Forward service lifecycle action artifacts

epiphany-core/src/bin/epiphany-verse-query.rs

@@ -2437,10 +2437,20 @@ fn main() -> Result<()> {
                     row.priority == 40
                         && row.family == "service-lifecycle"
                         && row.effect_class == "service-lifecycle-readback"
+                        && row.operator_artifact_ref
+                            == "smoke://verse-query/cluster-windows-service-execution-audit"
+                        && row.operator_artifact_status == "external-ref"
+                        && row.operator_artifact_sha256 == "none"
                         && !row.mutates_state
                         && !row.requires_elevated_authority
                         && !row.private_state_exposed
                 })
+                || !service_overview.swarm_action_tui_rows.iter().any(|row| {
+                    row.contains("service-lifecycle")
+                        && row.contains("artifact=external-ref")
+                        && row.contains("sha256=none")
+                        && row.contains("audit=none")
+                })
                 || !service_overview.swarm_action_rows.iter().any(|row| {
                     row.priority == 50
                         && row.family == "service-execution-authority"
@@ -2563,6 +2573,7 @@ fn main() -> Result<()> {
                 "ready",
                 &[],
                 &ready_policy_report,
+                None,
                 "epiphany-verse-query receipt-directory cluster-service-lifecycle follow-up",
                 "cluster-service-execution-audit",
                 WRAPPER_CLUSTER_SERVICE_EXECUTION_AUDIT_COMMAND,
@@ -3392,6 +3403,7 @@ fn swarm_action_rows(
     liveness_status: &str,
     tool_host_attention_rows: &[DaemonToolDirectoryRow],
     policy_report: &DaemonRestartPolicyDirectoryReport,
+    service_lifecycle_attention_row: Option<&ReceiptDirectoryRow>,
     service_lifecycle_recommended_action: &str,
     service_lifecycle_recommended_wrapper_mode: &str,
     service_lifecycle_recommended_wrapper_command: &str,
@@ -3482,6 +3494,26 @@ fn swarm_action_rows(
         });
     }
     if service_lifecycle_recommended_wrapper_mode != "none" {
+        let (
+            operator_artifact_ref,
+            operator_artifact_status,
+            operator_artifact_sha256,
+            private_state_exposed,
+        ) = if let Some(row) = service_lifecycle_attention_row {
+            (
+                row.artifact_ref.clone(),
+                row.artifact_status.clone(),
+                row.artifact_sha256.clone(),
+                row.private_state_exposed,
+            )
+        } else {
+            (
+                "none".to_string(),
+                "none".to_string(),
+                "none".to_string(),
+                false,
+            )
+        };
         rows.push(SwarmActionRow {
             priority: 40,
             family: "service-lifecycle".to_string(),
@@ -3489,9 +3521,9 @@ fn swarm_action_rows(
             action: service_lifecycle_recommended_action.to_string(),
             wrapper_mode: service_lifecycle_recommended_wrapper_mode.to_string(),
             wrapper_command: service_lifecycle_recommended_wrapper_command.to_string(),
-            operator_artifact_ref: "none".to_string(),
-            operator_artifact_status: "none".to_string(),
-            operator_artifact_sha256: "none".to_string(),
+            operator_artifact_ref,
+            operator_artifact_status,
+            operator_artifact_sha256,
             operator_artifact_execution_command: "none".to_string(),
             operator_aftercare_command: "none".to_string(),
             completion_audit_wrapper_mode: "none".to_string(),
@@ -3501,7 +3533,7 @@ fn swarm_action_rows(
             mutates_state: false,
             requires_elevated_authority: false,
             reason: "Windows service lifecycle receipts need readback/audit before the daemon swarm can be called service-ready.".to_string(),
-            private_state_exposed: false,
+            private_state_exposed,
         });
     }
     if let Some(runbook_row) = service_execution_runbook_row {
@@ -4046,10 +4078,13 @@ fn load_swarm_overview_report(args: &Args) -> Result<SwarmOverviewReport> {
         &service_lifecycle_rows,
         &service_lifecycle_recommended_wrapper_mode,
     );
+    let service_lifecycle_attention_row =
+        cluster_service_lifecycle_attention.or(service_lifecycle_attention);
     let (swarm_action_rows, swarm_action_tui_rows) = swarm_action_rows(
         &liveness_status,
         &tool_host_attention_rows,
         &policy_report,
+        service_lifecycle_attention_row,
         &service_lifecycle_recommended_action,
         &service_lifecycle_recommended_wrapper_mode,
         &service_lifecycle_recommended_wrapper_command,

notes/fresh-workspace-handoff.md

@@ -68,6 +68,7 @@ remembers doctrine; the branch remembers the blade.
 - Receipt directory rows now classify and hash their artifact refs. `ReceiptDirectoryRow` includes `artifactStatus` plus `artifactSha256`, receipt TUI rows append `artifact=<status> | sha256=<digest-or-none>`, and wrapper `receipt-directory` prints compact `artifactHashes=<family>:<sha256>; ...` for present local artifacts. Fresh smoke guards present-artifact SHA-256 in receipt-directory JSON/TUI; live wrapper artifacts `local-20260618-165005-139-6188fe30` and `local-20260618-165319-478-e929d2bd` prove the cluster execution runbook hash `3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`, the per-service execution runbook hash `b213a3c11a8f11a03061fcd743f507edaa59bc6767257b79cef63329596375e7`, and non-artifact rows `artifactSha256=none`.
 - `epiphany-verse-query receipt-directory` still derives compact artifact status counts: `artifactNoneCount`, `artifactExternalRefCount`, `artifactPresentCount`, and `artifactMissingCount`. Live readback reports `artifactNone=13`, `artifactExternalRef=2`, `artifactPresent=2`, `artifactMissing=0`, and `privateStateExposed=false`. A clean direct empty-store readback reported all 17 rows as `artifactNone`. The earlier all-in-one `epiphany-verse-query smoke` Windows stack overflow was fixed by cutting full `query_epiphany_local_verse_context` out of `load_swarm_overview_report`; overview now reads daemon service lifecycle rows through narrow history/latest loaders.
 - Wrapper `swarm-overview` and `swarm-triage` one-line summaries now forward Rust-owned compact TUI row families as `actionRows`, `daemonRows`, `toolRows` where present, `policyRows` where present, `toolAttentionRows`, `serviceAttentionRows`, and `serviceFailedCheckRows` instead of rebuilding the global sight surface in PowerShell. The older compatibility summaries still include service lifecycle receipt `artifactStatus`, local runbook `sha256`, operator aftercare, and compact `serviceExecutionFailedChecks`. Live artifacts `local-20260618-210646-478-88b58f07` and `local-20260618-210646-474-2fb504ff` show seven READY daemon rows, sixteen globally invokable receipt-gated tool rows, seven enabled restart-policy rows, two ordered service action rows, two service lifecycle attention rows, five sealed failed service-execution check rows, and `privateStateExposed=false`.
+- 2026-06-18: `swarm-overview` action rows now forward sealed artifact witness data from the selected service-lifecycle attention receipt. The non-mutating priority-40 readback row carries the service-manager artifact ref/status/hash/private flag instead of saying `artifact=none`; live wrapper proof `local-20260618-213553-947-eb284491` printed `artifactStatus=external-ref`, `sha256=none`, and `artifact=service-manager://windows/epiphany-cluster-daemon-services/cluster-execution-readiness` for that row while keeping `mutates=False`, `elevated=False`, and the priority-50 elevated runbook row unchanged.
 - Full service lifecycle history now excludes the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror entry. Latest remains readable through the dedicated latest loader; history contains only real per-receipt events. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two writes load as exactly two history receipts while latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage artifacts `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove the compact swarm sights still report service lifecycle attention and the present elevated runbook artifact without daemon pokes or service mutation. A broad unscoped `cargo test service_lifecycle_receipt_history_excludes_latest_mirror` was abandoned after the Windows test harness fanned out across bin targets and hit a broken pipe; use `cargo test --lib service_lifecycle_receipt_history_excludes_latest_mirror` for this check.
 - The operator snapshot distills typed fields such as thread id, state status, coordinator action, CRRC action, reorient action, available actions, and artifact refs; it does not preserve the raw JSON status blob as internal state. JSON remains display/evidence at the edge.
 - Local MVP Persona front-door bubbles now route their `epiphany.cultmesh.persona_speech_audit.v0` witness into the same `.epiphany-run/cultmesh/local-verse.ccmp` store and write a final `local-verse-context.json` for MVP mode too. `Persona-bubble.stdout.json` remains display; the local Verse carries the mouth-edge eligibility receipt.

