From 6c0c93fbff935544d7527f45df9ecfaae6080294 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sat, 20 Jun 2026 13:59:06 +0100 Subject: [PATCH] Add repo work closure review receipts --- epiphany-core/src/bin/epiphany-work.rs | 141 ++++++++++++++++++++-- notes/epiphany-repo-swarm-mvp-contract.md | 46 +++++-- notes/fresh-workspace-handoff.md | 25 ++-- state/ledgers.msgpack | Bin 320450 -> 321292 bytes state/map.yaml | 4 +- 5 files changed, 183 insertions(+), 33 deletions(-) diff --git a/epiphany-core/src/bin/epiphany-work.rs b/epiphany-core/src/bin/epiphany-work.rs index 8163285d..797f4b6b 100644 --- a/epiphany-core/src/bin/epiphany-work.rs +++ b/epiphany-core/src/bin/epiphany-work.rs @@ -219,6 +219,8 @@ struct CloseArgs { verification_command: Option, verification_summary: Option, modeling_summary: Option, + closure_model_ref: Option, + model_authored: bool, state_revision: u64, } @@ -726,6 +728,8 @@ fn parse_close_args(args: impl Iterator) -> Result { let mut verification_command = None; let mut verification_summary = None; let mut modeling_summary = None; + let mut closure_model_ref = None; + let mut model_authored = false; let mut state_revision = 0_u64; let mut args = args.peekable(); @@ -747,6 +751,10 @@ fn parse_close_args(args: impl Iterator) -> Result { "--modeling-summary" => { modeling_summary = Some(take_string(&mut args, "--modeling-summary")?); } + "--closure-model-ref" | "--model-ref" => { + closure_model_ref = Some(take_string(&mut args, "--closure-model-ref")?); + } + "--model-authored" => model_authored = true, "--state-revision" => state_revision = take_u64(&mut args, "--state-revision")?, other => return Err(anyhow!("unexpected close argument {other:?}")), } @@ -760,6 +768,8 @@ fn parse_close_args(args: impl Iterator) -> Result { verification_command, verification_summary, modeling_summary, + closure_model_ref, + model_authored, state_revision, }) } @@ -2843,11 +2853,86 @@ fn run_close(args: CloseArgs) -> Result { fs::write(&stderr_artifact, &verification.stderr) .with_context(|| format!("failed to write {}", stderr_artifact.display()))?; let now = Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true); - let verification_passed = verification.status.success(); + let declared_changed_paths = + sorted_normalized_paths(string_array_from_json(&execute_receipt, &["changedPaths"])); + let actual_changed_paths = sorted_normalized_paths( + git_output( + &workspace, + &[ + "diff-tree", + "--no-commit-id", + "--name-only", + "-r", + &commit_sha, + ], + )? + .lines() + .map(ToString::to_string) + .collect(), + ); + let path_scope_matched = declared_changed_paths == actual_changed_paths; + let commit_stat = git_output(&workspace, &["show", "--stat", "--oneline", &commit_sha])?; + let closure_model_authored = args.model_authored || args.closure_model_ref.is_some(); + let closure_review_id = format!("repo-work-close-{item_slug}-closure-review"); + let closure_review_path = artifact_dir.join(format!("work-close-{item_slug}-review.json")); + let closure_review = json!({ + "schemaVersion": "epiphany.repo_work_closure_review.v0", + "createdAt": now, + "workspace": workspace, + "receiptId": closure_review_id, + "item": item, + "owner": "Soul+Modeling", + "stateGate": "Mind", + "executeReceiptPath": execute_receipt_path, + "runtimeStore": runtime_store, + "handsReceipts": { + "patchReceiptId": patch_receipt_id, + "commandReceiptId": command_receipt_id, + "commitReceiptId": commit_receipt_id, + "commitSha": commit_sha + }, + "verification": { + "command": verification_command, + "exitCode": verification.status.code(), + "stdoutArtifact": normalize_path_for_receipt(&stdout_artifact), + "stderrArtifact": normalize_path_for_receipt(&stderr_artifact), + "passed": verification.status.success() + }, + "sourceGrounding": { + "declaredChangedPaths": declared_changed_paths, + "actualChangedPaths": actual_changed_paths, + "pathScopeMatched": path_scope_matched, + "commitStat": compact_multiline(&commit_stat), + "commitReceiptMatchedExecuteReceipt": true + }, + "modelingReview": { + "modelAuthored": closure_model_authored, + "modelRef": args.closure_model_ref, + "deterministicFallback": !closure_model_authored, + "operatorAuthoredShellDetails": false, + "summary": args.modeling_summary.clone() + }, + "authoritySeal": { + "branchLocalOnly": true, + "publicationAuthorized": false, + "mergeAuthorized": false, + "serviceLifecycleAuthority": false, + "crossRepoMutation": false, + "privateStateExposed": false + }, + "privateStateExposed": false, + "nextSafeMove": "Soul may pass closure only when verification succeeds and actual git changed paths match the Hands-declared path scope." + }); + write_json(&closure_review_path, &closure_review)?; + let verification_passed = verification.status.success() && path_scope_matched; let soul_verdict_id = format!("repo-work-close-{item_slug}-soul-verdict"); let soul_summary = args.verification_summary.unwrap_or_else(|| { if verification_passed { format!("Soul verified branch-local commit {commit_sha} for repo work item {item}.") + } else if !path_scope_matched { + format!( + "Soul verification failed for branch-local commit {commit_sha}: actual changed paths did not match declared Hands path scope." + ) } else { format!("Soul verification failed for branch-local commit {commit_sha}.") } @@ -2858,8 +2943,9 @@ fn run_close(args: CloseArgs) -> Result { commit_receipt_id.clone(), normalize_path_for_receipt(&stdout_artifact), normalize_path_for_receipt(&stderr_artifact), + normalize_path_for_receipt(&closure_review_path), ]; - evidence_ids.extend(string_array_from_json(&execute_receipt, &["changedPaths"])); + evidence_ids.extend(declared_changed_paths.clone()); let soul_verdict = SoulVerdictReceipt { schema_version: SOUL_VERDICT_RECEIPT_SCHEMA_VERSION.to_string(), receipt_id: soul_verdict_id.clone(), @@ -2874,6 +2960,11 @@ fn run_close(args: CloseArgs) -> Result { evidence_ids: evidence_ids.clone(), risks: if verification_passed { Vec::new() + } else if !path_scope_matched { + vec![ + "Closure refused because actual git changed paths differ from Hands-declared scope." + .to_string(), + ] } else { vec!["Closure verification command failed; publication remains blocked.".to_string()] }, @@ -2897,8 +2988,11 @@ fn run_close(args: CloseArgs) -> Result { "verdict": soul_verdict.verdict, "summary": soul_verdict.summary, "stdoutArtifact": normalize_path_for_receipt(&stdout_artifact), - "stderrArtifact": normalize_path_for_receipt(&stderr_artifact) + "stderrArtifact": normalize_path_for_receipt(&stderr_artifact), + "closureReviewReceiptId": closure_review_id, + "closureReviewPath": normalize_path_for_receipt(&closure_review_path) }, + "closureReview": closure_review, "authority": { "branchLocalOnly": true, "publicationGateSatisfied": false, @@ -2916,6 +3010,7 @@ fn run_close(args: CloseArgs) -> Result { "receiptPath": closure_receipt_path, "item": failed_receipt["item"], "soul": failed_receipt["soul"], + "closureReview": failed_receipt["closureReview"], "authority": failed_receipt["authority"], "privateStateExposed": false, "nextSafeMove": failed_receipt["nextSafeMove"], @@ -2925,7 +3020,7 @@ fn run_close(args: CloseArgs) -> Result { let modeling_summary = args.modeling_summary.unwrap_or_else(|| { format!( "Modeling records repo work item {item} changed [{}] at commit {commit_sha}; scheduler should stop implementation until publication review.", - string_array_from_json(&execute_receipt, &["changedPaths"]).join(", ") + declared_changed_paths.join(", ") ) }); let gateway_id = format!("repo-work-close-{item_slug}-mind-review"); @@ -2943,7 +3038,7 @@ fn run_close(args: CloseArgs) -> Result { refused_effects: Vec::new(), reasons: vec![ "Soul passed the branch-local Hands consequence.".to_string(), - "Modeling summary is source-grounded in execute receipt and commit proof.".to_string(), + "Modeling summary is source-grounded in execute receipt, closure review, and commit proof.".to_string(), "Mind admits closure metadata only; Bifrost still gates publication and merge.".to_string(), ], contract: "Mind review for repo-work closure; admits the verified Modeling summary and publication gate without granting merge or service authority.".to_string(), @@ -2981,13 +3076,17 @@ fn run_close(args: CloseArgs) -> Result { "verdict": soul_verdict.verdict, "summary": soul_verdict.summary, "stdoutArtifact": normalize_path_for_receipt(&stdout_artifact), - "stderrArtifact": normalize_path_for_receipt(&stderr_artifact) + "stderrArtifact": normalize_path_for_receipt(&stderr_artifact), + "closureReviewReceiptId": closure_review_id, + "closureReviewPath": normalize_path_for_receipt(&closure_review_path) }, + "closureReview": closure_review, "modeling": { "summary": modeling_summary, "changedPaths": execute_receipt["changedPaths"], "commitSha": execute_receipt["handsReceipts"]["commitSha"], - "source": "epiphany.repo_work_execute_receipt.v0" + "source": "epiphany.repo_work_closure_review.v0", + "modelAuthored": closure_model_authored }, "mind": { "gatewayReviewId": mind_review.gateway_id, @@ -3018,6 +3117,7 @@ fn run_close(args: CloseArgs) -> Result { "item": closure_receipt["item"], "handsReceipts": closure_receipt["handsReceipts"], "soul": closure_receipt["soul"], + "closureReview": closure_receipt["closureReview"], "modeling": closure_receipt["modeling"], "mind": closure_receipt["mind"], "authority": closure_receipt["authority"], @@ -3467,6 +3567,8 @@ fn run_overview(args: OverviewArgs) -> Result { let adopt_receipt_path = work_receipt_path(&workspace, "adopt", &item); let execute_receipt_path = work_receipt_path(&workspace, "execute", &item); let close_receipt_path = work_receipt_path(&workspace, "close", &item); + let close_review_receipt_path = + artifact_dir.join(format!