Add repo deployment aftercare audit

epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs

@@ -221,6 +221,44 @@ fn run_smoke(args: Args) -> Result<Value> {
         ],
         &root,
     )?;
+    let idunn_receipt_dir = repo.join(".epiphany").join("work").join("idunn-deployment");
+    fs::create_dir_all(&idunn_receipt_dir)
+        .with_context(|| format!("failed to create {}", idunn_receipt_dir.display()))?;
+    let idunn_deployment_receipt_path = idunn_receipt_dir.join("fixture-idunn-deployment.json");
+    let idunn_aftercare_receipt_path = idunn_receipt_dir.join("fixture-idunn-aftercare.json");
+    write_json(
+        &idunn_deployment_receipt_path,
+        &json!({
+            "schemaVersion": "gamecult.idunn.deployment_receipt.v0",
+            "status": "deployed",
+            "trigger": "git-push-observed-by-idunn",
+            "watchedRef": "refs/heads/main",
+            "privateStateExposed": false
+        }),
+    )?;
+    write_json(
+        &idunn_aftercare_receipt_path,
+        &json!({
+            "schemaVersion": "gamecult.idunn.deployment_aftercare_audit.v0",
+            "status": "complete",
+            "checkedRef": "refs/heads/main",
+            "privateStateExposed": false
+        }),
+    )?;
+    let aftercare = cargo_json(
+        &manifest,
+        "epiphany-work",
+        &[
+            "deployment-aftercare-audit",
+            "--workspace",
+            path_str(&repo)?,
+            "--idunn-deployment-receipt",
+            path_str(&idunn_deployment_receipt_path)?,
+            "--aftercare-audit-receipt",
+            path_str(&idunn_aftercare_receipt_path)?,
+        ],
+        &root,
+    )?;
 
     require_eq(
         &plan,
@@ -343,6 +381,34 @@ fn run_smoke(args: Args) -> Result<Value> {
         &runbook_text,
         "gamecult.idunn.deployment_aftercare_audit.v0",
     )?;
+    require_eq(
+        &aftercare,
+        &["schemaVersion"],
+        "epiphany.repo_deployment_aftercare_audit.v0",
+    )?;
+    require_eq(&aftercare, &["status"], "complete")?;
+    require_bool(&aftercare, &["deploymentComplete"], true)?;
+    require_bool(&aftercare, &["mutatesRemoteWhenRun"], false)?;
+    require_bool(&aftercare, &["executionAuthorized"], false)?;
+    require_bool(&aftercare, &["deploymentAuthority"], false)?;
+    require_bool(&aftercare, &["sshAuthority"], false)?;
+    require_bool(&aftercare, &["gitPushAuthority"], false)?;
+    require_bool(&aftercare, &["serviceLifecycleAuthority"], false)?;
+    require_bool(&aftercare, &["handsAuthority"], false)?;
+    require_bool(&aftercare, &["publicationAuthorized"], false)?;
+    require_bool(&aftercare, &["mergeAuthorized"], false)?;
+    require_bool(&aftercare, &["daemonOwnsExecution"], true)?;
+    require_bool(&aftercare, &["privateStateExposed"], false)?;
+    require_eq(
+        &aftercare,
+        &["idunnDeploymentReceipt", "schemaVersion"],
+        "gamecult.idunn.deployment_receipt.v0",
+    )?;
+    require_eq(
+        &aftercare,
+        &["idunnAftercareAuditReceipt", "schemaVersion"],
+        "gamecult.idunn.deployment_aftercare_audit.v0",
+    )?;
 
     let summary = json!({
         "schemaVersion": "epiphany.repo_deployment_config_family_smoke.v0",
@@ -366,6 +432,8 @@ fn run_smoke(args: Args) -> Result<Value> {
         "deploymentExecutionRunbookSha256": runbook["runbookSha256"],
         "requiresExplicitOperatorAuthority": runbook["requiresExplicitOperatorAuthority"],
         "mutatesRemoteWhenRun": runbook["mutatesRemoteWhenRun"],
+        "deploymentAftercareAuditStatus": aftercare["status"],
+        "deploymentComplete": aftercare["deploymentComplete"],
         "deploymentTrigger": "git-push-observed-by-idunn",
         "deploymentOwner": "Idunn",
         "daemonOwnsExecution": true,

epiphany-core/src/bin/epiphany-work.rs

@@ -126,6 +126,9 @@ fn main() -> Result<()> {
         "deployment-execution-runbook" | "idunn-deployment-runbook" | "deployment-push-runbook" => {
             run_deployment_execution_runbook(parse_deployment_execution_runbook_args(args)?)
         }
+        "deployment-aftercare-audit" | "idunn-aftercare-audit" | "deployment-receipt-audit" => {
+            run_deployment_aftercare_audit(parse_deployment_aftercare_audit_args(args)?)
+        }
         "export-proof" | "public-proof" => run_export_proof(parse_export_proof_args(args)?),
         "tick" | "pulse" | "schedule" => run_tick(parse_tick_args(args)?),
         "queue-run" | "run-queue" | "queue-tick" | "scheduler-run" => {
@@ -341,6 +344,16 @@ struct DeploymentExecutionRunbookArgs {
     write_receipt: bool,
 }
 
+#[derive(Clone, Debug)]
+struct DeploymentAftercareAuditArgs {
+    workspace: PathBuf,
+    artifact_dir: Option<PathBuf>,
+    runbook_receipt: Option<PathBuf>,
+    idunn_deployment_receipt: Option<PathBuf>,
+    aftercare_audit_receipt: Option<PathBuf>,
+    write_receipt: bool,
+}
+
 #[derive(Clone, Debug)]
 struct ExportProofArgs {
     workspace: PathBuf,
@@ -1166,6 +1179,48 @@ fn parse_deployment_execution_runbook_args(
     })
 }
 
+fn parse_deployment_aftercare_audit_args(
+    args: impl Iterator<Item = String>,
+) -> Result<DeploymentAftercareAuditArgs> {
+    let mut workspace = None;
+    let mut artifact_dir = None;
+    let mut runbook_receipt = None;
+    let mut idunn_deployment_receipt = None;
+    let mut aftercare_audit_receipt = None;
+    let mut write_receipt = true;
+
+    let mut args = args.peekable();
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--workspace" => workspace = Some(take_path(&mut args, "--workspace")?),
+            "--artifact-dir" => artifact_dir = Some(take_path(&mut args, "--artifact-dir")?),
+            "--runbook-receipt" => {
+                runbook_receipt = Some(take_path(&mut args, "--runbook-receipt")?)
+            }
+            "--idunn-deployment-receipt" | "--deployment-receipt" => {
+                idunn_deployment_receipt = Some(take_path(&mut args, "--idunn-deployment-receipt")?)
+            }
+            "--aftercare-audit-receipt" | "--aftercare-receipt" => {
+                aftercare_audit_receipt = Some(take_path(&mut args, "--aftercare-audit-receipt")?)
+            }
+            "--no-write" | "--read-only" => write_receipt = false,
+            other => {
+                return Err(anyhow!(
+                    "unexpected deployment-aftercare-audit argument {other:?}"
+                ));
+            }
+        }
+    }
+    Ok(DeploymentAftercareAuditArgs {
+        workspace: workspace.context("missing --workspace")?,
+        artifact_dir,
+        runbook_receipt,
+        idunn_deployment_receipt,
+        aftercare_audit_receipt,
+        write_receipt,
+    })
+}
+
 fn parse_export_proof_args(args: impl Iterator<Item = String>) -> Result<ExportProofArgs> {
     let mut workspace = None;
     let mut item = None;
@@ -10568,6 +10623,151 @@ fn run_deployment_execution_runbook(args: DeploymentExecutionRunbookArgs) -> Res
     Ok(receipt)
 }
 
