Map standalone Codex transport authority
This commit is contained in:
Meta Vens
parent
87ea81db2a
commit
895476b1b3
6 changed files with 137 additions and 68 deletions
|
|
@ -83,11 +83,13 @@ runtime-local identity, session, job, binding, coordinator, native model/tool,
|
|||
and state-ledger JSON mirror. Those documents remain typed CultCache state and
|
||||
are discovered from the native registration or projected by their owning
|
||||
CultMesh provider; no live CultNet crossing consumed the hand-maintained JSON,
|
||||
and several schemas contradicted their Rust owners. The catalog now contains
|
||||
only three earned portable boundaries: the exact OpenAI-compatible provider
|
||||
request, `gamecult.persona_state.v0`, and `epiphany.work_organ_state.v0`. The
|
||||
two cuts remove 850 net maintained lines. Atlas remains untouched and untested
|
||||
end to end.
|
||||
and several schemas contradicted their Rust owners. Those two cuts left three
|
||||
portable boundaries and removed 850 net maintained lines. Exact `87ea81db`
|
||||
then deletes the generic OpenAI-shaped schema after its Rust document ceases to
|
||||
exist. The public Epiphany catalog now contains only
|
||||
`gamecult.persona_state.v0` and `epiphany.work_organ_state.v0`. Connector owns
|
||||
the shared Codex contract; Epiphany's closed provider-request document remains
|
||||
private Mind state. Atlas remains untouched and untested end to end.
|
||||
|
||||
Dependency ownership follows source ownership. Exact `695af6c6` deletes
|
||||
thirteen manifest edges with no consumer in their owning package, plus the
|
||||
|
|
@ -669,11 +671,12 @@ route, not a tool route plus a parallel no-tools opinion.
|
|||
The target boundary is the independent daemon mapped in
|
||||
`notes/standalone-codex-transport-migration.md`. Independent
|
||||
`GameCult/CodexConnector` exact
|
||||
`54d8bc2525b7e7fa1b9dd26b95871247ff4c7566` now owns one typed multi-caller
|
||||
`6dc80f6d266db4d82566d2434adcc55a48e8ecad` owns one typed multi-caller
|
||||
transport package and one public daemon binary without linking a Codex crate.
|
||||
Its default library is only the encrypted contract/client ABI; daemon-only
|
||||
auth, raw Responses transport, CultCache replay, and Ureq/Rustls dependencies
|
||||
sit behind the `daemon` feature.
|
||||
With no features the library exposes only the typed provider/result contract.
|
||||
The default `client` feature adds authenticated encryption, framing, and socket
|
||||
transport. Auth, raw Responses transport, CultCache replay, and Ureq/Rustls sit
|
||||
behind the `daemon` feature.
|
||||
Each consumer internally derives its exact typed provider request. The daemon
|
||||
verifies those exact bytes, returns a digest-bound transport receipt plus typed
|
||||
events, and uses a private digest-pinned official `codex app-server` child only
|
||||
|
|
@ -696,6 +699,17 @@ readiness, the independent Idunn target, Yggdrasil installation, one real
|
|||
Epiphany round trip, and Ghostlight's copied wire/deployment deletion remain
|
||||
open.
|
||||
|
||||
Exact `c37cae8b` closes the remaining request-authorship split. The consumer
|
||||
adapter turns the canonical native request directly into one closed durable
|
||||
provider-request variant before inference. For Codex, that variant contains the
|
||||
exact `CodexProviderRequest` sent across the socket. The release edge may add
|
||||
only Connector invocation physiology: caller identity, native-request digest,
|
||||
expiry, encryption, and framing. It cannot lower schemas, rename tool calls,
|
||||
choose tools, or author a second provider request. OpenRouter retains its own
|
||||
exact direct request variant. Decision contexts and runtime model execution
|
||||
persist the same provider-request bytes; runtime v47 and decision context v3
|
||||
refuse the old writable shape.
|
||||
|
||||
## Canonical authority map
|
||||
|
||||
| Owner | Inputs | Outputs | Invariant |
|
||||
|
|
@ -707,7 +721,7 @@ open.
|
|||
| `current_work.rs` | keyed Mind view and exact runtime request/job/result/decision families | pure family scheduling and continuation projections | Events, timestamps, role lanes, and thread provenance cannot create or suppress work. |
|
||||
| coordinator policy/status | keyed Mind presence, exact current work, and the accepted continuity decision | one action/reason pair plus operator-readable role lanes | Coordinator presence is derived; no mutable coordinator head, pressure tableau, or duplicate policy wrapper exists. |
|
||||
| runtime worker attempt owner | sealed typed launch, exact process claim, semantic result or typed failure, job result, archival evidence | one terminal attempt authority | The launch document solely owns live family identity. The result cannot repeat routing identity; after live deletion the archive owns exact request kind/ID beside the preserved structured decision. Scheduling, process liveness, and semantic admission remain distinct authorities. |
|
||||
| model-provider boundary | sealed native model request plus explicit provider configuration | exact internally derived provider request and transport result | OpenRouter remains a release-owned direct boundary. Codex crosses the lean CodexConnector client ABI; the daemon owns only caller admission, credential refresh, exact transport, and durable replay. Provider selection cannot author a second request truth or admit Mind state. |
|
||||
| model-provider boundary | sealed native model request plus explicit provider configuration | one closed durable provider-request variant and transport result | The consumer adapter owns provider lowering. OpenRouter remains a release-owned direct boundary. For Codex, the persisted request is the exact `CodexProviderRequest` crossing the lean Connector client ABI; the release edge adds only authenticated invocation physiology. The daemon owns caller admission, credential refresh, exact transport, and durable replay. No transport layer can author a second request truth or admit Mind state. |
|
||||
| OpenAI Responses schema projector | full native typed output schema | one provider-legal strict generation schema | Provider formatting preserves useful supported constraints but never replaces native decoding or Mind admission. |
|
||||
| model-pass terminal owner | sealed reasoning basis/context and typed failure class | exact transport closure plus `EpiphanyModelPassFailure` and terminal session/job result in one batch CAS | The caller cannot nominate a job/session; the context-derived binding closes role, reorient, and Persona failures without granting generic transport results decision authority. |
|
||||
| Substrate Gate | exact worker/job authority and requested operation | scoped grant or refusal | Access permission does not admit Mind state. |
|
||||
|
|
|
|||
|
|
@ -222,15 +222,17 @@ Delete or demote:
|
|||
## Immediate Next Action
|
||||
|
||||
Keep the five-day shakedown, Ox17 deployment, and Model Atlas operational Gate
|
||||
1 paused. Exact `ed7357a2` completes Epiphany's source-side Codex transport cut:
|
||||
the embedded spine, compiled Codex graph, direct auth/HTTP/SSE path, and
|
||||
Codex-home readiness are absent. Modeling still consumes typed Body and keyed
|
||||
RepoModel state directly; Persona still consumes keyed memory and social state
|
||||
directly. No Epiphany-owned Rider or Unity bridge exists: Brokkr owns Unity
|
||||
through typed Eve/CultMesh capabilities, and a future Rider daemon owns Rider.