("work-close-{item_slug}-review.json")); let publish_receipt_path = work_receipt_path(&workspace, "publish", &item); let sync_receipt_path = work_receipt_path(&workspace, "sync", &item); let overview_receipt_path = artifact_dir.join(format!("work-overview-{item_slug}.json")); @@ -3538,6 +3640,7 @@ fn run_overview(args: OverviewArgs) -> Result { ("run", &run_receipt_path), ("adopt", &adopt_receipt_path), ("execute", &execute_receipt_path), + ("close-review", &close_review_receipt_path), ("close", &close_receipt_path), ("publish", &publish_receipt_path), ("sync", &sync_receipt_path), @@ -3561,6 +3664,7 @@ fn run_overview(args: OverviewArgs) -> Result { ("run", &run_receipt_path), ("adopt", &adopt_receipt_path), ("execute", &execute_receipt_path), + ("close-review", &close_review_receipt_path), ("close", &close_receipt_path), ("publish", &publish_receipt_path), ("sync", &sync_receipt_path), @@ -3597,6 +3701,7 @@ fn run_overview(args: OverviewArgs) -> Result { "runReceiptPath": existing_path_value(&run_receipt_path), "adoptReceiptPath": existing_path_value(&adopt_receipt_path), "executeReceiptPath": existing_path_value(&execute_receipt_path), + "closeReviewReceiptPath": existing_path_value(&close_review_receipt_path), "closeReceiptPath": existing_path_value(&close_receipt_path), "publishReceiptPath": existing_path_value(&publish_receipt_path), "syncReceiptPath": existing_path_value(&sync_receipt_path), @@ -4489,6 +4594,8 @@ fn run_tick(args: TickArgs) -> Result { modeling_summary: Some(format!( "Modeling records scheduler-closed repo work item {item}; publication remains gated by Bifrost." )), + closure_model_ref: None, + model_authored: false, state_revision: 0, })?; status = "advanced".to_string(); @@ -5351,6 +5458,14 @@ fn compact_line(text: &str) -> String { } } +fn compact_multiline(text: &str) -> Vec { + text.lines() + .map(compact_line) + .filter(|line| !line.is_empty()) + .take(40) + .collect() +} + fn compact_join(values: &[String]) -> String { if values.is_empty() { "none".to_string() @@ -5363,6 +5478,16 @@ fn compact_join(values: &[String]) -> String { } } +fn sorted_normalized_paths(paths: Vec) -> Vec { + let mut normalized = normalize_paths(paths) + .into_iter() + .filter(|path| path != ".") + .collect::>(); + normalized.sort(); + normalized.dedup(); + normalized +} + fn powershell_single_quoted(value: &str) -> String { format!("'{}'", value.replace('\'', "''")) } @@ -5726,7 +5851,7 @@ fn print_usage() { run --workspace [--item ] [--accept-receipt ] [--runtime-store ] [--requested-path ]\n\ adopt --workspace [--item ] [--run-receipt ] [--from-plan ] [--plan-summary ] [--adoption-evidence-ref ]\n\ execute --workspace [--item ] [--from-plan ] [--command ] [--changed-path ] [--commit-message ]\n\ - close --workspace [--item ] [--execute-receipt ] [--verification-command ]\n\ + close --workspace [--item ] [--execute-receipt ] [--verification-command ] [--closure-model-ref ] [--model-authored]\n\ publish --workspace [--item ] --change-summary --justification --verification-receipt --review-receipt --ledger-entry-id --pull-request-url --pull-request-title \n\ sync --workspace [--item ] [--publish-receipt ] [--upstream-ref origin/main] --merge-receipt \n\ overview --workspace [--item ] [--accept-receipt ] [--no-write]\n\ diff --git a/notes/epiphany-repo-swarm-mvp-contract.md b/notes/epiphany-repo-swarm-mvp-contract.md index c30cf4e8..b30fe9a1 100644 --- a/notes/epiphany-repo-swarm-mvp-contract.md +++ b/notes/epiphany-repo-swarm-mvp-contract.md @@ -639,10 +639,17 @@ It reads `work-execute-.json`, requires matches the recorded git SHA, then runs a verification command in the repo Body (`git show --stat --oneline ` by default, or `--verification-command ` when supplied). The command stdout/stderr are -sealed under `.epiphany/work/`, Soul writes -`epiphany.soul.verdict_receipt`, Modeling records the execution/commit summary, -and Mind writes gateway review plus state-commit receipts into runtime-spine. -The final `.epiphany/work/work-close-.json` receipt is +sealed under `.epiphany/work/`. Closure also writes a structured +`epiphany.repo_work_closure_review.v0` packet at +`.epiphany/work/work-close--review.json`, recording the verification +command/exit code, declared Hands paths, actual git commit paths, commit stat, +optional model-review provenance from `--closure-model-ref` / `--model-authored`, +and authority seals. Soul passes only when the verification command succeeds +and actual git changed paths match the Hands-declared path scope. Soul then +writes `epiphany.soul.verdict_receipt`, Modeling records the +execution/commit/closure-review summary, and Mind writes gateway review plus +state-commit receipts into runtime-spine. The final +`.epiphany/work/work-close-.json` receipt is `epiphany.repo_work_closure_receipt.v0` with `durableStateAdmitted=true`, `publicationGateSatisfied=true`, and `privateStateExposed=false`. It still does not grant publication, merge, @@ -662,6 +669,20 @@ A fifth smoke proved the closure chain on a disposable fresh repo Body: the next tick returned `noop:none`, and every receipt summary reported `privateStateExposed=false`. +A richer closure-review smoke proved the typed Soul/Modeling bridge: +`.epiphany-smoke\closure-review-20260620-135009` ran init -> online -> accept +-> `derive-plan --action-family task-card --model-authored` -> run -> adopt -> +execute -> `close --closure-model-ref smoke-closure-review-v0 --model-authored` +-> overview -> export-proof. The close output carried +`epiphany.repo_work_closure_review.v0`, `pathScopeMatched=true`, +`modelAuthored=true`, Soul `passed`, and `privateStateExposed=false`; overview +included a present `close-review` proof artifact row; redacted public proof +included that row with SHA-256 and no local path fields. A tampered execute +receipt declaring `README.md` while the commit actually changed +`notes/epiphany-work/closure-review-request-task-card.toml` produced +`verification-failed`, Soul `failed`, `pathScopeMatched=false`, and +`privateStateExposed=false`. + `epiphany-work overview` is the first compact repo work sight/proof surface: ```powershell @@ -982,8 +1003,8 @@ No: the machine is not yet Epiphany Online in the full MVP sense. The remaining gap is not "more permission prompts." The remaining gap is to make the existing typed artery run as a living repo organism: -- richer model-authored closure where Soul and Modeling inspect source and - consequences beyond the deterministic mechanical path +- deeper model-authored closure review beyond the first typed + `epiphany.repo_work_closure_review.v0` packet - later non-planning action classes where Imagination can propose useful branch-local work beyond planning cargo without arbitrary shell authority - an Idunn-owned service lifecycle path for the queue-run pulse when the @@ -1009,9 +1030,9 @@ temptation wearing clean robes. | Local Verse online | `epiphany-swarm online` seeds repo-local CultMesh, standing-faculty SoA, topology, liveness, Eve, and tool sight. | Keep private Verse sealed while exposing operator-safe repo status. | | Persona/Bifrost intake | `epiphany-work accept` records pressure and candidate action refs without Hands authority. `epiphany-work persona-intake` now invokes the Persona bubble speech-audit path, records public discussion and candidate-action refs, then delegates to `accept`; wrapper mode `repo-persona-intake` exposes the operator mouth. | Deepen the intake-to-Imagination interpreter so richer model-authored action items can be proposed without granting Hands, publication, or durable-state authority at the mouth edge. | | Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, and `task-card` / `repo.task_card`. `plan` remains manual quarantine scaffolding. | Deepen model-authored closure and any later non-planning action classes without turning model text into arbitrary shell authority. | -| Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan` and `repo-work-service-runbook` write Idunn lifecycle receipts/artifacts for the same queue-run command without launching it. | Add richer safe-family depth next; keep any future queue-run service launch/install behind Idunn and explicit operator authority. | +| Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan` and `repo-work-service-runbook` write Idunn lifecycle receipts/artifacts for the same queue-run command without launching it. | Keep any future queue-run service launch/install behind Idunn and explicit operator authority. | | Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. | -| Soul/Modeling/Mind closure | `close` verifies the Hands commit and writes deterministic Soul, Modeling, and Mind receipts. | Add richer model-authored closure where useful, while preserving deterministic local closure for simple mechanical work. | +| Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, and writes Soul, Modeling, and Mind receipts. | Deepen model-authored closure review beyond the first structured closure-review packet while preserving deterministic local closure for simple mechanical work. | | Repo work sight | `overview` emits compact proof rows and mirrors typed `epiphany.cultmesh.repo_work_overview.v0` event documents plus a latest key; Gjallar enumerates the history as queue rows and non-mutating action rows; Persona's Eve surface and Eve connection readbacks expose peer-readable gate/blocker/next-action rows; `queue-run` consumes the same queue for branch-local scheduler pulses. | Deepen the Persona-to-plan loop without moving action authority out of Hands/Self/Bifrost. | | Publication | `publish` routes Bifrost/GitHub receipts from closure or explicit