Record Ox16 repository authority cut

notes/epiphany-current-algorithmic-map.md

@@ -1,8 +1,8 @@
 # Epiphany current algorithmic map
 
-Updated: 2026-08-22
-Latest committed implementation cut: `e046a4d1` on `codex/epiphany-shakedown-live`
-Current worktree cut: replayable admission-refusal documentation and evidence reconciliation
+Updated: 2026-08-23
+Latest committed implementation cut: `5b799b12` on `codex/epiphany-shakedown-live`
+Current worktree cut: Ox16 scope-authority reconciliation and Ox17 preparation
 
 This document describes the live machine. Historical cuts, rejected paths, and
 proof chronology belong in git, `state/ledgers.msgpack`, and bounded smoke
@@ -42,7 +42,7 @@ interface authority.
 | Modeling | Body basis, keyed RepoModel view, verified consequences, and explicit proposals | typed graph/frontier mutations | Modeling processes the Body directly and owns no external-source permission. |
 | Hands | adopted route/plan plus exact capability receipts | typed consequences | A claimed intention is not a consequence. |
 | Soul | exact consequence and invariant/evidence obligations | verification audit or refusal | Work is not true merely because it ran. |
-| Persona | unread typed social/relationship state plus exact Persona projection | typed effects, speech intent, and consequence receipts | Persona work cannot block unrelated Hands or Modeling documents. |
+| Persona | unread typed social/relationship state plus exact Persona projection and one explicit service turn budget | typed effects, speech intent, consequence receipts, or exact typed failure | Persona owns its outer pass deadline; provider transport owns no competing timeout policy, and Persona work cannot block unrelated Hands or Modeling documents. |
 | CultMesh/Eve | typed provider-owned documents and deterministic views | private/local/public projections | Visibility and rendering never create authority. |
 
 External lifecycle boundary: Idunn remains available when Epiphany is missing,
@@ -118,6 +118,14 @@ Provider credentials remain deployment-substrate inputs. Yggdrasil injects the
 OpenRouter key through systemd `LoadCredential`; readiness is checked inside
 Resident Self's mount namespace. The key is neither prompt cargo nor Mind state.
 
+Persona and worker passes use the same provider boundary but keep family-owned
+execution budgets. Workers already wrap the complete typed pass in their outer
+budget and therefore lower provider transport with no independent request
+timeout. Exact `3b958a83` gives Persona the same ownership shape through its
+explicit `--turn-timeout-seconds` service input, defaulting to 600 seconds. The
+inner provider transport receives no second timer. Provider-specific error text
+is also removed from the shared transport failure surface.
+
 Structured decisions are authoritative; token streams and assistant deltas are
 optional retention. A model-backed failure is also a typed terminal decision
 record. Generic diagnostic model runs cannot produce Mind-admissible decisions.
@@ -319,17 +327,14 @@ same durable records before and after archival.
 
 ## Verification and open gates
 
-Accepted through the local `e046a4d1` source boundary:
+Accepted through the local `5b799b12` source boundary:
 
-- every Epiphany core target compiles;
-- core library `491/491`;
-- OpenAI runtime library `25/25`;
-- model-runtime binary `10/10`;
-- OpenAI-runtime binary `10/10`.
-- Persona service `1/1`.
-- tool runtime `14/14`, with the explicitly live immutable-GitHub test ignored.
-- release construction `21/21`.
-- all core targets compile; generic role-patch source guards pass.
+- core library `494/494`;
+- OpenAI runtime library `26/26`;
+- model-runtime binary `13/13`;
+- coordinator binary `12/12`;
+- swarm binary `10/10`;
+- core and OpenAI runtime libraries compile natively through the shared target.
 - authenticated Persona re-entry refuses naked typed input, performs no
   external observation or model call, and preserves the exact three-stage
   decision chain;
@@ -346,6 +351,11 @@ Accepted through the local `e046a4d1` source boundary:
 - proposal retry receives the ordered exact prior refusals. Claim/node
   identities cannot masquerade as frontier dependency identities in the output
   contract. Successful model transport remains distinct from Mind admission;
+- `repository_scope` is now the explicit sorted repository-relative ceiling for
+  future Planning and Hands consequences. Inspected files and evidence sources
+  remain separate audit cargo. The shared RepoModel validator refuses invalid
+  routed scope before any keyed graph document is written; Hands receives only
+  the adopted narrowing as `authorized_paths`;
 - `epiphany-model-runtime audit-decision` reconstructs an exact terminal pass
   from typed durable records only; the query is byte-for-byte read-only and
   remains complete after live worker result retirement.
@@ -367,16 +377,15 @@ Accepted through the local `e046a4d1` source boundary:
   and remains a sealed immutable package. A foreign-target helper interrupted
   candidate deployment; exact rollback restored d2ca and prevented false
   admission. Production units are inactive and deployment.env is absent;
-- Mind epoch v3 and runtime spine v4 refuse prior writable stores without
-  mutation.
+- Mind epoch v4, runtime spine v5, and RepoModel epoch v2 refuse prior writable
+  stores without mutation or a dual-read path.
+- Persona production source has one outer turn deadline, no hidden provider
+  request deadline, and focused provider/runtime suites pass.
 
