From 6a031c209e5b0ca58a6920e803c35eee07b3cf0b Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sat, 20 Jun 2026 22:35:33 +0100 Subject: [PATCH] Add repo deployment config audit --- ...any-repo-deployment-config-family-smoke.rs | 26 +++ epiphany-core/src/bin/epiphany-work.rs | 205 +++++++++++++++++- notes/epiphany-repo-swarm-mvp-contract.md | 11 + notes/fresh-workspace-handoff.md | 1 + state/ledgers.msgpack | Bin 354120 -> 354555 bytes state/map.yaml | 6 +- 6 files changed, 245 insertions(+), 4 deletions(-) diff --git a/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs b/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs index 3635eb07..c1844178 100644 --- a/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs +++ b/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs @@ -205,6 +205,12 @@ fn run_smoke(args: Args) -> Result { repo.join("deploy").join("idunn-deploy.ps1").display() ) })?; + let audit = cargo_json( + &manifest, + "epiphany-work", + &["deployment-config-audit", "--workspace", path_str(&repo)?], + &root, + )?; require_eq( &plan, @@ -276,6 +282,23 @@ fn run_smoke(args: Args) -> Result { require_text(&config_text, "private_verse_rummaging = false")?; require_text(&config_text, "private_state_exposed = false")?; require_text(&deploy_script_text, "deployment script placeholder")?; + require_eq( + &audit, + &["schemaVersion"], + "epiphany.repo_deployment_config_audit.v0", + )?; + require_eq(&audit, &["status"], "ready-for-idunn-review")?; + require_bool(&audit, &["readyForIdunnReview"], true)?; + require_bool(&audit, &["executionAuthorized"], false)?; + require_bool(&audit, &["deploymentAuthority"], false)?; + require_bool(&audit, &["sshAuthority"], false)?; + require_bool(&audit, &["gitPushAuthority"], false)?; + require_bool(&audit, &["serviceLifecycleAuthority"], false)?; + require_bool(&audit, &["handsAuthority"], false)?; + require_bool(&audit, &["publicationAuthorized"], false)?; + require_bool(&audit, &["mergeAuthorized"], false)?; + require_bool(&audit, &["daemonOwnsExecution"], true)?; + require_bool(&audit, &["privateStateExposed"], false)?; let summary = json!({ "schemaVersion": "epiphany.repo_deployment_config_family_smoke.v0", @@ -291,6 +314,9 @@ fn run_smoke(args: Args) -> Result { "familyAssertionsStatus": close["closureReview"]["familyAssertions"]["status"], "pathScopeMatched": close["closureReview"]["sourceGrounding"]["pathScopeMatched"], "deploymentConfigEnabled": false, + "deploymentConfigAuditStatus": audit["status"], + "deploymentConfigAuditReceiptPath": audit["receiptPath"], + "readyForIdunnReview": audit["readyForIdunnReview"], "deploymentTrigger": "git-push-observed-by-idunn", "deploymentOwner": "Idunn", "daemonOwnsExecution": true, diff --git a/epiphany-core/src/bin/epiphany-work.rs b/epiphany-core/src/bin/epiphany-work.rs index 1297bce8..896ffe34 100644 --- a/epiphany-core/src/bin/epiphany-work.rs +++ b/epiphany-core/src/bin/epiphany-work.rs @@ -120,6 +120,9 @@ fn main() -> Result<()> { "publish" => run_publish(parse_publish_args(args)?), "sync" | "sync-main" => run_sync(parse_sync_args(args)?), "overview" | "proof-bundle" | "status" => run_overview(parse_overview_args(args)?), + "deployment-config-audit" | "audit-deployment-config" | "idunn-deployment-audit" => { + run_deployment_config_audit(parse_deployment_config_audit_args(args)?) + } "export-proof" | "public-proof" => run_export_proof(parse_export_proof_args(args)?), "tick" | "pulse" | "schedule" => run_tick(parse_tick_args(args)?), "queue-run" | "run-queue" | "queue-tick" | "scheduler-run" => { @@ -320,6 +323,13 @@ struct OverviewArgs { write_receipt: bool, } +#[derive(Clone, Debug)] +struct DeploymentConfigAuditArgs { + workspace: PathBuf, + artifact_dir: Option, + write_receipt: bool, +} + #[derive(Clone, Debug)] struct ExportProofArgs { workspace: PathBuf, @@ -1088,6 +1098,33 @@ fn parse_overview_args(args: impl Iterator) -> Result, +) -> Result { + let mut workspace = None; + let mut artifact_dir = None; + let mut write_receipt = true; + + let mut args = args.peekable(); + while let Some(arg) = args.next() { + match arg.as_str() { + "--workspace" => workspace = Some(take_path(&mut args, "--workspace")?), + "--artifact-dir" => artifact_dir = Some(take_path(&mut args, "--artifact-dir")?), + "--no-write" | "--read-only" => write_receipt = false, + other => { + return Err(anyhow!( + "unexpected deployment-config-audit argument {other:?}" + )); + } + } + } + Ok(DeploymentConfigAuditArgs { + workspace: workspace.context("missing --workspace")?, + artifact_dir, + write_receipt, + }) +} + fn parse_export_proof_args(args: impl Iterator) -> Result { let mut workspace = None; let mut item = None; @@ -10203,6 +10240,171 @@ fn run_overview(args: OverviewArgs) -> Result { })) } +fn run_deployment_config_audit(args: DeploymentConfigAuditArgs) -> Result { + let workspace = args + .workspace + .canonicalize() + .with_context(|| format!("failed to resolve {}", args.workspace.display()))?; + ensure_git_repo(&workspace)?; + let artifact_dir = args + .artifact_dir + .unwrap_or_else(|| workspace.join(".epiphany").join("work")); + fs::create_dir_all(&artifact_dir) + .with_context(|| format!