From 3c7bfae52df02a466b723b827d18917dc37a3b3e Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Tue, 11 Aug 2026 17:03:00 +0200 Subject: [PATCH] Record daemon brake actuation proof --- notes/epiphany-current-algorithmic-map.md | 33 ++++++++++++++++++++ notes/fresh-workspace-handoff.md | 34 +++++++++++++++++++++ notes/perfect-machine-audit-roadmap.md | 37 ++++++++++++++++------- state/map.yaml | 8 ++--- 4 files changed, 97 insertions(+), 15 deletions(-) diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index 76d6a459..7688a221 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -4099,3 +4099,36 @@ state is now the sole final-action owner for these review paths. the real receipt, left runtime bytes unchanged, and exact packaged Heartbeat produced no replacement grant while braked or released. Receipts live under `.epiphany-run/b81-superseded-fixture`. + +## Canonical brake ownership of daemon actuation + +- Owner: the canonical CultMesh swarm-brake document owns whether Idunn may + perform daemon lifecycle actuation during a shakedown pause. Idunn owns the + restart decision only after that brake permits it. +- Inputs: canonical brake identity and owner, status, all-scope affected + runtime, protected surfaces, exact daemon status, typed restart policy or + explicit operator override, cooldown, and force/staleness signal. +- Outputs: an engaged brake containing `daemon.lifecycle_poke` refuses before + intent publication or process execution. A permitted attempt emits one poke + intent, native process result, receipt, and updated retry policy. +- Derived state: `requesting_agent_id`, CLI command text, status projections, + and tool-directory rows are provenance or sight; none can release the brake. +- Forbidden writers: direct `reconcile --restart-command`, scheduled tick, + generic service launch, v0 daemon capabilities, and compatibility wrappers + cannot remove a protected surface or infer permission from an all-scope + brake. Unauthenticated v0 tool capabilities remain ignored and publish no + invocation command. +- Shared paths: explicit engagement and engaged-brake adoption both use + `canonical_epiphany_swarm_brake_protected_surfaces`; direct and scheduled + reconciliation converge on `assert_swarm_brake_allows_daemon_poke` before + `run_restart_command`. +- Cut line: canonical engagement no longer replaces the default surface set + with a list that omits `daemon.lifecycle_poke`. No second actuator gate or + Hands impersonation was added. +- Verification: exact packaged `3fdff19f` passes the full Verse smoke. Forced + reconciliation with operator-supplied `/bin/sh` against quarantined copied + state exits 1 with the canonical-brake refusal, preserves the CultCache hash + byte-for-byte, and creates no marker. Its 24-binary release is + `sha256-bd0062904fa8e7097946c6fd735191de43ff04a89d1c3c29c0c86f876815fb31`; + witness + `sha256-a051980f70b13d9dafa014fedc7fc636eb075a9fc85dc53e3a94081bcc3fe3e0`. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 24f7fa9a..222cc709 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -3757,3 +3757,37 @@ revision 312 with no active lease. Exact status derives pending proposal, no Imagination frontier, and no Hands consequence. Receipts are `.epiphany-run/forge-crosscommit-3a5d2b5e*` and `.epiphany-run/live-swap-c007f-2e1ccaf7`. + +## Canonical brake closes direct daemon actuation - 2026-08-11 + +The non-repository actuator audit found one real Idunn bypass. The default +brake listed `daemon.lifecycle_poke`, but explicit canonical engagement replaced +that list with `canonical_epiphany_swarm_brake_protected_surfaces`, which +omitted it. Therefore `epiphany-daemon-supervisor reconcile --restart-command` +could reach an arbitrary operator-supplied executable while an all-scope brake +was engaged. Commit `5a46f569` restores that surface to the canonical owner +list and adds an exact engagement test. This is a brake ownership repair, not a +new Hands gate: Idunn still owns permitted deployment restart actuation. + +The first packaged probe also exposed two dead assertions in +`epiphany-verse-query smoke`: one demanded the former EpiphanyAgent path instead +of the fixture topology's Body domain; another demanded a removed +`imagination-consensus` receipt row with no producer or report path. Commit +`3fdff19f` compares poke routing to the topology document that owns it and +deletes the