Move acceptance protocol shaping into bridge

epiphany-codex-bridge/src/protocol_edge.rs

@@ -38,6 +38,7 @@ use codex_app_server_protocol::ThreadEpiphanyPressureStatus;
 use codex_app_server_protocol::ThreadEpiphanyPromoteParams;
 use codex_app_server_protocol::ThreadEpiphanyPromoteResponse;
 use codex_app_server_protocol::ThreadEpiphanyReorientAcceptParams;
+use codex_app_server_protocol::ThreadEpiphanyReorientAcceptResponse;
 use codex_app_server_protocol::ThreadEpiphanyReorientAction;
 use codex_app_server_protocol::ThreadEpiphanyReorientCheckpointStatus;
 use codex_app_server_protocol::ThreadEpiphanyReorientDecision;
@@ -52,6 +53,7 @@ use codex_app_server_protocol::ThreadEpiphanyReorientWorkerLaunchDocument;
 use codex_app_server_protocol::ThreadEpiphanyRetrievalFreshness;
 use codex_app_server_protocol::ThreadEpiphanyRetrievalFreshnessStatus;
 use codex_app_server_protocol::ThreadEpiphanyRoleAcceptParams;
+use codex_app_server_protocol::ThreadEpiphanyRoleAcceptResponse;
 use codex_app_server_protocol::ThreadEpiphanyRoleFinding;
 use codex_app_server_protocol::ThreadEpiphanyRoleId;
 use codex_app_server_protocol::ThreadEpiphanyRoleLaunchParams;
@@ -104,7 +106,9 @@ use epiphany_state_model::EpiphanyThreadState;
 
 use crate::mutation_service::EpiphanyJobInterruptApplied;
 use crate::mutation_service::EpiphanyJobLaunchApplied;
+use crate::mutation_service::EpiphanyReorientAcceptApplied;
 use crate::mutation_service::EpiphanyReorientLaunchApplied;
+use crate::mutation_service::EpiphanyRoleAcceptApplied;
 use crate::mutation_service::EpiphanyThreadPromoteApplied;
 use crate::mutation_service::EpiphanyThreadUpdateApplied;
 
@@ -434,6 +438,38 @@ pub fn plan_thread_epiphany_role_accept(
     })
 }
 
+pub struct ThreadEpiphanyRoleAcceptRouteOutput {
+    pub response: ThreadEpiphanyRoleAcceptResponse,
+    pub changed_fields: Vec<EpiphanyStateUpdatedField>,
+    pub epiphany_state: EpiphanyThreadState,
+}
+
+pub fn thread_epiphany_role_accept_output(
+    role_id: ThreadEpiphanyRoleId,
+    binding_id: String,
+    applied: EpiphanyRoleAcceptApplied,
+) -> ThreadEpiphanyRoleAcceptRouteOutput {
+    let changed_fields = applied.changed_fields;
+    let epiphany_state = applied.epiphany_state;
+    let response = ThreadEpiphanyRoleAcceptResponse {
+        revision: applied.revision,
+        changed_fields: protocol_state_updated_fields(changed_fields.clone()),
+        epiphany_state: epiphany_state.clone(),
+        role_id,
+        binding_id,
+        accepted_receipt_id: applied.accepted_receipt_id,
+        accepted_observation_id: applied.accepted_observation_id,
+        accepted_evidence_id: applied.accepted_evidence_id,
+        applied_patch: protocol_patch_from_core(applied.applied_patch),
+        finding: protocol_role_finding(role_id, applied.finding),
+    };
+    ThreadEpiphanyRoleAcceptRouteOutput {
+        response,
+        changed_fields,
+        epiphany_state,
+    }
+}
+
 pub struct ThreadEpiphanyReorientLaunchPlan {
     pub thread_id: String,
     pub expected_revision: Option<u64>,
@@ -516,6 +552,35 @@ pub fn plan_thread_epiphany_reorient_accept(
     }
 }
 
