GameCult/Epiphany
Archived
Watch
9
0
Fork
You've already forked Epiphany
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add repo deployment config family

Browse source
This commit is contained in:
Meta Vens 2026-06-20 22:23:51 +01:00
commit 8d8afce17c
6 changed files with 716 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

444
epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs Normal file
View file

@ -0,0 +1,444 @@
use anyhow::Context;
use anyhow::Result;
use anyhow::anyhow;
use chrono::Utc;
use serde_json::Value;
use serde_json::json;
use std::env;
use std::fs;
use std::path::Path;
use std::path::PathBuf;
use std::process::Command;
fn main() -> Result<()> {
let args = Args::parse()?;
let result = run_smoke(args)?;
println!("{}", serde_json::to_string_pretty(&result)?);
Ok(())
}
#[derive(Clone, Debug)]
struct Args {
root: PathBuf,
smoke_root: PathBuf,
}
impl Args {
fn parse() -> Result<Self> {
let mut root = env::current_dir().context("failed to resolve current directory")?;
let mut smoke_root = root.join(".epiphany-smoke");
let mut args = env::args().skip(1).peekable();
while let Some(arg) = args.next() {
match arg.as_str() {
"--root" => root = take_path(&mut args, "--root")?,
"--smoke-root" => smoke_root = take_path(&mut args, "--smoke-root")?,
other => return Err(anyhow!("unexpected argument {other:?}")),
}
}
Ok(Self { root, smoke_root })
}
}
fn run_smoke(args: Args) -> Result<Value> {
let root = args
.root
.canonicalize()
.with_context(|| format!("failed to resolve {}", args.root.display()))?;
let manifest = root.join("epiphany-core").join("Cargo.toml");
if !manifest.exists() {
return Err(anyhow!(
"could not find epiphany-core manifest at {}",
manifest.display()
));
}
fs::create_dir_all(&args.smoke_root)
.with_context(|| format!("failed to create {}", args.smoke_root.display()))?;
let stamp = Utc::now().format("%Y%m%d-%H%M%S").to_string();
let smoke_dir = args
.smoke_root
.join(format!("repo-deployment-config-family-{stamp}"));
if smoke_dir.exists() {
fs::remove_dir_all(&smoke_dir)
.with_context(|| format!("failed to clear {}", smoke_dir.display()))?;
}
fs::create_dir_all(&smoke_dir)
.with_context(|| format!("failed to create {}", smoke_dir.display()))?;
let repo = smoke_dir.join("repo-body");
fs::create_dir_all(&repo).with_context(|| format!("failed to create {}", repo.display()))?;
git(["init"], &repo)?;
git(
["config", "user.email", "epiphany-smoke@example.invalid"],
&repo,
)?;
git(["config", "user.name", "Epiphany Smoke"], &repo)?;
fs::write(
repo.join("README.md"),
"# Repo Deployment Config Family Smoke\n\nThis repository proves branch-local Idunn deployment config cargo without deploy authority.\n",
)
.with_context(|| format!("failed to seed {}", repo.join("README.md").display()))?;
fs::create_dir_all(repo.join("deploy"))
.with_context(|| format!("failed to create {}", repo.join("deploy").display()))?;
fs::write(
repo.join("deploy").join("idunn-deploy.ps1"),
"# reviewed by Idunn before use\nWrite-Output 'deployment script placeholder'\n",
)
.with_context(|| {
format!(
"failed to seed {}",
repo.join("deploy").join("idunn-deploy.ps1").display()
)
})?;
git(["add", "README.md", "deploy/idunn-deploy.ps1"], &repo)?;
git(
["commit", "-m", "Seed repo deployment config smoke body"],
&repo,
)?;
git(
["switch", "-c", "epiphany/repo-deployment-config-family"],
&repo,
)?;
let item = "repo-deployment-config-family";
let target_path = ".epiphany/deployment.toml";
let local_verse = repo.join(".epiphany").join("local-verse.ccmp");
cargo_json(
&manifest,
"epiphany-repo",
&[
"init",
"--workspace",
path_str(&repo)?,
"--epiphany-root",
path_str(&root)?,
"--swarm-id",
"repo-deployment-config-family-smoke",
"--topic",
"repo-deployment-config-family",
],
&root,
)?;
cargo_json(
&manifest,
"epiphany-swarm",
&[
"online",
"--workspace",
path_str(&repo)?,
"--epiphany-root",
path_str(&root)?,
"--runtime-id",
"repo-deployment-config-family-smoke",
"--local-verse-store",
path_str(&local_verse)?,
],
&root,
)?;
cargo_json(
&manifest,
"epiphany-work",
&[
"accept",
"--workspace",
path_str(&repo)?,
"--from",
"persona",
"--item",
item,
"--summary",
"Configure an Idunn-watched git-push deployment contract without granting deployment authority.",
"--candidate-action-ref",
"candidate-action://repo-deployment-config-family/idunn-config",
"--public-discussion-ref",
"epiphany-global/persona-collaboration/repo-deployment-config-family",
],
&root,
)?;
let plan = cargo_json(
&manifest,
"epiphany-work",
&[
"derive-plan",
"--workspace",
path_str(&repo)?,
"--item",
item,
"--action-family",
"repo-deployment-config",
"--model-ref",
"repo-deployment-config-family-smoke-imagination-v1",
"--model-authored",
],
&root,
)?;
for _ in 0..4 {
cargo_json(
&manifest,
"epiphany-work",
&[
"tick",
"--workspace",
path_str(&repo)?,
"--epiphany-root",
path_str(&root)?,
"--item",
item,
"--cooldown-seconds",
"0",
],
&root,
)?;
}
let close = read_json(
&repo
.join(".epiphany")
.join("work")
.join(format!("work-close-{item}.json")),
)?;
let config_text = fs::read_to_string(repo.join(target_path))
.with_context(|| format!("failed to read {}", repo.join(target_path).display()))?;
let deploy_script_text = fs::read_to_string(repo.join("deploy").join("idunn-deploy.ps1"))
.with_context(|| {
format!(
"failed to read {}",
repo.join("deploy").join("idunn-deploy.ps1").display()
)
})?;
require_eq(
&plan,
&["derivation", "safeActionFamily"],
"repo.deployment_config",
)?;
require_eq(&close, &["status"], "closed")?;
require_eq(&close, &["soul", "verdict"], "passed")?;
require_eq(
&close,
&["closureReview", "familyAssertions", "status"],
"passed",
)?;
require_bool(
&close,
&["closureReview", "sourceGrounding", "pathScopeMatched"],
true,
)?;
require_bool(&close, &["privateStateExposed"], false)?;
require_text(
&config_text,
"schema_version = \"epiphany.repo_deployment_config.v0\"",
)?;
require_text(
&config_text,
"safe_action_family = \"repo.deployment_config\"",
)?;
require_text(&config_text, "enabled = false")?;
require_text(&config_text, "owner = \"Idunn\"")?;
require_text(&config_text, "trigger = \"git-push-observed-by-idunn\"")?;
require_text(&config_text, "watched_ref = \"refs/heads/main\"")?;
require_text(
&config_text,
"deployment_script_ref = \"deploy/idunn-deploy.ps1\"",
)?;
require_text(&config_text, "deployment_script_hash_required = true")?;
require_text(&config_text, "deployment_script_review_required = true")?;
require_text(&config_text, "host_access_policy_ref_required = true")?;
require_text(&config_text, "secret_values_embedded = false")?;
require_text(&config_text, "rollback_plan_ref_required = true")?;
require_text(&config_text, "aftercare_checks_required = true")?;
require_text(&config_text, "idunn_receipt_required = true")?;
require_text(&config_text, "aftercare_audit_required = true")?;
require_text(
&config_text,
"capability_family = \"gamecult.idunn.deployment\"",
)?;
require_text(
&config_text,
"intent_contract = \"gamecult.idunn.deployment_intent.v0\"",
)?;
require_text(
&config_text,
"receipt_contract = \"gamecult.idunn.deployment_receipt.v0\"",
)?;
require_text(
&config_text,
"aftercare_contract = \"gamecult.idunn.deployment_aftercare_audit.v0\"",
)?;
require_text(&config_text, "daemon_owns_execution = true")?;
require_text(&config_text, "configuration_only = true")?;
require_text(&config_text, "direct_deployment_authority = false")?;
require_text(&config_text, "direct_ssh_authority = false")?;
