Refuse unbound Bifrost request closure

epiphany-core/src/bin/epiphany-verse-query.rs

@@ -8122,7 +8122,9 @@ fn push_artifact_acceptance_accounting_row(
             .cmp(&right.admitted_at)
             .then_with(|| left.map_entry_id.cmp(&right.map_entry_id))
     });
-    let request_private = matching.iter().any(|entry| entry.private_state_exposed);
+    let request_private = latest_request
+        .map(|entry| entry.private_state_exposed)
+        .unwrap_or(false);
     let receipt_private = latest_receipt
         .map(|receipt| receipt.private_state_exposed)
         .unwrap_or(false);
@@ -8146,7 +8148,7 @@ fn push_artifact_acceptance_accounting_row(
         .or_else(|| latest_request.map(|entry| entry.changed_paths.len()))
         .unwrap_or(0);
     let private = request_private || receipt_private;
-    let receipt_closed = latest_receipt
+    let receipt_proof_complete = latest_receipt
         .map(|receipt| {
             !receipt.artifact_ref.trim().is_empty()
                 && !receipt.public_proof_ref.trim().is_empty()
@@ -8164,14 +8166,19 @@ fn push_artifact_acceptance_accounting_row(
             lane: "artifact-acceptance-request".to_string(),
             owner: "Maintainer/Bifrost".to_string(),
             status: bifrost_accounting_status(
-                receipt_closed,
+                false,
                 latest_request.is_some() || latest_receipt.is_some(),
                 private,
             ),
             closure: format!(
-                "request={} acceptance={} review={} artifacts={}",
+                "request={} acceptance={} requestIdentity=missing receiptProof={} review={} artifacts={}",
                 present_word(latest_request.is_some()),
                 present_word(latest_receipt.is_some()),
+                if receipt_proof_complete {
+                    "complete"
+                } else {
+                    "incomplete"
+                },
                 review_receipt_count,
                 public_artifact_count
             ),
@@ -8218,7 +8225,9 @@ fn push_metrics_accounting_row(
             .cmp(&right.admitted_at)
             .then_with(|| left.map_entry_id.cmp(&right.map_entry_id))
     });
-    let request_private = matching.iter().any(|entry| entry.private_state_exposed);
+    let request_private = latest_request
+        .map(|entry| entry.private_state_exposed)
+        .unwrap_or(false);
     let receipt_private = latest_receipt
         .map(|receipt| receipt.private_state_exposed)
         .unwrap_or(false);
@@ -8253,7 +8262,7 @@ fn push_metrics_accounting_row(
         request_review_count
     };
     let private = request_private || receipt_private;
-    let receipt_closed = latest_receipt
+    let receipt_proof_complete = latest_receipt
         .map(|receipt| {
             !receipt.artifact_acceptance_receipt_id.trim().is_empty()
                 && model_spend_count > 0
@@ -8271,14 +8280,19 @@ fn push_metrics_accounting_row(
             lane: "metrics-request".to_string(),
             owner: "Bifrost/Maintainer".to_string(),
             status: bifrost_accounting_status(
-                receipt_closed,
+                false,
                 latest_request.is_some() || latest_receipt.is_some(),
                 private,
             ),
             closure: format!(
-                "request={} metrics={} modelSpend={} reviewLoad={} credit={}",
+                "request={} metrics={} requestIdentity=missing receiptProof={} modelSpend={} reviewLoad={} credit={}",
                 present_word(latest_request.is_some()),
                 present_word(latest_receipt.is_some()),
+                if receipt_proof_complete {
+                    "complete"
+                } else {
+                    "incomplete"
+                },
                 model_spend_count,
                 review_load_count,
                 credit_count
@@ -9543,6 +9557,79 @@ mod lifecycle_projection_tests {
         }
     }
 