+pub struct ThreadEpiphanyReorientAcceptRouteOutput {
+    pub response: ThreadEpiphanyReorientAcceptResponse,
+    pub changed_fields: Vec<EpiphanyStateUpdatedField>,
+    pub epiphany_state: EpiphanyThreadState,
+}
+
+pub fn thread_epiphany_reorient_accept_output(
+    binding_id: String,
+    applied: EpiphanyReorientAcceptApplied,
+) -> ThreadEpiphanyReorientAcceptRouteOutput {
+    let changed_fields = applied.changed_fields;
+    let epiphany_state = applied.epiphany_state;
+    let response = ThreadEpiphanyReorientAcceptResponse {
+        revision: applied.revision,
+        changed_fields: protocol_state_updated_fields(changed_fields.clone()),
+        epiphany_state: epiphany_state.clone(),
+        binding_id,
+        accepted_receipt_id: applied.accepted_receipt_id,
+        accepted_observation_id: applied.accepted_observation_id,
+        accepted_evidence_id: applied.accepted_evidence_id,
+        finding: protocol_reorient_finding(applied.finding),
+    };
+    ThreadEpiphanyReorientAcceptRouteOutput {
+        response,
+        changed_fields,
+        epiphany_state,
+    }
+}
+
 pub struct ThreadEpiphanyJobLaunchPlan {
     pub thread_id: String,
     pub launch_request: EpiphanyJobLaunchRequest,