Soul/Mind refs. | Keep publication Bifrost-owned; do not let scheduler publish. | | Upstream main sync | `sync` proves the published commit is contained by upstream main after explicit merge/sync authority. | Treat upstream-main sync as a required final proof for published work. | @@ -1282,9 +1303,12 @@ Required organs before MVP: without operator shell details. Remaining work is richer closure depth and any later model-authored action classes that move beyond planning cargo while preserving the same authority seals. -- Closure depth: deterministic Soul/Modeling/Mind closure exists for Hands - commits; richer model-authored Soul/Modeling review remains to replace the - current local verification rite where appropriate. +- Closure depth: `close` now writes a structured + `epiphany.repo_work_closure_review.v0` packet for Hands commits, records + model-review provenance when supplied, refuses actual-vs-declared path-scope + mismatch before Soul passes, and exposes the closure-review artifact through + overview/export proof rows. Deeper model-authored Soul/Modeling review remains + a later upgrade on top of this typed packet. - Repo work projection/run surface: local `epiphany-work overview` proof bundles, typed `epiphany.cultmesh.repo_work_overview.v0` event history plus latest-key projection, and Gjallar multi-item `repo-work-overview` action/readback rows diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index f90f3c67..2a89a511 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -103,19 +103,20 @@ remembers doctrine; the branch remembers the blade. - Edge JSON is allowed for schema description, hostile ingress before immediate typed parsing, sealed forensic artifacts, or named quarantine experiments. When both subsystems are ours, runtime data must remain typed CultCache documents and move over CultNet typed contracts. Generic `serde_json::Value` in worker launch/result/selfPatch/runtime flow is contamination until classified and replaced. - Hands now has a first executable action receipt spine. `epiphany-core::hands_gateway` owns `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt`; runtime-spine can persist/reread them; `runtime_spine_persists_mind_gateway_review_receipts` includes the Hands chain beside Mind/Eyes/Substrate/Soul/Continuity proofs and proves the post-timestamp Hands receipt-chain detector; `epiphany-hands-action-smoke` emits intent/review/patch/command/commit receipt ids from `.epiphany-smoke\runtime-spine\hands-action-smoke.msgpack`; and the repo-action launch proof profile now requires action intent, action review, and patch receipt together. `epiphany-mvp-coordinator` now turns `continueImplementation` into a persisted Substrate Gate grant plus Hands intent/review gate and includes the receipt ids in the operator step. `epiphany-hands-action` is the native consequence recorder for that gate: `record-patch`, `record-command`, `record-commit`, and turn-level `record-pass` load the stored intent/review or `finalAction.handsActionGate` from `coordinator-summary.json`, require an approved matching review, enforce allowed operations, and keep patch/commit changed paths inside the requested scope. `epiphany-mvp-coordinator-smoke` includes the deterministic Hands pass proof. The coordinator now treats a complete Hands receipt chain after an accepted Soul result as new implementation evidence, launches Soul again, and routes a passing accepted Soul result to Modeling/modeling before another Hands turn. Work-loop telemetry is now typed internal CultMesh state: Verification role launches write `epiphany.cultmesh.work_loop_telemetry.v0` beside runtime-spine, render that packet for Soul with resolved receipt bodies, commit diff preview, source proof notes, verification assertions, and stdout/stderr previews, and Modeling launches read/enrich the latest packet with Soul acceptance receipt ids before Modeling updates the map. Local Verse prompt context now exposes only a sealed `latest_work_loop_summary` digest with telemetry id, Hands receipt ids, path/source/assertion counts, and Soul receipt ids; receipt payload previews, artifact previews, and commit diff previews remain internal telemetry and are leak-guarded by tests plus `epiphany-verse-query -- smoke`. - `notes/epiphany-swarm-readiness-plan.md` is the current live-fire direction gate. The local runner proves startup/status/coordinator wiring; it does not authorize unattended swarm operation. Carry VoidBot's lessons forward: one CTB-style initiative scheduler, typed pause/brake, active-turn freeze, cooldown after completion, stale active-turn recovery receipts, parent-side speech eligibility, memory lifecycle phases, and typed operation proposals instead of prompt-owned governance. `epiphany-verse-query swarm-brake --brake-status engaged|released` can now write the local Verse brake document, and `tools/epiphany_local_run.ps1` refuses live `plan`/`run`/`mvp` modes when that brake is engaged while keeping `status` readable. `epiphany-mvp-coordinator` also checks `--local-verse-store` before app-server startup, and `epiphany-heartbeat-store` guards tick/pump/heat/queue-mention/routine when passed `--local-verse-store`. Daemon tool invocation, daemon lifecycle poke, and `epiphany-daemon-supervisor` restart/tick/serve/service-plan/service-launch/service-runbook/windows-service-install/windows-service-status/windows-service-reconcile/windows-service-execution-readiness/start/stop attempts now fail closed under a matching engaged brake; supervisor restart now has durable per-daemon policy with cooldown/backoff, explicit scheduled tick pulses, latest scheduler receipts, typed service lifecycle plan/launch/runbook/install/status/reconcile/readiness/start/stop receipts, and local operator wrapper modes that write runbook/install/status/reconcile/readiness/control-plan/execution artifacts plus operator run receipts. The installed-service read path, read-only service-policy reconciliation path, execution-readiness path, non-mutating start/stop control-plan path, and non-elevated execution refusal path have been proved against real Windows `EventLog` service-manager state or safe missing-service targets through local Verse receipts, including explicit wrapper install/start/stop execution modes. The next cut is actual elevated install/start/stop execution proof under operator authority. -- `notes/epiphany-repo-swarm-mvp-contract.md` is the repo-swarm MVP authority map and migration plan. It states the live seventeen-front-door chain from `epiphany-repo init` through `epiphany-swarm run`, `epiphany-work persona-intake`, `derive-plan`, `close`, `overview`, `export-proof`, `tick`, `queue-run`, `publish`, and `sync`, documents the operator-safe proof receipts already proved with `privateStateExposed=false`, and names the remaining MVP organs as richer model-authored closure and later non-planning action classes. Autonomous branch-local work inside the owned repo Body is in scope and desired; Bifrost gates publication/merge/escalation, Idunn owns daemon lifecycle, and `epiphany-work tick` may only advance one safe receipt-backed branch-local step per pulse before stopping at publication gates. `epiphany-work derive-plan` now consumes accepted Persona/Bifrost pressure, writes typed Imagination action-item receipts, then lowers allowlisted safe families into Imagination/Self action plans: `append-worklog` appends to `EPIPHANY_WORKLOG.md`, `planning-note` creates a contained markdown note under `notes/epiphany-work/.md`, `checklist-note` creates a contained checklist, `section-note` / `repo.markdown_managed_section` creates or replaces one marker-bounded markdown section, and `task-card` / `repo.task_card` writes a structured TOML task card under `notes/epiphany-work/-task-card.toml`; the receipts carry `operatorAuthoredShellDetails=false`, authority seals, and no private-state exposure. Disposable smokes proved append-worklog, planning-note, checklist-note, section-note, and task-card routes through branch-local Hands commits; `.epiphany-smoke\section-note-20260620-124416` reached `awaiting-publication` with Soul `passed`, commit `cce53ae6bd86da51fc8651780743fa861e6ca225`, both section markers present, and `privateStateExposed=false`; `.epiphany-smoke\task-card-20260620-133704` reached `awaiting-publication` with `repo.task_card`, `modelAuthored=true`, a committed `notes/epiphany-work/task-card-request-task-card.toml`, authority seals, and `privateStateExposed=false`. `epiphany-work overview` now reads the repo work receipt chain and writes an Eyes/Gjallar-owned sight/proof bundle with current gate, blocker, next safe action, branch, changed paths, commit SHA, Soul verdict, compact rows, and private-state seal; it also mirrors a typed `epiphany.cultmesh.repo_work_overview.v0` document into the repo-local Verse when a local Verse store is known. `epiphany-work export-proof` mirrors redacted public proofs into local Verse, and `epiphany-verse-query bifrost-public-proof` plus wrapper `tools/epiphany_local_run.ps1 -Mode bifrost-public-proof` now publish an existing redacted proof row as `gamecult.bifrost.public_proof_publication_receipt.v0` with public Verse target, public room, ledger, review, credit, proof ref/SHA, and `privateStateExposed=false`; smoke `.epiphany-smoke\checklist-note-20260620-031347` plus wrapper artifact `local-20260620-132418-144-62ba9369` proved latest `bifrost-public-proof-publication-wrapper-checklist` in `bifrost-ledger` and `receipt-directory`. The tick pulse reads the repo-local CultMesh swarm brake and writes `refused-by-swarm-brake` without creating run/adopt/execute receipts when the brake is engaged. It also writes active-turn and last-completed scheduler receipts, refuses live duplicate pulses as `refused-active-turn`, refuses explicit completion-anchored cooldown as `refused-by-cooldown`, clears stale active markers after `--active-timeout-seconds`, and records `physiology.recoveredActiveTurn.recovered=true` when recovery proceeds. `epiphany-work queue-run` reads the repo-local typed overview queue, selects tick-actionable rows for the current repo Body through `awaiting-closure`, delegates to `tick`, refreshes overview after real advancement, and is wrapped by `tools/epiphany_local_run.ps1 -Mode repo-work-queue-run`; `epiphany-swarm run` is the bounded operator mouth over that same queue/tick artery. `epiphany-work serve` wraps the item-scoped tick artery in Self-owned cadence: bounded `--max-iterations` proof mode writes `work-scheduler-serve-.json`, unbounded service mode relies on per-pulse tick receipts, and unbounded zero-second polling is refused. `epiphany-work close` consumes branch-local execute receipts, verifies the Hands commit, writes Soul verdict plus Modeling summary plus Mind gateway/state-commit receipts, and seals `work-close-.json` without granting publication, merge, service lifecycle, cross-repo mutation, or private-state exposure; tick now calls that same close gate after execution. `epiphany-work publish --closure-receipt` can consume the closure's Soul/Mind ids, while tick no-ops once closure exists before Bifrost publication authority. -- 2026-06-20: The same repo-swarm note now carries the explicit migration thesis, MVP status board, Epiphany Online cut order, authority matrix, local CultMesh tool availability doctrine, and upstream-main sync doctrine. `tools/epiphany_local_run.ps1 -Mode repo-work-service-plan` and `-Mode repo-work-service-runbook` now write Idunn-owned non-mutating lifecycle receipts/artifacts for the real `epiphany-work queue-run` command; proofs `local-20260620-021415-094-58439baf` and `local-20260620-021415-147-067c36b0` planned/wrote the queue-run command vector with `privateStateExposed=false` and no service launch/install. Use that note when answering "are we headed toward a functional swarm?" The answer is yes, but only if the remaining cuts preserve typed organ ownership: richer model-authored safe families, proof bundles, and a fresh-repo acceptance run. Persona is the mouth, Imagination plans, Self schedules, Hands acts, Soul verifies, Modeling maps, Mind admits, Gjallar sees, Odin discovers, Idunn keeps daemon physiology alive, Bifrost publishes and credits, and Eve/CultUI renders without becoming truth. -- 2026-06-20: The first repo Persona intake mouth is live. `epiphany-work persona-intake` requires a repo-swarm online receipt, records a Persona bubble/speech-audit witness into repo-local CultMesh, creates public discussion and candidate action refs, delegates to `accept`, and seals `work-persona-intake-.json` without Hands, durable-state, publication, service lifecycle, cross-repo, elevation, or private-state authority. Wrapper mode `tools/epiphany_local_run.ps1 -Mode repo-persona-intake -RepoWorkItem -PersonaInput ''` exposes the operator surface. Disposable proof `.epiphany-smoke\persona-intake-20260620-022500` wrote direct item `persona-request` with speech audit `persona-speech-audit-cdcd20a7`, feedback `repo-work-feedback-persona-request`, consensus `repo-work-consensus-persona-request`, and `privateStateExposed=false`; wrapper artifact `local-20260620-022551-566-5576908e` wrote item `persona-wrapper`, speech audit `persona-speech-audit-55f74218`, feedback `repo-work-feedback-persona-wrapper`, consensus `repo-work-consensus-persona-wrapper`, and candidate action `candidate-action://repo-swarm-local/persona-wrapper/persona-speech-audit-55f74218`. The next cut is richer model-authored closure or later non-planning action classes, not another intake/display surface. -- 2026-06-20: Typed Imagination action-item receipts are live in `epiphany-work derive-plan`. The command now writes `work-action-items-.json` with schema `epiphany.repo_work_imagination_action_items_receipt.v0` before writing `work-plan-.json`; the receipt carries model provenance, safe action family, requested paths, verification asks, stop conditions, escalation reasons, rollback hints, public/candidate refs, `operatorAuthoredShellDetails=false`, and no Hands/durable-state/publication/service/cross-repo authority. The plan derivation cites the action-item receipt, while command text remains deterministic safe-family lowering. Disposable proof `.epiphany-smoke\action-items-20260620-023240` wrote action receipt `repo-work-action-items-action-items-request` with `modelAuthored=true`, `safeActionFamily=repo.markdown_planning_note`, requested path `notes/epiphany-work/action-items-request.md`, plan citation present, and `privateStateExposed=false`. The next cut is richer model-authored closure or later non-planning action classes, not another basic action-item schema. +- `notes/epiphany-repo-swarm-mvp-contract.md` is the repo-swarm MVP authority map and migration plan. It states the live seventeen-front-door chain from `epiphany-repo init` through `epiphany-swarm run`, `epiphany-work persona-intake`, `derive-plan`, `close`, `overview`, `export-proof`, `tick`, `queue-run`, `publish`, and `sync`, documents the operator-safe proof receipts already proved with `privateStateExposed=false`, and names the remaining MVP organs as deeper closure review beyond the first typed packet, later non-planning action classes, Idunn-owned queue-run service lifecycle under explicit operator authority, and fresh-repo acceptance proof. Autonomous branch-local work inside the owned repo Body is in scope and desired; Bifrost gates publication/merge/escalation, Idunn owns daemon lifecycle, and `epiphany-work tick` may only advance one safe receipt-backed branch-local step per pulse before stopping at publication gates. `epiphany-work derive-plan` now consumes accepted Persona/Bifrost pressure, writes typed Imagination action-item receipts, then lowers allowlisted safe families into Imagination/Self action plans: `append-worklog` appends to `EPIPHANY_WORKLOG.md`, `planning-note` creates a contained markdown note under `notes/epiphany-work/.md`, `checklist-note` creates a contained checklist, `section-note` / `repo.markdown_managed_section` creates or replaces one marker-bounded markdown section, and `task-card` / `repo.task_card` writes a structured TOML task card under `notes/epiphany-work/-task-card.toml`; the receipts carry `operatorAuthoredShellDetails=false`, authority seals, and no private-state exposure. Disposable smokes proved append-worklog, planning-note, checklist-note, section-note, and task-card routes through branch-local Hands commits; `.epiphany-smoke\section-note-20260620-124416` reached `awaiting-publication` with Soul `passed`, commit `cce53ae6bd86da51fc8651780743fa861e6ca225`, both section markers present, and `privateStateExposed=false`; `.epiphany-smoke\task-card-20260620-133704` reached `awaiting-publication` with `repo.task_card`, `modelAuthored=true`, a committed `notes/epiphany-work/task-card-request-task-card.toml`, authority seals, and `privateStateExposed=false`. `epiphany-work overview` now reads the repo work receipt chain and writes an Eyes/Gjallar-owned sight/proof bundle with current gate, blocker, next safe action, branch, changed paths, commit SHA, Soul verdict, compact rows, and private-state seal; it also mirrors a typed `epiphany.cultmesh.repo_work_overview.v0` document into the repo-local Verse when a local Verse store is known. `epiphany-work export-proof` mirrors redacted public proofs into local Verse, and `epiphany-verse-query bifrost-public-proof` plus wrapper `tools/epiphany_local_run.ps1 -Mode bifrost-public-proof` now publish an existing redacted proof row as `gamecult.bifrost.public_proof_publication_receipt.v0` with public Verse target, public room, ledger, review, credit, proof ref/SHA, and `privateStateExposed=false`; smoke `.epiphany-smoke\checklist-note-20260620-031347` plus wrapper artifact `local-20260620-132418-144-62ba9369` proved latest `bifrost-public-proof-publication-wrapper-checklist` in `bifrost-ledger` and `receipt-directory`. The tick pulse reads the repo-local CultMesh swarm brake and writes `refused-by-swarm-brake` without creating run/adopt/execute receipts when the brake is engaged. It also writes active-turn and last-completed scheduler receipts, refuses live duplicate pulses as `refused-active-turn`, refuses explicit completion-anchored cooldown as `refused-by-cooldown`, clears stale active markers after `--active-timeout-seconds`, and records `physiology.recoveredActiveTurn.recovered=true` when recovery proceeds. `epiphany-work queue-run` reads the repo-local typed overview queue, selects tick-actionable rows for the current repo Body through `awaiting-closure`, delegates to `tick`, refreshes overview after real advancement, and is wrapped by `tools/epiphany_local_run.ps1 -Mode repo-work-queue-run`; `epiphany-swarm run` is the bounded operator mouth over that same queue/tick artery. `epiphany-work serve` wraps the item-scoped tick artery in Self-owned cadence: bounded `--max-iterations` proof mode writes `work-scheduler-serve-.json`, unbounded service mode relies on per-pulse tick receipts, and unbounded zero-second polling is refused. `epiphany-work close` consumes branch-local execute receipts, verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0` with verification command/exit code, declared-vs-actual git changed paths, commit stat, optional model-review provenance, and authority seals, refuses path-scope mismatches before Soul passes, writes Soul verdict plus Modeling