("failed to create {}", artifact_dir.display()))?; + + let config_path = workspace.join(".epiphany").join("deployment.toml"); + let receipt_path = artifact_dir.join("deployment-config-audit.json"); + let generated_at = Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true); + let mut assertions = Vec::new(); + let mut config_text = String::new(); + + if config_path.exists() { + config_text = fs::read_to_string(&config_path) + .with_context(|| format!("failed to read {}", config_path.display()))?; + push_assertion( + &mut assertions, + "deployment-config-schema-present", + config_text.contains("schema_version = \"epiphany.repo_deployment_config.v0\""), + "Deployment config carries the schema version.".to_string(), + ); + push_assertion( + &mut assertions, + "deployment-config-family-present", + config_text.contains("safe_action_family = \"repo.deployment_config\""), + "Deployment config carries the safe action family.".to_string(), + ); + push_assertion( + &mut assertions, + "deployment-config-idunn-trigger", + config_text.contains("[deployment]") + && config_text.contains("enabled = false") + && config_text.contains("owner = \"Idunn\"") + && config_text.contains("trigger = \"git-push-observed-by-idunn\"") + && config_text.contains("watched_ref = \"refs/heads/main\"") + && config_text.contains("deployment_script_ref = \"deploy/idunn-deploy.ps1\"") + && config_text.contains("deployment_script_hash_required = true") + && config_text.contains("deployment_script_review_required = true") + && config_text.contains("host_access_policy_ref_required = true") + && config_text.contains("secret_values_embedded = false") + && config_text.contains("rollback_plan_ref_required = true") + && config_text.contains("aftercare_checks_required = true") + && config_text.contains("idunn_receipt_required = true") + && config_text.contains("aftercare_audit_required = true"), + "Deployment config names disabled Idunn git-push trigger, reviewed script/hash, policy, rollback, and aftercare requirements." + .to_string(), + ); + push_assertion( + &mut assertions, + "deployment-config-cultmesh-contract", + config_text.contains("[cultmesh]") + && config_text.contains("local_verse = \"gamecult-local\"") + && config_text.contains("capability_family = \"gamecult.idunn.deployment\"") + && config_text + .contains("intent_contract = \"gamecult.idunn.deployment_intent.v0\"") + && config_text + .contains("receipt_contract = \"gamecult.idunn.deployment_receipt.v0\"") + && config_text.contains( + "aftercare_contract = \"gamecult.idunn.deployment_aftercare_audit.v0\"", + ) + && config_text.contains("daemon_owns_execution = true"), + "Deployment config routes execution through Idunn CultMesh contracts.".to_string(), + ); + push_assertion( + &mut assertions, + "deployment-config-receipt-contract", + config_text.contains("[required_receipts]") + && config_text + .contains("mind_adoption = \"epiphany.repo_work_mind_adoption_decision.v0\"") + && config_text.contains("soul_review = \"epiphany.repo_work_closure_review.v0\"") + && config_text + .contains("maintainer_review = \"gamecult.maintainer.review_receipt.v0\"") + && config_text + .contains("secret_policy = \"epiphany.repo_secret_policy_request.v0\"") + && config_text + .contains("idunn_deployment = \"gamecult.idunn.deployment_receipt.v0\"") + && config_text.contains( + "aftercare_audit = \"gamecult.idunn.deployment_aftercare_audit.v0\"", + ), + "Deployment config names Mind, Soul, maintainer, secret-policy, Idunn deployment, and aftercare receipts." + .to_string(), + ); + push_assertion( + &mut assertions, + "deployment-config-authority-seals", + config_text.contains("[authority]") + && config_text.contains("configuration_only = true") + && config_text.contains("direct_deployment_authority = false") + && config_text.contains("direct_ssh_authority = false") + && config_text.contains("direct_git_push_authority = false") + && config_text.contains("direct_service_lifecycle_authority = false") + && config_text.contains("direct_hands_authority = false") + && config_text.contains("publication_authorized = false") + && config_text.contains("merge_authorized = false") + && config_text.contains("cross_body_mutation_authorized = false") + && config_text.contains("private_verse_rummaging = false") + && config_text.contains("idunn_deployment_authority_required = true"), + "Deployment config denies deployment, SSH, git-push, service lifecycle, Hands, publication, merge, and cross-body authority." + .to_string(), + ); + push_assertion( + &mut assertions, + "deployment-config-private-seal", + config_text.contains("private_state_exposed = false"), + "Deployment config preserves the private-state seal.".to_string(), + ); + } else { + push_assertion( + &mut assertions, + "deployment-config-present", + false, + format!("Deployment config missing at {}", config_path.display()), + ); + } + + let all_passed = assertions + .iter() + .all(|assertion| assertion.get("passed").and_then(Value::as_bool) == Some(true)); + let status = if all_passed { + "ready-for-idunn-review" + } else if config_path.exists() { + "invalid" + } else { + "missing" + }; + let daemon_owns_execution = all_passed && config_text.contains("daemon_owns_execution = true"); + let receipt = json!