diff --git a/epiphany-core/src/bin/epiphany-work.rs b/epiphany-core/src/bin/epiphany-work.rs index 21d39b91..31f2e4d8 100644 --- a/epiphany-core/src/bin/epiphany-work.rs +++ b/epiphany-core/src/bin/epiphany-work.rs @@ -8974,108 +8974,67 @@ fn closure_family_assertions( ); } "repo.deployment_config" => { + let parsed = parse_repo_deployment_config(&content); + let config = parsed.as_ref().ok(); + push_assertion( + &mut assertions, + "deployment-config-typed-toml", + parsed.is_ok(), + match parsed.as_ref() { + Ok(_) => "Committed deployment config parses as typed TOML.".to_string(), + Err(error) => format!("Committed deployment config parse failed: {error:#}"), + }, + ); push_assertion( &mut assertions, "deployment-config-schema-present", - content.contains("schema_version = \"epiphany.repo_deployment_config.v0\""), + config.is_some_and(|config| config.has_canonical_identity()), "Committed deployment config carries the schema version.".to_string(), ); push_assertion( &mut assertions, "deployment-config-family-present", - content.contains("safe_action_family = \"repo.deployment_config\""), + config.is_some_and(|config| config.has_canonical_identity()), "Committed deployment config carries the safe action family.".to_string(), ); push_assertion( &mut assertions, "deployment-config-summary-present", - content.contains(&compact_summary), + config.is_some_and(|config| config.summary == compact_summary), "Committed deployment config contains the accepted pressure summary.".to_string(), ); push_assertion( &mut assertions, "deployment-config-idunn-trigger", - content.contains("[deployment]") - && content.contains("enabled = false") - && content.contains("owner = \"Idunn\"") - && content.contains("trigger = \"git-push-observed-by-idunn\"") - && content.contains("watched_ref = \"refs/heads/main\"") - && content.contains("deployment_script_ref = \"deploy/idunn-deploy.ps1\"") - && content.contains("deployment_script_hash_required = true") - && content.contains("deployment_script_review_required = true") - && content.contains("host_access_policy_ref_required = true") - && content.contains("secret_values_embedded = false") - && content.contains("rollback_plan_ref_required = true") - && content.contains("aftercare_checks_required = true") - && content.contains("idunn_receipt_required = true") - && content.contains("aftercare_audit_required = true"), + config.is_some_and(|config| config.has_idunn_trigger_contract()), "Committed deployment config names disabled Idunn git-push trigger, reviewed script/hash, policy, rollback, and aftercare requirements." .to_string(), ); push_assertion( &mut assertions, "deployment-config-cultmesh-contract", - content.contains("[cultmesh]") - && content.contains("local_verse = \"gamecult-local\"") - && content.contains("capability_family = \"gamecult.idunn.deployment\"") - && content - .contains("intent_contract = \"gamecult.idunn.deployment_intent.v0\"") - && content - .contains("receipt_contract = \"gamecult.idunn.deployment_receipt.v0\"") - && content.contains( - "aftercare_contract = \"gamecult.idunn.deployment_aftercare_audit.v0\"", - ) - && content.contains("daemon_owns_execution = true"), + config.is_some_and(|config| config.has_cultmesh_contract()), "Committed deployment config routes deployment through Idunn CultMesh contracts." .to_string(), ); push_assertion( &mut assertions, "deployment-config-receipt-contract", - content.contains("[required_receipts]") - && content.contains( - "mind_adoption = \"epiphany.repo_work_mind_adoption_decision.v0\"", - ) - && content.contains( - "soul_review = \"epiphany.repo_work_closure_review.v0\"", - ) - && content.contains( - "maintainer_review = \"gamecult.maintainer.review_receipt.v0\"", - ) - && content.contains( - "secret_policy = \"epiphany.repo_secret_policy_request.v0\"", - ) - && content.contains( - "idunn_deployment = \"gamecult.idunn.deployment_receipt.v0\"", - ) - && content.contains( - "aftercare_audit = \"gamecult.idunn.deployment_aftercare_audit.v0\"", - ), + config.is_some_and(|config| config.has_required_receipt_contract()), "Committed deployment config names Mind, Soul, maintainer, secret-policy, Idunn deployment, and aftercare receipts." .to_string(), ); push_assertion( &mut assertions, "deployment-config-authority-seals", - content.contains("[authority]") - && content.contains("configuration_only = true") - && content.contains("direct_deployment_authority = false") - && content.contains("direct_ssh_authority = false") - && content.contains("direct_git_push_authority = false") - && content.contains("direct_service_lifecycle_authority = false") - && content.contains("direct_hands_authority = false") - && content.contains("publication_authorized = false") - && content.contains("merge_authorized = false") - && content.contains("cross_body_mutation_authorized = false") - && content.contains("private_verse_rummaging = false") - && content.contains("idunn_deployment_authority_required = true"), + config.is_some_and(|config| config.has_authority_seals()), "Committed deployment config denies deployment/SSH/push/service/action/publication/cross-body authority." .to_string(), ); push_assertion( &mut assertions, "deployment-config-private-seal", - content.contains("private_state_exposed = false"), + config.is_some_and(|config| !config.private_state_exposed), "Committed deployment config preserves the private-state seal.".to_string(), ); } @@ -12260,6 +12219,7 @@ fn run_readiness(args: ReadinessArgs) -> Result { struct RepoDeploymentConfig { schema_version: String, safe_action_family: String, + summary: String, private_state_exposed: bool, deployment: RepoDeploymentSettings, cultmesh: RepoDeploymentCultMesh, @@ -12267,6 +12227,65 @@ struct RepoDeploymentConfig { authority: RepoDeploymentAuthority, } +impl RepoDeploymentConfig { + fn has_canonical_identity(&self) -> bool { + self.schema_version == "epiphany.repo_deployment_config.v0" + && self.safe_action_family == "repo.deployment_config" + } + + fn has_idunn_trigger_contract(&self) -> bool { + let deployment = &self.deployment; + !deployment.enabled + && deployment.owner == "Idunn" + && deployment.trigger == "git-push-observed-by-idunn" + && deployment.watched_ref == "refs/heads/main" + && deployment.deployment_script_ref == "deploy/idunn-deploy.ps1" + && deployment.deployment_script_hash_required + && deployment.deployment_script_review_required + && deployment.host_access_policy_ref_required + && !deployment.secret_values_embedded + && deployment.rollback_plan_ref_required + && deployment.aftercare_checks_required + && deployment.idunn_receipt_required + && deployment.aftercare_audit_required + } + + fn has_cultmesh_contract(&self) -> bool { + let cultmesh = &self.cultmesh; + cultmesh.local_verse == "gamecult-local" + && cultmesh.capability_family == "gamecult.idunn.deployment" + && cultmesh.intent_contract == "gamecult.idunn.deployment_intent.v0" + && cultmesh.receipt_contract == "gamecult.idunn.deployment_receipt.v0" + && cultmesh.aftercare_contract == "gamecult.idunn.deployment_aftercare_audit.v0" + && cultmesh.daemon_owns_execution + } + + fn has_required_receipt_contract(&self) -> bool { + let receipts = &self.required_receipts; + receipts.mind_adoption == "epiphany.repo_work_mind_adoption_decision.v0" + && receipts.soul_review == "epiphany.repo_work_closure_review.v0" + && receipts.maintainer_review == "gamecult.maintainer.review_receipt.v0" + && receipts.secret_policy == "epiphany.repo_secret_policy_request.v0" + && receipts.idunn_deployment == "gamecult.idunn.deployment_receipt.v0" + && receipts.aftercare_audit == "gamecult.idunn.deployment_aftercare_audit.v0" + } + + fn has_authority_seals(&self) -> bool { + let authority = &self.authority; + authority.configuration_only + && !authority.direct_deployment_authority + && !authority.direct_ssh_authority + && !authority.direct_git_push_authority + && !authority.direct_service_lifecycle_authority + && !authority.direct_hands_authority + && !authority.publication_authorized + && !authority.merge_authorized + && !authority.cross_body_mutation_authorized + && !authority.private_verse_rummaging + && authority.idunn_deployment_authority_required + } +} + #[derive(Debug, Deserialize)] struct RepoDeploymentSettings { enabled: bool, @@ -15411,6 +15430,7 @@ mod authority_tests { r#" schema_version = "epiphany.repo_deployment_config.v0" safe_action_family = "repo.deployment_config" +summary = "test summary" private_state_exposed = false [deployment] @@ -15472,6 +15492,7 @@ idunn_deployment_authority_required = true ); let parsed = parse_repo_deployment_config(&counterfeit).unwrap(); assert!(parsed.authority.direct_git_push_authority); + assert!(!parsed.has_authority_seals()); let missing_typed_field = deployment_config_fixture().replace( "watched_ref = \"refs/heads/main\"\n", @@ -15480,6 +15501,22 @@ idunn_deployment_authority_required = true assert!