|
||||
Do not admit a fresh package until the standalone Connector has redacted signed
|
||||
readiness, an independent Idunn target, and a real digest-bound Epiphany round
|
||||
trip.
|
||||
1 paused. Exact `ed7357a2` removes Codex transport from Epiphany's body, and
|
||||
exact `c37cae8b` closes the residual request-authorship split. Epiphany now
|
||||
seals the exact final `CodexProviderRequest` as durable Mind input before the
|
||||
release edge sees it. The edge adds authenticated invocation physiology but no
|
||||
schema, tool, call-ID, tool-choice, or output-format opinion. Modeling still
|
||||
consumes typed Body and keyed RepoModel state directly; Persona still consumes
|
||||
keyed memory and social state directly. No Epiphany-owned Rider or Unity bridge
|
||||
exists: Brokkr owns Unity through typed Eve/CultMesh capabilities, and a future
|
||||
Rider daemon owns Rider. Do not admit a fresh package until the standalone
|
||||
Connector has redacted signed readiness, an independent Idunn target, and a
|
||||
real digest-bound Epiphany round trip.
|
||||
|
||||
The immediate comparison is now explicit. The former release-edge
|
||||
`codex-login` graph is gone from Epiphany. `epiphany-core` remains broad and
|
||||
|
|
@ -241,20 +243,26 @@ semantic owner rather than invent a package taxonomy.
|
|||
The provider decision is a service extraction specified by
|
||||
`notes/standalone-codex-transport-migration.md`. Independent
|
||||
`GameCult/CodexConnector` exact
|
||||
`54d8bc2525b7e7fa1b9dd26b95871247ff4c7566` owns the v2 multi-caller contract,
|
||||
`6dc80f6d266db4d82566d2434adcc55a48e8ecad` owns the v2 multi-caller contract,
|
||||
exact native/provider digest binding, typed tool and terminal receipts, the
|
||||
pinned official Codex credential child, raw Responses transport, and durable
|
||||
keyed replay. Its default feature set is the lean encrypted client/contract ABI;
|
||||
daemon-only anatomy is feature-gated. It links no Codex crate. Active replay
|
||||
identity is written before network access; the exact encrypted completion is
|
||||
durable before reply; restart ambiguity refuses rather than re-executing.
|
||||
Redacted CultMesh/Odin readiness is the remaining daemon source cut before its
|
||||
independent Idunn deployment.
|
||||
keyed replay. No features yields only the typed contract; default `client` adds
|
||||
authenticated framing and socket transport; `daemon` adds service authority.
|
||||
It links no Codex crate. Active replay identity is written before network
|
||||
access; the exact encrypted completion is durable before reply; restart
|
||||
ambiguity refuses rather than re-executing. Redacted CultMesh/Odin readiness is
|
||||
the remaining daemon source cut before its independent Idunn deployment.
|
||||
|
||||
Epiphany now passes the shared client contract and its old path is deleted.
|
||||
Ghostlight must adopt the same ABI and remove its copied wire types plus
|
||||
connector deployment authority after the standalone service is proven on
|
||||
Yggdrasil. No dual daemon or refresh writer is an acceptable transition state.
|
||||
Epiphany pins the contract-only surface in its adapter and enables the client
|
||||
only at its release edge. Exact `87ea81db` also deletes Epiphany's obsolete
|
||||
public schema for the extinct generic provider request; the shared Codex
|
||||
contract belongs to Connector, while Epiphany's wrapper remains private Mind
|
||||
state. Ghostlight exact `8e7d980` now pins the same Connector source without
|
||||
changing its live deployment. Repair the stale deployment maps next. No dual
|
||||
daemon or refresh writer is an acceptable transition state. After that,
|
||||
preserve the dirty vendored-Codex edits and delete
|
||||
the 3,592-file tree if its final live-consumer audit remains empty; resume the
|
||||
single-caller runtime-spine audit afterward.
|
||||
|
||||
Model Atlas has component proofs but no live inter-swarm collaboration run.
|
||||
Preserve its publication, trust, transport, projection, Soul verification, Self
|
||||
|
|
|
|||
|
|
@ -2,11 +2,11 @@
|
|||
|
||||
Updated: 2026-08-24
|
||||
Branch: `codex/epiphany-shakedown-live`
|
||||
Latest committed Epiphany source cut: `24023265`
|
||||
Current connector source: `54d8bc2525b7e7fa1b9dd26b95871247ff4c7566`
|
||||
Current pass: source subtraction continues after deleting duplicate live Hands
|
||||
receipt rereads; the Hands actuator ABI boundary is next; Ox17 and Atlas
|
||||
Gate 1 remain paused
|
||||
Latest committed Epiphany source cut: `87ea81db`
|
||||
Current connector source: `6dc80f6d266db4d82566d2434adcc55a48e8ecad`
|
||||
Current pass: exact provider-request authorship is singular; reconcile the
|
||||
stale deployment maps, then preserve and remove the unused vendored Codex tree;
|
||||
Ox17 and Atlas Gate 1 remain paused
|
||||
|
||||
## Orientation
|
||||
|
||||
|
|
@ -17,9 +17,9 @@ Idunn's Yggdrasil CI/CD task with local compiler work, or wake resident
|
|||
cognition without an explicit operator resumption.
