Record grant lifecycle live proof

notes/epiphany-current-algorithmic-map.md

@@ -3853,3 +3853,36 @@ Directory observation is a bounded source faculty, not Heartbeat authority.
   tool in copied live cognition and measured 72 directories, 74 files, and
   3,975,362 bytes with `complete=true`. Modeling refused to infer post-brake
   grant terminality from artifact names, preserving the ownership boundary.
+
+## Grant-owned resident lifecycle sight
+
+Resident lifecycle observation and scheduling now read the same authority.
+
+- Owner: each exact `ResidentSelfHeartbeatGrant` owns its consumed and terminal
+  state; `ResidentSelfState` owns whether that grant is prepared or active.
+- Inputs: one explicitly bound resident store, an optional exact grant ID, and
+  a bounded recent-row limit.
+- Outputs: typed pressure/schedule/action identity, consumed and terminal
+  timestamps/status, active/prepared flags, and derived `launchable` state.
+- Derived state: the projection is read-only evidence. Terminal acknowledgements,
+  retention heads, filesystem artifacts, and pulse names cannot decide whether
+  a grant may launch.
+- Forbidden writers: the tool adapter cannot discover sibling stores, inspect
+  generic CultCache cargo, mutate resident state, or infer authority from
+  filenames.
+- Shared paths: Heartbeat issuance, pending-grant selection, and projection all
+  use `resident_self_grant_is_pending`; there is no observer-only definition of
+  launchability.
+- Cut line: the native `epiphany_state.resident_grant_lifecycle` tool is exposed
+  only to Eyes, Modeling, and Soul and only when the authenticated resident
+  launch forwards its exact state-store binding.
+- Verification: exact `34d75d05` unit coverage proves an older terminal grant
+  remains non-launchable beside a later retry. Exact packaged copied cognition
+  observed the same shape; after three strict duplicate-field result failures,
+  attempt four admitted typed evidence and resident Self terminalized the exact
+  original grant once under the brake. No new grant appeared.
+
+The three failed attempts are not accepted reliability evidence. The next cut
+belongs to role-result schema construction/model ingress: preserve strict
+duplicate-field rejection while making the first model-produced result conform
+to its one-owner schema.

notes/fresh-workspace-handoff.md

@@ -3225,6 +3225,47 @@ consult tombstones before treating missing claims/results as live or pending.
 Next implement the archive and hostile/non-resurrection tests before packaging.
 Direct packaged proposal Modeling construction remains a later Linux-native
 evidence task. Actual c006 stays braked.
+
+## Grant-owned lifecycle sight accepted; structured-output retry wound — 2026-08-11
+
+Exact pushed source `34d75d05d11852fdc9ebacc2d08f9f63a774114a` adds a
+bounded `epiphany_state.resident_grant_lifecycle` organ. It reads only an
+explicitly bound resident store. The exact `ResidentSelfHeartbeatGrant` plus
+resident active/prepared state remain the owners; scheduling and projection
+share `resident_self_grant_is_pending`. Acknowledgements, retention heads, and
+artifact names remain evidence or notification only.
+
+Focused reconstructed-diff tests passed across resident Self, the tool runtime,
+OpenAI/model runtime wiring, and the coordinator. The full core library passed
+670 tests with one intentional ignore before the exact reconstructed diff was
+rechecked by focused suites. Exact Linux packaging produced 24 binaries with
+zero warnings, release
+`sha256-718316c4372f3caf127579cd8a185fe11717f2370f1418d9a1f465a0efa54b8c`
+and witness
+`sha256-58d4c05c3de5b9c07ea76e06a2f60af94571a0f053da49de65629f413e0cbd92`.
+Cargo took 3m21s for the core-touching relink.
+
+On copied c006 state, proposal Modeling invoked the typed lifecycle tool. The
+first three worker attempts failed the strict `epiphany.worker.role_result.v3`
+contract: one duplicated `checkpointSummary`, then two duplicated `verdict`.
+Resident Self did not treat those failures as fulfillment and canonically
+requeued without Hands, Persona, or deployment authority. Attempt four produced
+an admitted result: sampled older terminal grants remained `launchable=false`,
+and the active consumed grant was also non-launchable while awaiting terminal
+settlement.
+
+The copied brake was engaged before intervention. Heartbeat stayed stopped;
+resident Self alone replayed the completed typed evidence, cleared the exact
+active turn once at revision 74, then projected `braked` with no new grant.
+Both copied owners exited zero. Actual c006 remained alive and cognitively
+braked throughout. Receipts are under
+`.epiphany-run/grant-sight-live-34d75d05` plus the sealed copied volumes.
+
+Next: inspect generated role-result schema, role prompt, provider response, and
+strict ingress decoder as one ownership boundary. Remove the cause of duplicate
+top-level fields without weakening admission or adding a repair parser. Repeat
+the copied proposal and require first-attempt completion, exact one-grant
+terminalization, and zero external consequence. Yggdrasil never builds.
 ## Failed outer-worker attempt retention cut in source — 2026-08-10
 
