Move job launch planning into bridge

epiphany-codex-bridge/src/protocol_edge.rs

@@ -26,6 +26,7 @@ use codex_app_server_protocol::ThreadEpiphanyInvalidationInput;
 use codex_app_server_protocol::ThreadEpiphanyInvalidationStatus;
 use codex_app_server_protocol::ThreadEpiphanyJob;
 use codex_app_server_protocol::ThreadEpiphanyJobKind;
+use codex_app_server_protocol::ThreadEpiphanyJobLaunchParams;
 use codex_app_server_protocol::ThreadEpiphanyJobStatus;
 use codex_app_server_protocol::ThreadEpiphanyPressure;
 use codex_app_server_protocol::ThreadEpiphanyPressureBasis;
@@ -65,6 +66,7 @@ use epiphany_core::EpiphanyDistillInput;
 use epiphany_core::EpiphanyGraphQuery;
 use epiphany_core::EpiphanyGraphQueryDirection;
 use epiphany_core::EpiphanyGraphQueryKind;
+use epiphany_core::EpiphanyJobLaunchRequest;
 use epiphany_core::EpiphanyPressure;
 use epiphany_core::EpiphanyPressureBasis;
 use epiphany_core::EpiphanyPressureLevel;
@@ -80,6 +82,7 @@ use epiphany_core::EpiphanyRoleWorkerLaunchDocument;
 use epiphany_core::EpiphanyStateUpdatedField;
 use epiphany_core::EpiphanyViewLens;
 use epiphany_core::EpiphanyWorkerLaunchDocument;
+use epiphany_core::build_epiphany_job_launch_request;
 use epiphany_core::default_epiphany_view_lenses;
 use epiphany_core::epiphany_role_binding_id;
 use epiphany_core::epiphany_view_needs_jobs;
@@ -383,6 +386,52 @@ pub fn plan_thread_epiphany_reorient_accept(
     }
 }
 
+pub struct ThreadEpiphanyJobLaunchPlan {
+    pub thread_id: String,
+    pub launch_request: EpiphanyJobLaunchRequest,
+    pub kind: EpiphanyJobKind,
+}
+
+pub fn plan_thread_epiphany_job_launch(
+    params: ThreadEpiphanyJobLaunchParams,
+) -> ThreadEpiphanyJobLaunchPlan {
+    let ThreadEpiphanyJobLaunchParams {
+        thread_id,
+        expected_revision,
+        binding_id,
+        kind,
+        scope,
+        owner_role,
+        authority_scope,
+        linked_subgoal_ids,
+        linked_graph_node_ids,
+        instruction,
+        launch_document,
+        output_contract_id,
+        max_runtime_seconds,
+    } = params;
+    let launch_document = protocol_worker_launch_document_to_core(launch_document);
+    let launch_request = build_epiphany_job_launch_request(
+        expected_revision,
+        binding_id,
+        kind,
+        scope,
+        owner_role,
+        authority_scope,
+        linked_subgoal_ids,
+        linked_graph_node_ids,
+        instruction,
+        launch_document,
+        output_contract_id,
+        max_runtime_seconds,
+    );
+    ThreadEpiphanyJobLaunchPlan {
+        thread_id,
+        launch_request,
+        kind,
+    }
+}
+
 pub fn protocol_state_updated_fields(
     fields: Vec<EpiphanyStateUpdatedField>,
 ) -> Vec<ThreadEpiphanyStateUpdatedField> {

