docs: Record atomic Verification ownership

notes/epiphany-current-algorithmic-map.md

@@ -1,8 +1,8 @@
 # Epiphany current algorithmic map
 
 Updated: 2026-08-24
-Latest committed implementation cut: `8dbfcf63` on `codex/epiphany-shakedown-live`
-Current worktree cut: documentation/evidence for the final duplicate launch-binding deletion;
+Latest committed implementation cut: `3ed1d564` on `codex/epiphany-shakedown-live`
+Current worktree cut: documentation/evidence for duplicate frontier-Modeling writer deletion;
 Ox17 remains paused
 
 This document describes the live machine. Historical cuts, rejected paths, and
@@ -241,6 +241,16 @@ typed failures, and Mind admission remain with their existing owners. Runtime
 writable state is v19. This cut does not touch Model Atlas or narrow the still-
 unrun inter-swarm path.
 
+Verdict-driven Modeling has one writer. Exact `3ed1d564` deletes the public
+`commit_repo_frontier_modeling_request` API that production never called.
+Accepted Verification already commits its audit, Soul verdict, and canonical
+frontier-Modeling request atomically through the Mind owner; the deleted API
+reopened the store and offered a second mutation path solely for one OpenAI
+test fixture. That test now launches ordinary Body Modeling through current
+work and still proves exact sealed input, structured completion, typed result
+and job terminality, provider failure, and output-contract failure. Its
+fabricated frontier, route, Verification, and Soul tableau is gone.
+
 Bifrost owns its private feedback-signing identity. Exact `94098223` deletes
 Epiphany's host-identity executable and the private signer, persisted identity,
 enrollment, platform protection, and anchor-export implementation behind it.

notes/epiphany-fork-implementation-plan.md

@@ -362,6 +362,13 @@ Cut in this order:
    grants, typed failures, and refusal/retry invariants remain family-owned.
    Runtime writable state advances to v19. Model Atlas and the unrun
    inter-swarm collaboration path are unchanged.
+   Exact `3ed1d564` then deletes the standalone public writer for the derived
+   frontier-Modeling request. Accepted Verification is the sole writer and
+   atomically commits its audit, Soul verdict, and request. The deleted path had
+   no production caller and survived only because an OpenAI test fabricated a
+   parallel Verification/Soul tableau; that test now uses ordinary Body
+   Modeling while preserving provider, contract, structured-result, and job-
+   terminality proofs.
 12. **Landed at `1662a012`, `07d891ba`, and `ec1431ff`:** coordinator policy now
    projects keyed current work; persisted `EpiphanyThreadStateEntry`,
    `coordinator_state_transaction`, generic coordinator services, the

notes/fresh-workspace-handoff.md

@@ -2,8 +2,8 @@
 
 Updated: 2026-08-24
 Branch: `codex/epiphany-shakedown-live`
-Latest committed implementation cut: `8dbfcf63`
-Current worktree: documentation/evidence for the final duplicate launch-binding deletion;
+Latest committed implementation cut: `3ed1d564`
+Current worktree: documentation/evidence for duplicate frontier-Modeling writer deletion;
 Ox17 remains paused
 
 ## Orientation
@@ -15,7 +15,7 @@ Idunn's Yggdrasil CI/CD task with local compiler work, or wake resident
 cognition without an explicit operator resumption.
 
 Epiphany is a supervised engineering alpha. Exact source `d2ca6630` remains the
-production symlink body and is inactive. Exact `8dbfcf63` is the current
+production symlink body and is inactive. Exact `3ed1d564` is the current
 build-affecting source. Historical live proofs remain evidence; they do not
 authorize the next capstone or Gate 1.
 
@@ -45,6 +45,22 @@ authorize the next capstone or Gate 1.
 
 ## What just landed
 
+Exact `3ed1d564` deletes the public
+`commit_repo_frontier_modeling_request` mutation path. Production had no
+caller: accepted Verification already atomically commits its audit, Soul
+verdict, and derived frontier-Modeling request through one Mind transaction.
+The deleted writer reopened the store and existed only to feed an OpenAI test.
+That test now uses the real Body Modeling launcher and retains its consequential
+proofs for sealed input, structured completion, typed result/job persistence,
+provider failure, and output-contract failure. Its fabricated frontier, route,
+Verification result, and Soul verdict are gone. The cut removes 205 net source
+lines; `runtime_spine.rs` is 9,819 lines with 54 public functions. The atomic
+Verification-to-Modeling lifecycle and release-owned model runtime pass.
+
+Continue auditing public runtime-spine mutation/read wrappers and tests against
+real consumers and consequences. Preserve the unrun Atlas inter-swarm vertical
+slice until Gate 1.
+
 Exact `8dbfcf63` deletes the persisted Body Modeling, Imagination consideration,
 and Reorientation launch-binding families. Their attempt, request, role,
 binding, timestamp, Body/projection, and launch-digest fields duplicated the

state/map.yaml

@@ -59,6 +59,7 @@ current_status:
   proposal_modeling_launch_authority_cut: Exact b0a4978d deletes the Proposal-Modeling launch-binding document family after exact 6831eb69 exposed that even its four-field form owned nothing. The immutable worker launch already carries the exact request reference, role, binding, job identity, and sealed typed document. Current-work, retry counting, fulfillment, archival, and coordinator actuation now consume that owner directly; the registry entry and operator JSON echo are gone. The keyed lifecycle, coordinator target, OpenAI runtime, and old-epoch refusal pass; 70 net source lines are gone. Runtime writable epoch is v17.
   planning_launch_authority_cut: Exact b55e96ea deletes both persisted Planning and PlanMind launch-binding families. Their twenty-four fields copied the immutable worker launch, typed requests, runtime job, timestamp, canonical attempt identity, or typed failure review without owning a consequence. Self now derives contiguous attempts and current jobs from family-referenced worker launches. A retry launch strongly reads every prior launch plus the exact failed result and review, so stale retry authority conflicts instead of being summarized into decorative cargo. The complete keyed Planning-to-PlanMind lifecycle, v17 refusal, packaged coordinator, and model-runtime checks pass; 44 net source lines are gone. Runtime writable epoch is v18.
   remaining_launch_authority_cut: Exact 8dbfcf63 deletes the persisted Body Modeling, Imagination consideration, and Reorientation launch-binding families. Their attempt, request, role/binding, timestamp, Body/projection, and launch-digest fields were derivable from the immutable worker launch, typed family request/projection, runtime job/result, admission refusal, or typed pass failure. Canonical job identities own contiguous attempt order. Body retry CAS strongly reads prior launches, latest job, exact result, and matching refusal; Reorientation retry CAS strongly reads prior launches, latest job, typed failure, and exact terminal result; Imagination retry CAS strongly reads prior launches. Family semantic requests, sealed projections, result validation, substrate grants, typed failures, and Mind admission remain. Focused Body/Imagination lifecycle, Reorientation success/failure/retry, old-epoch refusal, coordinator, and OpenAI runtime checks pass; 24 net source lines are gone. Runtime writable epoch is v19. Model Atlas and its unrun inter-swarm path are untouched.
+  frontier_modeling_writer_cut: Exact 3ed1d564 deletes the public commit_repo_frontier_modeling_request API and export. Production had no caller because accepted Verification already atomically commits its audit, Soul verdict, and canonical frontier-Modeling request through one Mind transaction. The second writer reopened the store and survived only to feed one OpenAI test. That test now launches ordinary Body Modeling and still proves sealed reasoning input, structured completion, typed job/result persistence, provider failure, and output-contract failure; 164 lines of fabricated frontier, route, Verification, and Soul authority are gone. The atomic Verification-to-Modeling lifecycle, core library, OpenAI test, and release-owned model runtime pass. The cut removes 205 net source lines; runtime_spine.rs is 9,819 lines with 54 public functions. Model Atlas is untouched.
   supervisor_subtraction: Exact 856648de completes the supervisor deletion. Epiphany owns no local generic daemon supervisor, semantic projector service, workspace-coverage projector, Windows Task Scheduler integration, or service-policy/lifecycle/heartbeat/recovery mirror. Idunn on Yggdrasil owns source-triggered compilation, testing, packaging, deployment, signed health, and daemon survival. The canonical Epiphany brake gates Epiphany cognition and consequence authority, not Idunn startup or unrelated lifecycle.
   launch_dependency_cut: Exact 2aeab7a9 deletes the generic organ dependency matrix, generic receipt catalogue/proof profiles, persisted worker-launch cargo, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. Family admission owners derive exact dependencies from typed state. Worker-launch schema v2 and Persona projector prompt v1 refuse the old writable shape. Core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1 pass.
   operator_surface_subtraction: Exact ef92e853 deletes the callerless view-lens registry, legacy acceptance-bundle builders, test-only raw-JSON result interpreters, and six tests: 797 net lines. Exact a292979d and 77e817c1 delete the duplicate CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. Exact 3b94bf6e and 59c5e3a6 delete the nested duplicate status view, false auxiliary mode, and ignored status arguments. Exact 7c9b0cf3 deletes the fixed synthetic job table, role-board job cargo/mappers, and its test: 338 net lines. Exact 2ce91461 deletes the scene/planning Mind reconstructions, duplicate self-policy crate, unused prompt templates, four counterfeit schemas, and ten producer/source-text tests: 1,723 net lines. Exact 78836f3b deletes eight unconsumed status tableaux, the pressure calculator production only called without telemetry, its unreachable compaction action, one counterfeit schema, and six tests: 518 net lines. Exact f10f7fb3 deletes the final twelve epiphany.surface.* schemas and ten catalog entries after every one proved producerless and consumerless: 692 pure deletions. Exact ab3cacfb deletes thirty-one more producerless contracts, the false runtime-session mutation mouth, every Epiphany-owned Rider/Unity command schema, a callerless prompt-context module, its test-only specialist prompt system, and four self-affirming tests: 3,514 net lines. Exact 16d85b1b deletes six duplicate JSON-schema builder tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. Exact 06f93f70 deletes the test-only inverse OpenAI-to-native request mapper and makes two retained tests follow canonical native-to-provider derivation: sixty net lines. The local catalog now has twenty-three live or portable contracts. Brokkr owns Unity capabilities through CultMesh/Eve; a future Rider daemon owns Rider. Status retains Mind identity, exact current work, one action/reason decision, readable role lanes, and operator thought sealing. Core checks cleanly; retained provider and focused request-flow tests pass.
@@ -120,10 +121,10 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
-  unresolved_authority: `runtime_spine.rs` remains the largest central liability at 9,859 lines, 55 public functions, and 25 public structs; it still mixes immutable identity, sessions/jobs, process claims, model/tool execution binding, family request admission, consequence receipts, retention, and narrow identity/schema reads. All persisted family launch-binding documents are gone; immutable worker launches plus typed family requests and receipts own launch ancestry. Continue splitting only by deleting callerless or duplicate authority and auditing tests against consequential behavior; do not create family frameworks or adapters. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Bifrost's Discord delivery path is a real consumer of Epiphany's short-lived request-bound permit signature, so the distinct permit identity/process remains an earned privilege boundary; current Ygg deployment doctrine still points that crossing at the old Starfire endpoint and installs no issuer unit, which the Idunn lane must repair before Persona consequence readiness. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Resume the public runtime-spine and test-liability audit after exact 8dbfcf63. Trace each remaining public surface and test to a live consumer and consequential invariant; delete duplicate summaries, wrappers, and implementation-spelling proofs, but preserve exact identity, decision audit, conflict/replay, retry ancestry, retention fences, and the complete unrun Model Atlas inter-swarm vertical slice. Do not mistake component tests for collaboration acceptance. Do not run a local full-workspace compile, package, deployment, Ox root, or Model Atlas Gate run.
+  unresolved_authority: `runtime_spine.rs` remains the largest central liability at 9,819 lines, 54 public functions, and 25 public structs; it still mixes immutable identity, sessions/jobs, process claims, model/tool execution binding, family request admission, consequence receipts, retention, and narrow identity/schema reads. All persisted family launch-binding documents and the standalone verdict-driven Modeling writer are gone; immutable worker launches plus typed family requests and atomic admission receipts own launch ancestry and downstream work creation. Continue splitting only by deleting callerless or duplicate authority and auditing tests against consequential behavior; do not create family frameworks or adapters. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Bifrost's Discord delivery path is a real consumer of Epiphany's short-lived request-bound permit signature, so the distinct permit identity/process remains an earned privilege boundary; current Ygg deployment doctrine still points that crossing at the old Starfire endpoint and installs no issuer unit, which the Idunn lane must repair before Persona consequence readiness. Historical c011 and partial Gate roots stay untouched/read-only.
+  next_action: Resume the public runtime-spine and test-liability audit after exact 3ed1d564. Trace each remaining public surface and test to a live consumer and consequential invariant; delete duplicate summaries, mutation wrappers, and implementation-spelling proofs, but preserve exact identity, decision audit, conflict/replay, retry ancestry, retention fences, and the complete unrun Model Atlas inter-swarm vertical slice. Do not mistake component tests for collaboration acceptance. Do not run a local full-workspace compile, package, deployment, Ox root, or Model Atlas Gate run.
 
