Expose Soul binding mismatch

epiphany-core/src/runtime_spine.rs

@@ -7332,18 +7332,29 @@ pub fn put_repo_frontier_verification_request(
     let commit = cache
         .get::<HandsCommitReceipt>(&request.hands_commit_receipt_id)?
         .ok_or_else(|| anyhow!("verification request requires its exact commit receipt"))?;
-    let adopted_plan_consequence_is_exact = route.adopted_plan.as_ref().is_none_or(|plan| {
-        intent.frontier_route_id == route.route_id
-            && intent.plan_candidate_sha256 == plan.candidate_sha256
-            && intent.plan_action == plan.action
-            && command.command == plan.command
+    let current_model_hash = crate::memory_graph_model_hash(&model)?;
+    let adopted_plan_mismatches = route.adopted_plan.as_ref().map_or_else(Vec::new, |plan| {
+        let mut mismatches = Vec::new();
+        if intent.frontier_route_id != route.route_id {
+            mismatches.push("intent.plan.route");
+        }
+        if intent.plan_candidate_sha256 != plan.candidate_sha256 {
+            mismatches.push("intent.plan.candidate");
+        }
+        if intent.plan_action != plan.action {
+            mismatches.push("intent.plan.action");
+        }
+        if command.command != plan.command {
+            mismatches.push("command.plan.command");
+        }
+        mismatches
     });
     if request.model_revision != route.model_revision
         || request.model_hash != route.model_hash
         || request.frontier_item_id != route.frontier_item_id
         || request.frontier_item_hash != route.frontier_item_hash
         || model.model_revision != route.model_revision
-        || crate::memory_graph_model_hash(&model)? != route.model_hash
+        || current_model_hash != route.model_hash
         || authority.hands_review_id != request.hands_review_id
         || authority.model_revision != request.model_revision
         || authority.model_hash != request.model_hash
@@ -7364,10 +7375,15 @@ pub fn put_repo_frontier_verification_request(
         || commit.runtime_job_id != intent.runtime_job_id
         || patch.changed_paths != commit.changed_paths
         || !consequence_paths_within_authority(&patch.changed_paths, &authority.requested_paths)
-        || !adopted_plan_consequence_is_exact
+        || !adopted_plan_mismatches.is_empty()
     {
         return Err(anyhow!(
-            "verification request does not exactly bind route, model, Hands authority, and complete receipts"
+            "verification request does not exactly bind route, model, Hands authority, and complete receipts{}",
+            if adopted_plan_mismatches.is_empty() {
+                String::new()
+            } else {
+                format!("; mismatches: {}", adopted_plan_mismatches.join(", "))
+            }
         ));
     }
     let (envelope, _) = cache.prepare_entry(&request.request_id, request)?;

notes/fresh-workspace-handoff.md

@@ -7,11 +7,11 @@ growth.
 ## Authoritative live state
 
 - Branch: `codex/epiphany-shakedown-live`
-- Pushed HEAD: `0763fcbe94257eb9adbe92ab814b5a487f65551d`
+- Pushed HEAD: `189091bf` (`Keep rejected Modeling behind pending Soul`)
 - Live workspace: `F:\Projects\.epiphany-runtime\shakedown\live-20260808-v53-hands-precedence`
 - Sealed evidence: v49 through v52. Do not mutate them.
 - Current published release: commit `253ef34084c7b450e587c1938a68cd3e983ed79b`, release `sha256-e0a4fd22df335401d56295453e009f31aa2e82253634614426bfba298dd2d3f0`, witness `sha256-65cbc2f21f0774c4da00a60537c959d130e970a4b860de5629a7b929b8185b2c`.
-- Exact HEAD still needs one package/publish pass after the active Eyes worker completes.
+- Exact HEAD still needs one package/publish pass; do not start a duplicate build.
 
 ## What is true now
 
@@ -39,8 +39,20 @@ The Eyes worker completed as
 were valid and Mind accepted them at revision 26. Its suggestion to return to
 Imagination was advisory prose outside Eyes authority; Self retained runtime
 routing authority and derived one causal Modeling reconciliation because the
-accepted Research boundary is newer than Modeling. That single worker is active
-under model-runtime PID 31656. Poll it; do not relaunch.
+accepted Research boundary was newer than Modeling. Modeling result
+`result-worker-8772d5af-8df9-42da-a1c4-dee13eb1d959` proposed an Evolution
+patch and was correctly rejected because Evolution cannot bypass the active
+route. Commits `fbea0e22` and `189091bf` now keep that reviewed rejection behind
+Soul verification while a complete Hands consequence exists.
+
+Soul launch remains fail-closed. Supervisor retries supplied complete typed
+Hands chains for both plausible historical test-command spellings, with fresh
+passing logs, but verification-request admission still reports
+`command.plan.command`. Inspection of the typed route payload indicates that
+Imagination/Mind admitted a non-executable or empty plan command while later
+granting Hands authority. Do not weaken Soul and do not forge an empty command
+receipt. Preserve the failed launches (`v53-soul-r24`, `r25`, `r27`, diagnostic
+`r28`/`r29`) as receipts of the corrupted seam.
 
