Run managed services under Idunn scheduler

epiphany-core/src/bin/epiphany-daemon-supervisor.rs

@@ -11,6 +11,7 @@ use epiphany_core::EpiphanyCultMeshDaemonRestartPolicyEntry;
 use epiphany_core::EpiphanyCultMeshDaemonSchedulerReceiptEntry;
 use epiphany_core::EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry;
 use epiphany_core::EpiphanyCultMeshManagedServicePolicyEntry;
+use epiphany_core::EpiphanyCultMeshSwarmBrakeEntry;
 use epiphany_core::EpiphanyCultMeshDaemonStatusEntry;
 use epiphany_core::EpiphanyLocalVerseContext;
 use epiphany_core::EpiphanyServiceExecutionAuditReport;
@@ -21,6 +22,8 @@ use epiphany_core::epiphany_service_execution_audit_report;
 use epiphany_core::load_epiphany_cultmesh_daemon_restart_policy;
 use epiphany_core::load_epiphany_cultmesh_daemon_service_lifecycle_receipts;
 use epiphany_core::load_epiphany_cultmesh_managed_service_policy;
+use epiphany_core::load_epiphany_cultmesh_managed_service_policies;
+use epiphany_core::load_epiphany_cultmesh_swarm_brake;
 use epiphany_core::query_epiphany_local_verse_context;
 use epiphany_core::seed_epiphany_local_verse_context;
 use epiphany_core::write_epiphany_cultmesh_daemon_poke_intent;
@@ -49,6 +52,7 @@ fn main() -> Result<()> {
         "reconcile" | "poke" | "restart" => reconcile(args),
         "tick" | "schedule" | "reconcile-all" => tick(args),
         "serve" | "loop" | "daemon" => serve(args),
+        "managed-service-serve" | "service-desired-state-serve" => managed_service_serve(args),
         "service-plan" | "install-service" => service_plan(args),
         "service-launch" | "launch-service" | "start-service" => service_launch(args),
         "managed-service-policy" | "service-desired-state" => managed_service_policy(args),
@@ -182,14 +186,40 @@ fn serve(args: Args) -> Result<()> {
     Ok(())
 }
 
+fn managed_service_serve(args: Args) -> Result<()> {
+    let mut iteration = 0_u64;
+    loop {
+        iteration = iteration.saturating_add(1);
+        let policies = load_epiphany_cultmesh_managed_service_policies(
+            &args.store,
+            args.runtime_id.clone(),
+        )?;
+        for policy in &policies {
+            let mut service_args = args.clone();
+            service_args.service_id = policy.service_id.clone();
+            managed_service_reconcile(service_args)?;
+        }
+        println!("{}", serde_json::to_string_pretty(&json!({
+            "schemaVersion": "epiphany.cultmesh.managed_service_scheduler_pulse.v0",
+            "status": "completed",
+            "owner": "Idunn",
+            "iteration": iteration,
+            "policyCount": policies.len(),
+            "privateStateExposed": false,
+        }))?);
+        if args.max_iterations != 0 && iteration >= args.max_iterations {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_secs(
+            args.loop_interval_seconds.max(0) as u64,
+        ));
+    }
+    Ok(())
+}
+
 fn service_plan(args: Args) -> Result<()> {
-    seed_epiphany_local_verse_context(
-        &args.store,
-        args.runtime_id.clone(),
-        Utc::now().to_rfc3339(),
-    )?;
-    let context = query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?;
-    assert_swarm_brake_allows_service_lifecycle(&context)?;
+    let brake = load_epiphany_cultmesh_swarm_brake(&args.store, args.runtime_id.clone())?;
+    assert_swarm_brake_allows_service_lifecycle_entry(brake.as_ref())?;
     let started_at = Utc::now();
     let command = service_command_path(&args)?;
     let service_args = service_serve_args(&args);
@@ -227,13 +257,8 @@ fn service_plan(args: Args) -> Result<()> {
 }
 