state/map.yaml

@@ -622,7 +622,7 @@ current_status:
   - `epiphany-verse-query swarm-triage` and `tools/epiphany_local_run.ps1 -Mode swarm-triage` compose the compact swarm overview with the existing brake-aware daemon poke receipt writer. Triage pokes only daemon liveness attention; service-manager lifecycle wounds are reflected from overview as sealed `serviceLifecycleAttentionRows`/TUI rows, `serviceExecutionFailedCheckRows`/TUI rows, explicit `serviceLifecycleRecommended*` fields, and ordered `swarmActionRows`, but do not cause daemon poke receipts, while blocked daemon-hosted tools ride as sealed `toolHostAttentionRows`/TUI rows so agents can see which advertised capabilities are unavailable because their host body is sick. Current live triage `local-20260618-150015-844-aba20563` returns `status=noop`, `overviewStatus=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `clusterCount=7`, `privateVerseCount=7`, `pokedDaemonCount=0`, `recommendedWrapperMode=cluster-service-execution-audit`, `serviceLifecycleRecommendedWrapperMode=cluster-service-execution-audit`, `swarmActionCount=2`, the same sealed service readback plus operator-elevated runbook rows, including `operatorArtifactStatus=present`, `operatorArtifactRef=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-132257-139-26213a29\epiphany-cluster-daemon-services-execution-runbook.ps1`, and `completionAuditWrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit` on the elevated row, empty daemon/tool-host attention arrays, `serviceLifecycleAttentionCount=2`, routes `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit` and `epiphany-daemon-supervisor-service::windows-service-execution-audit`, direct and wrapper command hints including `wrapperInvokeTool` and `wrapperBifrostLedger=tools/epiphany_local_run.ps1 -Mode bifrost-ledger`, and `privateStateExposed=false`; degraded Hands proof returns `status=ok`, `overviewStatus=attention`, topology and daemon TUI rows, blocked Hands-hosted tool rows, one sealed topology-aware poke receipt for `epiphany-daemon-hands` with `bodyDomain=repo:E:/Projects/EpiphanyAgent`, `privateVerseId=epiphany.cluster.hands.private`, `eveSurfaceId=eve://epiphany/hands`, `observedStatus=degraded`, `attentionDaemonIds=[epiphany-daemon-hands]`, `attentionToolHostDaemonIds=[epiphany-daemon-hands]`, and liveness/tool-host action rows with no private-state exposure. Source smoke `verse-query-service-execution-failed-checks-clean` proves a physical synthetic written runbook plus incomplete service audit receipts expose both service lifecycle readback and failed-check anatomy with no Windows service mutation.
   - Compact `swarmActionTuiRows` now match the JSON service-execution queue including local runbook SHA-256 provenance: live artifact `local-20260618-164403-238-dba797ce` shows `050 | service-execution-authority | operator-authority-required | operator-elevated-runbook | operator.elevated_windows_service_control | mutates=true | elevated=true | artifact=present | sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0 | audit=cluster-service-execution-audit`, while the readback row stays `artifact=none | sha256=none | audit=none`. Source smoke `verse-query-action-tui-audit-smoke` guards this agent-friendly TUI surface.
   - Receipt directory rows now carry `artifactStatus` and `artifactSha256` beside `artifactRef`, using the same `none` / `external-ref` / `present` / `missing` vocabulary as action rows and hashing present local artifacts at the receipt-directory layer. Live wrapper artifact `local-20260618-165005-139-6188fe30` proves the cluster service execution runbook row reports `artifactStatus=present`, `artifactSha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`, and TUI `artifact=present | sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`; the per-service execution runbook row reports `artifactSha256=b213a3c11a8f11a03061fcd743f507edaa59bc6767257b79cef63329596375e7`; non-artifact rows report `artifactSha256=none`. Wrapper proof `local-20260618-165319-478-e929d2bd` also prints compact `artifactHashes=cluster-service-execution-runbook:3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0; service-execution-runbook:b213a3c11a8f11a03061fcd743f507edaa59bc6767257b79cef63329596375e7` in the one-line receipt-directory summary. Source smoke guards present-artifact SHA-256 in receipt-directory JSON/TUI, action-row SHA-256, missing-artifact demotion, and failed-check anatomy. `epiphany-verse-query receipt-directory` also derives compact artifact counts (`artifactNoneCount`, `artifactExternalRefCount`, `artifactPresentCount`, `artifactMissingCount`) from rows instead of storing a second truth. Live readback reports `artifactNone=13`, `artifactExternalRef=2`, `artifactPresent=2`, `artifactMissing=0`, and `privateStateExposed=false`; a clean direct empty-store readback reported all 17 rows as `artifactNone`. The earlier all-in-one `epiphany-verse-query smoke` Windows stack overflow was fixed by cutting full `query_epiphany_local_verse_context` out of `load_swarm_overview_report`; overview now reads daemon service lifecycle rows through narrow history/latest loaders.
-  - Wrapper `swarm-overview` and `swarm-triage` summaries now forward the Rust-owned compact TUI row families instead of rebuilding the global sight surface in PowerShell: `actionRows`, `daemonRows`, `toolRows` where present, `policyRows` where present, `toolAttentionRows`, `serviceAttentionRows`, and `serviceFailedCheckRows`. The older compatibility summaries still surface lifecycle receipt `artifactStatus`, local runbook `sha256`, operator aftercare command, and compact service execution failed-check anatomy. Live artifacts `local-20260618-210646-478-88b58f07` and `local-20260618-210646-474-2fb504ff` prove overview/triage print seven READY daemon rows, sixteen globally invokable receipt-gated tool rows, seven enabled restart-policy rows, two ordered service action rows, two service lifecycle attention rows, five sealed failed service-execution check rows, and `privateStateExposed=false`.
