GameCult/Epiphany
Archived
Watch
9
0
Fork
You've already forked Epiphany
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Share typed deployment closure semantics

Browse source
This commit is contained in:
Meta Vens 2026-07-13 01:47:19 +01:00
commit 4e48746d7d
5 changed files with 107 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

157
epiphany-core/src/bin/epiphany-work.rs
View file

@ -8974,108 +8974,67 @@ fn closure_family_assertions(
);
}
"repo.deployment_config" => {
let parsed = parse_repo_deployment_config(&content);
let config = parsed.as_ref().ok();
push_assertion(
&mut assertions,
"deployment-config-typed-toml",
parsed.is_ok(),
match parsed.as_ref() {
Ok(_) => "Committed deployment config parses as typed TOML.".to_string(),
Err(error) => format!("Committed deployment config parse failed: {error:#}"),
},
);
push_assertion(
&mut assertions,
"deployment-config-schema-present",
content.contains("schema_version = \"epiphany.repo_deployment_config.v0\""),
config.is_some_and(|config| config.has_canonical_identity()),
"Committed deployment config carries the schema version.".to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-family-present",
content.contains("safe_action_family = \"repo.deployment_config\""),
config.is_some_and(|config| config.has_canonical_identity()),
"Committed deployment config carries the safe action family.".to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-summary-present",
content.contains(&compact_summary),
config.is_some_and(|config| config.summary == compact_summary),
"Committed deployment config contains the accepted pressure summary.".to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-idunn-trigger",
content.contains("[deployment]")
&& content.contains("enabled = false")
&& content.contains("owner = \"Idunn\"")
&& content.contains("trigger = \"git-push-observed-by-idunn\"")
&& content.contains("watched_ref = \"refs/heads/main\"")
&& content.contains("deployment_script_ref = \"deploy/idunn-deploy.ps1\"")
&& content.contains("deployment_script_hash_required = true")
&& content.contains("deployment_script_review_required = true")
&& content.contains("host_access_policy_ref_required = true")
&& content.contains("secret_values_embedded = false")
&& content.contains("rollback_plan_ref_required = true")
&& content.contains("aftercare_checks_required = true")
&& content.contains("idunn_receipt_required = true")
&& content.contains("aftercare_audit_required = true"),
config.is_some_and(|config| config.has_idunn_trigger_contract()),
"Committed deployment config names disabled Idunn git-push trigger, reviewed script/hash, policy, rollback, and aftercare requirements."
.to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-cultmesh-contract",
content.contains("[cultmesh]")
&& content.contains("local_verse = \"gamecult-local\"")
&& content.contains("capability_family = \"gamecult.idunn.deployment\"")
&& content
.contains("intent_contract = \"gamecult.idunn.deployment_intent.v0\"")
&& content
.contains("receipt_contract = \"gamecult.idunn.deployment_receipt.v0\"")
&& content.contains(
"aftercare_contract = \"gamecult.idunn.deployment_aftercare_audit.v0\"",
)
&& content.contains("daemon_owns_execution = true"),
config.is_some_and(|config| config.has_cultmesh_contract()),
"Committed deployment config routes deployment through Idunn CultMesh contracts."
.to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-receipt-contract",
content.contains("[required_receipts]")
&& content.contains(
"mind_adoption = \"epiphany.repo_work_mind_adoption_decision.v0\"",
)
&& content.contains(
"soul_review = \"epiphany.repo_work_closure_review.v0\"",
)
&& content.contains(
"maintainer_review = \"gamecult.maintainer.review_receipt.v0\"",
)
&& content.contains(
"secret_policy = \"epiphany.repo_secret_policy_request.v0\"",
)
&& content.contains(
"idunn_deployment = \"gamecult.idunn.deployment_receipt.v0\"",
)
&& content.contains(
"aftercare_audit = \"gamecult.idunn.deployment_aftercare_audit.v0\"",
),
config.is_some_and(|config| config.has_required_receipt_contract()),
"Committed deployment config names Mind, Soul, maintainer, secret-policy, Idunn deployment, and aftercare receipts."
.to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-authority-seals",
content.contains("[authority]")
&& content.contains("configuration_only = true")
&& content.contains("direct_deployment_authority = false")
&& content.contains("direct_ssh_authority = false")
&& content.contains("direct_git_push_authority = false")
&& content.contains("direct_service_lifecycle_authority = false")
&& content.contains("direct_hands_authority = false")
&& content.contains("publication_authorized = false")