notes/epiphany-current-algorithmic-map.md

@@ -36,14 +36,14 @@ The spine exists in more than twenty-five live paths:
 - reorientation policy: the `reorient` view lens reuses the same live/stored thread view plus mapped pressure/freshness/watcher signals, then adapts those inputs into pure `epiphany-core` verdict policy. Core derives the bounded `resume`/`regather` decision with checkpoint-path/frontier reasons; app-server only maps the core decision back to protocol shape, without mutating, compacting, scheduling, notifying, or continuing work in [reorient.rs](E:/Projects/EpiphanyAgent/epiphany-core/src/surfaces/reorient.rs:1), [v2.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/v2.rs:4514), and [codex_message_processor.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server/src/codex_message_processor.rs:15296).
 - CRRC coordinator recommendation: the `crrc` view lens reuses pressure/freshness/watcher/reorientation mapping plus the fixed `reorient-worker` binding and result read-back helper, recognizes already accepted reorientation findings so an accepted result is not recommended for acceptance again, and calls pure `epiphany-core` CRRC policy to return one bounded recommendation such as continue, prepare checkpoint, launch worker, wait, review, accept, or regather manually without mutating, launching, accepting, compacting, notifying, scheduling, or silently continuing work in [v2.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/v2.rs:4661), [crrc.rs](E:/Projects/EpiphanyAgent/epiphany-core/src/surfaces/crrc.rs:60), and [codex_message_processor.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server/src/codex_message_processor.rs:4546).
 - role ownership projection: the `roles` view lens reuses the same state/jobs/pressure/reorient/result/CRRC signals as the coordinator loop, and projects implementation, Imagination/planning, modeling/checkpoint, verification/review, and reorientation lanes with owner roles, status, linked jobs, authority scopes, and recommended scene actions without launching, scheduling, accepting, compacting, notifying, or mutating state. App-server adapts concrete protocol jobs and thread state, while the pure role-board projection policy now lives in [role_board.rs](E:/Projects/EpiphanyAgent/epiphany-core/src/surfaces/role_board.rs:70).
-- role specialist launch/read-back/acceptance: app-server declares experimental `thread/epiphany/roleLaunch`, read-only `thread/epiphany/roleResult`, and write-gated `thread/epiphany/roleAccept`. `roleLaunch` route handling delegates protocol role-id conversion and legacy launch response projection to `epiphany-codex-bridge::protocol_edge::plan_thread_epiphany_role_launch` / `thread_epiphany_role_launch_output`, then builds bounded specialist payloads from authoritative Epiphany state through the heartbeat-backed `epiphany_launch_job` seam, opens a typed runtime-spine job receipt, and emits the normal `jobLaunch` state update for `jobBindings` only. `roleResult` route handling now delegates protocol role-id conversion, default binding selection, unsupported-role rejection, and response projection to `epiphany-codex-bridge::view_protocol::map_thread_epiphany_role_result_response`; app-server supplies only loaded/stored state and runtime-store host facts. The role-result surface resolves heartbeat bindings through typed runtime-spine job results and seals legacy `agent_jobs` bindings, then adapts worker JSON through core role-result interpretation in [role_result.rs](E:/Projects/EpiphanyAgent/epiphany-core/src/surfaces/role_result.rs:45), projecting structured output as a reviewable finding with verdict, summary, next safe move, inspected files, frontier/evidence ids, optional `statePatch`, optional `selfPatch`, coordinator `selfPersistence` review, and errors without mutation, promotion, scheduling, or hidden continuation. `selfPatch` is a Ghostlight-shaped lane-memory request, not project truth: core accepts only role-matched, bounded, evidence-grounded memory/goal/value/private-note mutations and refuses objectives, graphs, checkpoints, scratch, planning, jobs, authority, code edits, or raw transcripts with reasons. `roleAccept` route handling now delegates protocol role-id conversion, default binding selection, and unsupported-role rejection to `epiphany-codex-bridge::protocol_edge::plan_thread_epiphany_role_accept` before invoking the mutation service. The acceptance surface accepts completed heartbeat findings from typed runtime-spine results, accepts completed Imagination findings only when they contain a valid planning-only patch with draft Objective Draft review gates, accepts completed modeling/checkpoint findings only with a modeling-safe `statePatch`, applies accepted project patches through the existing Epiphany state validator, and uses core acceptance bundle policy to build the audit observation, evidence, and typed receipt. GUI/coordinator accept paths then apply accepted `selfPatch` requests to typed CultCache role dossiers in `state/agents.cc` through the native `epiphany-agent-memory-store` binary. Implementation stays owned by the main coding agent, verification output remains review-only, and reorientation stays on the CRRC-specific `reorientLaunch` / `reorientResult` / `reorientAccept` path.