notes/epiphany-current-algorithmic-map.md

@@ -25,7 +25,7 @@ The spine exists in more than twenty-five live paths:
 - scene projection: the `scene` view lens reads the same live/stored Epiphany state view used by `thread/read` and adapts the core scene projection. `epiphany-core` derives the compact client scene with objective, active subgoal, invariant status counts, graph focus/counts, retrieval status, investigation-checkpoint summary counts, observation/evidence summaries, churn, live/stored source, and available control-plane actions without mutating or persisting state in [scene.rs](E:/Projects/EpiphanyAgent/epiphany-core/src/surfaces/scene.rs:1).
 - job/progress reflection: the `jobs` view lens reads the same thread view as scene, optionally fills retrieval state for loaded threads with no Epiphany state, and adapts core-derived non-authoritative progress slots for retrieval indexing, graph remap, invariant verification, and bound specialist work. Durable `job_bindings` now act as thin Epiphany-owned authority slots with binding id, kind, scope, owner role, authority scope, linked ids, and optional blocking reason only. Runtime job ids project from `runtime_links` through core job view policy; old `agent_jobs` bindings are sealed instead of live-crawled in [jobs.rs](E:/Projects/EpiphanyAgent/epiphany-core/src/surfaces/jobs.rs:1).
 - bound-job progress notifications: app-server still declares experimental `thread/epiphany/jobsUpdated` as sealed legacy Codex evacuation telemetry, but the handler no longer emits Epiphany updates from old `agent_job_progress:{json}` background events. Heartbeat-owned activation and typed runtime-spine receipts are now the live Epiphany path.
-- explicit job control: app-server declares experimental `thread/epiphany/jobLaunch` and `thread/epiphany/jobInterrupt`, routes them through core launch/interrupt handlers that persist heartbeat-backed durable `job_bindings` revisions through the authoritative Epiphany state path, and emit `thread/epiphany/stateUpdated` with source `jobLaunch` or `jobInterrupt` instead of creating SQLite `agent_jobs` rows or pretending jobs reflection is the scheduler.
+- explicit job control: app-server declares experimental `thread/epiphany/jobLaunch` and `thread/epiphany/jobInterrupt`. `jobLaunch` route handling delegates protocol worker-launch document conversion and core `EpiphanyJobLaunchRequest` construction to `epiphany-codex-bridge::protocol_edge::plan_thread_epiphany_job_launch`; app-server then routes the planned request through core launch handlers that persist heartbeat-backed durable `job_bindings` revisions through the authoritative Epiphany state path. The write emits `thread/epiphany/stateUpdated` with source `jobLaunch` or `jobInterrupt` instead of creating SQLite `agent_jobs` rows or pretending jobs reflection is the scheduler.
 - freshness reflection: app-server declares experimental read-only `thread/epiphany/freshness`, reads the same live/stored thread view used by the view lenses and context, fills live retrieval state for loaded threads, and gathers watcher snapshots because those are host lifecycle facts. `epiphany-codex-bridge::view_protocol::map_epiphany_freshness_response` owns freshness surface derivation and protocol response projection. `epiphany-core` derives the bounded retrieval/graph freshness lens plus watcher-backed invalidation inputs with watched root, changed paths, mapped graph-node hits, active-frontier hits, and revision/source identity; the read does not mutate, schedule, notify, or perform automatic semantic invalidation in [freshness.rs](E:/Projects/EpiphanyAgent/epiphany-core/src/surfaces/freshness.rs:1), [view_protocol.rs](E:/Projects/EpiphanyAgent/epiphany-codex-bridge/src/view_protocol.rs:91), [common.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/common.rs:350), [v2.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/v2.rs:4167), [v2.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/v2.rs:4259), [epiphany_invalidation.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server/src/epiphany_invalidation.rs:19), and [epiphany_read_routes.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server/src/codex_message_processor/epiphany_read_routes.rs:221).
 - targeted context reflection: app-server declares experimental read-only `thread/epiphany/context`, reads the same live/stored Epiphany state view used by the view lenses, and derives a bounded state shard containing selected graph nodes/edges, links, active frontier, checkpoint, the full durable investigation-checkpoint packet, observations, direct evidence, linked evidence, and missing requested ids without retrieval, proposal, promotion, notification, mutation, or persistence in [common.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/common.rs:355), [v2.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/v2.rs:4253), [codex_message_processor.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server/src/codex_message_processor.rs:4261), and [codex_message_processor.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server/src/codex_message_processor.rs:11152).
 - graph traversal reflection: app-server declares experimental read-only `thread/epiphany/graphQuery`, reads the same live Epiphany state view used by context, and derives explicit node/edge lookup, path/symbol matches, bounded neighbors, edge-kind matches, and frontier neighborhoods with architecture/dataflow links plus frontier/checkpoint identity, matched selectors, and missing ids without retrieval, proposal, promotion, indexing, notification, mutation, or scheduling in [common.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/common.rs:379), [v2.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/v2.rs:4720), [codex_message_processor.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server/src/codex_message_processor.rs:5060), and [codex_message_processor.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server/src/codex_message_processor.rs:15201).