&& content.contains("merge_authorized = false")
&& content.contains("cross_body_mutation_authorized = false")
&& content.contains("private_verse_rummaging = false")
&& content.contains("idunn_deployment_authority_required = true"),
config.is_some_and(|config| config.has_authority_seals()),
"Committed deployment config denies deployment/SSH/push/service/action/publication/cross-body authority."
.to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-private-seal",
content.contains("private_state_exposed = false"),
config.is_some_and(|config| !config.private_state_exposed),
"Committed deployment config preserves the private-state seal.".to_string(),
);
}
@ -12260,6 +12219,7 @@ fn run_readiness(args: ReadinessArgs) -> Result<Value> {
struct RepoDeploymentConfig {
schema_version: String,
safe_action_family: String,
summary: String,
private_state_exposed: bool,
deployment: RepoDeploymentSettings,
cultmesh: RepoDeploymentCultMesh,
@ -12267,6 +12227,65 @@ struct RepoDeploymentConfig {
authority: RepoDeploymentAuthority,
}
impl RepoDeploymentConfig {
fn has_canonical_identity(&self) -> bool {
self.schema_version == "epiphany.repo_deployment_config.v0"
&& self.safe_action_family == "repo.deployment_config"
}
fn has_idunn_trigger_contract(&self) -> bool {
let deployment = &self.deployment;
!deployment.enabled
&& deployment.owner == "Idunn"
&& deployment.trigger == "git-push-observed-by-idunn"
&& deployment.watched_ref == "refs/heads/main"
&& deployment.deployment_script_ref == "deploy/idunn-deploy.ps1"
&& deployment.deployment_script_hash_required
&& deployment.deployment_script_review_required
&& deployment.host_access_policy_ref_required
&& !deployment.secret_values_embedded
&& deployment.rollback_plan_ref_required
&& deployment.aftercare_checks_required
&& deployment.idunn_receipt_required
&& deployment.aftercare_audit_required
}
fn has_cultmesh_contract(&self) -> bool {
let cultmesh = &self.cultmesh;
cultmesh.local_verse == "gamecult-local"
&& cultmesh.capability_family == "gamecult.idunn.deployment"
&& cultmesh.intent_contract == "gamecult.idunn.deployment_intent.v0"
&& cultmesh.receipt_contract == "gamecult.idunn.deployment_receipt.v0"
&& cultmesh.aftercare_contract == "gamecult.idunn.deployment_aftercare_audit.v0"
&& cultmesh.daemon_owns_execution
}
fn has_required_receipt_contract(&self) -> bool {
let receipts = &self.required_receipts;
receipts.mind_adoption == "epiphany.repo_work_mind_adoption_decision.v0"
&& receipts.soul_review == "epiphany.repo_work_closure_review.v0"
&& receipts.maintainer_review == "gamecult.maintainer.review_receipt.v0"
&& receipts.secret_policy == "epiphany.repo_secret_policy_request.v0"
&& receipts.idunn_deployment == "gamecult.idunn.deployment_receipt.v0"
&& receipts.aftercare_audit == "gamecult.idunn.deployment_aftercare_audit.v0"
}
fn has_authority_seals(&self) -> bool {
let authority = &self.authority;
authority.configuration_only
&& !authority.direct_deployment_authority
&& !authority.direct_ssh_authority
&& !authority.direct_git_push_authority
&& !authority.direct_service_lifecycle_authority
&& !authority.direct_hands_authority
&& !authority.publication_authorized
&& !authority.merge_authorized
&& !authority.cross_body_mutation_authorized
&& !authority.private_verse_rummaging
&& authority.idunn_deployment_authority_required
}
}
#[derive(Debug, Deserialize)]
struct RepoDeploymentSettings {
enabled: bool,
@ -15411,6 +15430,7 @@ mod authority_tests {
r#"
schema_version = "epiphany.repo_deployment_config.v0"
safe_action_family = "repo.deployment_config"
summary = "test summary"
private_state_exposed = false
[deployment]
@ -15472,6 +15492,7 @@ idunn_deployment_authority_required = true
);
let parsed = parse_repo_deployment_config(&counterfeit).unwrap();
assert!(parsed.authority.direct_git_push_authority);
assert!(!parsed.has_authority_seals());
let missing_typed_field = deployment_config_fixture().replace(
"watched_ref = \"refs/heads/main\"\n",
@ -15480,6 +15501,22 @@ idunn_deployment_authority_required = true
assert!(parse_repo_deployment_config(&missing_typed_field).is_err());
}
#[test]
fn deployment_closure_uses_the_typed_config_model() {
let source = include_str!("epiphany-work.rs");
let start = source
.find("\"repo.deployment_config\" => {")
.expect("deployment closure branch");
let end = source[start..]
.find("\n _ => {")
.map(|offset| start + offset)
.expect("end of deployment closure branch");
let branch = &source[start..end];
assert!(branch.contains("parse_repo_deployment_config"));
assert!(branch.contains("has_authority_seals"));
assert!(!branch.contains("content.contains"));
}
#[test]
fn queue_selection_rows_preserve_typed_scheduler_state() {
let overview = EpiphanyCultMeshRepoWorkOverviewEntry {