+- role specialist launch/read-back/acceptance: app-server declares experimental `thread/epiphany/roleLaunch`, read-only `thread/epiphany/roleResult`, and write-gated `thread/epiphany/roleAccept`. `roleLaunch` route handling delegates protocol role-id conversion and legacy launch response projection to `epiphany-codex-bridge::protocol_edge::plan_thread_epiphany_role_launch` / `thread_epiphany_role_launch_output`, then builds bounded specialist payloads from authoritative Epiphany state through the heartbeat-backed `epiphany_launch_job` seam, opens a typed runtime-spine job receipt, and emits the normal `jobLaunch` state update for `jobBindings` only. `roleResult` route handling now delegates protocol role-id conversion, default binding selection, unsupported-role rejection, and response projection to `epiphany-codex-bridge::view_protocol::map_thread_epiphany_role_result_response`; app-server supplies only loaded/stored state and runtime-store host facts. The role-result surface resolves heartbeat bindings through typed runtime-spine job results and seals legacy `agent_jobs` bindings, then adapts worker JSON through core role-result interpretation in [role_result.rs](E:/Projects/EpiphanyAgent/epiphany-core/src/surfaces/role_result.rs:45), projecting structured output as a reviewable finding with verdict, summary, next safe move, inspected files, frontier/evidence ids, optional `statePatch`, optional `selfPatch`, coordinator `selfPersistence` review, and errors without mutation, promotion, scheduling, or hidden continuation. `selfPatch` is a Ghostlight-shaped lane-memory request, not project truth: core accepts only role-matched, bounded, evidence-grounded memory/goal/value/private-note mutations and refuses objectives, graphs, checkpoints, scratch, planning, jobs, authority, code edits, or raw transcripts with reasons. `roleAccept` route handling now delegates protocol role-id conversion, default binding selection, unsupported-role rejection, and legacy accept response projection to `epiphany-codex-bridge::protocol_edge::plan_thread_epiphany_role_accept` / `thread_epiphany_role_accept_output` before invoking the mutation service. The acceptance surface accepts completed heartbeat findings from typed runtime-spine results, accepts completed Imagination findings only when they contain a valid planning-only patch with draft Objective Draft review gates, accepts completed modeling/checkpoint findings only with a modeling-safe `statePatch`, applies accepted project patches through the existing Epiphany state validator, and uses core acceptance bundle policy to build the audit observation, evidence, and typed receipt. GUI/coordinator accept paths then apply accepted `selfPatch` requests to typed CultCache role dossiers in `state/agents.cc` through the native `epiphany-agent-memory-store` binary. Implementation stays owned by the main coding agent, verification output remains review-only, and reorientation stays on the CRRC-specific `reorientLaunch` / `reorientResult` / `reorientAccept` path.
 - shared prompt memory projection and role dossiers: the prompt config now carries `[shared].persistent_memory` in [epiphany_specialists.toml](E:/Projects/EpiphanyAgent/epiphany-core/src/prompts/epiphany_specialists.toml:2). App-server parses that block through the bridge, prepends it with `epiphany_agent_prompt_with_memory` for embodied lanes, and keeps reorientation as a Continuity worker/protocol path rather than a role dossier. The base `<epiphany_state>` doctrine reinforces the Perfect Machine rule through [prompt.rs](E:/Projects/EpiphanyAgent/epiphany-state-model/src/prompt.rs:31) and [epiphany_doctrine.md](E:/Projects/EpiphanyAgent/epiphany-state-model/src/prompts/epiphany_doctrine.md:1). Individual Ghostlight-shaped role dossiers now live in typed CultCache `state/agents.cc` for embodied sub-agent lanes, and the native `epiphany-agent-memory-store` binary validates, reviews, and applies bounded self-memory patches through the Rust store.
 - fixed-lane coordinator: the `coordinator` view lens composes role, pressure, reorient, CRRC, role result, and reorient result signals, and returns one current action without mutation. App-server assembles host/protocol inputs, but the pure fixed-lane decision ladder now lives in `epiphany-core` in [coordinator.rs](E:/Projects/EpiphanyAgent/epiphany-core/src/surfaces/coordinator.rs:132). Review acceptance and implementation clearance are intentionally different: an accepted verification finding clears implementation only when the verifier verdict is `pass`; accepted `needs-evidence`, `needs-review`, or `fail` findings route back toward modeling/checkpoint strengthening before code work resumes. `regatherManually` is now fallback, not a supervisor-puppeteering excuse: completed unaccepted modeling findings stop at `reviewModelingResult`, modeling acceptance precedes verification, and fixed lane actions are considered before manual regather.
 - MVP operator view: native `epiphany-mvp-status` launches app-server over stdio, starts or reads one thread, gathers scene, planning, pressure, reorient, jobs, roles, Imagination/modeling/verification role results, reorient result, CRRC responses, heartbeat, and Persona bubble artifacts, and renders them as text or JSON so the loop can be dogfooded without Python owning the product surface.
 - MVP dogfood runner: the old Python runner was cut with the `agent_jobs` path. The replacement must be native Rust/CultCache/CultNet and complete heartbeat-owned runtime-spine job results with operator-safe artifacts.