({ + "schemaVersion": "epiphany.repo_deployment_config_audit.v0", + "auditId": "repo-deployment-config-audit", + "generatedAt": generated_at, + "status": status, + "workspace": workspace, + "configPath": config_path, + "receiptPath": receipt_path, + "readyForIdunnReview": status == "ready-for-idunn-review", + "executionAuthorized": false, + "deploymentAuthority": false, + "sshAuthority": false, + "gitPushAuthority": false, + "serviceLifecycleAuthority": false, + "handsAuthority": false, + "publicationAuthorized": false, + "mergeAuthorized": false, + "crossBodyMutationAuthorized": false, + "daemonOwnsExecution": daemon_owns_execution, + "nextGate": if status == "ready-for-idunn-review" { + "idunn.review_deployment_config" + } else { + "repo.fix_deployment_config" + }, + "assertions": assertions, + "privateStateExposed": false + }); + if args.write_receipt { + write_json(&receipt_path, &receipt)?; + } + Ok(receipt) +} + fn run_export_proof(args: ExportProofArgs) -> Result { let workspace = args .workspace @@ -12347,7 +12549,7 @@ fn sanitize(value: &str) -> String { fn print_usage() { eprintln!( - "usage: epiphany-work ...\n\ + "usage: epiphany-work ...\n\ persona-intake --workspace --item --message [--topic ] [--store ] [--runtime-id ]\n\ accept --workspace --from --item [--summary ] [--topic ] [--store ] [--runtime-id ] [--online-receipt ] [--public-discussion-ref ] [--candidate-action-ref ]\n\ derive-plan --workspace [--item ] [--accept-receipt ] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card|repo-manifest|repo-tool-capabilities|repo-tool-request|repo-eve-surface|repo-collaboration-policy|repo-collaboration-topic|repo-consensus-brief|repo-objective-draft|repo-adoption-request|repo-scheduling-request|repo-work-order|repo-verification-request|repo-publication-request|repo-sync-request|repo-maintainer-review-request|repo-pr-request|repo-credit-request|repo-artifact-acceptance-request|repo-metrics-request|repo-doctrine-update-request|repo-secret-policy-request|repo-deployment-config|repo-deployment-request] [--target-path ] [--model-ref ] [--model-authored] [--action-summary ] [--verification-ask ] [--stop-condition ] [--escalation-reason ] [--assumption ] [--constraint ] [--non-goal ] [--open-question ] [--decision-point ] [--evidence-need ]\n\ @@ -12359,6 +12561,7 @@ fn print_usage() { publish --workspace [--item ] --change-summary --justification --verification-receipt --review-receipt --ledger-entry-id --pull-request-url --pull-request-title \n\ sync --workspace [--item ] [--publish-receipt ] [--upstream-ref origin/main] --merge-receipt \n\ overview --workspace [--item ] [--accept-receipt ] [--no-write]\n\ + deployment-config-audit --workspace [--artifact-dir ] [--no-write]\n\ export-proof --workspace [--item ] [--accept-receipt ] [--output ] [--local-verse-store ] [--runtime-id repo-swarm-local]\n\ tick --workspace [--item ] [--local-verse-store ] [--runtime-store ] [--dry-run]\n\ queue-run --workspace [--local-verse-store ] [--runtime-id repo-swarm-local] [--max-items 1] [--dry-run]" diff --git a/notes/epiphany-repo-swarm-mvp-contract.md b/notes/epiphany-repo-swarm-mvp-contract.md index 118cadc9..b644bd63 100644 --- a/notes/epiphany-repo-swarm-mvp-contract.md +++ b/notes/epiphany-repo-swarm-mvp-contract.md @@ -778,6 +778,17 @@ contracts, daemon-owned execution, and denied direct deployment, SSH, git push, service lifecycle, Hands, publication, merge, cross-body authority, and `privateStateExposed=false`. +The deployment config audit readback is now live as the non-mutating Idunn +handoff check. `epiphany-work deployment-config-audit --workspace ` reads +`.epiphany/deployment.toml`, emits +`epiphany.repo_deployment_config_audit.v0`, and classifies a complete disabled +Idunn git-push contract as `ready-for-idunn-review` while keeping +`executionAuthorized=false`, `deploymentAuthority=false`, +`sshAuthority=false`, `gitPushAuthority=false`, +`serviceLifecycleAuthority=false`, and `privateStateExposed=false`. Smoke +`.epiphany-smoke\repo-deployment-config-family-20260620-213042` proved the +audit receipt beside the family close path. + ### Landed Work Run Gate The sixth front door exists as native Rust: diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 02f142de..112f30cb 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -126,6 +126,7 @@ remembers doctrine; the branch remembers the blade. - 2026-06-20: The first repo-work map semantic lens is live in Gjallar. `epiphany-verse-query gjallar` now derives `repoWorkMapFamilyLensCount`, `repoWorkMapFamilyLensRows`, and `repoWorkMapFamilyLensTuiRows` from Mind-admitted `epiphany.cultmesh.repo_work_map_entry.v0` rows, grouping by safe action family with item/path counts, latest item/commit/Mind commit, Bifrost gate, and private-state seal. Smoke `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205055` reran the counterfeit-adoption guard and proved `gjallarRepoWorkMapFamilyLensCount=1` plus `privateStateExposed=false`. The next map work is deeper source-grounded semantic lenses beyond safe-family aggregation, not basic Gjallar map