From 82091d704ea3dfe70219c12029bd91b81d64af9b Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sat, 30 May 2026 01:28:32 +0100 Subject: [PATCH] Add launch receipt proof profiles --- epiphany-codex-bridge/src/runtime_results.rs | 20 +-- epiphany-core/src/lib.rs | 3 + epiphany-core/src/organ_dependencies.rs | 125 ++++++++++++++++++- epiphany-core/src/runtime_spine.rs | 16 +++ notes/fresh-workspace-handoff.md | 16 +-- notes/perfect-machine-audit-roadmap.md | 31 ++--- state/ledgers.msgpack | Bin 168755 -> 169104 bytes state/map.yaml | 6 +- 8 files changed, 184 insertions(+), 33 deletions(-) diff --git a/epiphany-codex-bridge/src/runtime_results.rs b/epiphany-codex-bridge/src/runtime_results.rs index a8ddd1ff..3accf679 100644 --- a/epiphany-codex-bridge/src/runtime_results.rs +++ b/epiphany-codex-bridge/src/runtime_results.rs @@ -2,6 +2,7 @@ use std::path::Path; use epiphany_core::EpiphanyCoordinatorRoleResultStatus as CoreEpiphanyCoordinatorRoleResultStatus; use epiphany_core::EpiphanyCrrcResultStatus as CoreEpiphanyCrrcResultStatus; +use epiphany_core::EpiphanyReceiptEffectKind; use epiphany_core::EpiphanyReorientFindingInterpretation; use epiphany_core::EpiphanyRoleFindingInterpretation; use epiphany_core::EpiphanyRoleResultRoleId; @@ -481,24 +482,27 @@ fn require_launch_organ_contract( ))); } if request.organ_launch_contract.dependencies.is_empty() - || request - .organ_launch_contract - .required_receipt_document_types - .is_empty() + || request.organ_launch_contract.receipt_proof_profiles.is_empty() { return Err(EpiphanyBridgeError::InvalidRequest(format!( - "cannot accept runtime job {:?}: worker launch request has no organ dependency/receipt contract", + "cannot accept runtime job {:?}: worker launch request has no organ dependency/proof-profile contract", job_id ))); } if !request .organ_launch_contract - .required_receipt_document_types + .receipt_proof_profiles .iter() - .any(|document_type| document_type == MIND_GATEWAY_REVIEW_TYPE) + .any(|profile| { + profile.effect_kind == EpiphanyReceiptEffectKind::StateAdmission + && profile + .required_before_promotion_document_types + .iter() + .any(|document_type| document_type == MIND_GATEWAY_REVIEW_TYPE) + }) { return Err(EpiphanyBridgeError::InvalidRequest(format!( - "cannot accept runtime job {:?}: worker launch contract does not require Mind review", + "cannot accept runtime job {:?}: worker launch contract has no state-admission proof profile requiring Mind review", job_id ))); } diff --git a/epiphany-core/src/lib.rs b/epiphany-core/src/lib.rs index 7eb84c7f..c1da49e6 100644 --- a/epiphany-core/src/lib.rs +++ b/epiphany-core/src/lib.rs @@ -334,10 +334,13 @@ pub use organ_dependencies::EPIPHANY_ORGAN_DEPENDENCY_SCHEMA_VERSION; pub use organ_dependencies::EPIPHANY_STANDING_ORGANS; pub use organ_dependencies::EpiphanyLaunchOrganContract; pub use organ_dependencies::EpiphanyOrganDependency; +pub use organ_dependencies::EpiphanyReceiptEffectKind; +pub use organ_dependencies::EpiphanyReceiptProofProfile; pub use organ_dependencies::default_launch_organ_contract; pub use organ_dependencies::default_launch_required_receipts; pub use organ_dependencies::default_organ_dependencies_for; pub use organ_dependencies::default_organ_dependency_matrix; +pub use organ_dependencies::default_receipt_proof_profiles; pub use organ_dependencies::render_organ_dependencies; pub use organ_dependencies::render_organ_dependency; pub use promotion::EpiphanyPromotionDecision; diff --git a/epiphany-core/src/organ_dependencies.rs b/epiphany-core/src/organ_dependencies.rs index 8db3430d..896095ef 100644 --- a/epiphany-core/src/organ_dependencies.rs +++ b/epiphany-core/src/organ_dependencies.rs @@ -52,10 +52,33 @@ pub struct EpiphanyLaunchOrganContract { pub output_contract_id: String, pub owner_organ: String, pub dependencies: Vec, + #[serde(default)] + pub receipt_proof_profiles: Vec, pub required_receipt_document_types: Vec, pub contract: String, } +#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "camelCase")] +pub enum EpiphanyReceiptEffectKind { + #[default] + StateAdmission, + EvidencePromotion, + RepoAction, + Verification, + ContinuityRecovery, +} + +#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "camelCase")] +pub struct EpiphanyReceiptProofProfile { + pub effect_kind: EpiphanyReceiptEffectKind, + pub owner_organ: String, + pub required_before_promotion_document_types: Vec, + pub terminal_receipt_document_types: Vec, + pub contract: String, +} + pub fn default_organ_dependencies_for(organ_id: &str) -> EpiphanyOrganDependency { let normalized = organ_id.trim().to_ascii_lowercase(); EpiphanyOrganDependency { @@ -89,11 +112,93 @@ pub fn default_launch_organ_contract( output_contract_id: output_contract_id.to_string(), owner_organ: owner_organ_for_authority_scope(authority_scope).to_string(), dependencies: default_organ_dependency_matrix(), + receipt_proof_profiles: default_receipt_proof_profiles(), required_receipt_document_types: default_launch_required_receipts(), - contract: "A worker launch is not naked task cargo: it carries the sub-agent dependency matrix and the receipts expected before worker output may affect durable state. Mind gates state effects, Substrate Gate gates repo access, Eyes supplies evidence, Proprioception models the Body, Hands records action, Soul verifies, and Continuity protocols preserve recovery across rupture.".to_string(), + contract: "A worker launch is not naked task cargo: it carries the sub-agent dependency matrix, a receipt document catalogue, and effect-specific proof profiles. Mind gates state effects, Substrate Gate gates repo access, Eyes supplies evidence, Proprioception models the Body, Hands records action, Soul verifies, and Continuity protocols preserve recovery across rupture.".to_string(), } } +pub fn default_receipt_proof_profiles() -> Vec { + vec![ + EpiphanyReceiptProofProfile { + effect_kind: EpiphanyReceiptEffectKind::StateAdmission, + owner_organ: "mind".to_string(), + required_before_promotion_document_types: vec![MIND_GATEWAY_REVIEW_TYPE.to_string()], + terminal_receipt_document_types: vec![ + MIND_STATE_COMMIT_RECEIPT_TYPE.to_string(), + MIND_STATE_REJECTION_RECEIPT_TYPE.to_string(), + ], + contract: "Durable state admission requires Mind review before promotion and a Mind commit or rejection receipt after the decision resolves.".to_string(), + }, + EpiphanyReceiptProofProfile { + effect_kind: EpiphanyReceiptEffectKind::EvidencePromotion, + owner_organ: "eyes".to_string(), + required_before_promotion_document_types: vec![ + SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE.to_string(), + EYES_EVIDENCE_PACKET_TYPE.to_string(), + MIND_GATEWAY_REVIEW_TYPE.to_string(), + ], + terminal_receipt_document_types: vec![ + MIND_STATE_COMMIT_RECEIPT_TYPE.to_string(), + MIND_STATE_REJECTION_RECEIPT_TYPE.to_string(), + EYES_EVIDENCE_REFUSAL_RECEIPT_TYPE.to_string(), + ], + contract: "A source-dependent truth claim needs scoped substrate access, an Eyes evidence packet, and Mind admission before it becomes durable state.".to_string(), + }, + EpiphanyReceiptProofProfile { + effect_kind: EpiphanyReceiptEffectKind::RepoAction, + owner_organ: "hands".to_string(), + required_before_promotion_document_types: vec![ + SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE.to_string(), + HANDS_PATCH_RECEIPT_TYPE.to_string(), + SOUL_VERDICT_RECEIPT_TYPE.to_string(), + MIND_GATEWAY_REVIEW_TYPE.to_string(), + ], + terminal_receipt_document_types: vec![ + SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_TYPE.to_string(), + HANDS_COMMIT_RECEIPT_TYPE.to_string(), + HANDS_ROLLBACK_RECEIPT_TYPE.to_string(), + HANDS_ACTION_REFUSAL_RECEIPT_TYPE.to_string(), + SOUL_REGRESSION_RECEIPT_TYPE.to_string(), + SOUL_VERIFICATION_REFUSAL_RECEIPT_TYPE.to_string(), + MIND_STATE_COMMIT_RECEIPT_TYPE.to_string(), + MIND_STATE_REJECTION_RECEIPT_TYPE.to_string(), + ], + contract: "A repository mutation needs substrate grant, Hands action proof, Soul verification, and Mind state admission before it can be called true.".to_string(), + }, + EpiphanyReceiptProofProfile { + effect_kind: EpiphanyReceiptEffectKind::Verification, + owner_organ: "soul".to_string(), + required_before_promotion_document_types: vec![ + SOUL_VERDICT_RECEIPT_TYPE.to_string(), + MIND_GATEWAY_REVIEW_TYPE.to_string(), + ], + terminal_receipt_document_types: vec![ + SOUL_REVIEW_RECEIPT_TYPE.to_string(), + SOUL_REGRESSION_RECEIPT_TYPE.to_string(), + SOUL_VERIFICATION_REFUSAL_RECEIPT_TYPE.to_string(), + MIND_STATE_COMMIT_RECEIPT_TYPE.to_string(), + MIND_STATE_REJECTION_RECEIPT_TYPE.to_string(), + ], + contract: "Verification claims require Soul verdict proof before Mind admits the claim into durable state.".to_string(), + }, + EpiphanyReceiptProofProfile { + effect_kind: EpiphanyReceiptEffectKind::ContinuityRecovery, + owner_organ: "continuity".to_string(), + required_before_promotion_document_types: vec![ + CONTINUITY_RECOVERY_RECEIPT_TYPE.to_string(), + MIND_GATEWAY_REVIEW_TYPE.to_string(), + ], + terminal_receipt_document_types: vec![ + MIND_STATE_COMMIT_RECEIPT_TYPE.to_string(), + MIND_STATE_REJECTION_RECEIPT_TYPE.to_string(), + CONTINUITY_REFUSAL_RECEIPT_TYPE.to_string(), + ], + contract: "Recovery and rupture-crossing claims require Continuity proof plus Mind admission; transcript residue is not durable memory.".to_string(), + }, + ] +} + pub fn default_launch_required_receipts() -> Vec { unique_strings(vec![ MIND_GATEWAY_REVIEW_TYPE, @@ -224,6 +329,24 @@ mod tests { .required_receipt_document_types .contains(&SOUL_VERDICT_RECEIPT_TYPE.to_string()) ); + assert!(contract.receipt_proof_profiles.iter().any(|profile| { + profile.effect_kind == EpiphanyReceiptEffectKind::StateAdmission + && profile + .required_before_promotion_document_types + .contains(&MIND_GATEWAY_REVIEW_TYPE.to_string()) + && profile + .terminal_receipt_document_types + .contains(&MIND_STATE_COMMIT_RECEIPT_TYPE.to_string()) + })); + assert!(contract.receipt_proof_profiles.iter().any(|profile| { + profile.effect_kind == EpiphanyReceiptEffectKind::RepoAction + && profile + .required_before_promotion_document_types + .contains(&HANDS_PATCH_RECEIPT_TYPE.to_string()) + && profile + .required_before_promotion_document_types + .contains(&SOUL_VERDICT_RECEIPT_TYPE.to_string()) + })); assert!(contract.contract.contains("not naked task cargo")); } } diff --git a/epiphany-core/src/runtime_spine.rs b/epiphany-core/src/runtime_spine.rs index 2247e0f9..4d68b98a 100644 --- a/epiphany-core/src/runtime_spine.rs +++ b/epiphany-core/src/runtime_spine.rs @@ -2768,6 +2768,11 @@ fn validate_launch_organ_contract( "epiphany launch organ contract must carry required receipt document types" )); } + if contract.receipt_proof_profiles.is_empty() { + return Err(anyhow!( + "epiphany launch organ contract must carry effect-specific receipt proof profiles" + )); + } Ok(()) } @@ -3204,6 +3209,17 @@ mod tests { .required_receipt_document_types .contains(&crate::MIND_GATEWAY_REVIEW_TYPE.to_string()) ); + assert!( + launch_request + .organ_launch_contract + .receipt_proof_profiles + .iter() + .any(|profile| profile.effect_kind + == crate::EpiphanyReceiptEffectKind::StateAdmission + && profile + .required_before_promotion_document_types + .contains(&crate::MIND_GATEWAY_REVIEW_TYPE.to_string())) + ); Ok(()) } diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index c6e2215e..57b7ec5c 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -34,7 +34,7 @@ remembers doctrine; the branch remembers the blade. - Do not copy exact branch or HEAD from this note. Run `git status --short --branch` and `git log --oneline -5`. - Canonical anatomy now lives in `notes/epiphany-anatomy.md`. Embodied sub-agents are Self, Face, Imagination, Eyes, Proprioception, Hands, and Soul. Body, Mind, Continuity, and Substrate Gate are substrate/state/protocol surfaces, not sub-agent identities. State is split by layer: `work_organ` for resident Epiphany sub-agents, `persona` for portable public/person-shaped state shared by Epiphany Face, VoidBot repo Faces, and Ghostlight characters, and heartbeat/swarm state for scheduling and coordination physiology. Persona state now carries provenance, required public presentation, `date-time` timestamps, typed `candidateActions`, strict anchored thoughts with non-authoritative extensions, custom enum companion labels, and typed affect records for bonds/status reads/doctrine stances. - The repo now has a one-command local operator path: `.\tools\epiphany_local_run.ps1`. Default mode is `smoke`; it builds the retained Codex app-server compatibility edge, builds native Epiphany operator binaries, runs the coordinator smoke, and writes launcher artifacts under `.epiphany-run/` plus coordinator artifacts under `.epiphany-dogfood/`. `-Mode status` is now Epiphany-native: it builds only Epiphany operator binaries, reads `state/thread-state.msgpack` when present, derives status through `epiphany-core`, and does not start or require `codex-app-server`. Use `-Mode plan` or `-Mode run -MaxSteps 4` for the raw bridge-equipped coordinator entrypoints; use `-Mode mvp -FaceInput "" -MaxSteps 4` for the local product cycle that projects Face's character turn, writes a Face/Aquarium bubble, bootstraps a minimal local checkpoint for fresh