summary plus Mind gateway/state-commit receipts, and seals `work-close-.json` without granting publication, merge, service lifecycle, cross-repo mutation, or private-state exposure; tick now calls that same close gate after execution. `epiphany-work publish --closure-receipt` can consume the closure's Soul/Mind ids, while tick no-ops once closure exists before Bifrost publication authority. +- 2026-06-20: The same repo-swarm note now carries the explicit migration thesis, MVP status board, Epiphany Online cut order, authority matrix, local CultMesh tool availability doctrine, and upstream-main sync doctrine. `tools/epiphany_local_run.ps1 -Mode repo-work-service-plan` and `-Mode repo-work-service-runbook` now write Idunn-owned non-mutating lifecycle receipts/artifacts for the real `epiphany-work queue-run` command; proofs `local-20260620-021415-094-58439baf` and `local-20260620-021415-147-067c36b0` planned/wrote the queue-run command vector with `privateStateExposed=false` and no service launch/install. Use that note when answering "are we headed toward a functional swarm?" The answer is yes, but only if the remaining cuts preserve typed organ ownership: deeper closure review beyond the first typed packet, later non-planning action classes, Idunn-owned queue-run service lifecycle under explicit operator authority, and a fresh-repo acceptance run. Persona is the mouth, Imagination plans, Self schedules, Hands acts, Soul verifies, Modeling maps, Mind admits, Gjallar sees, Odin discovers, Idunn keeps daemon physiology alive, Bifrost publishes and credits, and Eve/CultUI renders without becoming truth. +- 2026-06-20: The first repo Persona intake mouth is live. `epiphany-work persona-intake` requires a repo-swarm online receipt, records a Persona bubble/speech-audit witness into repo-local CultMesh, creates public discussion and candidate action refs, delegates to `accept`, and seals `work-persona-intake-.json` without Hands, durable-state, publication, service lifecycle, cross-repo, elevation, or private-state authority. Wrapper mode `tools/epiphany_local_run.ps1 -Mode repo-persona-intake -RepoWorkItem -PersonaInput ''` exposes the operator surface. Disposable proof `.epiphany-smoke\persona-intake-20260620-022500` wrote direct item `persona-request` with speech audit `persona-speech-audit-cdcd20a7`, feedback `repo-work-feedback-persona-request`, consensus `repo-work-consensus-persona-request`, and `privateStateExposed=false`; wrapper artifact `local-20260620-022551-566-5576908e` wrote item `persona-wrapper`, speech audit `persona-speech-audit-55f74218`, feedback `repo-work-feedback-persona-wrapper`, consensus `repo-work-consensus-persona-wrapper`, and candidate action `candidate-action://repo-swarm-local/persona-wrapper/persona-speech-audit-55f74218`. The next cut is deeper closure review beyond the first packet, later non-planning action classes, Idunn-owned queue-run service execution, or fresh-repo acceptance proof; not another intake/display surface. +- 2026-06-20: Typed Imagination action-item receipts are live in `epiphany-work derive-plan`. The command now writes `work-action-items-.json` with schema `epiphany.repo_work_imagination_action_items_receipt.v0` before writing `work-plan-.json`; the receipt carries model provenance, safe action family, requested paths, verification asks, stop conditions, escalation reasons, rollback hints, public/candidate refs, `operatorAuthoredShellDetails=false`, and no Hands/durable-state/publication/service/cross-repo authority. The plan derivation cites the action-item receipt, while command text remains deterministic safe-family lowering. Disposable proof `.epiphany-smoke\action-items-20260620-023240` wrote action receipt `repo-work-action-items-action-items-request` with `modelAuthored=true`, `safeActionFamily=repo.markdown_planning_note`, requested path `notes/epiphany-work/action-items-request.md`, plan citation present, and `privateStateExposed=false`. The next cut is deeper closure review beyond the first packet, later non-planning action classes, Idunn-owned queue-run service execution, or fresh-repo acceptance proof; not another basic action-item schema. - 2026-06-20: The first richer model-authored safe family is live. `epiphany-work derive-plan --action-family checklist-note` lowers accepted Persona/Bifrost pressure into a contained markdown checklist under `notes/epiphany-work/-checklist.md` with safe family `repo.checklist_note`, model provenance, candidate/public refs, branch-local checklist items, verification asks, rollback hints, and authority seals forbidding publication, merge, service lifecycle, cross-repo mutation, durable-state admission, and private-state exposure. Disposable proof `.epiphany-smoke\checklist-note-20260620-031347` ran accept -> derive-plan with `--model-ref smoke-imagination-v0 --model-authored` -> run -> adopt -> execute on an `epiphany/*` branch; the derivation and action-item receipt both reported `modelAuthored=true`, Hands created a branch-local commit, overview reported `awaiting-closure`, and `privateStateExposed=false`. -- 2026-06-20: `epiphany-swarm run` is live as the bounded repo-swarm operator mouth over Self's queue/tick physiology. It requires the online receipt/local Verse queue, delegates queue selection to `epiphany-work queue-run`, delegates item actuation to `epiphany-work tick`, writes `epiphany.repo_swarm_run_receipt.v0` at `.epiphany\swarm-run\repo-swarm-run-receipt.json`, and keeps publication, merge, service lifecycle, elevation, cross-repo mutation, and private-state exposure sealed. Wrapper mode `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` exposes the surface with brake preflight and compact pulse summaries. Disposable proof `.epiphany-smoke\swarm-run-20260620-024252` first returned dry-run preview `would-advance/run-from-plan`; wrapper artifact `local-20260620-024413-360-85548195` printed the same queue/tick delegation; a non-dry single pulse advanced `swarm-run-request` from `ready-to-run` to refreshed overview `ready-to-adopt` with `privateStateExposed=false`. The next cut is richer model-authored closure or later non-planning action classes, not another queue mouth. -- 2026-06-20: Execute-to-close scheduler handoff is live. `epiphany-work tick` now treats `awaiting-closure` as tick-actionable, delegates executed branch-local work to the existing `epiphany-work close` gate, writes Soul verdict plus Modeling summary plus Mind state-commit receipts, then stops at `awaiting-publication` with Bifrost as blocker. Disposable proof `.epiphany-smoke\tick-close-20260620-025526` ran `epiphany-swarm run --max-iterations 4` through `run-from-plan,adopt-from-plan,execute-from-plan,close-from-execute`; the final overview reported `awaiting-publication` / `bifrost-publication-missing`, and the close receipt was `closed`, Soul `passed`, Mind commit `repo-work-close-tick-close-request-mind-commit`, `durableStateAdmitted=true`, and `privateStateExposed=false` with publication/merge/service/cross-repo authority sealed. The next cut is richer model-authored closure or later non-planning action classes, not another scheduler handoff. -- 2026-06-20: Local proof-bundle packaging is live. `epiphany-work overview` now embeds `epiphany.repo_work_proof_bundle.v0` with generated time, gate/blocker/next-safe-move, compact TUI rows, expected artifact paths, present/missing artifact status, document schema/status, SHA-256 receipt hashes, and `privateStateExposed=false`. Disposable proof `.epiphany-smoke\tick-close-20260620-025526\08-overview-proof-bundle.json` reported six present artifacts from accept through close with hashes, missing publish/sync rows, `awaiting-publication` / `bifrost-publication-missing`, and no private-state exposure. The next cut is richer model-authored closure or later non-planning action classes, not another local proof-bundle wrapper. -- 2026-06-20: Published/credited proof-bundle rows are live. `epiphany-work overview` now adds `publicationRows` to `epiphany.repo_work_proof_bundle.v0`, lifting Bifrost intent/publication/GitHub/ledger/credit/PR fields, Hands commit/PR fields, and upstream-main ancestry fields from publish/sync receipts without granting publication, merge, scheduler, service lifecycle, cross-repo, or private-state authority. Disposable proof `.epiphany-smoke\checklist-note-20260620-031347\12-overview-published-proof.json` ran close -> publish -> sync -> overview after the checklist safe-family proof; overview reported `complete-or-awaiting-new-work`, `upstreamMainSynced=true` from `authority.upstreamMainSynced`, three publication rows, and `privateStateExposed=false`. The next cut is richer public/export packaging outside the local bundle or model-authored closure, not basic Bifrost/GitHub/sync row visibility. -- 2026-06-20: Public proof export is live. `epiphany-work export-proof` calls overview, distills the local `epiphany.repo_work_proof_bundle.v0` into redacted `epiphany.repo_work_public_proof_bundle.v0`, and writes `.epiphany/public/proof-bundles/repo-work-public-proof-.json` by default without raw receipt bodies, local receipt paths, expected paths, worker thought, publication authority, or private Verse exposure. Disposable proof `.epiphany-smoke\checklist-note-20260620-031347\13-export-proof.json` reported eight artifact rows, three publication rows, zero artifact path fields, `rawReceiptBodies=false`, and `private=false`. The next cut is richer model-authored closure or later non-planning action classes; not another local public-proof export wrapper. -- 2026-06-20: Public proof local Verse transport, Bifrost publication closure, and the standard wrapper mouth are live. `epiphany-work