From 8074e6d1ddbc73464f520c9bed707d2c46f32fa1 Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sat, 20 Jun 2026 22:45:59 +0100
Subject: [PATCH] Add repo deployment execution runbook

---
 ...any-repo-deployment-config-family-smoke.rs |  49 +++++
 epiphany-core/src/bin/epiphany-work.rs        | 178 +++++++++++++++++-
 notes/epiphany-repo-swarm-mvp-contract.md     |  15 ++
 notes/fresh-workspace-handoff.md              |   1 +
 state/ledgers.msgpack                         | Bin 354555 -> 355175 bytes
 state/map.yaml                                |   6 +-
 6 files changed, 245 insertions(+), 4 deletions(-)

diff --git a/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs b/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs
index c1844178..d553e950 100644
--- a/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs
+++ b/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs
@@ -211,6 +211,16 @@ fn run_smoke(args: Args) -> Result<Value> {
         &["deployment-config-audit", "--workspace", path_str(&repo)?],
         &root,
     )?;
+    let runbook = cargo_json(
+        &manifest,
+        "epiphany-work",
+        &[
+            "deployment-execution-runbook",
+            "--workspace",
+            path_str(&repo)?,
+        ],
+        &root,
+    )?;
 
     require_eq(
         &plan,
@@ -299,6 +309,40 @@ fn run_smoke(args: Args) -> Result<Value> {
     require_bool(&audit, &["mergeAuthorized"], false)?;
     require_bool(&audit, &["daemonOwnsExecution"], true)?;
     require_bool(&audit, &["privateStateExposed"], false)?;
+    require_eq(
+        &runbook,
+        &["schemaVersion"],
+        "epiphany.repo_deployment_execution_runbook.v0",
+    )?;
+    require_eq(&runbook, &["status"], "ready-for-operator-git-push")?;
+    require_bool(&runbook, &["runbookWritten"], true)?;
+    require_bool(&runbook, &["requiresExplicitOperatorAuthority"], true)?;
+    require_bool(&runbook, &["mutatesRemoteWhenRun"], true)?;
+    require_bool(&runbook, &["executionAuthorized"], false)?;
+    require_bool(&runbook, &["deploymentAuthority"], false)?;
+    require_bool(&runbook, &["sshAuthority"], false)?;
+    require_bool(&runbook, &["gitPushAuthority"], false)?;
+    require_bool(&runbook, &["serviceLifecycleAuthority"], false)?;
+    require_bool(&runbook, &["handsAuthority"], false)?;
+    require_bool(&runbook, &["publicationAuthorized"], false)?;
+    require_bool(&runbook, &["mergeAuthorized"], false)?;
+    require_bool(&runbook, &["daemonOwnsExecution"], true)?;
+    require_bool(&runbook, &["privateStateExposed"], false)?;
+    require_eq(&runbook, &["watchedRef"], "refs/heads/main")?;
+    let runbook_path = value_at_path(&runbook, &["runbookPath"])
+        .and_then(Value::as_str)
+        .ok_or_else(|| anyhow!("missing runbook path"))?;
+    let runbook_text = fs::read_to_string(runbook_path)
+        .with_context(|| format!("failed to read runbook {runbook_path}"))?;
+    require_text(
+        &runbook_text,
+        "schema_version = \"epiphany.repo_deployment_execution_runbook.v0\"",
+    )?;
+    require_text(&runbook_text, "git push $Remote HEAD:refs/heads/main")?;
+    require_text(
+        &runbook_text,
+        "gamecult.idunn.deployment_aftercare_audit.v0",
+    )?;
 
     let summary = json!({
         "schemaVersion": "epiphany.repo_deployment_config_family_smoke.v0",
@@ -317,6 +361,11 @@ fn run_smoke(args: Args) -> Result<Value> {
         "deploymentConfigAuditStatus": audit["status"],
         "deploymentConfigAuditReceiptPath": audit["receiptPath"],
         "readyForIdunnReview": audit["readyForIdunnReview"],
+        "deploymentExecutionRunbookStatus": runbook["status"],
+        "deploymentExecutionRunbookPath": runbook["runbookPath"],
+        "deploymentExecutionRunbookSha256": runbook["runbookSha256"],
+        "requiresExplicitOperatorAuthority": runbook["requiresExplicitOperatorAuthority"],
+        "mutatesRemoteWhenRun": runbook["mutatesRemoteWhenRun"],
         "deploymentTrigger": "git-push-observed-by-idunn",
         "deploymentOwner": "Idunn",
         "daemonOwnsExecution": true,
diff --git a/epiphany-core/src/bin/epiphany-work.rs b/epiphany-core/src/bin/epiphany-work.rs
index 896ffe34..1cc13a03 100644
--- a/epiphany-core/src/bin/epiphany-work.rs
+++ b/epiphany-core/src/bin/epiphany-work.rs
@@ -123,6 +123,9 @@ fn main() -> Result<()> {
         "deployment-config-audit" | "audit-deployment-config" | "idunn-deployment-audit" => {
             run_deployment_config_audit(parse_deployment_config_audit_args(args)?)
         }
+        "deployment-execution-runbook" | "idunn-deployment-runbook" | "deployment-push-runbook" => {
+            run_deployment_execution_runbook(parse_deployment_execution_runbook_args(args)?)
+        }
         "export-proof" | "public-proof" => run_export_proof(parse_export_proof_args(args)?),
         "tick" | "pulse" | "schedule" => run_tick(parse_tick_args(args)?),
         "queue-run" | "run-queue" | "queue-tick" | "scheduler-run" => {
@@ -330,6 +333,14 @@ struct DeploymentConfigAuditArgs {
     write_receipt: bool,
 }
 
+#[derive(Clone, Debug)]
+struct DeploymentExecutionRunbookArgs {
+    workspace: PathBuf,
+    artifact_dir: Option<PathBuf>,
+    remote: String,
+    write_receipt: bool,
+}
+
 #[derive(Clone, Debug)]
 struct ExportProofArgs {
     workspace: PathBuf,
@@ -1125,6 +1136,36 @@ fn parse_deployment_config_audit_args(
     })
 }
 
+fn parse_deployment_execution_runbook_args(
+    args: impl Iterator<Item = String>,
+) -> Result<DeploymentExecutionRunbookArgs> {
+    let mut workspace = None;
+    let mut artifact_dir = None;
+    let mut remote = "origin".to_string();
+    let mut write_receipt = true;
+
+    let mut args = args.peekable();
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--workspace" => workspace = Some(take_path(&mut args, "--workspace")?),
+            "--artifact-dir" => artifact_dir = Some(take_path(&mut args, "--artifact-dir")?),
+            "--remote" => remote = take_string(&mut args, "--remote")?,
+            "--no-write" | "--read-only" => write_receipt = false,
+            other => {
+                return Err(anyhow!(
+                    "unexpected deployment-execution-runbook argument {other:?}"
+                ));
+            }
+        }
+    }
+    Ok(DeploymentExecutionRunbookArgs {
+        workspace: workspace.context("missing --workspace")?,
+        artifact_dir,
+        remote,
+        write_receipt,
+    })
+}
+
 fn parse_export_proof_args(args: impl Iterator<Item = String>) -> Result<ExportProofArgs> {
     let mut workspace = None;
     let mut item = None;
@@ -10405,6 +10446,128 @@ fn run_deployment_config_audit(args: DeploymentConfigAuditArgs) -> Result<Value>
     Ok(receipt)
 }
 
+fn run_deployment_execution_runbook(args: DeploymentExecutionRunbookArgs) -> Result<Value> {
+    let workspace = args
+        .workspace
+        .canonicalize()
+        .with_context(|| format!("failed to resolve {}", args.workspace.display()))?;
+    ensure_git_repo(&workspace)?;
+    let artifact_dir = args
+        .artifact_dir
+        .unwrap_or_else(|| workspace.join(".epiphany").join("work"));
+    fs::create_dir_all(&artifact_dir)
+        .with_context(|| format!("failed to create {}", artifact_dir.display()))?;
+
+    let config_path = workspace.join(".epiphany").join("deployment.toml");
+    let config_text = if config_path.exists() {
+        fs::read_to_string(&config_path)
+            .with_context(|| format!("failed to read {}", config_path.display()))?
+    } else {
+        String::new()
+    };
+    let watched_ref = deployment_config_string_value(&config_text, "watched_ref")
+        .unwrap_or_else(|| "refs/heads/main".to_string());
+    let deployment_script_ref =
+        deployment_config_string_value(&config_text, "deployment_script_ref")
+            .unwrap_or_else(|| "deploy/idunn-deploy.ps1".to_string());
+    let current_branch = git_output(&workspace, &["rev-parse", "--abbrev-ref", "HEAD"])?;
+    let current_commit = git_output(&workspace, &["rev-parse", "HEAD"])?;
+    let generated_at = Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true);
+    let receipt_path = artifact_dir.join("deployment-execution-runbook.json");
+    let runbook_dir = artifact_dir.join("idunn-deployment");
+    let runbook_path = runbook_dir.join("idunn-git-push-runbook.ps1");
+    let audit = run_deployment_config_audit(DeploymentConfigAuditArgs {
+        workspace: workspace.clone(),
+        artifact_dir: Some(artifact_dir.clone()),
+        write_receipt: args.write_receipt,
+    })?;
+    let ready_for_idunn = audit.get("readyForIdunnReview").and_then(Value::as_bool) == Some(true);
+    let push_command = format!("git push {} HEAD:{watched_ref}", args.remote);
+    let operator_execution_command = format!(
+        "powershell -ExecutionPolicy Bypass -File {} -Remote {}",
+        powershell_single_quoted(&runbook_path.display().to_string()),
+        powershell_single_quoted(&args.remote)
+    );
+    let mut runbook_written = false;
+    let mut runbook_sha256 = Value::Null;
+
+    if ready_for_idunn && args.write_receipt {
+        fs::create_dir_all(&runbook_dir)
+            .with_context(|| format!("failed to create {}", runbook_dir.display()))?;
+        let runbook = [
+            "# schema_version = \"epiphany.repo_deployment_execution_runbook.v0\"".to_string(),
+            "# owner = \"Idunn\"".to_string(),
+            "# authority = \"explicit-operator-git-push\"".to_string(),
+            "# generated_by = \"epiphany-work deployment-execution-runbook\"".to_string(),
+            "param([string]$Remote = 'origin')".to_string(),
+            "$ErrorActionPreference = 'Stop'".to_string(),
+            format!("Set-Location -LiteralPath {}", powershell_single_quoted(&workspace.display().to_string())),
+            "Write-Host 'Epiphany Idunn deployment handoff: operator-owned git push.'".to_string(),
+            "Write-Host 'This runbook mutates the remote ref; run only with explicit operator authority.'".to_string(),
+            "git status --short".to_string(),
+            format!("git push $Remote HEAD:{watched_ref}"),
+            "Write-Host 'Aftercare: wait for Idunn deployment receipt and aftercare audit on CultMesh.'".to_string(),
+            "Write-Host 'Required receipts: gamecult.idunn.deployment_receipt.v0 and gamecult.idunn.deployment_aftercare_audit.v0.'".to_string(),
+        ]
+        .join("\n");
+        fs::write(&runbook_path, runbook)
+            .with_context(|| format!("failed to write {}", runbook_path.display()))?;
+        runbook_written = true;
+        runbook_sha256 = json!(file_sha256(&runbook_path)?);
+    }
+
+    let status = if ready_for_idunn {
+        "ready-for-operator-git-push"
+    } else {
+        "blocked-config-not-ready"
+    };
+    let receipt = json!({
+        "schemaVersion": "epiphany.repo_deployment_execution_runbook.v0",
+        "runbookId": "repo-idunn-git-push-runbook",
+        "generatedAt": generated_at,
+        "status": status,
+        "workspace": workspace,
+        "configPath": config_path,
+        "configAudit": audit,
+        "receiptPath": receipt_path,
+        "runbookPath": if runbook_written { json!(runbook_path) } else { Value::Null },
+        "runbookSha256": runbook_sha256,
+        "runbookWritten": runbook_written,
+        "operatorExecutionCommand": if runbook_written {
+            json!(operator_execution_command)
+        } else {
+            Value::Null
+        },
+        "gitPushCommand": push_command,
+        "remote": args.remote,
+        "watchedRef": watched_ref,
+        "currentBranch": current_branch,
+        "currentCommit": current_commit,
+        "deploymentScriptRef": deployment_script_ref,
+        "requiredIdunnReceipts": [
+            "gamecult.idunn.deployment_receipt.v0",
+            "gamecult.idunn.deployment_aftercare_audit.v0"
+        ],
+        "requiresExplicitOperatorAuthority": true,
+        "mutatesRemoteWhenRun": true,
+        "executionAuthorized": false,
+        "deploymentAuthority": false,
+        "sshAuthority": false,
+        "gitPushAuthority": false,
+        "serviceLifecycleAuthority": false,
+        "handsAuthority": false,
+        "publicationAuthorized": false,
+        "mergeAuthorized": false,
+        "crossBodyMutationAuthorized": false,
+        "daemonOwnsExecution": true,
+        "privateStateExposed": false
+    });
+    if args.write_receipt {
+        write_json(&receipt_path, &receipt)?;
+    }
+    Ok(receipt)
+}
+
 fn run_export_proof(args: ExportProofArgs) -> Result<Value> {
     let workspace = args
         .workspace
@@ -12449,6 +12612,18 @@ fn compact_text(text: &str, limit: usize) -> String {
     truncated
 }
 
+fn deployment_config_string_value(text: &str, key: &str) -> Option<String> {
+    let prefix = format!("{key} = ");
+    for line in text.lines() {
+        let trimmed = line.trim();
+        if let Some(value) = trimmed.strip_prefix(&prefix) {
+            let value = value.strip_prefix('"')?.strip_suffix('"')?;
+            return Some(value.to_string());
+        }
+    }
+    None
+}
+
 fn read_json(path: &Path) -> Result<Value> {
     let raw =
         fs::read_to_string(path).with_context(|| format!("failed to read {}", path.display()))?;
@@ -12549,7 +12724,7 @@ fn sanitize(value: &str) -> String {
 
 fn print_usage() {
     eprintln!(
-        "usage: epiphany-work <persona-intake|accept|derive-plan|plan|run|adopt|execute|close|publish|sync|overview|deployment-config-audit|export-proof|tick|queue-run|serve> ...\n\
+        "usage: epiphany-work <persona-intake|accept|derive-plan|plan|run|adopt|execute|close|publish|sync|overview|deployment-config-audit|deployment-execution-runbook|export-proof|tick|queue-run|serve> ...\n\
          persona-intake --workspace <repo> --item <id> --message <text> [--topic <topic>] [--store <local-verse.ccmp>] [--runtime-id <id>]\n\
          accept --workspace <repo> --from <persona|bifrost|persona-or-bifrost> --item <id> [--summary <text>] [--topic <topic>] [--store <local-verse.ccmp>] [--runtime-id <id>] [--online-receipt <path>] [--public-discussion-ref <ref>] [--candidate-action-ref <ref>]\n\
          derive-plan --workspace <repo> [--item <id>] [--accept-receipt <path>] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card|repo-manifest|repo-tool-capabilities|repo-tool-request|repo-eve-surface|repo-collaboration-policy|repo-collaboration-topic|repo-consensus-brief|repo-objective-draft|repo-adoption-request|repo-scheduling-request|repo-work-order|repo-verification-request|repo-publication-request|repo-sync-request|repo-maintainer-review-request|repo-pr-request|repo-credit-request|repo-artifact-acceptance-request|repo-metrics-request|repo-doctrine-update-request|repo-secret-policy-request|repo-deployment-config|repo-deployment-request] [--target-path <path>] [--model-ref <ref>] [--model-authored] [--action-summary <text>] [--verification-ask <text>] [--stop-condition <text>] [--escalation-reason <text>] [--assumption <text>] [--constraint <text>] [--non-goal <text>] [--open-question <text>] [--decision-point <text>] [--evidence-need <text>]\n\
@@ -12562,6 +12737,7 @@ fn print_usage() {
          sync --workspace <repo> [--item <id>] [--publish-receipt <path>] [--upstream-ref origin/main] --merge-receipt <ref>\n\
          overview --workspace <repo> [--item <id>] [--accept-receipt <path>] [--no-write]\n\
          deployment-config-audit --workspace <repo> [--artifact-dir <path>] [--no-write]\n\
+         deployment-execution-runbook --workspace <repo> [--artifact-dir <path>] [--remote origin] [--no-write]\n\
          export-proof --workspace <repo> [--item <id>] [--accept-receipt <path>] [--output <path>] [--local-verse-store <path>] [--runtime-id repo-swarm-local]\n\
          tick --workspace <repo> [--item <id>] [--local-verse-store <path>] [--runtime-store <path>] [--dry-run]\n\
          queue-run --workspace <repo> [--local-verse-store <path>] [--runtime-id repo-swarm-local] [--max-items 1] [--dry-run]"
diff --git a/notes/epiphany-repo-swarm-mvp-contract.md b/notes/epiphany-repo-swarm-mvp-contract.md
index b644bd63..5e50222d 100644
--- a/notes/epiphany-repo-swarm-mvp-contract.md
+++ b/notes/epiphany-repo-swarm-mvp-contract.md
@@ -789,6 +789,21 @@ Idunn git-push contract as `ready-for-idunn-review` while keeping
 `.epiphany-smoke\repo-deployment-config-family-20260620-213042` proved the
 audit receipt beside the family close path.
 
+The matching execution handoff is now a runbook, not a hidden deployment act.
+`epiphany-work deployment-execution-runbook --workspace <repo>` reruns the
+config audit, then writes
+`.epiphany/work/idunn-deployment/idunn-git-push-runbook.ps1` only when the
+config is ready for Idunn review. The receipt
+`epiphany.repo_deployment_execution_runbook.v0` reports
+`ready-for-operator-git-push`, the exact `git push origin
+HEAD:refs/heads/main` handoff, the runbook SHA-256, and the required Idunn
+deployment/aftercare receipt contracts. It also marks
+`requiresExplicitOperatorAuthority=true` and `mutatesRemoteWhenRun=true` while
+keeping repo-agent execution, deployment, SSH, git-push, service lifecycle,
+Hands, publication, merge, and cross-body authority false. Smoke
+`.epiphany-smoke\repo-deployment-config-family-20260620-214109` proved the
+runbook beside config close and audit.
+
 ### Landed Work Run Gate
 
 The sixth front door exists as native Rust:
diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md
index 112f30cb..e00c159c 100644
--- a/notes/fresh-workspace-handoff.md
+++ b/notes/fresh-workspace-handoff.md
@@ -127,6 +127,7 @@ remembers doctrine; the branch remembers the blade.
 - 2026-06-20: Gjallar now has a changed-path lens over Mind-admitted repo-work maps. `repoWorkMapPathLensRows` / `REPO-WORK-MAP-PATH` group accepted map consequences by changed repo path, with item count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`. Smoke `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205740` reran the counterfeit-adoption guard and proved `gjallarRepoWorkMapPathLensCount=1` alongside the family lens. The next map work is richer semantic/source-grounded lenses beyond safe-family and path aggregation.
 - 2026-06-20: Gjallar now has a branch lens over Mind-admitted repo-work maps. `repoWorkMapBranchLensRows` / `REPO-WORK-MAP-BRANCH` group accepted map consequences by branch with item count, changed-path count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`. Smoke `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-210747` reran the counterfeit-adoption guard and proved `gjallarRepoWorkMapBranchLensCount=1` alongside the family/path lenses. This is branch-workbench sight only: Gjallar still does not schedule, publish, merge, deploy, keep daemons alive, or admit Mind state.
 - 2026-06-20: `epiphany-work deployment-config-audit` is live as the non-mutating Idunn handoff readback for repo deployment config. It reads `.epiphany/deployment.toml`, writes `epiphany.repo_deployment_config_audit.v0`, reports `ready-for-idunn-review` only when the disabled git-push Idunn trigger, CultMesh intent/receipt/aftercare contracts, required receipts, and authority seals are present, and always keeps execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-213042` proved the audit beside the `repo.deployment_config` close path with `daemonOwnsExecution=true`, `readyForIdunnReview=true`, and `privateStateExposed=false`.
+- 2026-06-20: `epiphany-work deployment-execution-runbook` is live as the explicit operator-owned git-push handoff for Idunn deployment. It requires the deployment config audit to pass, writes `.epiphany/work/idunn-deployment/idunn-git-push-runbook.ps1`, emits `epiphany.repo_deployment_execution_runbook.v0`, reports `ready-for-operator-git-push`, includes the exact `git push origin HEAD:refs/heads/main` route, runbook SHA-256, and required Idunn deployment/aftercare receipt contracts, and marks `requiresExplicitOperatorAuthority=true` plus `mutatesRemoteWhenRun=true` while keeping execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false for the repo agent. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-214109` proved the runbook with `deploymentExecutionRunbookStatus=ready-for-operator-git-push`, SHA-256 `57560eda912b6e5c15f97acf53500534bb3bcf739098f329add3d88e5a9cd1d3`, and `privateStateExposed=false`.
