diff --git a/epiphany-core/src/cultmesh_integration.rs b/epiphany-core/src/cultmesh_integration.rs index fb0ddfef..f84b76ed 100644 --- a/epiphany-core/src/cultmesh_integration.rs +++ b/epiphany-core/src/cultmesh_integration.rs @@ -5278,10 +5278,17 @@ pub fn write_epiphany_cultmesh_agent_state_soa_summary( validate_agent_state_soa_summary(&summary)?; let mut node = open_epiphany_cultmesh_node(&store_path, summary.runtime_id.clone())?; let written = node.put(summary.summary_id.clone(), &summary)?; - node.put( + let current_latest = node.get::( EPIPHANY_CULTMESH_AGENT_STATE_SOA_SUMMARY_LATEST_KEY, - &written, )?; + if current_latest.as_ref().is_none_or(|current| { + agent_state_soa_generation_key(&written) >= agent_state_soa_generation_key(current) + }) { + node.put( + EPIPHANY_CULTMESH_AGENT_STATE_SOA_SUMMARY_LATEST_KEY, + &written, + )?; + } node.flush()?; Ok(written) } @@ -5308,6 +5315,13 @@ fn validate_agent_state_soa_summary( EPIPHANY_CULTMESH_AGENT_STATE_SOA_SUMMARY_SCHEMA_VERSION )); } + if summary.verse_id != EPIPHANY_CULTMESH_LOCAL_AREA_VERSE_ID { + return Err(anyhow!( + "agent state SoA summary belongs in the local-area Verse" + )); + } + DateTime::parse_from_rfc3339(&summary.generated_at) + .map_err(|error| anyhow!("agent state SoA summary has invalid generated_at: {error}"))?; let len = summary.role_ids.len(); if summary.row_count as usize != len { return Err(anyhow!( @@ -5346,6 +5360,16 @@ fn validate_agent_state_soa_summary( Ok(()) } +fn agent_state_soa_generation_key( + summary: &EpiphanyCultMeshAgentStateSoaSummaryEntry, +) -> (DateTime, &str) { + ( + DateTime::parse_from_rfc3339(&summary.generated_at) + .expect("validated agent state SoA generation timestamp"), + summary.summary_id.as_str(), + ) +} + pub fn write_epiphany_cultmesh_repo_work_overview( store_path: impl AsRef, overview: EpiphanyCultMeshRepoWorkOverviewEntry, @@ -8316,6 +8340,34 @@ mod tests { assert!(!serialized.contains("privateNotes")); assert!(!summary.private_state_exposed); + let mut newer = summary.clone(); + newer.summary_id = "agent-state-soa-summary-newer".to_string(); + newer.generated_at = "2026-06-18T01:00:00Z".to_string(); + write_epiphany_cultmesh_agent_state_soa_summary(&store, newer.clone())?; + + let mut delayed = summary.clone(); + delayed.summary_id = "agent-state-soa-summary-delayed".to_string(); + delayed.generated_at = "2026-06-17T23:00:00Z".to_string(); + write_epiphany_cultmesh_agent_state_soa_summary(&store, delayed)?; + assert_eq!( + load_latest_epiphany_cultmesh_agent_state_soa_summary(&store, "epiphany-test")?, + Some(newer) + ); + + let mut invalid_time = summary.clone(); + invalid_time.summary_id = "agent-state-soa-summary-invalid".to_string(); + invalid_time.generated_at = "not-a-time".to_string(); + let err = write_epiphany_cultmesh_agent_state_soa_summary(&store, invalid_time) + .expect_err("invalid agent summary time must be refused"); + assert!(err.to_string().contains("invalid generated_at")); + + let mut wrong_verse = summary.clone(); + wrong_verse.summary_id = "agent-state-soa-summary-wrong-verse".to_string(); + wrong_verse.verse_id = EPIPHANY_CULTMESH_INTERNAL_VERSE_ID.to_string(); + let err = write_epiphany_cultmesh_agent_state_soa_summary(&store, wrong_verse) + .expect_err("agent summary outside local-area Verse must be refused"); + assert!(err.to_string().contains("local-area Verse")); + let mut leaked = summary.clone(); leaked.private_state_exposed = true; let err = write_epiphany_cultmesh_agent_state_soa_summary(&store, leaked) diff --git a/notes/conceptual-substitution-audit-2026-07-12.md b/notes/conceptual-substitution-audit-2026-07-12.md index 75ddfd76..eb7fb73e 100644 --- a/notes/conceptual-substitution-audit-2026-07-12.md +++ b/notes/conceptual-substitution-audit-2026-07-12.md @@ -613,3 +613,21 @@ replace the current proof projection with an older commit/hash. Public-proof writes now require valid RFC3339 generation time and advance `latest` by `(generation time, public proof ID)`. Publication receipts still bind their specific proof ID and SHA; the directory mirror can no longer drift backward. + +## Mirror arrival presented as current agent-state summary + +`agent-state-soa-summary/latest` shapes local swarm discovery and prompt context +but was arrival-owned despite carrying `generated_at`. Summaries now require a +valid RFC3339 generation time, are confined to the local-area Verse, and +advance `latest` by `(generation time, summary ID)`. Delayed stale summaries +cannot replace current swarm self-knowledge. + +## Unresolved: provider receipts without chronology + +Bifrost body-change/GitHub publication receipts are externally owned and their +local constructors/writers are test-only, but the current receipt contracts +carry no provider timestamp or monotonic revision while exposing global +`latest` mirrors. Epiphany cannot truthfully order delayed provider receipts +without inventing chronology from receipt IDs or consumer arrival. The coherent +future fix is a Bifrost-owned contract revision carrying provider event order; +no consumer-side compensator was added. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index cfb2601e..9cac6bdd 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -154,6 +154,10 @@ The confirmed conceptual substitutions have been cut: TUI, and Bifrost accounting. Real review receipts retain their owners. - Repo-work public-proof global `latest` is generation-time-owned. Delayed proof transport cannot replace the current commit/hash evidence projection. +- Agent-state SoA `latest` is generation-time-owned and local-area confined; + delayed summaries cannot rewind prompt/swarm self-knowledge. +- Bifrost provider receipt contracts still lack provider timestamp/revision. + Do not invent consumer-side ordering; repair that in a Bifrost-owned schema. The presentation boundary is now plain: `swarm overview` is a generic compact read-only projection. Gjallar is a downstream TUI application on Nightwing and is not an Epiphany organ, provider, owner, runtime, or architectural dependency. Eve/CultUI graphs may be lowered or composited downstream without Epiphany caring which presentation client does it. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 8fb6b4d8..4e6c6b9f 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 363f6973..fcc82f8f 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -660,4 +660,4 @@ current_status: - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Publication/closure/Hands authority is single-sourced; operational/evidence latest mirrors are validated event-time projections; repo-work map/overview/readiness/public-proof latest keys follow owning time; the writerless readiness-review family is deleted. Continue auditing publication and other evidence/security mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority. + next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Operational/evidence/self-state mirrors with owned clocks are event-time ordered; repo-work projections follow owning time; writerless readiness-review is deleted. Bifrost provider receipts still need a provider-owned chronology contract rather than consumer inference. Continue auditing other evidence/security mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority.