Extract worker attempt authority
This commit is contained in:
Meta Vens
parent
868a5be070
commit
7b404d130d
10 changed files with 280 additions and 188 deletions
|
|
@ -3522,7 +3522,9 @@ model direction binds the request/model projection directly. Failed terminal
|
|||
status is not permission to launder malformed launch state into a tombstone.
|
||||
Model-direction result admission now checks the same projected model hash.
|
||||
|
||||
- Owner: runtime spine owns archival of one immutable outer worker attempt.
|
||||
- Owner: `runtime_worker_attempt` owns one immutable outer worker attempt's
|
||||
typed request association and process-status semantics. Runtime spine retains
|
||||
the CultCache transaction primitives for claim, result, and archival commits.
|
||||
Resident Self supplies cross-store liveness but cannot delete runtime rows.
|
||||
- Inputs: exact typed request identity; worker launch; lane-specific launch
|
||||
binding; process claim; terminal role result and typed companion; runtime job
|
||||
|
|
@ -3539,13 +3541,18 @@ Model-direction result admission now checks the same projected model hash.
|
|||
and artifact cleanup cannot retire outer worker authority. No generic sweep
|
||||
may delete a claim or result independently.
|
||||
- Shared paths: proposal Modeling, Imagination consideration, and admitted model
|
||||
direction use the same archive commit primitive and common launch/claim/job
|
||||
direction use one exhaustive typed-request projection, the same status
|
||||
predicates, the same archive commit primitive, and common launch/claim/job
|
||||
invariants, with lane-specific binding/companion validators.
|
||||
- Cut line: archive only exact launch, terminal claim, terminal result,
|
||||
lane-specific attempt binding/companion, and terminal job/event rows. Preserve
|
||||
request, proposal, model, admission, and unrelated runtime families until a
|
||||
separately mapped lifecycle owns them. The tombstone must be written in the
|
||||
same full-snapshot CAS as deletion.
|
||||
- Demotion: serialized process-status strings are wire representation, not local
|
||||
policy owners. Resident recovery, coordinator retry, runtime fulfillment, and
|
||||
retention derive their decisions from `WorkerProcessStatus`. Per-consumer
|
||||
request-family arrays no longer decide which typed work exists.
|
||||
- Verification layer: terminal-result/failure/death attempts; prepared/active/
|
||||
unconsumed-ack refusal; downstream-reference refusal; stale snapshot race;
|
||||
unknown-row byte identity; retry after archived failure; fulfillment after
|
||||
|
|
|
|||
|
|
@ -5,10 +5,9 @@ Updated: 2026-08-12
|
|||
## Current state
|
||||
|
||||
The five-day live shakedown campaign is paused for architectural consolidation.
|
||||
The source branch is `codex/epiphany-shakedown-live`; the last pushed source
|
||||
before surgery is `80541843`. The working tree contains the consolidation cut
|
||||
described below and must be committed only after final source checks and map
|
||||
updates.
|
||||
The source branch is `codex/epiphany-shakedown-live`. Causal-work and immutable
|
||||
public-source ownership landed at `868a5be0`. The working tree contains the
|
||||
second consolidation cut described below.
|
||||
|
||||
The accepted live body remains c011 at exact `465af24d` on Starfire, cognitively
|
||||
braked at resident revision 384 with no active lease, admitted work, or defunct
|
||||
|
|
@ -35,10 +34,11 @@ repair.
|
|||
public-source receipt. Provider validation is no longer trusted as a substitute
|
||||
for admission validation.
|
||||
|
||||
The full `epiphany-core` library passes 683 tests with one intentional ignored
|
||||
cross-process helper. `epiphany-tool-mcp-runtime` passes 14 tests with one
|
||||
intentional ignored live-network proof. Focused stale-thread refusal preserves
|
||||
the exact store bytes.
|
||||
The first cut's full `epiphany-core` library passed 683 tests with one intentional
|
||||
ignored cross-process helper. After worker-attempt extraction, core passes 684
|
||||
active tests with one ignored helper, `epiphany-tool-mcp-runtime` passes 14
|
||||
active tests with one ignored live-network proof, and OpenAI runtime passes all
|
||||
39 tests. Focused stale-thread refusal preserves the exact store bytes.
|
||||
|
||||
## Authority map
|
||||
|
||||
|
|
@ -76,25 +76,23 @@ Do not collapse these into one enum or service:
|
|||
- Runtime worker attempt owns launch, exact process claim, result, and archive.
|
||||
- Mind decides adoption; fulfillment is evidence, not admission.
|
||||
|
||||
The next physical extraction is a narrow `runtime_worker_attempt` module. It
|
||||
should centralize typed process-status predicates and typed-request association
|
||||
without merging the authorities above or introducing a registry.
|
||||
The narrow `runtime_worker_attempt` module now owns the serialized process-status
|
||||
vocabulary, live/fulfilled/failed/retry classification, and the complete set of
|
||||
typed request families carried by one launch. Runtime, resident, and coordinator
|
||||
consumers call those predicates and accessors instead of maintaining local
|
||||
string sets and parallel family arrays. Persisted documents and transactions are
|
||||
unchanged; the lifecycle authorities above remain separate.
|
||||
|
||||
## Acceptance gates before shakedown resumes
|
||||
|
||||
1. Extract the worker-attempt aggregate from `runtime_spine` with no schema or
|
||||
state migration.
|
||||
2. Replay full core, resident, coordinator, tool-runtime, and OpenAI-runtime
|
||||
suites after extraction.
|
||||
3. Prove immutable public Eyes success and no-grant denial on a copied packaged
|
||||
1. Prove immutable public Eyes success and no-grant denial on a copied packaged
|
||||
body. This is the paused shakedown's first remaining live gate, not part of
|
||||
the consolidation commit.
|
||||
4. Run one fresh-repository source -> Hands -> Soul -> Modeling -> Mind -> Self
|
||||
2. Run one fresh-repository source -> Hands -> Soul -> Modeling -> Mind -> Self
|
||||
capstone before claiming organism-level readiness.
|
||||
|
||||
## Immediate next action
|
||||
|
||||
Review the current diff for any surviving family-local causal hash or public
|
||||
GitHub parser. Commit and push this first consolidation cut. Then map and extract
|
||||
`runtime_worker_attempt`; do not add new capability surfaces and do not replace
|
||||
c011.
|
||||
Commit and push the worker-attempt extraction, then resume with the copied
|
||||
packaged public Eyes success/denial pair. Do not add new capability surfaces and
|
||||
do not replace c011 before that gate closes.
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ consolidation gates below close.
|
|||
|---|---|---|---|
|
||||
| Durable request identity excludes mutable transport provenance | `causal_work_identity` | Proposal Modeling, Research, Planning, PlanMind, and Admitted Model Direction use one pure derivation owner; stale thread restoration refuses byte-identically | replay packaged coordinated circuits after worker-attempt extraction |
|
||||
| Immutable GitHub identity has one grammar | `ImmutableGithubSource` | Modeling selection, Eyes execution, and Mind authentication share one parser/canonicalizer; malformed identities fail at Mind | copied packaged public success and no-grant denial |
|
||||
| One worker attempt has one process/result/archive authority | planned `runtime_worker_attempt` | current lifecycle and archive proofs remain accepted | extract typed status predicates and request association from `runtime_spine` without schema migration |
|
||||
| One worker attempt has one process/result/archive authority | `runtime_worker_attempt` | typed status classes and request association are shared by runtime, resident, and coordinator; core 684/684 (+1 ignored), tool runtime 14/14 (+1 ignored), OpenAI runtime 39/39 | replay packaged settlement/archive circuits |
|
||||
| Canonical state admission has one writer | coordinator state transaction / Mind | CAS companions and negative source guards accepted | continue legacy-writer audit only when source evidence finds a live seam |
|
||||
|
||||
## Worker-attempt extraction boundary
|
||||
|
|
@ -49,14 +49,13 @@ consolidation gates below close.
|
|||
| Proposal/Planning causal identity | deterministic shared owner | stale carrier cannot restore thread | cross-incarnation replay | source complete |
|
||||
| Hands -> Soul -> Modeling -> Mind -> Self | bounded adjacent circuits | bypass/substitution refusals | fresh-repository full loop | capstone open |
|
||||
| Persona -> Bifrost -> public consequence | signed failure/unknown/no-repost | private-state and permit refusal | successful receipted consequence | blocked by external credential |
|
||||
| Worker process -> result/death -> archive | genuine Linux workers and zero-zombie reaping | resurrection and competing retry refused | both receipt orderings and restart | accepted; physical extraction pending |
|
||||
| Worker process -> result/death -> archive | genuine Linux workers and zero-zombie reaping | resurrection and competing retry refused | both receipt orderings and restart | source extraction complete; packaged replay pending |
|
||||
| Eve/CultUI operator interface | typed state surfaces | renderer cannot own truth | load/transition/settled/re-entry probes | open |
|
||||
|
||||
## Immediate order
|
||||
|
||||
1. Commit and push the causal/public-source identity consolidation.
|
||||
2. Extract `runtime_worker_attempt` without changing persisted contracts.
|
||||
3. Replay source tests and the accepted worker settlement/archive circuits.
|
||||
4. Resume shakedown with the packaged public Eyes success/denial pair.
|
||||
5. Run the fresh-repository full-organ capstone before any deployment-ready
|
||||
1. Commit and push `runtime_worker_attempt`.
|
||||
2. Replay the accepted worker settlement/archive circuits.
|
||||
3. Resume shakedown with the packaged public Eyes success/denial pair.
|
||||
4. Run the fresh-repository full-organ capstone before any deployment-ready
|
||||
claim.
|
||||
|
|
|
|||
Reference in a new issue