ownerless receipt assertion. Nineteen Verse-query tests and the +full native Verse smoke pass. + +Exact `3fdff19f` packages as 24-binary release +`sha256-bd0062904fa8e7097946c6fd735191de43ff04a89d1c3c29c0c86f876815fb31` +with witness +`sha256-a051980f70b13d9dafa014fedc7fc636eb075a9fc85dc53e3a94081bcc3fe3e0`; +changed Cargo took 30.66s and an identical warm replay took 0.82s with zero +warnings. Its packaged Verse smoke passes. On the resulting quarantined copied +state, a forced `/bin/sh` restart attempt refused exit 1 before execution, +preserved the exact local-Verse SHA-256, and created no marker. Receipts are +`.epiphany-run/forge-crosscommit-3fdff19f*` and +`.epiphany-run/brake-actuator-proof-3fdff19f`. + +Actual c007h remains exact `3a5d2b5e`, alive, braked at revision 312, and +untouched. Continue classifying remaining non-repository actuators by their +real owner; do not manufacture frontier work or build on Yggdrasil. diff --git a/notes/perfect-machine-audit-roadmap.md b/notes/perfect-machine-audit-roadmap.md index b2a3e9f9..33126b1b 100644 --- a/notes/perfect-machine-audit-roadmap.md +++ b/notes/perfect-machine-audit-roadmap.md @@ -12,7 +12,7 @@ the actual braked resident body are the live gates. ## Current body - Source branch: `codex/epiphany-shakedown-live`. -- Current source: exact `b8c39f99`. +- Current source: exact `3fdff19f`. - Accepted runtime implementation: exact `3a5d2b5e`. - Linux release: `sha256-84af3da8d2a2e170aa0611e48367eac4ecf5f66b2a2da763dc3045c5ad360177`. @@ -21,6 +21,10 @@ the actual braked resident body are the live gates. - Actual c007h: Heartbeat and resident Self alive in distinct containers, cognitive brake engaged, resident revision 312, authenticated readiness, no active lease, and action `awaitFrontierProposal`. +- Audited candidate release: + `sha256-bd0062904fa8e7097946c6fd735191de43ff04a89d1c3c29c0c86f876815fb31`; + witness + `sha256-a051980f70b13d9dafa014fedc7fc636eb075a9fc85dc53e3a94081bcc3fe3e0`. - Build body: Starfire. Yggdrasil is the small public crossing and never builds this graph. @@ -29,11 +33,11 @@ the actual braked resident body are the live gates. | Faculty | Owner | Accepted proof | Remaining live gate | |---|---|---|---| | Self | resident Self state machine | single-consumption Heartbeat grants, typed fulfillment, exact recovery/requeue, cooldown and brake behavior; actual c007h superseded one overtaken unlaunched continuation and accepted the recovered proposal-Modeling result exactly once | autonomous turnover from a genuinely new typed frontier; current `awaitFrontierProposal` is correctly idle | -| Substrate Gate | `substrate_gate` | scoped read/mutation grants on Eyes and Hands paths | audit remaining utility and compatibility actuators for bypasses | +| Substrate Gate | `substrate_gate` | scoped read/mutation grants on Eyes and Hands paths; canonical brake now covers direct daemon lifecycle actuation | finish classifying utility and compatibility actuators by their actual owner | | Eyes | Eyes gateway and authenticated source tools | challenged-claim Windows circuit and governed Linux tool circuit accepted into Mind | one broader foreign/public Verse evidence adoption path | | Modeling | runtime-owned typed Modeling contracts | causal Eyes-to-Modeling acceptance, direct proposal Modeling, archived fulfillment | broader Body-map coverage across a changing live repository | | Imagination | typed proposal/consideration producers | genuine packaged multi-option generation, proposal-only candidates, exact fulfillment, no Hands adoption leak | autonomous turnover from the next genuine eligible frontier | -| Hands | Hands gateway | bounded patch, command, commit, push, and changed-path receipts | audit non-repo-work actuators for direct consequence paths | +| Hands | Hands gateway | bounded patch, command, commit, push, and changed-path receipts; Idunn restart commands remain separate typed deployment authority and now brake closed | finish non-repo actuator classification for bridges, bootstrap, crossing, and forge paths | | Soul | Soul gateway | consequence-bound verdict, causal Modeling route, retention and replay | collapse remaining verifier-specific broad projections into narrow receipt reads | | Mind | canonical transactions and specialized admission | atomic RepoModel admission, launch-owned adjudication, semantic/runtime retention | audit remaining state families