|
||||
|
||||
Epiphany is a supervised engineering alpha. Exact source `d2ca6630` remains the
|
||||
production symlink body and is inactive. Exact `2c3335dc` is the current
|
||||
build-affecting source. Historical live proofs remain evidence; they do not
|
||||
authorize the next capstone or Gate 1.
|
||||
production symlink body and is inactive. Exact `87ea81db` is the current
|
||||
build-affecting source on this branch. Historical live proofs remain evidence;
|
||||
they do not authorize the next capstone or Gate 1.
|
||||
|
||||
## Current live deployment
|
||||
|
||||
|
|
@ -1338,18 +1338,39 @@ coordinator `12/12`, swarm `10/10`, and model-runtime `13/13`.
|
|||
|
||||
## Immediate next action
|
||||
|
||||
The Ox17 deployment lane remains paused. Continue subtraction from exact
|
||||
`a01c6842`. Map the remaining Codex provider boundary before changing it: the
|
||||
decision context currently seals `EpiphanyOpenAiModelRequest`, then the release
|
||||
edge derives the final `CodexProviderRequest` that crosses the standalone
|
||||
daemon boundary. Collapse that two-request seam without moving prompts, tools,
|
||||
retry, interpretation, or Mind admission into CodexConnector. Then reconcile
|
||||
the consumer protocol pins and stale deployment maps. The 3,592-file vendored
|
||||
Codex tree is excluded from every production build and has no nonhistorical
|
||||
source consumer; preserve its current uncommitted edits before deciding its
|
||||
deletion. Resume the single-caller runtime-spine audit after this boundary is
|
||||
watertight. Preserve keyed Mind, direct Body-to-Modeling flow, OpenRouter as a
|
||||
separate temporary provider edge, and the complete unrun Model Atlas slice.
|
||||
The Ox17 deployment lane remains paused. Exact Epiphany `c37cae8b` closes the
|
||||
remaining two-stage Codex request seam. The consumer adapter now derives and
|
||||
seals one closed durable provider-request document: either the exact final
|
||||
`CodexProviderRequest` or the exact OpenRouter request. The release edge no
|
||||
longer rewrites Codex schemas, tools, call IDs, tool choice, or output format;
|
||||
it only wraps the sealed request in the authenticated Connector invocation.
|
||||
Runtime and decision-context writable schemas are v47/v3. The source cut is 10
|
||||
net maintained deletions and passes Core 152/152, runtime 21/21, adapter 5/5,
|
||||
model edge 12/12, and Persona 1/1.
|
||||
|
||||
CodexConnector source exact
|
||||
`6dc80f6d266db4d82566d2434adcc55a48e8ecad` includes current mainline transport
|
||||
diagnostics and exposes three compile surfaces: contract-only with no features,
|
||||
the default encrypted socket client, and the daemon. Contract/client/daemon
|
||||
tests pass 8/8, 10/10, and 29/29. Documentation exact `8c57be4` records that
|
||||
boundary. Epiphany pins the contract-only surface in its adapter and enables
|
||||
the client only at the release edge.
|
||||
|
||||
Exact `87ea81db` pins the current Connector source and deletes Epiphany's stale
|
||||
106-line public JSON schema for the extinct generic request; the public catalog
|
||||
now contains only the portable Persona and work-organ contracts.
|
||||
|
||||
Ghostlight exact `8e7d980` now pins the same Connector source contract. Only
|
||||
Cargo metadata and the additive Connector API diff were checked locally; no
|
||||
Ghostlight compilation or deployment ran on Starfire.
|
||||
|
||||
Continue subtraction from exact `87ea81db`. Reconcile the stale
|
||||
standalone-daemon deployment maps without mutating live service authority. Then
|
||||
preserve the uncommitted edits inside the 3,592-file
|
||||
vendored Codex tree and delete the tree if the final live-consumer audit remains
|
||||
empty. Resume the single-caller runtime-spine audit afterward. Preserve keyed
|
||||
Mind, direct Body-to-Modeling flow, OpenRouter as a separate temporary provider
|
||||
edge, and the complete unrun Model Atlas slice.
|
||||
|
||||
Yggdrasil previously exposed 96 GiB of dead native Cargo targets after
|
||||
interrupted full-workspace builds; exact cleanup returned the builder target
|
||||
|
|
|
|||
|
|
@ -16,10 +16,12 @@ and release cadence.
|
|||
|
||||
The source and live mechanisms are deliberately distinct during the braked cut:
|
||||
|
||||
1. Exact Epiphany `ed7357a2` uses the standalone Connector client ABI for Codex
|
||||
requests. Its embedded spine, direct Codex auth/HTTP/SSE path, compiled Codex
|
||||
graph, `CODEX_HOME`, and auth.json readiness are deleted. That source is not
|
||||
deployed; production Epiphany remains inactive on its historical release.
|
||||
1. Exact Epiphany `c37cae8b` seals the final Codex provider request and uses the
|
||||
standalone Connector client ABI only for authenticated transport. Its
|
||||
embedded spine, direct Codex auth/HTTP/SSE path, compiled Codex graph,
|
||||
`CODEX_HOME`, auth.json readiness, and second release-edge request lowering
|
||||
are deleted. That source is not deployed; production Epiphany remains
|
||||
inactive on its historical release.
|
||||
2. Yggdrasil still runs `epiphany-model-connector.service` for Ghostlight.
|
||||
It uses encrypted CultNet/MessagePack on loopback TCP 4103, owns a private
|
||||
writable Codex home, serializes refresh through one `AuthManager`, bounds
|
||||
|
|
@ -35,14 +37,15 @@ is useful; the ownership is not.
|
|||
## Current cut status
|
||||
|
||||
Independent `GameCult/CodexConnector` exact
|
||||
`54d8bc2525b7e7fa1b9dd26b95871247ff4c7566` completes migration steps 1-4 on
|
||||
`6dc80f6d266db4d82566d2434adcc55a48e8ecad` completes migration steps 1-4 on
|
||||
the source side except redacted CultMesh/Odin publication and the Ghostlight
|
||||
cut. It owns one Cargo package, one public daemon binary, the v2 multi-caller
|
||||
encrypted MessagePack contract and lean default client ABI,
|
||||
caller-native and exact provider-request digest binding, typed tool/result
|
||||
transport, a private digest-pinned official `codex app-server` credential
|
||||
child, raw Responses HTTP/SSE, and durable keyed replay. It links no Codex
|
||||
crate.
|
||||
MessagePack contract, caller-native and exact provider-request digest binding,
|
||||
typed tool/result transport, a private digest-pinned official
|
||||
`codex app-server` credential child, raw Responses HTTP/SSE, and durable keyed
|
||||
replay. It links no Codex crate. The no-feature library is contract-only;
|
||||
default `client` adds authenticated encryption, framing, and socket transport;
|
||||
`daemon` adds service authority.
|
||||
|
||||
Replay uses one CultCache document per caller/request identity in an owned Redb
|
||||
store. The daemon persists `Active` before provider I/O and replaces it with
|
||||
|
|
@ -53,8 +56,8 @@ capacity for unrelated identities. Replay records do not disappear merely
|
|||
because request admission expiry elapsed. A non-secret connection-key epoch
|
||||
detects rotation without persisting a secret-derived verifier.
|
||||
|
||||
Default acceptance passes 10/10 and daemon acceptance passes 23/23 plus exact
|
||||
library/binary checks and Clippy. All disposable Connector targets were removed.
|
||||
Contract-only, client, and daemon acceptance pass 8/8, 10/10, and 29/29.
|
||||
Connector documentation exact `8c57be4` records the feature boundary.
|
||||
|
||||
Exact Epiphany `ed7357a2` consumes the lean client, keeps OpenRouter as a direct
|
||||
separate provider edge, and preserves Connector caller/native/provider digest
|
||||
|
|
@ -64,6 +67,28 @@ maintained non-lock source shrinks by 857 lines and Cargo.lock by 4,830 lines.
|
|||
The bounded verification roots were removed; only the exact state inspector
|
||||
remains. No live service, credential, or deployment authority moved.
|
||||
|
||||
Exact Epiphany `c37cae8b` closes the remaining two-request seam. The
|
||||
consumer-owned adapter now lowers the native request directly to one durable
|
||||
closed provider-request variant. Its Codex variant is the exact
|
||||
`CodexProviderRequest` supplied to the daemon; the release edge adds only
|
||||
caller identity, native digest, expiry, encryption, and framing. The old
|
||||
release-edge schema/tool/call-ID/output-format lowering is deleted. Runtime and
|
||||
decision-context writable schemas advance to v47/v3. Core 152/152, runtime
|
||||
21/21, adapter 5/5, model edge 12/12, and Persona 1/1 pass. The source cut
|
||||
removes 10 net maintained lines. Epiphany pins the contract-only Connector
|
||||
surface in its adapter and enables `client` only at the release edge.
|
||||
|
||||
Exact Epiphany `87ea81db` pins current Connector source `6dc80f6d` and deletes
|
||||
the obsolete public JSON schema for the extinct generic OpenAI-shaped request.
|
||||
Provider wire contracts are published by their owning provider boundary;
|
||||
Epiphany's closed provider-request wrapper remains private Mind state.
|
||||
|
||||
Exact Ghostlight `8e7d980` pins the same Connector source contract. Cargo
|
||||
metadata and the additive Connector API diff validate the dependency seam; no
|
||||
local Ghostlight compilation, Idunn transaction, or live service mutation was
|
||||
performed. The current Yggdrasil Ghostlight connector remains historical live
|
||||
physiology until the standalone deployment cut is admitted separately.
|
||||
|
||||
## Authority map
|
||||
|
||||
### Standalone Codex transport service
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -115,15 +115,16 @@ current_status:
|
|||
summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. Exact edb5c3a3 deletes the launch, heartbeat, and terminal-result family identity mirrors: the sealed typed launch owns live pass identity and the archived attempt owns historical request identity. Exact cabdd6c3 separates immutable coordinator incarnation basis/terminality from minimal model-session admission and removes the remaining session prose, clocks, dead states, redundant options, and whole-store coordinator snapshot. Exact a46725a1 reduces runtime jobs to Queued/Completed/Failed admission latches and removes timestamp selection from Research. Exact 10a70afc derives job role/session ownership from sealed launches and model bindings, leaving the generic job as identity plus status. Exact 53e869c0 removes generic job-result evidence/artifact mirrors; exact 8eaa96c5 stops persisting generic result documents for structured worker decisions; exact 2c3335dc deletes the generic result family entirely and makes typed decisions, model receipts/failures, job status, and process claims own their respective terminal facts. Exact dbb00c2b retains the minimal live/archive session pair for explicit phase closure and retired-identity refusal while deleting display echoes and a wrapper. Exact 24023265 makes the sealed Verification projection the sole Hands receipt input and deletes the duplicate live reread path. Exact a01c6842 deletes the coordinator's same-function always-approved Hands review, derives consequence authority through route/intent/grant identities, and refuses ambiguous receipt sets instead of selecting by timestamp. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
|
||||
public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
|
||||
competitive_launch_signal: The 2026-08-22 Munder Difflin launch analysis in notes/munder-difflin-launch-intelligence-2026-08-23.md is the current Eyes/Imagination owner for this category signal. It establishes strong demand to try a packaged, local, visual multi-agent control plane and supplies repeated qualitative demand for an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness; it does not establish retention, reliable autonomy, or paid product-market fit. Munder is materially ahead in installation, cross-platform reach, provider reuse, category compression, community formation, and feedback velocity. Its public failures make renderer-owned physiology, cross-Body restoration, proxy safety metrics, false consequence receipts, provider parity, and marketed-but-unavailable federation concrete falsification targets. Epiphany does not yet own a general operator UI: Persona projection into shared asynchronous chat is the concrete human surface, while CultMesh remains projection-neutral. Social Aquarium, a dense operator cockpit, TUI, and audit surfaces may use distinct Eve compositions over the same provider-owned facts. A one-hour projection experiment and managed continuity/federation remain evidence-led options rather than adopted roadmap authority; the source-subtraction and test-authority audit remains next.
