From 652e152b1aed4cd4d4a37ca0faeeea0d3a335d66 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sat, 20 Jun 2026 18:02:52 +0100 Subject: [PATCH] Add repo Eve surface safe family --- .../epiphany-repo-eve-surface-family-smoke.rs | 390 ++++++++++++++++++ epiphany-core/src/bin/epiphany-work.rs | 211 +++++++++- notes/epiphany-repo-swarm-mvp-contract.md | 10 +- notes/fresh-workspace-handoff.md | 1 + state/ledgers.msgpack | Bin 340177 -> 341606 bytes state/map.yaml | 4 +- 6 files changed, 611 insertions(+), 5 deletions(-) create mode 100644 epiphany-core/src/bin/epiphany-repo-eve-surface-family-smoke.rs diff --git a/epiphany-core/src/bin/epiphany-repo-eve-surface-family-smoke.rs b/epiphany-core/src/bin/epiphany-repo-eve-surface-family-smoke.rs new file mode 100644 index 00000000..5b660402 --- /dev/null +++ b/epiphany-core/src/bin/epiphany-repo-eve-surface-family-smoke.rs @@ -0,0 +1,390 @@ +use anyhow::Context; +use anyhow::Result; +use anyhow::anyhow; +use chrono::Utc; +use serde_json::Value; +use serde_json::json; +use std::env; +use std::fs; +use std::path::Path; +use std::path::PathBuf; +use std::process::Command; + +fn main() -> Result<()> { + let args = Args::parse()?; + let result = run_smoke(args)?; + println!("{}", serde_json::to_string_pretty(&result)?); + Ok(()) +} + +#[derive(Clone, Debug)] +struct Args { + root: PathBuf, + smoke_root: PathBuf, +} + +impl Args { + fn parse() -> Result { + let mut root = env::current_dir().context("failed to resolve current directory")?; + let mut smoke_root = root.join(".epiphany-smoke"); + let mut args = env::args().skip(1).peekable(); + while let Some(arg) = args.next() { + match arg.as_str() { + "--root" => root = take_path(&mut args, "--root")?, + "--smoke-root" => smoke_root = take_path(&mut args, "--smoke-root")?, + other => return Err(anyhow!("unexpected argument {other:?}")), + } + } + Ok(Self { root, smoke_root }) + } +} + +fn run_smoke(args: Args) -> Result { + let root = args + .root + .canonicalize() + .with_context(|| format!("failed to resolve {}", args.root.display()))?; + let manifest = root.join("epiphany-core").join("Cargo.toml"); + if !manifest.exists() { + return Err(anyhow!( + "could not find epiphany-core manifest at {}", + manifest.display() + )); + } + fs::create_dir_all(&args.smoke_root) + .with_context(|| format!("failed to create {}", args.smoke_root.display()))?; + let stamp = Utc::now().format("%Y%m%d-%H%M%S").to_string(); + let smoke_dir = args + .smoke_root + .join(format!("repo-eve-surface-family-{stamp}")); + if smoke_dir.exists() { + fs::remove_dir_all(&smoke_dir) + .with_context(|| format!("failed to clear {}", smoke_dir.display()))?; + } + fs::create_dir_all(&smoke_dir) + .with_context(|| format!("failed to create {}", smoke_dir.display()))?; + + let repo = smoke_dir.join("repo-body"); + fs::create_dir_all(&repo).with_context(|| format!("failed to create {}", repo.display()))?; + git(["init"], &repo)?; + git( + ["config", "user.email", "epiphany-smoke@example.invalid"], + &repo, + )?; + git(["config", "user.name", "Epiphany Smoke"], &repo)?; + fs::write( + repo.join("README.md"), + "# Repo Eve Surface Family Smoke\n\nThis repository proves branch-local Eve surface contracts.\n", + ) + .with_context(|| format!("failed to seed {}", repo.join("README.md").display()))?; + git(["add", "README.md"], &repo)?; + git(["commit", "-m", "Seed repo Eve surface smoke body"], &repo)?; + git(["switch", "-c", "epiphany/repo-eve-surface-family"], &repo)?; + + let item = "repo-eve-surface-family"; + let target_path = ".epiphany/eve-surfaces/repo-eve-surface-family.toml"; + let local_verse = repo.join(".epiphany").join("local-verse.ccmp"); + cargo_json( + &manifest, + "epiphany-repo", + &[ + "init", + "--workspace", + path_str(&repo)?, + "--epiphany-root", + path_str(&root)?, + "--swarm-id", + "repo-eve-surface-family-smoke", + "--topic", + "repo-eve-surface-family", + ], + &root, + )?; + cargo_json( + &manifest, + "epiphany-swarm", + &[ + "online", + "--workspace", + path_str(&repo)?, + "--epiphany-root", + path_str(&root)?, + "--runtime-id", + "repo-eve-surface-family-smoke", + "--local-verse-store", + path_str(&local_verse)?, + ], + &root, + )?; + cargo_json( + &manifest, + "epiphany-work", + &[ + "accept", + "--workspace", + path_str(&repo)?, + "--from", + "persona", + "--item", + item, + "--summary", + "Expose a compact agent-friendly Eve surface contract for repo collaboration over CultMesh.", + "--candidate-action-ref", + "candidate-action://repo-eve-surface-family/eve-contract", + "--public-discussion-ref", + "epiphany-global/persona-collaboration/repo-eve-surface-family", + ], + &root, + )?; + let plan = cargo_json( + &manifest, + "epiphany-work", + &[ + "derive-plan", + "--workspace", + path_str(&repo)?, + "--item", + item, + "--action-family", + "repo-eve-surface", + "--model-ref", + "repo-eve-surface-family-smoke-imagination-v1", + "--model-authored", + ], + &root, + )?; + for _ in 0..4 { + cargo_json( + &manifest, + "epiphany-work", + &[ + "tick", + "--workspace", + path_str(&repo)?, + "--epiphany-root", + path_str(&root)?, + "--item", + item, + "--cooldown-seconds", + "0", + ], + &root, + )?; + } + + let close = read_json( + &repo + .join(".epiphany") + .join("work") + .join(format!("work-close-{item}.json")), + )?; + let surface_text = fs::read_to_string(repo.join(target_path)) + .with_context(|| format!("failed to read {}", repo.join(target_path).display()))?; + + require_eq( + &plan, + &["derivation", "safeActionFamily"], + "repo.eve_surface", + )?; + require_eq(&close, &["status"], "closed")?; + require_eq(&close, &["soul", "verdict"], "passed")?; + require_eq( + &close, + &["closureReview", "familyAssertions", "status"], + "passed", + )?; + require_bool( + &close, + &["closureReview", "sourceGrounding", "pathScopeMatched"], + true, + )?; + require_bool(&close, &["privateStateExposed"], false)?; + require_text( + &surface_text, + "schema_version = \"epiphany.repo_eve_surface.v0\"", + )?; + require_text(&surface_text, "safe_action_family = \"repo.eve_surface\"")?; + require_text(&surface_text, "[surface]")?; + require_text(&surface_text, "id = \"eve://epiphany/repo/")?; + require_text(&surface_text, "renderer_owns_truth = false")?; + require_text(&surface_text, "[verses]")?; + require_text(&surface_text, "local = \"gamecult-local\"")?; + require_text(&surface_text, "public = \"epiphany-global\"")?; + require_text(&surface_text, "private_projection_allowed = false")?; + require_text(&surface_text, "odin_discoverable = true")?; + require_text(&surface_text, "[cultui]")?; + require_text( + &surface_text, + "tui_contract = \"epiphany.eve.tui_surface.v0\"", + )?; + require_text( + &surface_text, + "gui_contract = \"epiphany.eve.gui_surface.v0\"", + )?; + require_text(&surface_text, "compact_agent_tui = true")?; + require_text(&surface_text, "[collaboration]")?; + require_text(&surface_text, "feedback_routes_to_imagination = true")?; + require_text(&surface_text, "candidate_actions_non_authoritative = true")?; + require_text(&surface_text, "[authority]")?; + require_text(&surface_text, "rendering_authority = false")?; + require_text(&surface_text, "state_authority = false")?; + require_text(&surface_text, "publication_authority = false")?; + require_text(&surface_text, "service_lifecycle_authority = false")?; + require_text(&surface_text, "cross_body_mutation_authority = false")?; + require_text(&surface_text, "private_verse_rummaging = false")?; + require_text(&surface_text, "requires_cultmesh_receipts = true")?; + require_text(&surface_text, "private_state_exposed = false")?; + + Ok(json!({ + "schemaVersion": "epiphany.repo_eve_surface_family_smoke.v0", + "status": "ok", + "smokeDir": smoke_dir, + "repo": repo, + "branch": git_output(["branch", "--show-current"], &repo)?, + "item": item, + "safeActionFamily": "repo.eve_surface", + "targetPath": target_path, + "closeStatus": "closed", + "soulVerdict": "passed", + "familyAssertionsStatus": "passed", + "pathScopeMatched": true, + "hasCultUiContracts": true, + "hasVerseRouting": true, + "odinDiscoverable": true, + "feedbackRoutesToImagination": true, + "rendererOwnsTruth": false, + "renderingAuthority": false, + "stateAuthority": false, + "publicationAuthority": false, + "serviceLifecycleAuthority": false, + "crossBodyMutationAuthority": false, + "privateVerseRummaging": false, + "privateStateExposed": false + })) +} + +fn cargo_json(manifest_path: &Path, bin_name: &str, args: &[&str], cwd: &Path) -> Result { + let output = Command::new("cargo") + .arg("run") + .arg("--quiet") + .arg("--manifest-path") + .arg(manifest_path) + .arg("--bin") + .arg(bin_name) + .arg("--") + .args(args) + .current_dir(cwd) + .output() + .with_context(|| format!("failed to spawn cargo run --bin {bin_name}"))?; + if !output.status.success() { + return Err(anyhow!( + "cargo run --bin {bin_name} failed:\n{}", + String::from_utf8_lossy(&output.stderr) + )); + } + serde_json::from_slice(&output.stdout) + .with_context(|| format!("{bin_name} returned invalid JSON")) +} + +fn git(args: [&str; N], cwd: &Path) -> Result<()> { + let output = Command::new("git") + .args(args) + .current_dir(cwd) + .output() + .with_context(|| format!