 Open before Model Atlas Gate 1 resumes:
 
-1. compile, test, and seal exact build-affecting source `e046a4d1` through
-   Idunn only when no other target helper is active. Idunn needs a host-wide
-   deployment-transaction mutex before cross-target production promotion is
-   considered safe;
-2. use that exact package in a new private fresh-store Ox root; stop after three
+1. let Idunn compile, test, and seal exact build-affecting source `5b799b12`;
+2. use that exact package in private fresh-store Ox17; stop after three
    provider failures total, and prove direct Body Modeling, typed
    refusal-to-retry if exercised, Hands through Verification, exact context
    audit, and restart/re-entry without public speech;
@@ -404,6 +413,49 @@ refused the absent dependency and changed no graph document. Exact `e046a4d1`
 makes that refusal durable and retryable. Its epoch cut means Ox12 remains
 inactive and must never be resumed.
 
+Ox13 is historical evidence under
+`/var/lib/gamecult/epiphany/capstones/ox13-85061129`. Exact `85061129` passed
+Idunn's full Yggdrasil gate, then the fresh root launched Persona concurrently
+with direct Body Modeling and no Eyes result. Body Modeling and Imagination
+admitted. Proposal Modeling attempt 0 completed but repeated the claim/frontier
+dependency mistake; exact `e046a4d1` wrote a typed admission-refusal document
+plus commit receipt and minted attempt 1, which then completed with corrected
+semantics. The transcript-free audit for attempt 0 is retained at
+`proofs/proposal-attempt-0-audit.json`, SHA-256
+`b8346c676a0aedadc9004620a28479a2dddd63a3bca487a952177e8aee6ba36a`.
+Persona exposed a separate split timeout owner: its provider transport still
+hardcoded 90 seconds while workers used one outer 600-second budget. A stop
+race allowed four exact projector failures, all context-bound and carrying no
+Mind commit. No Hands mutation or public speech occurred. Ox13 is braked,
+inactive, and must not resume. Later fresh roots run Persona without a systemd
+restart loop so provider failure counts remain exact.
+
+Ox15 is historical fresh-store evidence for the Persona deadline cut. Persona
+no longer failed at the old inner transport timer, but the repository lane
+exposed a stale-currentness mistake in proposal handling. That fault was cut by
+making historical proposal direction proof independent of later disjoint
+RepoModel changes. Ox15 is sealed and must not resume.
+
+Ox16 is historical evidence under
+`/var/lib/gamecult/epiphany/capstones/ox16-749d977e`. Exact `749d977e` launched
+direct Body Modeling without Eyes while Persona's projector/persona/interpreter
+stages ran concurrently; no public delivery succeeded. Body and proposal
+decisions survived later disjoint RepoModel changes as intended. Planning then
+remained structurally unavailable because the admitted active Imagination
+frontier carried inspected evidence paths as its supposed future path scope,
+omitted the requested `OX-CAPSTONE.md` output, and was not lexicographically
+canonical. The root frontier's `sourceScopeValid=false` generated dependent
+proposal pressure, so the run was braked and sealed before a proposal forest
+could grow. No Hands consequence or capstone marker exists. Exact decision
+audit retained the typed Body result and context without consulting a
+transcript. Ox16 must never resume.
+
+Exact `5b799b12` makes the Ox16 diagnosis a hard schema cut rather than prompt
+penance: `source_scope`/`sourceScope` are deleted, `repository_scope` owns the
+future repository consequence ceiling, `authorized_paths` is the adopted Hands
+narrowing, and the graph validator owns canonical scope admission. Mind/runtime/
+RepoModel epochs advance to v4/v5/v2.
+
 Historical c011 and partial Gate roots remain read-only. The pre-upgrade
 Yggdrasil's old capacity/topology is obsolete; the upgraded 16-vCPU host is the
 intended swarm and CI/CD body. Idunn owns the installed Epiphany source-change

