From 4ab6bc66f68f4118c7aa8d8d406a815b64fded87 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 9 Aug 2026 18:17:16 +0100 Subject: [PATCH] Accept Heartbeat retention and journal ownership --- notes/epiphany-current-algorithmic-map.md | 38 +++++++++++++--------- notes/fresh-workspace-handoff.md | 25 +++++++++----- state/ledgers.msgpack | Bin 592512 -> 593087 bytes state/map.yaml | 6 ++-- 4 files changed, 42 insertions(+), 27 deletions(-) diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index d8ac0813..81f380db 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -9,7 +9,7 @@ - Forbidden writers: projection limits cannot masquerade as retention. Unknown directory names, symlinks, paths outside the canonical root, post-plan manifest changes, and the pulse containing the latest cognition artifact all fail closed before deletion. - Shared paths: explicit `retain-artifacts` and every resident heartbeat serve outcome call the same plan/reconcile primitive. A crash after plan commitment resumes that exact plan; already absent members are accepted, while surviving members must still match their planned manifests. - Cut line: the permanent one-directory-per-15-second growth path is removed. Process stdout/stderr logs remain a separate supervisor-owned rotation problem and are not deleted by heartbeat retention. -- Verification layer: synthetic CultCache-backed tests prove hysteresis bounding and idempotence, changed-plan refusal with preservation, unknown-directory refusal before deletion, and protection of the latest cognition artifact. Live backlog reduction waits for exact packaging. +- Verification layer: synthetic CultCache-backed tests prove hysteresis bounding and idempotence, changed-plan refusal with preservation, unknown-directory refusal before deletion, and protection of the latest cognition artifact. Exact packaged `16c4b19f` retired pulse directories 1-2 from a five-pulse copied-store fixture, retained 3-5 byte-identically, emitted its typed plan/receipt projection, and replay returned `within-bound` without another receipt. ## Runtime job and session closure ownership @@ -2067,8 +2067,11 @@ work. path, and digest may be removed. Symlinks, non-directories, drift, and unknown members fail closed. - **Verification layer:** existing tests prove boundedness, idempotence, - exact-member refusal, and typed receipts. The remaining live audit must use - the packaged path, not invent a second cleaner. + exact-member refusal, and typed receipts. Exact packaged `16c4b19f` used the + same public command path to retire two witnessed directories from a + five-pulse copied-store fixture, preserve the remaining three, and replay as + `within-bound` without another receipt. Receipts are under + `.epiphany-run/heartbeat-retention-16c4b19f`. ### Resident Self lifecycle rows @@ -2118,18 +2121,23 @@ work. ### Supervisor stdout/stderr -- **Owner:** the daemon supervisor opens each service stdout/stderr path. A - launch truncates those files, but output during one long-lived process is - currently unbounded; the append-only fatal log is unbounded across launches. -- **Forbidden writers:** an external truncator must not cut a file beneath an - inherited child descriptor. That can leave the writer at its old offset and - create sparse or misleading evidence. -- **Intended boundary:** either the supervisor owns piped, bounded rotation with - nonblocking drains and crash-safe receipts, or the deployment service manager - owns rotation and the repo stops claiming file ownership. The infrastructure - runbook must decide this boundary before code changes. The configured - `gamecult-ops` drive is unavailable in this workspace, so this branch remains - deliberately uncut rather than guessed. +- **Owner:** systemd-journald owns deployed Yggdrasil supervisor, semantic + projector, and workspace-coverage projector stream retention. Epiphany owns + typed service state, not a parallel filesystem log history. +- **Inputs:** the supervisor policies bind managed child output to + `/dev/stdout` and `/dev/stderr`; `epiphany.service` explicitly binds its own + streams to the journal. +- **Derived state:** journal rows are operational evidence. They cannot satisfy + service readiness, provider health, or typed completion. +- **Forbidden writers:** Epiphany must not create