("failed to spawn git in {}", cwd.display()))?; + if output.status.success() { + Ok(()) + } else { + Err(anyhow!( + "git failed in {}:\n{}", + cwd.display(), + String::from_utf8_lossy(&output.stderr) + )) + } +} + +fn git_output(args: [&str; N], cwd: &Path) -> Result { + let output = Command::new("git") + .args(args) + .current_dir(cwd) + .output() + .with_context(|| format!("failed to spawn git in {}", cwd.display()))?; + if !output.status.success() { + return Err(anyhow!( + "git failed in {}:\n{}", + cwd.display(), + String::from_utf8_lossy(&output.stderr) + )); + } + Ok(String::from_utf8_lossy(&output.stdout).trim().to_string()) +} + +fn read_json(path: &Path) -> Result { + let raw = + fs::read_to_string(path).with_context(|| format!("failed to read {}", path.display()))?; + serde_json::from_str(&raw).with_context(|| format!("failed to decode {}", path.display())) +} + +fn require_eq(value: &Value, path: &[&str], expected: &str) -> Result<()> { + let actual = value_at_path(value, path) + .and_then(Value::as_str) + .ok_or_else(|| anyhow!("missing string at {}", path.join(".")))?; + if actual == expected { + Ok(()) + } else { + Err(anyhow!( + "expected {} to be {:?}, got {:?}", + path.join("."), + expected, + actual + )) + } +} + +fn require_bool(value: &Value, path: &[&str], expected: bool) -> Result<()> { + let actual = value_at_path(value, path) + .and_then(Value::as_bool) + .ok_or_else(|| anyhow!("missing bool at {}", path.join(".")))?; + if actual == expected { + Ok(()) + } else { + Err(anyhow!( + "expected {} to be {}, got {}", + path.join("."), + expected, + actual + )) + } +} + +fn require_text(haystack: &str, needle: &str) -> Result<()> { + if haystack.contains(needle) { + Ok(()) + } else { + Err(anyhow!("expected text to contain {:?}", needle)) + } +} + +fn value_at_path<'a>(value: &'a Value, path: &[&str]) -> Option<&'a Value> { + let mut cursor = value; + for segment in path { + if let Ok(index) = segment.parse::() { + cursor = cursor.as_array()?.get(index)?; + } else { + cursor = cursor.get(*segment)?; + } + } + Some(cursor) +} + +fn path_str(path: &Path) -> Result<&str> { + path.to_str() + .ok_or_else(|| anyhow!("path is not valid UTF-8: {}", path.display())) +} + +fn take_path(args: &mut impl Iterator, name: &str) -> Result { + Ok(PathBuf::from( + args.next() + .ok_or_else(|| anyhow!("missing value for {name}"))?, + )) +} diff --git a/epiphany-core/src/bin/epiphany-work.rs b/epiphany-core/src/bin/epiphany-work.rs index e2394200..18765c41 100644 --- a/epiphany-core/src/bin/epiphany-work.rs +++ b/epiphany-core/src/bin/epiphany-work.rs @@ -1926,6 +1926,9 @@ fn derive_safe_plan_family(input: DeriveSafePlanInput<'_>) -> Result { derive_repo_tool_capabilities_plan(input, &action_family) } + "repo-eve-surface" | "eve-surface" | "cultui-surface" | "tui-surface" => { + derive_repo_eve_surface_plan(input, &action_family) + } "repo-collaboration-topic" | "collaboration-topic" | "eve-collaboration" => { derive_repo_collaboration_topic_plan(input, &action_family) } @@ -1971,7 +1974,7 @@ fn derive_safe_plan_family(input: DeriveSafePlanInput<'_>) -> Result Err(anyhow!( - "unsupported derive-plan action family {other:?}; supported families are append-worklog, planning-note, checklist-note, section-note, repo-status-section, task-card, repo-manifest, repo-tool-capabilities, repo-collaboration-topic, repo-consensus-brief, repo-objective-draft, repo-adoption-request, repo-scheduling-request, repo-work-order, repo-verification-request, repo-publication-request, repo-sync-request, repo-maintainer-review-request, repo-pr-request, repo-credit-request, repo-artifact-acceptance-request, and repo-metrics-request" + "unsupported derive-plan action family {other:?}; supported families are append-worklog, planning-note, checklist-note, section-note, repo-status-section, task-card, repo-manifest, repo-tool-capabilities, repo-eve-surface, repo-collaboration-topic, repo-consensus-brief, repo-objective-draft, repo-adoption-request, repo-scheduling-request, repo-work-order, repo-verification-request, repo-publication-request, repo-sync-request, repo-maintainer-review-request, repo-pr-request, repo-credit-request, repo-artifact-acceptance-request, and repo-metrics-request" )), } } @@ -2587,6 +2590,131 @@ fn derive_repo_tool_capabilities_plan( }) } +fn derive_repo_eve_surface_plan( + input: DeriveSafePlanInput<'_>, + action_family: &str, +) -> Result { + let item_slug = sanitize(input.item); + let default_target = format!(".epiphany/eve-surfaces/{item_slug}.toml"); + let target_path = validate_toml_target_path(input.target_path.unwrap_or(&default_target))?; + let candidate_refs = + string_array_from_json(input.accept_receipt, &["feedback", "candidateActionRefs"]); + let public_refs = + string_array_from_json(input.accept_receipt, &["feedback", "publicDiscussionRefs"]); + let now = Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true); + let surface_id = format!("eve://epiphany/repo/{item_slug}/surface"); + let local_verse_id = "gamecult-local"; + let public_verse_id = "epiphany-global"; + let owner = format!("repo:{item_slug}"); + let lines = vec![ + "# Epiphany repo Eve surface contract.".to_string(), + "# Branch-local CultUI projection cargo; not renderer ownership or private-state authority.".to_string(), + format!( + "schema_version = {}", + toml_basic_string("epiphany.repo_eve_surface.v0") + ), + format!("item = {}", toml_basic_string(input.item)), + format!("created_at = {}", toml_basic_string(&now)), + format!("source = {}", toml_basic_string(input.source)), + format!("summary = {}", toml_basic_string(&compact_line(input.summary))), + format!( + "safe_action_family = {}", + toml_basic_string("repo.eve_surface") + ), + format!("model_authored = {}", input.model_authored), + format!( + "model_ref = {}", + toml_basic_string(input.model_ref.unwrap_or("deterministic-fallback")) + ), + "operator_authored_shell_details = false".to_string(), + "hands_authority_granted = false".to_string(), + "durable_state_admitted = false".to_string(), + "publication_authorized = false".to_string(), + "merge_authorized = false".to_string(), + "service_lifecycle_authority = false".to_string(), + "cross_repo_mutation = false".to_string(), + "private_state_exposed = false".to_string(), + format!("candidate_action_refs = {}", toml_array(&candidate_refs)), + format!("public_discussion_refs = {}", toml_array(&public_refs)), + String::new(), + "[surface]".to_string(), + format!("id = {}", toml_basic_string(&surface_id)), + format!("owner_body = {}", toml_basic_string(&owner)), + "owner = \"repo Persona/Self\"".to_string(), + "renderer_owns_truth = false".to_string(), + "branch_local_only = true".to_string(), + String::new(), + "[verses]".to_string(), + format!("local = {}", toml_basic_string(local_verse_id)), + format!("public = {}", toml_basic_string(public_verse_id)), + "private_projection_allowed = false".to_string(), + "public_projection_allowed = true".to_string(), + "odin_discoverable = true".to_string(), + String::new(), + "[cultui]".to_string(), + "tui_contract = \"epiphany.eve.tui_surface.v0\"".to_string(), + "gui_contract = \"epiphany.eve.gui_surface.v0\"".to_string(), + "compact_agent_tui = true".to_string(), + "human_gui_lowering_allowed = true".to_string(), + "lowering_targets = [\"tui\", \"gui\", \"browser\", \"future-room\"]".to_string(), + String::new(), + "[rows]".to_string(), + "ids = [".to_string(), + " \"repo-work-queue\"," .to_string(), + " \"repo-work-next-action\"," .to_string(), + " \"repo-public-proof\"," .to_string(), + " \"persona-collaboration-topic\"".to_string(), + "]".to_string(), + String::new(), + "[collaboration]".to_string(), + "persona_discussion_allowed = true".to_string(), + "human_discussion_allowed = true".to_string(), + "feedback_routes_to_imagination = true".to_string(), + "candidate_actions_non_authoritative = true".to_string(), + "mind_adoption_required = true".to_string(), + String::new(), + "[authority]".to_string(), + "rendering_authority = false".to_string(), + "state_authority = false".to_string(), + "publication_authority = false".to_string(), + "service_lifecycle_authority = false".to_string(), + "cross_body_mutation_authority = false".to_string(), + "private_verse_rummaging = false".to_string(), + "requires_cultmesh_receipts = true".to_string(), + String::new(), + "[verification]".to_string(), + "asks = [".to_string(), + " \"Soul verifies the Eve surface contract path changed and contains the accepted pressure summary.\",".to_string(), + " \"Soul verifies the surface names CultUI TUI/GUI contracts, Verse routing, Odin discovery, and collaboration feedback routing without granting renderer or mutation authority.\",".to_string(), + " \"Soul verifies no paths outside the declared Eve surface contract changed.\"".to_string(), + "]".to_string(), + String::new(), + "[rollback]".to_string(), + "hints = [\"Remove the repo Eve surface contract if the accepted pressure was misderived.