notes/epiphany-fork-implementation-plan.md

@@ -471,6 +471,36 @@ Cut in this order:
    frontier dependencies are distinct in the output contract. Mind/runtime and
    proposal-context epochs cut to v3/v4/v2, so Ox12 is historical evidence and
    a new fresh-store capstone is mandatory.
+32. **Persona owns one outer turn deadline at `3b958a83`:** packaged Ox13
+   proved the admission-refusal lifecycle, then four exact Persona projector
+   failures exposed a separate 90-second timeout hidden inside the shared
+   provider transport. Persona service now accepts one explicit
+   `--turn-timeout-seconds` budget, defaults it to 600 seconds, wraps the whole
+   native pass once, and lowers provider transport with no independent request
+   timer. The shared transport error no longer impersonates an OpenAI-direct
+   path when OpenRouter owns the request. Ox13 is historical; later fresh roots
+   use a non-restarting Persona unit so provider failure counts remain exact.
+33. **Proposal semantics stay inside admission at `8812945e`:** proposal
+   current-work does not grow a second rules tribunal for model-authored graph
+   operations. The existing family mutation planner and generic RepoModel
+   validator remain the semantic owners; refusal is durable typed state and a
+   fresh pass receives the exact prior refusal.
+34. **Historical direction proof is not current-work authority at `749d977e`:**
+   a completed admitted-direction decision remains valid evidence for the
+   proposal it created even when later disjoint RepoModel documents change.
+   Current work is still projected from unresolved typed obligations, not from
+   an aggregate model freshness comparison. Ox16 proved this cut in package
+   reality before exposing the separate path-scope fault.
+35. **Repository consequence authority is explicit at `5b799b12`:** the old
+   `source_scope` name conflated evidence provenance with future write
+   authority. The hard cut replaces it with `repository_scope`, names the
+   adopted Hands narrowing `authorized_paths`, and makes generic RepoModel
+   validation own canonical sorted repository-relative paths. Unresolved Eyes,
+   Imagination, or Hands frontiers without a valid ceiling refuse atomically.
+   Prompt schemas state that not-yet-created outputs belong in the ceiling and
+   inspected evidence does not. Mind/runtime/RepoModel epochs advance to
+   v4/v5/v2 with no compatibility reader. Ox16 is historical; Ox17 starts from
+   a fresh store and exact package.
 
 Do not preserve the aggregate for compatibility, manufacture a bootstrap
 thread, release autonomous scheduling, register topology in `gamecult-ops`,

notes/fresh-workspace-handoff.md

@@ -1,9 +1,9 @@
 # Fresh workspace handoff
 
-Updated: 2026-08-22
+Updated: 2026-08-23
 Branch: `codex/epiphany-shakedown-live`
-Latest committed implementation cut: `e046a4d1`
-Current worktree: replayable admission-refusal documentation and evidence reconciliation
+Latest committed implementation cut: `5b799b12`
+Current worktree: Ox16 scope-authority reconciliation and Ox17 preparation
 
 ## Orientation
 
@@ -13,11 +13,10 @@ autonomous scheduling, register operational topology in `gamecult-ops`, race
 Idunn's Yggdrasil CI/CD task with local compiler work, or wake resident
 cognition without an explicit operator resumption.
 
-Epiphany is a supervised engineering alpha. Exact source `d2ca6630` is the
-current deployed OpenRouter/Ox body, signed-health admitted and deliberately
-braked. Exact `9b9b5c85` is the next build-affecting source and is not deployed
-yet. Historical live proofs remain evidence; they do not authorize the next
-capstone or Gate 1.
+Epiphany is a supervised engineering alpha. Exact source `d2ca6630` remains the
+production symlink body and is inactive. Exact `5b799b12` is the current
+build-affecting source. Historical live proofs remain evidence; they do not
+authorize the next capstone or Gate 1.
 