 ## Receipts
 
@@ -53,11 +65,17 @@ under model-runtime PID 31656. Poll it; do not relaunch.
 
 ## Next action
 
-Poll Modeling PID 31656. Review and accept the first valid causal RepoModel
-result, prove `modelingResultAcceptedAfterResearch` consumes the route, then
-follow Self into Soul verification of the completed Hands consequence. After that,
-package and publish exact `0763fcbe` once, replay v53 with no overrides, and
-inspect the next typed action.
+Finish the operator-safe mismatch diagnostic in `runtime_spine.rs` and commit
+it. Add fail-closed admission coverage so a non-executable adopted-plan command
+cannot produce Hands authority. Then implement one labeled typed supervisor
+migration for the live route, preserving the original route and every failed
+Soul launch as evidence, and retry Soul against the repaired binding.
+
+Build iteration is also an active architectural defect: a tiny
+`runtime_spine.rs` diagnostic edit forced 18-29 second debug rebuilds, while
+exact packages remain multi-minute. Map the crate/module dependency fan-out and
+extract the volatile coordinator/runtime-spine seam into narrower compilation
+units before the remaining shakedown passes.
 
 Keep separate the pending provenance audit: the adopted Mind decision serialized
 a model-supplied 2025 `decided_at`; coordinator commit-time ownership must be

state/map.yaml

@@ -34,9 +34,9 @@ invariants:
   - Evidence and git retain history; this map retains only state that changes future decisions.
 
 current_status:
-  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Live v53 has completed the adopted RepoModel revision 5 Hands route through commit 0763fcbe94257eb9adbe92ab814b5a487f65551d. Final typed Hands receipts are present. The Mind-admitted RepoModel now supplies one shared continuity checkpoint to status, CRRC, Reorientation launch, and atomic Reorientation acceptance. Accepted Reorientation found retrieval and graph freshness unknown, so Self correctly routed Eyes regather. Mind accepted the source-grounded Eyes packet at revision 26; its route narrative was advisory, not Eyes authority. Self then derived the causal single-use Modeling reconciliation, which is active under model-runtime PID 31656. Persona consequence, retention, endurance, restart closure, and Linux/Yggdrasil cognition remain open.
+  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Live v53 completed the adopted RepoModel revision 5 Hands consequence through commit 0763fcbe94257eb9adbe92ab814b5a487f65551d. Reorientation and Eyes regather were accepted; the resulting causal Modeling attempt was correctly rejected because Evolution cannot bypass the active route. HEAD 189091bf routes the still-unverified Hands consequence to Soul ahead of that rejected Modeling result. Soul now fails closed because the adopted plan command does not match the complete Hands command receipt, exposing an Imagination/Mind admission defect rather than a Soul defect. Persona consequence, retention, endurance, restart closure, and Linux/Yggdrasil cognition remain open.
   operational_state:
-    local_worktree: stale_proposal_precedence_fix_verified_commit_next
+    local_worktree: soul_binding_diagnostic_mid_pass
     operator_wireguard: restored
     yggdrasil: canonical_small_public_crossing_body
     starfire: temporary_epiphany_cognition_body
@@ -52,8 +52,8 @@ current_status:
     bifrost_feedback_crossing: authenticated_transport_only
     yggdrasil_epiphany_services: absent
     resident_physiology: heartbeat_and_self_running
-  unresolved_authority: Eyes result result-worker-437e5b05-9e8c-4596-b517-84a7a75d2b4f owns source observations, not runtime routing. Its evidence was accepted; Self retained routing authority and launched Modeling because accepted Research is newer than the last Modeling boundary. Exact HEAD packaging is still required because the currently published 253ef340 release predates the final atomic-acceptance corrections. The adopted Mind decision also carries a model-supplied 2025 timestamp; timestamp ownership remains a separate provenance audit item.
-  next_action: Poll the single active Modeling worker PID 31656; do not relaunch. Review and accept the first valid causal RepoModel result, verify modelingResultAcceptedAfterResearch consumes the route, then let Self route Soul over the existing Hands consequence. Package and publish exact HEAD once without duplicate builds, replay the closed continuity chain, and inspect the next typed action.
+  unresolved_authority: The active route admitted a plan whose command cannot bind the completed Hands consequence. Soul reports only command.plan.command after supervisor-supplied exact receipt-chain retries, so the live state is fail-closed and must not be bypassed. Prevent empty or non-executable plan commands from reaching Mind adoption, then migrate the live route through a labeled typed supervisor repair. Exact HEAD packaging remains required. The adopted Mind decision also carries a model-supplied 2025 timestamp; timestamp ownership remains a separate provenance audit item.
+  next_action: Finish and commit the Soul mismatch diagnostic, add admission coverage that rejects a non-executable adopted-plan command before Hands authority exists, then design one typed supervisor migration that repairs the live route and emits receipts without erasing the rejected state. Retry Soul only after the repaired route and current Hands consequence bind exactly. Separately map and split the monolithic epiphany-core runtime spine/build graph; tiny runtime-spine edits currently force 18-29 second debug rebuilds and multi-minute exact packages.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.