 - 2026-06-20: Deeper model-authored closure review is now live. `epiphany-work close` accepts `--closure-model-verdict passed|failed|needs-work|blocked`, `--closure-model-finding`, and `--require-closure-model-verdict`; the close review embeds `epiphany.repo_work_model_closure_review.v0` under `modelingReview.closureReview`, records reviewed inputs and gate enforcement, and Soul refuses closure when a supplied or required model verdict does not pass. Focused smoke `.epiphany-smoke\closure-model-gate-20260620-135103` created a disposable repo, ran two `repo.status_section` items through public front doors, closed one with required model verdict `passed`, and blocked one with `needs-work` while `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - 2026-06-20: Mind adoption/interpreter depth now has a concrete interpretation packet. `epiphany-work adopt` writes `epiphany.repo_work_mind_adoption_decision.v0` before the main adoption receipt, embeds `epiphany.repo_work_mind_interpretation.v0` with input summary, safe-family recognition, requested-path classification, allowed branch-local Hands transition, and forbidden durable-state/publication/service/private transitions, then records Self presentation, Mind evidence review, safe-family requirement, branch-local scope, Bifrost publication gate, Soul closure requirement, and no Hands/durable-state/publication/merge/service/cross-body/private authority inside the Mind decision; the main adoption receipt cites that decision before granting branch-local Hands authority. Focused smoke `.epiphany-smoke\repo-planning-facets-20260620-175503` proves model-authored planning facets survive into Imagination, plan derivation, Mind interpretation, Mind decision, and adoption, while close still passes Soul/family/path checks with `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics beyond the first Mind interpretation packet, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - 2026-06-20: `repo-manifest` is now the next non-planning safe family. `epiphany-work derive-plan --action-family repo-manifest` lowers accepted pressure into a structured `epiphany.toml` Body manifest with safe family `repo.body_manifest`, body domain, private/local/public Verse ids, Eve surface id, receipt-required capability hints, arbitrary shell sealed false, and private-state seals. Soul closure assertions now inspect the committed manifest for schema, safe family, summary, body domain, Verse ids, Eve surface, receipt requirement, no arbitrary shell, and private-state seals. Focused smoke `.epiphany-smoke\repo-manifest-family-20260620-141552` ran a disposable repo through init -> online -> accept -> repo-manifest derive-plan -> tick run/adopt/execute/close; Hands committed only `epiphany.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, additional useful repo-owned config/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack
index a4dbf78c99e165fab8abe96553ae905d2d07a4d1..c3877bc8c2db9b37f84aa944f039ede28d841799 100644
GIT binary patch
delta 447
zcmYL_ziU)M5XXIYw;&uAA_oytOh|jjy&t!C_YMq1QkXU&1Og)ac4zOc-tE5Z+tpa5
zu+YNx*fzD5U=jQW?32P?5bOe}ZG7=ZEWS)J-}%gZ=jTQ5$JgG+wWvFyvvhLw<qmni
z^Jz0Wj-rD%tJd39D{6F8+l@Nss}_+moLzSA-A$9(@0oD@y}j1m5?C$F>m_OzzI|vv
z*itnt)Jp_bgDVm6q*^Gh9GD6%bH)zLD~$qnh1VM9$_*-Cmryb-jFhtwZIJcw{)lwL
z6_SUYQ4;5&U6PIac!JzJW%M)abz#hl5SOHPdW-#s>cihY>_6Eaq;w2)LdP)*mM3X3
zM#>W^^9kdUW;BjzHY$p&;Bu1XaXyt<nlm9XF`Xi1ITwk@`b`MN9axn0utX;6;gTs0
zH-}TO#yf15;;~ouHrW5K44HIjIkVV!II7Ck{qXK-XFch|(mUp`-ovGFcvzy|^ZJpq
azTs)p*ef$&^X9Yg2Nz&Ydf{_P9{&P@PnY!o

delta 53
zcmaEUP4xFg(G3!e+{PwWCgxGc7+BM9Y*uD0WMm9!p32ldm5C9EK{PWEvuvNr#F~}{
E0Q<KQQ2+n{

diff --git a/state/map.yaml b/state/map.yaml
index f8275d77..dc99cd1c 100644
--- a/state/map.yaml
+++ b/state/map.yaml
@@ -88,7 +88,7 @@ active_subgoals:
   - Keep the landed Phase 6 coordinator, limited safe-boundary CRRC automation, and pre-compaction checkpoint intervention ready for the next bridge-equipped dogfood run.
   - Preserve the Ghostlight-derived heartbeat initiative seam: every lane, including coordinator/Self and Persona, has a organ-state record and competes for heartbeat slots through readiness/reaction timing; initiative heat can raise or cool global, group, arena, role, and agent tempo through typed heartbeat policy; active thinking freezes initiative until completion, so heat never queues a lane already mid-turn; idle winners ruminate instead of inventing project work, and sleep windows distill the accumulated thought pressure into reviewed self-memory or doctrine.
   - Use `notes/epiphany-swarm-readiness-plan.md` as the live-fire direction gate. The local run path is a compass, not launch clearance: before unattended swarm operation, Epiphany needs typed pause/brake enforcement, one initiative scheduler, completion-gated cooldown, stale active-turn recovery receipts, parent-side Persona speech eligibility, memory lifecycle operations, and CultNet-first operator snapshots/intents/receipts. The local Verse brake document exists, `epiphany-verse-query swarm-brake` can engage/release it, `tools/epiphany_local_run.ps1` refuses live `plan`/`run`/`mvp` modes when the brake is engaged while leaving `status` readable, `epiphany-mvp-coordinator` checks the local Verse brake before app-server startup, and `epiphany-heartbeat-store` guards tick/pump/heat/queue-mention/routine when given `--local-verse-store`. Daemon liveness is now a typed local Verse authority: `epiphany-verse-query daemon-status` writes one daemon status without repainting the table, local Verse seeding preserves existing daemon statuses and swarm brakes, `invoke-tool` refuses when the host daemon is not ready or lacks `submitTypedToolIntent`, and both daemon tool invocation and lifecycle poke fail closed under an engaged matching brake. `epiphany-daemon-supervisor policy` writes durable per-daemon restart policy with command/args/cwd/cooldown/backoff/attempt state plus reconcile cadence and stale-heartbeat threshold; `epiphany-daemon-supervisor reconcile` loads that policy when no override command is supplied, refuses under a matching lifecycle brake, refuses during cooldown/backoff, writes daemon poke intent/receipt, updates daemon status, and updates policy attempt state; `epiphany-daemon-supervisor tick` is an explicit scheduler pulse that scans durable policies, records ready/noop pulses, skips before the configured reconcile interval, marks stale heartbeat status degraded, routes restarts through the same brake/cooldown/poke receipt path, and writes a latest `epiphany.cultmesh.daemon_scheduler_receipt.v0`; `epiphany-daemon-supervisor serve` runs that same pulse on a configurable cadence with bounded `--max-iterations` proof mode or unbounded service mode. `epiphany-daemon-supervisor service-plan`/`install-service` now writes a planned `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` for the `serve` command, while `service-launch`/`start-service` spawns that `serve` loop through the current executable or `--service-command`, can `--wait-child` for bounded proof, and records command/args/cwd, scheduler id, daemon selector, pid/exit/status, artifact ref, and private-state guard. `service-runbook`, `windows-service-install`/`service-install-plan`, `windows-service-status`, `windows-service-reconcile`, `windows-service-execution-readiness`, and `windows-service-start`/`stop` now record service lifecycle receipts through the same local Verse; the read-only status path has been proved against the real Windows `EventLog` service with receipt `daemon-service-lifecycle-receipt-windows-eventlog-proof-windows-service-status`, status `running`, exit code `0`, and `privateStateExposed=false`; the read-only service-policy reconciliation path has been proved for missing service, real-service drift against `EventLog`, lifecycle-brake refusal, and wrapper/local-Verse receipt `daemon-service-lifecycle-receipt-windows-eventlog-reconcile-proof-windows-service-reconcile`; execution readiness has been proved as a non-mutating `not-elevated` receipt through direct and wrapper paths; start/stop now produce non-mutating `start-planned`/`stop-planned` receipts unless `--execute-control`/`--execute-service-control` is passed, and wrapper `service-start-plan`/`service-stop-plan` proves those receipts against `EventLog`; explicit install/control execution now refuses as `execution-refused-not-elevated` with `executed=false` when the shell lacks Windows administrator authority, and wrapper `service-install-execute`, `service-start-execute`, and `service-stop-execute` prove those refusal receipts without mutation. Service lifecycle actions check the local Verse swarm brake before process launch, artifact writes, service-manager queries, service-policy reconciliation, execution-readiness checks, control planning, elevation-gated execution, or start/stop execution. The local wrapper builds/checks this binary.
-  - Use `notes/epiphany-repo-swarm-mvp-contract.md` as the repo-swarm autonomy authority map. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruption, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Current safe-family cargo includes repo manifest, tool capability manifest, daemon-hosted tool request cargo, Eve/CultUI surface contract, repo collaboration policy, collaboration topics, consensus/objective/adoption/scheduling/work-order/verification/publication/sync/review/PR/credit/artifact/metrics/doctrine-update/secret-policy/deployment requests, repo deployment config, action-item receipts, Mind adoption interpretation/decision receipts, explicit Mind safe-family refusal proof `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, explicit Mind requested-path/plan changed-path refusal proof `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, overview/public-proof/Gjallar/Eve readbacks, typed swarm-run stop classification, Idunn non-mutating queue-run lifecycle receipts, and fresh-repo upstream-main proof. Latest deployment config proof `.epiphany-smoke\repo-deployment-config-family-20260620-213042` shows `repo.deployment_config` closes through Soul while writing disabled Idunn-owned git-push deployment config, then `epiphany-work deployment-config-audit` emits `epiphany.repo_deployment_config_audit.v0` with status `ready-for-idunn-review`, `daemonOwnsExecution=true`, and no execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority. Latest deployment request proof `.epiphany-smoke\repo-deployment-request-family-20260620-195605` shows `repo.deployment_request` closes through Soul while requesting reviewed git-push-observed-by-Idunn deployment with script/host/secret/rollback/aftercare requirements and no deployment/SSH/git-push/service authority. Latest security cargo proof `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` shows `repo.secret_policy_request` closes through Soul while requesting reviewed secret/write/export/deployment policy without exposing secrets or granting write/deployment/publication authority. Governance proof `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` shows `repo.doctrine_update_request` closes through Soul while requesting reviewed `AGENTS.md` doctrine work without mutating doctrine or granting Hands/service/publication authority. Swarm-run stop proofs now include `.epiphany-smoke\fresh-repo-mvp-20260620-180024` for `iteration-limit` / Self / `self.scheduler-iteration-limit` with upstream-main sync and public-proof export, plus `.epiphany-smoke\swarm-stop-classification-20260620-184717` for `queue-empty` / Gjallar / `repo.work.overview`, `dry-run-preview` / Self / `ready-to-run`, `authority-gated` / Bifrost / `awaiting-publication`, and `authority-gated` / Bifrost/GitHub / `awaiting-upstream-sync`; all stop packets are non-mutating, non-elevated, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853` now proves Idunn-owned non-mutating repo-work queue-run service plan/runbook receipts for exact service id `epiphany-repo-work-queue-runner`, receipt-directory readback, runbook SHA-256 `f2ec67c4f8243a3ebc2f9e915b6b9f5ae2ac2d99d2cdb86905b54667adc456f8`, `hostedBody=repo-work`, no service-manager mutation, no launch, no elevation, and `privateStateExposed=false`.
+  - Use `notes/epiphany-repo-swarm-mvp-contract.md` as the repo-swarm autonomy authority map. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruption, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Current safe-family cargo includes repo manifest, tool capability manifest, daemon-hosted tool request cargo, Eve/CultUI surface contract, repo collaboration policy, collaboration topics, consensus/objective/adoption/scheduling/work-order/verification/publication/sync/review/PR/credit/artifact/metrics/doctrine-update/secret-policy/deployment requests, repo deployment config, action-item receipts, Mind adoption interpretation/decision receipts, explicit Mind safe-family refusal proof `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, explicit Mind requested-path/plan changed-path refusal proof `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, overview/public-proof/Gjallar/Eve readbacks, typed swarm-run stop classification, Idunn non-mutating queue-run lifecycle receipts, and fresh-repo upstream-main proof. Latest deployment config proof `.epiphany-smoke\repo-deployment-config-family-20260620-214109` shows `repo.deployment_config` closes through Soul, `epiphany-work deployment-config-audit` emits `epiphany.repo_deployment_config_audit.v0` with status `ready-for-idunn-review`, and `epiphany-work deployment-execution-runbook` emits `epiphany.repo_deployment_execution_runbook.v0` with status `ready-for-operator-git-push`, runbook SHA-256 `57560eda912b6e5c15f97acf53500534bb3bcf739098f329add3d88e5a9cd1d3`, `requiresExplicitOperatorAuthority=true`, `mutatesRemoteWhenRun=true`, `daemonOwnsExecution=true`, and no repo-agent execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority. Latest deployment request proof `.epiphany-smoke\repo-deployment-request-family-20260620-195605` shows `repo.deployment_request` closes through Soul while requesting reviewed git-push-observed-by-Idunn deployment with script/host/secret/rollback/aftercare requirements and no deployment/SSH/git-push/service authority. Latest security cargo proof `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` shows `repo.secret_policy_request` closes through Soul while requesting reviewed secret/write/export/deployment policy without exposing secrets or granting write/deployment/publication authority. Governance proof `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` shows `repo.doctrine_update_request` closes through Soul while requesting reviewed `AGENTS.md` doctrine work without mutating doctrine or granting Hands/service/publication authority. Swarm-run stop proofs now include `.epiphany-smoke\fresh-repo-mvp-20260620-180024` for `iteration-limit` / Self / `self.scheduler-iteration-limit` with upstream-main sync and public-proof export, plus `.epiphany-smoke\swarm-stop-classification-20260620-184717` for `queue-empty` / Gjallar / `repo.work.overview`, `dry-run-preview` / Self / `ready-to-run`, `authority-gated` / Bifrost / `awaiting-publication`, and `authority-gated` / Bifrost/GitHub / `awaiting-upstream-sync`; all stop packets are non-mutating, non-elevated, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853` now proves Idunn-owned non-mutating repo-work queue-run service plan/runbook receipts for exact service id `epiphany-repo-work-queue-runner`, receipt-directory readback, runbook SHA-256 `f2ec67c4f8243a3ebc2f9e915b6b9f5ae2ac2d99d2cdb86905b54667adc456f8`, `hostedBody=repo-work`, no service-manager mutation, no launch, no elevation, and `privateStateExposed=false`.
   - Mind-admitted repo-work map facts now leave local Verse sight. Successful `epiphany-work close` first admits `.epiphany/state/repo-work-map.msgpack` as `epiphany.repo_work_map_store.v0`, then mirrors the accepted item fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0` under `gamecult-local/repo-work-map/latest`. `epiphany-verse-query gjallar` exposes `repoWorkMapRows`, `repoWorkMapTuiRows`, and `latestRepoWorkMapEntry` with safe family, changed-path count, Soul verdict id, Mind review/commit ids, Bifrost gate, source map store ref, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` plus direct Gjallar readback showed one compact `REPO-WORK-MAP` row after counterfeit Mind adoption was refused and the real close passed. This is sight only; Gjallar still does not schedule, publish, merge, deploy, keep daemons alive, or open private state.
   - Gjallar now derives the first repo-work map semantic lens from Mind-admitted local Verse map rows. `repoWorkMapFamilyLensRows` / `REPO-WORK-MAP-LENS` group accepted repo-work consequences by safe action family, with item count, changed-path count, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205055` reran the counterfeit-adoption guard and passed with `gjallarRepoWorkMapFamilyLensCount=1`. This is aggregate sight only, not scheduling, publication, merge, deployment, service lifecycle, or Mind admission authority.
   - Gjallar now derives a changed-path repo-work map lens from the same Mind-admitted local Verse rows. `repoWorkMapPathLensRows` / `REPO-WORK-MAP-PATH` group accepted consequences by changed repo path, with item count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205740` passed with `gjallarRepoWorkMapPathLensCount=1` beside the family lens. This lets agents see which Body paths have accepted work without opening private receipts or granting Gjallar actuation authority.
@@ -638,5 +638,5 @@ current_status:
   - `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness.
