Record unearned Hands recorder cut

notes/epiphany-current-algorithmic-map.md

@@ -1,7 +1,7 @@
 # Epiphany current algorithmic map
 
 Updated: 2026-08-23
-Latest committed implementation cut: `94098223` on `codex/epiphany-shakedown-live`
+Latest committed implementation cut: `b78ffb25` on `codex/epiphany-shakedown-live`
 Current worktree cut: executable/test authority subtraction; Ox17 remains paused
 
 This document describes the live machine. Historical cuts, rejected paths, and
@@ -212,6 +212,15 @@ authority ends at exact patch, command, and commit consequences. A real remote
 publication result enters as provider/Bifrost-owned evidence rather than an
 Epiphany-authored facsimile.
 
+Hands also does not record operator-authored descriptions as if they were
+observed consequences. Exact `b78ffb25` deletes the callerless
+`epiphany-hands-action` recorder, its packaged role, command-description
+handshake, and main-only tests. The coordinator may seal a scoped action gate,
+but reports `awaitingHandsExecutor`; it cannot terminalize that gate. Exact
+receipt-chain admission and Verification projection remain ready for a future
+actuator that performs the operation and emits receipts from its own observed
+effects.
+
 Tool discovery also has no free-floating capability registry. Exact `beb9fd32`
 deletes `EpiphanyToolCapability`, its constructor/registration/contract row,
 standalone schema, catalog entry, and smoke-banner claim after finding no live

notes/epiphany-fork-implementation-plan.md

@@ -224,7 +224,7 @@ Delete or demote:
 
 Keep the five-day shakedown, Ox17 deployment, and Model Atlas operational Gate
 1 paused. Continue the source-subtraction and test-authority audit from exact
-`94098223`. The current sequence has deleted the semantic-memory/workspace-coverage
+`b78ffb25`. The current sequence has deleted the semantic-memory/workspace-coverage
 projection system, its local daemon supervisor, and the surviving generic
 RepoModel profile, impossible lifecycle, producerless receipt/summary, and
 decorative scoring axes. Modeling consumes typed Body and keyed RepoModel state
@@ -241,9 +241,11 @@ snapshot seam. Exact `56267201` deletes the three unadmitted Atlas daemon
 shells while retaining their typed library owners. Exact `900c5232` deletes the
 callerless frontier-proposal wrapper while retaining typed Self/runtime intake.
 Exact `94098223` reduces host identity to provider-owned public-anchor
-verification and deletes Epiphany's private-custody stack. Next redesign the
-Hands consequence command into its actual execution owner before removing its
-shell. The next test cut removes
+verification and deletes Epiphany's private-custody stack. Exact `b78ffb25`
+then deletes the callerless Hands consequence recorder and command-description
+handshake after proving that they executed nothing. Exact receipt-chain
+admission remains; the coordinator reports `awaitingHandsExecutor` until a real
+actuator owns execution and observed consequences. The next test cut removes
 static display labels, pure helper spelling checks, and redundant cache-policy
 assertions only where stronger consequence tests already own the invariant.
 

notes/fresh-workspace-handoff.md

@@ -2,7 +2,7 @@
 
 Updated: 2026-08-23
 Branch: `codex/epiphany-shakedown-live`
-Latest committed implementation cut: `94098223`
+Latest committed implementation cut: `b78ffb25`
 Current worktree: executable/test authority subtraction; Ox17 remains paused
 
 ## Orientation
@@ -44,6 +44,18 @@ authorize the next capstone or Gate 1.
 
 ## What just landed
 
+Exact `b78ffb25` deletes the counterfeit `epiphany-hands-action` consequence
+recorder, its release role, the coordinator's unconsumed `recordPassCommand`,
+and the recorder's main-only tests: 926 net deletions. The executable performed
+no patch, command, or commit and had no runtime caller; it accepted descriptions
+of consequences that had already happened and wrote receipts for them. The
+coordinator now reports `awaitingHandsExecutor` instead of claiming the gate is
+ready. Exact typed intent, review, path-scope, consequence, refusal, and
+Verification admission remain, and the current-work capstone still proves the
+retained chain. Cargo now has 11 executable targets. Epiphany has no admitted
+repository actuator yet; a future Hands owner must execute the operation and
+emit receipts from its own observed consequences.
+
 Exact `94098223` removes Epiphany's unowned private host-identity custody and
 leaves only the Bifrost public-anchor contract plus signature verifier. The
 host-identity executable, release role, private identity schema/signer,

state/map.yaml

@@ -57,7 +57,7 @@ current_status:
   launch_dependency_cut: Exact 2aeab7a9 deletes the generic organ dependency matrix, generic receipt catalogue/proof profiles, persisted worker-launch cargo, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. Family admission owners derive exact dependencies from typed state. Worker-launch schema v2 and Persona projector prompt v1 refuse the old writable shape. Core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1 pass.
   operator_surface_subtraction: Exact ef92e853 deletes the callerless view-lens registry, legacy acceptance-bundle builders, test-only raw-JSON result interpreters, and six tests: 797 net lines. Exact a292979d and 77e817c1 delete the duplicate CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. Exact 3b94bf6e and 59c5e3a6 delete the nested duplicate status view, false auxiliary mode, and ignored status arguments. Exact 7c9b0cf3 deletes the fixed synthetic job table, role-board job cargo/mappers, and its test: 338 net lines. Exact 2ce91461 deletes the scene/planning Mind reconstructions, duplicate self-policy crate, unused prompt templates, four counterfeit schemas, and ten producer/source-text tests: 1,723 net lines. Exact 78836f3b deletes eight unconsumed status tableaux, the pressure calculator production only called without telemetry, its unreachable compaction action, one counterfeit schema, and six tests: 518 net lines. Exact f10f7fb3 deletes the final twelve epiphany.surface.* schemas and ten catalog entries after every one proved producerless and consumerless: 692 pure deletions. Exact ab3cacfb deletes thirty-one more producerless contracts, the false runtime-session mutation mouth, every Epiphany-owned Rider/Unity command schema, a callerless prompt-context module, its test-only specialist prompt system, and four self-affirming tests: 3,514 net lines. Exact 16d85b1b deletes six duplicate JSON-schema builder tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. Exact 06f93f70 deletes the test-only inverse OpenAI-to-native request mapper and makes two retained tests follow canonical native-to-provider derivation: sixty net lines. The local catalog now has twenty-three live or portable contracts. Brokkr owns Unity capabilities through CultMesh/Eve; a future Rider daemon owns Rider. Status retains Mind identity, exact current work, one action/reason decision, readable role lanes, and operator thought sealing. Core checks cleanly; retained provider and focused request-flow tests pass.
   immutable_runtime_identity_cut: Exact bf997ce0 removes empty legacy frontier-decision echoes and requires exact worker-result provenance. Exact e00ea70f deletes the lossy PID-only process compatibility API. Exact 87983ffc makes runtime identity immutable bootstrap state: no update time, duplicated capability catalog, temporary metadata, or launch-time reconstruction survives. Current-work launch replays the original identity and existing root-session envelopes byte-for-byte as strong reads, preventing hidden singleton timestamp conflicts while retaining substitution refusal. Exact ffcf036f advances runtime spine to v7 and derives the constant native runtime kind at CultNet publication. The current-work capstone, epoch refusal, and OpenAI-runtime all-target checks pass.
-  build_target_ownership_cut: Exact a319146b deletes the public non-atomic worker-launch path used only by test fixtures; exact 76fd259b deletes two source-layout tests while retaining real CLI refusal behavior. Exact b95a3266 deletes the superseded unpackaged OpenAI debug executable and the tests/helper that animated it. Exact 6f93134d makes epiphany-release-bundle the sole package owner for production entrypoints, disables automatic leaf binaries, reduces Cargo executable targets from 26 to 22, and deletes a hardcoded release target map plus two self-affirming tests that did not drive the build. Exact c04c3aff deletes the five-reexport auth wrapper crate; the transport imports its narrow Codex auth surface directly. Exact ad2292ee deletes two callerless Persona identity setup executables, their forced release roles, and 96 lines of enrollment/anchor-export wrappers. Exact 3dda58a5 deletes the duplicate Persona feedback ingress executable and release role after Resident Self proved to be the live authenticated Bifrost import owner. Exact 56267201 deletes three unadmitted Model Atlas daemon shells and release roles while preserving the typed library owners; authority separation alone does not justify production processes. Exact 900c5232 deletes the callerless frontier-proposal executable and release role; typed Self/runtime proposal intake and selection remain. Exact 94098223 deletes the host-identity executable/release role and 555 net lines of unowned private identity custody; Bifrost owns its signer while Epiphany retains only public-anchor verification. Cargo metadata reports 12 executable targets and no binary source with multiple package owners; focused current-work, Atlas runtime, Persona feedback, verifier, swarm, permit, Persona-service, and release-construction checks pass.
+  build_target_ownership_cut: Exact a319146b deletes the public non-atomic worker-launch path used only by test fixtures; exact 76fd259b deletes two source-layout tests while retaining real CLI refusal behavior. Exact b95a3266 deletes the superseded unpackaged OpenAI debug executable and the tests/helper that animated it. Exact 6f93134d makes epiphany-release-bundle the sole package owner for production entrypoints, disables automatic leaf binaries, reduces Cargo executable targets from 26 to 22, and deletes a hardcoded release target map plus two self-affirming tests that did not drive the build. Exact c04c3aff deletes the five-reexport auth wrapper crate; the transport imports its narrow Codex auth surface directly. Exact ad2292ee deletes two callerless Persona identity setup executables, their forced release roles, and 96 lines of enrollment/anchor-export wrappers. Exact 3dda58a5 deletes the duplicate Persona feedback ingress executable and release role after Resident Self proved to be the live authenticated Bifrost import owner. Exact 56267201 deletes three unadmitted Model Atlas daemon shells and release roles while preserving the typed library owners; authority separation alone does not justify production processes. Exact 900c5232 deletes the callerless frontier-proposal executable and release role; typed Self/runtime proposal intake and selection remain. Exact 94098223 deletes the host-identity executable/release role and 555 net lines of unowned private identity custody; Bifrost owns its signer while Epiphany retains only public-anchor verification. Exact b78ffb25 deletes the callerless Hands consequence recorder, release role, unconsumed command-description handshake, and main-only tests after proving that it executed no patch, command, or commit. The coordinator now reports awaitingHandsExecutor; exact typed receipt-chain admission remains. Cargo metadata reports 11 executable targets and no binary source with multiple package owners; focused current-work, coordinator, and release-construction checks pass.
   runtime_registry_authority_cut: Exact 03140a47 deletes the 649-line epiphany-runtime-spine operator/debug CLI, its packaged release role, its callerless Hello/schema-catalog service facsimile, the 600-line hand-maintained mutation-contract mirror, and the source-shape test that guarded that mirror. CultCache exact fdbf3bf exposes its registered type identities, so runtime status and model preflight derive accepted documents from the same registration used to open the Mind store. Executable targets fall from 22 to 21 with zero duplicate source owners. Core checks without warnings and release construction passes 17/17. Editor actuation remains entirely provider-owned: Brokkr owns Unity through CultMesh/Eve and a future Rider daemon owns Rider.
   coordinator_status_cut: Exact 500125d5 deletes the unconsumed packaged epiphany-mvp-status executable. Its live projection and operator-sanitization functions move from a binary source textually included by the coordinator into one epiphany-core module. The dead CLI parser, default store, result-file writer, release role, and redundant release assertion are gone. Cargo has 20 executable targets and zero duplicate binary-source owners; the release-owned coordinator checks, the operator thought-sealing test passes, and release construction remains 17/17.
   persona_language_tribunal_cut: Exact 63939fa2 deletes Persona's keyword-based projector-output tribunal, its test-only no-transcript prompt wrapper, and two tests that blessed prompt phrases and forbidden words rather than a consequence. Projector and Persona outputs remain inert private cognition sealed into exact stage contexts. Only the Interpreter's closed typed effect enum can propose state or speech; its channel, cardinality, size, schema, and exact-context validation remain. The three-stage execution/replay, channel-escape refusal, substituted provider/model refusal, retained typed-effect validation, and OpenAI-runtime all-target checks pass.
@@ -115,7 +115,7 @@ current_status:
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
   unresolved_authority: Generic command, legacy lineage, caller-authored identity, behaviorless policy fields, global lifecycle latest state, timestamp election, Windows Task Scheduler authority, and their false proofs are gone. Semantic and workspace launch owners are separate over shared process mechanics. The remaining daemon supervisor still combines the service loop, aggregate signed-health publication, semantic reconciliation, and the large workspace recovery state machine. Continue decomposing only where ownership becomes smaller; do not create family frameworks or adapters. The false persisted cluster-topology bootstrap sentinel is gone; supervisor admission remains bound to exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until subtraction closes. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Continue the source/test-authority audit after exact 94098223. Redesign the Hands consequence recorder into the actual execution/coordinator owner while preserving exact intent, review, path-scope, consequence, refusal, and Verification receipt chains; only then delete the shell and release role. Remove static helper-spelling and redundant cache-policy tests only where stronger consequence tests already own the invariant. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, immutable runtime identity, single-package binary ownership, family admission owners, typed Persona effect validation, public-anchor verification, and Atlas library authority without speculative daemons. Epiphany owns no private Bifrost key custody, local daemon supervisor, standalone schema service, static status CLI, manual smoke command, counterfeit provider physiology, duplicate completion catalogue, editor bridge, keyword tribunal over natural language, tautological test, duplicate parser proof, ignored live-network anecdote, callerless identity setup executable, competing Persona feedback ingress, unadmitted Atlas process, or frontier proposal CLI. Do not run a local full-workspace compile, package, deployment, or Ox root.
+  next_action: Continue the source/test-authority audit after exact b78ffb25. Remove static helper-spelling and redundant cache-policy tests only where stronger consequence tests already own the invariant, then collapse the generic public host-identity verifier into its sole Bifrost feedback-admission consumer if CultNet wire compatibility is exact. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, immutable runtime identity, single-package binary ownership, family admission owners, typed Persona effect validation, Bifrost public-anchor verification, exact Hands receipt-chain admission, and Atlas library authority without speculative daemons. Epiphany owns no private Bifrost key custody, repository actuator yet, local daemon supervisor, standalone schema service, static status CLI, manual smoke command, counterfeit provider physiology, duplicate completion catalogue, editor bridge, keyword tribunal over natural language, tautological test, duplicate parser proof, ignored live-network anecdote, callerless identity setup executable, competing Persona feedback ingress, unadmitted Atlas process, frontier proposal CLI, or consequence recorder that did not execute consequences. Do not run a local full-workspace compile, package, deployment, or Ox root.
 
   runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.
 

state/scratch.md

@@ -76,13 +76,15 @@ and janitors may reduce the symptom but cannot substitute for deleting code.
    typed proposal intake and selection remain in Self/runtime.
 9. Done: delete the host-identity command and private-custody implementation;
    retain only Bifrost public-anchor verification plus deterministic test fixtures.
-10. In progress: redesign the Hands consequence command into its execution
-   owner before deleting the shell. Then remove tests that inspect spelling, duplicate
-   constructors, or
+10. Done: delete the callerless Hands consequence recorder, release role,
+   command-description handshake, and main-only tests. It executed nothing;
+   the coordinator now reports `awaitingHandsExecutor`, while exact typed
+   receipt-chain admission remains for a future real actuator.
+11. Next: remove tests that inspect spelling, duplicate constructors, or
    exercise one-line helpers without reaching a consequence. Preserve exact
    CAS, conflict, substitution, concurrency, lifecycle, and re-entry proofs.
    The semantic-memory/workspace-coverage projection stack and its local daemon
    supervisor were deleted at `856648de` after proving that no sealed reasoning
    projection consumed them.
-11. Run focused tests after each cut. Only after source subtraction stabilizes
+12. Run focused tests after each cut. Only after source subtraction stabilizes
    should Idunn's build scratch contract be reconsidered.