From 2f7f9e0ac6a8a5ace46f4ed7ecefd7833c04249d Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 23 Aug 2026 15:39:11 +0200 Subject: [PATCH] Record immutable runtime identity cut --- notes/epiphany-current-algorithmic-map.md | 3 ++- notes/epiphany-fork-implementation-plan.md | 6 ++++++ notes/fresh-workspace-handoff.md | 18 +++++++++++++++++- state/ledgers.msgpack | Bin 673011 -> 673663 bytes state/map.yaml | 3 ++- 5 files changed, 27 insertions(+), 3 deletions(-) diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index f9bed256..de0e0bf4 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -195,6 +195,7 @@ interface authority. |---|---|---|---| | keyed Mind documents | typed semantic documents keyed by logical identity | deterministic `EpiphanyMindView` | There is no persisted aggregate Mind head or global revision. | | `reasoning_context.rs` Mind commit owner | invariant-owned strong reads and complete typed writes | atomic batch CAS plus `EpiphanyMindCommitReceipt` | Disjoint identities merge; same-identity or changed-strong-read conflicts refuse without partial mutation. | +| runtime bootstrap | immutable runtime identity envelope | exact identity strong read plus keyed session/job/launch writes | Worker launch replays the original identity and existing session envelopes byte-for-byte; it cannot refresh a singleton timestamp or capability mirror and thereby serialize unrelated work. | | concrete family admission owners | sealed decision context, exact family request/result chain, affected semantic documents | one family-specific `MindMutation` | The model cannot choose which stale state is safe to ignore. | | `current_work.rs` | keyed Mind view and exact runtime request/job/result/decision families | pure family scheduling and continuation projections | Events, timestamps, role lanes, and thread provenance cannot create or suppress work. | | coordinator policy/status | keyed Mind presence, exact current work, and the accepted continuity decision | one action/reason pair plus operator-readable role lanes | Coordinator presence is derived; no mutable coordinator head, pressure tableau, or duplicate policy wrapper exists. | @@ -558,7 +559,7 @@ Accepted through the local `5b799b12` source boundary: and remains a sealed immutable package. A foreign-target helper interrupted candidate deployment; exact rollback restored d2ca and prevented false admission. Production units are inactive and deployment.env is absent; -- Mind epoch v4, runtime spine v5, and RepoModel epoch v2 refuse prior writable +- Mind epoch v4, runtime spine v6, and RepoModel epoch v2 refuse prior writable stores without mutation or a dual-read path. - Persona production source has one outer turn deadline, no hidden provider request deadline, and focused provider/runtime suites pass. diff --git a/notes/epiphany-fork-implementation-plan.md b/notes/epiphany-fork-implementation-plan.md index 06859e59..50189bec 100644 --- a/notes/epiphany-fork-implementation-plan.md +++ b/notes/epiphany-fork-implementation-plan.md @@ -500,6 +500,12 @@ Cut in this order: inspected evidence does not. Mind/runtime/RepoModel epochs advance to v4/v5/v2 with no compatibility reader. Ox16 is historical; Ox17 starts from a fresh store and exact package. +36. **Runtime identity is immutable at `87983ffc`:** the v6 hard cut removes + update time, derived document-type cargo, and temporary metadata from the + runtime identity. Current-work launch preserves the exact identity and + existing root-session envelopes as strong reads instead of reconstructing + them with fresh storage timestamps. Unrelated job launches therefore share + bootstrap identity without turning it into a global mutation head. Do not preserve the aggregate for compatibility, manufacture a bootstrap thread, release autonomous scheduling, register topology in `gamecult-ops`, diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 7d962f3f..2b5d8f0b 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -843,7 +843,7 @@ or tests. Authenticated source lookup receipts and the exact research decision's persisted evidence packet remain the real Eyes path. Core/release checks and focused Research 2/2 pass. -Next continue the test-authority audit, beginning with remaining direct schema, +Next continue the test-authority audit after exact `87983ffc`, beginning with remaining direct schema, prompt-rendering, CLI-parser, and CultMesh projection tests. Audit every claimed cross-service contract against its real producer before preserving it. Retain a test only when it reaches Epiphany validation, ownership, authentication, monotonicity, @@ -855,6 +855,22 @@ Ox root until subtraction closes. Never resume