|
||||
latest_phase: Fresh-package Ox17 remains paused while source subtraction continues. The live source owns keyed Mind, sealed reasoning projections and exact provider requests, direct Body-to-Modeling work, typed frontier planning, Persona, provider-owned Bifrost feedback, and Odin/Idunn deployment receipts. Provider events and receipts are transient transport values normalized into one native persisted model stream/receipt family. The pure OpenAI runtime library opens exact model execution and admits typed provider events. OpenRouter auth/networking remains a direct release-entrypoint boundary; Codex transport crosses the lean authenticated CodexConnector client ABI and no Codex auth, HTTP/SSE, Codex-home, or compiled Codex dependency remains in Epiphany. Runtime model bindings are request-to-session/job edges; provider, worker ancestry, and reasoning basis remain on the native model request. Runtime tool bindings are intent-to-session/job edges; model ancestry remains on the exact tool intent. Workers use one governed tool-capable route; no parallel no-tools mode survives. The sealed typed worker launch is the sole live owner of pass-family identity; terminal role results contain semantic decision cargo rather than routing echoes, and archived attempts retain historical request identity plus the structured decision. Runtime jobs are only mutable job-identity plus Queued/Completed/Failed admission latches; clocks, role/session mirrors, unowned intermediate states, and generic terminal-result documents are absent. Model bindings own model-session membership, sealed launches own outer-worker role, root membership is structural, and Research derives attempt authority as an exact set rather than timestamp order. Runtime child documents, Hands consequence receipts, and repository-frontier documents carry only causal identity, lifecycle, strong dependencies, semantic payload, and consequence; CultCache plus the runtime root epoch own internal type/schema identity. Runtime identity and swarm binding retain their explicit epoch fields. Sealed worker contexts retain explicit schema and contract because they are exact model input. Autonomous proposal origin belongs to the Proposal-Modeling request; there is no companion binding document or stored hash echo. The immutable repository-domain receipt carries only the canonical repository name and exact authenticated Body hash; runtime, swarm, workspace, envelope identity/schema, prose, and time remain derived. Operator objective intake carries only thread provenance, the asserted objective, source actor/reference, and submission time; CultCache owns envelope identity/schema and the Mind objective owns active state. Persona-memory v2 owns exact Interpreter effect/context provenance; Persona social mention v2 relies on its queue and turn request for routing; tool-receipt v1 owns exact result JSON or error. Research authenticates the real Substrate Gate grant and tool receipts in place, then writes keyed evidence/observations under one exact `Eyes.frontier_research` Mind commit; no source-lookup document or evidence packet survives. Resident Self state v3 and retention head v1 retain lifecycle counts and the exact deletion chain without a causal clock. Structured role/reorientation outcomes terminalize jobs and process claims through exact-envelope CAS; native model receipt/failure records own model terminality, process claims own process death, and archives retain typed decisions including typed failures. Mind/runtime writable epochs are v11/v46. The public CultNet catalog contains only three earned portable boundaries: exact OpenAI-compatible provider request, Persona state, and work-organ state. Old writable stores refuse with no migrator or dual reader. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon owns Rider. No Idunn build, package, deployment, Ox root, or Model Atlas Gate run is authorized. Ox16 remains sealed historical evidence.
|
||||
latest_phase: Fresh-package Ox17 remains paused while source subtraction continues. The live source owns keyed Mind, sealed reasoning projections and exact provider requests, direct Body-to-Modeling work, typed frontier planning, Persona, provider-owned Bifrost feedback, and Odin/Idunn deployment receipts. Provider events and receipts are transient transport values normalized into one native persisted model stream/receipt family. The pure OpenAI runtime library opens exact model execution and admits typed provider events. OpenRouter auth/networking remains a direct release-entrypoint boundary. For Codex, the consumer adapter seals the exact final `CodexProviderRequest` into Mind before inference; the release edge only wraps it in the authenticated Connector invocation. No Codex auth, HTTP/SSE, Codex-home, or compiled Codex implementation remains in Epiphany. Runtime model bindings are request-to-session/job edges; provider, worker ancestry, and reasoning basis remain on the native model request. Runtime tool bindings are intent-to-session/job edges; model ancestry remains on the exact tool intent. Workers use one governed tool-capable route; no parallel no-tools mode survives. The sealed typed worker launch is the sole live owner of pass-family identity; terminal role results contain semantic decision cargo rather than routing echoes, and archived attempts retain historical request identity plus the structured decision. Runtime jobs are only mutable job-identity plus Queued/Completed/Failed admission latches; clocks, role/session mirrors, unowned intermediate states, and generic terminal-result documents are absent. Model bindings own model-session membership, sealed launches own outer-worker role, root membership is structural, and Research derives attempt authority as an exact set rather than timestamp order. Runtime child documents, Hands consequence receipts, and repository-frontier documents carry only causal identity, lifecycle, strong dependencies, semantic payload, and consequence; CultCache plus the runtime root epoch own internal type/schema identity. Runtime identity and swarm binding retain their explicit epoch fields. Sealed worker contexts retain explicit schema and contract because they are exact model input. Autonomous proposal origin belongs to the Proposal-Modeling request; there is no companion binding document or stored hash echo. The immutable repository-domain receipt carries only the canonical repository name and exact authenticated Body hash; runtime, swarm, workspace, envelope identity/schema, prose, and time remain derived. Operator objective intake carries only thread provenance, the asserted objective, source actor/reference, and submission time; CultCache owns envelope identity/schema and the Mind objective owns active state. Persona-memory v2 owns exact Interpreter effect/context provenance; Persona social mention v2 relies on its queue and turn request for routing; tool-receipt v1 owns exact result JSON or error. Research authenticates the real Substrate Gate grant and tool receipts in place, then writes keyed evidence/observations under one exact `Eyes.frontier_research` Mind commit; no source-lookup document or evidence packet survives. Resident Self state v3 and retention head v1 retain lifecycle counts and the exact deletion chain without a causal clock. Structured role/reorientation outcomes terminalize jobs and process claims through exact-envelope CAS; native model receipt/failure records own model terminality, process claims own process death, and archives retain typed decisions including typed failures. Mind/runtime writable epochs are v11/v47. The public CultNet catalog contains only two earned portable boundaries: Persona state and work-organ state. Provider request contracts belong to their provider boundary; Epiphany's closed provider-request document is private Mind state. Old writable stores refuse with no migrator or dual reader. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon owns Rider. No Idunn build, package, deployment, Ox root, or Model Atlas Gate run is authorized. Ox16 remains sealed historical evidence.