 - Agent function/API telemetry: native `epiphany-agent-telemetry` mechanically parses sealed AppServerClient JSONL transcripts into operator-safe telemetry with method counts, request shape, job/status/path fields, and visible function/tool names while sealing text, turn items, raw results, and direct agent messages.
 - reorientation launch: app-server now declares experimental `thread/epiphany/reorientLaunch`, requires a loaded thread plus durable investigation checkpoint, gathers host facts for retrieval/watcher/token pressure, delegates protocol param conversion and legacy response projection to `epiphany-codex-bridge::protocol_edge::plan_thread_epiphany_reorient_launch` / `thread_epiphany_reorient_launch_output`, consumes the live reorientation verdict, and launches one fixed `reorient-worker` binding through the existing job-control seam with explicit resume-versus-regather scope, checkpoint-derived payload, and structured-output expectations instead of pretending CRRC suddenly grew a scheduler in [common.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/common.rs:370), [v2.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/v2.rs:4575), and [codex_message_processor.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server/src/codex_message_processor/epiphany_mutation_routes.rs:240).
-- reorientation result/read-back/acceptance: app-server now declares experimental read-only `thread/epiphany/reorientResult` and write-gated `thread/epiphany/reorientAccept`. Result read-back supplies loaded/stored thread state plus runtime-store host facts to `epiphany-codex-bridge::view_protocol::map_thread_epiphany_reorient_result_response`, which owns the fixed `reorient-worker` binding default, source projection, runtime-spine read-back, and response mapping. Accept planning supplies `ThreadEpiphanyReorientAcceptParams` to `epiphany-codex-bridge::protocol_edge::plan_thread_epiphany_reorient_accept`, which owns the same fixed binding default before the mutation service banks accepted findings. The surface resolves heartbeat bindings through typed runtime-spine job results, seals legacy `agent_jobs` bindings, and projects a reviewable finding with mode, summary, next safe move, checkpoint-validity flag, inspected files, frontier ids, evidence ids, raw result, and any errors without mutating state, promoting evidence, or scheduling follow-up work.
+- reorientation result/read-back/acceptance: app-server now declares experimental read-only `thread/epiphany/reorientResult` and write-gated `thread/epiphany/reorientAccept`. Result read-back supplies loaded/stored thread state plus runtime-store host facts to `epiphany-codex-bridge::view_protocol::map_thread_epiphany_reorient_result_response`, which owns the fixed `reorient-worker` binding default, source projection, runtime-spine read-back, and response mapping. Accept planning supplies `ThreadEpiphanyReorientAcceptParams` to `epiphany-codex-bridge::protocol_edge::plan_thread_epiphany_reorient_accept`, which owns the same fixed binding default before the mutation service banks accepted findings, and `thread_epiphany_reorient_accept_output` owns the legacy accept response projection after the mutation service returns. The surface resolves heartbeat bindings through typed runtime-spine job results, seals legacy `agent_jobs` bindings, and projects a reviewable finding with mode, summary, next safe move, checkpoint-validity flag, inspected files, frontier ids, evidence ids, raw result, and any errors without mutating state, promoting evidence, or scheduling follow-up work.
 - reorientation finding acceptance: app-server now declares experimental `thread/epiphany/reorientAccept`, requires a loaded thread and a completed `reorient-worker` result, accepts heartbeat-backed results from typed runtime-spine receipts before falling back to old bindings, uses core acceptance bundle policy to build accepted observation/evidence/receipt payloads plus optional scratch and durable investigation-checkpoint updates, persists through the normal typed update path, and emits `thread/epiphany/stateUpdated` with source `reorientAccept` without accepting pending work, auto-promoting arbitrary worker output, launching follow-up work, or silently continuing implementation in [common.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/common.rs:378), [v2.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server-protocol/src/protocol/v2.rs:4635), [role_result.rs](E:/Projects/EpiphanyAgent/epiphany-core/src/surfaces/role_result.rs:150), and [codex_message_processor.rs](E:/Projects/EpiphanyAgent/vendor/codex/codex-rs/app-server/src/codex_message_processor.rs:4885).
 - retrieval/indexing: app-server routes `thread/epiphany/retrieve` and `thread/epiphany/index` through `epiphany-codex-bridge::retrieve`; for retrieve, app-server reads only host cwd/Codex-home facts from `CodexThread`, while `retrieve_protocol::retrieve_thread_epiphany` accepts the protocol params and owns query/limit/path-prefix normalization, native `epiphany-core` retrieval, and Codex response projection in [retrieve_protocol.rs](E:/Projects/EpiphanyAgent/epiphany-codex-bridge/src/retrieve_protocol.rs:19), [retrieve.rs](E:/Projects/EpiphanyAgent/epiphany-codex-bridge/src/retrieve.rs:42), [retrieve.rs](E:/Projects/EpiphanyAgent/epiphany-codex-bridge/src/retrieve.rs:57), and [retrieve.rs](E:/Projects/EpiphanyAgent/epiphany-codex-bridge/src/retrieve.rs:69).
 