 ## Current live deployment
 
@@ -30,8 +29,9 @@ capstone or Gate 1.
 - Model provider: OpenRouter `stealth/ox-alpha`, selected explicitly and
   injected through the root-owned systemd credential boundary.
 - `epiphany.service`, `epiphany-heartbeat.service`, and
-  `epiphany-swarm.service` are active with zero restarts. Resident Self reports
-  `braked`; both the swarm brake and Idunn deployment brake are engaged.
+  `epiphany-swarm.service` are inactive with zero restarts after the hard epoch
+  refusal rollback. The d2ca stores and swarm brake remain historical
+  production state; no newer package is admitted there.
 - Idunn source `8b972715c47731f2418d0c423cb0dd2076940bd7` is provenance-exact and
   admits Epiphany through the shared authenticated daemon-health contract.
 - gamecult-ops `b47f9084` removes Docker from
@@ -389,19 +389,66 @@ epochs v3/v4/v2; old writable stores are refused. Ox12 is therefore historical
 evidence and must not resume. Local core `491/491`, coordinator `12/12`, status
 `2/2`, swarm `10/10`, and all core targets pass.
 
+Exact `85061129` then passed Idunn's full Yggdrasil workspace gate and sealed
+release `sha256-238a7911650c406c67b710b19642451c1b1e7bdbe66e9dc7605e46e098a780dd`.
+Private fresh-store Ox13 proved the new refusal lifecycle in package reality:
+Body Modeling launched without Eyes and admitted, Imagination completed, and a
+structurally valid proposal result wrote a typed admission-refusal commit before
+attempt 1 completed with corrected semantics. Transcript-free exact audit is
+retained under the Ox13 root. Persona concurrently exposed an independent
+deadline-owner defect: its provider transport hardcoded 90 seconds while worker
+passes used one outer 600-second budget. A stop race let systemd begin four
+typed projector failures rather than the live-observed three; none committed
+Mind or public speech. Ox13 is sealed, inactive, and must never resume.
+
+Exact `3b958a83` gives Persona one explicit outer
+`--turn-timeout-seconds` budget, defaults it to 600 seconds, removes the inner
+provider request timer, and makes the shared error provider-neutral. The
+focused provider/runtime suites pass: provider spine `17/17`, runtime library
+`26/26`, model-runtime binaries `13/13` each, and Persona service `1/1`.
+
+Ox15 is sealed historical fresh-store evidence. It proved Persona no longer
+dies at the old inner transport timeout, then exposed a separate proposal
+currentness fault. Exact `8812945e` keeps proposal semantics inside the family
+admission owner, and exact `749d977e` makes a completed historical direction
+decision valid evidence for its proposal across later disjoint RepoModel
+changes without turning an aggregate model revision back into authority.
+
+Exact `749d977e` passed Idunn's Yggdrasil gate under test receipt SHA-256
+`39229d8a526a7af7e7b29cec28d27b07f89ba5f5792658947e3d1d039b9449c4`
+and sealed package
+`sha256-5d9bc25612dd46511620671ccd5113f3b5e0e3c060c85e97dcdc199f9126a230`.
+Private fresh-store Ox16 launched direct Body Modeling without Eyes while all
+three Persona stages ran concurrently. Body and proposal admission survived
+later disjoint RepoModel changes. No public delivery succeeded. Planning then
+remained unavailable because the active Imagination frontier used inspected
+evidence paths as its supposed future write scope, omitted `OX-CAPSTONE.md`,
+and was unordered. Dependent proposal pressure began to form, so Ox16 was
+braked and sealed before the forest grew. No Hands consequence or capstone
+marker exists; Ox16 must never resume.
+
+Exact `5b799b12` is the hard architectural cut from that evidence. It deletes
+`source_scope`/`sourceScope`, makes `repository_scope` the canonical sorted
+repository-relative ceiling for future Planning/Hands consequences, and names
+the adopted route narrowing `authorized_paths`. Generic RepoModel validation
+owns the intrinsic path law and refuses an invalid routed frontier atomically
+before any graph document is written. Inspected files and evidence remain in
+their existing typed audit cargo. Mind/runtime/RepoModel epochs advance to
+v4/v5/v2. Local acceptance is core `494/494`, OpenAI runtime `26/26`,
+coordinator `12/12`, swarm `10/10`, and model-runtime `13/13`.
+
 ## Immediate next action
 
-1. Let Idunn natively compile, test, and seal exact `e046a4d1` only after no
-   other target helper is active. The current Idunn helper design lacks one
-   host-wide deployment-transaction mutex; do not confuse exact rollback with
-   safe cross-target transaction ownership.
-2. Run the exact package from a new private fresh-store Ox root. Stop after
+1. Let Idunn compile, test, and seal exact `5b799b12` without touching another
+   target or moving the historical production store.
+2. Run that exact package from private fresh-store Ox17. Stop after
    three provider failures total. Prove direct Body Modeling without Eyes,
    refusal-to-retry if exercised, Hands -> Verification -> Mind,
    `list-decisions` plus exact `audit-decision`, and restart/re-entry without
    public speech.
-3. Never resume Ox10 or Ox12 or transplant their decisions. Only after the new
-   capstone passes may Model Atlas Gate 1 restart from a new external root.
+3. Never resume Ox10, Ox12, Ox13, Ox15, or Ox16 or transplant their decisions.
+   Only after Ox17 passes may Model Atlas Gate 1 restart from a new external
+   root.
 
 ## Operational state that matters
 

notes/repo-frontier-planning-authority-map.md

@@ -2,76 +2,91 @@
 
 ## Current authority
 
+- Generic RepoModel validation owns the intrinsic frontier shape. A non-empty
+  `repository_scope` is a strict lexicographically sorted set of canonical
+  repository-relative paths. Every unresolved frontier routed to Eyes,
+  Imagination, or Hands must carry one. Invalid scope refuses the entire keyed
+  RepoModel mutation before any document is written.
+- `repository_scope` is future consequence authority: the ceiling Planning may
+  narrow and Hands may eventually change. Files inspected, evidence sources,
+  immutable Body basis, and tool receipts remain separate reasoning and
+  provenance cargo. They cannot impersonate write authority.
 - Self selects one dependency-ready, unchallenged, active Imagination frontier
-  from the uniquely admitted current RepoModel. It writes one immutable
-  `RepoFrontierPlanningRequest` binding the model revision/hash, admission,
-  frontier bytes, source scope, runtime, and thread.
+  from the current keyed RepoModel view. It writes one immutable
+  `RepoFrontierPlanningRequest` binding the exact frontier authority document
+  versions, frontier bytes and hash, repository scope, and runtime identity.
 - Coordinator commit replays that request, injects the exact typed Imagination
   projection, and atomically writes a request-keyed launch binding whose hash
   covers the stored worker launch document.
 - Imagination writes one immutable runtime result with an exclusive planning
-  request echo and one embedded canonical `RepoFrontierPlanCandidate`. It does
-  not route Hands or mutate RepoModel.
+  request echo and one embedded canonical `RepoFrontierPlanCandidate`.
+  `safe_paths` may only narrow `repository_scope`. Imagination cannot route
+  Hands or mutate RepoModel.
 - The runtime derives one `RepoFrontierPlanMindRequest` from the immutable
-  Imagination result and candidate hash. Its insert is CAS-bound to the exact
-  current model envelope.
-- Coordinator commit launches one bounded, non-embodied admission-review
-  procedure serving Mind. It injects the exact request/planning/candidate
-  projection and atomically writes the request-keyed launch binding. This
-  procedure is not an embodied Mind lane; Mind remains persistent state and
-  admission authority.
+  Imagination result and candidate hash. Coordinator commit launches one
+  bounded admission-review pass serving Mind with the exact request, candidate,
+  and keyed model-source documents.
 - The admission reviewer writes one immutable typed Adopt, Refuse, or Hold
-  judgment. Result persistence replays the request, both worker results, both
-  launch bindings, stored launch bytes, runtime/thread, candidate identity, and
-  current model/frontier while rejecting foreign organ cargo.
+  judgment. Result persistence replays the request, both worker results, launch
+  bindings, stored launch bytes, candidate identity, and current keyed frontier
+  authority while rejecting foreign organ cargo.
 - `commit_repo_frontier_plan_decision` consumes only that immutable review
   result. Refuse and Hold write one inert terminal receipt. Adopt atomically
-  writes the next canonical RepoModel, its specialized Mind review/admission,
-  and the terminal decision receipt.
+  writes the changed keyed frontier document, specialized Mind
+  review/admission, and terminal decision receipt through exact-envelope CAS.
 - The dedicated Adopt transition installs the exact candidate cargo and
-  provenance on `RepoFrontierItem.adopted_plan` and alone changes
-  Imagination to Hands. Generic frontier writers cannot author or rewrite it.
-- Self derives the Hands route from the admitted model. The route copies the
-  exact plan and safe paths; Hands intent binds route, candidate hash, and plan
-  action; verification requires the exact admitted command and shows Soul the
-  checks, stop conditions, rollback steps, and commit message.
-- Modeling may incorporate Soul's verdict by changing lifecycle/gap/evidence
-  fields while preserving the adopted execution anatomy byte-for-byte.
+  provenance on `RepoFrontierItem.adopted_plan` and alone changes Imagination
+  to Hands. Generic frontier writers cannot author or rewrite it.
+- Self derives the Hands route from the admitted keyed model. The route exposes
+  `authorized_paths`, equal to the adopted plan's `safe_paths`; Hands intent and
+  Substrate Gate receipts bind that exact set. Verification receives the exact
+  admitted command, checks, stop conditions, rollback steps, and consequence
+  receipts.
+- Modeling may incorporate Soul's verdict by changing lifecycle, gap, and
+  evidence fields while preserving the adopted execution anatomy byte-for-byte.
 