(parse_repo_deployment_config(&missing_typed_field).is_err()); } + #[test] + fn deployment_closure_uses_the_typed_config_model() { + let source = include_str!("epiphany-work.rs"); + let start = source + .find("\"repo.deployment_config\" => {") + .expect("deployment closure branch"); + let end = source[start..] + .find("\n _ => {") + .map(|offset| start + offset) + .expect("end of deployment closure branch"); + let branch = &source[start..end]; + assert!(branch.contains("parse_repo_deployment_config")); + assert!(branch.contains("has_authority_seals")); + assert!(!branch.contains("content.contains")); + } + #[test] fn queue_selection_rows_preserve_typed_scheduler_state() { let overview = EpiphanyCultMeshRepoWorkOverviewEntry { diff --git a/notes/conceptual-substitution-audit-2026-07-12.md b/notes/conceptual-substitution-audit-2026-07-12.md index 77adace1..0d11452b 100644 --- a/notes/conceptual-substitution-audit-2026-07-12.md +++ b/notes/conceptual-substitution-audit-2026-07-12.md @@ -728,6 +728,13 @@ fields fail parsing, and the runbook reports missing values rather than inventing deployment targets. Audit semantics compare the parsed values, not their textual costume. +The repo-work closure gate had retained a second substring-based deployment +validator after the operational path became typed. It is now collapsed onto +the same deserialized model and semantic predicates, including exact accepted +summary equality. Closure cannot bless a config that only mentions the desired +values in comments or unrelated tables, and no deployment closure branch uses +`content.contains` as authority. + ## Unresolved: provider receipts without chronology Bifrost body-change/GitHub publication receipts are externally owned and their diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 710623f7..e5f826a4 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -183,6 +183,8 @@ The confirmed conceptual substitutions have been cut: - Deployment operational audit and runbook read one typed TOML model. Substring presence, comments, wrong sections, and silent watched-ref/script defaults no longer substitute for valid deployment configuration. +- Repo-work deployment closure uses that same typed model and semantic + predicates; the duplicate substring validator is deleted. - Bifrost provider receipt contracts still lack provider timestamp/revision. Do not invent consumer-side ordering; repair that in a Bifrost-owned schema. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 25ce37cf..15f0117e 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 8af4b76a..6eda71ac 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -660,4 +660,4 @@ current_status: - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Operational/evidence/self-state and operator surfaces with owned clocks are event-time ordered; operator receipts bind intents by run identity rather than global chronology; Eve/tool/Bifrost/collaboration projections join chains only by typed identity; repo-work scheduling and service-runbook selection use typed rows/IDs rather than reparsed presentation prose; deployment operational audit/runbook use typed TOML rather than substring/scraper logic; writerless readiness-review is deleted. Bifrost provider receipts still need provider-owned chronology, and artifact/metrics receipts need explicit repo-work request identity; accounting refuses closure until those contracts exist. Continue auditing remaining closure validators, evidence/security mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority. + next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Operational/evidence/self-state and operator surfaces with owned clocks are event-time ordered; operator receipts bind intents by run identity rather than global chronology; Eve/tool/Bifrost/collaboration projections join chains only by typed identity; repo-work scheduling and service-runbook selection use typed rows/IDs rather than reparsed presentation prose; deployment operational audit, runbook, and closure share typed TOML semantics; writerless readiness-review is deleted. Bifrost provider receipts still need provider-owned chronology, and artifact/metrics receipts need explicit repo-work request identity; accounting refuses closure until those contracts exist. Continue auditing remaining closure validators, evidence/security mirrors, service configuration claims, adapters, and destructive path consumers for borrowed authority.