Fresh source smoke `verse-query-service-execution-failed-checks-clean` passes, including present-artifact, missing-artifact, and failed-check anatomy branches. +- `epiphany-verse-query swarm-overview` and `tools/epiphany_local_run.ps1 -Mode swarm-overview` are the one-command compact global-agent sight rite. It composes narrow cluster topology, liveness, Odin/Eve surface, daemon tool, restart-policy coverage, receipt-directory service-lifecycle attention, and the shared core service-execution audit report; returns seven agents/daemons, seven clusters, seven private Verse ids, seven Eve surfaces, one public Persona discussion surface, sixteen globally invokable receipt-gated tools, command hints for topology/liveness/surfaces/tools/receipts/poke/connect/invoke/Bifrost-ledger/service-policy-directory/service-execution-audit, sealed `toolHostAttentionRows`/TUI rows for blocked daemon-hosted capabilities, sealed `serviceLifecycleAttentionRows`/TUI rows copied from the receipt directory, explicit `serviceLifecycleRecommended*` fields for service-manager follow-up, ordered `swarmActionRows`/TUI rows with authority/effect/mutation/elevation metadata plus sealed `operatorArtifactRef`, `operatorArtifactStatus`, and `completionAuditWrapper*` pointers for operator-runbook rows, `serviceExecutionFailedCheckRows`/TUI rows naming the failed sealed execution checks, and `privateStateExposed=false`; and avoids full local Verse serialization. `epiphany-verse-query` now defaults to `.epiphany-run\cultmesh\local-verse.ccmp`, matching the wrapper and daemon supervisor. Verified: live overview artifact `local-20260618-161718-889-7cebdcb1` returned `status=attention`, `liveness=ready`, `recovery=attention`, `agents=7`, `clusters=7`, `privateVerses=7`, `surfaces=7`, `tools=16`, `nonReady=0`, `toolHostAttentionCount=0`, `policyMissing=0`, `recommended=cluster-service-execution-audit`, `serviceRecommended=cluster-service-execution-audit`, `swarmActionCount=2`, readback row `40:service-lifecycle:cluster-service-execution-audit:attention:mutates=False:elevated=False:artifactStatus=none:audit=none:artifact=none`, elevated row `50:service-execution-authority:operator-elevated-runbook:operator-authority-required:mutates=True:elevated=True:artifactStatus=present:audit=cluster-service-execution-audit:artifact=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-161632-376-436227d8\epiphany-cluster-daemon-services-execution-runbook.ps1`, lifecycle routes `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit` and `epiphany-daemon-supervisor-service::windows-service-execution-audit`, and `serviceExecutionFailedChecks=cluster-windows-service-execution-readiness=not-elevated; cluster-windows-service-install=planned; cluster-windows-service-start=execution-refused-not-elevated; cluster-windows-service-execution-audit=incomplete; cluster-windows-service-stop=execution-refused-not-elevated` with `privateStateExposed=False`. Fresh source smoke `verse-query-service-execution-failed-checks-clean` passes, including present-artifact, missing-artifact, and failed-check anatomy branches. - `epiphany-verse-query swarm-triage` and `tools/epiphany_local_run.ps1 -Mode swarm-triage` are the compact "see the swarm, then poke only if liveness attention exists" rite. It reads the compact overview first, writes no poke receipt when liveness is ready, routes non-ready daemons through the existing brake-aware `poke-down-daemons` receipt writer, carries overview's sealed service lifecycle attention rows, failed service-execution check rows, explicit service lifecycle recommendation, and ordered/effect-classified action queue with sealed runbook artifact and audit pointers without treating service-manager wounds as daemon-poke authority, and carries sealed `toolHostAttentionRows`/TUI rows so agents can see which advertised tools are blocked by a sick host daemon. Verified: live wrapper artifact `local-20260618-150015-844-aba20563` produced `status=noop`, `overview=attention`, `liveness=ready`, `recovery=attention`, `clusters=7`, `privateVerses=7`, `recommended=cluster-service-execution-audit`, `serviceRecommended=cluster-service-execution-audit`, service readback row `artifactStatus=none`, elevated service authority row `artifactStatus=present`, `completionAuditWrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`, artifact `E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-132257-139-26213a29\epiphany-cluster-daemon-services-execution-runbook.ps1`, `attention=none`, `serviceLifecycleAttention=cluster-service-lifecycle:epiphany-cluster-daemon-services::cluster-windows-service-execution-audit:incomplete; service-lifecycle:epiphany-daemon-supervisor-service::windows-service-execution-audit:incomplete`, `serviceLifecycleAttentionCount=2`, `poked=0`, and `privateStateExposed=False`; degraded Hands proof routes through the topology-aware poke path and exposes blocked Hands tool-host rows plus liveness/tool-host action rows; source smoke `verse-query-completion-audit-row-smoke` proves the degraded single-poke triage path without a post-receipt full-context readback. - `swarmActionTuiRows` now carry the same audit visibility as JSON rows. Fresh source smoke `verse-query-action-tui-audit-smoke` and live artifacts `local-20260618-150449-420-0371c76a` / `local-20260618-150450-027-74d864da` prove the compact rows include `artifact=present | audit=cluster-service-execution-audit` on the `service-execution-authority` row and `artifact=none | audit=none` on the readback row, while triage remains `poked=0` and private state remains sealed. - Receipt directory rows now classify their artifact refs too. `ReceiptDirectoryRow` includes `artifactStatus`, and receipt TUI rows append `artifact=`. Fresh smoke `verse-query-receipt-artifact-status-smoke` plus live overview/triage artifacts `local-20260618-150837-267-7fbf22bb` / `local-20260618-150837-466-a6a55086` prove service-manager lifecycle attention refs report `artifactStatus=external-ref` and TUI `artifact=external-ref`, while local runbook action rows still report `artifactStatus=present`. @@ -87,7 +87,7 @@ remembers doctrine; the branch remembers the blade. - `service-execution-runbook` makes that next cut repeatable: it generates the exact elevated wrapper command sequence without mutating the service manager, continues after per-step failure to preserve more receipts, runs `service-execution-audit` in `finally`, exits nonzero if any step failed, and seals a typed runbook lifecycle receipt. Run the generated artifact only with explicit operator authority. - `service-execution-audit` is the non-mutating acceptance proof after the elevated rite: it reports `complete` only when typed lifecycle receipts prove the runbook witness plus expected elevated chain, and otherwise reports the missing/failed sealed checks. - `service-tick` is the non-elevated scheduler pulse proof: it writes the latest daemon scheduler receipt through durable policy ownership and local wrapper receipts. -- `service-policy-directory` is the non-mutating scheduler coverage sight rite: run it before trusting `service-tick` as whole-swarm recovery. `cluster-service-runbook` is the non-mutating per-organ launch artifact rite; `cluster-service-install-plan` is the non-mutating per-organ Windows install artifact rite; `cluster-service-install-execute`, `cluster-service-start-execute`, and `cluster-service-stop-execute` are elevation-gated execution/refusal rites; `cluster-service-start-plan` and `cluster-service-stop-plan` are non-mutating control previews; `cluster-service-audit` is the read-only installed-service readiness rite; `cluster-service-execution-readiness` is the non-mutating cluster service authority check; `cluster-service-execution-runbook`/`service-execution-runbook` and `cluster-service-execution-audit`/`service-execution-audit` are elevated sequence artifacts plus post-run receipt verifiers, with audits requiring typed runbook witnesses before effect receipts. Run execute paths only with operator authority. Current live liveness and policy coverage are ready, but global overview now correctly recommends `cluster-service-execution-audit`; wrapper audit summaries print the failed sealed checks directly, e.g. readiness `not-elevated`, install/start/stop `execution-refused-not-elevated`, and cluster audit `incomplete`. The execution runbooks now continue after individual step failure, guarantee a final execution-audit attempt through `finally`, and exit nonzero after audit if any step failed. Latest live overview `local-20260618-160719-316-79d0422d` points at the robust cluster runbook artifact `local-20260618-160627-557-66b23361`. The remaining service scar is elevated durable service install/start plus complete audit/readiness for the installed services, not missing daemon heartbeat bodies, launch command shape, install command shape, control command shape, cluster readiness receipt shape, audit verifier shape, non-elevated refusal behavior, audit visibility, overview attention routing, compact failed-check visibility, runbook receipt sealing, or per-step runbook aftercare. +- `service-policy-directory` is the non-mutating scheduler coverage sight rite: run it before trusting `service-tick` as whole-swarm recovery. `cluster-service-runbook` is the non-mutating per-organ launch artifact rite; `cluster-service-install-plan` is the non-mutating per-organ Windows install artifact rite; `cluster-service-install-execute`, `cluster-service-start-execute`, and `cluster-service-stop-execute` are elevation-gated execution/refusal rites; `cluster-service-start-plan` and `cluster-service-stop-plan` are non-mutating control previews; `cluster-service-audit` is the read-only installed-service readiness rite; `cluster-service-execution-readiness` is the non-mutating cluster service authority check; `cluster-service-execution-runbook`/`service-execution-runbook` and `cluster-service-execution-audit`/`service-execution-audit` are elevated sequence artifacts plus post-run receipt verifiers, with audits requiring typed runbook witnesses before effect receipts. Run execute paths only with operator authority. Current live liveness and policy coverage are ready, but global overview now correctly recommends `cluster-service-execution-audit`; wrapper audit summaries print the failed sealed checks directly, e.g. readiness `not-elevated`, install/start/stop `execution-refused-not-elevated`, and cluster audit `incomplete`. The execution runbooks now continue after individual step failure, guarantee a final execution-audit attempt through `finally`, exit nonzero after audit if any step failed, and seal the aftercare policy in JSON plus typed receipt args. Latest live overview `local-20260618-161718-889-7cebdcb1` points at the robust cluster runbook artifact `local-20260618-161632-376-436227d8`. The remaining service scar is elevated durable service install/start plus complete audit/readiness for the installed services, not missing daemon heartbeat bodies, launch command shape, install command shape, control command shape, cluster readiness receipt shape, audit verifier shape, non-elevated refusal behavior, audit visibility, overview attention routing, compact failed-check visibility, runbook receipt sealing, or per-step runbook aftercare. - `swarm-poke-down` is the non-elevated swarm liveness reflex to run before deeper service surgery: it pokes every non-ready local Verse daemon through typed receipts and otherwise records a no-op. - `swarm-status` is the non-mutating sight rite to run before `swarm-poke-down`; it shows which daemon rows need a typed poke without opening private Verse state. - `agent-state-soa` is the compact agent-body sight rite: it refreshes the persisted agent-state SoA, mirrors only the sealed summary into local Verse, then reports seven standing-faculty rows through CultMesh SoA columns. diff --git a/state/agents.msgpack b/state/agents.msgpack index 9a2eb1ed084710f8cf4840441aee1daa0693cfb3..478bc3f4b995481948e0bb603652d60dfb5e1a5d 100644 GIT binary patch delta 28 fcmZp#Zm-_($%@s`%*xne@^>o(2y3&Bbu<$Iop%Xt delta 28 fcmZp#Zm-_($%@s$%*w=c@^>o(2y3&Bbu<$Ioi7P! diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 546f6c0aaf3c32c75e6f29574527d7bbd907b45d..8775f1025df6c70bc3252e3f0cb93e48bc77fb9d 100644 GIT binary patch delta 420 zcmY+Au};G<5Qa%SG87>OkQh#aF{-KxmOcVQi|EE?l51iS?DT9Wgax4vJVBKO35kgj z!NAG_Z-4|d15`}#1h{ECFjzX@-GASI_wm|zesA2Zd&})sXLslDWr=;?JZyPG&$}9p z{mZfMx#vHQeb)V|Rwiu4Z?~$SUw@N%_x0JOnOL#U(?($0s& zfQ!@~5C#q{&yW=0sc=T7`I#c9IVQpB#3QAS=N*gw+T=fSk)W*JCTzRsV`sqCaz~ln0)`gJxn6uD;Uc4`tS&}utqFxNiL%C-!O*&m WV!#x0ZrpJ+QZ7P-6KiUmZvFxJ)|_?# delta 45 zcmX?llmGEm{tXh0+y<6bCdN_67?@uk*sRQ0$jCUmc`8%;R3=6sX4*cLiP`T30Dol< A`) for artifact roots and operator run receipts. Same-second parallel compact wrapper proofs for `collaboration-feedback` and `bifrost-publication` produce separate artifact drawers and both complete, so operator rites no longer collide on second-resolution run ids. - `epiphany-verse-query tool-directory` and `tools/epiphany_local_run.ps1 -Mode tool-directory` provide the compact daemon tool sight organ over the same local Verse capability records used by `invoke-tool`. It returns sixteen globally available daemon-hosted capabilities, host readiness counts, agent-friendly TUI rows such as `READY | Hands | repo-action | submitHandsActionIntent | epiphany.cluster.hands.tool.repo-action | eve://epiphany/hands`, direct `invocationCommand`, wrapper `wrapperInvocationCommand=tools/epiphany_local_run.ps1 -Mode tool-invoke -ToolCapabilityId -ToolRequestingAgentId -ToolRequestingClusterId `, and the invariants `availableToAllAgents=true`, `requiresReceipt=true`, `privateStateExposed=false`. - `epiphany-verse-query cluster-topology` and `tools/epiphany_local_run.ps1 -Mode cluster-topology` provide the compact cluster/body/private-Verse/daemon sight organ over local Verse topology rows through a narrow CultMesh loader. The report returns seven clusters, seven private Verse ids, seven daemon ids, one public Persona discussion cluster, agent-friendly TUI rows such as `PUBLIC | Persona | epiphany.cluster.persona.private | repo:E:/Projects/EpiphanyAgent | epiphany-daemon-persona | eve://epiphany/persona`, and `privateStateExposed=false`; `epiphany-verse-query smoke` now source-proves the compact topology invariants. - - `epiphany-verse-query swarm-overview` and `tools/epiphany_local_run.ps1 -Mode swarm-overview` provide the one-command compact global-agent sight rite. It composes narrow cluster topology, liveness, Odin/Eve surface, daemon tool, restart-policy coverage, receipt-directory service-lifecycle attention, and the shared core service-execution audit report without full local Verse serialization, returning seven agents/daemons, seven clusters, seven private Verse ids, seven Eve surfaces, one public Persona discussion surface, sixteen globally invokable receipt-gated tools, command hints for topology/liveness/surfaces/tools/receipts/poke/connect/invoke/Bifrost-ledger/restart-policy coverage, wrapper command hints for overview/receipts/poke/connect/tool-invoke/Bifrost-ledger/service-policy-directory/service-execution-audit, sealed `toolHostAttentionRows`/TUI rows for blocked daemon-hosted capabilities, sealed `serviceLifecycleAttentionRows`/TUI rows copied from the receipt directory, `serviceExecutionFailedCheckRows`/TUI rows naming failed sealed execution checks, explicit `serviceLifecycleRecommended*` fields so service-manager follow-up remains visible even when global `recommendedWrapperMode` is occupied by liveness or policy, and ordered `swarmActionRows`/TUI rows with authority gates, effect class, mutation flag, elevation flag, sealed `operatorArtifactRef`, `operatorArtifactStatus`, and `completionAuditWrapper*` for operator-runbook rows. Current live overview `local-20260618-155606-611-19701102` returns `status=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `recommendedWrapperMode=cluster-service-execution-audit`, `serviceLifecycleRecommendedWrapperMode=cluster-service-execution-audit`, `toolHostAttentionCount=0`, `serviceLifecycleAttentionCount=2`, `swarmActionCount=2`, a non-mutating/non-elevated `priority=40` service lifecycle readback row, and a mutating/elevated `priority=50`, `family=service-execution-authority`, `status=operator-authority-required`, `effectClass=elevated-service-control`, `wrapperMode=operator-elevated-runbook`, `authorityGate=operator.elevated_windows_service_control`, `operatorArtifactStatus=present`, `operatorArtifactRef=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-132257-139-26213a29\epiphany-cluster-daemon-services-execution-runbook.ps1`, `completionAuditWrapperMode=cluster-service-execution-audit`, `completionAuditWrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`, `privateStateExposed=false`, and compact `serviceExecutionFailedChecks=cluster-windows-service-execution-readiness=not-elevated; cluster-windows-service-install=planned; cluster-windows-service-start=execution-refused-not-elevated; cluster-windows-service-execution-audit=incomplete; cluster-windows-service-stop=execution-refused-not-elevated`. If that local artifact is missing, source smoke proves the same row is demoted to `status=runbook-artifact-missing`, `wrapperMode=cluster-service-execution-runbook`, `effectClass=service-lifecycle-runbook-regeneration`, `mutatesState=false`, and `requiresElevatedAuthority=false` instead of pretending elevated service authority is actionable. Degraded daemon overview still routes global recommendation to `swarm-poke-down` first while independent action rows preserve the liveness/tool-host duties; liveness action rows are explicitly mutating typed lifecycle pokes but do not require elevation, while service execution authority rows make the operator grant boundary visible. `epiphany-verse-query` now defaults to the same shared `.epiphany-run\cultmesh\local-verse.ccmp` store as the wrapper and daemon supervisor, so