Cut false Body continuity authority
This commit is contained in:
Meta Vens
parent
677938d042
commit
645fcf38fe
7 changed files with 48 additions and 50 deletions
|
|
@ -38,12 +38,12 @@ fn main() -> Result<()> {
|
|||
&PathBuf::from(runtime_store),
|
||||
)? {
|
||||
ObserveOutcome::Created(value) => println!(
|
||||
"created generation={} tree={} continuity={}",
|
||||
value.generation, value.tree_oid, value.continuity_status
|
||||
"created generation={} tree={}",
|
||||
value.generation, value.tree_oid
|
||||
),
|
||||
ObserveOutcome::Unchanged(value) => println!(
|
||||
"unchanged generation={} tree={} continuity={}",
|
||||
value.generation, value.tree_oid, value.continuity_status
|
||||
"unchanged generation={} tree={}",
|
||||
value.generation, value.tree_oid
|
||||
),
|
||||
}
|
||||
}
|
||||
|
|
@ -52,15 +52,14 @@ fn main() -> Result<()> {
|
|||
match load_repository_body_status(&store)? {
|
||||
None => println!("missing"),
|
||||
Some((binding, value)) => println!(
|
||||
"observed workspace={} swarm={} runtime={} scope={} generation={} tree={} head={} continuity={}",
|
||||
"observed workspace={} swarm={} runtime={} scope={} generation={} tree={} head={}",
|
||||
binding.workspace_id,
|
||||
binding.swarm_id,
|
||||
binding.runtime_id,
|
||||
binding.scope,
|
||||
value.generation,
|
||||
value.tree_oid,
|
||||
value.head_oid.as_deref().unwrap_or("unborn"),
|
||||
value.continuity_status
|
||||
value.head_oid.as_deref().unwrap_or("unborn")
|
||||
),
|
||||
}
|
||||
}
|
||||
|
|
@ -118,8 +117,8 @@ fn smoke() -> Result<()> {
|
|||
ObserveOutcome::Created(value) | ObserveOutcome::Unchanged(value) => value.generation,
|
||||
};
|
||||
println!(
|
||||
"repository-body-smoke=ok generation={} tree={} continuity={}",
|
||||
generation, observed.1.tree_oid, observed.1.continuity_status
|
||||
"repository-body-smoke=ok generation={} tree={}",
|
||||
generation, observed.1.tree_oid
|
||||
);
|
||||
Ok(())
|
||||
}
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ pub const BODY_HEAD_TYPE: &str = "epiphany.repository_body.head";
|
|||
pub const BODY_MANIFEST_TYPE: &str = "epiphany.repository_body.manifest";
|
||||
pub const BODY_BINDING_KEY: &str = "binding";
|
||||
pub const BODY_HEAD_KEY: &str = "current";
|
||||
pub const BODY_SCHEMA_VERSION: &str = "epiphany.repository_body.v1";
|
||||
pub const BODY_SCHEMA_VERSION: &str = "epiphany.repository_body.v2";
|
||||
|
||||
#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)]
|
||||
#[cultcache(
|
||||
|
|
@ -100,12 +100,10 @@ pub struct RepositoryBodyObservation {
|
|||
#[cultcache(key = 20)]
|
||||
pub two_scan_outcome: String,
|
||||
#[cultcache(key = 21)]
|
||||
pub continuity_status: String,
|
||||
#[cultcache(key = 22)]
|
||||
pub global_excludes_policy: String,
|
||||
#[cultcache(key = 23)]
|
||||
#[cultcache(key = 22)]
|
||||
pub manifest_root_sha256: String,
|
||||
#[cultcache(key = 24)]
|
||||
#[cultcache(key = 23)]
|
||||
pub manifest_entry_count: u64,
|
||||
}
|
||||
|
||||
|
|
@ -375,7 +373,6 @@ fn scan_repository(
|
|||
first_tree_oid: first.tree_oid,
|
||||
second_tree_oid: second.tree_oid,
|
||||
two_scan_outcome: "stable_equal".into(),
|
||||
continuity_status: "unproven".into(),
|
||||
global_excludes_policy: "disabled_for_observation".into(),
|
||||
manifest_root_sha256: manifest.manifest_root_sha256.clone(),
|
||||
manifest_entry_count: manifest.entries.len() as u64,
|
||||
|
|
@ -780,7 +777,6 @@ fn validate_body_chain(
|
|||
|| observation.two_scan_outcome != "stable_equal"
|
||||
|| observation.first_tree_oid != observation.second_tree_oid
|
||||
|| observation.tree_oid != observation.first_tree_oid
|
||||
|| observation.continuity_status != "unproven"
|
||||
|| observation.manifest_root_sha256 != head.manifest_root_sha256
|
||||
{
|
||||
bail!("repository Body observation identity chain is invalid");
|
||||
|
|
@ -1091,7 +1087,6 @@ mod tests {
|
|||
_ => unreachable!(),
|
||||
};
|
||||
assert!(value.head_oid.is_none());
|
||||
assert_eq!(value.continuity_status, "unproven");
|
||||
assert_eq!(value.two_scan_outcome, "stable_equal");
|
||||
Ok(())
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1817,20 +1817,20 @@ same graph judgment instead of re-parsing the churn string.
