Separate external governance authorities

epiphany-core/src/bin/epiphany-repo-pr-request-family-smoke.rs

@@ -275,10 +275,10 @@ fn run_smoke(args: Args) -> Result<Value> {
     require_text(&request_text, "upstream_sync_authorized = false")?;
     require_text(&request_text, "hands_action_authorized = false")?;
     require_text(&request_text, "cross_body_mutation_authorized = false")?;
-    require_text(
-        &request_text,
-        "bifrost_or_maintainer_authority_required = true",
-    )?;
+    require_text(&request_text, "maintainer_review_required = true")?;
+    require_text(&request_text, "bifrost_publication_gate_required = true")?;
+    require_text(&request_text, "hands_execution_required = true")?;
+    require_text(&request_text, "github_provider_receipt_required = true")?;
     require_text(&request_text, "private_state_exposed = false")?;
 
     let summary = json!({

epiphany-core/src/bin/epiphany-repo-readiness-review-request-family-smoke.rs

@@ -220,7 +220,7 @@ fn run_smoke(args: Args) -> Result<Value> {
         &request_text,
         "required_reviewers = [\"Maintainer\", \"Soul\", \"Mind\", \"Bifrost\"]",
     )?;
-    require_text(&request_text, "readiness_approval_owner = \"none\"")?;
+    require_text(&request_text, "readiness_approval_owner = \"Maintainer\"")?;
     require_text(
         &request_text,
         "requested_effect = \"review-redacted-repo-swarm-mvp-proof-bundle\"",
@@ -231,7 +231,7 @@ fn run_smoke(args: Args) -> Result<Value> {
     )?;
     require_text(
         &request_text,
-        "review_is_advisory_until_maintainer_or_bifrost_acceptance = true",
+        "maintainer_readiness_acceptance_required = true",
     )?;
     require_text(&request_text, "[antecedents]")?;
     require_text(&request_text, "repo_init_required = true")?;
@@ -337,10 +337,7 @@ fn run_smoke(args: Args) -> Result<Value> {
     require_text(&request_text, "hands_action_authorized = false")?;
     require_text(&request_text, "cross_body_mutation_authorized = false")?;
     require_text(&request_text, "private_verse_rummaging = false")?;
-    require_text(
-        &request_text,
-        "maintainer_soul_mind_or_bifrost_review_required = true",
-    )?;
+    require_text(&request_text, "maintainer_review_required = true")?;
     require_text(&request_text, "private_state_exposed = false")?;
 
     let summary = json!({

epiphany-core/src/bin/epiphany-work.rs

@@ -4443,7 +4443,10 @@ fn derive_repo_pr_request_plan(
         "service_lifecycle_authority = false".to_string(),
         "cross_body_mutation_authorized = false".to_string(),
         "private_verse_rummaging = false".to_string(),
-        "bifrost_or_maintainer_authority_required = true".to_string(),
+        "maintainer_review_required = true".to_string(),
+        "bifrost_publication_gate_required = true".to_string(),
+        "hands_execution_required = true".to_string(),
+        "github_provider_receipt_required = true".to_string(),
         String::new(),
         "[verification]".to_string(),
         "asks = [".to_string(),
@@ -4737,7 +4740,8 @@ fn derive_repo_artifact_acceptance_request_plan(
         "service_lifecycle_authority = false".to_string(),
         "cross_body_mutation_authorized = false".to_string(),
         "private_verse_rummaging = false".to_string(),
-        "maintainer_or_bifrost_acceptance_authority_required = true".to_string(),
+        "maintainer_acceptance_authority_required = true".to_string(),
+        "bifrost_accounting_required = true".to_string(),
         String::new(),
         "[verification]".to_string(),
         "asks = [".to_string(),
@@ -4981,10 +4985,11 @@ fn derive_repo_readiness_review_request_plan(
         "status = \"awaiting-mvp-readiness-review\"".to_string(),
         "routing_owner = \"Self\"".to_string(),
         "required_reviewers = [\"Maintainer\", \"Soul\", \"Mind\", \"Bifrost\"]".to_string(),
-        "readiness_approval_owner = \"none\"".to_string(),
+        "readiness_approval_owner = \"Maintainer\"".to_string(),
         "requested_effect = \"review-redacted-repo-swarm-mvp-proof-bundle\"".to_string(),
         "readiness_scope = \"fresh repo init, online swarm, Persona intake, Imagination planning, Self queue-run, Hands branch work, Soul closure, Modeling map update, Mind admission, Bifrost public proof, upstream-main sync, Idunn lifecycle, global tool directory, and private-state redaction\"".to_string(),
-        "review_is_advisory_until_maintainer_or_bifrost_acceptance = true".to_string(),
+        "maintainer_readiness_acceptance_required = true".to_string(),
+        "bifrost_publication_review_required = true".to_string(),
         String::new(),
         "[antecedents]".to_string(),
         "repo_init_required = true".to_string(),
@@ -5047,7 +5052,10 @@ fn derive_repo_readiness_review_request_plan(
         "hands_action_authorized = false".to_string(),
         "cross_body_mutation_authorized = false".to_string(),
         "private_verse_rummaging = false".to_string(),
-        "maintainer_soul_mind_or_bifrost_review_required = true".to_string(),
+        "maintainer_review_required = true".to_string(),
+        "soul_verification_required = true".to_string(),
+        "mind_admission_required = true".to_string(),
+        "bifrost_publication_review_required = true".to_string(),
         String::new(),
         "[verification]".to_string(),
         "asks = [".to_string(),

epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs

@@ -325,7 +325,8 @@ impl RepoArtifactAcceptanceRequest {
             && !a.service_lifecycle_authority
             && !a.cross_body_mutation_authorized
             && !a.private_verse_rummaging
-            && a.maintainer_or_bifrost_acceptance_authority_required
+            && a.maintainer_acceptance_authority_required
+            && a.bifrost_accounting_required
     }
 }
 
@@ -387,7 +388,8 @@ struct RepoArtifactAcceptanceAuthority {
     service_lifecycle_authority: bool,
     cross_body_mutation_authorized: bool,
     private_verse_rummaging: bool,
-    maintainer_or_bifrost_acceptance_authority_required: bool,
+    maintainer_acceptance_authority_required: bool,
+    bifrost_accounting_required: bool,
 }
 
 pub(super) fn parse_repo_artifact_acceptance_request(
@@ -842,7 +844,10 @@ impl RepoPrRequest {
             && !a.service_lifecycle_authority
             && !a.cross_body_mutation_authorized
             && !a.private_verse_rummaging
-            && a.bifrost_or_maintainer_authority_required
+            && a.maintainer_review_required
+            && a.bifrost_publication_gate_required
+            && a.hands_execution_required
+            && a.github_provider_receipt_required
     }
 }
 #[derive(Debug, Deserialize)]
@@ -903,7 +908,10 @@ struct RepoPrAuthority {
     service_lifecycle_authority: bool,
     cross_body_mutation_authorized: bool,
     private_verse_rummaging: bool,
-    bifrost_or_maintainer_authority_required: bool,
+    maintainer_review_required: bool,
+    bifrost_publication_gate_required: bool,
+    hands_execution_required: bool,
+    github_provider_receipt_required: bool,
 }
 pub(super) fn parse_repo_pr_request(text: &str) -> Result<RepoPrRequest> {
     toml::from_str(text).context("PR request is not valid typed TOML")
@@ -1059,9 +1067,10 @@ impl RepoReadinessReviewRequest {
         r.status == "awaiting-mvp-readiness-review"
             && r.routing_owner == "Self"
             && r.required_reviewers == ["Maintainer", "Soul", "Mind", "Bifrost"]
-            && r.readiness_approval_owner == "none"
+            && r.readiness_approval_owner == "Maintainer"
             && r.requested_effect == "review-redacted-repo-swarm-mvp-proof-bundle"
-            && r.review_is_advisory_until_maintainer_or_bifrost_acceptance
+            && r.maintainer_readiness_acceptance_required
+            && r.bifrost_publication_review_required
     }
 
     pub(super) fn has_antecedent_contract(&self) -> bool {
@@ -1159,10 +1168,10 @@ impl RepoReadinessReviewRequest {
         denied
             .iter()
             .all(|key| self.authority.get(*key) == Some(&false))
-            && self
-                .authority
-                .get("maintainer_soul_mind_or_bifrost_review_required")
-                == Some(&true)
+            && self.authority.get("maintainer_review_required") == Some(&true)
+            && self.authority.get("soul_verification_required") == Some(&true)
+            && self.authority.get("mind_admission_required") == Some(&true)
+            && self.authority.get("bifrost_publication_review_required") == Some(&true)
     }
 }
 
@@ -1173,7 +1182,8 @@ struct RepoReadinessReviewBody {
     required_reviewers: Vec<String>,
     readiness_approval_owner: String,
     requested_effect: String,
-    review_is_advisory_until_maintainer_or_bifrost_acceptance: bool,
+    maintainer_readiness_acceptance_required: bool,
+    bifrost_publication_review_required: bool,
 }
 