direct and wrapper sights read the same body. + - `epiphany-verse-query swarm-overview` and `tools/epiphany_local_run.ps1 -Mode swarm-overview` provide the one-command compact global-agent sight rite. It composes narrow cluster topology, liveness, Odin/Eve surface, daemon tool, restart-policy coverage, receipt-directory service-lifecycle attention, and the shared core service-execution audit report without full local Verse serialization, returning seven agents/daemons, seven clusters, seven private Verse ids, seven Eve surfaces, one public Persona discussion surface, sixteen globally invokable receipt-gated tools, command hints for topology/liveness/surfaces/tools/receipts/poke/connect/invoke/Bifrost-ledger/restart-policy coverage, wrapper command hints for overview/receipts/poke/connect/tool-invoke/Bifrost-ledger/service-policy-directory/service-execution-audit, sealed `toolHostAttentionRows`/TUI rows for blocked daemon-hosted capabilities, sealed `serviceLifecycleAttentionRows`/TUI rows copied from the receipt directory, `serviceExecutionFailedCheckRows`/TUI rows naming failed sealed execution checks, explicit `serviceLifecycleRecommended*` fields so service-manager follow-up remains visible even when global `recommendedWrapperMode` is occupied by liveness or policy, and ordered `swarmActionRows`/TUI rows with authority gates, effect class, mutation flag, elevation flag, sealed `operatorArtifactRef`, `operatorArtifactStatus`, and `completionAuditWrapper*` for operator-runbook rows. Current live overview `local-20260618-161718-889-7cebdcb1` returns `status=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `recommendedWrapperMode=cluster-service-execution-audit`, `serviceLifecycleRecommendedWrapperMode=cluster-service-execution-audit`, `toolHostAttentionCount=0`, `serviceLifecycleAttentionCount=2`, `swarmActionCount=2`, a non-mutating/non-elevated `priority=40` service lifecycle readback row, and a mutating/elevated `priority=50`, `family=service-execution-authority`, `status=operator-authority-required`, `effectClass=elevated-service-control`, `wrapperMode=operator-elevated-runbook`, `authorityGate=operator.elevated_windows_service_control`, `operatorArtifactStatus=present`, `operatorArtifactRef=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-161632-376-436227d8\epiphany-cluster-daemon-services-execution-runbook.ps1`, `completionAuditWrapperMode=cluster-service-execution-audit`, `completionAuditWrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`, `privateStateExposed=false`, and compact `serviceExecutionFailedChecks=cluster-windows-service-execution-readiness=not-elevated; cluster-windows-service-install=planned; cluster-windows-service-start=execution-refused-not-elevated; cluster-windows-service-execution-audit=incomplete; cluster-windows-service-stop=execution-refused-not-elevated`. If that local artifact is missing, source smoke proves the same row is demoted to `status=runbook-artifact-missing`, `wrapperMode=cluster-service-execution-runbook`, `effectClass=service-lifecycle-runbook-regeneration`, `mutatesState=false`, and `requiresElevatedAuthority=false` instead of pretending elevated service authority is actionable. Degraded daemon overview still routes global recommendation to `swarm-poke-down` first while independent action rows preserve the liveness/tool-host duties; liveness action rows are explicitly mutating typed lifecycle pokes but do not require elevation, while service execution authority rows make the operator grant boundary visible. `epiphany-verse-query` now defaults to the same shared `.epiphany-run\cultmesh\local-verse.ccmp` store as the wrapper and daemon supervisor, so direct and wrapper sights read the same body. - `epiphany-verse-query swarm-triage` and `tools/epiphany_local_run.ps1 -Mode swarm-triage` compose the compact swarm overview with the existing brake-aware daemon poke receipt writer. Triage pokes only daemon liveness attention; service-manager lifecycle wounds are reflected from overview as sealed `serviceLifecycleAttentionRows`/TUI rows, `serviceExecutionFailedCheckRows`/TUI rows, explicit `serviceLifecycleRecommended*` fields, and ordered `swarmActionRows`, but do not cause daemon poke receipts, while blocked daemon-hosted tools ride as sealed `toolHostAttentionRows`/TUI rows so agents can see which advertised capabilities are unavailable because their host body is sick. Current live triage `local-20260618-150015-844-aba20563` returns `status=noop`, `overviewStatus=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `clusterCount=7`, `privateVerseCount=7`, `pokedDaemonCount=0`, `recommendedWrapperMode=cluster-service-execution-audit`, `serviceLifecycleRecommendedWrapperMode=cluster-service-execution-audit`, `swarmActionCount=2`, the same sealed service readback plus operator-elevated runbook rows, including `operatorArtifactStatus=present`, `operatorArtifactRef=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-132257-139-26213a29\epiphany-cluster-daemon-services-execution-runbook.ps1`, and `completionAuditWrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit` on the elevated row, empty daemon/tool-host attention arrays, `serviceLifecycleAttentionCount=2`, routes `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit` and `epiphany-daemon-supervisor-service::windows-service-execution-audit`, direct and wrapper command hints including `wrapperInvokeTool` and `wrapperBifrostLedger=tools/epiphany_local_run.ps1 -Mode bifrost-ledger`, and `privateStateExposed=false`; degraded Hands proof returns `status=ok`, `overviewStatus=attention`, topology and daemon TUI rows, blocked Hands-hosted tool rows, one sealed topology-aware poke receipt for `epiphany-daemon-hands` with `bodyDomain=repo:E:/Projects/EpiphanyAgent`, `privateVerseId=epiphany.cluster.hands.private`, `eveSurfaceId=eve://epiphany/hands`, `observedStatus=degraded`, `attentionDaemonIds=[epiphany-daemon-hands]`, `attentionToolHostDaemonIds=[epiphany-daemon-hands]`, and liveness/tool-host action rows with no private-state exposure. Source smoke `verse-query-service-execution-failed-checks-clean` proves a physical synthetic written runbook plus incomplete service audit receipts expose both service lifecycle readback and failed-check anatomy with no Windows service mutation. - Compact `swarmActionTuiRows` now match the JSON service-execution queue: live artifacts `local-20260618-150449-420-0371c76a` and `local-20260618-150450-027-74d864da` show `050 | service-execution-authority | operator-authority-required | operator-elevated-runbook | operator.elevated_windows_service_control | mutates=true | elevated=true | artifact=present | audit=cluster-service-execution-audit`, while the readback row stays `artifact=none | audit=none`. Source smoke `verse-query-action-tui-audit-smoke` guards this agent-friendly TUI surface. - Receipt directory rows now carry `artifactStatus` beside `artifactRef`, using the same `none` / `external-ref` / `present` / `missing` vocabulary as action rows. Live overview/triage artifacts `local-20260618-150837-267-7fbf22bb` and `local-20260618-150837-466-a6a55086` prove service-manager lifecycle attention refs classify as `external-ref` in JSON and `artifact=external-ref` in service lifecycle TUI rows; source smoke `verse-query-receipt-artifact-status-smoke` guards the compact surface. `epiphany-verse-query receipt-directory` also derives compact artifact counts (`artifactNoneCount`, `artifactExternalRefCount`, `artifactPresentCount`, `artifactMissingCount`) from rows instead of storing a second truth. Live direct readback against `.epiphany-run\cultmesh\local-verse.ccmp` and wrapper artifact `local-20260618-151656-688-a041afcc` both reported `artifactNone=13`, `artifactExternalRef=2`, `artifactPresent=2`, `artifactMissing=0`, and `privateStateExposed=false`; a clean direct empty-store readback reported all 17 rows as `artifactNone`. The earlier all-in-one `epiphany-verse-query smoke` Windows stack overflow was fixed by cutting full `query_epiphany_local_verse_context` out of `load_swarm_overview_report`; overview now reads daemon service lifecycle rows through narrow history/latest loaders. Fresh proof `verse-query-overview-slim-context-clean` passed the full smoke without stack overflow. - Wrapper `swarm-overview` and `swarm-triage` summaries now surface lifecycle receipt `artifactStatus` plus compact service execution failed-check anatomy instead of hiding either inside JSON. Live artifact `local-20260618-155606-611-19701102` shows both service lifecycle attention rows, the operator-elevated runbook row, and `serviceExecutionFailedChecks` naming readiness/install/start/audit/stop status, while private state stays sealed. - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. - next_action: Continue the swarm-readiness cuts toward elevated operator install/start execution and completed audit/readiness for the seven installed services. Run generated service execution/install/control runbooks