|
|||
The ungrounded legacy freshness fields were deleted. Churn retains only its
|
||||
understanding, diff, warning, and unexplained-write evidence; graph checkpoints
|
||||
retain identity and frontier content. Neither structure can publish a revision
|
||||
or freshness verdict. A future Ready projection requires the exact canonical
|
||||
RepoModel revision/hash plus matching Mind admission, joined to a separate
|
||||
continuity-bearing Body observation and retrieval coverage for the same source
|
||||
generation. Modeling cannot certify its own freshness; Mind derives readiness
|
||||
from the joined authorities.
|
||||
or freshness verdict. A future observed-ready-at projection requires the exact
|
||||
canonical RepoModel revision/hash plus matching Mind admission, joined to fresh
|
||||
Body observations bracketing exact retrieval coverage for the same manifest
|
||||
root. Modeling cannot certify its own freshness; Mind derives readiness from
|
||||
the race-bounded current-state join.
|
||||
|
||||
### Repository Body observation boundary
|
||||
|
||||
The bounded repository Body observer supplies only raw `git_worktree` tree state
|
||||
from two equal temporary-index scans. A separate bind step consumes the real
|
||||
runtime swarm binding and pins workspace, source hash, canonical root, object
|
||||
format, scope, and policy; observe has no identity-authoring arguments. It explicitly
|
||||
says continuity unproven and has no Ready field, preventing another freshness
|
||||
oracle before continuity and same-generation retrieval coverage exist. Sparse
|
||||
format, scope, and policy; observe has no identity-authoring arguments. It makes
|
||||
no historical continuity claim and has no Ready field, preventing another
|
||||
freshness oracle before Body-grounded model and retrieval coverage exist. Sparse
|
||||
worktrees fail closed; submodules contribute gitlinks only; integration is
|
||||
deliberately absent.
|
||||
Global excludes are neutralized. Corrupt HEAD and path/runtime/repository
|
||||
|
|
|
|||
|
|
@ -776,7 +776,7 @@ canonical Git root, object format, scope, and ignore policy; observe cannot mint
|
|||
identity. Two disposable-index `read-tree`/`git add --all -- .`/
|
||||
`write-tree` scans must agree. CultCache MessagePack persists immutable
|
||||
generations and an exact-CAS current head; unchanged raw manifest preserves the
|
||||
generation. `continuity_status` is always `unproven`; there is no Ready field.
|
||||
generation. The observer makes no historical continuity claim and has no Ready field.
|
||||
Sparse checkout fails closed, submodules are gitlink-only, and RepoModel/
|
||||
retrieval/scheduler/Mind integration is absent. The CultCache store must remain
|
||||
outside the observed worktree so observer writes cannot become observed input.
|
||||
|
|
@ -797,21 +797,23 @@ Gitlinks remain nonrecursive. Unsafe or unrepresentable paths fail closed.
|
|||
A truthful whole-repository readiness join does not yet exist. Mind must own a
|
||||
derived `RepositoryReadinessProjection`; Body observation, Modeling, retrieval,
|
||||
semantic projection, schedulers, watchers, jobs, and UI are forbidden writers.
|
||||
Its required inputs are the current validated Body chain, a continuity receipt
|
||||
covering that exact Body head, the canonical RepoModel plus its exact Mind
|
||||
admission receipt, a RepoModel grounding receipt bound to that Body manifest,
|
||||
Its required inputs are a fresh validated Body observation, the canonical
|
||||
RepoModel plus its exact Mind admission receipt, a RepoModel grounding receipt
|
||||
bound to that Body manifest,
|
||||
the authenticated Modeling semantic projection receipt for that admitted model,
|
||||
and exact workspace-retrieval coverage bound to the same Body manifest and a
|
||||
named inclusion policy. Derivation must retry if any participating head advances.
