From 8c20f8960ede6d8ffd2302237369c4d72abb1ac8 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 23 Aug 2026 12:57:38 +0200 Subject: [PATCH] Delete fictional Substrate Gate contracts --- epiphany-core/src/lib.rs | 10 --- epiphany-core/src/runtime_spine.rs | 82 ----------------- epiphany-core/src/substrate_gate.rs | 65 -------------- notes/substrate-gate-cultnet-contracts.md | 105 +++++++++++----------- 4 files changed, 51 insertions(+), 211 deletions(-) diff --git a/epiphany-core/src/lib.rs b/epiphany-core/src/lib.rs index f75124d9..81895863 100644 --- a/epiphany-core/src/lib.rs +++ b/epiphany-core/src/lib.rs @@ -565,16 +565,6 @@ pub use state_ledger::load_state_ledger; pub use state_ledger::state_ledger_status; pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION; pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE; -pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_SCHEMA_VERSION; -pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_TYPE; -pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REQUEST_SCHEMA_VERSION; -pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REQUEST_TYPE; -pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REVIEW_SCHEMA_VERSION; -pub use substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REVIEW_TYPE; -pub use substrate_gate::SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_SCHEMA_VERSION; -pub use substrate_gate::SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_TYPE; -pub use substrate_gate::SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_SCHEMA_VERSION; -pub use substrate_gate::SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_TYPE; pub use substrate_gate::SubstrateGateRepoAccessGrantReceipt; pub use substrate_gate::substrate_gate_coordinator_implementation_grant; pub use substrate_gate::substrate_gate_operation_for_governed_tool; diff --git a/epiphany-core/src/runtime_spine.rs b/epiphany-core/src/runtime_spine.rs index 92adb4d5..2063bf17 100644 --- a/epiphany-core/src/runtime_spine.rs +++ b/epiphany-core/src/runtime_spine.rs @@ -58,16 +58,6 @@ use crate::state_ledger::STATE_LEDGER_SCHEMA_VERSION; use crate::state_ledger::STATE_LEDGER_STORE_TYPE; use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION; use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE; -use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_SCHEMA_VERSION; -use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_TYPE; -use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REQUEST_SCHEMA_VERSION; -use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REQUEST_TYPE; -use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REVIEW_SCHEMA_VERSION; -use crate::substrate_gate::SUBSTRATE_GATE_REPO_ACCESS_REVIEW_TYPE; -use crate::substrate_gate::SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_SCHEMA_VERSION; -use crate::substrate_gate::SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_TYPE; -use crate::substrate_gate::SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_SCHEMA_VERSION; -use crate::substrate_gate::SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_TYPE; use crate::substrate_gate::SubstrateGateRepoAccessGrantReceipt; use crate::{ DECISION_CONTEXT_SCHEMA_VERSION, DECISION_CONTEXT_TYPE, MIND_COMMIT_RECEIPT_SCHEMA_VERSION, @@ -13241,40 +13231,6 @@ fn epiphany_mutation_contracts() -> Vec { "CultNet exposes the receipt read-only and cannot impersonate the commit owner.", ], ), - mutation_contract( - SUBSTRATE_GATE_REPO_ACCESS_REQUEST_TYPE, - SUBSTRATE_GATE_REPO_ACCESS_REQUEST_SCHEMA_VERSION, - vec![ - CultNetDocumentOperation::Snapshot, - CultNetDocumentOperation::IntentSubmit, - CultNetDocumentOperation::ReceiptWatch, - ], - CultNetMutationAuthority::Coordinator, - vec![SUBSTRATE_GATE_REPO_ACCESS_REQUEST_TYPE], - vec![ - SUBSTRATE_GATE_REPO_ACCESS_REVIEW_TYPE, - SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE, - SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_TYPE, - ], - vec![ - "Substrate Gate is the repository access protocol: reads, indexing, edits, commands, and bridge operations must be requested through this contract.", - "Hands mutates only after a scoped Substrate Gate grant; Eyes inspects only after a scoped Substrate Gate read/index grant.", - ], - ), - mutation_contract( - SUBSTRATE_GATE_REPO_ACCESS_REVIEW_TYPE, - SUBSTRATE_GATE_REPO_ACCESS_REVIEW_SCHEMA_VERSION, - vec![ - CultNetDocumentOperation::Snapshot, - CultNetDocumentOperation::ReceiptWatch, - ], - CultNetMutationAuthority::ReadOnly, - vec![], - vec![], - vec![ - "Substrate Gate reviews explain granted/refused repo paths, operations, commands, and bridge surfaces.", - ], - ), mutation_contract( SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE, SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION, @@ -13287,44 +13243,6 @@ fn epiphany_mutation_contracts() -> Vec { vec![], vec!["A Substrate Gate grant receipt scopes a permitted repo touch."], ), - mutation_contract( - SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_TYPE, - SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_SCHEMA_VERSION, - vec![ - CultNetDocumentOperation::Snapshot, - CultNetDocumentOperation::ReceiptWatch, - ], - CultNetMutationAuthority::ReadOnly, - vec![], - vec![], - vec!["A Substrate Gate refusal receipt preserves why repo access was denied."], - ), - mutation_contract( - SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_TYPE, - SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_SCHEMA_VERSION, - vec![ - CultNetDocumentOperation::Snapshot, - CultNetDocumentOperation::ReceiptWatch, - ], - CultNetMutationAuthority::ReadOnly, - vec![], - vec![], - vec!["Repo snapshots are evidence projections from Substrate-Gate-scoped access."], - ), - mutation_contract( - SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_TYPE, - SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_SCHEMA_VERSION, - vec![ - CultNetDocumentOperation::Snapshot, - CultNetDocumentOperation::ReceiptWatch, - ], - CultNetMutationAuthority::ReadOnly, - vec![], - vec![], - vec![ - "Repo mutation receipts prove Substrate Gate granted the substrate touch before Hands changed files or ran repo-affecting commands.", - ], - ), mutation_contract( EYES_SOURCE_LOOKUP_RECEIPT_TYPE, EYES_SOURCE_LOOKUP_RECEIPT_SCHEMA_VERSION, diff --git a/epiphany-core/src/substrate_gate.rs b/epiphany-core/src/substrate_gate.rs index 95e23dc3..7e5feb00 100644 --- a/epiphany-core/src/substrate_gate.rs +++ b/epiphany-core/src/substrate_gate.rs @@ -1,29 +1,9 @@ use cultcache_rs::DatabaseEntry; -pub const SUBSTRATE_GATE_REPO_ACCESS_REQUEST_TYPE: &str = - "epiphany.substrate_gate.repo_access_request"; -pub const SUBSTRATE_GATE_REPO_ACCESS_REVIEW_TYPE: &str = - "epiphany.substrate_gate.repo_access_review"; pub const SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_TYPE: &str = "epiphany.substrate_gate.repo_access_grant_receipt"; -pub const SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_TYPE: &str = - "epiphany.substrate_gate.repo_access_refusal_receipt"; -pub const SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_TYPE: &str = - "epiphany.substrate_gate.repo_snapshot_receipt"; -pub const SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_TYPE: &str = - "epiphany.substrate_gate.repo_mutation_receipt"; -pub const SUBSTRATE_GATE_REPO_ACCESS_REQUEST_SCHEMA_VERSION: &str = - "epiphany.substrate_gate.repo_access_request.v0"; -pub const SUBSTRATE_GATE_REPO_ACCESS_REVIEW_SCHEMA_VERSION: &str = - "epiphany.substrate_gate.repo_access_review.v0"; pub const SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION: &str = "epiphany.substrate_gate.repo_access_grant_receipt.v0"; -pub const SUBSTRATE_GATE_REPO_ACCESS_REFUSAL_RECEIPT_SCHEMA_VERSION: &str = - "epiphany.substrate_gate.repo_access_refusal_receipt.v0"; -pub const SUBSTRATE_GATE_REPO_SNAPSHOT_RECEIPT_SCHEMA_VERSION: &str = - "epiphany.substrate_gate.repo_snapshot_receipt.v0"; -pub const SUBSTRATE_GATE_REPO_MUTATION_RECEIPT_SCHEMA_VERSION: &str = - "epiphany.substrate_gate.repo_mutation_receipt.v0"; pub const SUBSTRATE_GATE_SOURCE_READ_OPERATION: &str = "read"; pub const SUBSTRATE_GATE_PUBLIC_SOURCE_READ_OPERATION: &str = "publicSourceRead"; @@ -153,27 +133,6 @@ pub fn substrate_gate_coordinator_implementation_grant( mod tests { use super::*; - #[test] - fn substrate_gate_grant_for_worker_is_read_only() { - let grant = substrate_gate_repo_access_grant_for_worker( - "grant-1".to_string(), - "job-1".to_string(), - "research-source-gather-worker".to_string(), - "epiphany-eyes".to_string(), - "epiphany.role.research".to_string(), - true, - "2026-05-30T00:00:00Z".to_string(), - ); - assert!(grant.granted_operations.contains(&"read".to_string())); - assert!( - grant - .granted_operations - .contains(&"publicSourceRead".to_string()) - ); - assert!(!grant.granted_operations.contains(&"write".to_string())); - assert!(grant.contract.contains("mutation remains forbidden")); - } - #[test] fn governed_tools_map_to_fixed_grant_operations() { assert_eq!( @@ -189,28 +148,4 @@ mod tests { None ); } - - #[test] - fn repo_work_and_implementation_grants_have_fixed_policies() { - let planning = substrate_gate_repo_work_planning_grant( - "planning-grant".to_string(), - "planning-job".to_string(), - vec!["README.md".to_string()], - "2026-07-12T00:00:00Z".to_string(), - ); - assert_eq!(planning.binding_id, "repo-work-runner"); - assert_eq!(planning.granted_operations, vec!["read", "snapshot"]); - - let implementation = substrate_gate_coordinator_implementation_grant( - "implementation-grant".to_string(), - "implementation-job".to_string(), - vec!["src".to_string()], - "2026-07-12T00:00:00Z".to_string(), - ); - assert_eq!(implementation.binding_id, "implementation-worker"); - assert_eq!( - implementation.granted_operations, - vec!["read", "snapshot", "patch", "command", "commit"] - ); - } } diff --git a/notes/substrate-gate-cultnet-contracts.md b/notes/substrate-gate-cultnet-contracts.md index 846912f5..dac3c578 100644 --- a/notes/substrate-gate-cultnet-contracts.md +++ b/notes/substrate-gate-cultnet-contracts.md @@ -1,63 +1,60 @@ -# Substrate Gate CultNet Contracts +# Substrate Gate CultNet Contract -Objective: make the Substrate Gate the repository access protocol. Body is the -substrate itself, not a gatekeeper persona and not the modeling organ. Organs -may request reads, indexing, commands, edits, and bridge operations, but the -Substrate Gate decides the scoped access to the repo. +Objective: make repository access explicit without turning Substrate Gate into a +second workflow, decision, or state-admission system. Body is the substrate; +Substrate Gate owns only the exact grant that lets a named runtime job touch a +bounded part of that substrate. ## Authority Map -- Owner: the Substrate Gate protocol owns repository access grants and refusals. -- Inputs: typed repo access requests, workspace identity, requested paths, - requested operations, command/bridge intent, current repo policy, coordinator - authority, operator approvals, and relevant safety/evidence context. -- Outputs: Substrate Gate access reviews, access grant receipts, access refusal - receipts, repo snapshot receipts, and repo mutation receipts. -- Derived state: retrieved snippets, search hits, index manifests, diffs, build - logs, provider-owned editor receipts, and source maps are evidence - projections, not permission to touch more substrate. Brokkr owns Unity editor - capabilities through CultMesh/Eve; a future Rider daemon owns Rider - capabilities through the same provider boundary. -- Forbidden writers/readers: Hands, Eyes, Persona, public Verse ingress, raw worker - launches, compatibility JSON-RPC routes, and bridge tools must not directly - read, index, execute against, or mutate the repo without a scoped Substrate - Gate grant. -- Shared path: source reads, semantic indexing, file edits, command execution, - and requests to provider-owned editor/runtime capabilities should all be - expressible as Substrate-Gate-scoped repo access requests with receipts. -- Deletion line: worker launch `authority_scope` is not repo access authority. - It may describe role/task scope, but the Substrate Gate must grant substrate - access. +- Owner: the concrete family invariant owner constructs and persists one + `SubstrateGateRepoAccessGrantReceipt` for an authenticated runtime job. +- Inputs: runtime job, worker binding, role, authority scope, fixed permitted + operations, bounded paths, and grant time. +- Output: one immutable grant receipt. Runtime validators correlate its exact + identity and envelope with the launch, tool intent, Hands intent/review, and + consequence that consumes it. +- Derived state: source lookup receipts, Body observations, Hands patch/command/ + commit receipts, provider-owned editor receipts, and CultNet views report + consequences. They do not create access authority. +- Forbidden writers: models, tools, CultNet clients, and provider daemons cannot + author an Epiphany grant. A model cannot widen the paths or operations in a + persisted grant. +- Shared paths: governed source tools and Hands consequences reach their + family-specific validators through the same exact grant identity. +- Cut line: launch `authority_scope` is descriptive until bound to a persisted + grant. Substrate Gate does not own workflow requests, reviews, refusals, + snapshots, mutations, evidence admission, or Mind commits. -## Contract Families +## Contract Family -- `epiphany.substrate_gate.repo_access_request`: request for scoped repository - access. -- `epiphany.substrate_gate.repo_access_review`: Substrate Gate decision and scope - explanation. -- `epiphany.substrate_gate.repo_access_grant_receipt`: proof of scoped access. -- `epiphany.substrate_gate.repo_access_refusal_receipt`: proof of refusal. -- `epiphany.substrate_gate.repo_snapshot_receipt`: proof of source - inspection/indexing performed under Substrate Gate access. -- `epiphany.substrate_gate.repo_mutation_receipt`: proof that mutation or - repo-affecting command execution had a prior Substrate Gate grant. +- `epiphany.substrate_gate.repo_access_grant_receipt`: the sole Substrate Gate + document. CultNet advertises it read-only. + +There is no generic access-request protocol. Family owners derive required +access from typed current work and either issue an exact grant or refuse the +operation directly. There is no generic snapshot or mutation receipt: Eyes +source receipts and Hands consequence receipts already own those facts. + +## Organ Boundaries + +Mind decides whether typed observations and decisions enter durable state. +Substrate Gate decides only whether a particular runtime job may touch bounded +repository substrate. Neither is an alias for the other. + +Modeling may consume typed Body observations and exact RepoModel documents +directly. Eyes is involved when a claim needs evidence outside the Body; it is +not a mandatory preprocessor for Modeling. Hands consumes an adopted action +route plus an exact grant, then emits the consequence receipt Soul verifies. + +Editor integration remains provider-owned. Brokkr owns Unity inspection and +actuation over Eve/CultMesh. A future Rider daemon owns Rider. Epiphany carries +no embedded Unity or Rider command organ and cannot manufacture provider +receipts on either daemon's behalf. ## Verse Boundary -Substrate Gate access contracts live in `epiphany-internal`. Operator-safe -projections may appear in `gamecult-local` after review, but raw repo access -requests, private paths, command cargo, diffs, and mutation receipts stay -internal unless another explicit export policy says otherwise. -`epiphany-global` never gains repository access authority. - -Mind and the Substrate Gate are neighboring protocols, not aliases. The -Substrate Gate decides whether the machine may touch the repo. Mind decides -whether resulting thought or evidence mutates persistent state. - -Imagination can project Body substrate facts into a Persona scene only after those facts have -entered through Substrate-Gate-scoped access. A beautiful scene is not a repo -access grant. Eyes is the next gate after access: a Substrate Gate grant allows -looking, but only Eyes can turn looked-at material into a citable evidence -packet. Modeling may update the machine's internal body model only from -source-grounded material that has passed through the appropriate access and -evidence path. +The grant remains private runtime state. CultNet may project its typed contract +and operator-safe receipt view, but cannot submit or widen grants. Provider +capabilities are discovered through CultMesh; discovery does not grant local +repository access or Mind admission.