for legacy writers and run longer memory behavior | | Persona | Persona turn, speech audit, public mouth | cross-host request/permit/receipt, signed failure and unknown no-repost behavior, conversation retention | one completed public consequence; currently blocked by absent Yggdrasil Discord credential | @@ -80,6 +84,15 @@ recovered `reviewModelingResult` route, accepted to idle at revision 312. The cognitive brake is engaged; no pending proposal, Imagination frontier, active lease, or Hands consequence exists. +Exact candidate `3fdff19f` retains `daemon.lifecycle_poke` whenever the +canonical all-scope brake is engaged. Its 24-binary Linux release completed in +30.66s; an identical warm replay took 0.82s. The packaged Verse smoke passes. +A forced supervisor reconciliation with operator-supplied `/bin/sh` against +quarantined copied state refused exit 1, preserved the exact CultCache hash, +and created no command marker. Receipts: +`.epiphany-run/forge-crosscommit-3fdff19f*` and +`.epiphany-run/brake-actuator-proof-3fdff19f`. + ## Completed narrow local Verse consumer audit Lifecycle and single-target commands read only the state families that own @@ -107,14 +120,16 @@ these legitimate aggregates into ad hoc query piles. ## Selected next bounded cut -Map every surviving non-repository process actuator before editing it. Begin -with `epiphany-daemon-supervisor`: distinguish explicit operator service launch, -typed restart-policy reconciliation, and any agent/CultMesh-published command -surface. For each path name the policy owner, executable binding, brake, -receipt, and forbidden writers. Then inspect the remaining utility and bridge -actuators. Cut only a demonstrated bypass; do not wrap coherent operator or -Idunn authority in another gate. Actual c007h remains braked and untouched -during the source audit. +Finish mapping the surviving non-repository process actuators. The supervisor +boundary is now classified: specialized managed children bind witnessed +executables and typed policies; explicit generic service launch is operator +CLI authority; restart reconciliation is Idunn authority under status, policy, +cooldown, brake, intent, and receipt; unauthenticated v0 tool capabilities are +ignored and publish no invocation command. Continue with Rider, Unity, +Persona/Bifrost, repo bootstrap, release construction, process observation, +and model-runtime launch paths. Cut only a demonstrated autonomous bypass; do +not wrap coherent operator, crossing, forge, or cognition authority in another +gate. Actual c007h remains braked and untouched during the source audit. ## Completion standard diff --git a/state/map.yaml b/state/map.yaml index 3a1167f4..2a10fbe5 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -36,9 +36,9 @@ invariants: current_status: summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, exact 16c4b19f coordinator receipt and Heartbeat artifact retention, exact cce2b8ac narrow model-generation retention, exact eea15e82 model-turn JSON ingress, exact b1e8c89a semantic unattempted-generation retention, exact 6bc3ec3f semantic physical-epoch retirement, and exact 44230a05 Persona conversation retention are proven. Gamecult-ops 059821f owns Yggdrasil stream retention and exact 6ee08a4 owns stable Starfire Persona-permit firewall ingress. Exact 16c4b19f genuine idle and exact a987d2f7 active cognition completed 900-pulse bounded plateaus. Runtime-owned typed fulfillment is accepted live under exact 6dd9b132. Yggdrasil is the small public crossing body, never the release forge. - latest_phase: Exact 3a5d2b5e makes preparation revalidate receipt-derived launch continuations and atomically supersede an overtaken unlaunched grant. It is pushed, packaged as release sha256-84af3da8d2a2e170aa0611e48367eac4ecf5f66b2a2da763dc3045c5ad360177 with witness sha256-589ff2ca11392b02fee9cb5d3a0209d958fc47cc3695f82bb6e5bed08d4c4463, and runs as c007h. Changed Cargo was 50.87s and identical warm replay 0.81s. Live c007h superseded the preserved stale launchModeling grant without process launch, accepted result-worker-8ddf57c1-96b4-4a60-ae8b-b24404e9ce2f exactly once through the recovered review route, and canonically consumed one already-admitted model-direction fulfillment that crossed the brake write. It is braked at revision 312 with no active lease. Status derives awaitFrontierProposal, Modeling accepted after