require_text(&config_text, "direct_git_push_authority = false")?;
require_text(&config_text, "direct_service_lifecycle_authority = false")?;
require_text(&config_text, "direct_hands_authority = false")?;
require_text(&config_text, "publication_authorized = false")?;
require_text(&config_text, "cross_body_mutation_authorized = false")?;
require_text(&config_text, "private_verse_rummaging = false")?;
require_text(&config_text, "private_state_exposed = false")?;
require_text(&deploy_script_text, "deployment script placeholder")?;
let summary = json!({
"schemaVersion": "epiphany.repo_deployment_config_family_smoke.v0",
"status": "ok",
"smokeDir": smoke_dir,
"repo": repo,
"branch": git_output(["branch", "--show-current"], &repo)?,
"item": item,
"safeActionFamily": plan["derivation"]["safeActionFamily"],
"targetPath": target_path,
"closeStatus": close["status"],
"soulVerdict": close["soul"]["verdict"],
"familyAssertionsStatus": close["closureReview"]["familyAssertions"]["status"],
"pathScopeMatched": close["closureReview"]["sourceGrounding"]["pathScopeMatched"],
"deploymentConfigEnabled": false,
"deploymentTrigger": "git-push-observed-by-idunn",
"deploymentOwner": "Idunn",
"daemonOwnsExecution": true,
"deploymentAuthority": false,
"sshAuthority": false,
"gitPushAuthority": false,
"serviceLifecycleAuthority": false,
"privateStateExposed": false,
});
write_json(&smoke_dir.join("summary.json"), &summary)?;
Ok(summary)
}
fn cargo_json(manifest: &Path, bin: &str, args: &[&str], cwd: &Path) -> Result<Value> {
let output = Command::new("cargo")
.arg("run")
.arg("--quiet")
.arg("--manifest-path")
.arg(manifest)
.arg("--bin")
.arg(bin)
.arg("--")
.args(args)
.current_dir(cwd)
.output()
.with_context(|| format!("failed to run cargo bin {bin}"))?;
if !output.status.success() {
return Err(anyhow!(
"{bin} failed with status {:?}\nstdout:\n{}\nstderr:\n{}",
output.status.code(),
String::from_utf8_lossy(&output.stdout),
String::from_utf8_lossy(&output.stderr)
));
}
serde_json::from_slice(&output.stdout).with_context(|| {
format!(
"{bin} did not emit JSON on stdout:\n{}",
String::from_utf8_lossy(&output.stdout)
)
})
}
fn git<const N: usize>(args: [&str; N], cwd: &Path) -> Result<()> {
let output = Command::new("git")
.args(args)
.current_dir(cwd)
.output()
.with_context(|| format!("failed to run git in {}", cwd.display()))?;
if output.status.success() {
Ok(())
} else {
Err(anyhow!(
"git {:?} failed in {}\nstdout:\n{}\nstderr:\n{}",
args,
cwd.display(),
String::from_utf8_lossy(&output.stdout),
String::from_utf8_lossy(&output.stderr)
))
}
}
fn git_output<const N: usize>(args: [&str; N], cwd: &Path) -> Result<String> {
let output = Command::new("git")
.args(args)
.current_dir(cwd)
.output()
.with_context(|| format!("failed to run git in {}", cwd.display()))?;
if output.status.success() {
Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
} else {
Err(anyhow!(
"git {:?} failed in {}\nstdout:\n{}\nstderr:\n{}",
args,
cwd.display(),
String::from_utf8_lossy(&output.stdout),
String::from_utf8_lossy(&output.stderr)
))
}
}
fn read_json(path: &Path) -> Result<Value> {
let bytes = fs::read(path).with_context(|| format!("failed to read {}", path.display()))?;
serde_json::from_slice(&bytes).with_context(|| format!("failed to parse {}", path.display()))
}
fn write_json(path: &Path, value: &Value) -> Result<()> {
let bytes = serde_json::to_vec_pretty(value)?;
fs::write(path, bytes).with_context(|| format!("failed to write {}", path.display()))
}
fn require_eq(value: &Value, path: &[&str], expected: &str) -> Result<()> {
let actual = value_at_path(value, path)
.and_then(Value::as_str)
.ok_or_else(|| anyhow!("missing string at {}", path.join(".")))?;
if actual == expected {
Ok(())
} else {
Err(anyhow!(
"expected {} at {}, got {}",
expected,
path.join("."),
actual
))
}
}
fn require_bool(value: &Value, path: &[&str], expected: bool) -> Result<()> {
let actual = value_at_path(value, path)
.and_then(Value::as_bool)
.ok_or_else(|| anyhow!("missing bool at {}", path.join(".")))?;
if actual == expected {
Ok(())
} else {
Err(anyhow!(
"expected {} at {}, got {}",
expected,
path.join("."),
actual
))
}
}
fn require_text(text: &str, needle: &str) -> Result<()> {
if text.contains(needle) {
Ok(())
} else {
Err(anyhow!("expected generated text to contain {needle:?}"))
}
}
fn value_at_path<'a>(value: &'a Value, path: &[&str]) -> Option<&'a Value> {
let mut cursor = value;
for segment in path {
cursor = cursor.get(*segment)?;
}
Some(cursor)
}
fn take_path<I>(args: &mut std::iter::Peekable<I>, flag: &str) -> Result<PathBuf>
where
I: Iterator<Item = String>,
{
args.next()
.map(PathBuf::from)
.ok_or_else(|| anyhow!("{flag} requires a value"))
}
fn path_str(path: &Path) -> Result<&str> {
path.to_str()
.ok_or_else(|| anyhow!("path is not valid UTF-8: {}", path.display()))
}

241
epiphany-core/src/bin/epiphany-work.rs
View file

@ -2035,12 +2035,16 @@ fn derive_safe_plan_family(input: DeriveSafePlanInput<'_>) -> Result<DerivedSafe
| "secret-policy-request"
| "security-policy-request"
| "repo-security-request" => derive_repo_secret_policy_request_plan(input, &action_family),
"repo-deployment-config"
| "deployment-config"
| "idunn-deployment-config"
| "repo-deploy-config" => derive_repo_deployment_config_plan(input, &action_family),
"repo-deployment-request"
| "deployment-request"
| "idunn-deployment-request"
| "repo-deploy-request" => derive_repo_deployment_request_plan(input, &action_family),
other => Err(anyhow!(
"unsupported derive-plan action family {other:?}; supported families are append-worklog, planning-note, checklist-note, section-note, repo-status-section, task-card, repo-manifest, repo-tool-capabilities, repo-tool-request, repo-eve-surface, repo-collaboration-policy, repo-collaboration-topic, repo-consensus-brief, repo-objective-draft, repo-adoption-request, repo-scheduling-request, repo-work-order, repo-verification-request, repo-publication-request, repo-sync-request, repo-maintainer-review-request, repo-pr-request, repo-credit-request, repo-artifact-acceptance-request, repo-metrics-request, repo-doctrine-update-request, repo-secret-policy-request, and repo-deployment-request"
"unsupported derive-plan action family {other:?}; supported families are append-worklog, planning-note, checklist-note, section-note, repo-status-section, task-card, repo-manifest, repo-tool-capabilities, repo-tool-request, repo-eve-surface, repo-collaboration-policy, repo-collaboration-topic, repo-consensus-brief, repo-objective-draft, repo-adoption-request, repo-scheduling-request, repo-work-order, repo-verification-request, repo-publication-request, repo-sync-request, repo-maintainer-review-request, repo-pr-request, repo-credit-request, repo-artifact-acceptance-request, repo-metrics-request, repo-doctrine-update-request, repo-secret-policy-request, repo-deployment-config, and repo-deployment-request"
)),
}
}
@ -5244,6 +5248,132 @@ fn derive_repo_deployment_request_plan(
})
}
fn derive_repo_deployment_config_plan(
input: DeriveSafePlanInput<'_>,
action_family: &str,
) -> Result<DerivedSafePlan> {
let target_path =
validate_toml_target_path(input.target_path.unwrap_or(".epiphany/deployment.toml"))?;
let candidate_refs =
string_array_from_json(input.accept_receipt, &["feedback", "candidateActionRefs"]);
let public_refs =
string_array_from_json(input.accept_receipt, &["feedback", "publicDiscussionRefs"]);
let now = Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true);
let deployment_id = format!("repo-deployment-config:{}", sanitize(input.item));
let lines = vec![
"# Epiphany repo deployment config.".to_string(),
"# Branch-local configuration cargo; Idunn owns deployment execution.".to_string(),
format!(
"schema_version = {}",
toml_basic_string("epiphany.repo_deployment_config.v0")
),
format!("id = {}", toml_basic_string(&deployment_id)),
format!("item = {}", toml_basic_string(input.item)),
format!("created_at = {}", toml_basic_string(&now)),
format!("source = {}", toml_basic_string(input.source)),
format!("summary = {}", toml_basic_string(&compact_line(input.summary))),
format!(
"safe_action_family = {}",
toml_basic_string("repo.deployment_config")
),
format!("model_authored = {}", input.model_authored),
format!(
"model_ref = {}",
toml_basic_string(input.model_ref.unwrap_or("deterministic-fallback"))
),
"hands_authority_granted = false".to_string(),
"deployment_authority = false".to_string(),
"ssh_authority = false".to_string(),
"git_push_authority = false".to_string(),
"service_lifecycle_authority = false".to_string(),
"durable_state_admitted = false".to_string(),
"publication_authorized = false".to_string(),
"merge_authorized = false".to_string(),
"cross_repo_mutation = false".to_string(),
"private_state_exposed = false".to_string(),
format!("candidate_action_refs = {}", toml_array(&candidate_refs)),
format!("public_discussion_refs = {}", toml_array(&public_refs)),
String::new(),
"[deployment]".to_string(),
"enabled = false".to_string(),
"owner = \"Idunn\"".to_string(),
"trigger = \"git-push-observed-by-idunn\"".to_string(),
"target_environment = \"review-required\"".to_string(),
"watched_ref = \"refs/heads/main\"".to_string(),
"deployment_script_ref = \"deploy/idunn-deploy.ps1\"".to_string(),
"deployment_script_hash_required = true".to_string(),
"deployment_script_review_required = true".to_string(),
"host_access_policy_ref_required = true".to_string(),
"secret_policy_ref = \".epiphany/security/secret-policy.toml\"".to_string(),
"secret_values_embedded = false".to_string(),
"rollback_plan_ref_required = true".to_string(),
"aftercare_checks_required = true".to_string(),
"idunn_receipt_required = true".to_string(),
"aftercare_audit_required = true".to_string(),
String::new(),
"[cultmesh]".to_string(),
"local_verse = \"gamecult-local\"".to_string(),
"capability_family = \"gamecult.idunn.deployment\"".to_string(),
"intent_contract = \"gamecult.idunn.deployment_intent.v0\"".to_string(),
"receipt_contract = \"gamecult.idunn.deployment_receipt.v0\"".to_string(),
"aftercare_contract = \"gamecult.idunn.deployment_aftercare_audit.v0\"".to_string(),
"daemon_owns_execution = true".to_string(),
String::new(),
"[required_receipts]".to_string(),
"mind_adoption = \"epiphany.repo_work_mind_adoption_decision.v0\"".to_string(),
"soul_review = \"epiphany.repo_work_closure_review.v0\"".to_string(),
"maintainer_review = \"gamecult.maintainer.review_receipt.v0\"".to_string(),
"secret_policy = \"epiphany.repo_secret_policy_request.v0\"".to_string(),
"idunn_deployment = \"gamecult.idunn.deployment_receipt.v0\"".to_string(),
"aftercare_audit = \"gamecult.idunn.deployment_aftercare_audit.v0\"".to_string(),
String::new(),
"[authority]".to_string(),
"configuration_only = true".to_string(),
"direct_deployment_authority = false".to_string(),
"direct_ssh_authority = false".to_string(),
"direct_git_push_authority = false".to_string(),
"direct_service_lifecycle_authority = false".to_string(),
"direct_hands_authority = false".to_string(),
"publication_authorized = false".to_string(),
"merge_authorized = false".to_string(),
"cross_body_mutation_authorized = false".to_string(),
"private_verse_rummaging = false".to_string(),
"idunn_deployment_authority_required = true".to_string(),
String::new(),
"[verification]".to_string(),
"asks = [".to_string(),
" \"Soul verifies the deployment config path changed and contains the accepted pressure summary.\",".to_string(),
" \"Soul verifies the config names git-push-observed-by-Idunn trigger, script review/hash, secret policy, rollback, aftercare, and Idunn receipt contracts.\",".to_string(),
" \"Soul verifies this config is disabled until reviewed and grants no direct deployment, SSH, git push, service lifecycle, publication, merge, Hands, cross-body, or private Verse authority.\"".to_string(),
"]".to_string(),
String::new(),
"[rollback]".to_string(),
"hints = [\"Remove or disable the deployment config if the Idunn deployment path is not ready.\"]"
.to_string(),
String::new(),
];
let command = powershell_set_lines_command(&target_path, &lines);
Ok(DerivedSafePlan {
safe_action_family: "repo.deployment_config".to_string(),
target_path,
plan_summary: format!(
"Imagination derived an Idunn-facing repo deployment config from accepted {} pressure.",
input.source
),
command,
commit_message: format!("Add deployment config for repo work item {}", input.item),
verification_asks: vec![
"Soul verifies the repo deployment config path changed and contains the accepted pressure summary.".to_string(),
"Soul verifies the config names git-push-observed-by-Idunn trigger, script review/hash, secret policy, rollback, aftercare, Idunn receipts, and no direct deployment/SSH/push authority.".to_string(),
"Soul verifies no paths outside the declared deployment config changed.".to_string(),
],
rollback_hints: vec![
"Remove or disable the generated deployment config if Idunn review is not ready.".to_string(),
],
derivation: plan_derivation_receipt(input, action_family, "repo.deployment_config"),
})
}
fn closure_family_assertions(
workspace: &Path,
commit_sha: &str,
@ -7387,6 +7517,112 @@ fn closure_family_assertions(
"Committed deployment request preserves the private-state seal.".to_string(),
);
}
"repo.deployment_config" => {
push_assertion(
&mut assertions,
"deployment-config-schema-present",
content.contains("schema_version = \"epiphany.repo_deployment_config.v0\""),
"Committed deployment config carries the schema version.".to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-family-present",
content.contains("safe_action_family = \"repo.deployment_config\""),
"Committed deployment config carries the safe action family.".to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-summary-present",
content.contains(&compact_summary),
"Committed deployment config contains the accepted pressure summary.".to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-idunn-trigger",
content.contains("[deployment]")
&& content.contains("enabled = false")
&& content.contains("owner = \"Idunn\"")
&& content.contains("trigger = \"git-push-observed-by-idunn\"")
&& content.contains("watched_ref = \"refs/heads/main\"")
&& content.contains("deployment_script_ref = \"deploy/idunn-deploy.ps1\"")
&& content.contains("deployment_script_hash_required = true")
&& content.contains("deployment_script_review_required = true")
&& content.contains("host_access_policy_ref_required = true")
&& content.contains("secret_values_embedded = false")
&& content.contains("rollback_plan_ref_required = true")
&& content.contains("aftercare_checks_required = true")
&& content.contains("idunn_receipt_required = true")
&& content.contains("aftercare_audit_required = true"),
"Committed deployment config names disabled Idunn git-push trigger, reviewed script/hash, policy, rollback, and aftercare requirements."
.to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-cultmesh-contract",
content.contains("[cultmesh]")
&& content.contains("local_verse = \"gamecult-local\"")
&& content.contains("capability_family = \"gamecult.idunn.deployment\"")
&& content
.contains("intent_contract = \"gamecult.idunn.deployment_intent.v0\"")
&& content
.contains("receipt_contract = \"gamecult.idunn.deployment_receipt.v0\"")
&& content.contains(
"aftercare_contract = \"gamecult.idunn.deployment_aftercare_audit.v0\"",
)
&& content.contains("daemon_owns_execution = true"),
"Committed deployment config routes deployment through Idunn CultMesh contracts."
.to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-receipt-contract",
content.contains("[required_receipts]")
&& content.contains(
"mind_adoption = \"epiphany.repo_work_mind_adoption_decision.v0\"",
)
&& content.contains(
"soul_review = \"epiphany.repo_work_closure_review.v0\"",
)
&& content.contains(
"maintainer_review = \"gamecult.maintainer.review_receipt.v0\"",
)
&& content.contains(
"secret_policy = \"epiphany.repo_secret_policy_request.v0\"",
)
&& content.contains(
"idunn_deployment = \"gamecult.idunn.deployment_receipt.v0\"",
)
&& content.contains(
"aftercare_audit = \"gamecult.idunn.deployment_aftercare_audit.v0\"",
),
"Committed deployment config names Mind, Soul, maintainer, secret-policy, Idunn deployment, and aftercare receipts."
.to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-authority-seals",
content.contains("[authority]")
&& content.contains("configuration_only = true")
&& content.contains("direct_deployment_authority = false")
&& content.contains("direct_ssh_authority = false")
&& content.contains("direct_git_push_authority = false")
&& content.contains("direct_service_lifecycle_authority = false")
&& content.contains("direct_hands_authority = false")
&& content.contains("publication_authorized = false")
&& content.contains("merge_authorized = false")
&& content.contains("cross_body_mutation_authorized = false")
&& content.contains("private_verse_rummaging = false")
&& content.contains("idunn_deployment_authority_required = true"),
"Committed deployment config denies deployment/SSH/push/service/action/publication/cross-body authority."
.to_string(),
);
push_assertion(
&mut assertions,
"deployment-config-private-seal",
content.contains("private_state_exposed = false"),
"Committed deployment config preserves the private-state seal.".to_string(),
);
}
_ => {
return Ok((
json!({
@ -11993,6 +12229,7 @@ fn repo_work_safe_family_is_recognized(safe_family: &str) -> bool {
| "repo.metrics_request"
| "repo.doctrine_update_request"
| "repo.secret_policy_request"
| "repo.deployment_config"
| "repo.deployment_request"
)
}
@ -12113,7 +12350,7 @@ fn print_usage() {
"usage: epiphany-work <persona-intake|accept|derive-plan|plan|run|adopt|execute|close|publish|sync|overview|export-proof|tick|queue-run|serve> ...\n\
persona-intake --workspace <repo> --item <id> --message <text> [--topic <topic>] [--store <local-verse.ccmp>] [--runtime-id <id>]\n\
accept --workspace <repo> --from <persona|bifrost|persona-or-bifrost> --item <id> [--summary <text>] [--topic <topic>] [--store <local-verse.ccmp>] [--runtime-id <id>] [--online-receipt <path>] [--public-discussion-ref <ref>] [--candidate-action-ref <ref>]\n\
derive-plan --workspace <repo> [--item <id>] [--accept-receipt <path>] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card|repo-manifest|repo-tool-capabilities|repo-tool-request|repo-eve-surface|repo-collaboration-policy|repo-collaboration-topic|repo-consensus-brief|repo-objective-draft|repo-adoption-request|repo-scheduling-request|repo-work-order|repo-verification-request|repo-publication-request|repo-sync-request|repo-maintainer-review-request|repo-pr-request|repo-credit-request|repo-artifact-acceptance-request|repo-metrics-request|repo-doctrine-update-request|repo-secret-policy-request|repo-deployment-request] [--target-path <path>] [--model-ref <ref>] [--model-authored] [--action-summary <text>] [--verification-ask <text>] [--stop-condition <text>] [--escalation-reason <text>] [--assumption <text>] [--constraint <text>] [--non-goal <text>] [--open-question <text>] [--decision-point <text>] [--evidence-need <text>]\n\
derive-plan --workspace <repo> [--item <id>] [--accept-receipt <path>] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card|repo-manifest|repo-tool-capabilities|repo-tool-request|repo-eve-surface|repo-collaboration-policy|repo-collaboration-topic|repo-consensus-brief|repo-objective-draft|repo-adoption-request|repo-scheduling-request|repo-work-order|repo-verification-request|repo-publication-request|repo-sync-request|repo-maintainer-review-request|repo-pr-request|repo-credit-request|repo-artifact-acceptance-request|repo-metrics-request|repo-doctrine-update-request|repo-secret-policy-request|repo-deployment-config|repo-deployment-request] [--target-path <path>] [--model-ref <ref>] [--model-authored] [--action-summary <text>] [--verification-ask <text>] [--stop-condition <text>] [--escalation-reason <text>] [--assumption <text>] [--constraint <text>] [--non-goal <text>] [--open-question <text>] [--decision-point <text>] [--evidence-need <text>]\n\
plan --workspace <repo> [--item <id>] --objective <text> --plan-summary <text> --command <command> --changed-path <path> --commit-message <text> [--adoption-evidence-ref <ref>]\n\
run --workspace <repo> [--item <id>] [--accept-receipt <path>] [--runtime-store <path>] [--requested-path <path>]\n\
adopt --workspace <repo> [--item <id>] [--run-receipt <path>] [--from-plan <path>] [--plan-summary <text>] [--adoption-evidence-ref <ref>] [--mind-adoption-rationale <text>]\n\

33
notes/epiphany-repo-swarm-mvp-contract.md
View file

@ -356,7 +356,15 @@ locations without values, credential owner, write-permission scope,
public/private export boundaries, deployment authority owner, rollback planning,
Eyes/Soul/Mind/maintainer/Bifrost receipts, and redaction requirements without
itself granting secret access, write permission, deployment, publication, merge,
service lifecycle, or cross-body authority. Its receipt includes
service lifecycle, or cross-body authority; and `--action-family
repo-deployment-config` writes a structured Idunn deployment config under
`.epiphany/deployment.toml`, naming a disabled git-push-observed-by-Idunn
trigger, watched ref, deployment script ref, script hash/review requirement,
host access policy requirement, secret policy ref, rollback, aftercare checks,
Idunn intent/receipt/aftercare CultMesh contracts, and daemon-owned execution
without itself granting deployment, SSH, git push, service lifecycle,
publication, merge, Hands, cross-body, or private Verse authority. Its receipt
includes
`epiphany.repo_work_plan_derivation.v0`, mode `append-worklog`,
`planning-note`, `checklist-note`, `section-note`, `repo-status-section`, or
`task-card`, `repo-manifest`, `repo-tool-capabilities`,
@ -366,8 +374,8 @@ service lifecycle, or cross-body authority. Its receipt includes
`repo-verification-request`, `repo-publication-request`, `repo-sync-request`, or
`repo-maintainer-review-request`, `repo-pr-request`, `repo-credit-request`,
`repo-artifact-acceptance-request`, `repo-metrics-request`,
`repo-doctrine-update-request`, `repo-secret-policy-request`, or
`repo-deployment-request`, a
`repo-doctrine-update-request`, `repo-secret-policy-request`,
`repo-deployment-config`, or `repo-deployment-request`, a
`safeActionFamily`, and an authority seal forbidding publication, merge, service
lifecycle mutation, cross-repo mutation, and private state exposure.
These deterministic families are quarantine scaffolding on the road to
@ -753,6 +761,23 @@ policy/rollback requirements, and denied direct deployment, SSH, git push,
service lifecycle, Hands, publication, merge, cross-body authority, and
`privateStateExposed=false`.
The following Idunn configuration smoke made the git-push deployment contract
repo-owned without granting deployment authority:
`.epiphany-smoke\repo-deployment-config-family-20260620-211809` ran init ->
online -> accept -> `derive-plan --action-family repo-deployment-config
--model-ref repo-deployment-config-family-smoke-imagination-v1
--model-authored` -> tick through run/adopt/execute/close on a fresh repo. The
plan carried `safeActionFamily=repo.deployment_config`; Hands committed only
`.epiphany/deployment.toml`; Soul passed with `pathScopeMatched=true` and
`familyAssertions.status=passed`; the config carried `schema_version =
"epiphany.repo_deployment_config.v0"`, `enabled=false`,
`owner="Idunn"`, `trigger="git-push-observed-by-idunn"`,
`watched_ref="refs/heads/main"`, deployment script/hash/review, host policy,
secret policy, rollback, aftercare, Idunn CultMesh intent/receipt/aftercare
contracts, daemon-owned execution, and denied direct deployment, SSH, git push,
service lifecycle, Hands, publication, merge, cross-body authority, and
`privateStateExposed=false`.
### Landed Work Run Gate
The sixth front door exists as native Rust:
@ -1547,7 +1572,7 @@ temptation wearing clean robes.
| Repo Body birth | `epiphany-repo init` exists and writes repo-local stores plus branch workbench intent. | Keep birth startup-only, review-gated, and branch-oriented. |
| Local Verse online | `epiphany-swarm online` seeds repo-local CultMesh, standing-faculty SoA, topology, liveness, Eve, and tool sight. | Keep private Verse sealed while exposing operator-safe repo status. |
| Persona/Bifrost intake | `epiphany-work accept` records pressure and candidate action refs without Hands authority. `epiphany-work persona-intake` now invokes the Persona bubble speech-audit path, records public discussion and candidate-action refs, then delegates to `accept`; wrapper mode `repo-persona-intake` exposes the operator mouth. | Deepen the intake-to-Imagination interpreter so richer model-authored action items can be proposed without granting Hands, publication, or durable-state authority at the mouth edge. |
| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, planning facets (assumptions, constraints, non-goals, open questions, decision points, and evidence needs), and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo-doctrine-update-request` / `repo.doctrine_update_request`, `repo-secret-policy-request` / `repo.secret_policy_request`, and `repo-deployment-request` / `repo.deployment_request`. `adopt` now writes `epiphany.repo_work_mind_adoption_decision.v0` before the main adoption receipt cites the decision and grants branch-local Hands authority. `plan` remains manual quarantine scaffolding. | Deepen further interpreter behavior and useful repo-owned configuration/action classes without turning model text into arbitrary shell authority. |
| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, planning facets (assumptions, constraints, non-goals, open questions, decision points, and evidence needs), and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo-doctrine-update-request` / `repo.doctrine_update_request`, `repo-secret-policy-request` / `repo.secret_policy_request`, `repo-deployment-config` / `repo.deployment_config`, and `repo-deployment-request` / `repo.deployment_request`. `adopt` now writes `epiphany.repo_work_mind_adoption_decision.v0` before the main adoption receipt cites the decision and grants branch-local Hands authority. `plan` remains manual quarantine scaffolding. | Deepen further interpreter behavior and useful repo-owned configuration/action classes without turning model text into arbitrary shell authority. |
| Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan` and `repo-work-service-runbook` write Idunn lifecycle receipts/artifacts for the same queue-run command without launching it. | Keep any future queue-run service launch/install behind Idunn and explicit operator authority. |
| Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. |
| Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, refuses missing/tampered/non-affirmative Mind adoption proof, runs known safe-family content assertions, optionally gates on model-authored closure verdicts, writes Soul/Modeling/Mind receipts, admits a compact typed repo map entry into `.epiphany/state/repo-work-map.msgpack`, and mirrors that admitted fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0`. | Keep extending closure toward source-grounded semantic review and richer semantic map lenses, while preserving deterministic local closure for simple mechanical work. |

1
notes/fresh-workspace-handoff.md
View file

@ -148,6 +148,7 @@ remembers doctrine; the branch remembers the blade.
- 2026-06-20: `repo-doctrine-update-request` is now live as repo-governance request cargo. `epiphany-work derive-plan --action-family repo-doctrine-update-request` writes `.epiphany/doctrine-update-requests/<item>.toml` with safe family `repo.doctrine_update_request`, status `awaiting-doctrine-review`, `AGENTS.md` as review target, source-grounding, invariant-impact, rehydration-impact, rollback, redaction, Imagination/Mind/Soul/maintainer/Hands receipt requirements, and denials for direct doctrine mutation, Hands, Mind state commit, publication, merge, service lifecycle, cross-body mutation, private Verse rummaging, and private-state exposure. Soul closure assertions inspect schema, family, summary, request state, antecedents, receipt contract, doctrine packet, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` ran init -> online -> accept -> repo-doctrine-update-request derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/doctrine-update-requests/repo-doctrine-update-request-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `awaitingDoctrineReview=true`, `doctrineMutationAuthorized=false`, and `privateStateExposed=false`; the seed `AGENTS.md` stayed untouched. Current remaining repo-swarm MVP organs are deeper interpreter semantics, further reviewed configuration/action request families, richer closure depth, and Idunn-owned queue-run service lifecycle under explicit operator authority.
- 2026-06-20: `repo-secret-policy-request` is now live as security-governance request cargo. `epiphany-work derive-plan --action-family repo-secret-policy-request` writes `.epiphany/security/secret-policy-requests/<item>.toml` with safe family `repo.secret_policy_request`, status `awaiting-security-review`, secret locations without values, credential owner, write scope, public/private export boundaries, deployment authority owner, rollback, Eyes/Soul/Mind/maintainer/Bifrost receipt requirements, and denials for direct secret access, secret value materialization, write permission, deployment, publication, merge, service lifecycle, cross-body mutation, private Verse rummaging, and private-state exposure. Soul closure assertions inspect schema, family, summary, request state, antecedents, receipt contract, security packet, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` ran init -> online -> accept -> repo-secret-policy-request derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/security/secret-policy-requests/repo-secret-policy-request-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `awaitingSecurityReview=true`, `secretAccessAuthorized=false`, `writePermissionAuthorized=false`, `deploymentAuthority=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics, further reviewed config/action request families, richer closure depth, and Idunn-owned queue-run service lifecycle under explicit operator authority.
- 2026-06-20: `repo-deployment-request` is now live as Idunn-facing deployment request cargo. `epiphany-work derive-plan --action-family repo-deployment-request` writes `.epiphany/deployment-requests/<item>.toml` with safe family `repo.deployment_request`, status `awaiting-idunn-review`, git-push-observed-by-Idunn trigger, Idunn/Maintainer ownership, target environment, git ref/branch, deployment script ref, script hash or review ref, host access policy, secret policy, rollback plan, aftercare checks, Eyes/Mind/Soul/maintainer/secret-policy/Bifrost/Idunn deployment/aftercare receipt requirements, and denials for direct deployment, SSH, git push, service lifecycle, Hands, publication, merge, cross-body mutation, private Verse rummaging, and private-state exposure. Soul closure assertions inspect schema, family, summary, request state, antecedents, receipt contract, deployment packet, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-deployment-request-family-20260620-195605` ran init -> online -> accept -> repo-deployment-request derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/deployment-requests/repo-deployment-request-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `awaitingIdunnReview=true`, `deploymentTrigger=git-push-observed-by-idunn`, `deploymentAuthority=false`, `sshAuthority=false`, `gitPushAuthority=false`, `serviceLifecycleAuthority=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics, further reviewed config/action request families, richer closure depth, and explicit Idunn deployment execution/audit under operator authority.
- 2026-06-20: `repo-deployment-config` is now live as repo-owned Idunn deployment configuration cargo. `epiphany-work derive-plan --action-family repo-deployment-config` writes `.epiphany/deployment.toml` with safe family `repo.deployment_config`, `enabled=false`, owner `Idunn`, trigger `git-push-observed-by-idunn`, watched ref `refs/heads/main`, deployment script ref, script hash/review requirement, host policy, secret policy, rollback, aftercare checks, Idunn CultMesh intent/receipt/aftercare contracts, daemon-owned execution, and denials for direct deployment, SSH, git push, service lifecycle, Hands, publication, merge, cross-body mutation, private Verse rummaging, and private-state exposure. Focused smoke `.epiphany-smoke\repo-deployment-config-family-20260620-211809` ran init -> online -> accept -> repo-deployment-config derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/deployment.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `deploymentConfigEnabled=false`, `daemonOwnsExecution=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics, richer closure depth, and explicit Idunn deployment execution/audit under operator authority.
- 2026-06-20: `derive-plan` action-item receipts now carry richer model-authored planning facets without widening command authority, and `adopt --from-plan` now preserves the chosen Imagination action item in the Mind adoption receipt. New CLI fields `--assumption`, `--constraint`, `--non-goal`, `--open-question`, `--decision-point`, and `--evidence-need` are recorded under `planningFacets` in `epiphany.repo_work_imagination_action_items_receipt.v0`, mirrored into the plan derivation's `actionItemReceipt`, then copied into `epiphany.repo_work_adoption_receipt.v0` as `adoptedActionItem`; deterministic defaults are emitted when a model does not supply them. Focused smoke `.epiphany-smoke\repo-planning-facets-20260620-164958` ran init -> online -> accept -> model-authored `derive-plan --action-family planning-note` with all facet fields -> tick run/adopt/execute/close; the action-item receipt preserved assumptions, constraints, non-goals, open questions, decision points, and evidence needs while `handsAuthorityGranted=false`, `durableStateAdmitted=false`, `handsCommandAuthority=false`, `durableStateAuthority=false`, and `privateStateExposed=false`; the adoption receipt preserved `adoptedActionItem.safeActionFamily=repo.markdown_planning_note`, planning facets, `adoptedActionItem.handsCommandAuthority=false`, `adoptedActionItem.durableStateAuthority=false`, `adoptedActionItem.publicationAuthorized=false`, `authority.handsAuthorityGranted=true`, `authority.durableStateAdmitted=false`, and `privateStateExposed=false`; Soul closure passed with family assertions and path scope matched. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
- 2026-06-20: Mind now has explicit repo-work safe-family and requested-path guards before branch-local Hands authority. `adopt --from-plan` treats unsupported plan-derived safe-family labels as refused interpreter decisions, writes `epiphany.repo_work_mind_adoption_decision.v0` with `status=refused-unsupported-safe-family`, keeps `actionItemAccepted=false` and `safeFamilyRecognized=false`, grants no Hands/durable-state/service/publication/cross-body/private-state authority, and writes no normal adoption receipt. It also compares the sorted action-item `requestedPaths` against the sorted plan action `changedPaths`; mismatches write `status=refused-requested-path-mismatch`, keep `safeFamilyRecognized=true` but `requestedPathsMatchPlan=false`, point the next gate at `imagination.replan_with_matching_requested_paths`, and grant no Hands/durable-state/service/publication/cross-body/private-state authority. Focused smokes `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425` and `.epiphany-smoke\repo-mind-path-guard-20260620-194239` prove both refusal paths; earlier positive smokes `.epiphany-smoke\repo-planning-facets-20260620-190916` and `.epiphany-smoke\closure-model-gate-20260620-190916` prove recognized planning facets and closure model gates still pass. Current remaining repo-swarm MVP organs are deeper interpreter semantics beyond adoption refusal, more useful repo-owned configuration/action families, richer closure depth, and Idunn-owned queue-run service lifecycle under explicit operator authority.
- 2026-06-20: `repo-eve-surface` is now live as repo-owned Eve/CultUI surface contract cargo. `epiphany-work derive-plan --action-family repo-eve-surface` writes `.epiphany/eve-surfaces/<item>.toml` with safe family `repo.eve_surface`, compact agent TUI and GUI lowering contracts, local/public Verse routing, Odin discovery, provider-owned surface identity, Persona/human collaboration flags, feedback routing to Imagination, and denials for renderer ownership, rendering/state/publication/service/cross-body authority, private Verse rummaging, and private-state exposure. Soul closure assertions inspect schema, family, summary, surface routing, Verse routing, CultUI contracts, collaboration route, authority seals, and private-state seal. Focused smoke `.epiphany-smoke\repo-eve-surface-family-20260620-165927` ran init -> online -> accept -> repo-eve-surface derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/eve-surfaces/repo-eve-surface-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `hasCultUiContracts=true`, `hasVerseRouting=true`, `odinDiscoverable=true`, `feedbackRoutesToImagination=true`, `rendererOwnsTruth=false`, `renderingAuthority=false`, `stateAuthority=false`, `publicationAuthority=false`, `serviceLifecycleAuthority=false`, `crossBodyMutationAuthority=false`, `privateVerseRummaging=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.

BIN
state/ledgers.msgpack
View file

Binary file not shown.

6
state/map.yaml
View file

@ -88,7 +88,7 @@ active_subgoals:
- Keep the landed Phase 6 coordinator, limited safe-boundary CRRC automation, and pre-compaction checkpoint intervention ready for the next bridge-equipped dogfood run.
- Preserve the Ghostlight-derived heartbeat initiative seam: every lane, including coordinator/Self and Persona, has a organ-state record and competes for heartbeat slots through readiness/reaction timing; initiative heat can raise or cool global, group, arena, role, and agent tempo through typed heartbeat policy; active thinking freezes initiative until completion, so heat never queues a lane already mid-turn; idle winners ruminate instead of inventing project work, and sleep windows distill the accumulated thought pressure into reviewed self-memory or doctrine.
- Use `notes/epiphany-swarm-readiness-plan.md` as the live-fire direction gate. The local run path is a compass, not launch clearance: before unattended swarm operation, Epiphany needs typed pause/brake enforcement, one initiative scheduler, completion-gated cooldown, stale active-turn recovery receipts, parent-side Persona speech eligibility, memory lifecycle operations, and CultNet-first operator snapshots/intents/receipts. The local Verse brake document exists, `epiphany-verse-query swarm-brake` can engage/release it, `tools/epiphany_local_run.ps1` refuses live `plan`/`run`/`mvp` modes when the brake is engaged while leaving `status` readable, `epiphany-mvp-coordinator` checks the local Verse brake before app-server startup, and `epiphany-heartbeat-store` guards tick/pump/heat/queue-mention/routine when given `--local-verse-store`. Daemon liveness is now a typed local Verse authority: `epiphany-verse-query daemon-status` writes one daemon status without repainting the table, local Verse seeding preserves existing daemon statuses and swarm brakes, `invoke-tool` refuses when the host daemon is not ready or lacks `submitTypedToolIntent`, and both daemon tool invocation and lifecycle poke fail closed under an engaged matching brake. `epiphany-daemon-supervisor policy` writes durable per-daemon restart policy with command/args/cwd/cooldown/backoff/attempt state plus reconcile cadence and stale-heartbeat threshold; `epiphany-daemon-supervisor reconcile` loads that policy when no override command is supplied, refuses under a matching lifecycle brake, refuses during cooldown/backoff, writes daemon poke intent/receipt, updates daemon status, and updates policy attempt state; `epiphany-daemon-supervisor tick` is an explicit scheduler pulse that scans durable policies, records ready/noop pulses, skips before the configured reconcile interval, marks stale heartbeat status degraded, routes restarts through the same brake/cooldown/poke receipt path, and writes a latest `epiphany.cultmesh.daemon_scheduler_receipt.v0`; `epiphany-daemon-supervisor serve` runs that same pulse on a configurable cadence with bounded `--max-iterations` proof mode or unbounded service mode. `epiphany-daemon-supervisor service-plan`/`install-service` now writes a planned `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` for the `serve` command, while `service-launch`/`start-service` spawns that `serve` loop through the current executable or `--service-command`, can `--wait-child` for bounded proof, and records command/args/cwd, scheduler id, daemon selector, pid/exit/status, artifact ref, and private-state guard. `service-runbook`, `windows-service-install`/`service-install-plan`, `windows-service-status`, `windows-service-reconcile`, `windows-service-execution-readiness`, and `windows-service-start`/`stop` now record service lifecycle receipts through the same local Verse; the read-only status path has been proved against the real Windows `EventLog` service with receipt `daemon-service-lifecycle-receipt-windows-eventlog-proof-windows-service-status`, status `running`, exit code `0`, and `privateStateExposed=false`; the read-only service-policy reconciliation path has been proved for missing service, real-service drift against `EventLog`, lifecycle-brake refusal, and wrapper/local-Verse receipt `daemon-service-lifecycle-receipt-windows-eventlog-reconcile-proof-windows-service-reconcile`; execution readiness has been proved as a non-mutating `not-elevated` receipt through direct and wrapper paths; start/stop now produce non-mutating `start-planned`/`stop-planned` receipts unless `--execute-control`/`--execute-service-control` is passed, and wrapper `service-start-plan`/`service-stop-plan` proves those receipts against `EventLog`; explicit install/control execution now refuses as `execution-refused-not-elevated` with `executed=false` when the shell lacks Windows administrator authority, and wrapper `service-install-execute`, `service-start-execute`, and `service-stop-execute` prove those refusal receipts without mutation. Service lifecycle actions check the local Verse swarm brake before process launch, artifact writes, service-manager queries, service-policy reconciliation, execution-readiness checks, control planning, elevation-gated execution, or start/stop execution. The local wrapper builds/checks this binary.
- Use `notes/epiphany-repo-swarm-mvp-contract.md` as the repo-swarm autonomy authority map. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruption, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Current safe-family cargo includes repo manifest, tool capability manifest, daemon-hosted tool request cargo, Eve/CultUI surface contract, repo collaboration policy, collaboration topics, consensus/objective/adoption/scheduling/work-order/verification/publication/sync/review/PR/credit/artifact/metrics/doctrine-update/secret-policy/deployment requests, action-item receipts, Mind adoption interpretation/decision receipts, explicit Mind safe-family refusal proof `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, explicit Mind requested-path/plan changed-path refusal proof `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, overview/public-proof/Gjallar/Eve readbacks, typed swarm-run stop classification, Idunn non-mutating queue-run lifecycle receipts, and fresh-repo upstream-main proof. Latest deployment cargo proof `.epiphany-smoke\repo-deployment-request-family-20260620-195605` shows `repo.deployment_request` closes through Soul while requesting reviewed git-push-observed-by-Idunn deployment with script/host/secret/rollback/aftercare requirements and no deployment/SSH/git-push/service authority. Latest security cargo proof `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` shows `repo.secret_policy_request` closes through Soul while requesting reviewed secret/write/export/deployment policy without exposing secrets or granting write/deployment/publication authority. Governance proof `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` shows `repo.doctrine_update_request` closes through Soul while requesting reviewed `AGENTS.md` doctrine work without mutating doctrine or granting Hands/service/publication authority. Swarm-run stop proofs now include `.epiphany-smoke\fresh-repo-mvp-20260620-180024` for `iteration-limit` / Self / `self.scheduler-iteration-limit` with upstream-main sync and public-proof export, plus `.epiphany-smoke\swarm-stop-classification-20260620-184717` for `queue-empty` / Gjallar / `repo.work.overview`, `dry-run-preview` / Self / `ready-to-run`, `authority-gated` / Bifrost / `awaiting-publication`, and `authority-gated` / Bifrost/GitHub / `awaiting-upstream-sync`; all stop packets are non-mutating, non-elevated, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853` now proves Idunn-owned non-mutating repo-work queue-run service plan/runbook receipts for exact service id `epiphany-repo-work-queue-runner`, receipt-directory readback, runbook SHA-256 `f2ec67c4f8243a3ebc2f9e915b6b9f5ae2ac2d99d2cdb86905b54667adc456f8`, `hostedBody=repo-work`, no service-manager mutation, no launch, no elevation, and `privateStateExposed=false`.
- Use `notes/epiphany-repo-swarm-mvp-contract.md` as the repo-swarm autonomy authority map. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruption, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Current safe-family cargo includes repo manifest, tool capability manifest, daemon-hosted tool request cargo, Eve/CultUI surface contract, repo collaboration policy, collaboration topics, consensus/objective/adoption/scheduling/work-order/verification/publication/sync/review/PR/credit/artifact/metrics/doctrine-update/secret-policy/deployment requests, repo deployment config, action-item receipts, Mind adoption interpretation/decision receipts, explicit Mind safe-family refusal proof `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, explicit Mind requested-path/plan changed-path refusal proof `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, overview/public-proof/Gjallar/Eve readbacks, typed swarm-run stop classification, Idunn non-mutating queue-run lifecycle receipts, and fresh-repo upstream-main proof. Latest deployment config proof `.epiphany-smoke\repo-deployment-config-family-20260620-211809` shows `repo.deployment_config` closes through Soul while writing disabled Idunn-owned git-push deployment config with script/hash review, host policy, secret policy, rollback, aftercare, Idunn CultMesh intent/receipt/aftercare contracts, daemon-owned execution, and no deployment/SSH/git-push/service authority. Latest deployment request proof `.epiphany-smoke\repo-deployment-request-family-20260620-195605` shows `repo.deployment_request` closes through Soul while requesting reviewed git-push-observed-by-Idunn deployment with script/host/secret/rollback/aftercare requirements and no deployment/SSH/git-push/service authority. Latest security cargo proof `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` shows `repo.secret_policy_request` closes through Soul while requesting reviewed secret/write/export/deployment policy without exposing secrets or granting write/deployment/publication authority. Governance proof `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` shows `repo.doctrine_update_request` closes through Soul while requesting reviewed `AGENTS.md` doctrine work without mutating doctrine or granting Hands/service/publication authority. Swarm-run stop proofs now include `.epiphany-smoke\fresh-repo-mvp-20260620-180024` for `iteration-limit` / Self / `self.scheduler-iteration-limit` with upstream-main sync and public-proof export, plus `.epiphany-smoke\swarm-stop-classification-20260620-184717` for `queue-empty` / Gjallar / `repo.work.overview`, `dry-run-preview` / Self / `ready-to-run`, `authority-gated` / Bifrost / `awaiting-publication`, and `authority-gated` / Bifrost/GitHub / `awaiting-upstream-sync`; all stop packets are non-mutating, non-elevated, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853` now proves Idunn-owned non-mutating repo-work queue-run service plan/runbook receipts for exact service id `epiphany-repo-work-queue-runner`, receipt-directory readback, runbook SHA-256 `f2ec67c4f8243a3ebc2f9e915b6b9f5ae2ac2d99d2cdb86905b54667adc456f8`, `hostedBody=repo-work`, no service-manager mutation, no launch, no elevation, and `privateStateExposed=false`.
- Mind-admitted repo-work map facts now leave local Verse sight. Successful `epiphany-work close` first admits `.epiphany/state/repo-work-map.msgpack` as `epiphany.repo_work_map_store.v0`, then mirrors the accepted item fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0` under `gamecult-local/repo-work-map/latest`. `epiphany-verse-query gjallar` exposes `repoWorkMapRows`, `repoWorkMapTuiRows`, and `latestRepoWorkMapEntry` with safe family, changed-path count, Soul verdict id, Mind review/commit ids, Bifrost gate, source map store ref, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` plus direct Gjallar readback showed one compact `REPO-WORK-MAP` row after counterfeit Mind adoption was refused and the real close passed. This is sight only; Gjallar still does not schedule, publish, merge, deploy, keep daemons alive, or open private state.
- Gjallar now derives the first repo-work map semantic lens from Mind-admitted local Verse map rows. `repoWorkMapFamilyLensRows` / `REPO-WORK-MAP-LENS` group accepted repo-work consequences by safe action family, with item count, changed-path count, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205055` reran the counterfeit-adoption guard and passed with `gjallarRepoWorkMapFamilyLensCount=1`. This is aggregate sight only, not scheduling, publication, merge, deployment, service lifecycle, or Mind admission authority.
- Gjallar now derives a changed-path repo-work map lens from the same Mind-admitted local Verse rows. `repoWorkMapPathLensRows` / `REPO-WORK-MAP-PATH` group accepted consequences by changed repo path, with item count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205740` passed with `gjallarRepoWorkMapPathLensCount=1` beside the family lens. This lets agents see which Body paths have accepted work without opening private receipts or granting Gjallar actuation authority.
@ -638,5 +638,5 @@ current_status:
- `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness.
- Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
- `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
last_completed_repo_swarm_cut: Gjallar now derives a branch-workbench semantic lens over Mind-admitted repo-work map rows. `epiphany-verse-query gjallar` exposes `repoWorkMapBranchLensRows` / `REPO-WORK-MAP-BRANCH`, grouping accepted consequences by branch with item count, changed-path count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`. Proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-210747` reran the counterfeit Mind-adoption guard, closed the original chain, projected the local Verse map row, and passed with `gjallarRepoWorkMapBranchLensCount=1` beside the family/path lenses.
next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `task-card` / `repo.task_card`, `repo-status-section` / `repo.status_section`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo-doctrine-update-request` / `repo.doctrine_update_request`, `repo-secret-policy-request` / `repo.secret_policy_request`, and `repo-deployment-request` / `repo.deployment_request`, typed Imagination action-item receipts over allowlisted safe families, `epiphany.repo_work_mind_interpretation.v0` plus `epiphany.repo_work_mind_adoption_decision.v0` Mind interpreter receipts, explicit safe-family allowlist refusal, explicit requested-path/plan-changed-path mismatch refusal, Soul closure's Mind-adoption proof guard, durable repo-work map admission before branch-local Hands consequences reach publication gates, local Verse `epiphany.cultmesh.repo_work_map_entry.v0` Gjallar readback for Mind-admitted map facts, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts including native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853`, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; proofs `.epiphany-smoke\fresh-repo-mvp-20260620-180024`, `.epiphany-smoke\swarm-stop-classification-20260620-184717`, `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140`, `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046`, `.epiphany-smoke\repo-deployment-request-family-20260620-195605`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-201153`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-202113`, and `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` show fresh-repo iteration-limit stop classification, empty-queue Gjallar classification, dry-run planning-preview Self classification, Bifrost publication-gate classification, Bifrost/GitHub upstream-sync gate classification, Mind refusal for unsupported safe-family cargo and mismatched requested paths, reviewed doctrine/security/deployment request cargo, closure refusal for counterfeit Mind adoption, durable repo-map admission only after passing closure, local Verse/Gjallar map projection, closure, publication receipts, upstream-main sync, public-proof export, and private-state sealing. The contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper semantic review/map lenses, further useful repo-owned config/action request families, or explicit Idunn deployment execution/audit under operator authority. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start/deployment execution still requires explicit elevated operator authority.
last_completed_repo_swarm_cut: `repo-deployment-config` is now branch-local Idunn deployment configuration cargo. `epiphany-work derive-plan --action-family repo-deployment-config` writes `.epiphany/deployment.toml` with safe family `repo.deployment_config`, disabled Idunn git-push trigger, watched ref, script ref plus hash/review requirement, host policy, secret policy, rollback, aftercare checks, Idunn CultMesh intent/receipt/aftercare contracts, daemon-owned execution, and no direct deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority. Proof `.epiphany-smoke\repo-deployment-config-family-20260620-211809` closed through Soul with `familyAssertions.status=passed`, `deploymentConfigEnabled=false`, `daemonOwnsExecution=true`, and `privateStateExposed=false`.
next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. Typed Gjallar repo-work history/queue sight, peer-readable Persona Eve lowering, Self-owned `epiphany-work queue-run`, bounded `epiphany-swarm run`, execute-to-close scheduler handoff through `close-from-execute`, deterministic `derive-plan` families `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `task-card` / `repo.task_card`, `repo-status-section` / `repo.status_section`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo-doctrine-update-request` / `repo.doctrine_update_request`, `repo-secret-policy-request` / `repo.secret_policy_request`, `repo-deployment-config` / `repo.deployment_config`, and `repo-deployment-request` / `repo.deployment_request`, typed Imagination action-item receipts over allowlisted safe families, `epiphany.repo_work_mind_interpretation.v0` plus `epiphany.repo_work_mind_adoption_decision.v0` Mind interpreter receipts, explicit safe-family allowlist refusal, explicit requested-path/plan-changed-path mismatch refusal, Soul closure's Mind-adoption proof guard, durable repo-work map admission before branch-local Hands consequences reach publication gates, local Verse `epiphany.cultmesh.repo_work_map_entry.v0` Gjallar readback for Mind-admitted map facts, hash-backed local proof bundles with Bifrost/GitHub/credit/PR/upstream-main publication rows, redacted `epiphany-work export-proof` public bundles plus local Verse `epiphany.cultmesh.repo_work_public_proof.v0` Gjallar readback, Bifrost-owned `gamecult.bifrost.public_proof_publication_receipt.v0` closure plus wrapper `bifrost-public-proof` for redacted public proofs, Idunn-hosted non-mutating queue-run lifecycle plan/runbook receipts including native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853`, and the speech-audited `epiphany-work persona-intake` mouth plus wrapper `repo-persona-intake` are live with `privateStateExposed=false`; proofs `.epiphany-smoke\fresh-repo-mvp-20260620-180024`, `.epiphany-smoke\swarm-stop-classification-20260620-184717`, `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140`, `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046`, `.epiphany-smoke\repo-deployment-config-family-20260620-211809`, `.epiphany-smoke\repo-deployment-request-family-20260620-195605`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-201153`, `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-202113`, and `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` show fresh-repo iteration-limit stop classification, empty-queue Gjallar classification, dry-run planning-preview Self classification, Bifrost publication-gate classification, Bifrost/GitHub upstream-sync gate classification, Mind refusal for unsupported safe-family cargo and mismatched requested paths, reviewed doctrine/security/deployment config/request cargo, closure refusal for counterfeit Mind adoption, durable repo-map admission only after passing closure, local Verse/Gjallar map projection, closure, publication receipts, upstream-main sync, public-proof export, and private-state sealing. The contract note now explicitly answers that Epiphany is headed toward a functional repo swarm but is not fully online until the typed artery runs as a living repo organism. The next cut is deeper interpreter/closure depth or explicit Idunn deployment execution/audit under operator authority. Preserve Idunn service lifecycle ownership and existing CultMesh/Odin/Eve tool directories; service install/start/deployment execution still requires explicit elevated operator authority.