diff --git a/epiphany-core/src/bin/epiphany-repo-pr-request-family-smoke.rs b/epiphany-core/src/bin/epiphany-repo-pr-request-family-smoke.rs index 0fee6f5f..1b3d4597 100644 --- a/epiphany-core/src/bin/epiphany-repo-pr-request-family-smoke.rs +++ b/epiphany-core/src/bin/epiphany-repo-pr-request-family-smoke.rs @@ -275,10 +275,10 @@ fn run_smoke(args: Args) -> Result { require_text(&request_text, "upstream_sync_authorized = false")?; require_text(&request_text, "hands_action_authorized = false")?; require_text(&request_text, "cross_body_mutation_authorized = false")?; - require_text( - &request_text, - "bifrost_or_maintainer_authority_required = true", - )?; + require_text(&request_text, "maintainer_review_required = true")?; + require_text(&request_text, "bifrost_publication_gate_required = true")?; + require_text(&request_text, "hands_execution_required = true")?; + require_text(&request_text, "github_provider_receipt_required = true")?; require_text(&request_text, "private_state_exposed = false")?; let summary = json!({ diff --git a/epiphany-core/src/bin/epiphany-repo-readiness-review-request-family-smoke.rs b/epiphany-core/src/bin/epiphany-repo-readiness-review-request-family-smoke.rs index f0e461ff..60394096 100644 --- a/epiphany-core/src/bin/epiphany-repo-readiness-review-request-family-smoke.rs +++ b/epiphany-core/src/bin/epiphany-repo-readiness-review-request-family-smoke.rs @@ -220,7 +220,7 @@ fn run_smoke(args: Args) -> Result { &request_text, "required_reviewers = [\"Maintainer\", \"Soul\", \"Mind\", \"Bifrost\"]", )?; - require_text(&request_text, "readiness_approval_owner = \"none\"")?; + require_text(&request_text, "readiness_approval_owner = \"Maintainer\"")?; require_text( &request_text, "requested_effect = \"review-redacted-repo-swarm-mvp-proof-bundle\"", @@ -231,7 +231,7 @@ fn run_smoke(args: Args) -> Result { )?; require_text( &request_text, - "review_is_advisory_until_maintainer_or_bifrost_acceptance = true", + "maintainer_readiness_acceptance_required = true", )?; require_text(&request_text, "[antecedents]")?; require_text(&request_text, "repo_init_required = true")?; @@ -337,10 +337,7 @@ fn run_smoke(args: Args) -> Result { require_text(&request_text, "hands_action_authorized = false")?; require_text(&request_text, "cross_body_mutation_authorized = false")?; require_text(&request_text, "private_verse_rummaging = false")?; - require_text( - &request_text, - "maintainer_soul_mind_or_bifrost_review_required = true", - )?; + require_text(&request_text, "maintainer_review_required = true")?; require_text(&request_text, "private_state_exposed = false")?; let summary = json!({ diff --git a/epiphany-core/src/bin/epiphany-work.rs b/epiphany-core/src/bin/epiphany-work.rs index bbb2d83f..1db7d24c 100644 --- a/epiphany-core/src/bin/epiphany-work.rs +++ b/epiphany-core/src/bin/epiphany-work.rs @@ -4443,7 +4443,10 @@ fn derive_repo_pr_request_plan( "service_lifecycle_authority = false".to_string(), "cross_body_mutation_authorized = false".to_string(), "private_verse_rummaging = false".to_string(), - "bifrost_or_maintainer_authority_required = true".to_string(), + "maintainer_review_required = true".to_string(), + "bifrost_publication_gate_required = true".to_string(), + "hands_execution_required = true".to_string(), + "github_provider_receipt_required = true".to_string(), String::new(), "[verification]".to_string(), "asks = [".to_string(), @@ -4737,7 +4740,8 @@ fn derive_repo_artifact_acceptance_request_plan( "service_lifecycle_authority = false".to_string(), "cross_body_mutation_authorized = false".to_string(), "private_verse_rummaging = false".to_string(), - "maintainer_or_bifrost_acceptance_authority_required = true".to_string(), + "maintainer_acceptance_authority_required = true".to_string(), + "bifrost_accounting_required = true".to_string(), String::new(), "[verification]".to_string(), "asks = [".to_string(), @@ -4981,10 +4985,11 @@ fn derive_repo_readiness_review_request_plan( "status = \"awaiting-mvp-readiness-review\"".to_string(), "routing_owner = \"Self\"".to_string(), "required_reviewers = [\"Maintainer\", \"Soul\", \"Mind\", \"Bifrost\"]".to_string(), - "readiness_approval_owner = \"none\"".to_string(), + "readiness_approval_owner = \"Maintainer\"".to_string(), "requested_effect = \"review-redacted-repo-swarm-mvp-proof-bundle\"".to_string(), "readiness_scope = \"fresh repo init, online swarm, Persona intake, Imagination planning, Self queue-run, Hands branch work, Soul closure, Modeling map update, Mind admission, Bifrost public proof, upstream-main sync, Idunn lifecycle, global tool directory, and private-state redaction\"".to_string(), - "review_is_advisory_until_maintainer_or_bifrost_acceptance = true".to_string(), + "maintainer_readiness_acceptance_required = true".to_string(), + "bifrost_publication_review_required = true".to_string(), String::new(), "[antecedents]".to_string(), "repo_init_required = true".to_string(), @@ -5047,7 +5052,10 @@ fn derive_repo_readiness_review_request_plan( "hands_action_authorized = false".to_string(), "cross_body_mutation_authorized = false".to_string(), "private_verse_rummaging = false".to_string(), - "maintainer_soul_mind_or_bifrost_review_required = true".to_string(), + "maintainer_review_required = true".to_string(), + "soul_verification_required = true".to_string(), + "mind_admission_required = true".to_string(), + "bifrost_publication_review_required = true".to_string(), String::new(), "[verification]".to_string(), "asks = [".to_string(), diff --git a/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs b/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs index 133f7e42..fe896d40 100644 --- a/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs +++ b/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs @@ -325,7 +325,8 @@ impl RepoArtifactAcceptanceRequest { && !a.service_lifecycle_authority && !a.cross_body_mutation_authorized && !a.private_verse_rummaging - && a.maintainer_or_bifrost_acceptance_authority_required + && a.maintainer_acceptance_authority_required + && a.bifrost_accounting_required } } @@ -387,7 +388,8 @@ struct RepoArtifactAcceptanceAuthority { service_lifecycle_authority: bool, cross_body_mutation_authorized: bool, private_verse_rummaging: bool, - maintainer_or_bifrost_acceptance_authority_required: bool, + maintainer_acceptance_authority_required: bool, + bifrost_accounting_required: bool, } pub(super) fn parse_repo_artifact_acceptance_request( @@ -842,7 +844,10 @@ impl RepoPrRequest { && !a.service_lifecycle_authority && !a.cross_body_mutation_authorized && !a.private_verse_rummaging - && a.bifrost_or_maintainer_authority_required + && a.maintainer_review_required + && a.bifrost_publication_gate_required + && a.hands_execution_required + && a.github_provider_receipt_required } } #[derive(Debug, Deserialize)] @@ -903,7 +908,10 @@ struct RepoPrAuthority { service_lifecycle_authority: bool, cross_body_mutation_authorized: bool, private_verse_rummaging: bool, - bifrost_or_maintainer_authority_required: bool, + maintainer_review_required: bool, + bifrost_publication_gate_required: bool, + hands_execution_required: bool, + github_provider_receipt_required: bool, } pub(super) fn parse_repo_pr_request(text: &str) -> Result { toml::from_str(text).context("PR request is not valid typed TOML") @@ -1059,9 +1067,10 @@ impl RepoReadinessReviewRequest { r.status == "awaiting-mvp-readiness-review" && r.routing_owner == "Self" && r.required_reviewers == ["Maintainer", "Soul", "Mind", "Bifrost"] - && r.readiness_approval_owner == "none" + && r.readiness_approval_owner == "Maintainer" && r.requested_effect == "review-redacted-repo-swarm-mvp-proof-bundle" - && r.review_is_advisory_until_maintainer_or_bifrost_acceptance + && r.maintainer_readiness_acceptance_required + && r.bifrost_publication_review_required } pub(super) fn has_antecedent_contract(&self) -> bool { @@ -1159,10 +1168,10 @@ impl RepoReadinessReviewRequest { denied .iter() .all(|key| self.authority.get(*key) == Some(&false)) - && self - .authority - .get("maintainer_soul_mind_or_bifrost_review_required") - == Some(&true) + && self.authority.get("maintainer_review_required") == Some(&true) + && self.authority.get("soul_verification_required") == Some(&true) + && self.authority.get("mind_admission_required") == Some(&true) + && self.authority.get("bifrost_publication_review_required") == Some(&true) } } @@ -1173,7 +1182,8 @@ struct RepoReadinessReviewBody { required_reviewers: Vec, readiness_approval_owner: String, requested_effect: String, - review_is_advisory_until_maintainer_or_bifrost_acceptance: bool, + maintainer_readiness_acceptance_required: bool, + bifrost_publication_review_required: bool, } #[derive(Debug, Deserialize)] diff --git a/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance_tests.rs b/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance_tests.rs index ef4690be..2205e1e7 100644 --- a/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance_tests.rs +++ b/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance_tests.rs @@ -13,9 +13,10 @@ private_state_exposed = false status = "awaiting-mvp-readiness-review" routing_owner = "Self" required_reviewers = ["Maintainer", "Soul", "Mind", "Bifrost"] -readiness_approval_owner = "none" +readiness_approval_owner = "Maintainer" requested_effect = "review-redacted-repo-swarm-mvp-proof-bundle" -review_is_advisory_until_maintainer_or_bifrost_acceptance = true +maintainer_readiness_acceptance_required = true +bifrost_publication_review_required = true [antecedents] [required_receipts] [readiness_packet] @@ -193,7 +194,8 @@ hands_action_authorized = false service_lifecycle_authority = false cross_body_mutation_authorized = false private_verse_rummaging = false -maintainer_or_bifrost_acceptance_authority_required = true +maintainer_acceptance_authority_required = true +bifrost_accounting_required = true "#; let request = parse_repo_artifact_acceptance_request(text).expect("fixture is typed TOML"); assert!