 #[derive(Debug, Deserialize)]

epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance_tests.rs

@@ -13,9 +13,10 @@ private_state_exposed = false
 status = "awaiting-mvp-readiness-review"
 routing_owner = "Self"
 required_reviewers = ["Maintainer", "Soul", "Mind", "Bifrost"]
-readiness_approval_owner = "none"
+readiness_approval_owner = "Maintainer"
 requested_effect = "review-redacted-repo-swarm-mvp-proof-bundle"
-review_is_advisory_until_maintainer_or_bifrost_acceptance = true
+maintainer_readiness_acceptance_required = true
+bifrost_publication_review_required = true
 [antecedents]
 [required_receipts]
 [readiness_packet]
@@ -193,7 +194,8 @@ hands_action_authorized = false
 service_lifecycle_authority = false
 cross_body_mutation_authorized = false
 private_verse_rummaging = false
-maintainer_or_bifrost_acceptance_authority_required = true
+maintainer_acceptance_authority_required = true
+bifrost_accounting_required = true
 "#;
         let request = parse_repo_artifact_acceptance_request(text).expect("fixture is typed TOML");
         assert!(!request.has_authority_seals());
@@ -415,7 +417,10 @@ hands_action_authorized = false
 service_lifecycle_authority = false
 cross_body_mutation_authorized = false
 private_verse_rummaging = false
-bifrost_or_maintainer_authority_required = true
+maintainer_review_required = true
+bifrost_publication_gate_required = true
+hands_execution_required = true
+github_provider_receipt_required = true
 "#;
         let request = parse_repo_pr_request(text).expect("fixture is typed TOML");
         assert!(!request.has_authority_seals());

notes/conceptual-substitution-audit-2026-07-12.md

@@ -1320,3 +1320,16 @@ The wider scan still finds composite decision fields in external governance
 (artifact acceptance, operator/maintainer consequence, PR authority, readiness)
 and composite labels in operator projections. These are the next named scars;
 they are not evidence that every slash in prose is an owner.
+
+The artifact-acceptance, PR, and readiness scars are now cut. Artifact
+acceptance requires Maintainer acceptance and Bifrost accounting separately.
+PR requests require Maintainer review, Bifrost publication gating, Hands
+execution, and a GitHub provider receipt separately. Readiness no longer has
+owner `none`: Maintainer owns the readiness verdict; Soul verification, Mind
+admission, and Bifrost publication review remain conjunctive requirements.
+
+`operator_or_maintainer_authority_required` on upstream synchronization remains
+unresolved rather than mechanically renamed. Operator authority and Maintainer
+policy consent may be genuinely different inputs, but the current field does
+not say whether either may execute, approve, or merely request synchronization.
+Map the actual sync consequence path before cutting it.

notes/fresh-workspace-handoff.md

@@ -466,3 +466,12 @@ and Bifrost publication review are separately required. Dependency policy also
 requires supply-chain audit evidence. The next conceptual-substitution targets
 are the surviving composite decision fields in external governance and the
 composite owner labels in operator projections.
+
+Artifact acceptance, PR publication, and readiness seals are now aligned with
+their split request bodies. Maintainer acceptance cannot substitute for Bifrost
+accounting; Maintainer review cannot substitute for Bifrost publication, Hands
+execution, or GitHub provider evidence; and readiness approval is Maintainer-
+owned instead of ownerless. The unresolved external-governance field is
+upstream sync's `operator_or_maintainer_authority_required`; trace its actual
+effect owner before deciding whether it is alternate human authority or another
+collapsed obligation.

state/map.yaml

@@ -660,4 +660,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Continue the beyond-closure composite-owner purge. Secret and dependency policy are split: Self routes, Mind admits, and Maintainer review, Soul verification, Mind admission, Bifrost publication review, plus dependency supply-chain audit are conjunctive. Next map the surviving external-governance OR fields (artifact acceptance, operator/maintainer consequence, PR authority, readiness) and composite owner labels in operator projections; distinguish genuine alternate human authority from collapsed organ ownership before cutting. Keep closure's zero-substring invariant intact.
+  next_action: Continue the beyond-closure composite-owner purge. Secret/dependency policy, artifact acceptance, PR publication, and readiness now use distinct routing, decision, verification, admission, execution, accounting, publication, and provider-evidence authorities. Next trace upstream sync's unresolved operator_or_maintainer_authority_required through the real consequence path before cutting it, then repair composite owner labels in operator projections. Distinguish genuine alternate human authority from collapsed organ ownership; keep closure's zero-substring invariant intact.