Ox10, Ox12, Ox13, Ox15, or Ox16. ## Latest authority cuts +Exact `bf997ce0` hard-cuts frontier plan-decision receipts to v2. The two +permanently empty legacy worker echoes are gone, decision provenance is +required, and unused public type aliases no longer pretend to be contracts. +Exact `e00ea70f` deletes the PID-only process-observation compatibility API and +its unused path helper; exact process-incarnation identity remains the only +liveness and termination authority. + +Exact `87983ffc` makes runtime identity immutable bootstrap state and advances +runtime spine to v6. Launches no longer rewrite a shared singleton merely to +refresh `stored_at`, an update timestamp, a derived capability list, or +temporary evacuation metadata. Existing identity and root-session envelopes +are replayed byte-for-byte as strong reads, so disjoint keyed jobs can merge +without losing identity substitution protection. The existing current-work +capstone now proves the identity envelope survives all launch families +unchanged; focused core and OpenAI-runtime native checks pass. + Exact `8c20f896` reduces Substrate Gate from six advertised contract families to its one real immutable repo-access grant. Request, review, refusal, snapshot, and mutation were prose-only constants with no typed body, writer, reader, or diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 0a9c525dd3780b1c3400ed78cadb60b0bdff8ff7..d2460dbe86f2568c97e8c066f74544b8f22cca31 100644 GIT binary patch delta 665 zcmY+Bv2N5r5Qgyq2^<{-N`cTwsZ#i4?xfuLQY8YUt4NUwMWFS1Y_GE3b#~THTpd!1 zh=z*OmAnEH1>yyG3SI*705A)>2#Q~pc4z+o-_Jka?frVc_h~13FiGc0^6J~I;fvGH zyU}?RJ-S*Au2+MI6~4DwcUX5>TdZx?J=Xm%tHJQ~(Zdg4$H{mV&{zuD1Io(slrZ^v`7wI3 zY#eVHVI+>=uOlW2ifK|njv77B`U;^nEnyDY67_Jrcotiud*Ee>L?CV52(L1w6=xqF zFE(DYX*!z}g#?jzA%noR+^a^QMi~UZw9xH`Hc*SRf38)IJjZ6Lu3IlMjdPH#b9@?K zSa$|mv_@9^>PCy6z&cebBQ)GB22Z?Hpg-p zQWbW|TZj1@;W-3|PnZh3Na0F5f)j>QC`TR)1NN#z5Jc#FNRpy0D-U?y za4bAtpUx1pt#p+VF!1}^6do0S<085u>Jr!uuqWnu(k5X}t4EI`Z(#B4y! Q4#XTl%(;Ck6IYxQ0AbJ;9smFU diff --git a/state/map.yaml b/state/map.yaml index 17c4e27f..ea8084c2 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -56,6 +56,7 @@ current_status: supervisor_subtraction: Exact 856648de completes the supervisor deletion. Epiphany owns no local generic daemon supervisor, semantic projector service, workspace-coverage projector, Windows Task Scheduler integration, or service-policy/lifecycle/heartbeat/recovery mirror. Idunn on Yggdrasil owns source-triggered compilation, testing, packaging, deployment, signed health, and daemon survival. The canonical Epiphany brake gates Epiphany cognition and consequence authority, not Idunn startup or unrelated lifecycle. launch_dependency_cut: Exact 2aeab7a9 deletes the generic organ dependency matrix, generic receipt catalogue/proof profiles, persisted worker-launch cargo, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. Family admission owners derive exact dependencies from typed state. Worker-launch schema v2 and Persona projector prompt v1 refuse the old writable shape. Core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1 pass. operator_surface_subtraction: Exact ef92e853 deletes the callerless view-lens registry, legacy acceptance-bundle builders, test-only raw-JSON result interpreters, and six tests: 797 net lines. Exact a292979d and 77e817c1 delete the duplicate CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. Exact 3b94bf6e and 59c5e3a6 delete the nested duplicate status view, false auxiliary mode, and ignored status arguments. Exact 7c9b0cf3 deletes the fixed synthetic job table, role-board job cargo/mappers, and its test: 338 net lines. Exact 2ce91461 deletes the scene/planning Mind reconstructions, duplicate self-policy crate, unused prompt templates, four counterfeit schemas, and ten producer/source-text tests: 1,723 net lines. Exact 78836f3b deletes eight unconsumed status tableaux, the pressure calculator production only called without telemetry, its unreachable compaction action, one counterfeit schema, and six tests: 518 net lines. Exact f10f7fb3 deletes the final twelve epiphany.surface.