(!request.has_authority_seals()); @@ -415,7 +417,10 @@ hands_action_authorized = false service_lifecycle_authority = false cross_body_mutation_authorized = false private_verse_rummaging = false -bifrost_or_maintainer_authority_required = true +maintainer_review_required = true +bifrost_publication_gate_required = true +hands_execution_required = true +github_provider_receipt_required = true "#; let request = parse_repo_pr_request(text).expect("fixture is typed TOML"); assert!(!request.has_authority_seals()); diff --git a/notes/conceptual-substitution-audit-2026-07-12.md b/notes/conceptual-substitution-audit-2026-07-12.md index 8d2fd4e5..7a2eb08c 100644 --- a/notes/conceptual-substitution-audit-2026-07-12.md +++ b/notes/conceptual-substitution-audit-2026-07-12.md @@ -1320,3 +1320,16 @@ The wider scan still finds composite decision fields in external governance (artifact acceptance, operator/maintainer consequence, PR authority, readiness) and composite labels in operator projections. These are the next named scars; they are not evidence that every slash in prose is an owner. + +The artifact-acceptance, PR, and readiness scars are now cut. Artifact +acceptance requires Maintainer acceptance and Bifrost accounting separately. +PR requests require Maintainer review, Bifrost publication gating, Hands +execution, and a GitHub provider receipt separately. Readiness no longer has +owner `none`: Maintainer owns the readiness verdict; Soul verification, Mind +admission, and Bifrost publication review remain conjunctive requirements. + +`operator_or_maintainer_authority_required` on upstream synchronization remains +unresolved rather than mechanically renamed. Operator authority and Maintainer +policy consent may be genuinely different inputs, but the current field does +not say whether either may execute, approve, or merely request synchronization. +Map the actual sync consequence path before cutting it. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 95d793ab..548b7d96 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -466,3 +466,12 @@ and Bifrost publication review are separately required. Dependency policy also requires supply-chain audit evidence. The next conceptual-substitution targets are the surviving composite decision fields in external governance and the composite owner labels in operator projections. + +Artifact acceptance, PR publication, and readiness seals are now aligned with +their split request bodies. Maintainer acceptance cannot substitute for Bifrost +accounting; Maintainer review cannot substitute for Bifrost publication, Hands +execution, or GitHub provider evidence; and readiness approval is Maintainer- +owned instead of ownerless. The unresolved external-governance field is +upstream sync's `operator_or_maintainer_authority_required`; trace its actual +effect owner before deciding whether it is alternate human authority or another +collapsed obligation. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 7dd5229f..4ac97d6c 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 3a8e0e39..8ebe5492 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -660,4 +660,4 @@ current_status: - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - next_action: Continue the beyond-closure composite-owner purge. Secret and dependency policy are split: Self routes, Mind admits, and Maintainer review, Soul verification, Mind admission, Bifrost publication review, plus dependency supply-chain audit are conjunctive. Next map the surviving external-governance OR fields (artifact acceptance, operator/maintainer consequence, PR authority, readiness) and composite owner labels in operator projections; distinguish genuine alternate human authority from collapsed organ ownership before cutting. Keep closure's zero-substring invariant intact. + next_action: Continue the beyond-closure composite-owner purge. Secret/dependency policy, artifact acceptance, PR publication, and readiness now use distinct routing, decision, verification, admission, execution, accounting, publication, and provider-evidence authorities. Next trace upstream sync's unresolved operator_or_maintainer_authority_required through the real consequence path before cutting it, then repair composite owner labels in operator projections. Distinguish genuine alternate human authority from collapsed organ ownership; keep closure's zero-substring invariant intact.