|
||||
|
||||
The joined projection may report Missing, Pending/Unknown, Stale, or Ready with
|
||||
exact evidence identities and mismatch reasons. It may report Ready only when
|
||||
every binding agrees and coverage is complete. Two equal Body scans prove one
|
||||
stable observation interval, not gap-free continuity. The current observer's
|
||||
`continuity_status=unproven` therefore makes Ready structurally unavailable.
|
||||
The join is a race-bounded operation: observe Body root R1, validate every exact
|
||||
artifact against R1, then observe again and require R2=R1 before emitting an
|
||||
`observed-ready-at` receipt whose truth interval ends at the second scan. Later
|
||||
reads must revalidate rather than present it as timeless Ready. A→B→A is harmless
|
||||
when all artifacts are content-addressed to A. Gap-free watcher or journal
|
||||
continuity is not required and cannot prove truth after its own final event.
|
||||
Legacy retrieval `Ready`, empty dirty paths, timestamps, watcher silence, Git
|
||||
tree or HEAD OIDs, Qdrant existence, counts, and unrelated generations are not
|
||||
substitutes. The lossy JSON workspace manifest remains cache metadata, not
|
||||
substitutes. Watchers and Hands receipts may trigger recomputation but cannot
|
||||
replace either Body observation. The lossy JSON workspace manifest remains cache metadata, not
|
||||
coverage authority. Semantic-projector Ready remains exact query eligibility for
|
||||
the admitted RepoModel projection; it does not prove repository Body coverage.
|
||||
|
||||
|
|
|
|||
|
|
@ -1625,10 +1625,10 @@ The ungrounded `churn.graph_freshness` and
|
|||
identity and frontier content; churn retains understanding, diff, warning, and
|
||||
unexplained-write evidence. Canonical RepoModel revision/hash plus its exact
|
||||
Mind-issued `RepoModelAdmissionReceipt` proves only admitted map identity.
|
||||
Future Ready also requires a separate continuity-bearing Body observation and
|
||||
retrieval coverage bound to the same source generation; Mind derives the joined
|
||||
readiness projection. No current artifact proves that Body head. Do not build a
|
||||
bridge from snapshot metadata, watcher silence, or timestamps.
|
||||
Future observed-ready-at also requires fresh Body observations bracketing exact
|
||||
Body-grounded model admission and retrieval coverage for one manifest root;
|
||||
Mind derives the joined projection. Do not build a bridge from snapshot
|
||||
metadata, watcher silence, timestamps, or historical event continuity.
|
||||
|
||||
## Repository Body substrate landed (2026-07-15)
|
||||
|
||||
|
|
@ -1638,7 +1638,7 @@ explicit runtime-bound bind step, observe, pure status, and smoke for
|
|||
runtime/swarm/source identity plus canonical Git root and policy. Two equal
|
||||
isolated Git-index scans feed immutable CultCache observations/current-head CAS.
|
||||
Unchanged raw manifest does not advance generation; missing status creates no
|
||||
store. Continuity remains unproven with no Ready field. Sparse checkout is
|
||||
store. The observer makes no historical continuity claim and has no Ready field. Sparse checkout is
|
||||
rejected, submodules are gitlink-only, and downstream joins remain absent.
|
||||
The CultCache store is required to live outside the observed worktree.
|
||||
Canonical path checks run before any bind/store write, global excludes are
|
||||
|
|
@ -1657,17 +1657,19 @@ commit atomically. Gitlinks are nonrecursive; unrepresentable paths fail closed.
|
|||
|
||||
Modeling audited the next ownership seam after the Body observer landed. Mind is
|
||||
the only coherent owner for a derived repository-readiness projection, but the
|
||||
inputs required to emit Ready do not exist yet: a continuity receipt covering
|
||||
the exact current Body head, RepoModel admission grounded to that manifest, and
|
||||
exact workspace-retrieval coverage for that same manifest. The existing
|
||||
inputs required to emit observed-ready-at do not exist yet: RepoModel admission
|
||||
grounded to the exact current Body manifest and exact workspace-retrieval
|
||||
coverage for that same manifest. The existing
|
||||
semantic projector proves exact query eligibility for an admitted RepoModel
|
||||
projection; the legacy workspace retrieval JSON manifest proves only path/size/
|
||||
mtime/chunk cache agreement. Do not join its `Ready` label, empty dirty paths,
|
||||
watcher silence, Git OIDs, timestamps, counts, or Qdrant presence into repository
|
||||
readiness. A join evaluator built before those primitives may only return
|
||||
Missing/Unknown/Stale with reasons. Build order is continuity receipt, exact
|
||||
Body-grounded RepoModel admission, typed Body-bound retrieval coverage, the
|
||||
Mind-owned join, then deletion of local consumer interpretations.