+  - Wrapper `swarm-overview` and `swarm-triage` summaries now forward the Rust-owned compact TUI row families instead of rebuilding the global sight surface in PowerShell: `actionRows`, `daemonRows`, `toolRows` where present, `policyRows` where present, `toolAttentionRows`, `serviceAttentionRows`, and `serviceFailedCheckRows`. The older compatibility summaries still surface lifecycle receipt `artifactStatus`, local runbook `sha256`, operator aftercare command, and compact service execution failed-check anatomy. Live artifacts `local-20260618-210646-478-88b58f07` and `local-20260618-210646-474-2fb504ff` prove overview/triage print seven READY daemon rows, sixteen globally invokable receipt-gated tool rows, seven enabled restart-policy rows, two ordered service action rows, two service lifecycle attention rows, five sealed failed service-execution check rows, and `privateStateExposed=false`. The Rust-owned action queue now forwards sealed artifact witness data from the selected service-lifecycle attention receipt too: live wrapper proof `local-20260618-213553-947-eb284491` printed the priority-40 non-mutating readback row with `artifactStatus=external-ref`, `sha256=none`, and `artifact=service-manager://windows/epiphany-cluster-daemon-services/cluster-execution-readiness` instead of `artifact=none`, while leaving the priority-50 elevated runbook authority row unchanged.
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   next_action: Continue the swarm-readiness cuts toward elevated operator install/start execution and completed audit/readiness for the seven installed services. Run generated service execution/install/control runbooks only when the operator grants that authority. The current local Verse proves liveness readiness, scheduler-policy coverage, daemon-body invocation, per-organ launch artifact generation, per-organ install-plan generation, non-elevated install/start/stop execution refusal, read-only installed-service audit, cluster-wide service control planning, service-lifecycle attention surfacing, and cluster execution audit acceptance criteria: `swarm-overview` now reports `status=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, and `recommendedWrapperMode=cluster-service-execution-audit`; `service-tick` can refresh all seven daemon heartbeats through sealed scheduler receipts; `cluster-service-runbook` writes seven explicit `epiphany-cluster-daemon serve` commands with `privateStateExposed=false`; `cluster-service-install-plan` writes seven distinct Windows service install commands with `privateStateExposed=false`; `cluster-service-install-execute`, `cluster-service-start-execute`, and `cluster-service-stop-execute` refuse as `execution-refused-not-elevated` with `executed=false` when the shell lacks service authority; `cluster-service-start-plan` and `cluster-service-stop-plan` emit seven non-mutating planned rows; `cluster-service-audit` currently reports `incomplete` with seven missing services in this non-installed environment; `service-execution-runbook` and `cluster-service-execution-runbook` write elevated wrapper sequences that continue after per-step failure, run final audits in `finally`, exit nonzero after audit when any step failed, and seal typed runbook receipts with aftercare args (`stepFailurePolicy`, `continueAfterStepFailure`, `nonzeroExitFailsStep`, `exitsNonzeroAfterFinalAudit`); and `service-execution-audit` plus `cluster-service-execution-audit` now require those runbook witnesses before considering elevated-ready/install/start/audit/status/reconcile/stop effect receipts. Preserve the existing typed local Verse surfaces: `service-plan`, `service-launch`, `service-runbook`, `cluster-service-runbook`, `cluster-service-install-plan`, `cluster-service-install-execute`, `cluster-service-audit`, `cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, `cluster-service-stop-execute`, `cluster-service-execution-readiness`, `cluster-service-execution-runbook`, `cluster-service-execution-audit`, `service-execution-runbook`, `service-execution-audit`, `service-tick`, `service-policy-directory`, `agent-state-soa`, `swarm-status`, `swarm-poke-down`, `swarm-triage`, `cluster-topology`, `eve-surfaces`, `eve-connect`, `collaboration-feedback`, `bifrost-publication`, `bifrost-ledger`, `receipt-directory`, `tool-directory`, `tool-invoke`, `swarm-overview`, `seed-compact`, service manager status/reconcile/readiness/control wrappers, compact daemon scheduler/policy receipt rows, daemon liveness-gated tool routing, Bifrost/Imagination chains, coordinator-run receipts, Hands gates, role review mirrors, and sealed agent-state SoA summary. Keep the seven-standing-faculty SoA, stale-turn repair, memory lifecycle, shared local Verse witnesses, and typed CultMesh Persona speech gate intact.