\"]".to_string(), + String::new(), + ]; + let command = powershell_set_lines_command(&target_path, &lines); + Ok(DerivedSafePlan { + safe_action_family: "repo.eve_surface".to_string(), + target_path, + plan_summary: format!( + "Imagination derived a repo Eve surface contract from accepted {} pressure.", + input.source + ), + command, + commit_message: format!("Add repo Eve surface contract for work item {}", input.item), + verification_asks: vec![ + "Soul verifies the repo Eve surface contract path changed and contains the accepted pressure summary.".to_string(), + "Soul verifies the contract exposes compact TUI/GUI lowering through CultMesh/Odin while preserving provider ownership and private-state seals.".to_string(), + "Soul verifies no paths outside the declared Eve surface contract changed.".to_string(), + ], + rollback_hints: vec![ + "Remove the generated repo Eve surface contract if the accepted pressure was misinterpreted.".to_string(), + ], + derivation: plan_derivation_receipt(input, action_family, "repo.eve_surface"), + }) +} + fn derive_repo_collaboration_topic_plan( input: DeriveSafePlanInput<'_>, action_family: &str, @@ -4731,6 +4859,85 @@ fn closure_family_assertions( "Committed tool capability manifest preserves the private-state seal.".to_string(), ); } + "repo.eve_surface" => { + push_assertion( + &mut assertions, + "eve-surface-schema-present", + content.contains("schema_version = \"epiphany.repo_eve_surface.v0\""), + "Committed Eve surface contract carries the schema version.".to_string(), + ); + push_assertion( + &mut assertions, + "eve-surface-family-present", + content.contains("safe_action_family = \"repo.eve_surface\""), + "Committed Eve surface contract carries the safe action family.".to_string(), + ); + push_assertion( + &mut assertions, + "eve-surface-summary-present", + content.contains(&compact_summary), + "Committed Eve surface contract contains the accepted pressure summary." + .to_string(), + ); + push_assertion( + &mut assertions, + "eve-surface-routing-present", + content.contains("[surface]") + && content.contains("id = \"eve://epiphany/repo/") + && content.contains("renderer_owns_truth = false"), + "Committed Eve surface contract names the provider-owned surface.".to_string(), + ); + push_assertion( + &mut assertions, + "eve-surface-verses-present", + content.contains("[verses]") + && content.contains("local = \"gamecult-local\"") + && content.contains("public = \"epiphany-global\"") + && content.contains("private_projection_allowed = false") + && content.contains("odin_discoverable = true"), + "Committed Eve surface contract names Verse routing and Odin discovery." + .to_string(), + ); + push_assertion( + &mut assertions, + "eve-surface-cultui-contracts", + content.contains("[cultui]") + && content.contains("tui_contract = \"epiphany.eve.tui_surface.v0\"") + && content.contains("gui_contract = \"epiphany.eve.gui_surface.v0\"") + && content.contains("compact_agent_tui = true"), + "Committed Eve surface contract names compact TUI and GUI lowering contracts." + .to_string(), + ); + push_assertion( + &mut assertions, + "eve-surface-collaboration-route", + content.contains("[collaboration]") + && content.contains("persona_discussion_allowed = true") + && content.contains("human_discussion_allowed = true") + && content.contains("feedback_routes_to_imagination = true") + && content.contains("candidate_actions_non_authoritative = true"), + "Committed Eve surface contract routes collaboration feedback to Imagination without authorizing actions.".to_string(), + ); + push_assertion( + &mut assertions, + "eve-surface-authority-seals", + content.contains("[authority]") + && content.contains("rendering_authority = false") + && content.contains("state_authority = false") + && content.contains("publication_authority = false") + && content.contains("service_lifecycle_authority = false") + && content.contains("cross_body_mutation_authority = false") + && content.contains("private_verse_rummaging = false") + && content.contains("requires_cultmesh_receipts = true"), + "Committed Eve surface contract denies renderer/state/publication/service/cross-body/private-rummaging authority.".to_string(), + ); + push_assertion( + &mut assertions, + "eve-surface-private-seal", + content.contains("private_state_exposed = false"), + "Committed Eve surface contract preserves the private-state seal.".to_string(), + ); + } "repo.collaboration_topic" => { push_assertion( &mut assertions, @@ -9992,7 +10199,7 @@ fn print_usage() { "usage: epiphany-work ...\n\ persona-intake --workspace --item --message [--topic ] [--store ] [--runtime-id ]\n\ accept --workspace --from --item [--summary ] [--topic ] [--store ] [--runtime-id ] [--online-receipt ] [--public-discussion-ref ] [--candidate-action-ref ]\n\ - derive-plan --workspace [--item ] [--accept-receipt ] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card|repo-manifest|repo-tool-capabilities|repo-collaboration-topic|repo-consensus-brief|repo-objective-draft|repo-adoption-request|repo-scheduling-request|repo-work-order|repo-verification-request|repo-publication-request|repo-sync-request|repo-maintainer-review-request|repo-pr-request|repo-credit-request|repo-artifact-acceptance-request|repo-metrics-request] [--target-path ] [--model-ref ] [--model-authored] [--action-summary ] [--verification-ask ] [--stop-condition ] [--escalation-reason ] [--assumption ] [--constraint ] [--non-goal ] [--open-question ] [--decision-point ] [--evidence-need ]\n\ + derive-plan --workspace [--item ] [--accept-receipt ] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card|repo-manifest|repo-tool-capabilities|repo-eve-surface|repo-collaboration-topic|repo-consensus-brief|repo-objective-draft|repo-adoption-request|repo-scheduling-request|repo-work-order|repo-verification-request|repo-publication-request|repo-sync-request|repo-maintainer-review-request|repo-pr-request|repo-credit-request|repo-artifact-acceptance-request|repo-metrics-request] [--target-path ] [--model-ref ] [--model-authored] [--action-summary ] [--verification-ask ] [--stop-condition ] [--escalation-reason ] [--assumption ] [--constraint ] [--non-goal ] [--open-question ] [--decision-point ] [--evidence-need ]\n\ plan --workspace [--item ] --objective --plan-summary --command --changed-path --commit-message [--adoption-evidence-ref ]\n\ run --workspace [--item ] [--accept-receipt ] [--runtime-store ] [--requested-path ]\n\ adopt --workspace [--item ] [--run-receipt ] [--from-plan ] [--plan-summary ] [--adoption-evidence-ref ]\n\ diff --git a/notes/epiphany-repo-swarm-mvp-contract.md b/notes/epiphany-repo-swarm-mvp-contract.md index 3f7e9b14..ea139e9f 100644 --- a/notes/epiphany-repo-swarm-mvp-contract.md +++ b/notes/epiphany-repo-swarm-mvp-contract.md @@ -1388,7 +1388,7 @@ temptation wearing clean robes. | Repo Body birth | `epiphany-repo init` exists and writes repo-local stores plus branch workbench intent. | Keep birth startup-only, review-gated, and branch-oriented. | | Local Verse online | `epiphany-swarm online` seeds repo-local CultMesh, standing-faculty SoA, topology, liveness, Eve, and tool sight. | Keep private Verse sealed while exposing operator-safe repo status. | | Persona/Bifrost intake | `epiphany-work accept` records pressure and candidate action refs without Hands authority. `epiphany-work persona-intake` now invokes the Persona bubble speech-audit path, records public discussion and candidate-action refs, then delegates to `accept`; wrapper mode `repo-persona-intake` exposes the operator mouth. | Deepen the intake-to-Imagination interpreter so richer model-authored action items can be proposed without granting Hands, publication, or durable-state authority at the mouth edge. | -| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, planning facets (assumptions, constraints, non-goals, open questions, decision points, and evidence needs), and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, and `repo-metrics-request` / `repo.metrics_request`. `plan` remains manual quarantine scaffolding. | Deepen adoption/interpreter behavior and further useful repo-owned configuration classes without turning model text into arbitrary shell authority. | +| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, planning facets (assumptions, constraints, non-goals, open questions, decision points, and evidence needs), and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, and `repo-metrics-request` / `repo.metrics_request`. `plan` remains manual quarantine scaffolding. | Deepen adoption/interpreter behavior and further useful repo-owned configuration classes without turning model text into arbitrary shell authority. | | Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan` and `repo-work-service-runbook` write Idunn lifecycle receipts/artifacts for the same queue-run command without launching it. | Keep any future queue-run service launch/install behind Idunn and explicit operator authority. | | Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. | | Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, and writes Soul, Modeling, and Mind receipts. | Deepen model-authored closure review beyond the first structured closure-review packet while preserving deterministic local closure for simple mechanical work. | @@ -1731,6 +1731,14 @@ Required organs before MVP: lifecycle, cross-body mutation, and private-state exposure remain false; the branch-local item still closes through Soul with family assertions and path scope passing. + `repo-eve-surface` now proves branch-local Eve/CultUI surface contract cargo + under `.epiphany/eve-surfaces/.toml`, with compact agent TUI and GUI + lowering contracts, local/public Verse routing, Odin discovery, Persona/human + collaboration, and feedback routing to Imagination. Smoke + `.epiphany-smoke\repo-eve-surface-family-20260620-165927` proved the contract + closes through Soul with family assertions and path scope passing while + renderer ownership, rendering/state/publication/service/cross-body authority, + private Verse rummaging, and private-state exposure remain false. Remaining work is later model-authored action classes that can change more useful repo-owned configuration, plus deeper interpreter/adoption semantics, without arbitrary shell authority. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index a327b8c1..e42154c6 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -136,6 +136,7 @@ remembers doctrine; the branch remembers the blade. - 2026-06-20: `repo-artifact-acceptance-request` is now live as accepted-artifact request cargo. `epiphany-work derive-plan --action-family repo-artifact-acceptance-request` writes `.epiphany/artifact-acceptance-requests/.toml` with safe family `repo.artifact_acceptance_request`, status `awaiting-artifact-acceptance-review`, closure/Soul/Mind/public-proof, maintainer-review, and Hands-commit antecedents, artifact/commit/path/review/proof/rationale/redaction packet requirements, and denials for artifact acceptance, credit ledger, GitHub PR, merge, publication, upstream sync, Hands action, cross-body mutation, and private Verse rummaging. Soul closure assertions inspect schema, family, summary, request state, antecedents, receipt contract, artifact packet, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-artifact-acceptance-request-family-20260620-161559` ran init -> online -> accept -> repo-artifact-acceptance-request derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/artifact-acceptance-requests/repo-artifact-acceptance-request-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `awaitingArtifactAcceptanceReview=true`, `artifactAcceptanceAuthorized=false`, `creditLedgerAuthorized=false`, `githubPrAuthorized=false`, `mergeAuthorized=false`, `publicationAuthorized=false`, `upstreamSyncAuthorized=false`, `handsActionAuthorized=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority. - 2026-06-20: `repo-metrics-request` is now live as Bifrost/maintainer accounting request cargo. `epiphany-work derive-plan --action-family repo-metrics-request` writes `.epiphany/metrics-requests/.toml` with safe family `repo.metrics_request`, status `awaiting-metrics-review`, closure/Soul/Mind/public-proof, accepted-artifact, and credit-request antecedents, model-call/token-cost/review-load/artifact/proof/credit-readback/redaction packet requirements, and denials for metrics ledger, spend, review-load, credit ledger, GitHub PR, merge, publication, upstream sync, Hands action, cross-body mutation, and private Verse rummaging. Soul closure assertions inspect schema, family, summary, request state, antecedents, receipt contract, metrics packet, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-metrics-request-family-20260620-162919` ran init -> online -> accept -> repo-metrics-request derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/metrics-requests/repo-metrics-request-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `awaitingMetricsReview=true`, `metricsLedgerAuthorized=false`, `spendAuthorized=false`, `reviewLoadAuthorized=false`, `creditLedgerAuthorized=false`, `githubPrAuthorized=false`, `mergeAuthorized=false`, `publicationAuthorized=false`, `upstreamSyncAuthorized=false`, `handsActionAuthorized=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority. - 2026-06-20: `derive-plan` action-item receipts now carry richer model-authored planning facets without widening command authority, and `adopt --from-plan` now preserves the chosen Imagination action item in the Mind adoption receipt. New CLI fields `--assumption`, `--constraint`, `--non-goal`, `--open-question`, `--decision-point`, and `--evidence-need` are recorded under `planningFacets` in `epiphany.repo_work_imagination_action_items_receipt.v0`, mirrored into the plan derivation's `actionItemReceipt`, then copied into `epiphany.repo_work_adoption_receipt.v0` as `adoptedActionItem`; deterministic defaults are emitted when a model does not supply them. Focused smoke `.epiphany-smoke\repo-planning-facets-20260620-164958` ran init -> online -> accept -> model-authored `derive-plan --action-family planning-note` with all facet fields -> tick run/adopt/execute/close; the action-item receipt preserved assumptions, constraints, non-goals, open questions, decision points, and evidence needs while `handsAuthorityGranted=false`, `durableStateAdmitted=false`, `handsCommandAuthority=false`, `durableStateAuthority=false`, and `privateStateExposed=false`; the adoption receipt preserved `adoptedActionItem.safeActionFamily=repo.markdown_planning_note`, planning facets, `adoptedActionItem.handsCommandAuthority=false`, `adoptedActionItem.durableStateAuthority=false`, `adoptedActionItem.publicationAuthorized=false`, `authority.handsAuthorityGranted=true`, `authority.durableStateAdmitted=false`, and `privateStateExposed=false`; Soul closure passed with family assertions and path scope matched. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority. +- 2026-06-20: `repo-eve-surface` is now live as repo-owned Eve/CultUI surface contract cargo. `epiphany-work derive-plan --action-family repo-eve-surface` writes `.epiphany/eve-surfaces/.toml` with safe family `repo.eve_surface`, compact agent TUI and GUI lowering contracts, local/public Verse routing, Odin discovery, provider-owned surface identity, Persona/human collaboration flags, feedback routing to Imagination, and denials for renderer ownership, rendering/state/publication/service/cross-body authority, private Verse rummaging, and private-state exposure. Soul closure assertions inspect schema, family, summary, surface routing, Verse routing, CultUI contracts, collaboration route, authority seals, and private-state seal. Focused smoke `.epiphany-smoke\repo-eve-surface-family-20260620-165927` ran init -> online -> accept -> repo-eve-surface derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/eve-surfaces/repo-eve-surface-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `hasCultUiContracts=true`, `hasVerseRouting=true`, `odinDiscoverable=true`, `feedbackRoutesToImagination=true`, `rendererOwnsTruth=false`, `renderingAuthority=false`, `stateAuthority=false`, `publicationAuthority=false`, `serviceLifecycleAuthority=false`, `crossBodyMutationAuthority=false`, `privateVerseRummaging=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority. - `service-execution-runbook` makes that next cut repeatable: it generates the exact elevated wrapper command sequence without mutating the service manager, continues after per-step failure to preserve more receipts, runs `service-execution-audit` in `finally`, exits nonzero if any step failed, and seals a typed runbook lifecycle receipt. Run the generated artifact only with explicit operator authority. - `service-execution-audit` is the non-mutating acceptance proof after the elevated rite: it reports `complete` only when typed lifecycle receipts prove the runbook witness plus expected elevated chain, and otherwise reports the missing/failed sealed checks. - `service-tick` is the non-elevated scheduler pulse proof: it writes the latest daemon scheduler receipt through durable policy ownership and local wrapper receipts. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index f21c9fde094392f4e69aa03c8894ce05f10ae74f..5f398e31a14d428decd0b89d4967b64942eb7e2e 100644 GIT binary patch delta 1042 zcmc(dv2PPG6vnyqTp^)~C6tsF$t@CH?sC^aQV~&!k|IQf29V?PB~~3f*uGSm zg2cdI5P4-~YsG+AU_tDKjRi5l#Ge2XzRN|5l!1}qWa;yJ?>_(Dcly2f^H=eB-kDpk zhhe>X?eV8GpxStI#d+p9^%uj!%VEK>UwY2i&wV>AfSYCW>a#oNuGQ*QbNbF%TKGD1 zb~B1d1SRPTpY({Y5*Z^*%=3$&eCbY)1dW90N82#hAr@Rqgw2x+pmc7s;ba9A2cpwO zSVPnzT*H0ahIj<;+B0v{%7aW`#DZ?pWE8^#A{BvBB%1P;2X`XMVMG-cJtF%a>`Kw2 z5s|();@0KZgq66a+7>*t{eq*Qopca~MJyOYO(Bt{g2R}hmh#N&KQr*a%dBu=U&`%3 zB4IjGsy6L;%N+V5jbJ>tU5!s`d1Xv2C{HBQd5GA@TWcq(|-UTJcGs_>{CA0V2 zy=>kug4vY`E`E$Ul=b~eSgD1zO6afEsTAn|F@5+LzY-MvRyu=EpK9&yE6Q zc30ifRw39UzO*D`JAh540>%O-$}Yn0MZ^%r+H#DA>>!