diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 13cb980c..1302cac6 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -72,6 +72,7 @@ remembers doctrine; the branch remembers the blade. - 2026-06-18: `swarm-overview` action rows now enumerate every sealed service-lifecycle attention receipt instead of only the selected global recommendation. Each non-mutating readback row carries the receipt's service-manager artifact ref/status/hash/private flag; live wrapper proof `local-20260618-214044-049-a63d008c` printed priority 40 `cluster-service-execution-audit` with `artifactStatus=external-ref`, `sha256=none`, and `artifact=service-manager://windows/epiphany-cluster-daemon-services/cluster-execution-audit`, priority 41 `service-execution-audit` with `artifactStatus=external-ref`, `sha256=none`, and `artifact=service-manager://windows/epiphany-daemon-supervisor-service/execution-audit`, and the priority-50 elevated runbook row unchanged. - 2026-06-18: Service execution failed-check rows now carry `serviceId` and the compact TUI/PowerShell summaries render `serviceId::action=status`. Single-service overview audits are scoped to service ids from current service-lifecycle attention rows instead of blending all non-cluster receipts, so old EventLog proof scars cannot masquerade as Epiphany supervisor service evidence. Failed-check TUI rows also carry `followUp=` for the receipt-producing/readback route; live wrapper proof `local-20260618-224925-221-8e114063` printed cluster follow-ups such as `cluster-service-execution-readiness`, `cluster-service-install-execute`, and `cluster-service-execution-audit`, plus supervisor-service follow-ups such as `service-execution-readiness`, `service-install-execute`, `service-status`, and `service-reconcile`, with `privateStateExposed=false`. Standalone `service-execution-audit` proof `local-20260618-215828-537-12b29ecf` printed the supervisor-service prefix on runbook witness and failed-check rows, and standalone `cluster-service-execution-audit` proof `local-20260618-215948-348-7be0110c` printed the cluster service prefix on runbook witness and failed-check rows. - 2026-06-18: Direct wrapper audit summaries now print actionable `failed check rows` for `cluster-service-execution-audit` and `service-execution-audit`: each row carries `serviceId::action=status`, artifact ref, local artifact SHA-256 when present, and `followUp=`. Live proofs `local-20260618-225923-468-d818951a` and `local-20260618-225923-529-7cfa2bb3` showed the cluster execution scar and supervisor-service scar with exact follow-up wrapper modes while preserving `privateStateExposed=false`. +- 2026-06-18: Direct execution-runbook summaries now print the explicit elevated invocation and post-run audit command. `cluster-service-execution-runbook` proof `local-20260618-230302-532-ba02c01c` printed `elevatedCommand=Start-Process PowerShell -Verb RunAs -Wait ...` and `aftercare=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`; `service-execution-runbook` proof `local-20260618-230302-517-cb2b650c` printed the matching single-service RunAs command plus `aftercare=tools/epiphany_local_run.ps1 -Mode service-execution-audit`. Both are non-mutating artifact rites until the operator explicitly runs the elevated command. - 2026-06-18: The `swarm-overview`/`swarm-triage` action queue now carries aggregate sealed service-execution wound counts on the elevated service-control row as `serviceExecutionFailedCheckCount` and `serviceExecutionMissingCheckCount`, with compact wrapper/TUI rows rendering `failedChecks=` and `missingChecks=`. Non-mutating readback rows keep both counts at zero. Live proofs `local-20260618-220534-199-d8e90287` and `local-20260618-220534-205-59582da5` printed the priority-50 `service-execution-authority` row with `failedChecks=11`, `missingChecks=6`, `artifactStatus=present`, the sealed cluster runbook SHA-256, and `privateStateExposed=false`. - 2026-06-18: The elevated service-control action queue now emits one `service-execution-authority` row per sealed runbook witness instead of attaching all failed checks to the recommended cluster artifact. Source smoke seeds both cluster and single-service runbook witnesses and proves separate scoped rows. Live overview proof `local-20260618-221339-826-b1981064` and triage proof `local-20260618-221340-099-4b4baba8` printed priority 50 for `cluster-service-execution-runbook` with `failedChecks=5`, `missingChecks=0`, SHA-256 `3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`, and aftercare `cluster-service-execution-audit`; and priority 51 for `service-execution-runbook` with `failedChecks=6`, `missingChecks=6`, SHA-256 `b213a3c11a8f11a03061fcd743f507edaa59bc6767257b79cef63329596375e7`, and aftercare `service-execution-audit`, with no private state exposure. - 2026-06-18: `SwarmActionRow` now carries explicit `serviceId` and `serviceRoute`, and Rust TUI plus PowerShell wrapper action queues render `service=` and `route=` for service lifecycle/readiness rows. Non-service rows render `none`. Source smoke guards both fields on the cluster and single-service runbook authority rows. Live overview proof `local-20260618-221912-231-805389bf` and triage proof `local-20260618-221912-282-a79ba8bd` showed readback rows and both elevated runbook rows naming `epiphany-cluster-daemon-services` and `epiphany-daemon-supervisor-service` directly, without parsing artifact paths or prose. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index b5c90df1..d38ca857 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index eadbf7f3..baa04ca1 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -600,7 +600,7 @@ current_status: cargo and rejects modeling/planning/graph/checkpoint authority. MVP status and coordinator smokes pass with six lanes, and the smoke harness now rebuilds stale coordinator/app-server binaries before using them. - - `tools/epiphany_local_run.ps1 -Mode service-execution-runbook` is the repeatable elevated Windows service proof artifact generator. It writes a non-mutating `#Requires -RunAsAdministrator` PowerShell runbook containing the exact `service-execution-readiness`, `service-install-execute`, `service-start-execute`, `service-status`, `service-reconcile`, `service-stop-execute`, final `service-status`, and `service-execution-audit` wrapper calls, so the remaining elevated service proof can run through typed operator and lifecycle receipts instead of improvised `sc.exe` rites. The artifact now uses `Invoke-EpiphanyRunbookStep` to reset `$LASTEXITCODE`, catch thrown/nonzero failures, continue gathering receipts after a failed step, run final `service-execution-audit` in `finally`, and exit nonzero only after audit if any step failed. Latest proof `local-20260618-160641-685-331af57c` generated and parsed the single-service artifact. + - `tools/epiphany_local_run.ps1 -Mode service-execution-runbook` is the repeatable elevated Windows service proof artifact generator. It writes a non-mutating `#Requires -RunAsAdministrator` PowerShell runbook containing the exact `service-execution-readiness`, `service-install-execute`, `service-start-execute`, `service-status`, `service-reconcile`, `service-stop-execute`, final `service-status`, and `service-execution-audit` wrapper calls, so the remaining elevated service proof can run through typed operator and lifecycle receipts instead of improvised `sc.exe` rites. The artifact now uses `Invoke-EpiphanyRunbookStep` to reset `$LASTEXITCODE`, catch thrown/nonzero failures, continue gathering receipts after a failed step, run final `service-execution-audit` in `finally`, and exit nonzero only after audit if any step failed. Direct wrapper summaries print the exact `elevatedCommand=Start-Process PowerShell -Verb RunAs -Wait ...` invocation plus `aftercare=tools/epiphany_local_run.ps1 -Mode service-execution-audit`; live proof `local-20260618-230302-517-cb2b650c` showed the command for the supervisor-service artifact without mutating the service manager. - `epiphany-daemon-supervisor windows-service-execution-audit` and `tools/epiphany_local_run.ps1 -Mode service-execution-audit` are the post-run service proof verifier. The audit scans typed `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` documents for a service, first requires the sealed `windows-service-execution-runbook` receipt as the non-mutating preflight witness, then checks readiness/install/start/status/reconcile/stop receipt statuses, requires private-state sealing, writes its own `windows-service-execution-audit` lifecycle receipt, and returns `complete` only when the runbook plus elevated effect receipts prove the chain. Audit check rows now retain `operatorArtifactRef` from lifecycle receipts, so runbook witnesses can be identified without opening raw receipt payloads. `service-execution-audit-smoke` now writes synthetic sealed lifecycle receipts to prove the audit accepts a complete chain and then rejects a drifted reconcile receipt. Live wrapper proof `local-20260618-133559-466-6644f26f` reported the runbook witness as `written` and OK while six elevated effect receipts remained missing, preserving the elevated authority boundary. - `epiphany-verse-query poke-down-daemons` and `tools/epiphany_local_run.ps1 -Mode swarm-poke-down` are the typed swarm responsibility reflex: inspect local Verse daemon status rows, write daemon poke intent/receipt documents for every non-ready daemon, respect the `daemon.lifecycle_poke` swarm brake, include target display name/body domain/private Verse id/Eve surface metadata from cluster topology in the operator-safe poke summary, and expose no private state. Compact poke rows now print each poke target, daemon id, observed status, body domain, private Verse, Eve surface, intent id, receipt id/status, resulting status, and `private=false`; live wrapper proof `local-20260618-180548-293-ff73f9de` temporarily degraded Hands, printed one topology-aware receipt row, and restored Hands to ready; follow-up swarm status proof `local-20260618-180618-002-06e77583` reported seven ready daemons and zero non-ready rows. `epiphany-verse-query smoke` source-proves both the ready no-op and degraded single-poke compact row path. - `epiphany-verse-query swarm-status` and `tools/epiphany_local_run.ps1 -Mode swarm-status` provide the compact read-only liveness sight organ over local Verse daemon rows. It uses a narrow CultMesh daemon-liveness loader instead of serializing the full local Verse context, returns seven agent-friendly TUI rows with `READY`/`POKE`, daemon id, body domain, private Verse id, Eve surface, `followUp=tools/epiphany_local_run.ps1 -Mode swarm-poke-down`, and `private=false`, and exposes no private state. Live wrapper proof `local-20260618-210235-584-110d1120` printed all seven Rust-owned `READY` rows in `statusRows` with body domain, private Verse ids, Eve surfaces, batch poke follow-up, and `private=false`; source smoke also proves degraded Hands returns a `POKE` row with `privateVerse=epiphany.cluster.hands.private` plus the same follow-up command. @@ -611,7 +611,7 @@ current_status: - `epiphany-verse-query bifrost-ledger` and `tools/epiphany_local_run.ps1 -Mode bifrost-ledger` provide the compact Bifrost ledger sight organ. It reads only the latest Bifrost body-change intent, Bifrost publication receipt, GitHub publication receipt, collaboration feedback, and Imagination consensus receipt through narrow CultMesh loaders, returns five agent-friendly TUI rows when both chains exist, publishes follow-on command hints for swarm overview, tool directory, collaboration feedback, Bifrost publication, and Bifrost ledger readback, and exposes no private state. Compact ledger rows carry explicit `owner=`, `public=`, and `private=false`, so body-change/public-feedback proof is inspectable without opening raw local Verse payloads or inferring authority from document names; wrapper proof `local-20260618-223951-549-747c02f9` prints all five rows in `ledgerRows`, covering `owner=Bifrost`, `owner=Bifrost/GitHub`, `owner=Persona->Imagination`, and `owner=Imagination` across the body-change intent, Bifrost publication receipt, GitHub receipt, collaboration feedback, and Imagination consensus receipt. - `epiphany-verse-query receipt-directory` and `tools/epiphany_local_run.ps1 -Mode receipt-directory` provide the compact latest-witness directory over local Verse. It indexes operator run, daemon poke, daemon tool invocation, Eve connection, Bifrost publication, Imagination consensus, coordinator run, Hands gate, role review, work-loop, cluster service lifecycle, single-service lifecycle, cluster service execution runbook, single-service execution runbook, scheduler, Persona speech, and agent-state SoA witness families from typed local Verse projections; returns agent-friendly `OK`/`ABSENT`/`ATTN` TUI rows with owner, family, status, route, latest id, follow-up command, `presentRowCount`, and `absentRowCount`; preserves `missingRowCount` as compatibility for absent witnesses; flags sealed service lifecycle failure states such as `not-elevated`, `execution-refused-not-elevated`, and `incomplete` as attention without exposing receipt payloads; routes cluster service lifecycle receipts to `cluster-service-execution-audit`, single-service receipts to `service-execution-audit`, the cluster execution-runbook witness to `cluster-service-execution-runbook`, and the single-service execution-runbook witness to `service-execution-runbook`; and exposes no private state or receipt payload previews. The lifecycle projection now reads the typed receipt family, splits `cluster-service-lifecycle` from `service-lifecycle`, selects the latest attention receipt before falling back to latest overall, and exposes `service-id::action` route values such as `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit`, so agents can see the owning lifecycle action without opening raw audit JSON. Compact receipt TUI rows append `followUp=`, artifact status, and SHA-256; wrapper proof `local-20260618-205920-451-383b0da7` now prints all seventeen compact rows in `receiptRows`, including missing Hands/role/work-loop gates, runbook hashes, scheduler follow-up, Bifrost/Imagination witnesses, and the active service lifecycle attention rows. It also exposes `cluster-service-execution-runbook` plus `service-execution-runbook` as display-only rows, so newer harmless planned/runbook lifecycle receipts cannot hide the active seven-service cluster wound. Receipt-directory JSON now carries Rust-owned `attentionRouteRows` derived from the same policy predicate as `attentionRowCount`, and the wrapper prints that field instead of rebuilding attention from ad hoc status strings; live proof `local-20260618-212134-758-c7c56240` left the old degraded Hands daemon-poke receipt as an `OK` historical witness while attention routes named only the cluster and single-service lifecycle wounds. Daemon-poke rows now resolve historical receipt status against current daemon liveness: source smoke proves degraded remains degraded before heartbeat recovery and becomes `resolved` after current status returns ready, while live wrapper proof `local-20260618-212649-563-48647018` printed the old Hands poke receipt as `OK | Self | daemon-poke | resolved`. - `tools/epiphany_local_run.ps1 -Mode service-tick` is the wrapper-owned daemon scheduler pulse rite. It runs `epiphany-daemon-supervisor tick` through the same local Verse store, operator run intent/receipt, agent-state SoA refresh, and swarm-brake preflight as other service lifecycle modes, but leaves restart authority inside durable daemon restart policies. The receipt directory scheduler row now follows up with `tools/epiphany_local_run.ps1 -Mode service-tick` instead of passive service status. Proof seeded one disabled Persona restart policy as inert policy metadata, then the wrapper wrote `daemon-scheduler-receipt-epiphany-daemon-supervisor-0` with `status=tickComplete`, `outcomeCount=1`, `skippedCount=1`, `restartedCount=0`, `refusedCount=0`, and `privateStateExposed=false`; the follow-up receipt-directory proof reported the scheduler row as present with route `*`, follow-up command `service-tick`, and no private-state exposure. - - `epiphany-cluster-daemon` is the first real per-cluster daemon heartbeat body. It runs as a narrow Rust binary parameterized by daemon id, publishes typed `epiphany.cultmesh.daemon_status.v0` heartbeats into the shared local Verse, can run once or loop, and exposes no private state. Durable restart policies for Self, Hands, Persona, Imagination, Eyes, Modeling, and Soul now invoke `epiphany-cluster-daemon heartbeat`, not the generic query/debug writer. A degraded proof showed `service-tick` invoking all seven daemon bodies through the supervisor and restoring ready liveness with sealed scheduler/poke receipts; a fresh tick no-ops when all heartbeats are current. `epiphany-daemon-supervisor cluster-service-runbook` and wrapper `-Mode cluster-service-runbook` write a non-mutating service runbook plus `daemon_service_lifecycle` receipt for all seven organ daemon `epiphany-cluster-daemon serve` commands. `epiphany-daemon-supervisor cluster-service-install-plan` and wrapper `-Mode cluster-service-install-plan` write a non-mutating Windows install script plus lifecycle receipt for seven distinct per-organ Windows services. Wrapper `-Mode cluster-service-install-execute` requests execution through the same typed path and, in non-elevated shells, writes `execution-refused-not-elevated` with `executed=false` instead of mutating services. `epiphany-daemon-supervisor cluster-service-audit` and wrapper `-Mode cluster-service-audit` read Windows service-manager state for those seven expected service names, writing an incomplete audit receipt when they are missing. `epiphany-daemon-supervisor cluster-service-start`/`cluster-service-stop` and wrapper `-Mode cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, and `cluster-service-stop-execute` record cluster lifecycle receipts for all seven services: plan modes emit seven `*-planned` rows without mutation, and explicit execute modes refuse as `execution-refused-not-elevated` with seven refused rows when the shell lacks service authority. The cluster install/audit/control wrapper summaries now print compact `serviceRows` for all seven daemon-owned Windows service names with daemon id, status or observed status, cluster id, executed flag, exit code, start type, and `private=false`; live proofs `local-20260618-211051-126-2a89d61c`, `local-20260618-211051-125-cd687ee2`, `local-20260618-211051-063-f0ff980d`, and `local-20260618-211118-108-df5cb8cd` show seven missing audit rows, seven ready/demand install-plan rows, seven start-planned rows, and seven stop-planned rows without service mutation. `cluster-service-execution-runbook` writes an admin-gated wrapper sequence for cluster-native readiness, cluster install, cluster start, cluster audit, cluster stop, and final cluster audit; the artifact now uses `Invoke-EpiphanyRunbookStep` to reset `$LASTEXITCODE`, catch thrown/nonzero failures, continue gathering receipts after a failed step, and always runs `cluster-service-execution-audit` from `finally`; the wrapper calls `epiphany-daemon-supervisor cluster-service-execution-runbook` after artifact generation, so the runbook itself has a typed `daemon_service_lifecycle` receipt with action `cluster-windows-service-execution-runbook`, status `written`, artifact path, final-audit metadata, step-failure policy metadata, and `privateStateExposed=false`. Its wrapper JSON and typed receipt args expose `runbookTryModes`, `finalAuditMode=cluster-service-execution-audit`, `finalAuditRunsInFinally=true`, `stepFailurePolicy=continue-after-step-failure`, `continueAfterStepFailure=true`, `nonzeroExitFailsStep=true`, and `exitsNonzeroAfterFinalAudit=true`, and the compact wrapper line prints those same aftercare facts. Latest proof `local-20260618-161632-376-436227d8` generated and parsed the robust cluster artifact; live overview `local-20260618-161718-889-7cebdcb1` points the elevated operator row at that artifact. `cluster-service-execution-audit` first requires the sealed `cluster-windows-service-execution-runbook` receipt, then checks the latest cluster-native readiness plus cluster install/start/audit/stop lifecycle receipts by receipt timestamp and reports `complete` only when the runbook and elevated effect receipts are sealed and successful. Audit check rows retain lifecycle `operatorArtifactRef`; wrapper summaries now print OK runbook witnesses with SHA-256 before compact failed-check anatomy. Live proof `local-20260618-170322-330-e6cb2117` printed `cluster-windows-service-execution-runbook=...\epiphany-cluster-daemon-services-execution-runbook.ps1:sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0` and the expected five failed checks without mutating Windows services. + - `epiphany-cluster-daemon` is the first real per-cluster daemon heartbeat body. It runs as a narrow Rust binary parameterized by daemon id, publishes typed `epiphany.cultmesh.daemon_status.v0` heartbeats into the shared local Verse, can run once or loop, and exposes no private state. Durable restart policies for Self, Hands, Persona, Imagination, Eyes, Modeling, and Soul now invoke `epiphany-cluster-daemon heartbeat`, not the generic query/debug writer. A degraded proof showed `service-tick` invoking all seven daemon bodies through the supervisor and restoring ready liveness with sealed scheduler/poke receipts; a fresh tick no-ops when all heartbeats are current. `epiphany-daemon-supervisor cluster-service-runbook` and wrapper `-Mode cluster-service-runbook` write a non-mutating service runbook plus `daemon_service_lifecycle` receipt for all seven organ daemon `epiphany-cluster-daemon serve` commands. `epiphany-daemon-supervisor cluster-service-install-plan` and wrapper `-Mode cluster-service-install-plan` write a non-mutating Windows install script plus lifecycle receipt for seven distinct per-organ Windows services. Wrapper `-Mode cluster-service-install-execute` requests execution through the same typed path and, in non-elevated shells, writes `execution-refused-not-elevated` with `executed=false` instead of mutating services. `epiphany-daemon-supervisor cluster-service-audit` and wrapper `-Mode cluster-service-audit` read Windows service-manager state for those seven expected service names, writing an incomplete audit receipt when they are missing. `epiphany-daemon-supervisor cluster-service-start`/`cluster-service-stop` and wrapper `-Mode cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, and `cluster-service-stop-execute` record cluster lifecycle receipts for all seven services: plan modes emit seven `*-planned` rows without mutation, and explicit execute modes refuse as `execution-refused-not-elevated` with seven refused rows when the shell lacks service authority. The cluster install/audit/control wrapper summaries now print compact `serviceRows` for all seven daemon-owned Windows service names with daemon id, status or observed status, cluster id, executed flag, exit code, start type, and `private=false`; live proofs `local-20260618-211051-126-2a89d61c`, `local-20260618-211051-125-cd687ee2`, `local-20260618-211051-063-f0ff980d`, and `local-20260618-211118-108-df5cb8cd` show seven missing audit rows, seven ready/demand install-plan rows, seven start-planned rows, and seven stop-planned rows without service mutation. `cluster-service-execution-runbook` writes an admin-gated wrapper sequence for cluster-native readiness, cluster install, cluster start, cluster audit, cluster stop, and final cluster audit; the artifact now uses `Invoke-EpiphanyRunbookStep` to reset `$LASTEXITCODE`, catch thrown/nonzero failures, continue gathering receipts after a failed step, and always runs `cluster-service-execution-audit` from `finally`; the wrapper calls `epiphany-daemon-supervisor cluster-service-execution-runbook` after artifact generation, so the runbook itself has a typed `daemon_service_lifecycle` receipt with action `cluster-windows-service-execution-runbook`, status `written`, artifact path, final-audit metadata, step-failure policy metadata, and `privateStateExposed=false`. Its wrapper JSON and typed receipt args expose `runbookTryModes`, `finalAuditMode=cluster-service-execution-audit`, `finalAuditRunsInFinally=true`, `stepFailurePolicy=continue-after-step-failure`, `continueAfterStepFailure=true`, `nonzeroExitFailsStep=true`, and `exitsNonzeroAfterFinalAudit=true`; direct wrapper summaries now print the exact `elevatedCommand=Start-Process PowerShell -Verb RunAs -Wait ...` invocation plus `aftercare=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`. Live proof `local-20260618-230302-532-ba02c01c` generated the robust cluster artifact and printed the elevated command without service mutation. `cluster-service-execution-audit` first requires the sealed `cluster-windows-service-execution-runbook` receipt, then checks the latest cluster-native readiness plus cluster install/start/audit/stop lifecycle receipts by receipt timestamp and reports `complete` only when the runbook and elevated effect receipts are sealed and successful. Audit check rows retain lifecycle `operatorArtifactRef`; wrapper summaries now print OK runbook witnesses with SHA-256 before compact failed-check anatomy. Live proof `local-20260618-170322-330-e6cb2117` printed `cluster-windows-service-execution-runbook=...\epiphany-cluster-daemon-services-execution-runbook.ps1:sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0` and the expected five failed checks without mutating Windows services. - Cluster service execution readiness now uses the same compact wrapper `serviceRows` mouth as install/audit/control. Identity-only readiness rows inherit the global readiness verdict, so the seven expected Windows service rows show `not-elevated` instead of `unknown` when the shell lacks service authority. Live proof `local-20260618-211524-363-5d85b3aa` printed seven readiness rows with service name, daemon id, cluster id, `executed=n/a`, `exit=none`, `startType=none`, and `private=false`; live proof `local-20260618-211524-345-d580da5c` printed seven `execution-refused-not-elevated` stop-execute rows without service mutation. - `epiphany-verse-query restart-policy-directory` and `tools/epiphany_local_run.ps1 -Mode service-policy-directory` provide the compact scheduler coverage sight organ. It reads daemon topology/status plus durable `epiphany.cultmesh.daemon_restart_policy.v0` rows through a narrow CultMesh restart-policy directory loader, reports each daemon as `ENABLED`, `DISABLED`, or `MISSING`, treats disabled and missing policies as recovery attention, returns covered/enabled/disabled/missing/attention counts, and publishes explicit policy-write plus scheduler-tick follow-up commands without creating or mutating policies. Compact TUI rows now expose cooldown, reconcile interval, heartbeat stale threshold, failure count, last result, `followUp=`, and `private=false`; wrapper proof `local-20260618-213147-804-7dec3346` prints the Rust-owned `tuiRows` directly for all seven faculties as `ENABLED` with `last=ready`, `cooldown=30s`, `reconcile=60s`, `stale=300s`, `followUp=tools/epiphany_local_run.ps1 -Mode service-tick`, and `private=false`, instead of rebuilding policy text in PowerShell. Direct and wrapper proof now report seven daemons, seven covered policies, seven enabled policies, zero disabled, zero