threads, runs the coordinator with auto-tools, then runs heartbeat sleep/dream maintenance. Live plan/run/mvp modes use the workspace `state/runtime-spine.msgpack`, because CodexThread launch writes worker requests there; the run bundle remains artifact evidence, not runtime lifecycle authority. Add `-ThreadId ` and `-Workspace ` to inspect or continue an existing thread. `status`, `plan`, and `smoke` do not spend model calls; `run` and `mvp` build and use `epiphany-openai-runtime`. Coordinator workers now launch detached and are polled through runtime-spine instead of blocking the coordinator. MVP runs are non-ephemeral by default so `-ThreadId ` can resume and poll later. `-MaxRuntimeSeconds ` is passed into worker runtime; timeout writes a failed worker receipt and exits. Failed modeling now blocks downstream verification until the failed result is reviewed. -- Current Mom-ready status: the normal MVP pass reaches Face -> coordinator -> detached runtime -> heartbeat sleep, and modeling workers now complete through the ChatGPT subscription transport. The first failure was a stack of violated observability/runtime invariants: worker prompts prepended the whole shared persistent-memory rite, Responses frame liveness was invisible until completion, and the runtime tried to persist hundreds of text deltas before completing the worker job. Role/reorient workers now get a compact Epiphany worker boundary instead of full persistent memory; runtime-spine records sampled raw Responses frame kinds with small previews; contiguous reasoning/text deltas compact before durable storage; and live proofs completed `2fe38dcd-d99e-4c73-9a58-afcc81f851c7`, `241e3851-e3ea-4877-a63b-0d2bbd96a7e2`, and `85149a26-6975-403f-ac93-092b717c5825` instead of timing out. The second failure was stale lifecycle authority: completed runtime jobs remained as unresolved `runtime_links`, replacement launches treated historical active links as current, and one bad validation path opened an orphan job before rejecting the state patch. Latest-link-wins is now the runtime-link invariant, terminal links project completed jobs, stale active history cannot veto replacement, launch validation happens before opening runtime jobs, and completed-but-unreviewable modeling findings stop for review instead of relaunching the same lane. The Eyes/source-gather fork is now landed: Research is a fixed Eyes lane with launch/result/accept/status/coordinator/protocol support, and `regather-needed` modeling findings route to `LaunchResearch` instead of relaunching blind Proprioception. Research statePatch admission is Eyes-shaped only: observations, evidence, scratch, and optional investigationCheckpoint; no graph, planning, objective, or checkpoint authority. Mind admission now leaves typed runtime-spine proof: role/reorient acceptance persists `epiphany.mind.gateway_review` before state admission and `epiphany.mind.state_commit_receipt` after admission with the resulting durable revision. The next concrete rebuild layer is effect-specific receipt enforcement beyond Mind: Substrate Gate, Eyes, Hands, Soul, and Continuity receipts are named and carried on launch contracts, but runtime/promotion paths still need to prove the required receipts before state/action claims are accepted. +- Current Mom-ready status: the normal MVP pass reaches Face -> coordinator -> detached runtime -> heartbeat sleep, and modeling workers now complete through the ChatGPT subscription transport. The first failure was a stack of violated observability/runtime invariants: worker prompts prepended the whole shared persistent-memory rite, Responses frame liveness was invisible until completion, and the runtime tried to persist hundreds of text deltas before completing the worker job. Role/reorient workers now get a compact Epiphany worker boundary instead of full persistent memory; runtime-spine records sampled raw Responses frame kinds with small previews; contiguous reasoning/text deltas compact before durable storage; and live proofs completed `2fe38dcd-d99e-4c73-9a58-afcc81f851c7`, `241e3851-e3ea-4877-a63b-0d2bbd96a7e2`, and `85149a26-6975-403f-ac93-092b717c5825` instead of timing out. The second failure was stale lifecycle authority: completed runtime jobs remained as unresolved `runtime_links`, replacement launches treated historical active links as current, and one bad validation path opened an orphan job before rejecting