+fn run_deployment_aftercare_audit(args: DeploymentAftercareAuditArgs) -> Result<Value> {
+    let workspace = args
+        .workspace
+        .canonicalize()
+        .with_context(|| format!("failed to resolve {}", args.workspace.display()))?;
+    ensure_git_repo(&workspace)?;
+    let artifact_dir = args
+        .artifact_dir
+        .unwrap_or_else(|| workspace.join(".epiphany").join("work"));
+    fs::create_dir_all(&artifact_dir)
+        .with_context(|| format!("failed to create {}", artifact_dir.display()))?;
+
+    let receipt_path = artifact_dir.join("deployment-aftercare-audit.json");
+    let runbook_receipt_path = args
+        .runbook_receipt
+        .unwrap_or_else(|| artifact_dir.join("deployment-execution-runbook.json"));
+    let idunn_deployment_receipt_path = args.idunn_deployment_receipt;
+    let aftercare_audit_receipt_path = args.aftercare_audit_receipt;
+    let generated_at = Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true);
+    let mut assertions = Vec::new();
+
+    let runbook_receipt = read_json_if_exists(&runbook_receipt_path)?;
+    let runbook_ready = runbook_receipt.as_ref().is_some_and(|receipt| {
+        string_from_json(receipt, &["schemaVersion"]).as_deref()
+            == Some("epiphany.repo_deployment_execution_runbook.v0")
+            && string_from_json(receipt, &["status"]).as_deref()
+                == Some("ready-for-operator-git-push")
+            && bool_from_json(receipt, &["requiresExplicitOperatorAuthority"]) == Some(true)
+            && bool_from_json(receipt, &["mutatesRemoteWhenRun"]) == Some(true)
+            && bool_from_json(receipt, &["privateStateExposed"]) == Some(false)
+    });
+    push_assertion(
+        &mut assertions,
+        "deployment-runbook-receipt-ready",
+        runbook_ready,
+        "Deployment execution runbook receipt is present, operator-owned, and ready for explicit git-push handoff."
+            .to_string(),
+    );
+
+    let idunn_deployment_summary = if let Some(path) = idunn_deployment_receipt_path.as_ref() {
+        let receipt = read_json(path)?;
+        let schema_ok = string_from_json(&receipt, &["schemaVersion"]).as_deref()
+            == Some("gamecult.idunn.deployment_receipt.v0");
+        let status =
+            string_from_json(&receipt, &["status"]).unwrap_or_else(|| "missing".to_string());
+        let status_ok = matches!(status.as_str(), "ok" | "complete" | "deployed" | "passed");
+        let private_ok =
+            bool_from_json(&receipt, &["privateStateExposed"]).unwrap_or(false) == false;
+        push_assertion(
+            &mut assertions,
+            "idunn-deployment-receipt-valid",
+            schema_ok && status_ok && private_ok,
+            "Idunn deployment receipt carries the expected contract, successful status, and private-state seal."
+                .to_string(),
+        );
+        json!({
+            "path": path,
+            "schemaVersion": string_from_json(&receipt, &["schemaVersion"]).unwrap_or_else(|| "missing".to_string()),
+            "status": status,
+            "privateStateExposed": bool_from_json(&receipt, &["privateStateExposed"]).unwrap_or(false)
+        })
+    } else {
+        push_assertion(
+            &mut assertions,
+            "idunn-deployment-receipt-present",
+            false,
+            "Idunn deployment receipt was not supplied.".to_string(),
+        );
+        Value::Null
+    };
+
+    let aftercare_summary = if let Some(path) = aftercare_audit_receipt_path.as_ref() {
+        let receipt = read_json(path)?;
+        let schema_ok = string_from_json(&receipt, &["schemaVersion"]).as_deref()
+            == Some("gamecult.idunn.deployment_aftercare_audit.v0");
+        let status =
+            string_from_json(&receipt, &["status"]).unwrap_or_else(|| "missing".to_string());
+        let status_ok = matches!(status.as_str(), "ok" | "complete" | "passed");
+        let private_ok =
+            bool_from_json(&receipt, &["privateStateExposed"]).unwrap_or(false) == false;
+        push_assertion(
+            &mut assertions,
+            "idunn-aftercare-audit-receipt-valid",
+            schema_ok && status_ok && private_ok,
+            "Idunn aftercare audit receipt carries the expected contract, successful status, and private-state seal."
+                .to_string(),
+        );
+        json!({
+            "path": path,
+            "schemaVersion": string_from_json(&receipt, &["schemaVersion"]).unwrap_or_else(|| "missing".to_string()),
+            "status": status,
+            "privateStateExposed": bool_from_json(&receipt, &["privateStateExposed"]).unwrap_or(false)
+        })
+    } else {
+        push_assertion(
+            &mut assertions,
+            "idunn-aftercare-audit-receipt-present",
+            false,
+            "Idunn aftercare audit receipt was not supplied.".to_string(),
+        );
+        Value::Null
+    };
+
+    let all_passed = assertions
+        .iter()
+        .all(|assertion| assertion.get("passed").and_then(Value::as_bool) == Some(true));
+    let status = if all_passed {
+        "complete"
+    } else if runbook_ready {
+        "awaiting-idunn-receipts"
+    } else {
+        "runbook-not-ready"
+    };
+    let receipt = json!({
+        "schemaVersion": "epiphany.repo_deployment_aftercare_audit.v0",
+        "auditId": "repo-deployment-aftercare-audit",
+        "generatedAt": generated_at,
+        "status": status,
+        "workspace": workspace,
+        "receiptPath": receipt_path,
+        "runbookReceiptPath": runbook_receipt_path,
+        "idunnDeploymentReceipt": idunn_deployment_summary,
+        "idunnAftercareAuditReceipt": aftercare_summary,
+        "deploymentComplete": status == "complete",
+        "requiresExplicitOperatorAuthority": false,
+        "mutatesRemoteWhenRun": false,
+        "executionAuthorized": false,
+        "deploymentAuthority": false,
+        "sshAuthority": false,
+        "gitPushAuthority": false,
+        "serviceLifecycleAuthority": false,
+        "handsAuthority": false,
+        "publicationAuthorized": false,
+        "mergeAuthorized": false,
+        "crossBodyMutationAuthorized": false,
+        "daemonOwnsExecution": true,
+        "assertions": assertions,
+        "privateStateExposed": false
+    });
+    if args.write_receipt {
+        write_json(&receipt_path, &receipt)?;
+    }
+    Ok(receipt)
+}
+
 fn run_export_proof(args: ExportProofArgs) -> Result<Value> {
     let workspace = args
         .workspace
@@ -12724,7 +12924,7 @@ fn sanitize(value: &str) -> String {
 
 fn print_usage() {
     eprintln!(
-        "usage: epiphany-work <persona-intake|accept|derive-plan|plan|run|adopt|execute|close|publish|sync|overview|deployment-config-audit|deployment-execution-runbook|export-proof|tick|queue-run|serve> ...\n\
+        "usage: epiphany-work <persona-intake|accept|derive-plan|plan|run|adopt|execute|close|publish|sync|overview|deployment-config-audit|deployment-execution-runbook|deployment-aftercare-audit|export-proof|tick|queue-run|serve> ...\n\
          persona-intake --workspace <repo> --item <id> --message <text> [--topic <topic>] [--store <local-verse.ccmp>] [--runtime-id <id>]\n\
          accept --workspace <repo> --from <persona|bifrost|persona-or-bifrost> --item <id> [--summary <text>] [--topic <topic>] [--store <local-verse.ccmp>] [--runtime-id <id>] [--online-receipt <path>] [--public-discussion-ref <ref>] [--candidate-action-ref <ref>]\n\
          derive-plan --workspace <repo> [--item <id>] [--accept-receipt <path>] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card|repo-manifest|repo-tool-capabilities|repo-tool-request|repo-eve-surface|repo-collaboration-policy|repo-collaboration-topic|repo-consensus-brief|repo-objective-draft|repo-adoption-request|repo-scheduling-request|repo-work-order|repo-verification-request|repo-publication-request|repo-sync-request|repo-maintainer-review-request|repo-pr-request|repo-credit-request|repo-artifact-acceptance-request|repo-metrics-request|repo-doctrine-update-request|repo-secret-policy-request|repo-deployment-config|repo-deployment-request] [--target-path <path>] [--model-ref <ref>] [--model-authored] [--action-summary <text>] [--verification-ask <text>] [--stop-condition <text>] [--escalation-reason <text>] [--assumption <text>] [--constraint <text>] [--non-goal <text>] [--open-question <text>] [--decision-point <text>] [--evidence-need <text>]\n\
@@ -12738,6 +12938,7 @@ fn print_usage() {
          overview --workspace <repo> [--item <id>] [--accept-receipt <path>] [--no-write]\n\
          deployment-config-audit --workspace <repo> [--artifact-dir <path>] [--no-write]\n\
          deployment-execution-runbook --workspace <repo> [--artifact-dir <path>] [--remote origin] [--no-write]\n\
+         deployment-aftercare-audit --workspace <repo> [--artifact-dir <path>] [--runbook-receipt <path>] [--idunn-deployment-receipt <path>] [--aftercare-audit-receipt <path>] [--no-write]\n\
          export-proof --workspace <repo> [--item <id>] [--accept-receipt <path>] [--output <path>] [--local-verse-store <path>] [--runtime-id repo-swarm-local]\n\
          tick --workspace <repo> [--item <id>] [--local-verse-store <path>] [--runtime-store <path>] [--dry-run]\n\
          queue-run --workspace <repo> [--local-verse-store <path>] [--runtime-id repo-swarm-local] [--max-items 1] [--dry-run]"

notes/epiphany-repo-swarm-mvp-contract.md

@@ -804,6 +804,20 @@ Hands, publication, merge, and cross-body authority false. Smoke
 `.epiphany-smoke\repo-deployment-config-family-20260620-214109` proved the
 runbook beside config close and audit.
 
+The post-push receipt mouth is now explicit as well.
+`epiphany-work deployment-aftercare-audit --workspace <repo>
+--idunn-deployment-receipt <path> --aftercare-audit-receipt <path>` reads the
+operator runbook receipt plus supplied Idunn deployment and aftercare receipts,
+checks `gamecult.idunn.deployment_receipt.v0` and
+`gamecult.idunn.deployment_aftercare_audit.v0`, and emits
+`epiphany.repo_deployment_aftercare_audit.v0`. It reports `complete` only when
+the runbook is ready and both Idunn receipts carry successful statuses and
+private-state seals; otherwise it reports the missing gate without mutating
+remote refs or granting deployment authority. Smoke
+`.epiphany-smoke\repo-deployment-config-family-20260620-215037` proved the
+complete ingestion path from explicit fixture receipts with
+`deploymentComplete=true` and `privateStateExposed=false`.
+
 ### Landed Work Run Gate
 
 The sixth front door exists as native Rust:

notes/fresh-workspace-handoff.md

@@ -128,6 +128,7 @@ remembers doctrine; the branch remembers the blade.
 - 2026-06-20: Gjallar now has a branch lens over Mind-admitted repo-work maps. `repoWorkMapBranchLensRows` / `REPO-WORK-MAP-BRANCH` group accepted map consequences by branch with item count, changed-path count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`. Smoke `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-210747` reran the counterfeit-adoption guard and proved `gjallarRepoWorkMapBranchLensCount=1` alongside the family/path lenses. This is branch-workbench sight only: Gjallar still does not schedule, publish, merge, deploy, keep daemons alive, or admit Mind state.
 - 2026-06-20: `epiphany-work deployment-config-audit` is live as the non-mutating Idunn handoff readback for repo deployment config. It reads `.epiphany/deployment.toml`, writes `epiphany.repo_deployment_config_audit.v0`, reports `ready-for-idunn-review` only when the disabled git-push Idunn trigger, CultMesh intent/receipt/aftercare contracts, required receipts, and authority seals are present, and always keeps execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-213042` proved the audit beside the `repo.deployment_config` close path with `daemonOwnsExecution=true`, `readyForIdunnReview=true`, and `privateStateExposed=false`.
 - 2026-06-20: `epiphany-work deployment-execution-runbook` is live as the explicit operator-owned git-push handoff for Idunn deployment. It requires the deployment config audit to pass, writes `.epiphany/work/idunn-deployment/idunn-git-push-runbook.ps1`, emits `epiphany.repo_deployment_execution_runbook.v0`, reports `ready-for-operator-git-push`, includes the exact `git push origin HEAD:refs/heads/main` route, runbook SHA-256, and required Idunn deployment/aftercare receipt contracts, and marks `requiresExplicitOperatorAuthority=true` plus `mutatesRemoteWhenRun=true` while keeping execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false for the repo agent. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-214109` proved the runbook with `deploymentExecutionRunbookStatus=ready-for-operator-git-push`, SHA-256 `57560eda912b6e5c15f97acf53500534bb3bcf739098f329add3d88e5a9cd1d3`, and `privateStateExposed=false`.
+- 2026-06-20: `epiphany-work deployment-aftercare-audit` is live as the post-operator Idunn receipt ingestion mouth. It reads the deployment runbook receipt plus explicit `gamecult.idunn.deployment_receipt.v0` and `gamecult.idunn.deployment_aftercare_audit.v0` files, emits `epiphany.repo_deployment_aftercare_audit.v0`, reports `complete` only when both Idunn receipts have successful statuses and private-state seals, and remains non-mutating with deployment/SSH/git-push/service/Hands/publication/merge authority false. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-215037` proved the complete path with fixture Idunn receipts, `deploymentAftercareAuditStatus=complete`, `deploymentComplete=true`, and `privateStateExposed=false`.
 - 2026-06-20: Deeper model-authored closure review is now live. `epiphany-work close` accepts `--closure-model-verdict passed|failed|needs-work|blocked`, `--closure-model-finding`, and `--require-closure-model-verdict`; the close review embeds `epiphany.repo_work_model_closure_review.v0` under `modelingReview.closureReview`, records reviewed inputs and gate enforcement, and Soul refuses closure when a supplied or required model verdict does not pass. Focused smoke `.epiphany-smoke\closure-model-gate-20260620-135103` created a disposable repo, ran two `repo.status_section` items through public front doors, closed one with required model verdict `passed`, and blocked one with `needs-work` while `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - 2026-06-20: Mind adoption/interpreter depth now has a concrete interpretation packet. `epiphany-work adopt` writes `epiphany.repo_work_mind_adoption_decision.v0` before the main adoption receipt, embeds `epiphany.repo_work_mind_interpretation.v0` with input summary, safe-family recognition, requested-path classification, allowed branch-local Hands transition, and forbidden durable-state/publication/service/private transitions, then records Self presentation, Mind evidence review, safe-family requirement, branch-local scope, Bifrost publication gate, Soul closure requirement, and no Hands/durable-state/publication/merge/service/cross-body/private authority inside the Mind decision; the main adoption receipt cites that decision before granting branch-local Hands authority. Focused smoke `.epiphany-smoke\repo-planning-facets-20260620-175503` proves model-authored planning facets survive into Imagination, plan derivation, Mind interpretation, Mind decision, and adoption, while close still passes Soul/family/path checks with `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics beyond the first Mind interpretation packet, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - 2026-06-20: `repo-manifest` is now the next non-planning safe family. `epiphany-work derive-plan --action-family repo-manifest` lowers accepted pressure into a structured `epiphany.toml` Body manifest with safe family `repo.body_manifest`, body domain, private/local/public Verse ids, Eve surface id, receipt-required capability hints, arbitrary shell sealed false, and private-state seals. Soul closure assertions now inspect the committed manifest for schema, safe family, summary, body domain, Verse ids, Eve surface, receipt requirement, no arbitrary shell, and private-state seals. Focused smoke `.epiphany-smoke\repo-manifest-family-20260620-141552` ran a disposable repo through init -> online -> accept -> repo-manifest derive-plan -> tick run/adopt/execute/close; Hands committed only `epiphany.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, additional useful repo-owned config/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.