|
||||
execution_binding_authority_cut: Exact ce6bff12 reduces model and tool execution bindings to the only facts they own. A model binding maps one native request to its runtime session and job; a tool binding maps one typed intent to its runtime session and job. Provider identity, source worker, reasoning basis, and model-request ancestry are no longer copied into bindings or compared through timestamp-shaped API arguments. Validation, retention, public-source lookup, worker terminality, decision sealing, and tool continuation reload the exact native request or tool intent. Runtime writable state advances to v37. Core, epoch refusal, transcript-free decision audit, OpenAI tool continuation, and the release-owned tool runtime pass. The cut removes 67 net source lines and leaves runtime_spine.rs at 9,300 physical lines with 50 public functions and 25 public structs. Verification generated 12.713 GiB across 19,134 files; Cargo cleanup restored the single 1.78 MiB state inspector. Atlas is untouched; no live inter-swarm collaboration has run.
|
||||
provider_transport_boundary_cut: Exact ed7357a2 removes Codex transport from Epiphany's compiled body. The complete epiphany-openai-codex-spine package, codex-login/codex-client graph, CODEX_HOME/auth.json readiness, direct Codex HTTP/SSE, and Codex credential creation/argv are gone. Model and Persona entrypoints use the lean typed client from exact CodexConnector 54d8bc2525b7e7fa1b9dd26b95871247ff4c7566 over authenticated loopback MessagePack; Connector owns Codex auth, transport, replay, and exact native/provider digest receipts. Epiphany retains sealed native/provider requests, strict schema/call-ID projection, tool continuation, decision admission, and typed receipt evidence. OpenRouter remains one direct ureq/Rustls boundary with its own credential and terminal-tool dialect. Model receipts advance to v1 and runtime to v38; caller identity, both request digests, and cached-token usage survive transcript deletion. The maintained non-lock source shrinks by 857 lines and Cargo.lock drops 4,830 lines. Core 150/150, runtime 21/21, adapter 5/5, model edge 12/12, Persona 1/1, exact launch checks, and focused no-deps Clippy pass. Two focused build roots totaling 10.8 GiB were removed; only the exact 1,776,640-byte state inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E remains. Atlas is untouched and no collaboration acceptance is claimed.
|
||||
provider_request_authority_cut: Exact c37cae8b replaces the durable generic OpenAI-shaped request with a closed provider-request document. The consumer adapter now lowers the canonical native request directly to either the exact final `CodexProviderRequest` or the exact OpenRouter request before inference and decision-context sealing. The release edge no longer performs Codex schema, tool, call-ID, or output-format lowering; it supplies the already sealed Codex request to the authenticated Connector invocation. Runtime and decision-context writable schemas advance to v47/v3 with no compatibility reader. Exact 87ea81db pins current Connector source 6dc80f6d266db4d82566d2434adcc55a48e8ecad and deletes Epiphany's obsolete 106-line public schema for the dead generic request, leaving two earned portable CultNet contracts. Connector separates contract-only, client, and daemon compile surfaces; Epiphany uses the contract-only surface in the adapter and the client surface only at the release edge. The Epiphany source cuts remove 125 net maintained lines; Core 152/152, runtime 21/21, adapter 5/5, model edge 12/12, Persona 1/1, and Connector contract/client/daemon 8/8, 10/10, 29/29 pass. Atlas is untouched and no live collaboration acceptance is claimed.
|
||||
runtime_session_authority_cut: Exact cabdd6c3 removes coordinator process incarnations from the generic model-session aggregate. EpiphanyRuntimeSession now contains only grouping identity plus active/completed admission state. Immutable EpiphanyCoordinatorRunBasis records exact thread, resident launch, objective, and start provenance. Exact completion/failure receipts and process-death recovery compete through one deterministic EpiphanyCoordinatorRunTerminality identity, so one full typed authority wins while unrelated document inserts merge. Objective prose, clocks, coordinator notes, four unused status variants, the one-field session-options wrapper, and the dead whole-snapshot append helper are deleted. Runtime advances to v40 with no compatibility reader. The focused Core, model-failure audit, Persona, coordinator terminality/conflict, release coordinator, and release model-runtime checks pass. The code cut removes 62 maintained lines net. Verification created 6.3 GiB across 7,017 Cargo files; cleanup restored exactly the 1,776,640-byte state inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E. Atlas remains untouched and no live inter-swarm collaboration is claimed.
|
||||
runtime_job_authority_cut: Exact a46725a1 removes timestamp causality and dead transition theater from EpiphanyRuntimeJob. The job is now the minimal mutable admission latch from Queued to Completed or Failed; Running, WaitingForReview, Cancelled, created_at, and updated_at are gone. Research no longer chooses a latest attempt by creation time: it derives the exact attempt set, refuses multiple live or multiple successful authorities, requires terminal evidence for failures, and otherwise projects launch, wait, or review deterministically. Runtime advances to v41 with no compatibility reader. Core, old-epoch refusal, model-failure audit, Persona replay, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 67 maintained lines net. Verification created 3.2 GiB across 4,498 Cargo files; cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven.
|
||||
runtime_job_binding_cut: Exact 10a70afc makes EpiphanyRuntimeJob a two-field identity/status latch. The sealed worker launch owns outer-worker role; EpiphanyRuntimeModelExecutionBinding owns model-session membership; outer workers belong to the root session by definition. Role and session disappear from jobs and generic job results, the result's always-empty metadata map is deleted, and heartbeat launch options lose constant root-session plus unused objective/note cargo. Session closure and retention derive their exact job set from model bindings; tool ownership derives from either the sealed launch or one exact model binding; duplicate terminal results refuse instead of sorting by completion time. Runtime advances to v42 without a compatibility reader. Keyed lifecycle, model-failure audit, transcript-free binding, tool continuation, Persona replay, coordinator terminality, epoch refusal, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 73 maintained lines net. Verification created 3.7 GiB across 4,764 Cargo files; cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven.
|
||||
runtime_job_result_cargo_cut: Exact 53e869c0 deletes evidence and artifact mirrors from EpiphanyRuntimeJobResult and its completion API. Structured role/reorientation outcomes remain the sole evidence/artifact owners; the generic result retains only lifecycle verdict, terse summary/next-move account, completion time, and optional decision-context binding for transport and process-death physiology. Reorientation failure display no longer invents generic evidence. Runtime advances to v43 with no compatibility reader. Keyed lifecycle, auditable model failure, epoch refusal, reorientation, typed worker admission, Persona replay, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 51 maintained lines net. Verification created 3.654 GiB across 4,759 Cargo files; Cargo cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven.
|
||||
structured_worker_result_cut: Exact 8eaa96c5 makes typed role/reorientation outcomes the sole durable structured worker decisions. Runtime completion strong-reads and byte-identically replays the exact structured envelope while atomically terminalizing job/process physiology; it persists a generic result only when no structured outcome exists. Fulfilled worker archives retain decision context plus the full typed role result, not a generic companion. Coordinator reorientation success derives from job status and requires the typed reorientation result. Runtime advances to v44 and archived worker attempts to v3 with no compatibility reader. Keyed lifecycle, decision audit, model-failure audit, reorientation, role admission, Persona replay, runtime-error/tool-loop failures, release coordinator, and release model-runtime checks pass. The source cut adds 7 maintained lines because the exact CAS dependency fence replaces a larger durable duplication. Verification created 5.632 GiB across 6,826 Cargo files; Cargo cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven.
|
||||
standalone_codex_transport_target: Independent GameCult/CodexConnector exact 54d8bc2525b7e7fa1b9dd26b95871247ff4c7566 owns one Cargo package and one public daemon binary. Its default library is the lean encrypted client/contract ABI; the daemon feature adds the public service, bounded raw Responses transport, the private digest-pinned official codex app-server credential child, and keyed CultCache replay. Active identity is sealed before provider I/O; the exact encrypted completion is durable before reply; completed replay survives restart byte-identically; restart-era active work refuses as indeterminate without consuming current capacity. Callers own native/provider projection, prompts, tools, decisions, and admission. Redacted CultMesh/Odin readiness, the independent Idunn target, Yggdrasil service installation, and Ghostlight's consumer/deployment cut remain open. No live credential or deployment authority has moved.
|
||||
standalone_codex_transport_target: Independent GameCult/CodexConnector source exact 6dc80f6d266db4d82566d2434adcc55a48e8ecad owns one Cargo package and one public daemon binary. Its no-feature library is the typed provider/result contract only; the default `client` feature adds authenticated encryption, bounded framing, and one-request socket transport; `daemon` adds the public service, bounded raw Responses transport, the private digest-pinned official codex app-server credential child, and keyed CultCache replay. Active identity is sealed before provider I/O; the exact encrypted completion is durable before reply; completed replay survives restart byte-identically; restart-era active work refuses as indeterminate without consuming current capacity. Callers own native/provider projection, prompts, tools, decisions, and admission. Connector docs exact 8c57be4 describe the three compile surfaces; Ghostlight exact 8e7d980 pins the same source contract. Redacted CultMesh/Odin readiness, the independent Idunn target, and Yggdrasil service installation remain open. No live credential or deployment authority moved in this cut.
|
||||
fixed_routing_and_retention_cargo_cut: Exact ffd91c20 deletes EyesEvidencePacket.source_role_id, PersonaSocialMention.target_agent_id, and ResidentSelfRetentionHead.retained_at_millis. Each producer supplied one fixed or non-causal value and no consumer read it; the request/context, Persona queue plus turn request, and retention chain remain the real owners. Eyes packet v2, Persona mention v2, Resident Self state v3/retention head v1, and runtime v27 form a hard cut. Core and the three consuming release entrypoints compile; consequential Persona, Research, and epoch-refusal proofs pass. The maintained source delta is 6 net deletions. Atlas is untouched; no live inter-swarm collaboration has run.
|
||||
provider_stream_authority_cut: Exact fe118e13 makes OpenAI/OpenRouter events and receipts transient transport values. The runtime immediately normalizes them into the single persisted native model event/receipt family used by tool continuation, assistant reconstruction, terminal validation, and bounded retention. Duplicate provider writes, registrations, archive requirements, schema IDs, two public schemas/index rows, and the include-only model-runtime shell are gone; the exact provider request remains durable. Runtime advances to v28 and the catalog drops to 18 schemas. The cut removes 270 net maintained lines. Adapter 1/1, provider spine 14/14, reasoning context 8/8, runtime 23/23, model entrypoint 11/11, swarm 4/4, epoch refusal 1/1, and release construction 15/15 pass. Atlas is untouched; live inter-swarm collaboration remains unproven.
|
||||
cultnet_catalog_authority_cut: Exact dbed11b3 and 8bb0719b delete the hand-maintained JSON shadow registry. The nonexistent runtime-event contract and obsolete public archived-session tombstone schema disappear first. Runtime-local identity, session, job, binding, coordinator, native model/tool, and state-ledger schemas then disappear because no live CultNet provider carries them and several contradicted their Rust owners. Typed CultCache registration and owner-projected CultMesh state remain authoritative. The catalog has exactly three earned boundaries: the exact OpenAI-compatible provider request, gamecult.persona_state.v0, and epiphany.work_organ_state.v0. Parse/path/unindexed/forbidden-contract checks pass at 3/3/0/0/0. The cuts remove 850 net maintained lines. Atlas is untouched; live inter-swarm collaboration remains unproven.