=)FTibr56$rxcfovE1fc#8 z4mT?65HpbuO!HT^.toml` public collaboration topic, a structured `.epiphany/consensus-briefs/.toml` Imagination consensus brief, a structured `.epiphany/objective-drafts/.toml` review-required Objective Draft, a structured `.epiphany/adoption-requests/.toml` Mind adoption request, a structured `.epiphany/scheduling-requests/.toml` Self scheduling request, a structured `.epiphany/work-orders/.toml` Hands work-order request, a structured `.epiphany/verification-requests/.toml` Soul verification request, a structured `.epiphany/publication-requests/.toml` Bifrost publication request, a structured `.epiphany/sync-requests/.toml` upstream-main sync proof request, a structured `.epiphany/review-requests/.toml` maintainer review request, a structured `.epiphany/pr-requests/.toml` GitHub/Bifrost PR request, a structured `.epiphany/credit-requests/.toml` Bifrost credit request, a structured `.epiphany/artifact-acceptance-requests/.toml` accepted-artifact request, or a structured `.epiphany/metrics-requests/.toml` Bifrost/maintainer accounting request, typed Imagination action-item receipts (`epiphany.repo_work_imagination_action_items_receipt.v0`) that carry model provenance, safe family, requested paths, verification asks, stop conditions, escalation reasons, planning facets (assumptions, constraints, non-goals, open questions, decision points, and evidence needs), and `operatorAuthoredShellDetails=false` before deterministic safe-family command lowering, plan-backed branch-local commit creation, a speech-audited repo Persona intake mouth that records public discussion refs plus candidate action refs before delegating to `accept`, a bounded `epiphany-swarm run` mouth that delegates queue selection to `epiphany-work queue-run` and item actuation to `epiphany-work tick`, a Self-owned tick pulse that advances `run-from-plan -> adopt-from-plan -> execute-from-plan -> close-from-execute` then no-ops before publication gates, local CultMesh swarm-brake refusal that writes `refused-by-swarm-brake` without creating a run/adopt/execute/close receipt, active-turn refusal through `work-tick-active-.json`, explicit completion-anchored cooldown refusal through `work-tick-last-.json`, stale active-turn recovery that records `physiology.recoveredActiveTurn.recovered=true`, Self-owned `epiphany-work serve` cadence that writes `work-scheduler-serve-.json`, bounded serve proof `advanced:run-from-plan -> refused-by-cooldown:none` without adoption, unbounded zero-interval refusal, deterministic `epiphany-work close` proof that consumes execute receipts, verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0` with verification command/exit code, declared-vs-actual git changed paths, compact commit stat, optional model-review provenance, committed-content assertions for known safe families, optional/required model-authored closure verdicts, and authority seals, refuses path-scope mismatch, safe-family assertion failure, or non-passing supplied/required model verdict before Soul passes, then writes Soul verdict plus Modeling summary plus Mind gateway/state-commit receipts; closure-model smoke `.epiphany-smoke\closure-model-gate-20260620-135103` proved required `passed` verdict closes and `needs-work` blocks closure while family assertions and path scope pass; scheduler proof `.epiphany-smoke\tick-close-20260620-025526` that `epiphany-swarm run --max-iterations 4` reached `awaiting-publication` through `close-from-execute` with Soul passed and Mind committed, closure-review proof `.epiphany-smoke\closure-review-20260620-135009` with Soul passed, `pathScopeMatched=true`, model-review provenance, overview/export `close-review` artifact rows, redacted pathless public proof row, negative tampered-path refusal `pathScopeMatched=false`, and `privateStateExposed=false`, closure-assertion proof `.epiphany-smoke\closure-assertions-20260620-141401` where a good `repo.status_section` passed family assertions and a bad README override kept `pathScopeMatched=true` but failed missing marker/summary/private-seal assertions so Soul refused closure, local `epiphany-work overview` proof bundle `epiphany.repo_work_proof_bundle.v0` that reports pre-plan `awaiting-plan`/`plan-receipt-missing` and post-close `awaiting-publication`/`bifrost-publication-missing` with branch, commit, changed paths, Soul verdict, compact TUI rows, expected receipt artifact paths, present/missing artifact statuses, document schemas/statuses, SHA-256 receipt hashes, publication rows for Bifrost/GitHub/credit/PR/upstream-main sync, and private seals, public `epiphany-work export-proof` packaging that writes redacted `epiphany.repo_work_public_proof_bundle.v0` artifacts and mirrors `epiphany.cultmesh.repo_work_public_proof.v0` rows into local Verse for Gjallar/Odin sight without local receipt paths, raw receipt bodies, worker thought, or private Verse exposure, Bifrost public-proof publication receipts that bind redacted proof refs/SHA to global public Verse room, ledger, review, and credit readback, typed local Verse projection as `epiphany.cultmesh.repo_work_overview.v0` with latest-key/event-history readback through Gjallar plus peer-readable Persona Eve lowering, `epiphany-work queue-run` selection over tick-actionable queue rows through `awaiting-closure` with wrapper `repo-work-queue-run`, Idunn-owned non-mutating `repo-work-service-plan`/`repo-work-service-runbook` receipts for the same queue-run command, `publish --closure-receipt` consumption of the close receipt's Soul/Mind refs, post-publication tick `noop:none`, task-card proof `.epiphany-smoke\task-card-20260620-133704` with safe family `repo.task_card`, `modelAuthored=true`, branch-local committed TOML task card, authority seals, and `privateStateExposed=false`, repo-status-section proof `.epiphany-smoke\repo-status-section-20260620-140245` with safe family `repo.status_section`, `modelAuthored=true`, branch-local committed README status section, Soul `passed`, `pathScopeMatched=true`, both Epiphany status markers present, and `privateStateExposed=false`, repo-manifest proof `.epiphany-smoke\repo-manifest-family-20260620-141552` with safe family `repo.body_manifest`, committed `epiphany.toml`, body domain, private/local/public Verse ids, Eve surface, receipt-required capability hints, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-tool-capabilities proof `.epiphany-smoke\repo-tool-capabilities-family-20260620-142430` with safe family `repo.tool_capabilities`, committed `.epiphany/repo-tool-capabilities.toml`, local CultMesh/Odin discovery, daemon tool invocation intent/receipt contracts, expected repo-swarm capability ids, host-daemon execution ownership, Idunn lifecycle ownership, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-collaboration-topic proof `.epiphany-smoke\repo-collaboration-topic-family-20260620-143342` with safe family `repo.collaboration_topic`, committed `.epiphany/collaboration-topics/repo-collaboration-topic-family.toml`, public Persona collaboration room, Eve surface, Imagination consensus route, non-authoritative candidate actions, Mind/Bifrost gates, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-consensus-brief proof `.epiphany-smoke\repo-consensus-brief-family-20260620-144212` with safe family `repo.consensus_brief`, committed `.epiphany/consensus-briefs/repo-consensus-brief-family.toml`, draft consensus state, public discussion refs, candidate action refs, non-authoritative candidate actions, Mind/Bifrost gates, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-objective-draft proof `.epiphany-smoke\repo-objective-draft-family-20260620-145012` with safe family `repo.objective_draft`, committed `.epiphany/objective-drafts/repo-objective-draft-family.toml`, review-required draft state, `objective_adopted=false`, acceptance criteria, public/candidate refs, Mind/Self/Bifrost gates, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-adoption-request proof `.epiphany-smoke\repo-adoption-request-family-20260620-145823` with safe family `repo.adoption_request`, committed `.epiphany/adoption-requests/repo-adoption-request-family.toml`, awaiting Mind review, allowed adopt/refuse/more-consensus verdicts, Mind review/state-commit receipt requirements, `does_not_modify_state=true`, no state commit or Self scheduling authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-scheduling-request proof `.epiphany-smoke\repo-scheduling-request-family-20260620-150758` with safe family `repo.scheduling_request`, committed `.epiphany/scheduling-requests/repo-scheduling-request-family.toml`, awaiting Mind adoption, bounded one-item queue pulse contract, Mind review/state-commit receipt requirements, no Self scheduling or queue mutation authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-work-order proof `.epiphany-smoke\repo-work-order-family-20260620-151643` with safe family `repo.work_order`, committed `.epiphany/work-orders/repo-work-order-family.toml`, awaiting Hands review, Objective/adoption/scheduling antecedents, Substrate/Hands/Soul/Mind receipt requirements, bounded branch-local scope, no substrate access, shell command, commit, or Hands action authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-verification-request proof `.epiphany-smoke\repo-verification-request-family-20260620-152400` with safe family `repo.verification_request`, committed `.epiphany/verification-requests/repo-verification-request-family.toml`, awaiting Soul review, Hands evidence antecedents, closure checks, Soul/Mind required