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
-  last_completed_repo_swarm_cut: `epiphany-work deployment-config-audit` is now the non-mutating Idunn handoff readback for branch-local repo deployment configuration. It reads `.epiphany/deployment.toml`, writes `epiphany.repo_deployment_config_audit.v0`, reports `ready-for-idunn-review` only when the disabled Idunn git-push trigger, CultMesh intent/receipt/aftercare contracts, required receipts, and authority seals are present, and always keeps execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false. Proof `.epiphany-smoke\repo-deployment-config-family-20260620-213042` closed the `repo.deployment_config` family through Soul and then proved the audit with `deploymentConfigAuditStatus=ready-for-idunn-review`, `readyForIdunnReview=true`, `daemonOwnsExecution=true`, and `privateStateExposed=false`.
-  next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `task-card` / `repo.task_card`, `repo-status-section` / `repo.status_section`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo.doctrine_update_request`, `repo.secret_policy_request`, `repo.deployment_config`, and `repo.deployment_request`, typed Imagination action-item receipts over allowlisted safe families, `epiphany.repo_work_mind_interpretation.v0` plus `epiphany.repo_work_mind_adoption_decision.v0` Mind interpreter receipts, explicit safe-family allowlist refusal, explicit requested-path/plan-changed-path mismatch refusal, Soul closure's Mind-adoption proof guard, durable repo-work map admission before branch-local Hands consequences reach publication gates, local Verse `epiphany.cultmesh.repo_work_map_entry.v0` Gjallar readback for Mind-admitted map facts, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts including native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853`, non-mutating `epiphany-work deployment-config-audit` proof `.epiphany-smoke\repo-deployment-config-family-20260620-213042`, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; proofs `.epiphany-smoke\fresh-repo-mvp-20260620-180024`, `.epiphany-smoke\swarm-stop-classification-20260620-184717`, `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140`, `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046`, `.epiphany-smoke\repo-deployment-config-family-20260620-213042`, `.epiphany-smoke\repo-deployment-request-family-20260620-195605`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-201153`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-202113`, and `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` show fresh-repo iteration-limit stop classification, empty-queue Gjallar classification, dry-run planning-preview Self classification, Bifrost publication-gate classification, Bifrost/GitHub upstream-sync gate classification, Mind refusal for unsupported safe-family cargo and mismatched requested paths, reviewed doctrine/security/deployment config/request cargo, deployment-config audit readiness for Idunn review, closure refusal for counterfeit Mind adoption, durable repo-map admission only after passing closure, local Verse/Gjallar map projection, closure, publication receipts, upstream-main sync, public-proof export, and private-state sealing. The contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper interpreter/closure depth or explicit Idunn deployment execution under operator authority. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start/deployment execution still requires explicit elevated operator authority.
+  last_completed_repo_swarm_cut: `epiphany-work deployment-execution-runbook` is now the explicit operator-owned git-push handoff for branch-local Idunn deployment configuration. It requires `deployment-config-audit` to pass, writes `.epiphany/work/idunn-deployment/idunn-git-push-runbook.ps1`, emits `epiphany.repo_deployment_execution_runbook.v0`, reports `ready-for-operator-git-push`, includes the exact `git push origin HEAD:refs/heads/main` route, required Idunn deployment/aftercare receipts, and runbook SHA-256, and marks `requiresExplicitOperatorAuthority=true` plus `mutatesRemoteWhenRun=true` while keeping repo-agent execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority false. Proof `.epiphany-smoke\repo-deployment-config-family-20260620-214109` closed the `repo.deployment_config` family through Soul, proved config audit readiness, and proved the runbook with SHA-256 `57560eda912b6e5c15f97acf53500534bb3bcf739098f329add3d88e5a9cd1d3` and `privateStateExposed=false`.
+  next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `task-card` / `repo.task_card`, `repo-status-section` / `repo.status_section`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo.doctrine_update_request`, `repo.secret_policy_request`, `repo.deployment_config`, and `repo.deployment_request`, typed Imagination action-item receipts over allowlisted safe families, `epiphany.repo_work_mind_interpretation.v0` plus `epiphany.repo_work_mind_adoption_decision.v0` Mind interpreter receipts, explicit safe-family allowlist refusal, explicit requested-path/plan-changed-path mismatch refusal, Soul closure's Mind-adoption proof guard, durable repo-work map admission before branch-local Hands consequences reach publication gates, local Verse `epiphany.cultmesh.repo_work_map_entry.v0` Gjallar readback for Mind-admitted map facts, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts including native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853`, non-mutating `epiphany-work deployment-config-audit` plus operator-owned `epiphany-work deployment-execution-runbook` proof `.epiphany-smoke\repo-deployment-config-family-20260620-214109`, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; proofs `.epiphany-smoke\fresh-repo-mvp-20260620-180024`, `.epiphany-smoke\swarm-stop-classification-20260620-184717`, `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140`, `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046`, `.epiphany-smoke\repo-deployment-config-family-20260620-214109`, `.epiphany-smoke\repo-deployment-request-family-20260620-195605`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-201153`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-202113`, and `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` show fresh-repo iteration-limit stop classification, empty-queue Gjallar classification, dry-run planning-preview Self classification, Bifrost publication-gate classification, Bifrost/GitHub upstream-sync gate classification, Mind refusal for unsupported safe-family cargo and mismatched requested paths, reviewed doctrine/security/deployment config/request cargo, deployment-config audit readiness for Idunn review, deployment execution runbook readiness for explicit operator git-push handoff, closure refusal for counterfeit Mind adoption, durable repo-map admission only after passing closure, local Verse/Gjallar map projection, closure, publication receipts, upstream-main sync, public-proof export, and private-state sealing. The contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper interpreter/closure depth or actual Idunn deployment aftercare receipt ingestion once an operator-run deployment exists. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start/deployment execution still requires explicit elevated operator authority.