diff --git a/epiphany-core/src/bin/epiphany-verse-query.rs b/epiphany-core/src/bin/epiphany-verse-query.rs index 3d48253f..86ddb85c 100644 --- a/epiphany-core/src/bin/epiphany-verse-query.rs +++ b/epiphany-core/src/bin/epiphany-verse-query.rs @@ -43,7 +43,6 @@ use epiphany_core::epiphany_cultmesh_bifrost_collaboration_feedback; use epiphany_core::epiphany_cultmesh_daemon_poke_intent_from_status; use epiphany_core::epiphany_cultmesh_daemon_poke_receipt_for_intent; use epiphany_core::epiphany_cultmesh_daemon_tool_invocation_intent_from_capability; -use epiphany_core::epiphany_cultmesh_daemon_tool_invocation_receipt_for_intent; use epiphany_core::epiphany_cultmesh_eve_connection_intent_from_advertisement; use epiphany_core::epiphany_service_execution_audit_report; use epiphany_core::load_agent_state_soa_entry; @@ -95,7 +94,6 @@ use epiphany_core::write_epiphany_cultmesh_daemon_restart_policy; use epiphany_core::write_epiphany_cultmesh_daemon_service_lifecycle_receipt; use epiphany_core::write_epiphany_cultmesh_daemon_status; use epiphany_core::write_epiphany_cultmesh_daemon_tool_invocation_intent; -use epiphany_core::write_epiphany_cultmesh_daemon_tool_invocation_receipt; use epiphany_core::write_epiphany_cultmesh_eve_connection_intent; use epiphany_core::write_epiphany_cultmesh_swarm_brake; use epiphany_core::write_epiphany_cultmesh_work_loop_telemetry; @@ -1805,24 +1803,13 @@ fn run_cli() -> Result<()> { args.runtime_id.clone(), tool_intent.clone(), )?; - let tool_receipt = epiphany_cultmesh_daemon_tool_invocation_receipt_for_intent( - "daemon-tool-receipt-smoke", - &tool_intent, - "accepted-for-hands-review", - hands_repo_action.receipt_contract_type.clone(), - "cultmesh://epiphany-local/hands-action-review/smoke", - "Hands accepted the globally discoverable tool invocation for typed review.", - ); - write_epiphany_cultmesh_daemon_tool_invocation_receipt( - &args.store, - args.runtime_id.clone(), - tool_receipt, - )?; let context = query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?; if context.latest_daemon_tool_invocation_intent.is_none() - || context.latest_daemon_tool_invocation_receipt.is_none() + || context.latest_daemon_tool_invocation_receipt.is_some() { - anyhow::bail!("local Verse query smoke lost daemon tool invocation intent/receipt"); + anyhow::bail!( + "local Verse query smoke lost daemon tool intent or manufactured a host receipt" + ); } let persona_cluster = cluster_topology_for_id(&context, "epiphany.cluster.persona")?; let hands_cluster = cluster_topology_for_id(&context, "epiphany.cluster.hands")?; @@ -2677,7 +2664,8 @@ fn run_cli() -> Result<()> { || receipt_directory.artifact_missing_count != 0 || !receipt_directory.rows.iter().any(|row| { row.family == "daemon-tool" - && row.latest_id == "daemon-tool-receipt-smoke" + && !row.present + && row.latest_id == "missing" && row.follow_up_command == WRAPPER_INVOKE_TOOL_COMMAND }) || !receipt_directory.rows.iter().any(|row| { diff --git a/epiphany-core/src/cultmesh_integration.rs b/epiphany-core/src/cultmesh_integration.rs index 9371a43b..c3f1dd57 100644 --- a/epiphany-core/src/cultmesh_integration.rs +++ b/epiphany-core/src/cultmesh_integration.rs @@ -4125,6 +4125,7 @@ pub fn epiphany_cultmesh_daemon_tool_invocation_intent_from_capability( } } +#[cfg(test)] pub fn epiphany_cultmesh_daemon_tool_invocation_receipt_for_intent( receipt_id: impl Into, intent: &EpiphanyCultMeshDaemonToolInvocationIntentEntry, @@ -4193,6 +4194,7 @@ fn validate_daemon_tool_invocation_intent( Ok(()) } +#[cfg(test)] fn validate_daemon_tool_invocation_receipt( receipt: &EpiphanyCultMeshDaemonToolInvocationReceiptEntry, ) -> Result<()> { @@ -4245,6 +4247,7 @@ pub fn write_epiphany_cultmesh_daemon_tool_invocation_intent( Ok(written) } +#[cfg(test)] pub fn write_epiphany_cultmesh_daemon_tool_invocation_receipt( store_path: impl AsRef, runtime_id: impl Into, @@ -6227,6 +6230,7 @@ fn epiphany_cultmesh_idunn_aftercare_audit_receipt_ref_key(receipt_ref: &str) -> } } +#[cfg(test)] fn epiphany_cultmesh_daemon_tool_invocation_receipt_key(receipt_id: &str) -> String { format!