|
||||
|
|
@ -223,10 +224,10 @@ current_status:
|
|||
starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
|
||||
yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
|
||||
resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
|
||||
unresolved_authority: `runtime_spine.rs` remains the largest central liability; it still mixes immutable identity, minimal model sessions/jobs, process claims, model/tool execution binding, family admission, consequence receipts, retention, and resurrection fences. Exact a01c6842 removes the counterfeit Hands review; route, Substrate Gate grant, minimal intent, frontier authority, and exact consequences now own that chain. No production actuator authors those receipts, so the coordinator truthfully stops at `awaitingHandsExecutor`. The sharper provider seam is now Codex: Mind seals `EpiphanyOpenAiModelRequest`, while the release edge derives the final `CodexProviderRequest` sent to the standalone daemon. That second derivation must be collapsed or sealed exactly without moving consumer cognition into CodexConnector. The 3,592-file vendored Codex tree has no production build consumer but contains uncommitted edits that must be preserved before deletion. Historical c011 and partial Gate roots stay untouched/read-only.
|
||||
next_action: Continue source subtraction from exact a01c6842. Map the two-stage Codex request lowering and make the exact final daemon request the audited provider request while preserving consumer-owned prompts, tools, retry, interpretation, and Mind admission. Reconcile Epiphany/Ghostlight/Connector protocol pins and repair stale standalone-daemon deployment maps. Then preserve the current uncommitted vendored-Codex edits and delete the 3,592-file tree if the final live-consumer audit remains empty. Resume the single-caller runtime-spine audit afterward. Keep OpenRouter as a separate temporary provider edge, Model Atlas operationally paused, and avoid local workspace-wide builds or deployment mutation.
|
||||
unresolved_authority: `runtime_spine.rs` remains the largest central liability; it still mixes immutable identity, minimal model sessions/jobs, process claims, model/tool execution binding, family admission, consequence receipts, retention, and resurrection fences. Exact a01c6842 removes the counterfeit Hands review; route, Substrate Gate grant, minimal intent, frontier authority, and exact consequences now own that chain. No production actuator authors those receipts, so the coordinator truthfully stops at `awaitingHandsExecutor`. Exact c37cae8b closes the two-stage Codex request seam: Mind seals the final daemon request and the release edge only transports it. Ghostlight exact 8e7d980 pins the same Connector source contract without changing its live deployment. The 3,592-file vendored Codex tree has no production build consumer but contains uncommitted edits that must be preserved before deletion. Standalone-daemon deployment maps remain stale. Historical c011 and partial Gate roots stay untouched/read-only.
|
||||
next_action: Continue source subtraction from exact 87ea81db. Repair stale standalone-daemon deployment maps without touching live service authority. Then preserve the current uncommitted vendored-Codex edits and delete the 3,592-file tree if the final live-consumer audit remains empty. Resume the single-caller runtime-spine audit afterward. Keep OpenRouter as a separate temporary provider edge, Model Atlas operationally paused, and avoid local workspace-wide builds or deployment mutation.
|
||||
|
||||
runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, minimal model sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. Provider requests remain exact durable audit input; provider events/receipts normalize into one native persisted stream/receipt family. The sealed typed worker launch owns live pass-family identity and outer-worker role. Model execution bindings own model-session membership; outer-worker root membership is structural. Archived worker attempts retain exact request kind/ID, deletion digest, decision context, and full typed structured outcome after live launch deletion, including typed failures. Model sessions carry only grouping identity plus the active/completed phase latch; completed-session retention derives its exact jobs from model bindings and writes one private tombstone containing retired identities plus the deletion-chain digest. The live and archived documents protect distinct admission and resurrection invariants and do not duplicate decision cargo. Runtime jobs carry only job identity plus the Queued/Completed/Failed latch. No job clock, role/session mirror, intermediate status, generic terminal-result document, latest-result selector, or model-turn identity echo participates in causality. Typed role/reorientation outcomes own structured terminal decisions and atomically close their job/process physiology; native model receipt/failure records own model-pass terminality; process claims own process death. Verification reasons from the exact route, authority, intent, patch, command, and commit bodies sealed in its basis and has no review document or live receipt-reread tool. Mind/runtime writable epochs remain v11/v46; archived worker attempts are v3. Family launch CAS, model execution, and coordinator basis admission are the only session/job creation owners. Continue subtraction at the exact Codex request seam and then the remaining single-caller runtime-spine surfaces; do not recreate deleted authority through registries, adapters, compatibility readers, or summary DTOs.
|
||||
runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, minimal model sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. Provider requests remain exact durable audit input; provider events/receipts normalize into one native persisted stream/receipt family. The sealed typed worker launch owns live pass-family identity and outer-worker role. Model execution bindings own model-session membership; outer-worker root membership is structural. Archived worker attempts retain exact request kind/ID, deletion digest, decision context, and full typed structured outcome after live launch deletion, including typed failures. Model sessions carry only grouping identity plus the active/completed phase latch; completed-session retention derives its exact jobs from model bindings and writes one private tombstone containing retired identities plus the deletion-chain digest. The live and archived documents protect distinct admission and resurrection invariants and do not duplicate decision cargo. Runtime jobs carry only job identity plus the Queued/Completed/Failed latch. No job clock, role/session mirror, intermediate status, generic terminal-result document, latest-result selector, or model-turn identity echo participates in causality. Typed role/reorientation outcomes own structured terminal decisions and atomically close their job/process physiology; native model receipt/failure records own model-pass terminality; process claims own process death. Verification reasons from the exact route, authority, intent, patch, command, and commit bodies sealed in its basis and has no review document or live receipt-reread tool. Mind/runtime writable epochs remain v11/v47; archived worker attempts are v3. Family launch CAS, model execution, and coordinator basis admission are the only session/job creation owners. Continue subtraction through the remaining single-caller runtime-spine surfaces; do not recreate deleted authority through registries, adapters, compatibility readers, or summary DTOs.
|
||||
|
||||
runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.
|
||||
|
||||
|
|
|
|||
Reference in a new issue