-  runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, exact sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. It exposes no aggregate status head, global revision, generic role patch, caller-authored mutation surface, duplicate prompt-state projection, persisted family launch-binding document, or public typed-fulfillment machinery. Completed model-session retention writes one private resurrection tombstone. Archived worker retention writes one decision-bearing historical record with exact request/terminal identity, deletion digest, decision context, structured role result, and terminal job records; duplicate IDs, timestamps, count summaries, and returned archive vectors own nothing and are absent. Mind/runtime writable epochs are v8/v19, archived-session schema is v1, archived-worker-attempt schema/type is v2, and claim-obligation schema is v3. The spine is 9,859 lines with 55 public functions and 25 public structs. Continue subtraction by tracing each remaining public surface and verifier to a live consumer and consequential invariant; do not replace deleted authority with registries, adapters, compatibility readers, or summary DTOs.
+  runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, exact sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. It exposes no aggregate status head, global revision, generic role patch, caller-authored mutation surface, duplicate prompt-state projection, persisted family launch-binding document, standalone verdict-driven Modeling writer, or public typed-fulfillment machinery. Completed model-session retention writes one private resurrection tombstone. Archived worker retention writes one decision-bearing historical record with exact request/terminal identity, deletion digest, decision context, structured role result, and terminal job records; duplicate IDs, timestamps, count summaries, and returned archive vectors own nothing and are absent. Mind/runtime writable epochs are v8/v19, archived-session schema is v1, archived-worker-attempt schema/type is v2, and claim-obligation schema is v3. The spine is 9,819 lines with 54 public functions and 25 public structs. Continue subtraction by tracing each remaining public surface and verifier to a live consumer and consequential invariant; do not replace deleted authority with registries, adapters, compatibility readers, or summary DTOs.
 
   runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.