only when the operator grants that authority. The current local Verse proves liveness readiness, scheduler-policy coverage, daemon-body invocation, per-organ launch artifact generation, per-organ install-plan generation, non-elevated install/start/stop execution refusal, read-only installed-service audit, cluster-wide service control planning, service-lifecycle attention surfacing, and cluster execution audit acceptance criteria: `swarm-overview` now reports `status=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, and `recommendedWrapperMode=cluster-service-execution-audit`; `service-tick` can refresh all seven daemon heartbeats through sealed scheduler receipts; `cluster-service-runbook` writes seven explicit `epiphany-cluster-daemon serve` commands with `privateStateExposed=false`; `cluster-service-install-plan` writes seven distinct Windows service install commands with `privateStateExposed=false`; `cluster-service-install-execute`, `cluster-service-start-execute`, and `cluster-service-stop-execute` refuse as `execution-refused-not-elevated` with `executed=false` when the shell lacks service authority; `cluster-service-start-plan` and `cluster-service-stop-plan` emit seven non-mutating planned rows; `cluster-service-audit` currently reports `incomplete` with seven missing services in this non-installed environment; `service-execution-runbook` and `cluster-service-execution-runbook` write elevated wrapper sequences that continue after per-step failure, run final audits in `finally`, exit nonzero after audit when any step failed, and seal typed runbook receipts; and `service-execution-audit` plus `cluster-service-execution-audit` now require those runbook witnesses before considering elevated-ready/install/start/audit/status/reconcile/stop effect receipts. Preserve the existing typed local Verse surfaces: `service-plan`, `service-launch`, `service-runbook`, `cluster-service-runbook`, `cluster-service-install-plan`, `cluster-service-install-execute`, `cluster-service-audit`, `cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, `cluster-service-stop-execute`, `cluster-service-execution-readiness`, `cluster-service-execution-runbook`, `cluster-service-execution-audit`, `service-execution-runbook`, `service-execution-audit`, `service-tick`, `service-policy-directory`, `agent-state-soa`, `swarm-status`, `swarm-poke-down`, `swarm-triage`, `cluster-topology`, `eve-surfaces`, `eve-connect`, `collaboration-feedback`, `bifrost-publication`, `bifrost-ledger`, `receipt-directory`, `tool-directory`, `tool-invoke`, `swarm-overview`, `seed-compact`, service manager status/reconcile/readiness/control wrappers, compact daemon scheduler/policy receipt rows, daemon liveness-gated tool routing, Bifrost/Imagination chains, coordinator-run receipts, Hands gates, role review mirrors, and sealed agent-state SoA summary. Keep the seven-standing-faculty SoA, stale-turn repair, memory lifecycle, shared local Verse witnesses, and typed CultMesh Persona speech gate intact. + next_action: Continue the swarm-readiness cuts toward elevated operator install/start execution and completed audit/readiness for the seven installed services. Run generated service execution/install/control runbooks only when the operator grants that authority. The current local Verse proves liveness readiness, scheduler-policy coverage, daemon-body invocation, per-organ launch artifact generation, per-organ install-plan generation, non-elevated install/start/stop execution refusal, read-only installed-service audit, cluster-wide service control planning, service-lifecycle attention surfacing, and cluster execution audit acceptance criteria: `swarm-overview` now reports `status=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, and `recommendedWrapperMode=cluster-service-execution-audit`; `service-tick` can refresh all seven daemon heartbeats through sealed scheduler receipts; `cluster-service-runbook` writes seven explicit `epiphany-cluster-daemon serve` commands with `privateStateExposed=false`; `cluster-service-install-plan` writes seven distinct Windows service install commands with `privateStateExposed=false`; `cluster-service-install-execute`, `cluster-service-start-execute`, and `cluster-service-stop-execute` refuse as `execution-refused-not-elevated` with `executed=false` when the shell lacks service authority; `cluster-service-start-plan` and `cluster-service-stop-plan` emit seven non-mutating planned rows; `cluster-service-audit` currently reports `incomplete` with seven missing services in this non-installed environment; `service-execution-runbook` and `cluster-service-execution-runbook` write elevated wrapper sequences that continue after per-step failure, run final audits in `finally`, exit nonzero after audit when any step failed, and seal typed runbook receipts with aftercare args (`stepFailurePolicy`, `continueAfterStepFailure`, `nonzeroExitFailsStep`, `exitsNonzeroAfterFinalAudit`); and `service-execution-audit` plus `cluster-service-execution-audit` now require those runbook witnesses before considering elevated-ready/install/start/audit/status/reconcile/stop effect receipts. Preserve the existing typed local Verse surfaces: `service-plan`, `service-launch`, `service-runbook`, `cluster-service-runbook`, `cluster-service-install-plan`, `cluster-service-install-execute`, `cluster-service-audit`, `cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, `cluster-service-stop-execute`, `cluster-service-execution-readiness`, `cluster-service-execution-runbook`, `cluster-service-execution-audit`, `service-execution-runbook`, `service-execution-audit`, `service-tick`, `service-policy-directory`, `agent-state-soa`, `swarm-status`, `swarm-poke-down`, `swarm-triage`, `cluster-topology`, `eve-surfaces`, `eve-connect`, `collaboration-feedback`, `bifrost-publication`, `bifrost-ledger`, `receipt-directory`, `tool-directory`, `tool-invoke`, `swarm-overview`, `seed-compact`, service manager status/reconcile/readiness/control wrappers, compact daemon scheduler/policy receipt rows, daemon liveness-gated tool routing, Bifrost/Imagination chains, coordinator-run receipts, Hands gates, role review mirrors, and sealed agent-state SoA summary. Keep the seven-standing-faculty SoA, stale-turn repair, memory lifecycle, shared local Verse witnesses, and typed CultMesh Persona speech gate intact. diff --git a/tools/epiphany_local_run.ps1 b/tools/epiphany_local_run.ps1 index ad8c7b14..5fe8c4d8 100644 --- a/tools/epiphany_local_run.ps1 +++ b/tools/epiphany_local_run.ps1 @@ -1733,7 +1733,7 @@ if ($resultPath -ne "" -and (Test-Path -LiteralPath $resultPath)) { } elseif ($Mode -eq "cluster-service-execution-readiness") { Write-Host "Cluster daemon service execution readiness: service=$($result.serviceId), daemons=$($result.daemonCount), services=$($result.serviceCount), status=$($result.status), elevated=$($result.elevated), receipt=$($result.receiptId)" } elseif ($Mode -eq "cluster-service-execution-runbook") { - Write-Host "Cluster daemon service execution runbook: service=$($result.serviceId), status=$($result.status), finalAuditInFinally=$($result.finalAuditRunsInFinally), path=$($result.runbookPath)" + Write-Host "Cluster daemon service execution runbook: service=$($result.serviceId), status=$($result.status), finalAuditInFinally=$($result.finalAuditRunsInFinally), continueAfterStepFailure=$($result.continueAfterStepFailure), nonzeroExitFailsStep=$($result.nonzeroExitFailsStep), exitsNonzeroAfterFinalAudit=$($result.exitsNonzeroAfterFinalAudit), path=$($result.runbookPath)" } elseif ($Mode -eq "cluster-service-execution-audit") { Write-Host "Cluster daemon service execution audit: service=$($result.serviceId), status=$($result.status), missing=$($result.missingCount), failed=$($result.failedCount), receipt=$($result.receiptId)" $failedChecks = @($result.checks | Where-Object { -not $_.ok }) @@ -1748,7 +1748,7 @@ if ($resultPath -ne "" -and (Test-Path -LiteralPath $resultPath)) { Write-Host "Cluster daemon service execution failed checks: $failedSummary" } } elseif ($Mode -eq "service-execution-runbook") { - Write-Host "Service execution runbook: service=$($result.serviceId), name=$($result.serviceName), status=$($result.status), path=$($result.runbookPath)" + Write-Host "Service execution runbook: service=$($result.serviceId), name=$($result.serviceName), status=$($result.status), finalAuditInFinally=$($result.finalAuditRunsInFinally), continueAfterStepFailure=$($result.continueAfterStepFailure), nonzeroExitFailsStep=$($result.nonzeroExitFailsStep), exitsNonzeroAfterFinalAudit=$($result.exitsNonzeroAfterFinalAudit), path=$($result.runbookPath)" } elseif ($Mode -eq "service-install-plan" -or $Mode -eq "service-install-execute") { Write-Host "Service install: service=$($result.serviceId), name=$($result.serviceName), status=$($result.status), executed=$($result.executed), receipt=$($result.receiptId), path=$($result.installScriptPath)" } elseif ($Mode -eq "service-status") {