visibility. - 2026-06-20: Gjallar now has a changed-path lens over Mind-admitted repo-work maps. `repoWorkMapPathLensRows` / `REPO-WORK-MAP-PATH` group accepted map consequences by changed repo path, with item count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`. Smoke `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205740` reran the counterfeit-adoption guard and proved `gjallarRepoWorkMapPathLensCount=1` alongside the family lens. The next map work is richer semantic/source-grounded lenses beyond safe-family and path aggregation. - 2026-06-20: Gjallar now has a branch lens over Mind-admitted repo-work maps. `repoWorkMapBranchLensRows` / `REPO-WORK-MAP-BRANCH` group accepted map consequences by branch with item count, changed-path count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`. Smoke `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-210747` reran the counterfeit-adoption guard and proved `gjallarRepoWorkMapBranchLensCount=1` alongside the family/path lenses. This is branch-workbench sight only: Gjallar still does not schedule, publish, merge, deploy, keep daemons alive, or admit Mind state. +- 2026-06-20: `epiphany-work deployment-config-audit` is live as the non-mutating Idunn handoff readback for repo deployment config. It reads `.epiphany/deployment.toml`, writes `epiphany.repo_deployment_config_audit.v0`, reports `ready-for-idunn-review` only when the disabled git-push Idunn trigger, CultMesh intent/receipt/aftercare contracts, required receipts, and authority seals are present, and always keeps execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-213042` proved the audit beside the `repo.deployment_config` close path with `daemonOwnsExecution=true`, `readyForIdunnReview=true`, and `privateStateExposed=false`. - 2026-06-20: Deeper model-authored closure review is now live. `epiphany-work close` accepts `--closure-model-verdict passed|failed|needs-work|blocked`, `--closure-model-finding`, and `--require-closure-model-verdict`; the close review embeds `epiphany.repo_work_model_closure_review.v0` under `modelingReview.closureReview`, records reviewed inputs and gate enforcement, and Soul refuses closure when a supplied or required model verdict does not pass. Focused smoke `.epiphany-smoke\closure-model-gate-20260620-135103` created a disposable repo, ran two `repo.status_section` items through public front doors, closed one with required model verdict `passed`, and blocked one with `needs-work` while `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority. - 2026-06-20: Mind adoption/interpreter depth now has a concrete interpretation packet. `epiphany-work adopt` writes `epiphany.repo_work_mind_adoption_decision.v0` before the main adoption receipt, embeds `epiphany.repo_work_mind_interpretation.v0` with input summary, safe-family recognition, requested-path classification, allowed branch-local Hands transition, and forbidden durable-state/publication/service/private transitions, then records Self presentation, Mind evidence review, safe-family requirement, branch-local scope, Bifrost publication gate, Soul closure requirement, and no Hands/durable-state/publication/merge/service/cross-body/private authority inside the Mind decision; the main adoption receipt cites that decision before granting branch-local Hands authority. Focused smoke `.epiphany-smoke\repo-planning-facets-20260620-175503` proves model-authored planning facets survive into Imagination, plan derivation, Mind interpretation, Mind decision, and adoption, while close still passes Soul/family/path checks with `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics beyond the first Mind interpretation packet, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority. - 2026-06-20: `repo-manifest` is now the next non-planning safe family. `epiphany-work derive-plan --action-family repo-manifest` lowers accepted pressure into a structured `epiphany.toml` Body manifest with safe family `repo.body_manifest`, body domain, private/local/public Verse ids, Eve surface id, receipt-required capability hints, arbitrary shell sealed false, and private-state seals. Soul closure assertions now inspect the committed manifest for schema, safe family, summary, body domain, Verse ids, Eve surface, receipt requirement, no arbitrary shell, and private-state seals. Focused smoke `.epiphany-smoke\repo-manifest-family-20260620-141552` ran a disposable repo through init -> online -> accept -> repo-manifest derive-plan -> tick run/adopt/execute/close; Hands committed only `epiphany.