diff --git a/epiphany-core/src/bin/epiphany-daemon-supervisor.rs b/epiphany-core/src/bin/epiphany-daemon-supervisor.rs index 33c6e499..e0b1c37c 100644 --- a/epiphany-core/src/bin/epiphany-daemon-supervisor.rs +++ b/epiphany-core/src/bin/epiphany-daemon-supervisor.rs @@ -11,6 +11,7 @@ use epiphany_core::EpiphanyCultMeshDaemonRestartPolicyEntry; use epiphany_core::EpiphanyCultMeshDaemonSchedulerReceiptEntry; use epiphany_core::EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry; use epiphany_core::EpiphanyCultMeshManagedServicePolicyEntry; +use epiphany_core::EpiphanyCultMeshSwarmBrakeEntry; use epiphany_core::EpiphanyCultMeshDaemonStatusEntry; use epiphany_core::EpiphanyLocalVerseContext; use epiphany_core::EpiphanyServiceExecutionAuditReport; @@ -21,6 +22,8 @@ use epiphany_core::epiphany_service_execution_audit_report; use epiphany_core::load_epiphany_cultmesh_daemon_restart_policy; use epiphany_core::load_epiphany_cultmesh_daemon_service_lifecycle_receipts; use epiphany_core::load_epiphany_cultmesh_managed_service_policy; +use epiphany_core::load_epiphany_cultmesh_managed_service_policies; +use epiphany_core::load_epiphany_cultmesh_swarm_brake; use epiphany_core::query_epiphany_local_verse_context; use epiphany_core::seed_epiphany_local_verse_context; use epiphany_core::write_epiphany_cultmesh_daemon_poke_intent; @@ -49,6 +52,7 @@ fn main() -> Result<()> { "reconcile" | "poke" | "restart" => reconcile(args), "tick" | "schedule" | "reconcile-all" => tick(args), "serve" | "loop" | "daemon" => serve(args), + "managed-service-serve" | "service-desired-state-serve" => managed_service_serve(args), "service-plan" | "install-service" => service_plan(args), "service-launch" | "launch-service" | "start-service" => service_launch(args), "managed-service-policy" | "service-desired-state" => managed_service_policy(args), @@ -182,14 +186,40 @@ fn serve(args: Args) -> Result<()> { Ok(()) } +fn managed_service_serve(args: Args) -> Result<()> { + let mut iteration = 0_u64; + loop { + iteration = iteration.saturating_add(1); + let policies = load_epiphany_cultmesh_managed_service_policies( + &args.store, + args.runtime_id.clone(), + )?; + for policy in &policies { + let mut service_args = args.clone(); + service_args.service_id = policy.service_id.clone(); + managed_service_reconcile(service_args)?; + } + println!("{}", serde_json::to_string_pretty(&json!({ + "schemaVersion": "epiphany.cultmesh.managed_service_scheduler_pulse.v0", + "status": "completed", + "owner": "Idunn", + "iteration": iteration, + "policyCount": policies.len(), + "privateStateExposed": false, + }))?); + if args.max_iterations != 0 && iteration >= args.max_iterations { + break; + } + std::thread::sleep(std::time::Duration::from_secs( + args.loop_interval_seconds.max(0) as u64, + )); + } + Ok(()) +} + fn service_plan(args: Args) -> Result<()> { - seed_epiphany_local_verse_context( - &args.store, - args.runtime_id.clone(), - Utc::now().to_rfc3339(), - )?; - let context = query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?; - assert_swarm_brake_allows_service_lifecycle(&context)?; + let brake = load_epiphany_cultmesh_swarm_brake(&args.store, args.runtime_id.clone())?; + assert_swarm_brake_allows_service_lifecycle_entry(brake.as_ref())?; let started_at = Utc::now(); let command = service_command_path(&args)?; let service_args = service_serve_args(&args); @@ -227,13 +257,8 @@ fn service_plan(args: Args) -> Result<()> { } fn service_launch(args: Args) -> Result<()> { - seed_epiphany_local_verse_context( - &args.store, - args.runtime_id.clone(), - Utc::now().to_rfc3339(), - )?; - let context = query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?; - assert_swarm_brake_allows_service_lifecycle(&context)?; + let brake = load_epiphany_cultmesh_swarm_brake(&args.store, args.runtime_id.clone())?; + assert_swarm_brake_allows_service_lifecycle_entry(brake.as_ref())?; if !args.required_document_types.is_empty() && (!args.schema_preflight_passed || args.executable_sha256.as_deref().is_none_or(str::is_empty) @@ -3424,7 +3449,13 @@ fn assert_swarm_brake_allows_scheduler_tick(context: &EpiphanyLocalVerseContext) } fn assert_swarm_brake_allows_service_lifecycle(context: &EpiphanyLocalVerseContext) -> Result<()> { - let Some(brake) = context.swarm_brake.as_ref() else { + assert_swarm_brake_allows_service_lifecycle_entry(context.swarm_brake.as_ref()) +} + +fn assert_swarm_brake_allows_service_lifecycle_entry( + brake: Option<&EpiphanyCultMeshSwarmBrakeEntry>, +) -> Result<()> { + let Some(brake) = brake else { return Ok(()); }; if brake.status != "engaged" { @@ -3462,6 +3493,7 @@ struct RestartOutput { stderr_len: usize, } +#[derive(Clone)] struct Args { command: String, store: PathBuf, @@ -3744,6 +3776,8 @@ impl Args { | "serve" | "loop" | "daemon" + | "managed-service-serve" + | "service-desired-state-serve" | "service-plan" | "install-service" | "service-launch" diff --git a/epiphany-core/src/cultmesh_integration.rs b/epiphany-core/src/cultmesh_integration.rs index 270802da..39ac682e 100644 --- a/epiphany-core/src/cultmesh_integration.rs +++ b/epiphany-core/src/cultmesh_integration.rs @@ -3665,6 +3665,18 @@ pub fn load_epiphany_cultmesh_managed_service_policy( node.get(&epiphany_cultmesh_managed_service_policy_key(service_id)) } +pub fn load_epiphany_cultmesh_managed_service_policies( + store_path: impl AsRef, + runtime_id: impl Into, +) -> Result> { + let node = open_epiphany_cultmesh_node(store_path, runtime_id)?; + Ok(node + .get_all_with_keys::()? + .into_iter() + .map(|(_, policy)| policy) + .collect()) +} + pub fn write_epiphany_cultmesh_idunn_deployment_receipt( store_path: impl AsRef, runtime_id: impl Into, diff --git a/epiphany-core/src/lib.rs b/epiphany-core/src/lib.rs index fc0b78aa..97d5d36f 100644 --- a/epiphany-core/src/lib.rs +++ b/epiphany-core/src/lib.rs @@ -416,6 +416,7 @@ pub use cultmesh_integration::load_epiphany_cultmesh_daemon_restart_policy; pub use cultmesh_integration::load_epiphany_cultmesh_daemon_restart_policy_directory; pub use cultmesh_integration::load_epiphany_cultmesh_daemon_service_lifecycle_receipts; pub use cultmesh_integration::load_epiphany_cultmesh_managed_service_policy; +pub use cultmesh_integration::load_epiphany_cultmesh_managed_service_policies; pub use cultmesh_integration::load_epiphany_cultmesh_daemon_tool_directory; pub use cultmesh_integration::load_epiphany_cultmesh_eve_surface_directory; pub use cultmesh_integration::load_epiphany_cultmesh_idunn_aftercare_audit_receipt; diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index a6e46901..4bb2b73a 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -387,6 +387,17 @@ proved restart receipt and PID `19736` were observed alive after the prior process was killed. Next fold this reconcile into Idunn's own serve loop and cut the full-context Verse load from service launch. +Both cuts are landed. Service plan/launch now load only the typed swarm brake +and rely on their own typed writers to open/register the store; they do not +reseed or serialize the local Verse. `managed-service-serve` is a distinct Idunn +loop from standing-daemon `serve`, so child service desired state is not blocked +by absent topology restart policies. Live root +`C:\Users\Meta\AppData\Local\Temp\epiphany-idunn-unattended-3394ecfaa03f41d8935f9fb70411ca75` +proved PID `44276` was observed alive without duplication, then after forced +death the next pulse launched PID `40532` under unique receipt +`daemon-service-lifecycle-receipt-idunn-managed-heartbeat-launch-1783859054234`. +The next boundary is Gjallar/Eve sight over managed service desired/observed +state. This map must change when ownership changes. Historical scars belong in git, evidence, or an explicitly archived note—not in the machine's proprioception. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 3c680e45..6da637f9 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -2229,6 +2229,18 @@ the test harness then killed it deliberately. The first combined smoke exceeded its harness window because `service_launch` loads the entire local Verse merely to inspect the swarm brake. Next use the narrow brake loader and integrate managed-service reconcile into Idunn's native serve scheduler. +That unattended boundary is complete. Service launch/plan now use the narrow +swarm-brake loader and no full Verse seed/query. A separate +`managed-service-serve` scheduler enumerates service-id policies without +requiring standing-daemon restart policies. Live root +`C:\Users\Meta\AppData\Local\Temp\epiphany-idunn-unattended-3394ecfaa03f41d8935f9fb70411ca75` +proved one pulse observed PID `44276` alive without a new receipt; after the +test harness killed it, the next pulse restarted heartbeat as PID `40532` with +unique receipt +`daemon-service-lifecycle-receipt-idunn-managed-heartbeat-launch-1783859054234`. +The same heartbeat store survived and no child remains running. Next expose +compact managed-service policy/lifecycle/process rows through Gjallar/Eve so +operators can see Idunn physiology without invoking the supervisor CLI. ## Immediate Re-entry Instruction diff --git a/notes/perfect-machine-audit-roadmap.md b/notes/perfect-machine-audit-roadmap.md index cd1b435f..3bcf8078 100644 --- a/notes/perfect-machine-audit-roadmap.md +++ b/notes/perfect-machine-audit-roadmap.md @@ -162,6 +162,15 @@ Reconciliation is complete as an explicit Idunn command. The remaining unattended boundary is to include managed-service reconciliation in Idunn's native `serve` scheduler and replace `service-launch`'s full local-Verse context load with the narrow swarm-brake query it actually needs. +That boundary is now complete. Service plan/launch use the narrow typed brake +loader and no longer reseed the full local Verse. A dedicated +`managed-service-serve` loop enumerates only managed-service policies and runs +their reconcile reflex independently of standing-daemon topology. Live proof +observed a heartbeat alive without duplicate launch, killed it, and the next +Idunn pulse restarted it from the same store with a distinct PID and immutable +lifecycle receipt. The next gap is inspectability: publish compact managed +service desired/observed rows through Gjallar/Eve without opening command +payloads or routine artifacts. ### Forbidden writers diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 018a00cc..a9a943af 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index b13d20cb..ea7ae01a 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -659,4 +659,4 @@ current_status: - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. Gjallar readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - next_action: Make managed heartbeat restart genuinely unattended. Replace `service_launch`'s full local-Verse context load with the narrow swarm-brake loader, then integrate managed-service policy reconciliation into Idunn's native `serve` scheduler. Prove the scheduler observes a live heartbeat without duplication, restarts it after death with a unique lifecycle receipt, and preserves the heartbeat store without duplicate pending turns. + next_action: Make Idunn managed-service physiology visible through the organism's interface layer. Add compact Gjallar/Eve managed-service rows from typed policy plus latest lifecycle plus native process observation, showing desired enabled/restart mode, observed alive/dead/missing, last receipt, heartbeat pulse artifact/status, and private-state seal without exposing command arguments or routine payloads.