the state patch. Latest-link-wins is now the runtime-link invariant, terminal links project completed jobs, stale active history cannot veto replacement, launch validation happens before opening runtime jobs, and completed-but-unreviewable modeling findings stop for review instead of relaunching the same lane. The Eyes/source-gather fork is now landed: Research is a fixed Eyes lane with launch/result/accept/status/coordinator/protocol support, and `regather-needed` modeling findings route to `LaunchResearch` instead of relaunching blind Proprioception. Research statePatch admission is Eyes-shaped only: observations, evidence, scratch, and optional investigationCheckpoint; no graph, planning, objective, or checkpoint authority. Mind admission now leaves typed runtime-spine proof: role/reorient acceptance persists `epiphany.mind.gateway_review` before state admission and `epiphany.mind.state_commit_receipt` after admission with the resulting durable revision. Launch contracts now split the broad receipt catalogue from effect-specific proof profiles for state admission, evidence promotion, repo action, verification, and continuity recovery, so gates do not accidentally demand the whole organ catalogue for every finding. The next concrete rebuild layer is evaluating those profiles against runtime-spine receipts for claimed effects. - Local operator runs now write typed CultMesh intent/receipt documents to `.epiphany-run/cultmesh/operator-runs.ccmp` through `epiphany-operator-run`. The wrapper writes intent before acting and a completion receipt after success; this is the local consent/trace rail, not a hidden scheduler queue. - Status-mode local runs now also write a native CultMesh operator snapshot to `.epiphany-run/cultmesh/operator-snapshots.ccmp` through `epiphany-operator-snapshot`. That snapshot distills the operator-safe MVP status artifact into typed fields such as thread id, state status, coordinator action, CRRC action, reorient action, available actions, and artifact refs; it does not preserve the raw JSON status blob as internal state. - `epiphany-mvp-status --source native` is the current provider-neutral status boundary. It projects scene, pressure, jobs, roles, planning, reorient, CRRC, coordinator status, and runtime-linked worker lifecycle from native core surfaces. It reads runtime-spine job/result receipts for linked jobs so failed workers show as failed in role results, jobs, roles, and coordinator source signals, while successful semantic findings still require typed role/reorient worker result documents. Keep future pluggable model-provider work behind launch/result/runtime documents; do not let provider choice leak into status, prompt authority, scheduler policy, or durable `EpiphanyThreadState`. @@ -1418,9 +1418,13 @@ Runtime-spine validates and persists it on `EpiphanyRuntimeWorkerLaunchRequest`; bridge role/reorient/generic launch builders populate it. Role/reorient acceptance now refuses completed runtime-spine findings when the original worker launch request is missing, mismatched by document kind, or lacks -a dependency/receipt contract requiring Mind review. This blocks the old naked +a dependency/proof-profile contract requiring Mind review. This blocks the old naked runtime-spine acceptance path without pretending Substrate Gate/Hands/Soul receipt proof exists before the runtime emits those documents. +The launch contract now carries `receiptProofProfiles` beside the broad +`requiredReceiptDocumentTypes` catalogue. The latter is discoverability; the +former is gate law. Profiles currently cover state admission, evidence +promotion, repo action, verification, and continuity recovery. Mind review is now a persisted receipt chain for acceptance rather than an in-memory blessing: the bridge writes `epiphany.mind.gateway_review` before role/reorient state admission and `epiphany.mind.state_commit_receipt` after @@ -1432,11 +1436,9 @@ instead of adding a repair loop. compares Epiphany's named organ contracts against Void's current Face prompting shape and maps the route from contract catalog to executable organism. Main finding: the boundaries are directionally right, launch packets now carry organ -receipt expectations, and acceptance now has persisted Mind review/commit proof, -but most non-Mind gates still need runtime enforcement that proves the required -receipts before state/action promotion. Do not blindly