Add repo deployment aftercare audit

notes/epiphany-repo-swarm-mvp-contract.md

@@ -804,6 +804,20 @@ Hands, publication, merge, and cross-body authority false. Smoke
 `.epiphany-smoke\repo-deployment-config-family-20260620-214109` proved the
 runbook beside config close and audit.
 
+The post-push receipt mouth is now explicit as well.
+`epiphany-work deployment-aftercare-audit --workspace <repo>
+--idunn-deployment-receipt <path> --aftercare-audit-receipt <path>` reads the
+operator runbook receipt plus supplied Idunn deployment and aftercare receipts,
+checks `gamecult.idunn.deployment_receipt.v0` and
+`gamecult.idunn.deployment_aftercare_audit.v0`, and emits
+`epiphany.repo_deployment_aftercare_audit.v0`. It reports `complete` only when
+the runbook is ready and both Idunn receipts carry successful statuses and
+private-state seals; otherwise it reports the missing gate without mutating
+remote refs or granting deployment authority. Smoke
+`.epiphany-smoke\repo-deployment-config-family-20260620-215037` proved the
+complete ingestion path from explicit fixture receipts with
+`deploymentComplete=true` and `privateStateExposed=false`.
+
 ### Landed Work Run Gate
 
 The sixth front door exists as native Rust:

notes/fresh-workspace-handoff.md

@@ -128,6 +128,7 @@ remembers doctrine; the branch remembers the blade.
 - 2026-06-20: Gjallar now has a branch lens over Mind-admitted repo-work maps. `repoWorkMapBranchLensRows` / `REPO-WORK-MAP-BRANCH` group accepted map consequences by branch with item count, changed-path count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`. Smoke `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-210747` reran the counterfeit-adoption guard and proved `gjallarRepoWorkMapBranchLensCount=1` alongside the family/path lenses. This is branch-workbench sight only: Gjallar still does not schedule, publish, merge, deploy, keep daemons alive, or admit Mind state.
 - 2026-06-20: `epiphany-work deployment-config-audit` is live as the non-mutating Idunn handoff readback for repo deployment config. It reads `.epiphany/deployment.toml`, writes `epiphany.repo_deployment_config_audit.v0`, reports `ready-for-idunn-review` only when the disabled git-push Idunn trigger, CultMesh intent/receipt/aftercare contracts, required receipts, and authority seals are present, and always keeps execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-213042` proved the audit beside the `repo.deployment_config` close path with `daemonOwnsExecution=true`, `readyForIdunnReview=true`, and `privateStateExposed=false`.
 - 2026-06-20: `epiphany-work deployment-execution-runbook` is live as the explicit operator-owned git-push handoff for Idunn deployment. It requires the deployment config audit to pass, writes `.epiphany/work/idunn-deployment/idunn-git-push-runbook.ps1`, emits `epiphany.repo_deployment_execution_runbook.v0`, reports `ready-for-operator-git-push`, includes the exact `git push origin HEAD:refs/heads/main` route, runbook SHA-256, and required Idunn deployment/aftercare receipt contracts, and marks `requiresExplicitOperatorAuthority=true` plus `mutatesRemoteWhenRun=true` while keeping execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false for the repo agent. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-214109` proved the runbook with `deploymentExecutionRunbookStatus=ready-for-operator-git-push`, SHA-256 `57560eda912b6e5c15f97acf53500534bb3bcf739098f329add3d88e5a9cd1d3`, and `privateStateExposed=false`.
+- 2026-06-20: `epiphany-work deployment-aftercare-audit` is live as the post-operator Idunn receipt ingestion mouth. It reads the deployment runbook receipt plus explicit `gamecult.idunn.deployment_receipt.v0` and `gamecult.idunn.deployment_aftercare_audit.v0` files, emits `epiphany.repo_deployment_aftercare_audit.v0`, reports `complete` only when both Idunn receipts have successful statuses and private-state seals, and remains non-mutating with deployment/SSH/git-push/service/Hands/publication/merge authority false. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-215037` proved the complete path with fixture Idunn receipts, `deploymentAftercareAuditStatus=complete`, `deploymentComplete=true`, and `privateStateExposed=false`.
 - 2026-06-20: Deeper model-authored closure review is now live. `epiphany-work close` accepts `--closure-model-verdict passed|failed|needs-work|blocked`, `--closure-model-finding`, and `--require-closure-model-verdict`; the close review embeds `epiphany.repo_work_model_closure_review.v0` under `modelingReview.closureReview`, records reviewed inputs and gate enforcement, and Soul refuses closure when a supplied or required model verdict does not pass. Focused smoke `.epiphany-smoke\closure-model-gate-20260620-135103` created a disposable repo, ran two `repo.status_section` items through public front doors, closed one with required model verdict `passed`, and blocked one with `needs-work` while `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - 2026-06-20: Mind adoption/interpreter depth now has a concrete interpretation packet. `epiphany-work adopt` writes `epiphany.repo_work_mind_adoption_decision.v0` before the main adoption receipt, embeds `epiphany.repo_work_mind_interpretation.v0` with input summary, safe-family recognition, requested-path classification, allowed branch-local Hands transition, and forbidden durable-state/publication/service/private transitions, then records Self presentation, Mind evidence review, safe-family requirement, branch-local scope, Bifrost publication gate, Soul closure requirement, and no Hands/durable-state/publication/merge/service/cross-body/private authority inside the Mind decision; the main adoption receipt cites that decision before granting branch-local Hands authority. Focused smoke `.epiphany-smoke\repo-planning-facets-20260620-175503` proves model-authored planning facets survive into Imagination, plan derivation, Mind interpretation, Mind decision, and adoption, while close still passes Soul/family/path checks with `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics beyond the first Mind interpretation packet, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - 2026-06-20: `repo-manifest` is now the next non-planning safe family. `epiphany-work derive-plan --action-family repo-manifest` lowers accepted pressure into a structured `epiphany.toml` Body manifest with safe family `repo.body_manifest`, body domain, private/local/public Verse ids, Eve surface id, receipt-required capability hints, arbitrary shell sealed false, and private-state seals. Soul closure assertions now inspect the committed manifest for schema, safe family, summary, body domain, Verse ids, Eve surface, receipt requirement, no arbitrary shell, and private-state seals. Focused smoke `.epiphany-smoke\repo-manifest-family-20260620-141552` ran a disposable repo through init -> online -> accept -> repo-manifest derive-plan -> tick run/adopt/execute/close; Hands committed only `epiphany.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, additional useful repo-owned config/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.