receipts, no Soul verdict, state commit, rerun, or Hands action authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-publication-request proof `.epiphany-smoke\repo-publication-request-family-20260620-153215` with safe family `repo.publication_request`, committed `.epiphany/publication-requests/repo-publication-request-family.toml`, awaiting Bifrost review, closure/Soul/Mind/redacted-proof antecedents, Bifrost/GitHub/credit/upstream receipt requirements, public export redaction seals, no Bifrost publication, GitHub publication, credit ledger, upstream sync, or Hands action authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-sync-request proof `.epiphany-smoke\repo-sync-request-family-20260620-154029` with safe family `repo.sync_request`, committed `.epiphany/sync-requests/repo-sync-request-family.toml`, awaiting upstream-main proof, Bifrost/GitHub/maintainer/credit antecedents, origin/main ancestry proof requirements, no merge, push, upstream sync, GitHub publication, credit ledger, or Hands action authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-maintainer-review-request proof `.epiphany-smoke\repo-maintainer-review-request-family-20260620-155126` with safe family `repo.maintainer_review_request`, committed `.epiphany/review-requests/repo-maintainer-review-request-family.toml`, awaiting maintainer review, closure/Soul/Mind/public-proof/Bifrost antecedents, reviewer identity/verdict/changed-path/proof-ref/redaction packet requirements, no maintainer approval, merge, push, publication, upstream sync, Hands action, or cross-body authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-pr-request proof `.epiphany-smoke\repo-pr-request-family-20260620-160046` with safe family `repo.pr_request`, committed `.epiphany/pr-requests/repo-pr-request-family.toml`, awaiting PR publication review, closure/Soul/Mind/public-proof, maintainer-review, Bifrost-publication, and credit antecedents, branch/title/body/path/proof/review/credit/redaction packet requirements, no GitHub PR, branch push, merge, publication, upstream sync, Hands action, or cross-body authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-credit-request proof `.epiphany-smoke\repo-credit-request-family-20260620-160803` with safe family `repo.credit_request`, committed `.epiphany/credit-requests/repo-credit-request-family.toml`, awaiting Bifrost credit review, closure/Soul/Mind/public-proof, maintainer-review, accepted-artifact, and authorship antecedents, author/reviewer/artifact/proof/path/ledger/redaction packet requirements, no credit ledger, Bifrost publication, GitHub PR, merge, publication, upstream sync, Hands action, or cross-body authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-artifact-acceptance-request proof `.epiphany-smoke\repo-artifact-acceptance-request-family-20260620-161559` with safe family `repo.artifact_acceptance_request`, committed `.epiphany/artifact-acceptance-requests/repo-artifact-acceptance-request-family.toml`, awaiting artifact acceptance review, closure/Soul/Mind/public-proof, maintainer-review, and Hands-commit antecedents, artifact/commit/path/review/proof/rationale/redaction packet requirements, no artifact acceptance, credit ledger, GitHub PR, merge, publication, upstream sync, Hands action, or cross-body authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-metrics-request proof `.epiphany-smoke\repo-metrics-request-family-20260620-162919` with safe family `repo.metrics_request`, committed `.epiphany/metrics-requests/repo-metrics-request-family.toml`, awaiting metrics review, closure/Soul/Mind/public-proof, accepted-artifact, and credit-request antecedents, model-call/token-cost/review-load/artifact/proof/credit-readback/redaction packet requirements, no metrics ledger, spend, review-load, credit ledger, GitHub PR, merge, publication, upstream sync, Hands action, or cross-body authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-planning-facets proof `.epiphany-smoke\repo-planning-facets-20260620-164958` that model-authored action-item receipts preserve assumptions, constraints, non-goals, open questions, decision points, and evidence needs into Imagination, plan derivation, and Mind adoption receipts while `adoptedActionItem.safeActionFamily=repo.markdown_planning_note`, `handsAuthorityGranted=false` before adoption, `authority.handsAuthorityGranted=true` only at adoption, `durableStateAdmitted=false`, `handsCommandAuthority=false`, `durableStateAuthority=false`, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, native fresh-repo MVP smoke `.epiphany-smoke\fresh-repo-mvp-20260620-133452` that created a disposable origin/repo Body and ran init -> online -> Persona intake -> repo-status plan -> overview queue projection -> `epiphany-swarm run` -> Soul close -> Bifrost publication receipts -> disposable maintainer merge to `origin/main` -> sync -> overview -> public-proof export with Hands commit `76f8d5ebb023951a513864bdf8555a524d89c5dc`, Soul `passed`, `familyAssertions.status=passed`, `publishStatus=publication-receipts-recorded`, `syncStatus=upstream-main-synced`, `upstreamMainSynced=true`, `publicProofStatus=public-proof-exported`, and `privateStateExposed=false`, and upstream-main ancestry proof after explicit merge receipt. Remaining MVP organs are deeper interpreter/adoption semantics, additional useful repo-owned config/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority; the scheduler may advance only one safe receipt-backed branch-local step per pulse and must not publish, merge, mutate services, cross repo boundaries, expose private state, or impersonate Idunn. + - Use `notes/epiphany-repo-swarm-mvp-contract.md` as the authority correction and migration plan for repo-swarm autonomy. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruptibility, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Seventeen native repo-swarm front doors are live and documented there: `epiphany-repo init`, `epiphany-swarm online`, `epiphany-swarm run`, `epiphany-work accept`, `epiphany-work persona-intake`, `epiphany-work derive-plan`, `epiphany-work plan`, `epiphany-work run`, `epiphany-work adopt --from-plan`, `epiphany-work execute --from-plan`, `epiphany-work close`, `epiphany-work overview`, `epiphany-work export-proof`, `epiphany-work tick`, `epiphany-work queue-run`, `epiphany-work publish`, and `epiphany-work sync`. Fresh-repo smokes proved the chain with `privateStateExposed=false`, including deterministic Persona/Bifrost pressure-to-plan derivation (`append-worklog`, `planning-note`, `checklist-note`, `section-note`, and `task-card`) into `EPIPHANY_WORKLOG.md`, contained markdown planning notes, contained markdown checklists, a marker-bounded managed markdown section, a structured TOML task card, a marker-bounded README status section, a structured `epiphany.toml` Body manifest, a structured `.epiphany/repo-tool-capabilities.toml` tool capability manifest, a structured `.epiphany/eve-surfaces/.toml` Eve/CultUI surface contract, a structured `.epiphany/collaboration-topics/.toml` public collaboration topic, a structured `.epiphany/consensus-briefs/.toml` Imagination consensus brief, a structured `.epiphany/objective-drafts/.toml` review-required Objective Draft, a structured `.epiphany/adoption-requests/.toml` Mind adoption request, a structured `.epiphany/scheduling-requests/.toml` Self scheduling request, a structured `.epiphany/work-orders/.toml` Hands work-order request, a structured `.epiphany/verification-requests/.toml` Soul verification request, a structured `.epiphany/publication-requests/.toml` Bifrost publication request, a structured `.epiphany/sync-requests/.toml` upstream-main sync proof request, a structured `.epiphany/review-requests/.toml` maintainer review request, a structured `.epiphany/pr-requests/.toml` GitHub/Bifrost PR request, a structured `.epiphany/credit-requests/.toml` Bifrost credit request, a structured `.epiphany/artifact-acceptance-requests/.toml` accepted-artifact request, or a structured `.epiphany/metrics-requests/.toml` Bifrost/maintainer accounting request, typed Imagination action-item receipts (`epiphany.repo_work_imagination_action_items_receipt.v0`) that carry model provenance, safe family, requested paths, verification asks, stop conditions, escalation reasons, planning facets (assumptions, constraints, non-goals, open questions, decision points, and evidence needs), and `operatorAuthoredShellDetails=false` before deterministic safe-family command lowering, plan-backed branch-local commit creation, a speech-audited repo Persona intake mouth that records public discussion refs plus candidate action refs before delegating to `accept`, a bounded `epiphany-swarm run` mouth that delegates queue selection to `epiphany-work queue-run` and item actuation to `epiphany-work tick`, a Self-owned tick pulse that advances `run-from-plan -> adopt-from-plan -> execute-from-plan -> close-from-execute` then no-ops before publication gates, local CultMesh swarm-brake refusal that writes `refused-by-swarm-brake` without creating a run/adopt/execute/close receipt, active-turn refusal through `work-tick-active-.json`, explicit completion-anchored cooldown refusal through `work-tick-last-.json`, stale active-turn recovery that records `physiology.recoveredActiveTurn.recovered=true`, Self-owned `epiphany-work serve` cadence that writes `work-scheduler-serve-.json`, bounded serve proof `advanced:run-from-plan -> refused-by-cooldown:none` without adoption, unbounded zero-interval refusal, deterministic `epiphany-work close` proof that consumes execute receipts, verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0` with verification command/exit code, declared-vs-actual git changed paths, compact commit stat, optional model-review provenance, committed-content assertions for known safe families, optional/required model-authored closure verdicts, and authority seals, refuses path-scope mismatch, safe-family assertion failure, or non-passing supplied/required model verdict before Soul passes, then writes Soul verdict plus Modeling summary plus Mind gateway/state-commit receipts; closure-model smoke `.epiphany-smoke\closure-model-gate-20260620-135103` proved required `passed` verdict closes and `needs-work` blocks closure while family assertions and path scope pass; scheduler proof `.epiphany-smoke\tick-close-20260620-025526` that `epiphany-swarm run --max-iterations 4` reached `awaiting-publication` through `close-from-execute` with Soul passed and Mind committed, closure-review proof `.epiphany-smoke\closure-review-20260620-135009` with Soul passed, `pathScopeMatched=true`, model-review provenance, overview/export `close-review` artifact rows, redacted pathless public proof row, negative tampered-path refusal `pathScopeMatched=false`, and `privateStateExposed=false`, closure-assertion proof `.epiphany-smoke\closure-assertions-20260620-141401` where a good `repo.status_section` passed family assertions and a bad README override kept `pathScopeMatched=true` but failed missing marker/summary/private-seal assertions so Soul refused closure, local `epiphany-work overview` proof bundle `epiphany.repo_work_proof_bundle.v0` that reports pre-plan `awaiting-plan`/`plan-receipt-missing` and post-close `awaiting-publication`/`bifrost-publication-missing` with branch, commit, changed paths, Soul verdict, compact TUI rows, expected receipt artifact paths, present/missing artifact statuses, document schemas/statuses, SHA-256 receipt hashes, publication rows for Bifrost/GitHub/credit/PR/upstream-main sync, and private seals, public `epiphany-work export-proof` packaging that writes redacted `epiphany.repo_work_public_proof_bundle.v0` artifacts and mirrors `epiphany.cultmesh.repo_work_public_proof.v0` rows into local Verse for Gjallar/Odin sight without local receipt paths, raw receipt bodies, worker thought, or private Verse exposure, Bifrost public-proof publication receipts that bind redacted proof refs/SHA to global public Verse room, ledger, review, and credit readback, typed local Verse projection as `epiphany.cultmesh.repo_work_overview.v0` with latest-key/event-history readback through Gjallar plus peer-readable Persona Eve lowering, `epiphany-work queue-run` selection over tick-actionable queue rows through `awaiting-closure` with wrapper `repo-work-queue-run`, Idunn-owned non-mutating `repo-work-service-plan`/`repo-work-service-runbook` receipts for the same queue-run command, `publish --closure-receipt` consumption of the close receipt's Soul/Mind refs, post-publication tick `noop:none`, task-card proof `.epiphany-smoke\task-card-20260620-133704` with safe family `repo.task_card`, `modelAuthored=true`, branch-local committed TOML task card, authority seals, and `privateStateExposed=false`, repo-status-section proof `.epiphany-smoke\repo-status-section-20260620-140245` with safe family `repo.status_section`, `modelAuthored=true`, branch-local committed README status section, Soul `passed`, `pathScopeMatched=true`, both Epiphany status markers present, and `privateStateExposed=false`, repo-manifest proof `.epiphany-smoke\repo-manifest-family-20260620-141552` with safe family `repo.body_manifest`, committed `epiphany.toml`, body domain, private/local/public Verse ids, Eve surface, receipt-required capability hints, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-tool-capabilities proof `.epiphany-smoke\repo-tool-capabilities-family-20260620-142430` with safe family `repo.tool_capabilities`, committed `.epiphany/repo-tool-capabilities.toml`, local CultMesh/Odin discovery, daemon tool invocation intent/receipt contracts, expected repo-swarm capability ids, host-daemon execution ownership, Idunn lifecycle ownership, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-eve-surface proof `.epiphany-smoke\repo-eve-surface-family-20260620-165927` with safe family `repo.eve_surface`, committed `.epiphany/eve-surfaces/repo-eve-surface-family.toml`, compact agent TUI/GUI contracts, local/public Verse routing, Odin discovery, provider-owned surface identity, feedback routing to Imagination, no renderer/state/publication/service/cross-body/private-rummaging authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-collaboration-topic proof `.epiphany-smoke\repo-collaboration-topic-family-20260620-143342` with safe family `repo.collaboration_topic`, committed `.epiphany/collaboration-topics/repo-collaboration-topic-family.toml`, public Persona collaboration room, Eve surface, Imagination consensus route, non-authoritative candidate actions, Mind/Bifrost gates, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-consensus-brief proof `.epiphany-smoke\repo-consensus-brief-family-20260620-144212` with safe family `repo.consensus_brief`, committed `.epiphany/consensus-briefs/repo-consensus-brief-family.toml`, draft consensus state, public discussion refs, candidate action refs, non-authoritative candidate actions, Mind/Bifrost gates, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-objective-draft proof `.epiphany-smoke\repo-objective-draft-family-20260620-145012` with safe family `repo.objective_draft`, committed `.epiphany/objective-drafts/repo-objective-draft-family.toml`, review-required draft state, `objective_adopted=false`, acceptance criteria, public/candidate refs, Mind/Self/Bifrost gates, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-adoption-request proof `.epiphany-smoke\repo-adoption-request-family-20260620-145823` with safe family `repo.adoption_request`, committed `.epiphany/adoption-requests/repo-adoption-request-family.toml`, awaiting Mind review, allowed adopt/refuse/more-consensus verdicts, Mind review/state-commit receipt requirements, `does_not_modify_state=true`, no state commit or Self scheduling authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-scheduling-request proof `.epiphany-smoke\repo-scheduling-request-family-20260620-150758` with safe family `repo.scheduling_request`, committed `.epiphany/scheduling-requests/repo-scheduling-request-family.toml`, awaiting Mind adoption, bounded one-item queue pulse contract, Mind review/state-commit receipt requirements, no Self scheduling or queue mutation authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-work-order proof `.epiphany-smoke\repo-work-order-family-20260620-151643` with safe family `repo.work_order`, committed `.epiphany/work-orders/repo-work-order-family.toml`, awaiting Hands review, Objective/adoption/scheduling antecedents, Substrate/Hands/Soul/Mind receipt requirements, bounded branch-local scope, no substrate access, shell command, commit, or Hands action authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-verification-request proof `.epiphany-smoke\repo-verification-request-family-20260620-152400` with safe family `repo.verification_request`, committed `.epiphany/verification-requests/repo-verification-request-family.toml`, awaiting Soul review, Hands evidence antecedents, closure checks, Soul/Mind required receipts, no Soul verdict, state commit, rerun, or Hands action authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-publication-request proof `.epiphany-smoke\repo-publication-request-family-20260620-153215` with safe family `repo.publication_request`, committed `.epiphany/publication-requests/repo-publication-request-family.toml`, awaiting Bifrost review, closure/Soul/Mind/redacted-proof antecedents, Bifrost/GitHub/credit/upstream receipt requirements, public export redaction seals, no Bifrost publication, GitHub publication, credit ledger, upstream sync, or Hands action authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-sync-request proof `.epiphany-smoke\repo-sync-request-family-20260620-154029` with safe family `repo.sync_request`, committed `.epiphany/sync-requests/repo-sync-request-family.toml`, awaiting upstream-main proof, Bifrost/GitHub/maintainer/credit antecedents, origin/main ancestry proof requirements, no merge, push, upstream sync, GitHub publication, credit ledger, or Hands action authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-maintainer-review-request proof `.epiphany-smoke\repo-maintainer-review-request-family-20260620-155126` with safe family `repo.maintainer_review_request`, committed `.epiphany/review-requests/repo-maintainer-review-request-family.toml`, awaiting maintainer review, closure/Soul/Mind/public-proof/Bifrost antecedents, reviewer identity/verdict/changed-path/proof-ref/redaction packet requirements, no maintainer approval, merge, push, publication, upstream sync, Hands action, or cross-body authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-pr-request proof `.epiphany-smoke\repo-pr-request-family-20260620-160046` with safe family `repo.pr_request`, committed `.epiphany/pr-requests/repo-pr-request-family.toml`, awaiting PR publication review, closure/Soul/Mind/public-proof, maintainer-review, Bifrost-publication, and credit antecedents, branch/title/body/path/proof/review/credit/redaction packet requirements, no GitHub PR, branch push, merge, publication, upstream sync, Hands action, or cross-body authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-credit-request proof `.epiphany-smoke\repo-credit-request-family-20260620-160803` with safe family `repo.credit_request`, committed `.epiphany/credit-requests/repo-credit-request-family.toml`, awaiting Bifrost credit review, closure/Soul/Mind/public-proof, maintainer-review, accepted-artifact, and authorship antecedents, author/reviewer/artifact/proof/path/ledger/redaction packet requirements, no credit ledger, Bifrost publication, GitHub PR, merge, publication, upstream sync, Hands action, or cross-body authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-artifact-acceptance-request proof `.epiphany-smoke\repo-artifact-acceptance-request-family-20260620-161559` with safe family `repo.artifact_acceptance_request`, committed `.epiphany/artifact-acceptance-requests/repo-artifact-acceptance-request-family.toml`, awaiting artifact acceptance review, closure/Soul/Mind/public-proof, maintainer-review, and Hands-commit antecedents, artifact/commit/path/review/proof/rationale/redaction packet requirements, no artifact acceptance, credit ledger, GitHub PR, merge, publication, upstream sync, Hands action, or cross-body authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-metrics-request proof `.epiphany-smoke\repo-metrics-request-family-20260620-162919` with safe family `repo.metrics_request`, committed `.epiphany/metrics-requests/repo-metrics-request-family.toml`, awaiting metrics review, closure/Soul/Mind/public-proof, accepted-artifact, and credit-request antecedents, model-call/token-cost/review-load/artifact/proof/credit-readback/redaction packet requirements, no metrics ledger, spend, review-load, credit ledger, GitHub PR, merge, publication, upstream sync, Hands action, or cross-body authority, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, repo-planning-facets proof `.epiphany-smoke\repo-planning-facets-20260620-164958` that model-authored action-item receipts preserve assumptions, constraints, non-goals, open questions, decision points, and evidence needs into Imagination, plan derivation, and Mind adoption receipts while `adoptedActionItem.safeActionFamily=repo.markdown_planning_note`, `handsAuthorityGranted=false` before adoption, `authority.handsAuthorityGranted=true` only at adoption, `durableStateAdmitted=false`, `handsCommandAuthority=false`, `durableStateAuthority=false`, Soul `passed`, `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`, native fresh-repo MVP smoke `.epiphany-smoke\fresh-repo-mvp-20260620-133452` that created a disposable origin/repo Body and ran init -> online -> Persona intake -> repo-status plan -> overview queue projection -> `epiphany-swarm run` -> Soul close -> Bifrost publication receipts -> disposable maintainer merge to `origin/main` -> sync -> overview -> public-proof export with Hands commit `76f8d5ebb023951a513864bdf8555a524d89c5dc`, Soul `passed`, `familyAssertions.status=passed`, `publishStatus=publication-receipts-recorded`, `syncStatus=upstream-main-synced`, `upstreamMainSynced=true`, `publicProofStatus=public-proof-exported`, and `privateStateExposed=false`, and upstream-main ancestry proof after explicit merge receipt. Remaining MVP organs are deeper interpreter/adoption semantics, additional useful repo-owned config/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority; the scheduler may advance only one safe receipt-backed branch-local step per pulse and must not publish, merge, mutate services, cross repo boundaries, expose private state, or impersonate Idunn. - Gjallar/swarm-overview now projects typed repo-work overview history into the compact global sight report, Persona's public Eve surface lowers the same queue for peers, and Self has a first runnable queue surface over it. `epiphany-verse-query gjallar` reads all `epiphany.cultmesh.repo_work_overview.v0` event documents from local Verse, excludes the `latest` mirror, preserves latest scalar fields, emits multi-item `repoWorkOverviewRows`/TUI rows, and publishes bounded priority 35-39 non-mutating `repo-work-overview` action rows with `owner=Gjallar`, `hostedBody=repo-work`, `authorityGate=repo.work.overview`, `mutatesState=false`, `requiresElevatedAuthority=false`, proof-bundle refs, current gate/blocker/next-safe-move, and `privateStateExposed=false`. `epiphany-verse-query eve-surfaces`, `connect-eve`, and globally invokable Persona `eve-connect` tool readbacks expose compact `REPO-WORK-PEER` rows with item, gate, blocker, next safe move, branch, publication/sync state, and private seal for the public Persona surface only. `epiphany-work queue-run` selects current-repo rows at `ready-to-run`, `ready-to-adopt`, or `ready-to-execute`, delegates action to `tick`, refreshes overview after real advancement, and writes `epiphany.repo_work_queue_run_receipt.v0`; wrapper mode `tools/epiphany_local_run.ps1 -Mode repo-work-queue-run` exposes the same surface. Disposable proofs `.epiphany-smoke\gjallar-repo-work-queue-20260620-012027`, `.epiphany-smoke\eve-repo-work-queue-20260620-013322`, `.epiphany-smoke\queue-run-20260620-014314`, and wrapper artifact `local-20260620-014627-174-aada0241` showed two-item queues through sight, public Eve, direct queue-run, and wrapper dry-run without publication, merge, service lifecycle mutation, elevation, cross-repo mutation, or private-state exposure. - Agent memory lifecycle now has a first typed v0 operation surface in `epiphany-core::agent_memory`: `AgentMemoryLifecycleOperation` can revise, retire, crystallize, prune, and merge bounded memory records after role/agent review, and `epiphany-agent-memory-store review-lifecycle|apply-lifecycle` exposes the path at the operator edge. This closes the first explicit lifecycle-operation slice from the swarm-readiness gate; it does not yet make sleep silently mutate identity or project truth. - Persona public speech now has a parent-side eligibility receipt at the Discord/Aquarium mouth edge. `epiphany.persona_speech_audit.v0` records action kind, content fingerprint, opening/topic keys, recent-window counts, repeated opening/topic counts, channel saturation, and allow/block reasons. `epiphany-persona-discord post` blocks repeated public openings before token/webhook work; draft and bubble still emit audit receipts for operator inspection. The compatibility JSON artifact remains for display, but the durable witness is now `epiphany.cultmesh.persona_speech_audit.v0` in CultMesh with latest-key projection through local Verse context. Local MVP Persona bubbles now write that durable witness to `.epiphany-run/cultmesh/local-verse.ccmp`, not a separate mouth-side store. This is posting-edge policy, not a Persona prompt wish. @@ -634,4 +634,4 @@ current_status: - `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness. - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. - next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `task-card` / `repo.task_card`, `repo-status-section` / `repo.status_section`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, and `repo-metrics-request` / `repo.metrics_request`, typed Imagination action-item receipts over allowlisted safe families, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; the contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper interpreter/adoption semantics, more useful repo-owned config/action families, or Idunn-owned queue-run service lifecycle under explicit operator authority. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start execution still requires explicit elevated operator authority. + next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `task-card` / `repo.task_card`, `repo-status-section` / `repo.status_section`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, and `repo-metrics-request` / `repo.metrics_request`, typed Imagination action-item receipts over allowlisted safe families, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; the contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper interpreter/adoption semantics, more useful repo-owned config/action families, or Idunn-owned queue-run service lifecycle under explicit operator authority. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start execution still requires explicit elevated operator authority.