parallel long-lived projector + log files under its state root, and no external truncator may cut a file + beneath an inherited child descriptor. +- **Cut line:** `gamecult-ops` commit `059821f` removes all four projector + file-log paths from the Yggdrasil policy, names journald as the sole owner in + the deployment runbook, and passes the complete organizational operator + wiring suite. The optional supervisor fatal log is not configured by the + Yggdrasil unit; service failure is journal-owned too. Starfire's temporary + Windows shakedown logs remain bounded run receipts, not deployment truth. Resident lifecycle retention now follows this map. Resident Self's production serve/once owner applies a configurable closed-lifecycle bound (default 256). diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index a44f7c81..7ab070b2 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -1028,16 +1028,23 @@ prepared/active launches, unconsumed acknowledgements, and brake/shutdown cancellations whose pressure was requeued. Negative proof must show retained history cannot create pending work or resurrect a coordinator turn. -Coordinator receipt deletion remains forbidden until resident/current-frontier -and recovery references are mapped. Supervisor stdout/stderr truncate at -launch but grow without bound during a long-lived process; the fatal log grows -across launches. Do not truncate beneath inherited child file descriptors. -`E:\Projects\gamecult-ops` is unavailable in this workspace, so log ownership -must wait for the infrastructure runbook rather than being guessed. +Coordinator receipt, Heartbeat artifact, and deployment log ownership are now +settled. Exact packaged `16c4b19f` retired pulse directories 1-2 from a +five-pulse copied-store fixture, retained 3-5 byte-identically, emitted the +typed retention receipt, and replayed `within-bound` without another receipt. +Receipts are under `.epiphany-run/heartbeat-retention-16c4b19f`. -Next: implement the resident lifecycle retention organ and its negative tests, -then audit coordinator references, packaged Heartbeat retention, supervisor log -ownership, and the measured idle/active endurance plateau. +The live infrastructure repo is `F:\Projects\gamecult-ops`. Commit `059821f` +makes systemd-journald the sole Yggdrasil owner for supervisor and projector +stdout/stderr: both projector policies bind `/dev/stdout` and `/dev/stderr`, +the unit explicitly selects journal streams, and no parallel long-lived files +remain under the Epiphany state root. The optional fatal log is not configured +by the Yggdrasil unit. The full organizational operator wiring suite passes. +Do not reintroduce external truncation beneath inherited descriptors. + +Next: run the measured idle/active endurance plateau, then continue the +remaining organ coordination audit. Broad session/model/event/tool compaction +still waits for typed archived-session ownership. Resident lifecycle retention is now implemented in source. Resident Self's serve/once owner invokes a configurable `--retained-closed-lifecycles` bound diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index b7990711d6dd2591b1c78be494653dc8b6f8df57..976cdd8c4d98f82fc2bdc175da6cf05cb256635e 100644 GIT binary patch delta 608 zcmY*W&2AGh5N5+q2tC0GIFym-F-~>^{Rx~acmOVN^Ll3!w_e-Wvq|?9P!D|o8lg%& z1QG|ti5oA&OE3;Zs4IPI&1mNPu|KT$eqQZ;eVFYOhcAl!-LD&ioiE>>X795sp09fs z>t4o4=S{{f#%;zOMxSx_`?@#y-G6ZTW0Fq}M1Cal>6=7!`03;B<5lne@tITvUaC_$ z!wQN6^}H;mHM~X{s62E+F^Ms9gmd0ydh6>8SJkSFZ5}Q|*nkdKtR-$uOZ0}l>ed)= UEG?7XQintqTTRGs9wSzxKhY}Fxc~qF delta 69 zcmdl#Q>9_5$_5EWZUYM|L(`~Z44j;?o0S<085xV3r!uuqWnu(k5X}t4EI`Z(#B4y! O4#XVWr!sNAW(NSys1#HH diff --git a/state/map.yaml b/state/map.yaml index b02b2d3b..e85e00fc 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -35,7 +35,7 @@ invariants: - Evidence and git retain history; this map retains only state that changes future decisions. current_status: - summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, and exact ed15f83a resident lifecycle retention are proven. Exact 16c4b19f release sha256-6cd1907a87d37cd4517e3f1d3541ecee6595480c21401f977f51f63e929a8ef8 proves packaged coordinator receipt retention: 21 old receipts became one non-authority digest/count head, the newest and an explicitly cross-store-referenced old receipt survived, 720 