+    fn repo_request(family: &str, id: &str, private: bool) -> EpiphanyCultMeshRepoWorkMapEntry {
+        EpiphanyCultMeshRepoWorkMapEntry {
+            schema_version: epiphany_core::EPIPHANY_CULTMESH_REPO_WORK_MAP_ENTRY_SCHEMA_VERSION
+                .to_string(),
+            runtime_id: "test".to_string(),
+            verse_id: "gamecult-local".to_string(),
+            map_entry_id: id.to_string(),
+            admitted_at: "2026-07-13T00:00:00Z".to_string(),
+            mirrored_at: "2026-07-13T00:00:01Z".to_string(),
+            workspace: "E:/test".to_string(),
+            item: "test-item".to_string(),
+            branch: "main".to_string(),
+            changed_paths: vec!["src/lib.rs".to_string()],
+            commit_sha: "abc123".to_string(),
+            safe_action_family: family.to_string(),
+            modeling_summary: "modeled".to_string(),
+            soul_verdict_receipt_id: "soul-1".to_string(),
+            mind_gateway_review_id: "mind-review-1".to_string(),
+            mind_state_commit_receipt_id: "mind-commit-1".to_string(),
+            publication_gate: "bifrost".to_string(),
+            durable_state_admitted: true,
+            source_store_path: "state/thread.cc".to_string(),
+            tui_rows: Vec::new(),
+            private_state_exposed: private,
+            notes: Vec::new(),
+            modeling_finding_receipt_id: "modeling-1".to_string(),
+            modeling_route_id: "route-1".to_string(),
+            modeling_generation: 1,
+        }
+    }
+
+    fn artifact_receipt() -> EpiphanyCultMeshBifrostArtifactAcceptanceReceiptEntry {
+        EpiphanyCultMeshBifrostArtifactAcceptanceReceiptEntry {
+            schema_version:
+                epiphany_core::EPIPHANY_CULTMESH_BIFROST_ARTIFACT_ACCEPTANCE_RECEIPT_SCHEMA_VERSION
+                    .to_string(),
+            receipt_id: "artifact-receipt-1".to_string(),
+            item: "test-item".to_string(),
+            source_workspace: "E:/test".to_string(),
+            source_branch: "main".to_string(),
+            commit_sha: "abc123".to_string(),
+            changed_paths: vec!["src/lib.rs".to_string()],
+            artifact_ref: "artifact://1".to_string(),
+            public_proof_ref: "proof://1".to_string(),
+            maintainer_review_receipt_ids: vec!["review-1".to_string()],
+            bifrost_ledger_entry_id: "ledger-1".to_string(),
+            status: "accepted".to_string(),
+            accepted_by: "maintainer-1".to_string(),
+            private_state_exposed: false,
+            notes: Vec::new(),
+        }
+    }
+
+    fn metrics_receipt() -> EpiphanyCultMeshBifrostMetricsReceiptEntry {
+        EpiphanyCultMeshBifrostMetricsReceiptEntry {
+            schema_version: epiphany_core::EPIPHANY_CULTMESH_BIFROST_METRICS_RECEIPT_SCHEMA_VERSION
+                .to_string(),
+            receipt_id: "metrics-receipt-1".to_string(),
+            item: "test-item".to_string(),
+            source_workspace: "E:/test".to_string(),
+            source_branch: "main".to_string(),
+            artifact_acceptance_receipt_id: "artifact-receipt-1".to_string(),
+            model_spend_receipt_ids: vec!["spend-1".to_string()],
+            review_load_receipt_ids: vec!["load-1".to_string()],
+            credit_readback_receipt_ids: vec!["credit-1".to_string()],
+            public_proof_ref: "proof://1".to_string(),
+            metrics_summary: "complete metrics".to_string(),
+            status: "complete".to_string(),
+            private_state_exposed: false,
+            notes: Vec::new(),
+        }
+    }
+
     fn receipt(
         id: &str,
         status: &str,
@@ -9668,4 +9755,33 @@ mod lifecycle_projection_tests {
         assert!(row.closure.contains("consensus=missing"));
         assert_eq!(row.public_artifact_count, 1);
     }
+
+    #[test]
+    fn request_accounting_stays_open_without_typed_receipt_identity() {
+        let old_private = repo_request("repo.artifact_acceptance_request", "old", true);
+        let mut current = repo_request("repo.artifact_acceptance_request", "current", false);
+        current.admitted_at = "2026-07-13T01:00:00Z".to_string();
+        let artifact = artifact_receipt();
+        let mut rows = Vec::new();
+        let mut tui = Vec::new();
+        push_artifact_acceptance_accounting_row(
+            &mut rows,
+            &mut tui,
+            &[old_private, current],
+            Some(&artifact),
+        );
+        assert_eq!(rows[0].status, "open");
+        assert!(rows[0].closure.contains("requestIdentity=missing"));
+        assert!(rows[0].closure.contains("receiptProof=complete"));
+        assert!(!rows[0].private_state_exposed);
+
+        let request = repo_request("repo.metrics_request", "metrics", false);
+        let metrics = metrics_receipt();
+        rows.clear();
+        tui.clear();
+        push_metrics_accounting_row(&mut rows, &mut tui, &[request], Some(&metrics));
+        assert_eq!(rows[0].status, "open");
+        assert!(rows[0].closure.contains("requestIdentity=missing"));
+        assert!(rows[0].closure.contains("receiptProof=complete"));
+    }
 }