 ## Derived state
 
-- Planning readiness is current admitted Imagination frontier plus absence of a
-  terminal decision receipt.
+- Planning readiness derives from current keyed frontier documents, current
+  challenges and dependencies, and absence of a terminal decision receipt.
+- `repository_scope_valid` is diagnostic projection from the shared graph
+  validator. It does not own admission.
 - Candidate visibility is a projection of the immutable Imagination result.
-- Hands readiness and execution cargo derive only from the post-Adopt canonical
-  model, never from a candidate or decision shadow store.
+- Hands readiness and execution cargo derive only from the post-Adopt keyed
+  RepoModel, never from a candidate, event, role lane, or decision shadow store.
 - Completion remains Soul verdict followed by Modeling verdict incorporation;
   adoption is not completion.
 
 ## Forbidden writers and substitutions
 
+- No aggregate model revision/hash, global thread revision, event order,
+  timestamp freshness, or generic role slot owns planning or Hands readiness.
 - No standalone candidate or adoption store exists in the production path.
-- No caller supplies Mind's decision, rationale, or timestamp.
-- No prompted admission reviewer may emit state, Self, RepoModel, Verification,
-  Modeling, or implementation authority cargo.
-- Prompt prose, namespaces, metadata, evidence coincidence, or “the current
-  request” cannot substitute for exact typed echoes and launch bindings.
+- No caller supplies Mind's decision, rationale, timestamp, provider request,
+  or strong-read set.
+- No prompted reviewer may emit state, Self, RepoModel, Verification, Modeling,
+  or implementation authority cargo.
+- `filesInspected`, evidence references, prompt prose, namespaces, metadata, or
+  “the current request” cannot substitute for `repository_scope` or exact typed
+  launch bindings.
 - Generic Upsert/Revise cannot create an adopted plan or perform
   Imagination-to-Hands. Verdict incorporation cannot rewrite execution anatomy.
 - Same-path Hands work cannot substitute a different action, candidate, or
   command while retaining route authority.
-- Mind is not a chatty embodied lane. The bounded admission-review procedure
-  serves Mind and has no heartbeat, lane memory, `roleAccept`, or `selfPatch`.
+- Mind is not a chatty embodied lane. The bounded admission-review pass serves
+  Mind and has no heartbeat, lane memory, `roleAccept`, or `selfPatch`.
 
 ## Verification layer
 
-- Hostile proofs cover stale/swapped model, frontier, request, result, job,
-  launch binding, projection, candidate hash, escaped paths, failed worker
-  output, foreign cargo, duplicate/racing launches, competing terminal writes,
-  generic adoption bypass, post-adoption anatomy mutation, and same-path command
-  substitution.
+- Hostile proofs cover stale/swapped source documents, frontier, request,
+  result, job, launch binding, projection, candidate hash, escaped or unordered
+  paths, failed worker output, foreign cargo, duplicate/racing launches,
+  competing terminal writes, generic adoption bypass, post-adoption anatomy
+  mutation, and same-path command substitution.
+- Scope-specific negative proofs reject parent traversal, Windows separators
+  and drive roots, duplicate or unordered paths, and unresolved routed frontier
+  items with no repository ceiling. The mutation remains atomic and leaves no
+  partial frontier document.
 - Exact retry authenticates immutable terminal decision plus its historical
-  review/admission chain without requiring later canonical model revisions to
-  remain frozen.
-- The next organ is the production semantic index over typed graph claims so
-  Modeling can maintain a live persistent searchable Body map.
+  review/admission chain without requiring later disjoint RepoModel documents
+  to remain frozen.

state/map.yaml

@@ -4,7 +4,7 @@ experiment:
   purpose: Native, inspectable agent organism with typed state and explicit organ authority.
 
 objective:
-  current: Build exact replayable-admission cut e046a4d1 through Idunn, then run a new private fresh-store Ox capstone through Modeling, Hands, Verification, decision audit, and restart/re-entry. Production remains braked and historical Ox roots are not resumed.
+  current: Build exact repository-authority cut 5b799b12 through Idunn, then run private fresh-store Ox17 through direct Body Modeling, concurrent Persona, Planning, Hands, Verification, decision audit, and restart/re-entry. Production remains braked and historical Ox roots are never resumed.
 
 architecture:
   body: Repository, runtime, service processes, stores, interfaces, and deployment substrate.
@@ -48,9 +48,9 @@ current_status:
   package_baseline: Exact d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4 remains the admitted production source and current symlink target. Its native serialized full-workspace gate passed with receipt SHA-256 de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482. Idunn sealed 26 root-owned non-writable binaries plus release-witness.ccmp as release sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06; witness-file SHA-256 is 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357. Source 9b9b5c85 also passed Idunn's native test gate under receipt SHA-256 6c6a71359f8c31297419665d2872f6982a89f84e197d71fc5b36a7fc86216093 and remains sealed as release sha256-30a910785a380224bbdbd56a7b742c8d058fa70cb72dab3562e3907903e0d191 with witness-file SHA-256 75bf52d31c56ea3b08e1a702273301c1db12a4b1ffae45e3d948ce8a29b50e1d. A foreign-target helper restarted Idunn during the Epiphany transaction; rollback restored d2ca, removed deployment.env, and left production Epiphany units inactive. OpenRouter model stealth/ox-alpha and its systemd-injected credential are readiness-proven. Idunn is active with zero restarts and its deployment brake is engaged.
   summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure plus generic job result to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
   public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
-  latest_phase: Private Ox12 proved concurrent Persona and direct Body Modeling without Eyes. Under exact 9b9b5c85, OpenRouter then completed proposal Modeling attempt 1 with a structured result, but the result confused RepoModel claim identities with frontier dependencies. The mutation planner correctly refused the absent dependency and exposed a second general fault: terminal model output could remain successful while its semantic admission refusal was transient, preventing either fulfillment or a fresh pass. Exact e046a4d1 makes admission refusal a typed durable Mind document shared by Body, proposal, and frontier-verdict Modeling plus frontier Verification; current-work schedules a fresh attempt from that refusal, retry context carries the exact prior refusal, and successful model transport remains distinct from Mind admission. The native output contract now states that dependency_item_ids are frontier identities, never node/claim identities. Mind/runtime/proposal-context epochs cut to v3/v4/v2 with no legacy writable path. Local core 491/491, coordinator 12/12, status 2/2, swarm 10/10, and all core targets pass. Ox12 is historical under the prior epoch and must never resume.
+  latest_phase: Exact 749d977e proved in private Ox16 that direct Body Modeling launches without Eyes while Persona runs concurrently and that a completed historical direction decision remains valid across later disjoint RepoModel changes. Planning then remained structurally unavailable because Modeling used inspected evidence paths as future path authority, omitted OX-CAPSTONE.md, and emitted an unordered scope. Exact 5b799b12 hard-cuts the overloaded source_scope/sourceScope contract: repository_scope is the canonical sorted repository-relative ceiling that Planning may narrow, Hands receives only authorized_paths, and generic RepoModel validation refuses an invalid unresolved routed frontier before any graph write. Inspected files and evidence remain separate reasoning cargo. Mind/runtime/RepoModel epochs advance to v4/v5/v2 without compatibility reads. Local core 494/494, OpenAI runtime 26/26, coordinator 12/12, swarm 10/10, and model-runtime 13/13 pass. Ox16 is sealed historical evidence and must never resume.
   operational_state:
-    local_worktree: source_head_e046a4d190b8f7bcf7cb8f439d2391bab581eda6_committed_and_pushed_replayable_agent_admission_refusal_docs_and_evidence_in_progress
