diff --git a/epiphany-core/src/bin/epiphany-swarm.rs b/epiphany-core/src/bin/epiphany-swarm.rs index 5fface60..53c125c9 100644 --- a/epiphany-core/src/bin/epiphany-swarm.rs +++ b/epiphany-core/src/bin/epiphany-swarm.rs @@ -15,6 +15,7 @@ use epiphany_core::{ resident_prepared_launch_thread_id, resident_self_child_claim, resident_self_local_provider_status, terminate_process_instance, validate_persona_feedback_store_separation, validate_resident_self_store_separation, + verify_resident_self_grant_fulfillment, }; use serde_json::json; use std::collections::BTreeMap; @@ -236,6 +237,21 @@ fn cycle( "coordinator exited zero without its exact resident terminal receipt" ) })?; + if let Err(error) = verify_resident_self_grant_fulfillment( + &args.state_store, + &args.policy.runtime_store, + &lease.grant_id, + ) { + cancel_resident_self_turn( + &args.state_store, + &lease, + "unfulfilled", + &error.to_string(), + now, + )?; + *state = load_resident_self_state(&args.state_store)?; + return Ok(ResidentSelfOutcome::Failed); + } complete_resident_self_turn(&args.state_store, &lease, &receipt, now)?; *state = load_resident_self_state(&args.state_store)?; Ok(ResidentSelfOutcome::Completed) diff --git a/epiphany-core/src/resident_self.rs b/epiphany-core/src/resident_self.rs index b7ac2fac..e57aed24 100644 --- a/epiphany-core/src/resident_self.rs +++ b/epiphany-core/src/resident_self.rs @@ -1082,6 +1082,36 @@ pub fn resident_self_pressures(path: &Path) -> Result> Ok(pressure) } +pub fn verify_resident_self_grant_fulfillment( + resident_store: &Path, + runtime_store: &Path, + grant_id: &str, +) -> Result<()> { + let grant = state_cache(resident_store)? + .get::(grant_id)? + .ok_or_else(|| anyhow!("resident Self fulfillment check lost its grant"))?; + if grant.pressure_kind != "repo-frontier-proposal-modeling" { + return Ok(()); + } + let request_id = grant + .provenance_ref + .strip_prefix("cultcache://repo-frontier-proposal-modeling/") + .filter(|value| !value.trim().is_empty()) + .ok_or_else(|| anyhow!("proposal Modeling grant lost exact request provenance"))?; + let mut runtime = crate::runtime_spine_cache(runtime_store)?; + runtime.pull_all_backing_stores()?; + if !runtime + .get_all::()? + .iter() + .any(|binding| binding.proposal_modeling_request_id == request_id) + { + return Err(anyhow!( + "proposal Modeling pressure completed without its exact launch binding" + )); + } + Ok(()) +} + pub fn pending_resident_self_grant(path: &Path) -> Result> { let mut grants = state_cache(path)? .get_all::()? @@ -2177,6 +2207,21 @@ mod tests { pressures[0].provenance_ref, "cultcache://repo-frontier-proposal-modeling/selection-1" ); + let grant = heartbeat_issue_resident_self_grant( + &resident_store, + "queue-heartbeat", + "queue-action", + 2, + )? + .expect("queue-head grant"); + assert!( + verify_resident_self_grant_fulfillment( + &resident_store, + &runtime_store, + &grant.grant_id, + ) + .is_err() + ); let runtime_cache = crate::runtime_spine_cache(&runtime_store)?; let launch = crate::RepoFrontierProposalModelingLaunchBinding { @@ -2196,6 +2241,7 @@ mod tests { }; let (entry, _) = runtime_cache.prepare_entry(&launch.binding_record_id, &launch)?; SingleFileMessagePackBackingStore::new(&runtime_store).push(&entry)?; + verify_resident_self_grant_fulfillment(&resident_store, &runtime_store, &grant.grant_id)?; assert_eq!( ingest_resident_self_domain_pressure( diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index c6b6aa82..9d589f7a 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -1278,6 +1278,14 @@ a second independently ordered pressure queue. Self owns queue order; it does not silently discard or rank Imagination's already-selected options, and heartbeat owns opportunity without acquiring a second scheduling opinion. +Resident terminal success is also pressure-specific. For a +`repo-frontier-proposal-modeling` grant, a zero-exit coordinator receipt proves +only that the bounded coordinator process ended cleanly; it does not prove the +requested Modeling launch occurred. Before acknowledging that pressure, +resident Self now requires the runtime spine to contain the exact +`RepoFrontierProposalModelingLaunchBinding`. Missing fulfillment is a typed +failed turn: cancellation requeues the same pressure for heartbeat retry. + ## Exact release build cache ownership Release construction has two serialized cache authorities. The graph cache is diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 0897becb..18dd3ee3 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -40,6 +40,21 @@ cycle. All 17 resident-Self tests pass; focused tests prove runtime ordering, single-request launch consumption, and head-only pressure emission. v35 and v36 are sealed failure boundaries. +Exact `a1d80d40` packages as +`sha256-1ef95f24e9d0bfb5e88ded9391c261d3b4cdc37276f4a6a0f2479cb57a8c9760` +with witness +`sha256-1fde6a1cd73747393631ac50de02c5e404a48c263f48386232b01ae288ab0024`. +Fresh v37 replay proved head-only pressure: only request `464ac...` received a +pressure, grant, and child claim. The coordinator exited zero and resident Self +accepted its generic terminal receipt, but typed status still reported that +same request pending. The runtime had no exact proposal-Modeling launch binding. + +The current worktree makes that impossible to call success. A proposal-Modeling +grant must have its exact runtime launch binding before resident terminal ack; +otherwise the turn is cancelled as `unfulfilled` and the same pressure returns +to heartbeat. The focused fulfillment test and both swarm binary tests pass. +v37 is sealed at the false-success boundary. + Fresh runtime `F:\Projects\.epiphany-runtime\shakedown\live-20260808-v31` accepted initial and proposal-bound Modeling for thread `shakedown-v31-rupture-closure-implementation-r1`. The generic user proposal @@ -109,12 +124,11 @@ thread. ## Next action -1. Commit, push, package, and authenticate the single-owner ingestion repair. -2. Preserve v31 through v36 as failure evidence; replay from a boundary before - duplicate proposal pressures were created. -3. Run persistent resident supervision from an approved `.epiphany-dogfood` - root and prove selected Imagination options launch Modeling one at a time in - runtime request order. +1. Commit, push, package, and authenticate proposal-pressure fulfillment. +2. Preserve v31 through v37 as failure evidence; clone v37 and publish the exact + successor release. +3. Prove the unfulfilled zero-exit requeues, heartbeat retries, the exact launch + binding is created, and only then the next selected option becomes pressure. 4. In a fresh runtime, re-run pressure ingestion twice and resident launch. Prove autonomous direction consideration, proposal-bound Modeling, canonical Imagination, dedicated Mind adoption, and exact Hands authority. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index fe7e3e19..b0559802 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 4c534d10..2c1aa3d8 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -34,15 +34,15 @@ invariants: - Evidence and git retain history; this map retains only state that changes future decisions. current_status: - summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact 16be92f4 packages as sha256-998dbac0877ee2249f723796501f4f82c50cc9dcb8ae205117a50cde04bab3e6 with witness sha256-4975a3b043012f62eecfd9c9b6c9f431bbf66a48ff1f46117bd1532c8b0dba28. v36 proved its oldest-first runtime projection derives launchModeling and completed one proposal Modeling turn, but the same oldest request remained pending: resident ingestion had mirrored every option into a separate pressure queue and heartbeat selected a later pressure first. The current worktree makes runtime pending-request order the only scheduler and emits resident pressure only for its head. All 17 resident-Self tests plus the runtime queue test pass. Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open. + summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact a1d80d40 packages as sha256-1ef95f24e9d0bfb5e88ded9391c261d3b4cdc37276f4a6a0f2479cb57a8c9760 with witness sha256-1fde6a1cd73747393631ac50de02c5e404a48c263f48386232b01ae288ab0024. v37 proved request-owned Imagination and head-only proposal pressure, but the coordinator exited zero without creating that request's Modeling launch binding; resident Self accepted the generic run receipt and consumed unfulfilled work. The current worktree requires exact proposal launch binding before terminal success and converts missing fulfillment into failed-turn requeue. Focused fulfillment and both swarm tests pass. Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open. operational_state: - local_worktree: single_owner_proposal_modeling_queue_verified_pending_commit + local_worktree: proposal_pressure_fulfillment_verified_pending_commit operator_wireguard: restored yggdrasil: canonical_small_public_crossing_body starfire: temporary_epiphany_cognition_body starfire_runtime_identity: epiphany-starfire starfire_swarm_brake: released - starfire_release: authenticated_16be92f4_queue_projection; single_owner_successor_pending + starfire_release: authenticated_a1d80d40_single_owner_queue; fulfillment_successor_pending starfire_repository_body: bound_and_observed starfire_verse_topology: bound_to_current_repository_body starfire_native_status: supervised_shakedown_active @@ -52,8 +52,8 @@ current_status: bifrost_feedback_crossing: authenticated_transport_only yggdrasil_epiphany_services: absent resident_physiology: heartbeat_and_self_running - unresolved_authority: v31's generic user proposal produced a lawful direct Hands gate, but the active objective requires the autonomous Imagination-origin path and dedicated Mind adoption, so that gate remains inert. v35 proved request-owned Imagination continuation; v36 proved the cardinality repair but falsified split scheduling between runtime request order and resident pressure order. The single-owner ingestion repair is locally verified but not packaged/live. Canonical proposal Modeling, dedicated Mind adoption, exact Hands binding, bounded-worker failure/restart/closure, Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open. - next_action: Commit, package, and authenticate single-owner proposal-Modeling ingestion; replay from a pre-duplicate-pressure boundary and prove each selected Imagination option receives one Modeling launch in runtime order. Then continue canonical Imagination planning, dedicated Mind, Hands, and bounded-worker failure/restart/Soul closure. + unresolved_authority: v31's generic user proposal produced a lawful direct Hands gate, but the active objective requires the autonomous Imagination-origin path and dedicated Mind adoption, so that gate remains inert. v37 proved single-owner pressure ordering but exposed that generic coordinator completion could consume a typed pressure without its requested launch consequence. The fulfillment repair is locally verified but not packaged/live. Canonical proposal Modeling, dedicated Mind adoption, exact Hands binding, bounded-worker failure/restart/closure, Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open. + next_action: Commit, package, and authenticate proposal-pressure fulfillment; replay the sealed v37 boundary and prove zero-exit without binding requeues, retry creates the exact Modeling launch binding, and only then does the next request become pressure. Then continue canonical Imagination planning, dedicated Mind, Hands, and bounded-worker failure/restart/Soul closure. active_subgoals: - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.