export-proof --local-verse-store \.epiphany\local-verse.ccmp` mirrors each redacted export as `epiphany.cultmesh.repo_work_public_proof.v0` under `gamecult-local/repo-work-public-proof/latest`, with compact `PUBLIC-PROOF` TUI rows, artifact/publication row counts, public proof artifact ref, SHA-256, upstream-main sync truth, and `privateStateExposed=false`. `epiphany-verse-query swarm-overview` reads those rows as `repoWorkPublicProofRows` / `repoWorkPublicProofTuiRows`, exposes `latestRepoWorkPublicProof`, and adds non-mutating/non-elevated `repo-work-public-proof` action rows owned by Gjallar sight while Bifrost owns publication/credit consequence. `epiphany-verse-query bifrost-public-proof` and `tools/epiphany_local_run.ps1 -Mode bifrost-public-proof` now write `gamecult.bifrost.public_proof_publication_receipt.v0` from an existing redacted proof row with public Verse target, public room, ledger, review, credit, proof ref/SHA, and private-state refusal; `bifrost-ledger` and `receipt-directory` read it back. Disposable proofs `.epiphany-smoke\checklist-note-20260620-031347\14-export-proof-verse.json`, `15-swarm-overview-public-proof.json`, `21-bifrost-public-proof-publication.json`, `22-bifrost-ledger-after-public-proof-publication.json`, `23-receipt-directory-after-public-proof-publication.json`, wrapper artifact `local-20260620-132418-144-62ba9369`, and `24-bifrost-ledger-after-wrapper-public-proof.json` reported latest `repo-work-public-proof-checklist-request`, publication receipt `bifrost-public-proof-publication-wrapper-checklist`, SHA-256 `e781e09c2ba340c8818d3ef95e54085ccd0c92c6a3b5f73cc4878fb224e49dff`, `publicProofPublicationCount=1`, and `private=false`. The next cut is richer model-authored closure or later non-planning action classes. -- 2026-06-20: `notes/epiphany-repo-swarm-mvp-contract.md` now has the explicit functional-swarm answer. The current seventeen front doors are real proof surfaces, not decorative wrapper smoke, but Epiphany is not fully online until the typed artery can run as a living repo organism: richer Soul/Modeling closure, later non-planning action classes, Idunn-owned queue-run service lifecycle under explicit operator authority, and a fresh-repo acceptance run without supervisor contamination. Use that section when answering whether Epiphany is headed toward a functional swarm. -- 2026-06-20: Gjallar/swarm-overview now exposes repo-work overview history as first-class compact sight, Persona's public Eve surface lowers the same queue for peer-readable collaboration, and Self has a first runnable queue surface over it. `SwarmOverviewOutput` and `SwarmTriageOutput` include `repoWorkOverviewCount`, `repoWorkOverviewRows`, `repoWorkOverviewTuiRows`, `latestRepoWorkOverview`, `latestRepoWorkGate`, `latestRepoWorkBlocker`, and `latestRepoWorkNextSafeMove`; the shared `swarmActionRows` queue gets priority 35 `repo-work-overview` rows owned by Gjallar, hosted body `repo-work`, authority gate `repo.work.overview`, effect class `repo-work-readback`, no mutation, no elevation, proof-bundle ref, and private-state seal. `eve-surfaces`, direct `connect-eve`, and the globally invokable Persona `eve-connect` daemon tool readback expose public `REPO-WORK-PEER` rows with item, gate, blocker, next safe move, branch, publication, sync, and `private=false`. `epiphany-work queue-run` reads the same typed queue, selects current-repo rows at `ready-to-run`, `ready-to-adopt`, `ready-to-execute`, or `awaiting-closure`, delegates to `tick`, refreshes overview after real advancement, and wrapper `repo-work-queue-run` exposes the operator surface. Disposable proofs `.epiphany-smoke\gjallar-repo-work-queue-20260620-012027`, `.epiphany-smoke\eve-repo-work-queue-20260620-013322`, `.epiphany-smoke\queue-run-20260620-014314`, and wrapper artifact `local-20260620-014627-174-aada0241` prove two-item queue sight, Eve lowering, direct queue-run advancement, and wrapper dry-run without publication, merge, service lifecycle mutation, elevation, cross-repo mutation, or private-state exposure. The next cut is richer Persona-to-Imagination plan derivation, not another queue display surface. +- 2026-06-20: `epiphany-swarm run` is live as the bounded repo-swarm operator mouth over Self's queue/tick physiology. It requires the online receipt/local Verse queue, delegates queue selection to `epiphany-work queue-run`, delegates item actuation to `epiphany-work tick`, writes `epiphany.repo_swarm_run_receipt.v0` at `.epiphany\swarm-run\repo-swarm-run-receipt.json`, and keeps publication, merge, service lifecycle, elevation, cross-repo mutation, and private-state exposure sealed. Wrapper mode `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` exposes the surface with brake preflight and compact pulse summaries. Disposable proof `.epiphany-smoke\swarm-run-20260620-024252` first returned dry-run preview `would-advance/run-from-plan`; wrapper artifact `local-20260620-024413-360-85548195` printed the same queue/tick delegation; a non-dry single pulse advanced `swarm-run-request` from `ready-to-run` to refreshed overview `ready-to-adopt` with `privateStateExposed=false`. The next cut is deeper closure review beyond the first packet, later non-planning action classes, Idunn-owned queue-run service execution, or fresh-repo acceptance proof; not another queue mouth. +- 2026-06-20: Execute-to-close scheduler handoff is live. `epiphany-work tick` now treats `awaiting-closure` as tick-actionable, delegates executed branch-local work to the existing `epiphany-work close` gate, writes Soul verdict plus Modeling summary plus Mind state-commit receipts, then stops at `awaiting-publication` with Bifrost as blocker. Disposable proof `.epiphany-smoke\tick-close-20260620-025526` ran `epiphany-swarm run --max-iterations 4` through `run-from-plan,adopt-from-plan,execute-from-plan,close-from-execute`; the final overview reported `awaiting-publication` / `bifrost-publication-missing`, and the close receipt was `closed`, Soul `passed`, Mind commit `repo-work-close-tick-close-request-mind-commit`, `durableStateAdmitted=true`, and `privateStateExposed=false` with publication/merge/service/cross-repo authority sealed. The next cut is deeper closure review beyond the first packet, later non-planning action classes, Idunn-owned queue-run service execution, or fresh-repo acceptance proof; not another scheduler handoff. +- 2026-06-20: Local proof-bundle packaging is live. `epiphany-work overview` now embeds `epiphany.repo_work_proof_bundle.v0` with generated time, gate/blocker/next-safe-move, compact TUI rows, expected artifact paths, present/missing artifact status, document schema/status, SHA-256 receipt hashes, and `privateStateExposed=false`. Disposable proof `.epiphany-smoke\tick-close-20260620-025526\08-overview-proof-bundle.json` reported six present artifacts from accept through close with hashes, missing publish/sync rows, `awaiting-publication` / `bifrost-publication-missing`, and no private-state exposure. The next cut is deeper closure review beyond the first packet, later non-planning action classes, Idunn-owned queue-run service execution, or fresh-repo acceptance proof; not another local proof-bundle wrapper. +- 2026-06-20: Published/credited proof-bundle rows are live. `epiphany-work overview` now adds `publicationRows` to `epiphany.repo_work_proof_bundle.v0`, lifting Bifrost intent/publication/GitHub/ledger/credit/PR fields, Hands commit/PR fields, and upstream-main ancestry fields from publish/sync receipts without granting publication, merge, scheduler, service lifecycle, cross-repo, or private-state authority. Disposable proof `.epiphany-smoke\checklist-note-20260620-031347\12-overview-published-proof.json` ran close -> publish -> sync -> overview after the checklist safe-family proof; overview reported `complete-or-awaiting-new-work`, `upstreamMainSynced=true` from `authority.upstreamMainSynced`, three publication rows, and `privateStateExposed=false`. The next cut is deeper closure review beyond the first packet, later non-planning action classes, Idunn-owned queue-run service execution, or fresh-repo acceptance proof; not basic Bifrost/GitHub/sync row visibility. +- 2026-06-20: Public proof export is live. `epiphany-work export-proof` calls overview, distills the local `epiphany.repo_work_proof_bundle.v0` into redacted `epiphany.repo_work_public_proof_bundle.v0`, and writes `.epiphany/public/proof-bundles/repo-work-public-proof-.json` by default without raw receipt bodies, local receipt paths, expected paths, worker thought, publication authority, or private Verse exposure. Disposable proof `.epiphany-smoke\checklist-note-20260620-031347\13-export-proof.json` reported eight artifact rows, three publication rows, zero artifact path fields, `rawReceiptBodies=false`, and `private=false`. The next cut is deeper closure review beyond the first packet, later non-planning action classes, Idunn-owned queue-run service execution, or fresh-repo acceptance proof; not another local public-proof export wrapper. +- 2026-06-20: Richer repo-work closure review is live. `epiphany-work close` now writes `epiphany.repo_work_closure_review.v0` beside the close receipt, recording verification command/exit code, stdout/stderr artifacts, declared Hands paths, actual git commit paths, path-scope match truth, compact commit stat, optional `--closure-model-ref` / `--model-authored` provenance, and authority seals. Soul only passes when the verification command succeeds and actual git changed paths match the Hands-declared path scope. Disposable proof `.epiphany-smoke\closure-review-20260620-135009` ran task-card work through close with `--closure-model-ref smoke-closure-review-v0 --model-authored`, producing Soul `passed`, `pathScopeMatched=true`, closure-review proof rows in overview/export, and `privateStateExposed=false`; a tampered execute receipt declaring `README.md` while the commit changed `notes/epiphany-work/closure-review-request-task-card.toml` produced `verification-failed`, Soul `failed`, `pathScopeMatched=false`, and no private-state exposure. +- 2026-06-20: Public proof local Verse transport, Bifrost publication closure, and the standard wrapper mouth are live. `epiphany-work export-proof --local-verse-store \.epiphany\local-verse.ccmp` mirrors each redacted export as `epiphany.cultmesh.repo_work_public_proof.v0` under `gamecult-local/repo-work-public-proof/latest`, with compact `PUBLIC-PROOF` TUI rows, artifact/publication row counts, public proof artifact ref, SHA-256, upstream-main sync truth, and `privateStateExposed=false`. `epiphany-verse-query swarm-overview` reads those rows as `repoWorkPublicProofRows` / `repoWorkPublicProofTuiRows`, exposes `latestRepoWorkPublicProof`, and adds non-mutating/non-elevated `repo-work-public-proof` action rows owned by Gjallar sight while Bifrost owns publication/credit consequence. `epiphany-verse-query bifrost-public-proof` and `tools/epiphany_local_run.ps1 -Mode bifrost-public-proof` now write `gamecult.bifrost.public_proof_publication_receipt.v0` from an existing redacted proof row with public Verse target, public room, ledger, review, credit, proof ref/SHA, and private-state refusal; `bifrost-ledger` and `receipt-directory` read it back. Disposable proofs `.epiphany-smoke\checklist-note-20260620-031347\14-export-proof-verse.json`, `15-swarm-overview-public-proof.json`, `21-bifrost-public-proof-publication.json`, `22-bifrost-ledger-after-public-proof-publication.json`, `23-receipt-directory-after-public-proof-publication.json`, wrapper artifact `local-20260620-132418-144-62ba9369`, and `24-bifrost-ledger-after-wrapper-public-proof.json` reported latest `repo-work-public-proof-checklist-request`, publication receipt `bifrost-public-proof-publication-wrapper-checklist`, SHA-256 `e781e09c2ba340c8818d3ef95e54085ccd0c92c6a3b5f73cc4878fb224e49dff`, `publicProofPublicationCount=1`, and `private=false`. The next cut is deeper closure review beyond the first packet, later non-planning action classes, Idunn-owned queue-run service execution, or fresh-repo acceptance proof. +- 2026-06-20: `notes/epiphany-repo-swarm-mvp-contract.md` now has the explicit functional-swarm answer. The current seventeen front doors are real proof surfaces, not decorative wrapper smoke, but Epiphany is not fully online until the typed artery can run as a living repo organism: deeper closure review beyond the first typed packet, later non-planning action classes, Idunn-owned queue-run service lifecycle under explicit operator authority, and a fresh-repo acceptance run without supervisor contamination. Use that section when answering whether Epiphany is headed toward a functional swarm. +- 2026-06-20: Gjallar/swarm-overview now exposes repo-work overview history as first-class compact sight, Persona's public Eve surface lowers the same queue for peer-readable collaboration, and Self has a first runnable queue surface over it. `SwarmOverviewOutput` and `SwarmTriageOutput` include `repoWorkOverviewCount`, `repoWorkOverviewRows`, `repoWorkOverviewTuiRows`, `latestRepoWorkOverview`, `latestRepoWorkGate`, `latestRepoWorkBlocker`, and `latestRepoWorkNextSafeMove`; the shared `swarmActionRows` queue gets priority 35 `repo-work-overview` rows owned by Gjallar, hosted body `repo-work`, authority gate `repo.work.overview`, effect class `repo-work-readback`, no mutation, no elevation, proof-bundle ref, and private-state seal. `eve-surfaces`, direct `connect-eve`, and the globally invokable Persona `eve-connect` daemon tool readback expose public `REPO-WORK-PEER` rows with item, gate, blocker, next safe move, branch, publication, sync, and `private=false`. `epiphany-work queue-run` reads the same typed queue, selects current-repo rows at `ready-to-run`, `ready-to-adopt`, `ready-to-execute`, or `awaiting-closure`, delegates to `tick`, refreshes overview after real advancement, and wrapper `repo-work-queue-run` exposes the operator surface. Disposable proofs `.epiphany-smoke\gjallar-repo-work-queue-20260620-012027`, `.epiphany-smoke\eve-repo-work-queue-20260620-013322`, `.epiphany-smoke\queue-run-20260620-014314`, and wrapper artifact `local-20260620-014627-174-aada0241` prove two-item queue sight, Eve lowering, direct queue-run advancement, and wrapper dry-run without publication, merge, service lifecycle mutation, elevation, cross-repo mutation, or private-state exposure. The next cut is deeper closure review beyond the first packet, later non-planning action classes, Idunn-owned queue-run service execution, or fresh-repo acceptance proof; not another queue display surface. - `service-execution-runbook` makes that next cut repeatable: it generates the exact elevated wrapper command sequence without mutating the service manager, continues after per-step failure to preserve more receipts, runs `service-execution-audit` in `finally`, exits nonzero if any step failed, and seals a typed runbook lifecycle receipt. Run the generated artifact only with explicit operator authority. - `service-execution-audit` is the non-mutating acceptance proof after the elevated rite: it reports `complete` only when typed lifecycle receipts prove the runbook witness plus expected elevated chain, and otherwise reports the missing/failed sealed checks. - `service-tick` is the non-elevated scheduler pulse proof: it writes the latest daemon scheduler receipt through durable policy ownership and local wrapper receipts. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 955b5ce0dffead2ed24ffe4c6c19a6f9a2749d96..365504764053388efac89f00dec8ddfa81b9fb8d 100644 GIT binary patch delta 786 zcmZWnv2GJV5an!Bp;T!QLdu}DzW8Erq8Oz>A_$5!NtXt#cISL6-`y^|b9P+0prA=> zx#bg(C}c2t~#$)oru2>yYE(=Ui@wS`fG3N=KgRzI$Vp3=$@vMqbwlNtucU9MC!Lnfg8`l(}%I;3+42klb&=Co3r9S0SkqIZSGZqTmo7mL5`P z3Q#&tV{*vQ;rd(}i>HEQhN>U>vz*YnuJa_Q55@*=jJOeAFtHr0GcznjDH(}rfT$=l zPSXNBirhbhb5n7a@E$#w@>#xsd4}b`f_)_=B5SA-8sfDKC<3SJN_}9ve*e9{Lw|A&y(>aZR0TQt*YD;-C8#g@+QiIgK24)ge``K9)u&E2IHNXw{8N7!eSUQ wUZSih?3+Ywsqy5<>2d;RCyySVp6nG0Qlaw}HSA`+TK|ztc`mpXPr5t50p+9~V*mgE delta 49 zcmeA adopt-from-plan -> execute-from-plan -> close-from-execute` then no-ops before publication gates, local CultMesh swarm-brake refusal that writes `refused-by-swarm-brake` without creating a run/adopt/execute/close receipt, active-turn refusal through `work-tick-active-.json`, explicit completion-anchored cooldown refusal through `work-tick-last-.json`, stale active-turn recovery that records `physiology.recoveredActiveTurn.recovered=true`, Self-owned `epiphany-work serve` cadence that writes `work-scheduler-serve-.json`, bounded serve proof `advanced:run-from-plan -> refused-by-cooldown:none` without adoption, unbounded zero-interval refusal, deterministic `epiphany-work close` proof that consumes execute receipts, verifies the Hands commit, writes Soul verdict plus Modeling summary plus Mind gateway/state-commit receipts, scheduler proof `.epiphany-smoke\tick-close-20260620-025526` that `epiphany-swarm run --max-iterations 4` reached `awaiting-publication` through `close-from-execute` with Soul passed and Mind committed, local `epiphany-work overview` proof bundle `epiphany.repo_work_proof_bundle.v0` that reports pre-plan `awaiting-plan`/`plan-receipt-missing` and post-close `awaiting-publication`/`bifrost-publication-missing` with branch, commit, changed paths, Soul verdict, compact TUI rows, expected receipt artifact paths, present/missing artifact statuses, document schemas/statuses, SHA-256 receipt hashes, publication rows for Bifrost/GitHub/credit/PR/upstream-main sync, and private seals, public `epiphany-work export-proof` packaging that writes redacted `epiphany.repo_work_public_proof_bundle.v0` artifacts and mirrors `epiphany.cultmesh.repo_work_public_proof.v0` rows into local Verse for Gjallar/Odin sight without local receipt paths, raw receipt bodies, worker thought, or private Verse exposure, Bifrost public-proof publication receipts that bind redacted proof refs/SHA to global public Verse room, ledger, review, and credit readback, typed local Verse projection as `epiphany.cultmesh.repo_work_overview.v0` with latest-key/event-history readback through Gjallar plus peer-readable Persona Eve lowering, `epiphany-work queue-run` selection over tick-actionable queue rows through `awaiting-closure` with wrapper `repo-work-queue-run`, Idunn-owned non-mutating `repo-work-service-plan`/`repo-work-service-runbook` receipts for the same queue-run command, `publish --closure-receipt` consumption of the close receipt's Soul/Mind refs, post-publication tick `noop:none`, task-card proof `.epiphany-smoke\task-card-20260620-133704` with safe family `repo.task_card`, `modelAuthored=true`, branch-local committed TOML task card, authority seals, and `privateStateExposed=false`, and upstream-main ancestry proof after explicit merge receipt. Remaining MVP organs are richer model-authored closure and later non-planning action classes; the scheduler may advance only one safe receipt-backed branch-local step per pulse and must not publish, merge, mutate services, cross repo boundaries, expose private state, or impersonate Idunn. + - Use `notes/epiphany-repo-swarm-mvp-contract.md` as the authority correction and migration plan for repo-swarm autonomy. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruptibility, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Seventeen native repo-swarm front doors are live and documented there: `epiphany-repo init`, `epiphany-swarm online`, `epiphany-swarm run`, `epiphany-work accept`, `epiphany-work persona-intake`, `epiphany-work derive-plan`, `epiphany-work plan`, `epiphany-work run`, `epiphany-work adopt --from-plan`, `epiphany-work execute --from-plan`, `epiphany-work close`, `epiphany-work overview`, `epiphany-work export-proof`, `epiphany-work tick`, `epiphany-work queue-run`, `epiphany-work publish`, and `epiphany-work sync`. Fresh-repo smokes proved the chain with `privateStateExposed=false`, including deterministic Persona/Bifrost pressure-to-plan derivation (`append-worklog`, `planning-note`, `checklist-note`, `section-note`, and `task-card`) into `EPIPHANY_WORKLOG.md`, contained markdown planning notes, contained markdown checklists, a marker-bounded managed markdown section, or a structured TOML task card, typed Imagination action-item receipts (`epiphany.repo_work_imagination_action_items_receipt.v0`) that carry model provenance, safe family, requested paths, verification asks, stop conditions, escalation reasons, and `operatorAuthoredShellDetails=false` before deterministic safe-family command lowering, plan-backed branch-local commit creation, a speech-audited repo Persona intake mouth that records public discussion refs plus candidate action refs before delegating to `accept`, a bounded `epiphany-swarm run` mouth that delegates queue selection to `epiphany-work queue-run` and item actuation to `epiphany-work tick`, a Self-owned tick pulse that advances `run-from-plan -> adopt-from-plan -> execute-from-plan -> close-from-execute` then no-ops before publication gates, local CultMesh swarm-brake refusal that writes `refused-by-swarm-brake` without creating a run/adopt/execute/close receipt, active-turn refusal through `work-tick-active-.json`, explicit completion-anchored cooldown refusal through `work-tick-last-.json`, stale active-turn recovery that records `physiology.recoveredActiveTurn.recovered=true`, Self-owned `epiphany-work serve` cadence that writes `work-scheduler-serve-.json`, bounded serve proof `advanced:run-from-plan -> refused-by-cooldown:none` without adoption, unbounded zero-interval refusal, deterministic `epiphany-work close` proof that consumes execute receipts, verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0` with verification command/exit code, declared-vs-actual git changed paths, compact commit stat, optional model-review provenance, and authority seals, refuses path-scope mismatch before Soul passes, then writes Soul verdict plus Modeling summary plus Mind gateway/state-commit receipts, scheduler proof `.epiphany-smoke\tick-close-20260620-025526` that `epiphany-swarm run --max-iterations 4` reached `awaiting-publication` through `close-from-execute` with Soul passed and Mind committed, closure-review proof `.epiphany-smoke\closure-review-20260620-135009` with Soul passed, `pathScopeMatched=true`, model-review provenance, overview/export `close-review` artifact rows, redacted pathless public proof row, negative tampered-path refusal `pathScopeMatched=false`, and `privateStateExposed=false`, local `epiphany-work overview` proof bundle `epiphany.repo_work_proof_bundle.v0` that reports pre-plan `awaiting-plan`/`plan-receipt-missing` and post-close `awaiting-publication`/`bifrost-publication-missing` with branch, commit, changed paths, Soul verdict, compact TUI rows, expected receipt artifact paths, present/missing artifact statuses, document schemas/statuses, SHA-256 receipt hashes, publication rows for Bifrost/GitHub/credit/PR/upstream-main sync, and private seals, public `epiphany-work export-proof` packaging that writes redacted `epiphany.repo_work_public_proof_bundle.v0` artifacts and mirrors `epiphany.cultmesh.repo_work_public_proof.v0` rows into local Verse for Gjallar/Odin sight without local receipt paths, raw receipt bodies, worker thought, or private Verse exposure, Bifrost public-proof publication receipts that bind redacted proof refs/SHA to global public Verse room, ledger, review, and credit readback, typed local Verse projection as `epiphany.cultmesh.repo_work_overview.v0` with latest-key/event-history readback through Gjallar plus peer-readable Persona Eve lowering, `epiphany-work queue-run` selection over tick-actionable queue rows through `awaiting-closure` with wrapper `repo-work-queue-run`, Idunn-owned non-mutating `repo-work-service-plan`/`repo-work-service-runbook` receipts for the same queue-run command, `publish --closure-receipt` consumption of the close receipt's Soul/Mind refs, post-publication tick `noop:none`, task-card proof `.epiphany-smoke\task-card-20260620-133704` with safe family `repo.task_card`, `modelAuthored=true`, branch-local committed TOML task card, authority seals, and `privateStateExposed=false`, and upstream-main ancestry proof after explicit merge receipt. Remaining MVP organs are deeper closure review beyond the first typed packet, later non-planning action classes, Idunn-owned queue-run service lifecycle under explicit operator authority, and fresh-repo acceptance proof; the scheduler may advance only one safe receipt-backed branch-local step per pulse and must not publish, merge, mutate services, cross repo boundaries, expose private state, or impersonate Idunn. - Gjallar/swarm-overview now projects typed repo-work overview history into the compact global sight report, Persona's public Eve surface lowers the same queue for peers, and Self has a first runnable queue surface over it. `epiphany-verse-query gjallar` reads all `epiphany.cultmesh.repo_work_overview.v0` event documents from local Verse, excludes the `latest` mirror, preserves latest scalar fields, emits multi-item `repoWorkOverviewRows`/TUI rows, and publishes bounded priority 35-39 non-mutating `repo-work-overview` action rows with `owner=Gjallar`, `hostedBody=repo-work`, `authorityGate=repo.work.overview`, `mutatesState=false`, `requiresElevatedAuthority=false`, proof-bundle refs, current gate/blocker/next-safe-move, and `privateStateExposed=false`. `epiphany-verse-query eve-surfaces`, `connect-eve`, and globally invokable Persona `eve-connect` tool readbacks expose compact `REPO-WORK-PEER` rows with item, gate, blocker, next safe move, branch, publication/sync state, and private seal for the public Persona surface only. `epiphany-work queue-run` selects current-repo rows at `ready-to-run`, `ready-to-adopt`, or `ready-to-execute`, delegates action to `tick`, refreshes overview after real advancement, and writes `epiphany.repo_work_queue_run_receipt.v0`; wrapper mode `tools/epiphany_local_run.ps1 -Mode repo-work-queue-run` exposes the same surface. Disposable proofs `.epiphany-smoke\gjallar-repo-work-queue-20260620-012027`, `.epiphany-smoke\eve-repo-work-queue-20260620-013322`, `.epiphany-smoke\queue-run-20260620-014314`, and wrapper artifact `local-20260620-014627-174-aada0241` showed two-item queues through sight, public Eve, direct queue-run, and wrapper dry-run without publication, merge, service lifecycle mutation, elevation, cross-repo mutation, or private-state exposure. - Agent memory lifecycle now has a first typed v0 operation surface in `epiphany-core::agent_memory`: `AgentMemoryLifecycleOperation` can revise, retire, crystallize, prune, and merge bounded memory records after role/agent review, and `epiphany-agent-memory-store review-lifecycle|apply-lifecycle` exposes the path at the operator edge. This closes the first explicit lifecycle-operation slice from the swarm-readiness gate; it does not yet make sleep silently mutate identity or project truth. - Persona public speech now has a parent-side eligibility receipt at the Discord/Aquarium mouth edge. `epiphany.persona_speech_audit.v0` records action kind, content fingerprint, opening/topic keys, recent-window counts, repeated opening/topic counts, channel saturation, and allow/block reasons. `epiphany-persona-discord post` blocks repeated public openings before token/webhook work; draft and bubble still emit audit receipts for operator inspection. The compatibility JSON artifact remains for display, but the durable witness is now `epiphany.cultmesh.persona_speech_audit.v0` in CultMesh with latest-key projection through local Verse context. Local MVP Persona bubbles now write that durable witness to `.epiphany-run/cultmesh/local-verse.ccmp`, not a separate mouth-side store. This is posting-edge policy, not a Persona prompt wish. @@ -634,4 +634,4 @@ current_status: - `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness. - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. - next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, and `task-card` / `repo.task_card`, typed Imagination action-item receipts over allowlisted safe families, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; the contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is still richer model-authored closure or later non-planning action classes. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start execution still requires explicit elevated operator authority. + next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, and `task-card` / `repo.task_card`, typed Imagination action-item receipts over allowlisted safe families, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; the contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper closure review beyond the first typed packet, later non-planning action classes, Idunn-owned queue-run service lifecycle under explicit operator authority, or fresh-repo acceptance proof. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start execution still requires explicit elevated operator authority.