Type verification request closure semantics

epiphany-core/src/bin/epiphany-work.rs

@@ -7555,96 +7555,81 @@ fn closure_family_assertions(
             );
         }
         "repo.verification_request" => {
+            let request = parse_repo_verification_request(&content).ok();
             push_assertion(
                 &mut assertions,
                 "verification-request-schema-present",
-                content.contains("schema_version = \"epiphany.repo_verification_request.v0\""),
+                request
+                    .as_ref()
+                    .is_some_and(RepoVerificationRequest::has_canonical_identity),
                 "Committed verification request carries the schema version.".to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "verification-request-family-present",
-                content.contains("safe_action_family = \"repo.verification_request\""),
+                request
+                    .as_ref()
+                    .is_some_and(RepoVerificationRequest::has_canonical_identity),
                 "Committed verification request carries the safe action family.".to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "verification-request-summary-present",
-                content.contains(&compact_summary),
+                request
+                    .as_ref()
+                    .is_some_and(|request| request.summary == compact_summary),
                 "Committed verification request contains the accepted pressure summary."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "verification-request-awaits-soul-review",
-                content.contains("[request]")
-                    && content.contains("status = \"awaiting-soul-review\"")
-                    && content.contains("requested_owner = \"Soul\"")
-                    && content.contains("requested_effect = \"verify-branch-local-hands-work\"")
-                    && content.contains("work_order_ref = "),
+                request
+                    .as_ref()
+                    .is_some_and(RepoVerificationRequest::awaits_soul_review),
                 "Committed verification request waits for Soul review before proof consequence."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "verification-request-antecedents-present",
-                content.contains("[antecedents]")
-                    && content.contains("substrate_gate_required = true")
-                    && content.contains("hands_intent_required = true")
-                    && content.contains("hands_review_required = true")
-                    && content.contains("hands_patch_required = true")
-                    && content.contains("hands_command_required = true")
-                    && content.contains("hands_commit_required = true")
-                    && content.contains("work_order_required = true"),
+                request
+                    .as_ref()
+                    .is_some_and(RepoVerificationRequest::has_antecedent_contract),
                 "Committed verification request requires Substrate and Hands antecedents."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "verification-request-receipt-contract",
-                content.contains("[required_receipts]")
-                    && content.contains("hands_patch = \"epiphany.hands.patch_receipt\"")
-                    && content.contains("hands_command = \"epiphany.hands.command_receipt\"")
-                    && content.contains("hands_commit = \"epiphany.hands.commit_receipt\"")
-                    && content.contains("soul_verdict = \"epiphany.soul.verification_verdict\"")
-                    && content
-                        .contains("closure_review = \"epiphany.repo_work_closure_review.v0\"")
-                    && content.contains("mind_review = \"epiphany.mind.gateway_review\"")
-                    && content.contains("mind_commit = \"epiphany.mind.state_commit_receipt\""),
+                request
+                    .as_ref()
+                    .is_some_and(RepoVerificationRequest::has_receipt_contract),
                 "Committed verification request names Hands/Soul/closure/Mind receipt chain."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "verification-request-checks-present",
-                content.contains("[checks]")
-                    && content.contains("\"declared-paths-match-commit\"")
-                    && content.contains("\"hands-receipts-present\"")
-                    && content.contains("\"visible-diff-supports-summary\"")
-                    && content.contains("\"no-private-state-exposure\"")
-                    && content.contains("\"publication-remains-gated\"")
-                    && content.contains("failure_blocks_mind_admission = true"),
+                request
+                    .as_ref()
+                    .is_some_and(RepoVerificationRequest::has_check_contract),
                 "Committed verification request names the closure checks that Soul should run."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "verification-request-authority-seals",
-                content.contains("[authority]")
-                    && content.contains("soul_verdict_authorized = false")
-                    && content.contains("state_commit_authorized = false")
-                    && content.contains("hands_action_authorized = false")
-                    && content.contains("rerun_authorized = false")
-                    && content.contains("publication_authorized = false")
-                    && content.contains("cross_body_mutation_authorized = false")
-                    && content.contains("bifrost_publication_required = true"),
+                request.as_ref().is_some_and(RepoVerificationRequest::has_authority_seals),
                 "Committed verification request denies verdict/state/action/rerun/publication/cross-body authority."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "verification-request-private-seal",
-                content.contains("private_state_exposed = false"),
+                request
+                    .as_ref()
+                    .is_some_and(|request| !request.private_state_exposed),
                 "Committed verification request preserves the private-state seal.".to_string(),
             );
         }
@@ -15395,6 +15380,7 @@ idunn_deployment_authority_required = true
             "repo.sync_request",
             "repo.pr_request",
             "repo.maintainer_review_request",
+            "repo.verification_request",
             "repo.credit_request",
             "repo.artifact_acceptance_request",
             "repo.metrics_request",

epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs

@@ -704,4 +704,21 @@ pub(super) fn has_authority_seals(&self)->bool{let a=&self.authority;a.branch_lo
 #[derive(Debug,Deserialize)]struct RepoMaintainerReviewAuthority{branch_local_only:bool,maintainer_approval_authorized:bool,merge_authorized:bool,push_authorized:bool,publication_authorized:bool,upstream_sync_authorized:bool,hands_action_authorized:bool,service_lifecycle_authority:bool,cross_body_mutation_authorized:bool,private_verse_rummaging:bool,human_or_maintainer_response_required:bool}
 pub(super) fn parse_repo_maintainer_review_request(text:&str)->Result<RepoMaintainerReviewRequest>{toml::from_str(text).context("maintainer review request is not valid typed TOML")}
 
+#[derive(Debug,Deserialize)]
+pub(super) struct RepoVerificationRequest{pub(super)schema_version:String,pub(super)safe_action_family:String,pub(super)summary:String,pub(super)private_state_exposed:bool,request:RepoVerificationBody,antecedents:RepoVerificationAntecedents,required_receipts:RepoVerificationReceipts,checks:RepoVerificationChecks,authority:RepoVerificationAuthority}
+impl RepoVerificationRequest{
+pub(super)fn has_canonical_identity(&self)->bool{self.schema_version=="epiphany.repo_verification_request.v0"&&self.safe_action_family=="repo.verification_request"}
+pub(super)fn awaits_soul_review(&self)->bool{let r=&self.request;r.status=="awaiting-soul-review"&&r.requested_owner=="Soul"&&r.requested_effect=="verify-branch-local-hands-work"&&!r.work_order_ref.is_empty()}
+pub(super)fn has_antecedent_contract(&self)->bool{let a=&self.antecedents;a.substrate_gate_required&&a.hands_intent_required&&a.hands_review_required&&a.hands_patch_required&&a.hands_command_required&&a.hands_commit_required&&a.work_order_required}
+pub(super)fn has_receipt_contract(&self)->bool{let r=&self.required_receipts;r.hands_patch=="epiphany.hands.patch_receipt"&&r.hands_command=="epiphany.hands.command_receipt"&&r.hands_commit=="epiphany.hands.commit_receipt"&&r.soul_verdict=="epiphany.soul.verification_verdict"&&r.closure_review=="epiphany.repo_work_closure_review.v0"&&r.mind_review=="epiphany.mind.gateway_review"&&r.mind_commit=="epiphany.mind.state_commit_receipt"}
+pub(super)fn has_check_contract(&self)->bool{self.checks.required==["declared-paths-match-commit","hands-receipts-present","visible-diff-supports-summary","no-private-state-exposure","publication-remains-gated"]&&self.checks.model_verdict_allowed&&self.checks.failure_blocks_mind_admission}
+pub(super)fn has_authority_seals(&self)->bool{let a=&self.authority;a.branch_local_only&&!a.soul_verdict_authorized&&!a.state_commit_authorized&&!a.hands_action_authorized&&!a.rerun_authorized&&!a.publication_authorized&&!a.merge_authorized&&!a.service_lifecycle_authority&&!a.cross_body_mutation_authorized&&!a.private_verse_rummaging&&a.bifrost_publication_required}
+}
+#[derive(Debug,Deserialize)]struct RepoVerificationBody{status:String,requested_owner:String,requested_effect:String,work_order_ref:String}
+#[derive(Debug,Deserialize)]struct RepoVerificationAntecedents{substrate_gate_required:bool,hands_intent_required:bool,hands_review_required:bool,hands_patch_required:bool,hands_command_required:bool,hands_commit_required:bool,work_order_required:bool}
+#[derive(Debug,Deserialize)]struct RepoVerificationReceipts{hands_patch:String,hands_command:String,hands_commit:String,soul_verdict:String,closure_review:String,mind_review:String,mind_commit:String}
+#[derive(Debug,Deserialize)]struct RepoVerificationChecks{required:Vec<String>,model_verdict_allowed:bool,failure_blocks_mind_admission:bool}
+#[derive(Debug,Deserialize)]struct RepoVerificationAuthority{branch_local_only:bool,soul_verdict_authorized:bool,state_commit_authorized:bool,hands_action_authorized:bool,rerun_authorized:bool,publication_authorized:bool,merge_authorized:bool,service_lifecycle_authority:bool,cross_body_mutation_authorized:bool,private_verse_rummaging:bool,bifrost_publication_required:bool}
+pub(super)fn parse_repo_verification_request(text:&str)->Result<RepoVerificationRequest>{toml::from_str(text).context("verification request is not valid typed TOML")}
+
 include!("external_governance_tests.rs");

notes/conceptual-substitution-audit-2026-07-12.md

@@ -990,6 +990,16 @@ grant.
 
 Twelve high-authority families are now typed; 582 substring assertions remain.
 
+## Verification-request prose substituted for Soul authority
+
+`repo.verification_request` closure now parses exact typed request,
+Substrate/Hands antecedent, receipt-chain, required-check, and authority
+semantics. Soul owns the verdict; Mind admission remains downstream. The
+request grants no verdict, rerun, state commit, Hands, publication, lifecycle,
+or cross-body consequence. The class guard prevents substring fallback.
+
+Thirteen high-authority families are now typed; 543 substring assertions remain.
+
 The same inspection found 33 consecutive duplicate `#[cfg(test)]` attributes
 on provider constructors/writers and their re-exports. One gate already makes
 each item test-only; the second owned nothing. The duplicates are removed.

notes/fresh-workspace-handoff.md

@@ -308,6 +308,10 @@ Maintainer-review closure is now typed and class-guarded. Current count: twelve
 typed high-authority families and 582 remaining substring assertions. The
 explicit malicious maintainer-approval fixture now passes as a negative proof.
 
+Verification-request closure is now typed and class-guarded. Current count:
+thirteen typed high-authority families and 543 remaining substring assertions.
+Add the explicit malicious Soul-verdict fixture next.
+
 The latest structural count is 32 closure family branches, 744 remaining
 substring assertions in the closure region, and 1,284 lines in
 `closure_contracts.rs`. Do not blindly generate a struct forest for every

state/map.yaml

@@ -660,4 +660,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Continue the conceptual-substitution pass. Twelve high-authority closure families, now including maintainer review, are typed and guarded against regaining substring authority; maintainer review has an explicit malicious approval-grant fixture. The closure region still has 32 family branches and 582 substring assertions; closure contracts remain a parent-private lexical facade over external_governance and operations authority domains. Prioritize remaining consequence-bearing request families without building a blind struct forest. Provider chronology is explicitly external and guarded as arrival order. Continue auditing evidence/security mirrors and adapters for borrowed authority.
+  next_action: Continue the conceptual-substitution pass. Thirteen high-authority closure families, now including verification request, are typed and guarded against regaining substring authority. The closure region still has 32 family branches and 543 substring assertions; closure contracts remain a parent-private lexical facade over external_governance and operations authority domains. Add the explicit malicious Soul-verdict fixture next, then prioritize remaining consequence-bearing request families without building a blind struct forest. Provider chronology is explicitly external and guarded as arrival order. Continue auditing evidence/security mirrors and adapters for borrowed authority.