7
notes/conceptual-substitution-audit-2026-07-12.md
View file

@ -728,6 +728,13 @@ fields fail parsing, and the runbook reports missing values rather than
inventing deployment targets. Audit semantics compare the parsed values, not
their textual costume.
The repo-work closure gate had retained a second substring-based deployment
validator after the operational path became typed. It is now collapsed onto
the same deserialized model and semantic predicates, including exact accepted
summary equality. Closure cannot bless a config that only mentions the desired
values in comments or unrelated tables, and no deployment closure branch uses
`content.contains` as authority.
## Unresolved: provider receipts without chronology
Bifrost body-change/GitHub publication receipts are externally owned and their

2
notes/fresh-workspace-handoff.md
View file

@ -183,6 +183,8 @@ The confirmed conceptual substitutions have been cut:
- Deployment operational audit and runbook read one typed TOML model. Substring
presence, comments, wrong sections, and silent watched-ref/script defaults no
longer substitute for valid deployment configuration.
- Repo-work deployment closure uses that same typed model and semantic
predicates; the duplicate substring validator is deleted.
- Bifrost provider receipt contracts still lack provider timestamp/revision.
Do not invent consumer-side ordering; repair that in a Bifrost-owned schema.

BIN
state/ledgers.msgpack
View file

Binary file not shown.

2
state/map.yaml
View file

@ -660,4 +660,4 @@ current_status:
- Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
- `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Operational/evidence/self-state and operator surfaces with owned clocks are event-time ordered; operator receipts bind intents by run identity rather than global chronology; Eve/tool/Bifrost/collaboration projections join chains only by typed identity; repo-work scheduling and service-runbook selection use typed rows/IDs rather than reparsed presentation prose; deployment operational audit/runbook use typed TOML rather than substring/scraper logic; writerless readiness-review is deleted. Bifrost provider receipts still need provider-owned chronology, and artifact/metrics receipts need explicit repo-work request identity; accounting refuses closure until those contracts exist. Continue auditing remaining closure validators, evidence/security mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority.
next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Operational/evidence/self-state and operator surfaces with owned clocks are event-time ordered; operator receipts bind intents by run identity rather than global chronology; Eve/tool/Bifrost/collaboration projections join chains only by typed identity; repo-work scheduling and service-runbook selection use typed rows/IDs rather than reparsed presentation prose; deployment operational audit, runbook, and closure share typed TOML semantics; writerless readiness-review is deleted. Bifrost provider receipts still need provider-owned chronology, and artifact/metrics receipts need explicit repo-work request identity; accounting refuses closure until those contracts exist. Continue auditing remaining closure validators, evidence/security mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority.