GameCult/Epiphany
Archived
Watch
9
0
Fork
You've already forked Epiphany
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Delete fictional Substrate Gate contracts

Browse source
This commit is contained in:
Meta Vens 2026-08-23 12:57:38 +02:00
commit 8c20f8960e
4 changed files with 53 additions and 213 deletions
Download patch file Download diff file Expand all files Collapse all files

10
epiphany-core/src/lib.rs
View file

@ -565,16 +565,6 @@ pub use state_ledger::load_state_ledger;
pub use state_ledger::state_ledger_status;
pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION;
pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE;
pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_SCHEMA_VERSION;
pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_TYPE;
pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REQUEST_SCHEMA_VERSION;
pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REQUEST_TYPE;
pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REVIEW_SCHEMA_VERSION;
pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REVIEW_TYPE;
pub use substrate_gate::SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_SCHEMA_VERSION;
pub use substrate_gate::SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_TYPE;
pub use substrate_gate::SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_SCHEMA_VERSION;
pub use substrate_gate::SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_TYPE;
pub use substrate_gate::SubstrateGateRepoAccessGrantReceipt;
pub use substrate_gate::substrate_gate_coordinator_implementation_grant;
pub use substrate_gate::substrate_gate_operation_for_governed_tool;

82
epiphany-core/src/runtime_spine.rs
View file

@ -58,16 +58,6 @@ use crate::state_ledger::STATE_LEDGER_SCHEMA_VERSION;
use crate::state_ledger::STATE_LEDGER_STORE_TYPE;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_SCHEMA_VERSION;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_TYPE;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REQUEST_SCHEMA_VERSION;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REQUEST_TYPE;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REVIEW_SCHEMA_VERSION;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REVIEW_TYPE;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_SCHEMA_VERSION;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_TYPE;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_SCHEMA_VERSION;
use crate::substrate_gate::SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_TYPE;
use crate::substrate_gate::SubstrateGateRepoAccessGrantReceipt;
use crate::{
DECISION_CONTEXT_SCHEMA_VERSION, DECISION_CONTEXT_TYPE, MIND_COMMIT_RECEIPT_SCHEMA_VERSION,
@ -13241,40 +13231,6 @@ fn epiphany_mutation_contracts() -> Vec<CultNetDocumentMutationContract> {
"CultNet exposes the receipt read-only and cannot impersonate the commit owner.",
],
),
mutation_contract(
SUBSTRATE_GATE_REPO_ACCESS_REQUEST_TYPE,
SUBSTRATE_GATE_REPO_ACCESS_REQUEST_SCHEMA_VERSION,
vec![
CultNetDocumentOperation::Snapshot,
CultNetDocumentOperation::IntentSubmit,
CultNetDocumentOperation::ReceiptWatch,
],
CultNetMutationAuthority::Coordinator,
vec![SUBSTRATE_GATE_REPO_ACCESS_REQUEST_TYPE],
vec![
SUBSTRATE_GATE_REPO_ACCESS_REVIEW_TYPE,
SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE,
SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_TYPE,
],
vec![
"Substrate Gate is the repository access protocol: reads, indexing, edits, commands, and bridge operations must be requested through this contract.",
"Hands mutates only after a scoped Substrate Gate grant; Eyes inspects only after a scoped Substrate Gate read/index grant.",
],
),
mutation_contract(
SUBSTRATE_GATE_REPO_ACCESS_REVIEW_TYPE,
SUBSTRATE_GATE_REPO_ACCESS_REVIEW_SCHEMA_VERSION,
vec![
CultNetDocumentOperation::Snapshot,
CultNetDocumentOperation::ReceiptWatch,
],
CultNetMutationAuthority::ReadOnly,
vec![],
vec![],
vec![
"Substrate Gate reviews explain granted/refused repo paths, operations, commands, and bridge surfaces.",
],
),
mutation_contract(
SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE,
SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION,
@ -13287,44 +13243,6 @@ fn epiphany_mutation_contracts() -> Vec<CultNetDocumentMutationContract> {
vec![],
vec!["A Substrate Gate grant receipt scopes a permitted repo touch."],
),
mutation_contract(
SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_TYPE,
SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_SCHEMA_VERSION,
vec![
CultNetDocumentOperation::Snapshot,
CultNetDocumentOperation::ReceiptWatch,
],
CultNetMutationAuthority::ReadOnly,
vec![],
vec![],
vec!["A Substrate Gate refusal receipt preserves why repo access was denied."],
),
mutation_contract(
SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_TYPE,
SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_SCHEMA_VERSION,
vec![
CultNetDocumentOperation::Snapshot,
CultNetDocumentOperation::ReceiptWatch,
],
CultNetMutationAuthority::ReadOnly,
vec![],
vec![],
vec!["Repo snapshots are evidence projections from Substrate-Gate-scoped access."],
),
mutation_contract(
SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_TYPE,
SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_SCHEMA_VERSION,
vec![
CultNetDocumentOperation::Snapshot,
CultNetDocumentOperation::ReceiptWatch,
],
CultNetMutationAuthority::ReadOnly,
vec![],
vec![],
vec![
"Repo mutation receipts prove Substrate Gate granted the substrate touch before Hands changed files or ran repo-affecting commands.",
],
),
mutation_contract(
EYES_SOURCE_LOOKUP_RECEIPT_TYPE,
EYES_SOURCE_LOOKUP_RECEIPT_SCHEMA_VERSION,