 fn service_launch(args: Args) -> Result<()> {
-    seed_epiphany_local_verse_context(
-        &args.store,
-        args.runtime_id.clone(),
-        Utc::now().to_rfc3339(),
-    )?;
-    let context = query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?;
-    assert_swarm_brake_allows_service_lifecycle(&context)?;
+    let brake = load_epiphany_cultmesh_swarm_brake(&args.store, args.runtime_id.clone())?;
+    assert_swarm_brake_allows_service_lifecycle_entry(brake.as_ref())?;
     if !args.required_document_types.is_empty()
         && (!args.schema_preflight_passed
             || args.executable_sha256.as_deref().is_none_or(str::is_empty)
@@ -3424,7 +3449,13 @@ fn assert_swarm_brake_allows_scheduler_tick(context: &EpiphanyLocalVerseContext)
 }
 
 fn assert_swarm_brake_allows_service_lifecycle(context: &EpiphanyLocalVerseContext) -> Result<()> {
-    let Some(brake) = context.swarm_brake.as_ref() else {
+    assert_swarm_brake_allows_service_lifecycle_entry(context.swarm_brake.as_ref())
+}
+
+fn assert_swarm_brake_allows_service_lifecycle_entry(
+    brake: Option<&EpiphanyCultMeshSwarmBrakeEntry>,
+) -> Result<()> {
+    let Some(brake) = brake else {
         return Ok(());
     };
     if brake.status != "engaged" {
@@ -3462,6 +3493,7 @@ struct RestartOutput {
     stderr_len: usize,
 }
 
+#[derive(Clone)]
 struct Args {
     command: String,
     store: PathBuf,
@@ -3744,6 +3776,8 @@ impl Args {
                     | "serve"
                     | "loop"
                     | "daemon"
+                    | "managed-service-serve"
+                    | "service-desired-state-serve"
                     | "service-plan"
                     | "install-service"
                     | "service-launch"

epiphany-core/src/cultmesh_integration.rs

@@ -3665,6 +3665,18 @@ pub fn load_epiphany_cultmesh_managed_service_policy(
     node.get(&epiphany_cultmesh_managed_service_policy_key(service_id))
 }
 
+pub fn load_epiphany_cultmesh_managed_service_policies(
+    store_path: impl AsRef<Path>,
+    runtime_id: impl Into<String>,
+) -> Result<Vec<EpiphanyCultMeshManagedServicePolicyEntry>> {
+    let node = open_epiphany_cultmesh_node(store_path, runtime_id)?;
+    Ok(node
+        .get_all_with_keys::<EpiphanyCultMeshManagedServicePolicyEntry>()?
+        .into_iter()
+        .map(|(_, policy)| policy)
+        .collect())
+}
+
 pub fn write_epiphany_cultmesh_idunn_deployment_receipt(
     store_path: impl AsRef<Path>,
     runtime_id: impl Into<String>,

epiphany-core/src/lib.rs

@@ -416,6 +416,7 @@ pub use cultmesh_integration::load_epiphany_cultmesh_daemon_restart_policy;
 pub use cultmesh_integration::load_epiphany_cultmesh_daemon_restart_policy_directory;
 pub use cultmesh_integration::load_epiphany_cultmesh_daemon_service_lifecycle_receipts;
 pub use cultmesh_integration::load_epiphany_cultmesh_managed_service_policy;
+pub use cultmesh_integration::load_epiphany_cultmesh_managed_service_policies;
 pub use cultmesh_integration::load_epiphany_cultmesh_daemon_tool_directory;
 pub use cultmesh_integration::load_epiphany_cultmesh_eve_surface_directory;
 pub use cultmesh_integration::load_epiphany_cultmesh_idunn_aftercare_audit_receipt;