missing, zero attention, `status=ok`, and `privateStateExposed=false`. This is a real daemon heartbeat body with non-mutating per-organ launch and install artifacts, but not yet executed installed per-organ OS services. - `https://gamecult.org/Blog/purge-the-heretek-from-our-daemonic-swarm` is a public doctrine receipt for the Perfect Machine audit pressure: organs must not borrow each other's crowns, witnesses need owning mouths, surfaces reflect rather than rule, and cross-repo purification needs Bifrost-shaped ledger evidence instead of relying on recoverable transcripts or commit trails alone. diff --git a/tools/epiphany_local_run.ps1 b/tools/epiphany_local_run.ps1 index 44be41cc..9fff8fa1 100644 --- a/tools/epiphany_local_run.ps1 +++ b/tools/epiphany_local_run.ps1 @@ -176,6 +176,19 @@ function Get-ServiceExecutionCheckFollowUpCommand { } } +function ConvertTo-PowerShellLiteral { + param([string]$Value) + + return "'" + $Value.Replace("'", "''") + "'" +} + +function Get-ElevatedRunbookCommand { + param([string]$RunbookPath) + + $literalPath = ConvertTo-PowerShellLiteral $RunbookPath + return "Start-Process PowerShell -Verb RunAs -Wait -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-File',$literalPath)" +} + function Format-TuiRows { param([object]$Rows) @@ -1979,7 +1992,8 @@ if ($resultPath -ne "" -and (Test-Path -LiteralPath $resultPath)) { $serviceRows = Format-ClusterServiceRows $result.services $result.status Write-Host "Cluster daemon service execution readiness: service=$($result.serviceId), daemons=$($result.daemonCount), services=$($result.serviceCount), status=$($result.status), elevated=$($result.elevated), receipt=$($result.receiptId), serviceRows=$serviceRows" } elseif ($Mode -eq "cluster-service-execution-runbook") { - Write-Host "Cluster daemon service execution runbook: service=$($result.serviceId), status=$($result.status), finalAuditInFinally=$($result.finalAuditRunsInFinally), continueAfterStepFailure=$($result.continueAfterStepFailure), nonzeroExitFailsStep=$($result.nonzeroExitFailsStep), exitsNonzeroAfterFinalAudit=$($result.exitsNonzeroAfterFinalAudit), path=$($result.runbookPath)" + $elevatedCommand = Get-ElevatedRunbookCommand $result.runbookPath + Write-Host "Cluster daemon service execution runbook: service=$($result.serviceId), status=$($result.status), finalAuditInFinally=$($result.finalAuditRunsInFinally), continueAfterStepFailure=$($result.continueAfterStepFailure), nonzeroExitFailsStep=$($result.nonzeroExitFailsStep), exitsNonzeroAfterFinalAudit=$($result.exitsNonzeroAfterFinalAudit), elevatedCommand=$elevatedCommand, aftercare=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit, path=$($result.runbookPath)" } elseif ($Mode -eq "cluster-service-execution-audit") { Write-Host "Cluster daemon service execution audit: service=$($result.serviceId), status=$($result.status), missing=$($result.missingCount), failed=$($result.failedCount), receipt=$($result.receiptId)" $failedCheckRows = Format-ServiceExecutionFailedChecks @($result.checks | Where-Object { -not $_.ok }) @@ -2016,7 +2030,8 @@ if ($resultPath -ne "" -and (Test-Path -LiteralPath $resultPath)) { } Write-Host "Cluster daemon service execution failed check rows: $failedCheckRows" } elseif ($Mode -eq "service-execution-runbook") { - Write-Host "Service execution runbook: service=$($result.serviceId), name=$($result.serviceName), status=$($result.status), finalAuditInFinally=$($result.finalAuditRunsInFinally), continueAfterStepFailure=$($result.continueAfterStepFailure), nonzeroExitFailsStep=$($result.nonzeroExitFailsStep), exitsNonzeroAfterFinalAudit=$($result.exitsNonzeroAfterFinalAudit), path=$($result.runbookPath)" + $elevatedCommand = Get-ElevatedRunbookCommand $result.runbookPath + Write-Host "Service execution runbook: service=$($result.serviceId), name=$($result.serviceName), status=$($result.status), finalAuditInFinally=$($result.finalAuditRunsInFinally), continueAfterStepFailure=$($result.continueAfterStepFailure), nonzeroExitFailsStep=$($result.nonzeroExitFailsStep), exitsNonzeroAfterFinalAudit=$($result.exitsNonzeroAfterFinalAudit), elevatedCommand=$elevatedCommand, aftercare=tools/epiphany_local_run.ps1 -Mode service-execution-audit, path=$($result.runbookPath)" } elseif ($Mode -eq "service-install-plan" -or $Mode -eq "service-install-execute") { Write-Host "Service install: service=$($result.serviceId), name=$($result.serviceName), status=$($result.status), executed=$($result.executed), receipt=$($result.receiptId), path=$($result.installScriptPath)" } elseif ($Mode -eq "service-status") {