|
||||
readiness. Historical continuity was audited and rejected as another conceptual
|
||||
substitution. The correct join observes Body root R1, validates every artifact,
|
||||
observes R2, and emits only a time-bounded result when R1=R2. Watchers and Hands
|
||||
receipts trigger recomputation; they never replace either observation. Build
|
||||
order is exact Body-grounded RepoModel admission, typed Body-bound retrieval
|
||||
coverage, the Mind-owned race-safe join, then deletion of local interpretations.
|
||||
|
||||
The deployment next action is unchanged and permission-bound. Do not reboot
|
||||
without exact live operator approval. With that approval, run the real
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -1,7 +1,7 @@
|
|||
experiment:
|
||||
name: EpiphanyAgent
|
||||
repository_body_observer: "Native Rust explicitly binds caller workspace ID to an existing validated runtime/swarm/source identity plus canonical Git root/object format/scope/policy. Two equal sanitized temporary-index scans enumerate ignore-aware UTF-8 paths, Git modes, and nonrecursive gitlinks with global excludes disabled; raw regular bytes/lengths and non-followed symlink-target bytes are SHA-256 hashed. The domain-separated ordered raw manifest root, not the clean-filtered auxiliary tree OID, is authoritative Body identity. Every Git subprocess strips ambient repository/worktree/object/ref/index/namespace/replacement/graft/shallow and config-injection authority. Observe cannot mint identity. CultCache MessagePack atomically commits immutable manifest+observation and a manifest-root head by exact CAS. Canonical store-path checks precede writes; corrupt HEAD, sparse checkout, unsafe/unrepresentable paths, racing reads, and repo/runtime substitution fail closed. Only accepted stable observations persist; errors advance no head. Unchanged raw manifest preserves generation; status is read-pure. Continuity remains unproven; no Ready field or downstream integration exists."
|
||||
repository_readiness_join: "Mind must own one derived repository-readiness projection from exact authenticated authorities: the current validated Body head plus a continuity receipt covering it, canonical RepoModel plus exact Mind admission and Body-grounding receipt, authenticated semantic projection eligibility for that admitted model, and workspace retrieval coverage bound to the same Body manifest and named scope policy. Derivation must retry across head movement. Current Body continuity is unproven and no admission-grounding or exact retrieval-coverage receipt exists, so Ready is structurally unavailable. Legacy retrieval Ready/empty dirty paths, timestamps, watcher silence, Git OIDs, Qdrant existence, counts, and unrelated generations are forbidden substitutes."
|
||||
repository_body_observer: "Native Rust explicitly binds caller workspace ID to an existing validated runtime/swarm/source identity plus canonical Git root/object format/scope/policy. Two equal sanitized temporary-index scans enumerate ignore-aware UTF-8 paths, Git modes, and nonrecursive gitlinks with global excludes disabled; raw regular bytes/lengths and non-followed symlink-target bytes are SHA-256 hashed. The domain-separated ordered raw manifest root, not the clean-filtered auxiliary tree OID, is authoritative Body identity. Every Git subprocess strips ambient repository/worktree/object/ref/index/namespace/replacement/graft/shallow and config-injection authority. Observe cannot mint identity. CultCache MessagePack atomically commits immutable manifest+observation and a manifest-root head by exact CAS. Canonical store-path checks precede writes; corrupt HEAD, sparse checkout, unsafe/unrepresentable paths, racing reads, and repo/runtime substitution fail closed. Only accepted stable observations persist; errors advance no head. Unchanged raw manifest preserves generation; status is read-pure. The observer owns bounded current-state identity, makes no historical continuity claim, and has no Ready field or downstream integration."