+    local_worktree: source_head_5b799b12_committed_and_pushed_repository_scope_authority_cut_docs_and_ox17_preparation_in_progress
     docker_engine_access: starfire_compiler_retired_all_yggdrasil_epiphany_transient_containers_volumes_package_roots_and_per_run_test_target_removed_future_idunn_epiphany_builds_native_rust_1_95_0_via_gamecult_ops_89f0d78
     operator_wireguard: restored
     starfire_persona_permit_firewall: persistent_exact_gamecult_ops_6ee08a4
@@ -61,6 +61,8 @@ current_status:
     yggdrasil_epiphany_deployment: request_2026_08_22T16_35_41_670Z_succeeded_exact_d2ca6630_native_test_package_signed_authenticated_health_active_openrouter_ox_credential_ready_swarm_and_deployment_brakes_engaged
     ox10_failed_capstone: sealed_braked_inactive_exact_470d4cb5_direct_body_modeling_without_eyes_exact_failure_context_no_mind_commit_no_public_consequence_retry_projection_falsified
     ox12_frozen_capstone: root_ox12_84a7dec1_private_inactive_historical_epoch_direct_body_modeling_without_eyes_openrouter_proposal_attempt_1_structured_result_repo_model_mutation_refused_absent_frontier_dependency_no_public_consequence_never_resume
+    ox16_frozen_capstone: root_ox16_749d977e_private_inactive_historical_epoch_direct_body_modeling_without_eyes_concurrent_persona_historical_direction_proof_survived_disjoint_model_changes_planning_blocked_by_evidence_paths_impersonating_repository_authority_no_hands_no_public_consequence_never_resume
+    yggdrasil_epiphany_749d_package: source_749d977e_release_sha256_5d9bc25612dd46511620671ccd5113f3b5e0e3c060c85e97dcdc199f9126a230_test_receipt_sha256_39229d8a526a7af7e7b29cec28d27b07f89ba5f5792658947e3d1d039b9449c4_historical_exact_package
     starfire: operator_workstation_and_source_checkout_not_cicd_build_body
     starfire_runtime_identity: epiphany-starfire
     starfire_swarm_brake: original_c011_quiescent_exited_255_f90_copied_proof_body_braked_and_stopped_exit_zero
@@ -88,8 +90,8 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
-  unresolved_authority: The Decision-Auditable Concurrent Mind cut and explicit OpenRouter/Ox provider boundary are source-complete; a fresh exact-package capstone remains open. Idunn's target-specific helpers lack one host-wide deployment-transaction mutex: a Ghostlight helper can stop/restart Idunn while an Epiphany transaction owns candidate state. Exact release binding prevented a false admission and rollback restored production, but transaction continuity is not yet architecturally owned. Bifrost remains Persona and governed external-consequence transport; Eve/CultUI and local typed tools remain human and enginseer surfaces. Model Atlas Gate 1 remains paused. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Let Idunn natively compile, test, and seal exact e046a4d190b8f7bcf7cb8f439d2391bab581eda6 only after confirming no foreign deployment helper is active. Do not treat a production rollout as accepted until Idunn's missing cross-target transaction mutex is repaired. Use the exact package in a new private fresh-store Ox capstone; stop after three provider failures, prove direct Body Modeling without Eyes, typed refusal-to-retry if exercised, Hands-Verification-Mind, exact decision audit, and restart/re-entry without public speech. Never resume Ox10 or Ox12, transplant decisions, restore event/coordinator authority, trigger non-Epiphany targets, or compile on Starfire.
+  unresolved_authority: The Decision-Auditable Concurrent Mind cut, explicit OpenRouter/Ox provider boundary, and repository-scope ownership cut are source-complete; fresh exact-package Ox17 remains open. Bifrost remains Persona and governed external-consequence transport; Eve/CultUI and local typed tools remain human and enginseer surfaces. Model Atlas Gate 1 remains paused. Historical c011 and partial Gate roots stay untouched/read-only.
+  next_action: Let Idunn natively compile, test, and seal exact 5b799b12 without triggering another target or moving the historical production store. Use only that exact package in private fresh-store Ox17; stop after three provider failures and prove direct Body Modeling without Eyes, concurrent Persona, typed refusal-to-retry if exercised, Planning-Mind-Hands-Verification-Modeling, exact decision audit, and restart/re-entry without public speech. Never resume Ox10, Ox12, Ox13, Ox15, or Ox16, transplant decisions, restore event/coordinator authority, trigger non-Epiphany targets, or compile on Starfire.
 
 active_subgoals:
   - Complete the fresh exact-package Decision-Auditable Concurrent Mind capstone before any further operational Gate run.