notes/fresh-workspace-handoff.md

@@ -902,6 +902,13 @@ loads the thread, calls the mutation service, builds the legacy accept response
 DTO, and emits the state-updated notification. `epiphany_mutation_routes.rs` is
 about 744 lines after this cut.
 
+Job-launch write-route planning has moved to the bridge protocol edge.
+`plan_thread_epiphany_job_launch` owns protocol worker-launch document
+conversion and core `EpiphanyJobLaunchRequest` construction. App-server still
+loads the thread, invokes the mutation service, builds the legacy launch
+response DTO, and emits the state-updated notification.
+`epiphany_mutation_routes.rs` is about 718 lines after this cut.
+
 Context and graph-query route-level conversion followed. App-server still
 parses thread ids, loads live/stored thread views, and emits JSON-RPC
 responses, but `map_thread_epiphany_context_response` and

state/map.yaml

@@ -139,7 +139,7 @@ accepted_design:
   - `epiphany-core` and `epiphany-codex-bridge` must not depend directly on vendored `codex-core`. Host-specific Codex concepts belong in vendored app-server host adapters or the thin OpenAI subscription auth/model-transport spine, while native retrieval/state/runtime/mutation policy stays in Epiphany crates.
   - The prompt reads typed state through a bounded `<epiphany_state>` developer fragment.
   - Clients read typed state through `Thread.epiphanyState`, read-only `thread/epiphany/view` lenses for scene/jobs/roles/planning/pressure/reorient/CRRC/coordinator, freshness through `thread/epiphany/freshness`, targeted state shards through `thread/epiphany/context`, bounded graph traversal through `thread/epiphany/graphQuery`, and reviewable role output through `thread/epiphany/roleResult`. The scene, jobs, roles, planning, pressure, reorient, CRRC, and coordinator read projections now live only as view lenses, not standalone protocol verbs.
-  - Durable typed state writes route through `thread/epiphany/update`, accepted `thread/epiphany/promote`, `thread/epiphany/reorientAccept`, `thread/epiphany/roleAccept`, or the bounded `thread/epiphany/jobLaunch`, `thread/epiphany/jobInterrupt`, `thread/epiphany/reorientLaunch`, and `thread/epiphany/roleLaunch` authority surfaces when they mutate state or `job_bindings`; roleAccept and reorientAccept protocol/default-binding planning now lives in the bridge protocol edge rather than app-server mutation routes.
+  - Durable typed state writes route through `thread/epiphany/update`, accepted `thread/epiphany/promote`, `thread/epiphany/reorientAccept`, `thread/epiphany/roleAccept`, or the bounded `thread/epiphany/jobLaunch`, `thread/epiphany/jobInterrupt`, `thread/epiphany/reorientLaunch`, and `thread/epiphany/roleLaunch` authority surfaces when they mutate state or `job_bindings`; jobLaunch request construction plus roleAccept/reorientAccept protocol/default-binding planning now lives in the bridge protocol edge rather than app-server mutation routes.
   - `thread/epiphany/retrieve`, `thread/epiphany/distill`, `thread/epiphany/propose`, `thread/epiphany/freshness`, `thread/epiphany/context`, `thread/epiphany/graphQuery`, and `thread/epiphany/view` stay read-only.
   - `thread/epiphany/index` writes the retrieval catalog, not durable Epiphany understanding; catalog is auspex output, not doctrine.
   - Qdrant is the preferred persistent semantic backend; BM25 remains the bootstrap/fallback/control path. Qdrant's HTTP API and acknowledgements remain JSON wire edges, but Epiphany-owned retrieval point payloads are typed at the adapter boundary before serialization/deserialization.