unrelated runtime envelopes remained byte-identical by digest, and replay was idempotent without creating work. Broader runtime/log retention, packaged Heartbeat retention, long-duration plateau, and stable Starfire firewall ownership remain open. Yggdrasil is the small public crossing body, never the release forge. + summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, and exact 16c4b19f coordinator receipt retention are proven. Packaged 16c4b19f also proves Heartbeat pulse-artifact retention and idempotent replay. Gamecult-ops 059821f makes journald the sole Yggdrasil supervisor/projector stream-retention owner. Broad session/model/event/tool retention, the long-duration plateau, and stable Starfire firewall ownership remain open. Yggdrasil is the small public crossing body, never the release forge. latest_phase: Commit 76afdaf0 moved release construction, filesystem verification, and witness inspection out of monolithic epiphany-core into epiphany-release-construction; core retains only CultMesh publication, load, and authentication. The bootstrap dependency graph excludes epiphany-core, all 19 construction tests pass, and the full core test harness compiles. Exact Linux bootstrap fell from 7m57s to 30.24s cold and 4.40s warm. Exact source 76afdaf0 then produced warning-free 24-binary release sha256-30caab9ef1ea89f9a885d87832b1e312a35288ec3f895bd5b0e83f7f7a6a1aec with witness sha256-89c2ad604254faec3e1e01f753b5dff38a402f43d009074ba4b47b1ec46fdecf. Independent inspection accepted the 12m16s cold build and the identical 10.16s warm replay with Cargo at 0.82s. The packaged full publisher accepted the narrow constructor's witness and changed c005 local-verse.cc from SHA-256 b160c610988753278afbad7f5bad436193144a92e9fd506982099ad58d213909 to 83ed430f5bf0c33996d7c4ee7bf0fa6c9f5f80bc8db94621395ea560852cae81 without body activation. operational_state: local_worktree: coordinator_receipt_retention_packaged_proven @@ -68,8 +68,8 @@ current_status: starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed resident_physiology: authenticated_9b8df0b4_c005_bound_to_eyes_tools_nervous_system_with_217dd_and_bd96305e_helpers_running - unresolved_authority: Coordinator receipt retention is accepted. Broader semantic/runtime histories remain unbounded pending a typed archived-session owner. Supervisor stdout/stderr are truncated only at launch and unbounded during a long-lived process; the fatal log is append-only. Packaged Heartbeat retention ownership and long-duration resource plateau remain unproven. Repository Body observation still performs two authenticated full-tree Git index/manifest passes. Execute-mode workers require a persistent process body. Keyed storage has not earned live migration. One Discord consequence remains blocked by the absent Yggdrasil credential. - next_action: Settle supervisor stdout/stderr/fatal-log ownership from source and infrastructure runbooks, then audit packaged Heartbeat artifact retention before editing. Preserve active c005 and do not compact session/model/event/tool history until typed archived-session ownership exists. After bounded retention is accepted, run measured idle and active endurance plateau and continue the remaining organ coordination matrix. + unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, and deployed supervisor/projector log retention are accepted. Broader semantic/runtime histories remain unbounded pending a typed archived-session owner. The long-duration idle/active resource plateau remains unproven. Repository Body observation still performs two authenticated full-tree Git index/manifest passes. Execute-mode workers require a persistent process body. Keyed storage has not earned live migration. One Discord consequence remains blocked by the absent Yggdrasil credential. + next_action: Run a measured idle and active endurance plateau on copied or isolated authenticated Starfire state, preserving active c005. Record process RSS/CPU, store and artifact growth, bounded retention behavior, and clean shutdown/restart over a duration long enough to expose monotonic growth. Then continue the remaining organ coordination matrix. Do not compact session/model/event/tool history until typed archived-session ownership exists. active_subgoals: - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.