Research, proposal bound, no pending proposal, no Imagination frontier, and no Hands consequence. Yggdrasil never builds. + latest_phase: Exact 3fdff19f closes a canonical-brake actuator bypass and cuts two archaeological Verse-smoke assertions. Explicit brake engagement now retains daemon.lifecycle_poke, so direct Idunn reconciliation cannot execute even an operator-supplied restart command while the all-scope brake is engaged. The exact Linux candidate is release sha256-bd0062904fa8e7097946c6fd735191de43ff04a89d1c3c29c0c86f876815fb31 with witness sha256-a051980f70b13d9dafa014fedc7fc636eb075a9fc85dc53e3a94081bcc3fe3e0; changed Cargo took 30.66s and identical warm replay 0.82s across 24 binaries with zero warnings. Its packaged Verse smoke passes, and a forced /bin/sh restart against quarantined copied state refuses exit 1 with byte-identical CultCache and no marker. Actual c007h remains exact 3a5d2b5e, braked at revision 312 with no active lease and action awaitFrontierProposal. Yggdrasil never builds. operational_state: - local_worktree: exact_b8c39f99_live_recovery_state_pushed_clean + local_worktree: exact_3fdff19f_runtime_with_current_mind_refresh operator_wireguard: restored starfire_persona_permit_firewall: persistent_exact_gamecult_ops_6ee08a4 yggdrasil: canonical_small_public_crossing_body @@ -69,8 +69,8 @@ current_status: starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed resident_physiology: c007h_exact_3a5d2b5e_live_braked_revision_312_bounded_local_logs - unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, all three packaged fulfilled-before-receipt lanes, genuine packaged Imagination option generation, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, co-resident resident lifecycle retention, authenticated outer-worker attempt retention, deployed supervisor/projector journald ownership, Docker named-volume atomic snapshot visibility, and deterministic incremental release construction are accepted. Starfire's Docker Desktop F: bind is rejected for mutable authority after an exact packaged lockless reader observed an empty published snapshot during writer interruption. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. One completed Discord consequence remains blocked by the absent Yggdrasil credential. Exact aa841873 also makes legacy coordinator repair one full-snapshot transaction so a later hostile family cannot leave an earlier partial repair. - next_action: Keep exact 3a5d2b5e c007h braked at revision 312. The autonomous proposal queue is drained and current action awaitFrontierProposal has no eligible Imagination frontier, so do not manufacture work or relaunch Modeling. Seal the live recovery evidence, then return to the remaining shakedown organ matrix: audit the next unproven Soul/Continuity/retention boundary from current source and copied state, preserving c007h. Yggdrasil never builds. + unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, all three packaged fulfilled-before-receipt lanes, genuine packaged Imagination option generation, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, co-resident resident lifecycle retention, authenticated outer-worker attempt retention, deployed supervisor/projector journald ownership, Docker named-volume atomic snapshot visibility, deterministic incremental release construction, and canonical-brake refusal of direct daemon lifecycle actuation are accepted. Starfire's Docker Desktop F: bind is rejected for mutable authority after an exact packaged lockless reader observed an empty published snapshot during writer interruption. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. One completed Discord consequence remains blocked by the absent Yggdrasil credential. Exact aa841873 also makes legacy coordinator repair one full-snapshot transaction so a later hostile family cannot leave an earlier partial repair. + next_action: Keep exact 3a5d2b5e c007h braked at revision 312. Continue the non-repository actuator audit from exact 3fdff19f: classify Rider, Unity, Persona/Bifrost, repo bootstrap, release construction, process observation, and model-runtime launch paths by explicit operator, cognition, crossing, forge, or test authority. Cut only demonstrated autonomous bypasses, then select the next unproven organ boundary. Do not manufacture frontier work or build on Yggdrasil. active_subgoals: - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.