("epiphany-local/daemon-tool-invocation-receipt/{receipt_id}") } diff --git a/epiphany-core/src/lib.rs b/epiphany-core/src/lib.rs index 757c4f3e..51ede66b 100644 --- a/epiphany-core/src/lib.rs +++ b/epiphany-core/src/lib.rs @@ -391,6 +391,7 @@ pub use cultmesh_integration::epiphany_cultmesh_daemon_statuses; #[cfg(test)] pub use cultmesh_integration::epiphany_cultmesh_daemon_tool_invocation_from_status_json; pub use cultmesh_integration::epiphany_cultmesh_daemon_tool_invocation_intent_from_capability; +#[cfg(test)] pub use cultmesh_integration::epiphany_cultmesh_daemon_tool_invocation_receipt_for_intent; pub use cultmesh_integration::epiphany_cultmesh_eve_connection_intent_from_advertisement; #[cfg(test)] @@ -490,6 +491,7 @@ pub use cultmesh_integration::write_epiphany_cultmesh_daemon_status; #[cfg(test)] pub use cultmesh_integration::write_epiphany_cultmesh_daemon_statuses; pub use cultmesh_integration::write_epiphany_cultmesh_daemon_tool_invocation_intent; +#[cfg(test)] pub use cultmesh_integration::write_epiphany_cultmesh_daemon_tool_invocation_receipt; pub use cultmesh_integration::write_epiphany_cultmesh_eve_connection_intent; #[cfg(test)] diff --git a/notes/conceptual-substitution-audit-2026-07-12.md b/notes/conceptual-substitution-audit-2026-07-12.md index 86378751..71df356d 100644 --- a/notes/conceptual-substitution-audit-2026-07-12.md +++ b/notes/conceptual-substitution-audit-2026-07-12.md @@ -251,3 +251,16 @@ boundary owns them. The aggregate Verse smoke now proves the honest pending state: requester intent present, provider receipt absent. The typed response schema and reader remain as the wire/ingest contract; they grant no local response authorship. + +## Orphaned daemon-tool response authority + +Daemon-tool intents were requester-only in production, but the response +constructor/writer remained publicly exported with no host-daemon caller. The +aggregate smoke was the sole shipped writer and fabricated an accepted Hands +result so receipt-directory presentation could look complete. + +Response construction, validation, persistence, and keying are now test-only. +The smoke persists the requester intent, requires the host receipt to remain +absent, and verifies the directory reports a missing response. The typed schema +and reader remain the host-daemon/ingest contract; no shipped generic CLI can +author the daemon's answer. diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index d0394317..422efe7f 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -48,6 +48,7 @@ ## Persona feedback and Imagination consensus boundary (2026-07-12) - Eve connection requests remain pending until a real target provider daemon or authenticated ingest boundary supplies the typed response. The former generic `epiphany-eve-provider` CLI is deleted because caller-supplied provider identity and status did not constitute provider participation; local response construction/writing is test-only. +- Daemon-tool invocation requests likewise remain pending until the advertised host daemon or authenticated ingest boundary supplies the typed response. Local response construction/writing/validation is test-only; aggregate smoke and receipt-directory projection prove intent-present/receipt-missing instead of manufacturing host acceptance. - Persona owner: `collaboration-feedback` writes public, bounded feedback only after that provider receipt exists. - Imagination owner: consensus participant selection, packet reference, receipt status/id, and adoption gate. - Persona output: `pending-imagination` with null consensus fields and `responseOwner=Imagination`. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 453d0f26..9f9303f0 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -57,6 +57,9 @@ The confirmed conceptual substitutions have been cut: identity/status was not provider participation. Eve requests remain pending; local response construction/writing is test-only until a real target daemon or authenticated ingest boundary owns the receipt. +- daemon-tool response construction/writing is also test-only. No shipped host + daemon currently responds; the aggregate smoke proves a pending intent and a + missing host receipt rather than fabricating Hands acceptance. The presentation boundary is now plain: `swarm overview` is a generic compact read-only projection. Gjallar is a downstream TUI application on Nightwing and is not an Epiphany organ, provider, owner, runtime, or architectural dependency. Eve/CultUI graphs may be lowered or composited downstream without Epiphany caring which presentation client does it. diff --git a/notes/receipt-writer-provenance-audit-2026-07-12.md b/notes/receipt-writer-provenance-audit-2026-07-12.md index cd489333..993c280b 100644 --- a/notes/receipt-writer-provenance-audit-2026-07-12.md +++ b/notes/receipt-writer-provenance-audit-2026-07-12.md @@ -11,6 +11,10 @@ Inventory every production call to `write_*receipt`, then ask whether the execut `epiphany-eve-provider` accepted caller-supplied provider identity and status, so it was deleted; constructor/writer are test-only pending a real provider daemon or authenticated ingest boundary. +- Daemon-tool invocation receipt: no production local writer. The aggregate + smoke was the only shipped caller and manufactured host acceptance; response + constructor/writer/validator/key are test-only pending a real host-daemon or + authenticated ingest boundary. - `epiphany-operator-run`: owner-aligned for operator-run receipts and coordinator receipts derived from the run it executes. - smoke binaries and the `epiphany-verse-query smoke` arm: fixtures, not runtime evidence. They remain a quarantine risk if permitted to target canonical stores. - `epiphany-work` Weksa lowering: a lowering projection receipt, explicitly non-publication authority; no substitution confirmed in this pass. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index a6890acc..50e0b333 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 12648b5b..69585484 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -70,7 +70,7 @@ data_flow: - move historical proof to git, commits, smoke artifacts, or distilled evidence rather than plan prose active_subgoals: - - Use `notes/conceptual-substitution-audit-2026-07-12.md` plus `notes/receipt-writer-provenance-audit-2026-07-12.md` as the current authority-corrosion maps. Snapshot promotion, synthetic smoke escape, unbound operator completion, hidden service execution flags, provider/bootstrap collapse, central/all-provider publication, production-side implicit bootstrap, orphaned external response authority, bulk readiness authority, public topology-derived provider builders, bootstrap/template-authored operator observation, writerless operator-status schema authority, SoA projection body creation, path-selection-as-body-creation, and executable-name-as-provider-participation are cut. Provider responses and readiness without observers are test-only; the ownerless operator-status family and counterfeit Eve provider CLI are deleted; templates are private; query mutations require the body. CultCache's backing store owns missing-read purity by returning before lock acquisition. Next audit remaining projections, caches, schedulers, adapters, and non-receipt smokes for borrowed authority or path escape. + - Use `notes/conceptual-substitution-audit-2026-07-12.md` plus `notes/receipt-writer-provenance-audit-2026-07-12.md` as the current authority-corrosion maps. Snapshot promotion, synthetic smoke escape, unbound operator completion, hidden service execution flags, provider/bootstrap collapse, central/all-provider publication, production-side implicit bootstrap, orphaned external response authority, bulk readiness authority, public topology-derived provider builders, bootstrap/template-authored operator observation, writerless operator-status schema authority, SoA projection body creation, path-selection-as-body-creation, executable-name-as-provider-participation, and orphaned daemon-tool response authority are cut. Provider responses and readiness without observers are test-only; the ownerless operator-status family and counterfeit Eve provider CLI are deleted; templates are private; query mutations require the body. CultCache's backing store owns missing-read purity by returning before lock acquisition. Next audit remaining projections, caches, schedulers, adapters, and non-receipt smokes for borrowed authority or path escape. - `swarm-overview` is an Epiphany-local, renderer-neutral diagnostic projection over provider-owned typed state. It owns no lifecycle, discovery, composition, or mutation authority. Epiphany publishes clean provider-owned Eve surfaces; Odin may discover them; downstream lowerers and compositors remain outside Epiphany's concern. - Idunn owns daemon survival and service lifecycle physiology. Codex/operator sessions may inspect, generate runbooks, and route explicit operator authority, but keeping daemons alive belongs to Idunn-owned service lifecycle receipts, scheduler policy, audits, and aftercare. Do not let Self, diagnostic projections, or ad hoc wrapper summaries become a second daemon-keeper. Global tool readbacks for Self `service-health`, `service-policy-directory`, and `swarm-online-runbook` state `lifecycleOwner=Idunn` and `hostedBody=Epiphany` without service mutation or private-state exposure. - Use `notes/epiphany-cultmesh-dreaming-roadmap.md` as the design authority for distributed Epiphany dreaming. Public dreams are separately authored typed documents distributed through CultMesh/CultNet; private state remains local and cannot be shared by flipping a visibility flag. Foreign dreams are external thought weather until a reviewed local adoption receipt digests them into memory, planning, doctrine, or governance.