notes/fresh-workspace-handoff.md

@@ -888,19 +888,24 @@ id, loads the live/stored thread view, and looks up the runtime-store path, but
 binding default, live/stored protocol source projection, and response mapping.
 `epiphany_read_routes.rs` is about 528 lines after this cut.
 
-Role-accept write-route planning has moved to the bridge protocol edge.
-`plan_thread_epiphany_role_accept` owns protocol role conversion, default
-binding selection, and unsupported-role rejection before the mutation service
-accepts the finding. App-server still loads the thread, calls the mutation
-service, builds the legacy accept response DTO, and emits the state-updated
-notification. `epiphany_mutation_routes.rs` is about 749 lines after this cut.
+Role-accept write-route planning and response shaping moved to the bridge
+protocol edge. `plan_thread_epiphany_role_accept` owns protocol role
+conversion, default binding selection, and unsupported-role rejection before the
+mutation service accepts the finding; `thread_epiphany_role_accept_output` owns
+the legacy accept response DTO plus notification payload handoff from
+`EpiphanyRoleAcceptApplied`. App-server still loads the thread, calls the
+mutation service, sends the response, and emits the state-updated notification.
+`epiphany_mutation_routes.rs` is about 580 lines after this cut.
 
-Reorient-accept write-route planning has moved to the bridge protocol edge too.
+Reorient-accept write-route planning and response shaping moved to the bridge
+protocol edge too.
 `plan_thread_epiphany_reorient_accept` owns the fixed reorient binding default
-and carries the explicit scratch/checkpoint flags forward. App-server still
-loads the thread, calls the mutation service, builds the legacy accept response
-DTO, and emits the state-updated notification. `epiphany_mutation_routes.rs` is
-about 744 lines after this cut.
+and carries the explicit scratch/checkpoint flags forward;
+`thread_epiphany_reorient_accept_output` owns the legacy accept response DTO
+plus notification payload handoff from `EpiphanyReorientAcceptApplied`.
+App-server still loads the thread, calls the mutation service, sends the
+response, and emits the state-updated notification.
+`epiphany_mutation_routes.rs` is about 580 lines after this cut.
 
 Job-launch write-route planning and response shaping moved to the bridge
 protocol edge. `plan_thread_epiphany_job_launch` owns protocol worker-launch

state/map.yaml

@@ -139,7 +139,7 @@ accepted_design:
   - `epiphany-core` and `epiphany-codex-bridge` must not depend directly on vendored `codex-core`. Host-specific Codex concepts belong in vendored app-server host adapters or the thin OpenAI subscription auth/model-transport spine, while native retrieval/state/runtime/mutation policy stays in Epiphany crates.
   - The prompt reads typed state through a bounded `<epiphany_state>` developer fragment.
   - Clients read typed state through `Thread.epiphanyState`, read-only `thread/epiphany/view` lenses for scene/jobs/roles/planning/pressure/reorient/CRRC/coordinator, freshness through `thread/epiphany/freshness`, targeted state shards through `thread/epiphany/context`, bounded graph traversal through `thread/epiphany/graphQuery`, and reviewable role output through `thread/epiphany/roleResult`. The scene, jobs, roles, planning, pressure, reorient, CRRC, and coordinator read projections now live only as view lenses, not standalone protocol verbs.
-  - Durable typed state writes route through `thread/epiphany/update`, accepted `thread/epiphany/promote`, `thread/epiphany/reorientAccept`, `thread/epiphany/roleAccept`, or the bounded `thread/epiphany/jobLaunch`, `thread/epiphany/jobInterrupt`, `thread/epiphany/reorientLaunch`, and `thread/epiphany/roleLaunch` authority surfaces when they mutate state or `job_bindings`; update/promote, jobLaunch, jobInterrupt, roleLaunch, and reorientLaunch response shaping, jobLaunch request construction, plus roleLaunch/reorientLaunch/roleAccept/reorientAccept protocol/default-binding planning now live in the bridge protocol edge rather than app-server mutation routes.
+  - Durable typed state writes route through `thread/epiphany/update`, accepted `thread/epiphany/promote`, `thread/epiphany/reorientAccept`, `thread/epiphany/roleAccept`, or the bounded `thread/epiphany/jobLaunch`, `thread/epiphany/jobInterrupt`, `thread/epiphany/reorientLaunch`, and `thread/epiphany/roleLaunch` authority surfaces when they mutate state or `job_bindings`; update/promote, jobLaunch, jobInterrupt, roleLaunch, reorientLaunch, roleAccept, and reorientAccept response shaping, jobLaunch request construction, plus roleLaunch/reorientLaunch/roleAccept/reorientAccept protocol/default-binding planning now live in the bridge protocol edge rather than app-server mutation routes.
   - `thread/epiphany/retrieve`, `thread/epiphany/distill`, `thread/epiphany/propose`, `thread/epiphany/freshness`, `thread/epiphany/context`, `thread/epiphany/graphQuery`, and `thread/epiphany/view` stay read-only.
   - `thread/epiphany/index` writes the retrieval catalog, not durable Epiphany understanding; catalog is auspex output, not doctrine.
   - Qdrant is the preferred persistent semantic backend; BM25 remains the bootstrap/fallback/control path. Qdrant's HTTP API and acknowledgements remain JSON wire edges, but Epiphany-owned retrieval point payloads are typed at the adapter boundary before serialization/deserialization.

vendor/codex/codex-rs/app-server/src/codex_message_processor/epiphany_mutation_routes.rs