|
||||
repository_readiness_join: "Mind must own one race-bounded derived repository-readiness operation from exact authenticated authorities: freshly observe Body root R1, validate canonical RepoModel plus exact Mind admission and Body-grounding receipt, authenticated semantic projection eligibility for that admitted model, and workspace retrieval coverage bound to R1 and a named scope policy, then freshly observe R2 and require R2=R1. Its output is observed-ready-at with a truth interval ending at the second scan, not timeless Ready; later reads revalidate. A→B→A is harmless for content-addressed artifacts. Watcher/journal continuity and Hands receipts are invalidation triggers only. Legacy retrieval Ready/empty dirty paths, timestamps, watcher silence, Git OIDs, Qdrant existence, counts, and unrelated generations are forbidden substitutes."
|
||||
status: active
|
||||
phase: phase_6_reflection_boundary
|
||||
premise: >
|
||||
|
|
@ -194,7 +194,7 @@ accepted_design:
|
|||
- Durable `job_bindings` now form a thin Epiphany-owned launcher seam: new specialist/reorient launches write only binding id, kind, scope, owner role, authority scope, linked ids, and an optional blocking reason. Runtime lifecycle ids live in `runtime_links` and runtime-spine job/result records, not in durable job bindings.
|
||||
- The `jobs` view lens is a read-only job/progress reflection: it derives indexing, remap, verification, and specialist slots from authoritative state and retrieval summaries, then projects heartbeat-backed bindings as pending heartbeat turns. It is not the scheduler, notification stream, durable runtime job table, or SQLite reader.
|
||||
- `thread/epiphany/jobsUpdated` is sealed legacy Codex evacuation telemetry. The handler no longer emits Epiphany updates from old runtime `agent_job_progress:{json}` background events; heartbeat/runtime-spine is the live activation and result path.
|
||||
- Native `derive_freshness` is the read-only freshness judgment: canonical retrieval state, explicit legacy frontier pressure, and positive watcher changes are its inputs; retrieval/legacy-graph/watcher judgments are its outputs. Watcher silence, legacy graph checkpoints, MVP adapters, jobs, reorientation, CRRC, and launch projection are forbidden readiness writers. The ungrounded churn freshness and graph checkpoint revision fields were deleted; checkpoints retain identity/frontier content and churn retains understanding/diff/warning/unexplained-write evidence. `surfaces/jobs.rs` consumes the same derived graph judgment and therefore keeps remap Needed without canonical authority. Canonical RepoModel revision/hash plus its exact Mind-issued `RepoModelAdmissionReceipt` proves admitted map identity only. Future Ready also requires a nervous-system-owned continuity-bearing Body observation and retrieval coverage bound to the same source generation; Mind derives the joined projection. Snapshot metadata, watcher silence, and timestamps cannot substitute for the missing Body head.
|
||||
- Native `derive_freshness` is a legacy read-only pressure projection: canonical retrieval state, explicit legacy frontier pressure, and positive watcher changes are its inputs; retrieval/legacy-graph/watcher judgments are its outputs. Watcher silence, legacy graph checkpoints, MVP adapters, jobs, reorientation, CRRC, and launch projection are forbidden readiness writers. The ungrounded churn freshness and graph checkpoint revision fields were deleted; checkpoints retain identity/frontier content and churn retains understanding/diff/warning/unexplained-write evidence. `surfaces/jobs.rs` consumes the same derived graph judgment and therefore keeps remap Needed without canonical authority. Canonical RepoModel revision/hash plus its exact Mind-issued `RepoModelAdmissionReceipt` proves admitted map identity only. Whole-repository readiness requires a race-bounded Mind join: fresh Body root R1, exact Body-grounded model admission, semantic eligibility, retrieval coverage for R1, then fresh Body root R2 equal to R1. Watchers and Hands receipts trigger recomputation but do not prove continuity or readiness. Snapshot metadata, watcher silence, and timestamps cannot substitute.
|
||||
- `thread/epiphany/context` is the targeted read-only state-shard surface: `epiphany-core` selects graph nodes/edges, active frontier, checkpoint, observations, and evidence from authoritative typed state while app-server only adapts protocol, without mutating or notifying.
|
||||
- `thread/epiphany/graphQuery` is the read-only graph traversal surface over authoritative typed state: `epiphany-core` returns explicit nodes, path/symbol matches, bounded neighbors, and frontier neighborhoods with architecture/dataflow links while app-server only adapts protocol, without mutating, notifying, indexing, scheduling, proposing, or promoting.
|
||||
- The `pressure` view lens derives context pressure from current context usage, not cumulative token spend, against auto-compact/context limits without compacting, scheduling, mutating, or notifying; compaction prep starts at 80% of the active limit.
|
||||
|
|
|
|||
Reference in a new issue