state/map.yaml

@@ -88,7 +88,7 @@ active_subgoals:
   - Keep the landed Phase 6 coordinator, limited safe-boundary CRRC automation, and pre-compaction checkpoint intervention ready for the next bridge-equipped dogfood run.
   - Preserve the Ghostlight-derived heartbeat initiative seam: every lane, including coordinator/Self and Persona, has a organ-state record and competes for heartbeat slots through readiness/reaction timing; initiative heat can raise or cool global, group, arena, role, and agent tempo through typed heartbeat policy; active thinking freezes initiative until completion, so heat never queues a lane already mid-turn; idle winners ruminate instead of inventing project work, and sleep windows distill the accumulated thought pressure into reviewed self-memory or doctrine.
   - Use `notes/epiphany-swarm-readiness-plan.md` as the live-fire direction gate. The local run path is a compass, not launch clearance: before unattended swarm operation, Epiphany needs typed pause/brake enforcement, one initiative scheduler, completion-gated cooldown, stale active-turn recovery receipts, parent-side Persona speech eligibility, memory lifecycle operations, and CultNet-first operator snapshots/intents/receipts. The local Verse brake document exists, `epiphany-verse-query swarm-brake` can engage/release it, `tools/epiphany_local_run.ps1` refuses live `plan`/`run`/`mvp` modes when the brake is engaged while leaving `status` readable, `epiphany-mvp-coordinator` checks the local Verse brake before app-server startup, and `epiphany-heartbeat-store` guards tick/pump/heat/queue-mention/routine when given `--local-verse-store`. Daemon liveness is now a typed local Verse authority: `epiphany-verse-query daemon-status` writes one daemon status without repainting the table, local Verse seeding preserves existing daemon statuses and swarm brakes, `invoke-tool` refuses when the host daemon is not ready or lacks `submitTypedToolIntent`, and both daemon tool invocation and lifecycle poke fail closed under an engaged matching brake. `epiphany-daemon-supervisor policy` writes durable per-daemon restart policy with command/args/cwd/cooldown/backoff/attempt state plus reconcile cadence and stale-heartbeat threshold; `epiphany-daemon-supervisor reconcile` loads that policy when no override command is supplied, refuses under a matching lifecycle brake, refuses during cooldown/backoff, writes daemon poke intent/receipt, updates daemon status, and updates policy attempt state; `epiphany-daemon-supervisor tick` is an explicit scheduler pulse that scans durable policies, records ready/noop pulses, skips before the configured reconcile interval, marks stale heartbeat status degraded, routes restarts through the same brake/cooldown/poke receipt path, and writes a latest `epiphany.cultmesh.daemon_scheduler_receipt.v0`; `epiphany-daemon-supervisor serve` runs that same pulse on a configurable cadence with bounded `--max-iterations` proof mode or unbounded service mode. `epiphany-daemon-supervisor service-plan`/`install-service` now writes a planned `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` for the `serve` command, while `service-launch`/`start-service` spawns that `serve` loop through the current executable or `--service-command`, can `--wait-child` for bounded proof, and records command/args/cwd, scheduler id, daemon selector, pid/exit/status, artifact ref, and private-state guard. `service-runbook`, `windows-service-install`/`service-install-plan`, `windows-service-status`, `windows-service-reconcile`, `windows-service-execution-readiness`, and `windows-service-start`/`stop` now record service lifecycle receipts through the same local Verse; the read-only status path has been proved against the real Windows `EventLog` service with receipt `daemon-service-lifecycle-receipt-windows-eventlog-proof-windows-service-status`, status `running`, exit code `0`, and `privateStateExposed=false`; the read-only service-policy reconciliation path has been proved for missing service, real-service drift against `EventLog`, lifecycle-brake refusal, and wrapper/local-Verse receipt `daemon-service-lifecycle-receipt-windows-eventlog-reconcile-proof-windows-service-reconcile`; execution readiness has been proved as a non-mutating `not-elevated` receipt through direct and wrapper paths; start/stop now produce non-mutating `start-planned`/`stop-planned` receipts unless `--execute-control`/`--execute-service-control` is passed, and wrapper `service-start-plan`/`service-stop-plan` proves those receipts against `EventLog`; explicit install/control execution now refuses as `execution-refused-not-elevated` with `executed=false` when the shell lacks Windows administrator authority, and wrapper `service-install-execute`, `service-start-execute`, and `service-stop-execute` prove those refusal receipts without mutation. Service lifecycle actions check the local Verse swarm brake before process launch, artifact writes, service-manager queries, service-policy reconciliation, execution-readiness checks, control planning, elevation-gated execution, or start/stop execution. The local wrapper builds/checks this binary.
-  - Use `notes/epiphany-repo-swarm-mvp-contract.md` as the repo-swarm autonomy authority map. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruption, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Current safe-family cargo includes repo manifest, tool capability manifest, daemon-hosted tool request cargo, Eve/CultUI surface contract, repo collaboration policy, collaboration topics, consensus/objective/adoption/scheduling/work-order/verification/publication/sync/review/PR/credit/artifact/metrics/doctrine-update/secret-policy/deployment requests, repo deployment config, action-item receipts, Mind adoption interpretation/decision receipts, explicit Mind safe-family refusal proof `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, explicit Mind requested-path/plan changed-path refusal proof `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, overview/public-proof/Gjallar/Eve readbacks, typed swarm-run stop classification, Idunn non-mutating queue-run lifecycle receipts, and fresh-repo upstream-main proof. Latest deployment config proof `.epiphany-smoke\repo-deployment-config-family-20260620-214109` shows `repo.deployment_config` closes through Soul, `epiphany-work deployment-config-audit` emits `epiphany.repo_deployment_config_audit.v0` with status `ready-for-idunn-review`, and `epiphany-work deployment-execution-runbook` emits `epiphany.repo_deployment_execution_runbook.v0` with status `ready-for-operator-git-push`, runbook SHA-256 `57560eda912b6e5c15f97acf53500534bb3bcf739098f329add3d88e5a9cd1d3`, `requiresExplicitOperatorAuthority=true`, `mutatesRemoteWhenRun=true`, `daemonOwnsExecution=true`, and no repo-agent execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority. Latest deployment request proof `.epiphany-smoke\repo-deployment-request-family-20260620-195605` shows `repo.deployment_request` closes through Soul while requesting reviewed git-push-observed-by-Idunn deployment with script/host/secret/rollback/aftercare requirements and no deployment/SSH/git-push/service authority. Latest security cargo proof `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` shows `repo.secret_policy_request` closes through Soul while requesting reviewed secret/write/export/deployment policy without exposing secrets or granting write/deployment/publication authority. Governance proof `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` shows `repo.doctrine_update_request` closes through Soul while requesting reviewed `AGENTS.md` doctrine work without mutating doctrine or granting Hands/service/publication authority. Swarm-run stop proofs now include `.epiphany-smoke\fresh-repo-mvp-20260620-180024` for `iteration-limit` / Self / `self.scheduler-iteration-limit` with upstream-main sync and public-proof export, plus `.epiphany-smoke\swarm-stop-classification-20260620-184717` for `queue-empty` / Gjallar / `repo.work.overview`, `dry-run-preview` / Self / `ready-to-run`, `authority-gated` / Bifrost / `awaiting-publication`, and `authority-gated` / Bifrost/GitHub / `awaiting-upstream-sync`; all stop packets are non-mutating, non-elevated, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853` now proves Idunn-owned non-mutating repo-work queue-run service plan/runbook receipts for exact service id `epiphany-repo-work-queue-runner`, receipt-directory readback, runbook SHA-256 `f2ec67c4f8243a3ebc2f9e915b6b9f5ae2ac2d99d2cdb86905b54667adc456f8`, `hostedBody=repo-work`, no service-manager mutation, no launch, no elevation, and `privateStateExposed=false`.
+  - Use `notes/epiphany-repo-swarm-mvp-contract.md` as the repo-swarm autonomy authority map. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruption, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Current safe-family cargo includes repo manifest, tool capability manifest, daemon-hosted tool request cargo, Eve/CultUI surface contract, repo collaboration policy, collaboration topics, consensus/objective/adoption/scheduling/work-order/verification/publication/sync/review/PR/credit/artifact/metrics/doctrine-update/secret-policy/deployment requests, repo deployment config, action-item receipts, Mind adoption interpretation/decision receipts, explicit Mind safe-family refusal proof `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, explicit Mind requested-path/plan changed-path refusal proof `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, overview/public-proof/Gjallar/Eve readbacks, typed swarm-run stop classification, Idunn non-mutating queue-run lifecycle receipts, and fresh-repo upstream-main proof. Latest deployment proof `.epiphany-smoke\repo-deployment-config-family-20260620-215037` shows `repo.deployment_config` closes through Soul, `deployment-config-audit` reports `ready-for-idunn-review`, `deployment-execution-runbook` reports `ready-for-operator-git-push`, and `deployment-aftercare-audit` ingests explicit Idunn deployment/aftercare receipts with status `complete`, `deploymentComplete=true`, `daemonOwnsExecution=true`, no repo-agent execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority, and `privateStateExposed=false`. Latest deployment request proof `.epiphany-smoke\repo-deployment-request-family-20260620-195605` shows `repo.deployment_request` closes through Soul while requesting reviewed git-push-observed-by-Idunn deployment with script/host/secret/rollback/aftercare requirements and no deployment/SSH/git-push/service authority. Latest security cargo proof `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` shows `repo.secret_policy_request` closes through Soul while requesting reviewed secret/write/export/deployment policy without exposing secrets or granting write/deployment/publication authority. Governance proof `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` shows `repo.doctrine_update_request` closes through Soul while requesting reviewed `AGENTS.md` doctrine work without mutating doctrine or granting Hands/service/publication authority. Swarm-run stop proofs now include `.epiphany-smoke\fresh-repo-mvp-20260620-180024` for `iteration-limit` / Self / `self.scheduler-iteration-limit` with upstream-main sync and public-proof export, plus `.epiphany-smoke\swarm-stop-classification-20260620-184717` for `queue-empty` / Gjallar / `repo.work.overview`, `dry-run-preview` / Self / `ready-to-run`, `authority-gated` / Bifrost / `awaiting-publication`, and `authority-gated` / Bifrost/GitHub / `awaiting-upstream-sync`; all stop packets are non-mutating, non-elevated, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853` now proves Idunn-owned non-mutating repo-work queue-run service plan/runbook receipts for exact service id `epiphany-repo-work-queue-runner`, receipt-directory readback, runbook SHA-256 `f2ec67c4f8243a3ebc2f9e915b6b9f5ae2ac2d99d2cdb86905b54667adc456f8`, `hostedBody=repo-work`, no service-manager mutation, no launch, no elevation, and `privateStateExposed=false`.
   - Mind-admitted repo-work map facts now leave local Verse sight. Successful `epiphany-work close` first admits `.epiphany/state/repo-work-map.msgpack` as `epiphany.repo_work_map_store.v0`, then mirrors the accepted item fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0` under `gamecult-local/repo-work-map/latest`. `epiphany-verse-query gjallar` exposes `repoWorkMapRows`, `repoWorkMapTuiRows`, and `latestRepoWorkMapEntry` with safe family, changed-path count, Soul verdict id, Mind review/commit ids, Bifrost gate, source map store ref, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` plus direct Gjallar readback showed one compact `REPO-WORK-MAP` row after counterfeit Mind adoption was refused and the real close passed. This is sight only; Gjallar still does not schedule, publish, merge, deploy, keep daemons alive, or open private state.
   - Gjallar now derives the first repo-work map semantic lens from Mind-admitted local Verse map rows. `repoWorkMapFamilyLensRows` / `REPO-WORK-MAP-LENS` group accepted repo-work consequences by safe action family, with item count, changed-path count, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205055` reran the counterfeit-adoption guard and passed with `gjallarRepoWorkMapFamilyLensCount=1`. This is aggregate sight only, not scheduling, publication, merge, deployment, service lifecycle, or Mind admission authority.
   - Gjallar now derives a changed-path repo-work map lens from the same Mind-admitted local Verse rows. `repoWorkMapPathLensRows` / `REPO-WORK-MAP-PATH` group accepted consequences by changed repo path, with item count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205740` passed with `gjallarRepoWorkMapPathLensCount=1` beside the family lens. This lets agents see which Body paths have accepted work without opening private receipts or granting Gjallar actuation authority.
@@ -638,5 +638,5 @@ current_status:
   - `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness.
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
-  last_completed_repo_swarm_cut: `epiphany-work deployment-execution-runbook` is now the explicit operator-owned git-push handoff for branch-local Idunn deployment configuration. It requires `deployment-config-audit` to pass, writes `.epiphany/work/idunn-deployment/idunn-git-push-runbook.ps1`, emits `epiphany.repo_deployment_execution_runbook.v0`, reports `ready-for-operator-git-push`, includes the exact `git push origin HEAD:refs/heads/main` route, required Idunn deployment/aftercare receipts, and runbook SHA-256, and marks `requiresExplicitOperatorAuthority=true` plus `mutatesRemoteWhenRun=true` while keeping repo-agent execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false. Proof `.epiphany-smoke\repo-deployment-config-family-20260620-214109` closed the `repo.deployment_config` family through Soul, proved config audit readiness, and proved the runbook with SHA-256 `57560eda912b6e5c15f97acf53500534bb3bcf739098f329add3d88e5a9cd1d3` and `privateStateExposed=false`.
-  next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `task-card` / `repo.task_card`, `repo-status-section` / `repo.status_section`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo.doctrine_update_request`, `repo.secret_policy_request`, `repo.deployment_config`, and `repo.deployment_request`, typed Imagination action-item receipts over allowlisted safe families, `epiphany.repo_work_mind_interpretation.v0` plus `epiphany.repo_work_mind_adoption_decision.v0` Mind interpreter receipts, explicit safe-family allowlist refusal, explicit requested-path/plan-changed-path mismatch refusal, Soul closure's Mind-adoption proof guard, durable repo-work map admission before branch-local Hands consequences reach publication gates, local Verse `epiphany.cultmesh.repo_work_map_entry.v0` Gjallar readback for Mind-admitted map facts, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts including native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853`, non-mutating `epiphany-work deployment-config-audit` plus operator-owned `epiphany-work deployment-execution-runbook` proof `.epiphany-smoke\repo-deployment-config-family-20260620-214109`, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; proofs `.epiphany-smoke\fresh-repo-mvp-20260620-180024`, `.epiphany-smoke\swarm-stop-classification-20260620-184717`, `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140`, `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046`, `.epiphany-smoke\repo-deployment-config-family-20260620-214109`, `.epiphany-smoke\repo-deployment-request-family-20260620-195605`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-201153`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-202113`, and `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` show fresh-repo iteration-limit stop classification, empty-queue Gjallar classification, dry-run planning-preview Self classification, Bifrost publication-gate classification, Bifrost/GitHub upstream-sync gate classification, Mind refusal for unsupported safe-family cargo and mismatched requested paths, reviewed doctrine/security/deployment config/request cargo, deployment-config audit readiness for Idunn review, deployment execution runbook readiness for explicit operator git-push handoff, closure refusal for counterfeit Mind adoption, durable repo-map admission only after passing closure, local Verse/Gjallar map projection, closure, publication receipts, upstream-main sync, public-proof export, and private-state sealing. The contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper interpreter/closure depth or actual Idunn deployment aftercare receipt ingestion once an operator-run deployment exists. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start/deployment execution still requires explicit elevated operator authority.
+  last_completed_repo_swarm_cut: `epiphany-work deployment-aftercare-audit` is now the non-mutating post-operator Idunn receipt ingestion mouth for branch-local deployment. It reads the deployment runbook receipt plus explicit `gamecult.idunn.deployment_receipt.v0` and `gamecult.idunn.deployment_aftercare_audit.v0` files, emits `epiphany.repo_deployment_aftercare_audit.v0`, reports `complete` only when the runbook is ready and both Idunn receipts have successful statuses and private-state seals, and keeps repo-agent execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false. Proof `.epiphany-smoke\repo-deployment-config-family-20260620-215037` closed the `repo.deployment_config` family through Soul, proved config audit, runbook generation, and complete aftercare ingestion with `deploymentComplete=true` and `privateStateExposed=false`.
+  next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `task-card` / `repo.task_card`, `repo-status-section` / `repo.status_section`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo.doctrine_update_request`, `repo.secret_policy_request`, `repo.deployment_config`, and `repo.deployment_request`, typed Imagination action-item receipts over allowlisted safe families, `epiphany.repo_work_mind_interpretation.v0` plus `epiphany.repo_work_mind_adoption_decision.v0` Mind interpreter receipts, explicit safe-family allowlist refusal, explicit requested-path/plan-changed-path mismatch refusal, Soul closure's Mind-adoption proof guard, durable repo-work map admission before branch-local Hands consequences reach publication gates, local Verse `epiphany.cultmesh.repo_work_map_entry.v0` Gjallar readback for Mind-admitted map facts, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts including native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853`, deployment config/audit/runbook/aftercare ingestion proof `.epiphany-smoke\repo-deployment-config-family-20260620-215037`, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; proofs `.epiphany-smoke\fresh-repo-mvp-20260620-180024`, `.epiphany-smoke\swarm-stop-classification-20260620-184717`, `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140`, `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046`, `.epiphany-smoke\repo-deployment-config-family-20260620-215037`, `.epiphany-smoke\repo-deployment-request-family-20260620-195605`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-201153`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-202113`, and `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` show fresh-repo iteration-limit stop classification, empty-queue Gjallar classification, dry-run planning-preview Self classification, Bifrost publication-gate classification, Bifrost/GitHub upstream-sync gate classification, Mind refusal for unsupported safe-family cargo and mismatched requested paths, reviewed doctrine/security/deployment config/request cargo, deployment-config audit readiness for Idunn review, deployment execution runbook readiness for explicit operator git-push handoff, deployment aftercare receipt ingestion, closure refusal for counterfeit Mind adoption, durable repo-map admission only after passing closure, local Verse/Gjallar map projection, closure, publication receipts, upstream-main sync, public-proof export, and private-state sealing. The contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper interpreter/closure depth or routing real Idunn receipt refs from CultMesh/Odin instead of explicit files. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start/deployment execution still requires explicit elevated operator authority.