 Runtime spine now owns `EpiphanyArchivedRuntimeWorkerAttempt` for failed or

state/map.yaml

@@ -36,7 +36,7 @@ invariants:
 
 current_status:
   summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, exact 16c4b19f coordinator receipt and Heartbeat artifact retention, exact cce2b8ac narrow model-generation retention, exact eea15e82 model-turn JSON ingress, exact b1e8c89a semantic unattempted-generation retention, exact 6bc3ec3f semantic physical-epoch retirement, and exact 44230a05 Persona conversation retention are proven. Gamecult-ops 059821f owns Yggdrasil stream retention and exact 6ee08a4 owns stable Starfire Persona-permit firewall ingress. Exact 16c4b19f genuine idle and exact a987d2f7 active cognition completed 900-pulse bounded plateaus. Runtime-owned typed fulfillment is accepted live under exact 6dd9b132. Yggdrasil is the small public crossing body, never the release forge.
-  latest_phase: Actual c006 remains exact c9a2a979, alive and cognitively braked. Exact pushed 31dcd351 adds governed workspace-confined directory inventory to the shared Eyes, Modeling, and Soul source organ. Exact Linux release sha256-6cf496f71da98f07a5775c07a031108f643e0bd6081ac15bf338e109376fa6e8 with witness sha256-5cca9d61b825bc2f54704c3d4f7b9049eec4d93de58e6d64f3f1d894b673966d passed 24-binary inspection with zero warnings after a 35.17s source-changing build. On copied c006, proposal Modeling invoked the new tool and established a complete inventory of the actual Heartbeat artifact copy: 72 directories, 74 files, and 3975362 regular-file bytes. It correctly refused to infer post-brake grant terminality from artifact names. Self completed the proposal plus two receipt-bound internal continuations, ending sleeping at revision 54 with 57 jobs/results, zero open jobs, and no Hands or Eyes authority. The copied brake was re-engaged and both owners exited zero; actual c006 was untouched.
+  latest_phase: Actual c006 remains exact c9a2a979, alive and cognitively braked. Exact pushed 34d75d05 makes the exact ResidentSelfHeartbeatGrant plus resident state the sole owner of a bounded lifecycle projection; scheduling and sight share resident_self_grant_is_pending, while acknowledgements and artifact names remain non-authoritative. Exact Linux release sha256-718316c4372f3caf127579cd8a185fe11717f2370f1418d9a1f465a0efa54b8c with witness sha256-58d4c05c3de5b9c07ea76e06a2f60af94571a0f053da49de65629f413e0cbd92 passed 24-binary inspection with zero warnings. On copied c006, proposal Modeling invoked the typed lifecycle tool. Three attempts failed the strict role-result contract because the model emitted duplicate JSON fields; each failure stayed unfulfilled and was canonically requeued. Attempt four produced an admitted typed result grounded in resident lifecycle state: sampled older terminal grants remained launchable=false and the then-active grant was consumed and launchable=false. After the copied brake engaged, resident Self reconciled that evidence, terminalized the exact original grant once at revision 74, emitted no new grant, and then remained braked. Both copied owners exited zero; actual c006 was untouched.
   operational_state:
     local_worktree: exact_acd91e6e_imagination_runtime_owned_causality_live_accepted
     operator_wireguard: restored
@@ -70,7 +70,7 @@ current_status:
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: c006_exact_c9a2a979_alive_braked_revision_34_after_two_receipt_bound_continuation_grants
   unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, all three packaged fulfilled-before-receipt lanes, genuine packaged Imagination option generation, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, co-resident resident lifecycle retention, authenticated outer-worker attempt retention, deployed supervisor/projector journald ownership, Docker named-volume atomic snapshot visibility, and deterministic incremental release construction are accepted. Starfire's Docker Desktop F: bind is rejected for mutable authority after an exact packaged lockless reader observed an empty published snapshot during writer interruption. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. One completed Discord consequence remains blocked by the absent Yggdrasil credential. Exact aa841873 also makes legacy coordinator repair one full-snapshot transaction so a later hostile family cannot leave an earlier partial repair.
-  next_action: Keep actual c006 exact c9a2a979 alive under its cognitive brake. On copied state, inspect the existing typed Heartbeat and resident projections to identify the owner that can prove whether pre-brake grants remain terminal and unlaunchable; do not infer authority from artifact names and do not give the source tool arbitrary CultCache access. Route the next Eyes pass through that typed owner, then continue copied autonomous turnover without minting Hands, Persona, or deployment authority. Separately recheck Yggdrasil's Persona credential boundary before attempting the one missing public consequence. Yggdrasil never builds.
+  next_action: Keep actual c006 exact c9a2a979 alive under its cognitive brake. Treat exact 34d75d05 lifecycle sight as accepted, but not the three model-schema retries: map why proposal Modeling role-result JSON repeatedly acquired duplicate fields and cut the output-contract failure at its owning schema/ingress boundary without relaxing strict admission. Prove one copied proposal completes on its first attempt, then continue copied autonomous turnover without minting Hands, Persona, or deployment authority. Separately recheck Yggdrasil's Persona credential boundary before attempting the one missing public consequence. Yggdrasil never builds.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
@@ -80,9 +80,9 @@ active_subgoals:
 