vendor/codex/codex-rs/app-server/src/codex_message_processor/epiphany_mutation_routes.rs

@@ -6,7 +6,6 @@ use codex_protocol::protocol::EpiphanyThreadState;
 use epiphany_codex_bridge::cultnet::EpiphanyStateUpdatedField;
 use epiphany_codex_bridge::error::EpiphanyBridgeError;
 use epiphany_codex_bridge::invalidation::epiphany_freshness_watcher_snapshot;
-use epiphany_codex_bridge::launch::build_epiphany_job_launch_request;
 use epiphany_codex_bridge::mutation_service::EpiphanyThreadPromoteApplied;
 use epiphany_codex_bridge::mutation_service::apply_thread_epiphany_promote;
 use epiphany_codex_bridge::mutation_service::apply_thread_epiphany_reorient_accept;
@@ -16,6 +15,7 @@ use epiphany_codex_bridge::mutation_service::interrupt_thread_epiphany_job;
 use epiphany_codex_bridge::mutation_service::launch_thread_epiphany_job;
 use epiphany_codex_bridge::mutation_service::launch_thread_epiphany_reorient;
 use epiphany_codex_bridge::mutation_service::launch_thread_epiphany_role;
+use epiphany_codex_bridge::protocol_edge::plan_thread_epiphany_job_launch;
 use epiphany_codex_bridge::protocol_edge::plan_thread_epiphany_reorient_accept;
 use epiphany_codex_bridge::protocol_edge::plan_thread_epiphany_role_accept;
 use epiphany_codex_bridge::protocol_edge::protocol_job_from_surface;
@@ -29,7 +29,6 @@ use epiphany_codex_bridge::protocol_edge::protocol_role_id_to_core;
 use epiphany_codex_bridge::protocol_edge::protocol_state_updated_fields;
 use epiphany_codex_bridge::protocol_edge::protocol_state_updated_notification;
 use epiphany_codex_bridge::protocol_edge::protocol_update_patch_to_core;
-use epiphany_codex_bridge::protocol_edge::protocol_worker_launch_document_to_core;
 use epiphany_codex_bridge::retrieve::epiphany_retrieval_state_for_paths;
 use epiphany_codex_bridge::retrieve::index_epiphany_retrieval_for_paths;
 use epiphany_codex_bridge::retrieve_protocol::protocol_index_response;
@@ -584,46 +583,21 @@ impl CodexMessageProcessor {
         request_id: ConnectionRequestId,
         params: ThreadEpiphanyJobLaunchParams,
     ) {
-        let ThreadEpiphanyJobLaunchParams {
-            thread_id,
-            expected_revision,
-            binding_id,
-            kind,
-            scope,
-            owner_role,
-            authority_scope,
-            linked_subgoal_ids,
-            linked_graph_node_ids,
-            instruction,
-            launch_document,
-            output_contract_id,
-            max_runtime_seconds,
-        } = params;
+        let launch_plan = plan_thread_epiphany_job_launch(params);
 
-        let (thread_uuid, thread) = match self.load_epiphany_thread(&request_id, &thread_id).await {
+        let (thread_uuid, thread) = match self
+            .load_epiphany_thread(&request_id, &launch_plan.thread_id)
+            .await
+        {
             Some(thread) => thread,
             None => return,
         };
 
         let host = EpiphanyCodexThreadHost::new(thread.as_ref());
-        let core_launch_document = protocol_worker_launch_document_to_core(launch_document);
         let applied = match launch_thread_epiphany_job(
             &host,
-            build_epiphany_job_launch_request(
-                expected_revision,
-                binding_id.clone(),
-                kind,
-                scope,
-                owner_role,
-                authority_scope,
-                linked_subgoal_ids,
-                linked_graph_node_ids,
-                instruction,
-                core_launch_document,
-                output_contract_id,
-                max_runtime_seconds,
-            ),
-            kind,
+            launch_plan.launch_request,
+            launch_plan.kind,
             "missing launched job projection",
         )
         .await