@@ -22,15 +22,13 @@ use epiphany_codex_bridge::protocol_edge::plan_thread_epiphany_reorient_launch;
 use epiphany_codex_bridge::protocol_edge::plan_thread_epiphany_role_accept;
 use epiphany_codex_bridge::protocol_edge::plan_thread_epiphany_role_launch;
 use epiphany_codex_bridge::protocol_edge::plan_thread_epiphany_update;
-use epiphany_codex_bridge::protocol_edge::protocol_patch_from_core;
-use epiphany_codex_bridge::protocol_edge::protocol_reorient_finding;
-use epiphany_codex_bridge::protocol_edge::protocol_role_finding;
-use epiphany_codex_bridge::protocol_edge::protocol_state_updated_fields;
 use epiphany_codex_bridge::protocol_edge::protocol_state_updated_notification;
 use epiphany_codex_bridge::protocol_edge::thread_epiphany_job_interrupt_output;
 use epiphany_codex_bridge::protocol_edge::thread_epiphany_job_launch_output;
 use epiphany_codex_bridge::protocol_edge::thread_epiphany_promote_output;
+use epiphany_codex_bridge::protocol_edge::thread_epiphany_reorient_accept_output;
 use epiphany_codex_bridge::protocol_edge::thread_epiphany_reorient_launch_output;
+use epiphany_codex_bridge::protocol_edge::thread_epiphany_role_accept_output;
 use epiphany_codex_bridge::protocol_edge::thread_epiphany_role_launch_output;
 use epiphany_codex_bridge::protocol_edge::thread_epiphany_update_output;
 use epiphany_codex_bridge::retrieve::epiphany_retrieval_state_for_paths;
@@ -196,32 +194,20 @@ impl CodexMessageProcessor {
                 return;
             }
         };
-        let changed_fields = applied.changed_fields;
-        let protocol_changed_fields = protocol_state_updated_fields(changed_fields.clone());
-        let epiphany_state = applied.epiphany_state;
+        let output = thread_epiphany_role_accept_output(
+            accept_plan.protocol_role_id,
+            accept_plan.binding_id.clone(),
+            applied,
+        );
 
         self.outgoing
-            .send_response(
-                request_id,
-                ThreadEpiphanyRoleAcceptResponse {
-                    revision: applied.revision,
-                    changed_fields: protocol_changed_fields,
-                    epiphany_state: epiphany_state.clone(),
-                    role_id: accept_plan.protocol_role_id,
-                    binding_id: accept_plan.binding_id.clone(),
-                    accepted_receipt_id: applied.accepted_receipt_id,
-                    accepted_observation_id: applied.accepted_observation_id,
-                    accepted_evidence_id: applied.accepted_evidence_id,
-                    applied_patch: protocol_patch_from_core(applied.applied_patch),
-                    finding: protocol_role_finding(accept_plan.protocol_role_id, applied.finding),
-                },
-            )
+            .send_response(request_id, output.response)
             .await;
         self.send_epiphany_state_updated(
             thread_uuid,
             ThreadEpiphanyStateUpdatedSource::RoleAccept,
-            changed_fields,
-            epiphany_state,
+            output.changed_fields,
+            output.epiphany_state,
         )
         .await;
     }
@@ -344,30 +330,17 @@ impl CodexMessageProcessor {
                 return;
             }
         };
-        let changed_fields = applied.changed_fields;
-        let protocol_changed_fields = protocol_state_updated_fields(changed_fields.clone());
-        let epiphany_state = applied.epiphany_state;
+        let output =
+            thread_epiphany_reorient_accept_output(accept_plan.binding_id.clone(), applied);
 
         self.outgoing
-            .send_response(
-                request_id,
-                ThreadEpiphanyReorientAcceptResponse {
-                    revision: applied.revision,
-                    changed_fields: protocol_changed_fields,
-                    epiphany_state: epiphany_state.clone(),
-                    binding_id: accept_plan.binding_id.clone(),
-                    accepted_receipt_id: applied.accepted_receipt_id,
-                    accepted_observation_id: applied.accepted_observation_id,
-                    accepted_evidence_id: applied.accepted_evidence_id,
-                    finding: protocol_reorient_finding(applied.finding),
-                },
-            )
+            .send_response(request_id, output.response)
             .await;
         self.send_epiphany_state_updated(
             thread_uuid,
             ThreadEpiphanyStateUpdatedSource::ReorientAccept,
-            changed_fields,
-            epiphany_state,
+            output.changed_fields,
+            output.epiphany_state,
         )
         .await;
     }