require the whole organ -catalog for every result; split required receipts by effect type and then make -those proof profiles executable. The +receipt expectations and effect-specific proof profiles, and acceptance now has +persisted Mind review/commit proof, but most non-Mind gates still need runtime +enforcement that proves the required receipts before state/action promotion. The first dependency-body repair is landed: the missing `E:\Projects\CultLib\crates\*` paths were replaced with repo-contained vendored CultCache/CultNet/CultMesh crates, and the `epiphany-core` library tests pass diff --git a/notes/perfect-machine-audit-roadmap.md b/notes/perfect-machine-audit-roadmap.md index 10e55213..c7bdd9ee 100644 --- a/notes/perfect-machine-audit-roadmap.md +++ b/notes/perfect-machine-audit-roadmap.md @@ -126,15 +126,16 @@ Runtime-spine advertises those contracts and CultMesh persists Verse-scoped policy documents for each. The first executable pressure slice is landed: worker launch packets now carry an `EpiphanyLaunchOrganContract` derived from authority scope, launch document kind, and output contract id. That contract -carries the full standing sub-agent dependency matrix plus required Mind, Substrate Gate, -Eyes, Hands, Soul, and Continuity receipt document types. Role/reorient acceptance -now refuses completed runtime-spine findings if the original launch request is -missing, document-kind mismatched, or lacks a dependency/receipt contract that -requires Mind review. Mind's first executable proof chain is now persisted: -acceptance writes `epiphany.mind.gateway_review` before state admission and -`epiphany.mind.state_commit_receipt` after admission with the resulting state -revision. Remaining weakness: the non-Mind organ receipts are still -launch-carried expectations, not enforced proof chains before state/action +carries the full standing sub-agent dependency matrix, a receipt document +catalogue, and effect-specific proof profiles for state admission, evidence +promotion, repo action, verification, and continuity recovery. Role/reorient +acceptance now refuses completed runtime-spine findings if the original launch +request is missing, document-kind mismatched, or lacks a state-admission proof +profile requiring Mind review. Mind's first executable proof chain is now +persisted: acceptance writes `epiphany.mind.gateway_review` before state +admission and `epiphany.mind.state_commit_receipt` after admission with the +resulting state revision. Remaining weakness: the non-Mind organ receipts are +still launch-carried expectations, not enforced proof chains before state/action promotion, and the current Mind state mutation plus post-commit receipt is not a single transaction yet. @@ -316,13 +317,15 @@ comfort tunnels. dependency matrix, and required Substrate Gate/Eyes/Hands/Soul/Continuity/Mind receipts. - Landed: role/reorient acceptance refuses completed runtime-spine findings when the original worker launch request is missing, mismatched by document - kind, or lacks a dependency/receipt contract requiring Mind review. + kind, or lacks a state-admission proof profile requiring Mind review. - Landed: role/reorient acceptance persists Mind review/commit receipts around durable state admission. -- Next: split launch-carried receipt expectations into effect-specific proof - profiles, then make acceptance refuse results missing required Substrate - Gate/Eyes/Hands/Soul/Continuity receipts for the claimed effect type once - those receipt documents are produced by the live runtime. +- Landed: launch contracts split the broad receipt catalogue from effect-specific + proof profiles, so the machine does not demand every organ receipt for every + result. +- Next: make acceptance evaluate claimed effect types against available + runtime-spine receipts without pretending unavailable Substrate + Gate/Eyes/Hands/Soul/Continuity producers already exist. - Make Aquarium read the contract catalog and available receipts instead of hard-coding the route zoo. - Starve `codex_message_processor` down to Codex auth/model transport and diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 89da7200351d9bceb3e761097a9b5f479fb71e62..f16fe1077ba6fa07c241e07516d5ca04832b7833 100644 GIT binary patch delta 345 zcmY+9ze>bF5Qp9EOl4tn#le8Bkr@9$Kzsr1uCg09v&nMFZrt5mw6d_UJ2aJK#RthGNwPHD4>)F{;q;4bo^{4f$wGy#7A05`q#6$bJyxb@38XbO&<%;! z<5fk_SYzaJN>!1|hOG%7-)YkY#9BoTNJ