65
epiphany-core/src/substrate_gate.rs
View file

@ -1,29 +1,9 @@
use cultcache_rs::DatabaseEntry;
pub const SUBSTRATE_GATE_REPO_ACCESS_REQUEST_TYPE: &str =
"epiphany.substrate_gate.repo_access_request";
pub const SUBSTRATE_GATE_REPO_ACCESS_REVIEW_TYPE: &str =
"epiphany.substrate_gate.repo_access_review";
pub const SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE: &str =
"epiphany.substrate_gate.repo_access_grant_receipt";
pub const SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_TYPE: &str =
"epiphany.substrate_gate.repo_access_refusal_receipt";
pub const SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_TYPE: &str =
"epiphany.substrate_gate.repo_snapshot_receipt";
pub const SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_TYPE: &str =
"epiphany.substrate_gate.repo_mutation_receipt";
pub const SUBSTRATE_GATE_REPO_ACCESS_REQUEST_SCHEMA_VERSION: &str =
"epiphany.substrate_gate.repo_access_request.v0";
pub const SUBSTRATE_GATE_REPO_ACCESS_REVIEW_SCHEMA_VERSION: &str =
"epiphany.substrate_gate.repo_access_review.v0";
pub const SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION: &str =
"epiphany.substrate_gate.repo_access_grant_receipt.v0";
pub const SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_SCHEMA_VERSION: &str =
"epiphany.substrate_gate.repo_access_refusal_receipt.v0";
pub const SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_SCHEMA_VERSION: &str =
"epiphany.substrate_gate.repo_snapshot_receipt.v0";
pub const SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_SCHEMA_VERSION: &str =
"epiphany.substrate_gate.repo_mutation_receipt.v0";
pub const SUBSTRATE_GATE_SOURCE_READ_OPERATION: &str = "read";
pub const SUBSTRATE_GATE_PUBLIC_SOURCE_READ_OPERATION: &str = "publicSourceRead";
@ -153,27 +133,6 @@ pub fn substrate_gate_coordinator_implementation_grant(
mod tests {
use super::*;
#[test]
fn substrate_gate_grant_for_worker_is_read_only() {
let grant = substrate_gate_repo_access_grant_for_worker(
"grant-1".to_string(),
"job-1".to_string(),
"research-source-gather-worker".to_string(),
"epiphany-eyes".to_string(),
"epiphany.role.research".to_string(),
true,
"2026-05-30T00:00:00Z".to_string(),
);
assert!(grant.granted_operations.contains(&"read".to_string()));
assert!(
grant
.granted_operations
.contains(&"publicSourceRead".to_string())
);
assert!(!grant.granted_operations.contains(&"write".to_string()));
assert!(grant.contract.contains("mutation remains forbidden"));
}
#[test]
fn governed_tools_map_to_fixed_grant_operations() {
assert_eq!(
@ -189,28 +148,4 @@ mod tests {
None
);
}
#[test]
fn repo_work_and_implementation_grants_have_fixed_policies() {
let planning = substrate_gate_repo_work_planning_grant(
"planning-grant".to_string(),
"planning-job".to_string(),
vec!["README.md".to_string()],
"2026-07-12T00:00:00Z".to_string(),
);
assert_eq!(planning.binding_id, "repo-work-runner");
assert_eq!(planning.granted_operations, vec!["read", "snapshot"]);
let implementation = substrate_gate_coordinator_implementation_grant(
"implementation-grant".to_string(),
"implementation-job".to_string(),
vec!["src".to_string()],
"2026-07-12T00:00:00Z".to_string(),
);
assert_eq!(implementation.binding_id, "implementation-worker");
assert_eq!(
implementation.granted_operations,
vec!["read", "snapshot", "patch", "command", "commit"]
);
}
}

105
notes/substrate-gate-cultnet-contracts.md
View file

@ -1,63 +1,60 @@
# Substrate Gate CultNet Contracts
# Substrate Gate CultNet Contract
Objective: make the Substrate Gate the repository access protocol. Body is the
substrate itself, not a gatekeeper persona and not the modeling organ. Organs
may request reads, indexing, commands, edits, and bridge operations, but the
Substrate Gate decides the scoped access to the repo.
Objective: make repository access explicit without turning Substrate Gate into a
second workflow, decision, or state-admission system. Body is the substrate;
Substrate Gate owns only the exact grant that lets a named runtime job touch a
bounded part of that substrate.
## Authority Map
- Owner: the Substrate Gate protocol owns repository access grants and refusals.
- Inputs: typed repo access requests, workspace identity, requested paths,
requested operations, command/bridge intent, current repo policy, coordinator
authority, operator approvals, and relevant safety/evidence context.
- Outputs: Substrate Gate access reviews, access grant receipts, access refusal
receipts, repo snapshot receipts, and repo mutation receipts.
- Derived state: retrieved snippets, search hits, index manifests, diffs, build
logs, provider-owned editor receipts, and source maps are evidence
projections, not permission to touch more substrate. Brokkr owns Unity editor
capabilities through CultMesh/Eve; a future Rider daemon owns Rider
capabilities through the same provider boundary.
- Forbidden writers/readers: Hands, Eyes, Persona, public Verse ingress, raw worker
launches, compatibility JSON-RPC routes, and bridge tools must not directly
read, index, execute against, or mutate the repo without a scoped Substrate
Gate grant.
- Shared path: source reads, semantic indexing, file edits, command execution,
and requests to provider-owned editor/runtime capabilities should all be
expressible as Substrate-Gate-scoped repo access requests with receipts.
- Deletion line: worker launch `authority_scope` is not repo access authority.
It may describe role/task scope, but the Substrate Gate must grant substrate
access.
- Owner: the concrete family invariant owner constructs and persists one
`SubstrateGateRepoAccessGrantReceipt` for an authenticated runtime job.
- Inputs: runtime job, worker binding, role, authority scope, fixed permitted
operations, bounded paths, and grant time.
- Output: one immutable grant receipt. Runtime validators correlate its exact
identity and envelope with the launch, tool intent, Hands intent/review, and
consequence that consumes it.
- Derived state: source lookup receipts, Body observations, Hands patch/command/
commit receipts, provider-owned editor receipts, and CultNet views report
consequences. They do not create access authority.
- Forbidden writers: models, tools, CultNet clients, and provider daemons cannot
author an Epiphany grant. A model cannot widen the paths or operations in a
persisted grant.
- Shared paths: governed source tools and Hands consequences reach their
family-specific validators through the same exact grant identity.
- Cut line: launch `authority_scope` is descriptive until bound to a persisted
grant. Substrate Gate does not own workflow requests, reviews, refusals,
snapshots, mutations, evidence admission, or Mind commits.
## Contract Families
## Contract Family
- `epiphany.substrate_gate.repo_access_request`: request for scoped repository
access.
- `epiphany.substrate_gate.repo_access_review`: Substrate Gate decision and scope
explanation.
- `epiphany.substrate_gate.repo_access_grant_receipt`: proof of scoped access.
- `epiphany.substrate_gate.repo_access_refusal_receipt`: proof of refusal.
- `epiphany.substrate_gate.repo_snapshot_receipt`: proof of source
inspection/indexing performed under Substrate Gate access.
- `epiphany.substrate_gate.repo_mutation_receipt`: proof that mutation or
repo-affecting command execution had a prior Substrate Gate grant.
- `epiphany.substrate_gate.repo_access_grant_receipt`: the sole Substrate Gate
document. CultNet advertises it read-only.
There is no generic access-request protocol. Family owners derive required
access from typed current work and either issue an exact grant or refuse the
operation directly. There is no generic snapshot or mutation receipt: Eyes
source receipts and Hands consequence receipts already own those facts.
## Organ Boundaries
Mind decides whether typed observations and decisions enter durable state.
Substrate Gate decides only whether a particular runtime job may touch bounded
repository substrate. Neither is an alias for the other.
Modeling may consume typed Body observations and exact RepoModel documents
directly. Eyes is involved when a claim needs evidence outside the Body; it is
not a mandatory preprocessor for Modeling. Hands consumes an adopted action
route plus an exact grant, then emits the consequence receipt Soul verifies.
Editor integration remains provider-owned. Brokkr owns Unity inspection and
actuation over Eve/CultMesh. A future Rider daemon owns Rider. Epiphany carries
no embedded Unity or Rider command organ and cannot manufacture provider
receipts on either daemon's behalf.
## Verse Boundary
Substrate Gate access contracts live in `epiphany-internal`. Operator-safe
projections may appear in `gamecult-local` after review, but raw repo access
requests, private paths, command cargo, diffs, and mutation receipts stay
internal unless another explicit export policy says otherwise.
`epiphany-global` never gains repository access authority.
Mind and the Substrate Gate are neighboring protocols, not aliases. The
Substrate Gate decides whether the machine may touch the repo. Mind decides
whether resulting thought or evidence mutates persistent state.
Imagination can project Body substrate facts into a Persona scene only after those facts have
entered through Substrate-Gate-scoped access. A beautiful scene is not a repo
access grant. Eyes is the next gate after access: a Substrate Gate grant allows
looking, but only Eyes can turn looked-at material into a citable evidence
packet. Modeling may update the machine's internal body model only from
source-grounded material that has passed through the appropriate access and
evidence path.
The grant remains private runtime state. CultNet may project its typed contract
and operator-safe receipt view, but cannot submit or widen grants. Provider
capabilities are discovered through CultMesh; discovery does not grant local
repository access or Mind admission.