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, additional useful repo-owned config/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 176b0de82b2bb5bcbc9e81aaf72fa8f7db8f5e06..a4dbf78c99e165fab8abe96553ae905d2d07a4d1 100644 GIT binary patch delta 322 zcmX?cPW1Oh(G3!e+{PwWCgxGc7+BM9Y*uD0WMm9!p32ldm5C9EK{PWEvuvNr#JV{} zXv$6_10yqC12bJCgAgM_D`S)C8|zu5yct_lQVVkOD|1uxN_3O+^U^ZYbrVZdGD{RP zixqM*%Tg5*ixm)6x`*QWH~>5|gv7rZXzC z%1rNxV&$IxE|pa>(%8VnNTHx8zbrLHA+;d00H~o-uPC)3KOSLaJjBX)u$6jc1`5SM zJ4%behF0pP3v)5!f|BV0qh;qS90y mg{st|e1+7C)a25V%=|q4>7CK6hHUz|sYU6j(=)EHXaNAUnsM0x delta 53 zcmex;QS`()(G3!e+(yP$21ZfG7+BL(H!Cw1GBO4?Pi1PK%ESo7AetG7S+-AQV%?kq E0NdXXwEzGB diff --git a/state/map.yaml b/state/map.yaml index ca167eba..f8275d77 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -88,7 +88,7 @@ active_subgoals: - Keep the landed Phase 6 coordinator, limited safe-boundary CRRC automation, and pre-compaction checkpoint intervention ready for the next bridge-equipped dogfood run. - Preserve the Ghostlight-derived heartbeat initiative seam: every lane, including coordinator/Self and Persona, has a organ-state record and competes for heartbeat slots through readiness/reaction timing; initiative heat can raise or cool global, group, arena, role, and agent tempo through typed heartbeat policy; active thinking freezes initiative until completion, so heat never queues a lane already mid-turn; idle winners ruminate instead of inventing project work, and sleep windows distill the accumulated thought pressure into reviewed self-memory or doctrine. - Use `notes/epiphany-swarm-readiness-plan.md` as the live-fire direction gate. The local run path is a compass, not launch clearance: before unattended swarm operation, Epiphany needs typed pause/brake enforcement, one initiative scheduler, completion-gated cooldown, stale active-turn recovery receipts, parent-side Persona speech eligibility, memory lifecycle operations, and CultNet-first operator snapshots/intents/receipts. The local Verse brake document exists, `epiphany-verse-query swarm-brake` can engage/release it, `tools/epiphany_local_run.ps1` refuses live `plan`/`run`/`mvp` modes when the brake is engaged while leaving `status` readable, `epiphany-mvp-coordinator` checks the local Verse brake before app-server startup, and `epiphany-heartbeat-store` guards tick/pump/heat/queue-mention/routine when given `--local-verse-store`. Daemon liveness is now a typed local Verse authority: `epiphany-verse-query daemon-status` writes one daemon status without repainting the table, local Verse seeding preserves existing daemon statuses and swarm brakes, `invoke-tool` refuses when the host daemon is not ready or lacks `submitTypedToolIntent`, and both daemon tool invocation and lifecycle poke fail closed under an engaged matching brake. `epiphany-daemon-supervisor policy` writes durable per-daemon restart policy with command/args/cwd/cooldown/backoff/attempt state plus reconcile cadence and stale-heartbeat threshold; `epiphany-daemon-supervisor reconcile` loads that policy when no override command is supplied, refuses under a matching lifecycle brake, refuses during cooldown/backoff, writes daemon poke intent/receipt, updates daemon status, and updates policy attempt state; `epiphany-daemon-supervisor tick` is an explicit scheduler pulse that scans durable policies, records ready/noop pulses, skips before the configured reconcile interval, marks stale heartbeat status degraded, routes restarts through the same brake/cooldown/poke receipt path, and writes a latest `epiphany.cultmesh.daemon_scheduler_receipt.v0`; `epiphany-daemon-supervisor serve` runs that same pulse on a configurable cadence with bounded `--max-iterations` proof mode or unbounded service mode. `epiphany-daemon-supervisor service-plan`/`install-service` now writes a planned `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` for the `serve` command, while `service-launch`/`start-service` spawns that `serve` loop through the current executable or `--service-command`, can `--wait-child` for bounded proof, and records command/args/cwd, scheduler id, daemon selector, pid/exit/status, artifact ref, and private-state guard. `service-runbook`, `windows-service-install`/`service-install-plan`, `windows-service-status`, `windows-service-reconcile`, `windows-service-execution-readiness`, and `windows-service-start`/`stop` now record service lifecycle receipts through the same local Verse; the read-only status path has been proved against the real Windows `EventLog` service with receipt `daemon-service-lifecycle-receipt-windows-eventlog-proof-windows-service-status`, status `running`, exit code `0`, and `privateStateExposed=false`; the read-only service-policy reconciliation path has been proved for missing service, real-service drift against `EventLog`, lifecycle-brake refusal, and wrapper/local-Verse receipt `daemon-service-lifecycle-receipt-windows-eventlog-reconcile-proof-windows-service-reconcile`; execution readiness has been proved as a non-mutating `not-elevated` receipt through direct and wrapper paths; start/stop now produce non-mutating `start-planned`/`stop-planned` receipts unless `--execute-control`/`--execute-service-control` is passed, and wrapper `service-start-plan`/`service-stop-plan` proves those receipts against `EventLog`; explicit install/control execution now refuses as `execution-refused-not-elevated` with `executed=false` when the shell lacks Windows administrator authority, and wrapper `service-install-execute`, `service-start-execute`, and `service-stop-execute` prove those refusal receipts without mutation. Service lifecycle actions check the local Verse swarm brake before process launch, artifact writes, service-manager queries, service-policy reconciliation, execution-readiness checks, control planning, elevation-gated execution, or start/stop execution. The local wrapper builds/checks this binary. - - Use `notes/epiphany-repo-swarm-mvp-contract.md` as the repo-swarm autonomy authority map. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruption, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Current safe-family cargo includes repo manifest, tool capability manifest, daemon-hosted tool request cargo, Eve/CultUI surface contract, repo collaboration policy, collaboration topics, consensus/objective/adoption/scheduling/work-order/verification/publication/sync/review/PR/credit/artifact/metrics/doctrine-update/secret-policy/deployment requests, repo deployment config, action-item receipts, Mind adoption interpretation/decision receipts, explicit Mind safe-family refusal proof `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, explicit Mind requested-path/plan changed-path refusal proof `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, overview/public-proof/Gjallar/Eve readbacks, typed swarm-run stop classification, Idunn non-mutating queue-run lifecycle receipts, and fresh-repo upstream-main proof. Latest deployment config proof `.epiphany-smoke\repo-deployment-config-family-20260620-211809` shows `repo.deployment_config` closes through Soul while writing disabled Idunn-owned git-push deployment config with script/hash review, host policy, secret policy, rollback, aftercare, Idunn CultMesh intent/receipt/aftercare contracts, daemon-owned execution, and no deployment/SSH/git-push/service authority. Latest deployment request proof `.epiphany-smoke\repo-deployment-request-family-20260620-195605` shows `repo.deployment_request` closes through Soul while requesting reviewed git-push-observed-by-Idunn deployment with script/host/secret/rollback/aftercare requirements and no deployment/SSH/git-push/service authority. Latest security cargo proof `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` shows `repo.secret_policy_request` closes through Soul while requesting reviewed secret/write/export/deployment policy without exposing secrets or granting write/deployment/publication authority. Governance proof `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` shows `repo.doctrine_update_request` closes through Soul while requesting reviewed `AGENTS.md` doctrine work without mutating doctrine or granting Hands/service/publication authority. Swarm-run stop proofs now include `.epiphany-smoke\fresh-repo-mvp-20260620-180024` for `iteration-limit` / Self / `self.scheduler-iteration-limit` with upstream-main sync and public-proof export, plus `.epiphany-smoke\swarm-stop-classification-20260620-184717` for `queue-empty` / Gjallar / `repo.work.overview`, `dry-run-preview` / Self / `ready-to-run`, `authority-gated` / Bifrost / `awaiting-publication`, and `authority-gated` / Bifrost/GitHub / `awaiting-upstream-sync`; all stop packets are non-mutating, non-elevated, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853` now proves Idunn-owned non-mutating repo-work queue-run service plan/runbook receipts for exact service id `epiphany-repo-work-queue-runner`, receipt-directory readback, runbook SHA-256 `f2ec67c4f8243a3ebc2f9e915b6b9f5ae2ac2d99d2cdb86905b54667adc456f8`, `hostedBody=repo-work`, no service-manager mutation, no launch, no elevation, and `privateStateExposed=false`. + - Use `notes/epiphany-repo-swarm-mvp-contract.md` as the repo-swarm autonomy authority map. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruption, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Current safe-family cargo includes repo manifest, tool capability manifest, daemon-hosted tool request cargo, Eve/CultUI surface contract, repo collaboration policy, collaboration topics, consensus/objective/adoption/scheduling/work-order/verification/publication/sync/review/PR/credit/artifact/metrics/doctrine-update/secret-policy/deployment requests, repo deployment config, action-item receipts, Mind adoption interpretation/decision receipts, explicit Mind safe-family refusal proof `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, explicit Mind requested-path/plan changed-path refusal proof `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, overview/public-proof/Gjallar/Eve readbacks, typed swarm-run stop classification, Idunn non-mutating queue-run lifecycle receipts, and fresh-repo upstream-main proof. Latest deployment config proof `.epiphany-smoke\repo-deployment-config-family-20260620-213042` shows `repo.deployment_config` closes through Soul while writing disabled Idunn-owned git-push deployment config, then `epiphany-work deployment-config-audit` emits `epiphany.repo_deployment_config_audit.v0` with status `ready-for-idunn-review`, `daemonOwnsExecution=true`, and no execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority. Latest deployment request proof `.epiphany-smoke\repo-deployment-request-family-20260620-195605` shows `repo.deployment_request` closes through Soul while requesting reviewed git-push-observed-by-Idunn deployment with script/host/secret/rollback/aftercare requirements and no deployment/SSH/git-push/service