 organ_readiness:
   persona: partial; cross-host request/receipt/permit organs, distinct identities, exact release admission, unique permit completion, signed failure/unknown receipts, and no-repost behavior are live. Exact Bifrost cb3239aa fixes positional permit bodies and binds the Discord bridge command receipt to the signed request. A completed public consequence remains unproven because Yggdrasil has no Discord bot credential.
-  self: partial; proposal recovery, Mind admission, current-model Hands routing, Soul lifecycle precedence, verdict incorporation, proposal preemption, challenge-aware Eyes routing, in-process status ownership, and causal Research/Soul-to-Modeling routing are live. Broader autonomous frontier turnover remains open.
+  self: partial; proposal recovery, Mind admission, current-model Hands routing, Soul lifecycle precedence, verdict incorporation, proposal preemption, challenge-aware Eyes routing, in-process status ownership, causal Research/Soul-to-Modeling routing, and grant-owned lifecycle projection are live. Exact 34d75d05 proves strict schema failures requeue without granting consequence and a later admitted result terminalizes the original grant once, but first-attempt typed-result reliability remains open.
   eyes: proven for one bounded Windows challenged-claim circuit and one coordinated Linux resident circuit. Linux Eyes job eaf25324 invoked exactly three governed native read-only source tools, completed a typed role result, and was accepted as evidence ev-research-856fb6d1 with no external consequence. Broader source coverage remains open.
-  modeling: proven for the current bounded Windows circuit, the causal Linux resident Eyes-to-Modeling route, and governed live directory observation. Exact 31dcd351 Modeling measured the copied c006 Heartbeat artifact body itself as 72 directories, 74 files, and 3975362 bytes with complete=true, while refusing to promote filenames into grant authority. Broader Body-map coverage remains open.
+  modeling: proven for the current bounded Windows circuit, the causal Linux resident Eyes-to-Modeling route, governed live directory observation, and typed resident grant sight. Exact 34d75d05 Modeling used the resident-owned lifecycle projection to establish sampled older terminal grants remained launchable=false after later grants and that its active consumed grant was already non-launchable. Three preceding duplicate-field outputs failed strict admission, so reliable first-attempt structured publication remains open. Broader Body-map coverage remains open.
   imagination: proven for three bounded live circuits, exact packaged receipt-free settlement, and genuine packaged model-produced option generation. Exact acd91e6e accepted signed public feedback into one proposal-only request, derived all causal identity and quoted-evidence references from authenticated runtime context, atomically published worker result plus candidate companion, settled Self once without retry, and neither adopted the proposal nor granted Hands. The rejected b661ec4b copied run remains evidence that model-authored evidence identifiers were an illicit provenance mouth; its three failed attempts were braked and sealed.
   hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind reviewed path ceilings to exact changed-path subsets.
   soul: proven for the current bounded route-chain consequence; exact d3bfbda0 launched Verification through typed plan-decision provenance, result f23fe2b6 was accepted at revision 57, and Self then derived Modeling before any repeated Hands authority.