* schemas and ten catalog entries after every one proved producerless and consumerless: 692 pure deletions. Exact ab3cacfb deletes thirty-one more producerless contracts, the false runtime-session mutation mouth, every Epiphany-owned Rider/Unity command schema, a callerless prompt-context module, its test-only specialist prompt system, and four self-affirming tests: 3,514 net lines. Exact 16d85b1b deletes six duplicate JSON-schema builder tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. Exact 06f93f70 deletes the test-only inverse OpenAI-to-native request mapper and makes two retained tests follow canonical native-to-provider derivation: sixty net lines. The local catalog now has twenty-three live or portable contracts. Brokkr owns Unity capabilities through CultMesh/Eve; a future Rider daemon owns Rider. Status retains Mind identity, exact current work, one action/reason decision, readable role lanes, and operator thought sealing. Core checks cleanly; retained provider and focused request-flow tests pass. + immutable_runtime_identity_cut: Exact bf997ce0 removes empty legacy frontier-decision echoes and requires exact worker-result provenance. Exact e00ea70f deletes the lossy PID-only process compatibility API. Exact 87983ffc advances runtime spine to v6 and makes runtime identity immutable bootstrap state: no update time, duplicated capability catalog, temporary metadata, or launch-time reconstruction survives. Current-work launch replays the original identity and existing root-session envelopes byte-for-byte as strong reads, preventing hidden singleton timestamp conflicts while retaining substitution refusal. The current-work capstone and OpenAI-runtime all-target check pass. bifrost_authority_cut: Exact 203bcc41 deletes Epiphany's producerless Bifrost body-change/GitHub publication family: four document types, three singleton latest heads, constructors, validators, writers, local-Verse advertisement/projection, public exports, and five tests that manufactured both ends. Bifrost owns the real Persona feedback/delivery stores and signed crossing receipts; Epiphany does not publish an alternate Bifrost protocol. Core and release-bundle checks pass; the remaining CultMesh suite passes 13/13. hands_pr_authority_cut: Exact 11d99de1 deletes the producerless HandsPrReceipt type, registration, dead test-only writer, read path, exports, relinquishment branch, and two contract advertisements. Hands owns local patch, command, and commit consequences; exact remote publication evidence belongs to the provider/Bifrost crossing. Core and release-bundle checks pass, and the rebuilt 43-entry schema catalog contains no deleted PR family. local_verse_contract_cut: Exact a4af4734 makes runtime spine the sole live CultNet mutation-contract publisher by deleting six organ-specific contract DTO/factories, the callerless LocalVerseContext query/seed bundle, fixed Verse/room policy prose, the mind-contract self-test, and persisted cluster topology. The topology writer had no caller; supervision accepted any nonempty fixed-key subset without authenticating Body domain, completeness, or runtime binding. That false bootstrap gate, loader, exports, and its diagnostic test are gone. Exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health remain supervisor prerequisites. The cut removes 1,005 net source lines; core/release checks, CultMesh 12/12, and supervisor 4/4 pass. @@ -106,7 +107,7 @@ current_status: yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255 unresolved_authority: Generic command, legacy lineage, caller-authored identity, behaviorless policy fields, global lifecycle latest state, timestamp election, Windows Task Scheduler authority, and their false proofs are gone. Semantic and workspace launch owners are separate over shared process mechanics. The remaining daemon supervisor still combines the service loop, aggregate signed-health publication, semantic reconciliation, and the large workspace recovery state machine. Continue decomposing only where ownership becomes smaller; do not create family frameworks or adapters. The false persisted cluster-topology bootstrap sentinel is gone; supervisor admission remains bound to exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until subtraction closes. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only. - next_action: Continue the source/test-authority audit after exact ab1afc27. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Delete test-only APIs and fixtures with the tests they animate. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, and family admission owners. Epiphany owns no local daemon supervisor or editor bridge. Do not run a local full-workspace compile, package, deployment, or Ox root. + next_action: Continue the source/test-authority audit after exact 87983ffc. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Delete test-only APIs and fixtures with the tests they animate. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, immutable runtime identity, and family admission owners. Epiphany owns no local daemon supervisor or editor bridge. Do not run a local full-workspace compile, package, deployment, or Ox root. runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.