notes/epiphany-current-algorithmic-map.md

@@ -387,6 +387,17 @@ proved restart receipt
 and PID `19736` were observed alive after the prior process was killed. Next
 fold this reconcile into Idunn's own serve loop and cut the full-context Verse
 load from service launch.
+Both cuts are landed. Service plan/launch now load only the typed swarm brake
+and rely on their own typed writers to open/register the store; they do not
+reseed or serialize the local Verse. `managed-service-serve` is a distinct Idunn
+loop from standing-daemon `serve`, so child service desired state is not blocked
+by absent topology restart policies. Live root
+`C:\Users\Meta\AppData\Local\Temp\epiphany-idunn-unattended-3394ecfaa03f41d8935f9fb70411ca75`
+proved PID `44276` was observed alive without duplication, then after forced
+death the next pulse launched PID `40532` under unique receipt
+`daemon-service-lifecycle-receipt-idunn-managed-heartbeat-launch-1783859054234`.
+The next boundary is Gjallar/Eve sight over managed service desired/observed
+state.
 
 This map must change when ownership changes. Historical scars belong in git,
 evidence, or an explicitly archived note—not in the machine's proprioception.

notes/fresh-workspace-handoff.md

@@ -2229,6 +2229,18 @@ the test harness then killed it deliberately. The first combined smoke exceeded
 its harness window because `service_launch` loads the entire local Verse merely
 to inspect the swarm brake. Next use the narrow brake loader and integrate
 managed-service reconcile into Idunn's native serve scheduler.
+That unattended boundary is complete. Service launch/plan now use the narrow
+swarm-brake loader and no full Verse seed/query. A separate
+`managed-service-serve` scheduler enumerates service-id policies without
+requiring standing-daemon restart policies. Live root
+`C:\Users\Meta\AppData\Local\Temp\epiphany-idunn-unattended-3394ecfaa03f41d8935f9fb70411ca75`
+proved one pulse observed PID `44276` alive without a new receipt; after the
+test harness killed it, the next pulse restarted heartbeat as PID `40532` with
+unique receipt
+`daemon-service-lifecycle-receipt-idunn-managed-heartbeat-launch-1783859054234`.
+The same heartbeat store survived and no child remains running. Next expose
+compact managed-service policy/lifecycle/process rows through Gjallar/Eve so
+operators can see Idunn physiology without invoking the supervisor CLI.
 
 ## Immediate Re-entry Instruction
 

notes/perfect-machine-audit-roadmap.md

@@ -162,6 +162,15 @@ Reconciliation is complete as an explicit Idunn command. The remaining
 unattended boundary is to include managed-service reconciliation in Idunn's
 native `serve` scheduler and replace `service-launch`'s full local-Verse context
 load with the narrow swarm-brake query it actually needs.
+That boundary is now complete. Service plan/launch use the narrow typed brake
+loader and no longer reseed the full local Verse. A dedicated
+`managed-service-serve` loop enumerates only managed-service policies and runs
+their reconcile reflex independently of standing-daemon topology. Live proof
+observed a heartbeat alive without duplicate launch, killed it, and the next
+Idunn pulse restarted it from the same store with a distinct PID and immutable
+lifecycle receipt. The next gap is inspectability: publish compact managed
+service desired/observed rows through Gjallar/Eve without opening command
+payloads or routine artifacts.
 
 ### Forbidden writers
 

state/map.yaml

@@ -659,4 +659,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. Gjallar readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Make managed heartbeat restart genuinely unattended. Replace `service_launch`'s full local-Verse context load with the narrow swarm-brake loader, then integrate managed-service policy reconciliation into Idunn's native `serve` scheduler. Prove the scheduler observes a live heartbeat without duplication, restarts it after death with a unique lifecycle receipt, and preserves the heartbeat store without duplicate pending turns.
+  next_action: Make Idunn managed-service physiology visible through the organism's interface layer. Add compact Gjallar/Eve managed-service rows from typed policy plus latest lifecycle plus native process observation, showing desired enabled/restart mode, observed alive/dead/missing, last receipt, heartbeat pulse artifact/status, and private-state seal without exposing command arguments or routine payloads.