state/scratch.md

@@ -4,9 +4,9 @@ Disposable working memory for one bounded rite.
 
 ## Current Subgoal
 
-Map the typed authority that can prove a Heartbeat grant remains terminal and
-unlaunchable after later grants, retention, and restart. Route Eyes through
-that owner; do not mistake artifact inventory for lifecycle authority.
+Map and cut the repeated proposal-Modeling role-result duplicate-field failure
+at the schema/ingress owner. Preserve strict typed admission; do not add a
+permissive parser or let retries impersonate first-attempt readiness.
 
 ## Accepted live boundary
 
@@ -18,16 +18,33 @@ proposal grant and two receipt-bound continuations, ended sleeping at revision
 54 with 57/57 runtime jobs/results and zero open jobs, then both copied owners
 stopped cleanly under the restored brake. Actual c006 was untouched.
 
+## Accepted lifecycle sight
+
+Exact pushed `34d75d05`, release
+`sha256-718316c4372f3caf127579cd8a185fe11717f2370f1418d9a1f465a0efa54b8c`,
+witness
+`sha256-58d4c05c3de5b9c07ea76e06a2f60af94571a0f053da49de65629f413e0cbd92`
+exposes only the explicitly bound resident store. The exact grant envelope and
+resident state own lifecycle truth; scheduling and projection share
+`resident_self_grant_is_pending`. Artifact names and terminal acks do not own
+launchability.
+
+Copied live Modeling invoked this organ. Attempts one through three failed
+strict typed admission because the model duplicated `checkpointSummary` or
+`verdict`; resident Self requeued them without consequence. Attempt four
+completed and reported sampled older terminal grants `launchable=false` and
+the active consumed grant `launchable=false`. Under an engaged copied brake,
+Self reconciled the completed evidence, cleared the active turn at revision 74,
+and remained braked. No new grant appeared; both copied owners exited zero.
+
 ## Next authority map
 
-- Candidate owner: the typed Heartbeat grant envelope and resident lifecycle
-  state, not filesystem artifacts.
-- Allowed inputs: exact grant identity, terminal state/acknowledgement,
-  resident active lease, retention head, and restart-visible pending selection.
-- Required output: a narrow operator-safe or Eyes-readable projection proving
-  whether each relevant grant is terminal, active, pending, retained, or
-  retired.
-- Forbidden cut: do not give `epiphany_source` generic CultCache access and do
-  not add a filename heuristic.
-- Verification: an older terminal grant must remain unlaunchable after a later
-  grant completes, acknowledgements compact, and copied owners restart.
+- Owner to inspect: role-result schema construction and model-ingress decoding.
+- Inputs: the exact generated schema, role prompt, provider response body, and
+  strict duplicate-field rejection receipts.
+- Output: one canonical typed role-result object on the first valid model turn.
+- Forbidden cut: do not weaken duplicate-field rejection, merge conflicting
+  fields after the fact, or hide failure behind unbounded retry.
+- Verification: the same copied proposal must complete once on attempt one,
+  retain typed lifecycle evidence, terminalize exactly one grant, and remain
+  consequence-free.