authority. Latest security cargo proof `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` shows `repo.secret_policy_request` closes through Soul while requesting reviewed secret/write/export/deployment policy without exposing secrets or granting write/deployment/publication authority. Governance proof `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` shows `repo.doctrine_update_request` closes through Soul while requesting reviewed `AGENTS.md` doctrine work without mutating doctrine or granting Hands/service/publication authority. Swarm-run stop proofs now include `.epiphany-smoke\fresh-repo-mvp-20260620-180024` for `iteration-limit` / Self / `self.scheduler-iteration-limit` with upstream-main sync and public-proof export, plus `.epiphany-smoke\swarm-stop-classification-20260620-184717` for `queue-empty` / Gjallar / `repo.work.overview`, `dry-run-preview` / Self / `ready-to-run`, `authority-gated` / Bifrost / `awaiting-publication`, and `authority-gated` / Bifrost/GitHub / `awaiting-upstream-sync`; all stop packets are non-mutating, non-elevated, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853` now proves Idunn-owned non-mutating repo-work queue-run service plan/runbook receipts for exact service id `epiphany-repo-work-queue-runner`, receipt-directory readback, runbook SHA-256 `f2ec67c4f8243a3ebc2f9e915b6b9f5ae2ac2d99d2cdb86905b54667adc456f8`, `hostedBody=repo-work`, no service-manager mutation, no launch, no elevation, and `privateStateExposed=false`. - Mind-admitted repo-work map facts now leave local Verse sight. Successful `epiphany-work close` first admits `.epiphany/state/repo-work-map.msgpack` as `epiphany.repo_work_map_store.v0`, then mirrors the accepted item fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0` under `gamecult-local/repo-work-map/latest`. `epiphany-verse-query gjallar` exposes `repoWorkMapRows`, `repoWorkMapTuiRows`, and `latestRepoWorkMapEntry` with safe family, changed-path count, Soul verdict id, Mind review/commit ids, Bifrost gate, source map store ref, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` plus direct Gjallar readback showed one compact `REPO-WORK-MAP` row after counterfeit Mind adoption was refused and the real close passed. This is sight only; Gjallar still does not schedule, publish, merge, deploy, keep daemons alive, or open private state. - Gjallar now derives the first repo-work map semantic lens from Mind-admitted local Verse map rows. `repoWorkMapFamilyLensRows` / `REPO-WORK-MAP-LENS` group accepted repo-work consequences by safe action family, with item count, changed-path count, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205055` reran the counterfeit-adoption guard and passed with `gjallarRepoWorkMapFamilyLensCount=1`. This is aggregate sight only, not scheduling, publication, merge, deployment, service lifecycle, or Mind admission authority. - Gjallar now derives a changed-path repo-work map lens from the same Mind-admitted local Verse rows. `repoWorkMapPathLensRows` / `REPO-WORK-MAP-PATH` group accepted consequences by changed repo path, with item count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205740` passed with `gjallarRepoWorkMapPathLensCount=1` beside the family lens. This lets agents see which Body paths have accepted work without opening private receipts or granting Gjallar actuation authority. @@ -638,5 +638,5 @@ current_status: - `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness. - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. - last_completed_repo_swarm_cut: `repo-deployment-config` is now branch-local Idunn deployment configuration cargo. `epiphany-work derive-plan --action-family repo-deployment-config` writes `.epiphany/deployment.toml` with safe family `repo.deployment_config`, disabled Idunn git-push trigger, watched ref, script ref plus hash/review requirement, host policy, secret policy, rollback, aftercare checks, Idunn CultMesh intent/receipt/aftercare contracts, daemon-owned execution, and no direct deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority. Proof `.epiphany-smoke\repo-deployment-config-family-20260620-211809` closed through Soul with `familyAssertions.status=passed`, `deploymentConfigEnabled=false`, `daemonOwnsExecution=true`, and `privateStateExposed=false`. - next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `task-card` / `repo.task_card`, `repo-status-section` / `repo.status_section`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo-doctrine-update-request` / `repo.doctrine_update_request`, `repo-secret-policy-request` / `repo.secret_policy_request`, `repo-deployment-config` / `repo.deployment_config`, and `repo-deployment-request` / `repo.deployment_request`, typed Imagination action-item receipts over allowlisted safe families, `epiphany.repo_work_mind_interpretation.v0` plus `epiphany.repo_work_mind_adoption_decision.v0` Mind interpreter receipts, explicit safe-family allowlist refusal, explicit requested-path/plan-changed-path mismatch refusal, Soul closure's Mind-adoption proof guard, durable repo-work map admission before branch-local Hands consequences reach publication gates, local Verse `epiphany.cultmesh.repo_work_map_entry.v0` Gjallar readback for Mind-admitted map facts, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts including native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853`, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; proofs `.epiphany-smoke\fresh-repo-mvp-20260620-180024`, `.epiphany-smoke\swarm-stop-classification-20260620-184717`, `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140`, `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046`, `.epiphany-smoke\repo-deployment-config-family-20260620-211809`, `.epiphany-smoke\repo-deployment-request-family-20260620-195605`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-201153`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-202113`, and `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` show fresh-repo iteration-limit stop classification, empty-queue Gjallar classification, dry-run planning-preview Self classification, Bifrost publication-gate classification, Bifrost/GitHub upstream-sync gate classification, Mind refusal for unsupported safe-family cargo and mismatched requested paths, reviewed doctrine/security/deployment config/request cargo, closure refusal for counterfeit Mind adoption, durable repo-map admission only after passing closure, local Verse/Gjallar map projection, closure, publication receipts, upstream-main sync, public-proof export, and private-state sealing. The contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper interpreter/closure depth or explicit Idunn deployment execution/audit under operator authority. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start/deployment execution still requires explicit elevated operator authority. + last_completed_repo_swarm_cut: `epiphany-work deployment-config-audit` is now the non-mutating Idunn handoff readback for branch-local repo deployment configuration. It reads `.epiphany/deployment.toml`, writes `epiphany.repo_deployment_config_audit.v0`, reports `ready-for-idunn-review` only when the disabled Idunn git-push trigger, CultMesh intent/receipt/aftercare contracts, required receipts, and authority seals are present, and always keeps execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false. Proof `.epiphany-smoke\repo-deployment-config-family-20260620-213042` closed the `repo.deployment_config` family through Soul and then proved the audit with `deploymentConfigAuditStatus=ready-for-idunn-review`, `readyForIdunnReview=true`, `daemonOwnsExecution=true`, and `privateStateExposed=false`. + next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `task-card` / `repo.task_card`, `repo-status-section` / `repo.status_section`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo.doctrine_update_request`, `repo.secret_policy_request`, `repo.deployment_config`, and `repo.deployment_request`, typed Imagination action-item receipts over allowlisted safe families, `epiphany.repo_work_mind_interpretation.v0` plus `epiphany.repo_work_mind_adoption_decision.v0` Mind interpreter receipts, explicit safe-family allowlist refusal, explicit requested-path/plan-changed-path mismatch refusal, Soul closure's Mind-adoption proof guard, durable repo-work map admission before branch-local Hands consequences reach publication gates, local Verse `epiphany.cultmesh.repo_work_map_entry.v0` Gjallar readback for Mind-admitted map facts, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts including native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853`, non-mutating `epiphany-work deployment-config-audit` proof `.epiphany-smoke\repo-deployment-config-family-20260620-213042`, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; proofs `.epiphany-smoke\fresh-repo-mvp-20260620-180024`, `.epiphany-smoke\swarm-stop-classification-20260620-184717`, `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140`, `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046`, `.epiphany-smoke\repo-deployment-config-family-20260620-213042`, `.epiphany-smoke\repo-deployment-request-family-20260620-195605`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-201153`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-202113`, and `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` show fresh-repo iteration-limit stop classification, empty-queue Gjallar classification, dry-run planning-preview Self classification, Bifrost publication-gate classification, Bifrost/GitHub upstream-sync gate classification, Mind refusal for unsupported safe-family cargo and mismatched requested paths, reviewed doctrine/security/deployment config/request cargo, deployment-config audit readiness for Idunn review, closure refusal for counterfeit Mind adoption, durable repo-map admission only after passing closure, local Verse/Gjallar map projection, closure, publication receipts, upstream-main sync, public-proof export, and private-state sealing. The contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper interpreter/closure depth or explicit Idunn deployment execution under operator authority. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start/deployment execution still requires explicit elevated operator authority.