notes/conceptual-substitution-audit-2026-07-12.md

@@ -689,6 +689,10 @@ repo-work map/request ID. Item, workspace, branch, and commit fields are not a
 stable causal identity and must not be promoted into one by consumer inference.
 The provider contracts need an explicit request/map identity edge before these
 lanes can truthfully claim request-to-receipt closure under concurrency.
+Accounting therefore no longer marks either lane closed: it reports provider
+receipt proof completeness separately while naming `requestIdentity=missing`.
+Historical private requests also no longer contaminate the currently selected
+request; request-side privacy is derived from that request alone.
 
 ## Unresolved: provider receipts without chronology
 

notes/fresh-workspace-handoff.md

@@ -172,7 +172,9 @@ The confirmed conceptual substitutions have been cut:
   consensus cannot close another Persona feedback lane or lend public refs.
 - Artifact-acceptance and metrics receipts still lack an explicit repo-work
   request/map identity. Do not infer it from item/workspace/branch/commit;
-  repair the Bifrost-owned contracts before claiming concurrent-safe closure.
+  accounting keeps these lanes open with `requestIdentity=missing` while still
+  showing provider receipt proof completeness. Repair the Bifrost-owned
+  contracts before claiming concurrent-safe closure.
 - Bifrost provider receipt contracts still lack provider timestamp/revision.
   Do not invent consumer-side ordering; repair that in a Bifrost-owned schema.
 

state/map.yaml

@@ -660,4 +660,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Operational/evidence/self-state and operator surfaces with owned clocks are event-time ordered; operator receipts bind intents by run identity rather than global chronology; Eve/tool/Bifrost/collaboration projections join chains only by typed identity; repo-work projections follow owning time; writerless readiness-review is deleted. Bifrost provider receipts still need provider-owned chronology, and artifact/metrics receipts need explicit repo-work request identity rather than consumer inference. Continue auditing other evidence/security mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority.
+  next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Operational/evidence/self-state and operator surfaces with owned clocks are event-time ordered; operator receipts bind intents by run identity rather than global chronology; Eve/tool/Bifrost/collaboration projections join chains only by typed identity; repo-work projections follow owning time; writerless readiness-review is deleted. Bifrost provider receipts still need provider-owned chronology, and artifact/metrics receipts need explicit repo-work request identity; accounting refuses closure until those contracts exist. Continue auditing other evidence/security mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority.