From 90e14c3dc67dbccb9472cd4f2e9076af81b69f8f Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 12 Jul 2026 22:42:01 +0100 Subject: [PATCH] Delete synthetic Idunn completion --- ...any-repo-deployment-config-family-smoke.rs | 716 ------------------ .../bin/epiphany-repo-swarm-mvp-gate-smoke.rs | 48 -- epiphany-core/src/cultmesh_integration.rs | 97 --- epiphany-core/src/lib.rs | 2 - ...onceptual-substitution-audit-2026-07-12.md | 15 + notes/epiphany-current-algorithmic-map.md | 1 + notes/fresh-workspace-handoff.md | 4 + ...eipt-writer-provenance-audit-2026-07-12.md | 9 +- state/ledgers.msgpack | Bin 441460 -> 441872 bytes state/map.yaml | 6 +- 10 files changed, 31 insertions(+), 867 deletions(-) delete mode 100644 epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs diff --git a/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs b/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs deleted file mode 100644 index 5028a529..00000000 --- a/epiphany-core/src/bin/epiphany-repo-deployment-config-family-smoke.rs +++ /dev/null @@ -1,716 +0,0 @@ -use anyhow::Context; -use anyhow::Result; -use anyhow::anyhow; -use chrono::Utc; -use epiphany_core::EpiphanyCultMeshIdunnAftercareAuditReceiptEntry; -use epiphany_core::EpiphanyCultMeshIdunnDeploymentReceiptEntry; -use epiphany_core::write_epiphany_cultmesh_idunn_aftercare_audit_receipt; -use epiphany_core::write_epiphany_cultmesh_idunn_deployment_receipt; -use serde_json::Value; -use serde_json::json; -use std::env; -use std::fs; -use std::path::Path; -use std::path::PathBuf; -use std::process::Command; - -fn main() -> Result<()> { - let args = Args::parse()?; - let result = run_smoke(args)?; - println!("{}", serde_json::to_string_pretty(&result)?); - Ok(()) -} - -#[derive(Clone, Debug)] -struct Args { - root: PathBuf, -} - -impl Args { - fn parse() -> Result { - let mut root = env::current_dir().context("failed to resolve current directory")?; - let mut args = env::args().skip(1).peekable(); - while let Some(arg) = args.next() { - match arg.as_str() { - "--root" => root = take_path(&mut args, "--root")?, - other => return Err(anyhow!("unexpected argument {other:?}")), - } - } - Ok(Self { root }) - } -} - -fn run_smoke(args: Args) -> Result { - let root = args - .root - .canonicalize() - .with_context(|| format!("failed to resolve {}", args.root.display()))?; - let manifest = root.join("epiphany-core").join("Cargo.toml"); - if !manifest.exists() { - return Err(anyhow!( - "could not find epiphany-core manifest at {}", - manifest.display() - )); - } - let smoke_root = root.join(".epiphany-smoke"); - fs::create_dir_all(&smoke_root) - .with_context(|| format!("failed to create {}", smoke_root.display()))?; - let stamp = Utc::now().format("%Y%m%d-%H%M%S").to_string(); - let smoke_dir = smoke_root.join(format!("repo-deployment-config-family-{stamp}")); - if smoke_dir.exists() { - fs::remove_dir_all(&smoke_dir) - .with_context(|| format!("failed to clear {}", smoke_dir.display()))?; - } - fs::create_dir_all(&smoke_dir) - .with_context(|| format!("failed to create {}", smoke_dir.display()))?; - - let repo = smoke_dir.join("repo-body"); - fs::create_dir_all(&repo).with_context(|| format!("failed to create {}", repo.display()))?; - git(["init"], &repo)?; - git( - ["config", "user.email", "epiphany-smoke@example.invalid"], - &repo, - )?; - git(["config", "user.name", "Epiphany Smoke"], &repo)?; - fs::write( - repo.join("README.md"), - "# Repo Deployment Config Family Smoke\n\nThis repository proves branch-local Idunn deployment config cargo without deploy authority.\n", - ) - .with_context(|| format!("failed to seed {}", repo.join("README.md").display()))?; - fs::create_dir_all(repo.join("deploy")) - .with_context(|| format!("failed to create {}", repo.join("deploy").display()))?; - fs::write( - repo.join("deploy").join("idunn-deploy.ps1"), - "# reviewed by Idunn before use\nWrite-Output 'deployment script placeholder'\n", - ) - .with_context(|| { - format!( - "failed to seed {}", - repo.join("deploy").join("idunn-deploy.ps1").display() - ) - })?; - git(["add", "README.md", "deploy/idunn-deploy.ps1"], &repo)?; - git( - ["commit", "-m", "Seed repo deployment config smoke body"], - &repo, - )?; - git( - ["switch", "-c", "epiphany/repo-deployment-config-family"], - &repo, - )?; - - let item = "repo-deployment-config-family"; - let target_path = ".epiphany/deployment.toml"; - let local_verse = repo.join(".epiphany").join("local-verse.ccmp"); - cargo_json( - &manifest, - "epiphany-repo", - &[ - "init", - "--workspace", - path_str(&repo)?, - "--epiphany-root", - path_str(&root)?, - "--swarm-id", - "repo-deployment-config-family-smoke", - "--topic", - "repo-deployment-config-family", - ], - &root, - )?; - cargo_json( - &manifest, - "epiphany-swarm", - &[ - "online", - "--workspace", - path_str(&repo)?, - "--epiphany-root", - path_str(&root)?, - "--runtime-id", - "repo-deployment-config-family-smoke", - "--local-verse-store", - path_str(&local_verse)?, - ], - &root, - )?; - cargo_json( - &manifest, - "epiphany-work", - &[ - "accept", - "--workspace", - path_str(&repo)?, - "--from", - "persona", - "--item", - item, - "--summary", - "Configure an Idunn-watched git-push deployment contract without granting deployment authority.", - "--candidate-action-ref", - "candidate-action://repo-deployment-config-family/idunn-config", - "--public-discussion-ref", - "epiphany-global/persona-collaboration/repo-deployment-config-family", - ], - &root, - )?; - let plan = cargo_json( - &manifest, - "epiphany-work", - &[ - "derive-plan", - "--workspace", - path_str(&repo)?, - "--item", - item, - "--action-family", - "repo-deployment-config", - "--model-ref", - "repo-deployment-config-family-smoke-imagination-v1", - "--model-authored", - ], - &root, - )?; - for _ in 0..4 { - cargo_json( - &manifest, - "epiphany-work", - &[ - "tick", - "--workspace", - path_str(&repo)?, - "--epiphany-root", - path_str(&root)?, - "--item", - item, - "--cooldown-seconds", - "0", - ], - &root, - )?; - } - - let close = read_json( - &repo - .join(".epiphany") - .join("work") - .join(format!("work-close-{item}.json")), - )?; - let config_text = fs::read_to_string(repo.join(target_path)) - .with_context(|| format!("failed to read {}", repo.join(target_path).display()))?; - let deploy_script_text = fs::read_to_string(repo.join("deploy").join("idunn-deploy.ps1")) - .with_context(|| { - format!( - "failed to read {}", - repo.join("deploy").join("idunn-deploy.ps1").display() - ) - })?; - let audit = cargo_json( - &manifest, - "epiphany-work", - &["deployment-config-audit", "--workspace", path_str(&repo)?], - &root, - )?; - let runbook = cargo_json( - &manifest, - "epiphany-work", - &[ - "deployment-execution-runbook", - "--workspace", - path_str(&repo)?, - ], - &root, - )?; - let current_commit = git_output(["rev-parse", "HEAD"], &repo)?; - let idunn_deployment_receipt_id = "fixture-idunn-deployment"; - let idunn_aftercare_receipt_id = "fixture-idunn-aftercare"; - write_epiphany_cultmesh_idunn_deployment_receipt( - &local_verse, - "repo-deployment-config-family-smoke", - EpiphanyCultMeshIdunnDeploymentReceiptEntry { - schema_version: "gamecult.idunn.deployment_receipt.v0".to_string(), - receipt_id: idunn_deployment_receipt_id.to_string(), - runtime_id: "repo-deployment-config-family-smoke".to_string(), - verse_id: "gamecult-local".to_string(), - status: "deployed".to_string(), - trigger: "git-push-observed-by-idunn".to_string(), - watched_ref: "refs/heads/main".to_string(), - source_commit: current_commit, - result_ref: "idunn://deployment/fixture-idunn-deployment".to_string(), - result_summary: - "Fixture Idunn deployment receipt proves the repo audit can ingest sealed CultMesh receipt refs." - .to_string(), - private_state_exposed: false, - notes: vec![ - "Idunn owns deployment execution; this local Verse row is an operator-safe receipt projection." - .to_string(), - ], - }, - )?; - write_epiphany_cultmesh_idunn_aftercare_audit_receipt( - &local_verse, - "repo-deployment-config-family-smoke", - EpiphanyCultMeshIdunnAftercareAuditReceiptEntry { - schema_version: "gamecult.idunn.deployment_aftercare_audit.v0".to_string(), - receipt_id: idunn_aftercare_receipt_id.to_string(), - runtime_id: "repo-deployment-config-family-smoke".to_string(), - verse_id: "gamecult-local".to_string(), - status: "complete".to_string(), - checked_ref: "refs/heads/main".to_string(), - deployment_receipt_id: idunn_deployment_receipt_id.to_string(), - audit_ref: "idunn://deployment-aftercare/fixture-idunn-aftercare".to_string(), - result_summary: - "Fixture Idunn aftercare audit receipt proves the repo audit can close from sealed CultMesh receipt refs." - .to_string(), - private_state_exposed: false, - notes: vec![ - "Idunn owns aftercare; this local Verse row exposes status without private deployment state." - .to_string(), - ], - }, - )?; - let aftercare = cargo_json( - &manifest, - "epiphany-work", - &[ - "deployment-aftercare-audit", - "--workspace", - path_str(&repo)?, - "--local-verse-store", - path_str(&local_verse)?, - "--runtime-id", - "repo-deployment-config-family-smoke", - "--idunn-deployment-receipt-ref", - "latest", - "--aftercare-audit-receipt-ref", - "latest", - ], - &root, - )?; - let swarm_overview = cargo_json( - &manifest, - "epiphany-verse-query", - &[ - "swarm-overview", - "--store", - path_str(&local_verse)?, - "--runtime-id", - "repo-deployment-config-family-smoke", - ], - &root, - )?; - - require_eq( - &plan, - &["derivation", "safeActionFamily"], - "repo.deployment_config", - )?; - require_eq(&close, &["status"], "closed")?; - require_eq(&close, &["soul", "verdict"], "passed")?; - require_eq( - &close, - &["closureReview", "familyAssertions", "status"], - "passed", - )?; - require_bool( - &close, - &["closureReview", "sourceGrounding", "pathScopeMatched"], - true, - )?; - require_bool(&close, &["privateStateExposed"], false)?; - require_text( - &config_text, - "schema_version = \"epiphany.repo_deployment_config.v0\"", - )?; - require_text( - &config_text, - "safe_action_family = \"repo.deployment_config\"", - )?; - require_text(&config_text, "enabled = false")?; - require_text(&config_text, "owner = \"Idunn\"")?; - require_text(&config_text, "trigger = \"git-push-observed-by-idunn\"")?; - require_text(&config_text, "watched_ref = \"refs/heads/main\"")?; - require_text( - &config_text, - "deployment_script_ref = \"deploy/idunn-deploy.ps1\"", - )?; - require_text(&config_text, "deployment_script_hash_required = true")?; - require_text(&config_text, "deployment_script_review_required = true")?; - require_text(&config_text, "host_access_policy_ref_required = true")?; - require_text(&config_text, "secret_values_embedded = false")?; - require_text(&config_text, "rollback_plan_ref_required = true")?; - require_text(&config_text, "aftercare_checks_required = true")?; - require_text(&config_text, "idunn_receipt_required = true")?; - require_text(&config_text, "aftercare_audit_required = true")?; - require_text( - &config_text, - "capability_family = \"gamecult.idunn.deployment\"", - )?; - require_text( - &config_text, - "intent_contract = \"gamecult.idunn.deployment_intent.v0\"", - )?; - require_text( - &config_text, - "receipt_contract = \"gamecult.idunn.deployment_receipt.v0\"", - )?; - require_text( - &config_text, - "aftercare_contract = \"gamecult.idunn.deployment_aftercare_audit.v0\"", - )?; - require_text(&config_text, "daemon_owns_execution = true")?; - require_text(&config_text, "configuration_only = true")?; - require_text(&config_text, "direct_deployment_authority = false")?; - require_text(&config_text, "direct_ssh_authority = false")?; - require_text(&config_text, "direct_git_push_authority = false")?; - require_text(&config_text, "direct_service_lifecycle_authority = false")?; - require_text(&config_text, "direct_hands_authority = false")?; - require_text(&config_text, "publication_authorized = false")?; - require_text(&config_text, "cross_body_mutation_authorized = false")?; - require_text(&config_text, "private_verse_rummaging = false")?; - require_text(&config_text, "private_state_exposed = false")?; - require_text(&deploy_script_text, "deployment script placeholder")?; - require_eq( - &audit, - &["schemaVersion"], - "epiphany.repo_deployment_config_audit.v0", - )?; - require_eq(&audit, &["status"], "ready-for-idunn-review")?; - require_bool(&audit, &["readyForIdunnReview"], true)?; - require_bool(&audit, &["executionAuthorized"], false)?; - require_bool(&audit, &["deploymentAuthority"], false)?; - require_bool(&audit, &["sshAuthority"], false)?; - require_bool(&audit, &["gitPushAuthority"], false)?; - require_bool(&audit, &["serviceLifecycleAuthority"], false)?; - require_bool(&audit, &["handsAuthority"], false)?; - require_bool(&audit, &["publicationAuthorized"], false)?; - require_bool(&audit, &["mergeAuthorized"], false)?; - require_bool(&audit, &["daemonOwnsExecution"], true)?; - require_bool(&audit, &["privateStateExposed"], false)?; - require_eq( - &runbook, - &["schemaVersion"], - "epiphany.repo_deployment_execution_runbook.v0", - )?; - require_eq(&runbook, &["status"], "ready-for-operator-git-push")?; - require_bool(&runbook, &["runbookWritten"], true)?; - require_bool(&runbook, &["requiresExplicitOperatorAuthority"], true)?; - require_bool(&runbook, &["mutatesRemoteWhenRun"], true)?; - require_bool(&runbook, &["executionAuthorized"], false)?; - require_bool(&runbook, &["deploymentAuthority"], false)?; - require_bool(&runbook, &["sshAuthority"], false)?; - require_bool(&runbook, &["gitPushAuthority"], false)?; - require_bool(&runbook, &["serviceLifecycleAuthority"], false)?; - require_bool(&runbook, &["handsAuthority"], false)?; - require_bool(&runbook, &["publicationAuthorized"], false)?; - require_bool(&runbook, &["mergeAuthorized"], false)?; - require_bool(&runbook, &["daemonOwnsExecution"], true)?; - require_bool(&runbook, &["privateStateExposed"], false)?; - require_eq(&runbook, &["watchedRef"], "refs/heads/main")?; - let runbook_path = value_at_path(&runbook, &["runbookPath"]) - .and_then(Value::as_str) - .ok_or_else(|| anyhow!("missing runbook path"))?; - let runbook_text = fs::read_to_string(runbook_path) - .with_context(|| format!("failed to read runbook {runbook_path}"))?; - require_text( - &runbook_text, - "schema_version = \"epiphany.repo_deployment_execution_runbook.v0\"", - )?; - require_text(&runbook_text, "git push $Remote HEAD:refs/heads/main")?; - require_text( - &runbook_text, - "gamecult.idunn.deployment_aftercare_audit.v0", - )?; - require_eq( - &aftercare, - &["schemaVersion"], - "epiphany.repo_deployment_aftercare_audit.v0", - )?; - require_eq(&aftercare, &["status"], "complete")?; - require_bool(&aftercare, &["deploymentComplete"], true)?; - require_bool(&aftercare, &["mutatesRemoteWhenRun"], false)?; - require_bool(&aftercare, &["executionAuthorized"], false)?; - require_bool(&aftercare, &["deploymentAuthority"], false)?; - require_bool(&aftercare, &["sshAuthority"], false)?; - require_bool(&aftercare, &["gitPushAuthority"], false)?; - require_bool(&aftercare, &["serviceLifecycleAuthority"], false)?; - require_bool(&aftercare, &["handsAuthority"], false)?; - require_bool(&aftercare, &["publicationAuthorized"], false)?; - require_bool(&aftercare, &["mergeAuthorized"], false)?; - require_bool(&aftercare, &["daemonOwnsExecution"], true)?; - require_bool(&aftercare, &["privateStateExposed"], false)?; - require_eq( - &aftercare, - &["idunnDeploymentReceipt", "source"], - "cultmesh", - )?; - require_eq( - &aftercare, - &["idunnDeploymentReceipt", "receiptId"], - idunn_deployment_receipt_id, - )?; - require_eq( - &aftercare, - &["idunnAftercareAuditReceipt", "source"], - "cultmesh", - )?; - require_eq( - &aftercare, - &["idunnAftercareAuditReceipt", "receiptId"], - idunn_aftercare_receipt_id, - )?; - require_eq( - &aftercare, - &["idunnDeploymentReceipt", "schemaVersion"], - "gamecult.idunn.deployment_receipt.v0", - )?; - require_eq( - &aftercare, - &["idunnAftercareAuditReceipt", "schemaVersion"], - "gamecult.idunn.deployment_aftercare_audit.v0", - )?; - require_eq( - &swarm_overview, - &["latestIdunnDeploymentReceipt"], - idunn_deployment_receipt_id, - )?; - require_eq( - &swarm_overview, - &["latestIdunnAftercareAuditReceipt"], - idunn_aftercare_receipt_id, - )?; - require_u64(&swarm_overview, &["idunnDeploymentReceiptCount"], 2)?; - require_bool(&swarm_overview, &["privateStateExposed"], false)?; - require_array_contains( - &swarm_overview, - &["idunnDeploymentReceiptTuiRows"], - "IDUNN-DEPLOYMENT", - )?; - require_array_contains( - &swarm_overview, - &["idunnDeploymentReceiptTuiRows"], - idunn_deployment_receipt_id, - )?; - require_array_contains( - &swarm_overview, - &["idunnDeploymentReceiptTuiRows"], - idunn_aftercare_receipt_id, - )?; - - let summary = json!({ - "schemaVersion": "epiphany.repo_deployment_config_family_smoke.v0", - "status": "ok", - "smokeDir": smoke_dir, - "repo": repo, - "branch": git_output(["branch", "--show-current"], &repo)?, - "item": item, - "safeActionFamily": plan["derivation"]["safeActionFamily"], - "targetPath": target_path, - "closeStatus": close["status"], - "soulVerdict": close["soul"]["verdict"], - "familyAssertionsStatus": close["closureReview"]["familyAssertions"]["status"], - "pathScopeMatched": close["closureReview"]["sourceGrounding"]["pathScopeMatched"], - "deploymentConfigEnabled": false, - "deploymentConfigAuditStatus": audit["status"], - "deploymentConfigAuditReceiptPath": audit["receiptPath"], - "readyForIdunnReview": audit["readyForIdunnReview"], - "deploymentExecutionRunbookStatus": runbook["status"], - "deploymentExecutionRunbookPath": runbook["runbookPath"], - "deploymentExecutionRunbookSha256": runbook["runbookSha256"], - "requiresExplicitOperatorAuthority": runbook["requiresExplicitOperatorAuthority"], - "mutatesRemoteWhenRun": runbook["mutatesRemoteWhenRun"], - "deploymentAftercareAuditStatus": aftercare["status"], - "deploymentComplete": aftercare["deploymentComplete"], - "idunnDeploymentReceiptSource": aftercare["idunnDeploymentReceipt"]["source"], - "idunnAftercareAuditReceiptSource": aftercare["idunnAftercareAuditReceipt"]["source"], - "idunnDeploymentReceiptId": aftercare["idunnDeploymentReceipt"]["receiptId"], - "idunnAftercareAuditReceiptId": aftercare["idunnAftercareAuditReceipt"]["receiptId"], - "swarmOverviewIdunnDeploymentReceiptCount": swarm_overview["idunnDeploymentReceiptCount"], - "swarmOverviewLatestIdunnDeploymentReceipt": swarm_overview["latestIdunnDeploymentReceipt"], - "swarmOverviewLatestIdunnAftercareAuditReceipt": swarm_overview["latestIdunnAftercareAuditReceipt"], - "deploymentTrigger": "git-push-observed-by-idunn", - "deploymentOwner": "Idunn", - "daemonOwnsExecution": true, - "deploymentAuthority": false, - "sshAuthority": false, - "gitPushAuthority": false, - "serviceLifecycleAuthority": false, - "privateStateExposed": false, - }); - write_json(&smoke_dir.join("summary.json"), &summary)?; - Ok(summary) -} - -fn cargo_json(manifest: &Path, bin: &str, args: &[&str], cwd: &Path) -> Result { - let output = Command::new("cargo") - .arg("run") - .arg("--quiet") - .arg("--manifest-path") - .arg(manifest) - .arg("--bin") - .arg(bin) - .arg("--") - .args(args) - .current_dir(cwd) - .output() - .with_context(|| format!("failed to run cargo bin {bin}"))?; - if !output.status.success() { - return Err(anyhow!( - "{bin} failed with status {:?}\nstdout:\n{}\nstderr:\n{}", - output.status.code(), - String::from_utf8_lossy(&output.stdout), - String::from_utf8_lossy(&output.stderr) - )); - } - serde_json::from_slice(&output.stdout).with_context(|| { - format!( - "{bin} did not emit JSON on stdout:\n{}", - String::from_utf8_lossy(&output.stdout) - ) - }) -} - -fn git(args: [&str; N], cwd: &Path) -> Result<()> { - let output = Command::new("git") - .args(args) - .current_dir(cwd) - .output() - .with_context(|| format!("failed to run git in {}", cwd.display()))?; - if output.status.success() { - Ok(()) - } else { - Err(anyhow!( - "git {:?} failed in {}\nstdout:\n{}\nstderr:\n{}", - args, - cwd.display(), - String::from_utf8_lossy(&output.stdout), - String::from_utf8_lossy(&output.stderr) - )) - } -} - -fn git_output(args: [&str; N], cwd: &Path) -> Result { - let output = Command::new("git") - .args(args) - .current_dir(cwd) - .output() - .with_context(|| format!("failed to run git in {}", cwd.display()))?; - if output.status.success() { - Ok(String::from_utf8_lossy(&output.stdout).trim().to_string()) - } else { - Err(anyhow!( - "git {:?} failed in {}\nstdout:\n{}\nstderr:\n{}", - args, - cwd.display(), - String::from_utf8_lossy(&output.stdout), - String::from_utf8_lossy(&output.stderr) - )) - } -} - -fn read_json(path: &Path) -> Result { - let bytes = fs::read(path).with_context(|| format!("failed to read {}", path.display()))?; - serde_json::from_slice(&bytes).with_context(|| format!("failed to parse {}", path.display())) -} - -fn write_json(path: &Path, value: &Value) -> Result<()> { - let bytes = serde_json::to_vec_pretty(value)?; - fs::write(path, bytes).with_context(|| format!("failed to write {}", path.display())) -} - -fn require_eq(value: &Value, path: &[&str], expected: &str) -> Result<()> { - let actual = value_at_path(value, path) - .and_then(Value::as_str) - .ok_or_else(|| anyhow!("missing string at {}", path.join(".")))?; - if actual == expected { - Ok(()) - } else { - Err(anyhow!( - "expected {} at {}, got {}", - expected, - path.join("."), - actual - )) - } -} - -fn require_bool(value: &Value, path: &[&str], expected: bool) -> Result<()> { - let actual = value_at_path(value, path) - .and_then(Value::as_bool) - .ok_or_else(|| anyhow!("missing bool at {}", path.join(".")))?; - if actual == expected { - Ok(()) - } else { - Err(anyhow!( - "expected {} at {}, got {}", - expected, - path.join("."), - actual - )) - } -} - -fn require_u64(value: &Value, path: &[&str], expected: u64) -> Result<()> { - let actual = value_at_path(value, path) - .and_then(Value::as_u64) - .ok_or_else(|| anyhow!("missing unsigned integer at {}", path.join(".")))?; - if actual == expected { - Ok(()) - } else { - Err(anyhow!( - "expected {} at {}, got {}", - expected, - path.join("."), - actual - )) - } -} - -fn require_array_contains(value: &Value, path: &[&str], needle: &str) -> Result<()> { - let array = value_at_path(value, path) - .and_then(Value::as_array) - .ok_or_else(|| anyhow!("missing array at {}", path.join(".")))?; - if array - .iter() - .filter_map(Value::as_str) - .any(|item| item.contains(needle)) - { - Ok(()) - } else { - Err(anyhow!( - "expected array at {} to contain {:?}", - path.join("."), - needle - )) - } -} - -fn require_text(text: &str, needle: &str) -> Result<()> { - if text.contains(needle) { - Ok(()) - } else { - Err(anyhow!("expected generated text to contain {needle:?}")) - } -} - -fn value_at_path<'a>(value: &'a Value, path: &[&str]) -> Option<&'a Value> { - let mut cursor = value; - for segment in path { - cursor = cursor.get(*segment)?; - } - Some(cursor) -} - -fn take_path(args: &mut std::iter::Peekable, flag: &str) -> Result -where - I: Iterator, -{ - args.next() - .map(PathBuf::from) - .ok_or_else(|| anyhow!("{flag} requires a value")) -} - -fn path_str(path: &Path) -> Result<&str> { - path.to_str() - .ok_or_else(|| anyhow!("path is not valid UTF-8: {}", path.display())) -} diff --git a/epiphany-core/src/bin/epiphany-repo-swarm-mvp-gate-smoke.rs b/epiphany-core/src/bin/epiphany-repo-swarm-mvp-gate-smoke.rs index 599accb3..884b39b8 100644 --- a/epiphany-core/src/bin/epiphany-repo-swarm-mvp-gate-smoke.rs +++ b/epiphany-core/src/bin/epiphany-repo-swarm-mvp-gate-smoke.rs @@ -53,7 +53,6 @@ struct Args { fresh_repo_summary: Option, readiness_summary: Option, bifrost_accounting_summary: Option, - deployment_handoff_summary: Option, daemon_survival_summary: Option, } @@ -64,7 +63,6 @@ impl Args { let mut fresh_repo_summary = None; let mut readiness_summary = None; let mut bifrost_accounting_summary = None; - let mut deployment_handoff_summary = None; let mut daemon_survival_summary = None; let mut args = env::args().skip(1).peekable(); while let Some(arg) = args.next() { @@ -81,10 +79,6 @@ impl Args { bifrost_accounting_summary = Some(take_path(&mut args, "--bifrost-accounting-summary")?) } - "--deployment-handoff-summary" => { - deployment_handoff_summary = - Some(take_path(&mut args, "--deployment-handoff-summary")?) - } "--daemon-survival-summary" => { daemon_survival_summary = Some(take_path(&mut args, "--daemon-survival-summary")?) @@ -98,7 +92,6 @@ impl Args { fresh_repo_summary, readiness_summary, bifrost_accounting_summary, - deployment_handoff_summary, daemon_survival_summary, }) } @@ -136,9 +129,6 @@ fn run_smoke(args: Args) -> Result { let bifrost_accounting_summary = args .bifrost_accounting_summary .unwrap_or_else(|| latest_summary(&args.smoke_root, "repo-bifrost-accounting-bundle-")); - let deployment_handoff_summary = args - .deployment_handoff_summary - .unwrap_or_else(|| latest_summary(&args.smoke_root, "repo-deployment-config-family-")); let daemon_survival_summary = args .daemon_survival_summary .unwrap_or_else(|| latest_summary(&args.smoke_root, "daemon-survival-rehearsal-")); @@ -146,13 +136,11 @@ fn run_smoke(args: Args) -> Result { let fresh = read_json(&fresh_repo_summary)?; let readiness = read_json(&readiness_summary)?; let bifrost = read_json(&bifrost_accounting_summary)?; - let deployment_handoff = read_json(&deployment_handoff_summary)?; let daemon_survival = read_json(&daemon_survival_summary)?; verify_fresh_repo(&fresh)?; verify_readiness(&readiness)?; verify_bifrost_accounting(&bifrost)?; - verify_deployment_handoff(&deployment_handoff)?; verify_daemon_survival(&daemon_survival)?; let weksa_interlingua = verify_weksa_interlingua()?; let persona_memory_recall = verify_persona_memory_recall()?; @@ -215,11 +203,6 @@ fn run_smoke(args: Args) -> Result { "Bifrost", "readiness, artifact acceptance, and metrics accounting rows are closed", ), - green( - "idunn-deployment-handoff", - "Idunn", - "deployment config, operator runbook, and aftercare receipt readback are sealed", - ), green( "long-running-daemon-proof", "Idunn", @@ -263,12 +246,10 @@ fn run_smoke(args: Args) -> Result { "freshRepoSummary": fresh_repo_summary, "readinessSummary": readiness_summary, "bifrostAccountingSummary": bifrost_accounting_summary, - "deploymentHandoffSummary": deployment_handoff_summary, "daemonSurvivalSummary": daemon_survival_summary, "freshRepoSmokeDir": fresh["smokeDir"], "readinessSmokeDir": readiness["smokeDir"], "bifrostAccountingSmokeDir": bifrost["smokeDir"], - "deploymentHandoffSmokeDir": deployment_handoff["smokeDir"], "daemonSurvivalSmokeDir": daemon_survival["smokeDir"], "weksaInterlingua": weksa_interlingua, "personaMemoryRecall": persona_memory_recall, @@ -399,35 +380,6 @@ fn verify_daemon_survival(value: &Value) -> Result<()> { require_bool(value, &["privateStateExposed"], false) } -fn verify_deployment_handoff(value: &Value) -> Result<()> { - require_eq( - value, - &["schemaVersion"], - "epiphany.repo_deployment_config_family_smoke.v0", - )?; - require_eq(value, &["status"], "ok")?; - require_bool(value, &["deploymentConfigEnabled"], false)?; - require_eq( - value, - &["deploymentConfigAuditStatus"], - "ready-for-idunn-review", - )?; - require_bool(value, &["readyForIdunnReview"], true)?; - require_eq( - value, - &["deploymentExecutionRunbookStatus"], - "ready-for-operator-git-push", - )?; - require_eq(value, &["deploymentAftercareAuditStatus"], "complete")?; - require_bool(value, &["deploymentComplete"], true)?; - require_eq(value, &["idunnDeploymentReceiptSource"], "cultmesh")?; - require_eq(value, &["idunnAftercareAuditReceiptSource"], "cultmesh")?; - require_eq(value, &["deploymentTrigger"], "git-push-observed-by-idunn")?; - require_eq(value, &["deploymentOwner"], "Idunn")?; - require_bool(value, &["deploymentAuthority"], false)?; - require_bool(value, &["privateStateExposed"], false) -} - fn verify_weksa_interlingua() -> Result { let packet = build_weksa_interlingua_packet(WeksaInterlinguaInput { packet_id: "repo-swarm-mvp-gate-weksa-packet".to_string(), diff --git a/epiphany-core/src/cultmesh_integration.rs b/epiphany-core/src/cultmesh_integration.rs index c3f1dd57..b2698a0d 100644 --- a/epiphany-core/src/cultmesh_integration.rs +++ b/epiphany-core/src/cultmesh_integration.rs @@ -3574,23 +3574,6 @@ pub fn load_epiphany_cultmesh_managed_service_policies( .collect()) } -pub fn write_epiphany_cultmesh_idunn_deployment_receipt( - store_path: impl AsRef, - runtime_id: impl Into, - receipt: EpiphanyCultMeshIdunnDeploymentReceiptEntry, -) -> Result { - validate_idunn_deployment_receipt(&receipt)?; - let mut node = open_epiphany_cultmesh_node(store_path, runtime_id)?; - let receipt_key = epiphany_cultmesh_idunn_deployment_receipt_key(&receipt.receipt_id); - let written = node.put(receipt_key.as_str(), &receipt)?; - node.put( - EPIPHANY_CULTMESH_IDUNN_DEPLOYMENT_RECEIPT_LATEST_KEY, - &written, - )?; - node.flush()?; - Ok(written) -} - pub fn load_epiphany_cultmesh_idunn_deployment_receipt( store_path: impl AsRef, runtime_id: impl Into, @@ -3609,23 +3592,6 @@ pub fn load_latest_epiphany_cultmesh_idunn_deployment_receipt( node.get(EPIPHANY_CULTMESH_IDUNN_DEPLOYMENT_RECEIPT_LATEST_KEY) } -pub fn write_epiphany_cultmesh_idunn_aftercare_audit_receipt( - store_path: impl AsRef, - runtime_id: impl Into, - receipt: EpiphanyCultMeshIdunnAftercareAuditReceiptEntry, -) -> Result { - validate_idunn_aftercare_audit_receipt(&receipt)?; - let mut node = open_epiphany_cultmesh_node(store_path, runtime_id)?; - let receipt_key = epiphany_cultmesh_idunn_aftercare_audit_receipt_key(&receipt.receipt_id); - let written = node.put(receipt_key.as_str(), &receipt)?; - node.put( - EPIPHANY_CULTMESH_IDUNN_AFTERCARE_AUDIT_RECEIPT_LATEST_KEY, - &written, - )?; - node.flush()?; - Ok(written) -} - pub fn load_epiphany_cultmesh_idunn_aftercare_audit_receipt( store_path: impl AsRef, runtime_id: impl Into, @@ -4029,69 +3995,6 @@ fn validate_daemon_service_lifecycle_receipt( Ok(()) } -fn validate_idunn_deployment_receipt( - receipt: &EpiphanyCultMeshIdunnDeploymentReceiptEntry, -) -> Result<()> { - if receipt.private_state_exposed { - return Err(anyhow!( - "Idunn deployment receipts must not expose private state" - )); - } - if receipt.schema_version != EPIPHANY_CULTMESH_IDUNN_DEPLOYMENT_RECEIPT_SCHEMA_VERSION { - return Err(anyhow!( - "Idunn deployment receipt schema_version must be {:?}", - EPIPHANY_CULTMESH_IDUNN_DEPLOYMENT_RECEIPT_SCHEMA_VERSION - )); - } - for (label, value) in [ - ("receipt id", receipt.receipt_id.as_str()), - ("runtime id", receipt.runtime_id.as_str()), - ("verse id", receipt.verse_id.as_str()), - ("status", receipt.status.as_str()), - ("trigger", receipt.trigger.as_str()), - ("watched ref", receipt.watched_ref.as_str()), - ("result ref", receipt.result_ref.as_str()), - ] { - if value.trim().is_empty() { - return Err(anyhow!("Idunn deployment receipt missing {label}")); - } - } - Ok(()) -} - -fn validate_idunn_aftercare_audit_receipt( - receipt: &EpiphanyCultMeshIdunnAftercareAuditReceiptEntry, -) -> Result<()> { - if receipt.private_state_exposed { - return Err(anyhow!( - "Idunn aftercare audit receipts must not expose private state" - )); - } - if receipt.schema_version != EPIPHANY_CULTMESH_IDUNN_AFTERCARE_AUDIT_RECEIPT_SCHEMA_VERSION { - return Err(anyhow!( - "Idunn aftercare audit receipt schema_version must be {:?}", - EPIPHANY_CULTMESH_IDUNN_AFTERCARE_AUDIT_RECEIPT_SCHEMA_VERSION - )); - } - for (label, value) in [ - ("receipt id", receipt.receipt_id.as_str()), - ("runtime id", receipt.runtime_id.as_str()), - ("verse id", receipt.verse_id.as_str()), - ("status", receipt.status.as_str()), - ("checked ref", receipt.checked_ref.as_str()), - ( - "deployment receipt id", - receipt.deployment_receipt_id.as_str(), - ), - ("audit ref", receipt.audit_ref.as_str()), - ] { - if value.trim().is_empty() { - return Err(anyhow!("Idunn aftercare audit receipt missing {label}")); - } - } - Ok(()) -} - pub fn epiphany_cultmesh_daemon_tool_invocation_intent_from_capability( intent_id: impl Into, requesting_agent_id: impl Into, diff --git a/epiphany-core/src/lib.rs b/epiphany-core/src/lib.rs index 51ede66b..94c6ef89 100644 --- a/epiphany-core/src/lib.rs +++ b/epiphany-core/src/lib.rs @@ -500,8 +500,6 @@ pub use cultmesh_integration::write_epiphany_cultmesh_eyes_contracts; pub use cultmesh_integration::write_epiphany_cultmesh_global_room_policies; pub use cultmesh_integration::write_epiphany_cultmesh_hands_action_gate; pub use cultmesh_integration::write_epiphany_cultmesh_hands_contracts; -pub use cultmesh_integration::write_epiphany_cultmesh_idunn_aftercare_audit_receipt; -pub use cultmesh_integration::write_epiphany_cultmesh_idunn_deployment_receipt; #[cfg(test)] pub use cultmesh_integration::write_epiphany_cultmesh_imagination_consensus_receipt; pub use cultmesh_integration::write_epiphany_cultmesh_managed_service_policy; diff --git a/notes/conceptual-substitution-audit-2026-07-12.md b/notes/conceptual-substitution-audit-2026-07-12.md index 71df356d..a63578ac 100644 --- a/notes/conceptual-substitution-audit-2026-07-12.md +++ b/notes/conceptual-substitution-audit-2026-07-12.md @@ -264,3 +264,18 @@ The smoke persists the requester intent, requires the host receipt to remain absent, and verifies the directory reports a missing response. The typed schema and reader remain the host-daemon/ingest contract; no shipped generic CLI can author the daemon's answer. + +## Fixture-authored Idunn completion + +Idunn deployment and aftercare writers had no Idunn production caller. Their +only shipped caller was `epiphany-repo-deployment-config-family-smoke`, which +created `deployed` and `complete` receipts, fed them into aftercare, and then +advertised deployment completion through swarm overview. The aggregate MVP gate +accepted that smoke summary as a green Idunn deployment handoff. + +The entire synthetic deployment-config family smoke is deleted, along with the +orphaned local Idunn deployment/aftercare writers and validators. The aggregate +MVP gate no longer accepts its summary or publishes a green deployment row. +Deployment config audit and operator runbook commands remain requester/operator +surfaces; typed Idunn schemas/readers remain ingest contracts. Only an actual +Idunn body may make deployment or aftercare complete. diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index 422efe7f..200cc781 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -49,6 +49,7 @@ - Eve connection requests remain pending until a real target provider daemon or authenticated ingest boundary supplies the typed response. The former generic `epiphany-eve-provider` CLI is deleted because caller-supplied provider identity and status did not constitute provider participation; local response construction/writing is test-only. - Daemon-tool invocation requests likewise remain pending until the advertised host daemon or authenticated ingest boundary supplies the typed response. Local response construction/writing/validation is test-only; aggregate smoke and receipt-directory projection prove intent-present/receipt-missing instead of manufacturing host acceptance. +- Idunn deployment and aftercare outcomes have no local production writer. The synthetic deployment-config family smoke and its green aggregate MVP-gate handoff are deleted; config audit/runbook remain pre-deployment surfaces, while typed Idunn readers await genuine daemon-authored ingest. - Persona owner: `collaboration-feedback` writes public, bounded feedback only after that provider receipt exists. - Imagination owner: consensus participant selection, packet reference, receipt status/id, and adoption gate. - Persona output: `pending-imagination` with null consensus fields and `responseOwner=Imagination`. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 9f9303f0..444fcdd8 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -60,6 +60,10 @@ The confirmed conceptual substitutions have been cut: - daemon-tool response construction/writing is also test-only. No shipped host daemon currently responds; the aggregate smoke proves a pending intent and a missing host receipt rather than fabricating Hands acceptance. +- the deployment-config family smoke and its aggregate MVP-gate row are deleted: + they fabricated Idunn `deployed`/`complete` receipts. Epiphany exposes config + audit/runbook requests and typed Idunn readers, but no local deployment or + aftercare response writer. The presentation boundary is now plain: `swarm overview` is a generic compact read-only projection. Gjallar is a downstream TUI application on Nightwing and is not an Epiphany organ, provider, owner, runtime, or architectural dependency. Eve/CultUI graphs may be lowered or composited downstream without Epiphany caring which presentation client does it. diff --git a/notes/receipt-writer-provenance-audit-2026-07-12.md b/notes/receipt-writer-provenance-audit-2026-07-12.md index 993c280b..c4f9cfe5 100644 --- a/notes/receipt-writer-provenance-audit-2026-07-12.md +++ b/notes/receipt-writer-provenance-audit-2026-07-12.md @@ -15,6 +15,10 @@ Inventory every production call to `write_*receipt`, then ask whether the execut smoke was the only shipped caller and manufactured host acceptance; response constructor/writer/validator/key are test-only pending a real host-daemon or authenticated ingest boundary. +- Idunn deployment and aftercare receipts: no production local writers. The + deployment-config family smoke was their only caller and fabricated a closed + deployment chain; the smoke, writers, and validators are deleted. Typed + schemas/readers remain for genuine Idunn-authored ingest. - `epiphany-operator-run`: owner-aligned for operator-run receipts and coordinator receipts derived from the run it executes. - smoke binaries and the `epiphany-verse-query smoke` arm: fixtures, not runtime evidence. They remain a quarantine risk if permitted to target canonical stores. - `epiphany-work` Weksa lowering: a lowering projection receipt, explicitly non-publication authority; no substitution confirmed in this pass. @@ -46,7 +50,10 @@ Negative proof passed both directions: a plan command given hostile `--execute-i ## Standalone receipt-smoke quarantine update -The two standalone smoke binaries found writing canonical receipt schemas no longer accept receipt-store destinations. `epiphany-repo-deployment-config-family-smoke` accepts only `--root` and derives its entire disposable repo/Verse body under `/.epiphany-smoke`; `--smoke-root` is rejected. `epiphany-weksa-interlingua-smoke` accepts no arguments and writes only `.epiphany-smoke/weksa-interlingua/local-verse.ccmp`. Attempts to redirect either at live state fail before fixture construction. +The remaining standalone Weksa receipt smoke accepts no arguments and writes +only `.epiphany-smoke/weksa-interlingua/local-verse.ccmp`. The former Idunn +deployment-config receipt smoke is deleted rather than preserved behind path +quarantine because its claimed lifecycle never occurred. ## Orphaned provider response API quarantine diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 50e0b333e0acd00c4c336526fcd896ea19d03e3b..ca994db81fa8dbcc36b489345582aea55736b1f3 100644 GIT binary patch delta 368 zcmYL@Ax{HA5QW);p247?DTpE1mZqT?kYETQK_PHUcka4$Z|B(EYjYR`0tu!$$8R7( zkTziX5g5V`AVDAy2)5TIh?kjU-n{pH|J3e&YY$bn*lz7?Z=Jr*h0mXl8|;Fy>h&wW5ROicVY1Z0 zdth12%E_eu$ww*ba8=x&SJrw1BOMxB8v9&H!5ta9342o%o(buiCevp`y$K4J8d8Ie xf9hRudFn$Aa#1D?xO5Ps&ZNc}tJE>t;$.toml` with manifest inventory, lockfile policy, package-manager command review, network fetch policy, vulnerability/license/vendored-code/update-cadence requirements, Eyes/Soul/Mind/maintainer/Bifrost/dependency-audit receipt refs, and denials for dependency update, package install, lockfile mutation, network fetch, CI mutation, Hands, publication, merge, deployment, service lifecycle, cross-body mutation, private Verse rummaging, and private-state exposure. Proof `.epiphany-smoke\repo-dependency-policy-request-family-20260621-083433` closes through Soul with `familyAssertionsStatus=passed`, `pathScopeMatched=true`, `awaitingDependencyPolicyReview=true`, all direct dependency/package/network/CI authorities false, and `privateStateExposed=false`. - Repo planning brief cargo now carries the family-friendly safe-family matrix plus explicit candidate action and closure shapes. `repo-planning-brief` still lowers to safe family `repo.planning_brief` and writes `.epiphany/planning-briefs/.toml`, but it now names twenty-one candidate next safe families across preparation, adoption/queue, execution/review, publication/accounting, and policy/deployment groups, including `repo.readiness_review_request` for redacted repo-swarm MVP proof-bundle review before readiness claims. Each candidate must name id, safe family, owner, status, requested paths, verification asks, evidence needs, closure proofs, authority denials, and next gate, with statuses such as `ready-for-mind-review`, `ready-for-self-queue`, `blocked-needs-evidence`, and `closed` while remaining non-queue entries. The closure ladder names draft selection, Self queue-run, Hands receipts, Soul verdict, Modeling/Mind map admission, Bifrost publication or non-publication, Idunn deployment/config when in scope, and redaction closure. Closure `safeFamilyPlanning` readback now reports grouped matrix completeness, matrix controls, candidate-action-template presence, closure proof presence, closure-ladder presence, and authority denials while granting no scheduling, substrate, Hands, shell, commit, publication, deployment, service lifecycle, cross-body, private-transcript, raw-result, or private-state authority. Proof `.epiphany-smoke\repo-planning-brief-family-20260621-114826` closes through Soul with `candidateNextSafeFamilyCount=21`, `candidateActionTemplatePresent=true`, `allMatrixGroupsComplete=true`, `matrixControlsPresent=true`, `allClosureProofsPresent=true`, `closureLadderPresent=true`, `authorityDenied=true`, and `privateStateExposed=false`; wrapper swarm overview proof `local-20260621-124924-844-17b352e7` reads the accepted `repo.planning_brief` closure/acceptance rows from the repo-local Verse without private-state exposure. - Repo-work readiness sight is live and now leaves typed local Verse rows. `epiphany-work readiness` reuses the existing overview/proof-bundle artery, inspects repo init, swarm online, Persona intake, Imagination plan, Self queue-run, Hands execute, Soul closure, Modeling/Mind admission, public proof, Bifrost publication, upstream-main sync, Idunn lifecycle, daemon tool directory, and private-state redaction rows, then writes `.epiphany/work/work-readiness-.json` as `epiphany.repo_work_readiness_report.v0` and mirrors compact `epiphany.cultmesh.repo_work_readiness.v0` into the repo-local Verse when the accept receipt names a local Verse store. swarm overview/swarm-overview/swarm-triage expose `repoWorkReadinessRows`, `REPO-WORK-READINESS` TUI rows, `latestRepoWorkReadiness`, and non-mutating `repo-work-readiness` action rows. It is sight only: no readiness approval, durable state commit, publication, PR, merge, sync, deployment, service lifecycle, Hands action, cross-body mutation, private Verse rummaging, or private-state exposure authority. Proof `.epiphany-smoke\repo-work-readiness-20260621-094043` drove a fresh repo through init/online/intake/checklist execution/closure/queue-run/public-proof export; readiness reported `not-ready`, `missingRequiredCount=4` for Bifrost publication, upstream-main sync, Idunn lifecycle, and tool directory, wrote readiness id `repo-work-readiness-repo-work-readiness`, swarm overview reported `repoWorkReadinessCount=1`, and authority denials held. - Repo-swarm Mind interpretation cargo is live. `repo-interpreter-brief` lowers to safe family `repo.interpreter_brief` and writes `.epiphany/interpreter-briefs/.toml` as draft Mind-owned interpretation from Imagination consensus, with semantic checks, candidate safe families, required Mind/Soul/Bifrost/Hands/Substrate/Idunn gates, and explicit denials for direct state commit, objective adoption, scheduling, substrate access, Hands action, shell, commit, publication, deployment execution, service lifecycle, cross-body mutation, private transcripts/raw results, and private-state exposure. Proof `.epiphany-smoke\repo-interpreter-brief-family-20260621-010858` closes through Soul with `familyAssertions.status=passed`, `mindOwnsInterpretation=true`, `candidateActionsNonAuthoritative=true`, `directStateCommitAuthorized=false`, `handsActionAuthorized=false`, and `privateStateExposed=false`. - Idunn-hosted repo-work queue-run lifecycle now has plan/runbook/launch/audit closure under explicit operator authority. `epiphany-daemon-supervisor repo-work-service-audit` reads all typed service lifecycle receipts for `epiphany-repo-work-queue-runner`, requires planned install-plan, written local runbook artifact, completed launch with exit code `0`, and no private-state exposure, then writes a `repo-work-service-audit` receipt with `status=complete` or `incomplete`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260621-004202` proves plan/runbook/launch/audit with `auditStatus=complete`, `auditRunbookArtifactStatus=present`, `auditLaunchExitCode=0`, `mutatesServiceManager=false`, `requiresElevatedAuthority=false`, and `privateStateExposed=false`. Wrapper proofs `local-20260621-014302-362-31bbef47`, `local-20260621-014337-108-cbd99615`, `local-20260621-014413-125-09e183c5`, and `local-20260621-014558-197-f6951806` prove operator plan/runbook/launch/audit ergonomics, with audit reporting no missing or failed checks. Basic queue-run service lifecycle readiness is sealed; remaining Idunn work is optional elevated install/start execution under explicit operator authority, not Self scheduling authority. - - swarm overview/Odin sight now exposes Idunn deployment receipt refs without taking Idunn's execution throne. `EpiphanyLocalVerseContext`, `receipt-directory`, `swarm-overview`, `swarm-triage`, and `swarm-overview` surface latest `gamecult.idunn.deployment_receipt.v0` and `gamecult.idunn.deployment_aftercare_audit.v0` as compact `idunnDeploymentReceiptRows` / `IDUNN-DEPLOYMENT` rows with owner `Idunn`, watched/checked refs, source/result refs, aftercare ids, follow-up readback command, and `privateStateExposed=false`. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-223203` proves the aftercare audit still ingests CultMesh refs and swarm overview reports `swarm-overviewIdunnDeploymentReceiptCount=2`, latest deployment receipt `fixture-idunn-deployment`, latest aftercare receipt `fixture-idunn-aftercare`, and no private-state exposure. This is citeable discovery only; deployment still happens by explicit operator `git push` observed by Idunn. + - Swarm overview may read genuine typed Idunn deployment/aftercare receipts without taking lifecycle authority. No shipped Epiphany writer can create those outcomes; absent Idunn ingest remains visibly absent. - Mind adoption now has an explicit evidence-readiness refusal gate for plan-derived repo work. `derive-plan` carries verification asks into the Imagination action-item receipt; `adopt --from-plan` records verification asks and planning evidence needs in `epiphany.repo_work_mind_interpretation.v0` and refuses empty verification asks or evidence needs as `refused-missing-evidence-needs`, with next gate `imagination.replan_with_explicit_soul_evidence_needs`. Proof `.epiphany-smoke\repo-mind-evidence-guard-20260620-224426` grants no Hands/durable/service/publication/cross-body/private authority and writes no adoption receipt after tampering both arrays empty; regression `.epiphany-smoke\repo-planning-facets-20260620-224428` shows normal planning facets still close through Soul/Modeling/Mind. - Soul closure can now require verification-output source grounding. `epiphany-work close` records `epiphany.repo_work_verification_source_grounding_review.v0` in the closure review and `--require-source-grounding` refuses verifier output that does not cite every declared changed path appearing in the commit stat. Proof `.epiphany-smoke\repo-closure-source-grounding-20260620-230626` closes the default `git show --stat` path with source grounding required, then blocks custom `Write-Output 'ok'` verification as `verification-failed` while `pathScopeMatched=true`, `familyAssertions.status=passed`, Soul `failed`, and `privateStateExposed=false`. - Mind-admitted repo-work map facts now leave local Verse sight. Successful `epiphany-work close` first admits `.epiphany/state/repo-work-map.msgpack` as `epiphany.repo_work_map_store.v0`, then mirrors the accepted item fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0` under `gamecult-local/repo-work-map/latest`. `epiphany-verse-query swarm-overview` exposes `repoWorkMapRows`, `repoWorkMapTuiRows`, and `latestRepoWorkMapEntry` with safe family, changed-path count, Soul verdict id, Mind review/commit ids, Bifrost gate, source map store ref, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` plus direct swarm overview readback showed one compact `REPO-WORK-MAP` row after counterfeit Mind adoption was refused and the real close passed. This is sight only; swarm overview still does not schedule, publish, merge, deploy, keep daemons alive, or open private state. @@ -636,7 +636,7 @@ current_status: - `epiphany-verse-query connect-eve` and `tools/epiphany_local_run.ps1 -Mode eve-connect` provide the compact Odin-to-Eve collaboration receipt. The command selects the daemon-published surface through the narrow Eve directory, writes connection intent/receipt documents, verifies latest receipt keys through narrow CultMesh loaders, defaults the wrapper target to `epiphany.cluster.persona`, and exposes no private state. - `epiphany-verse-query collaboration-feedback` and `tools/epiphany_local_run.ps1 -Mode collaboration-feedback` provide the public Persona feedback to Imagination consensus receipt path. The wrapper records the prerequisite Eve connection receipt, writes feedback plus Imagination consensus receipt documents, verifies latest keys through narrow CultMesh loaders, publishes follow-on command hints for wrapper feedback, Eve connection, direct Bifrost publication, and wrapper Bifrost publication, and exposes no private state. The command returns compact TUI rows for the feedback and Imagination consensus receipt with explicit `owner=Persona->Imagination` / `owner=Imagination`, `public=`, candidate action refs, consensus packet ref, adoption gate, and `private=false`; wrapper proof `local-20260618-224207-941-2ca01b41` prints both rows in `feedbackRows`, including Persona public discussion feedback routed to Imagination consensus discovery before Mind/Bifrost adoption. - `epiphany-verse-query bifrost-publication` and `tools/epiphany_local_run.ps1 -Mode bifrost-publication` provide the non-mutating Bifrost body-change publication proof path. It writes Bifrost intent, Bifrost publication receipt, and GitHub publication receipt documents from explicit review/verification/credit inputs, verifies latest keys through narrow CultMesh loaders, publishes follow-on command hints for swarm overview, tool directory, and wrapper Bifrost publication readback, and exposes no private state. - - `epiphany-verse-query bifrost-ledger` and `tools/epiphany_local_run.ps1 -Mode bifrost-ledger` provide the compact Bifrost ledger sight organ. It reads only the latest Bifrost body-change intent, Bifrost publication receipt, GitHub publication receipt, public-proof publication receipt, artifact-acceptance receipt, metrics receipt, repo-work readiness-review receipt, collaboration feedback, Imagination consensus receipt, and Mind-admitted repo-work map entries through narrow CultMesh loaders, returns agent-friendly ledger TUI rows, publishes follow-on command hints for swarm overview, tool directory, collaboration feedback, Bifrost publication, artifact acceptance, metrics, and ledger readback, and exposes no private state. Compact ledger rows carry explicit `owner=`, `public=`, and `private=false`, so body-change/public-feedback proof is inspectable without opening raw local Verse payloads or inferring authority from document names. Bifrost ledger readback derives six `BIFROST-ACCOUNTING` rows for `body-change-publication`, `public-proof-publication`, `repo-work-readiness-review`, `artifact-acceptance-request`, `metrics-request`, and `collaboration-consensus`, with closure status, ledger/receipt/public refs, review and credit receipt counts, artifact count, and private-state seal. Readiness-review accounting closes only when latest `epiphany.cultmesh.repo_work_readiness_review.v0` has four Maintainer/Soul/Mind/Bifrost review refs, readiness approval, zero missing required rows, present review artifact, and no durable-state/publication/merge/sync/deployment/service/Hands/private authority. Artifact-acceptance and metrics request rows are `open` when only Mind-admitted request map entries exist, and close only from typed Bifrost/Maintainer receipts: `epiphany-verse-query bifrost-artifact-acceptance` writes `gamecult.bifrost.artifact_acceptance_receipt` from explicit artifact/public-proof/ledger/review refs, while `epiphany-verse-query bifrost-metrics` writes `gamecult.bifrost.metrics_receipt` from explicit accepted-artifact, model-spend, review-load, credit-readback, public-proof, and metrics summary refs. Wrapper modes `bifrost-artifact-acceptance` and `bifrost-metrics` expose the same closure rites. Focused smokes `.epiphany-smoke\repo-artifact-acceptance-request-family-20260621-130520` and `.epiphany-smoke\repo-metrics-request-family-20260621-130635` now prove request rows open first and then close from final Bifrost receipts without private-state exposure; wrapper proof `local-20260621-140740-750-2815f6f7` printed the closed metrics row from the repo-local Verse target. `epiphany-repo-bifrost-accounting-bundle-smoke` consumes the closed request-family summaries as an operator-safe aggregate proof, and `tools/epiphany_local_run.ps1 -Mode bifrost-accounting-bundle` now wraps that verifier with optional exact summary path inputs and the normal operator run receipts. Wrapper proof `local-20260621-142716-268-d6bc58b4` built the verifier, emitted bundle `.epiphany-smoke\repo-bifrost-accounting-bundle-20260621-132815`, and verified artifact acceptance and metrics close statuses, final Bifrost receipt ids, closed accounting rows, `planningAuthorityOnly=true`, and `privateStateExposed=false`. `epiphany-daemon-survival-rehearsal-smoke` now proves Idunn's bounded `serve` physiology can consume a durable restart policy, run two scheduler pulses, write scheduler receipts, and keep service-manager mutation/elevation/private-state exposure false; wrapper proof `local-20260621-145723-011-1175e273` emitted `.epiphany-smoke\daemon-survival-rehearsal-20260621-135723` with `serveIterations=2` and scheduler receipt `daemon-scheduler-receipt-epiphany-daemon-survival-rehearsal-2`. `epiphany-repo-swarm-mvp-gate-smoke` now consumes the fresh-repo MVP, repo-work readiness, Bifrost accounting-bundle, Idunn deployment handoff, daemon survival, Weksa interlingua, and Persona semantic memory recall proofs as one operator-safe MVP gate report; direct proof `.epiphany-smoke\repo-swarm-mvp-gate-20260621-174742` reports `demoReady=true`, `mvpReady=false`, fifteen green gates, one Idunn elevated-service warning gate, zero blockers, `personaMemoryRecall.cacheStatus=qdrant-unavailable`, `personaMemoryRecall.status=fallback`, `personaMemoryRecall.dynamicCacheStatus=qdrant-unavailable`, `personaMemoryRecall.dynamicRecallWired=true`, `personaMemoryRecall.heartbeatRecallWired=true`, Projector/Persona/output-triggered Interpreter prompt coverage, and `privateStateExposed=false`. Repo Persona intake now records both pre-turn semantic recall and `interpreterDynamicRecall` from candidate SAY meaning; this matches VoidBot's two-pass Projector/Face/Interpreter memory membrane while preserving the scaffold seal that repo-intake is not yet a full autonomous model Persona turn. + - `epiphany-verse-query bifrost-ledger` and `tools/epiphany_local_run.ps1 -Mode bifrost-ledger` provide the compact Bifrost ledger sight organ. It reads only the latest Bifrost body-change intent, Bifrost publication receipt, GitHub publication receipt, public-proof publication receipt, artifact-acceptance receipt, metrics receipt, repo-work readiness-review receipt, collaboration feedback, Imagination consensus receipt, and Mind-admitted repo-work map entries through narrow CultMesh loaders, returns agent-friendly ledger TUI rows, publishes follow-on command hints for swarm overview, tool directory, collaboration feedback, Bifrost publication, artifact acceptance, metrics, and ledger readback, and exposes no private state. Compact ledger rows carry explicit `owner=`, `public=`, and `private=false`, so body-change/public-feedback proof is inspectable without opening raw local Verse payloads or inferring authority from document names. Bifrost ledger readback derives six `BIFROST-ACCOUNTING` rows for `body-change-publication`, `public-proof-publication`, `repo-work-readiness-review`, `artifact-acceptance-request`, `metrics-request`, and `collaboration-consensus`, with closure status, ledger/receipt/public refs, review and credit receipt counts, artifact count, and private-state seal. Readiness-review accounting closes only when latest `epiphany.cultmesh.repo_work_readiness_review.v0` has four Maintainer/Soul/Mind/Bifrost review refs, readiness approval, zero missing required rows, present review artifact, and no durable-state/publication/merge/sync/deployment/service/Hands/private authority. Artifact-acceptance and metrics request rows are `open` when only Mind-admitted request map entries exist, and close only from typed Bifrost/Maintainer receipts: `epiphany-verse-query bifrost-artifact-acceptance` writes `gamecult.bifrost.artifact_acceptance_receipt` from explicit artifact/public-proof/ledger/review refs, while `epiphany-verse-query bifrost-metrics` writes `gamecult.bifrost.metrics_receipt` from explicit accepted-artifact, model-spend, review-load, credit-readback, public-proof, and metrics summary refs. Wrapper modes `bifrost-artifact-acceptance` and `bifrost-metrics` expose the same closure rites. Focused smokes `.epiphany-smoke\repo-artifact-acceptance-request-family-20260621-130520` and `.epiphany-smoke\repo-metrics-request-family-20260621-130635` now prove request rows open first and then close from final Bifrost receipts without private-state exposure; wrapper proof `local-20260621-140740-750-2815f6f7` printed the closed metrics row from the repo-local Verse target. `epiphany-repo-bifrost-accounting-bundle-smoke` consumes the closed request-family summaries as an operator-safe aggregate proof, and `tools/epiphany_local_run.ps1 -Mode bifrost-accounting-bundle` now wraps that verifier with optional exact summary path inputs and the normal operator run receipts. Wrapper proof `local-20260621-142716-268-d6bc58b4` built the verifier, emitted bundle `.epiphany-smoke\repo-bifrost-accounting-bundle-20260621-132815`, and verified artifact acceptance and metrics close statuses, final Bifrost receipt ids, closed accounting rows, `planningAuthorityOnly=true`, and `privateStateExposed=false`. `epiphany-daemon-survival-rehearsal-smoke` now proves Idunn's bounded `serve` physiology can consume a durable restart policy, run two scheduler pulses, write scheduler receipts, and keep service-manager mutation/elevation/private-state exposure false; wrapper proof `local-20260621-145723-011-1175e273` emitted `.epiphany-smoke\daemon-survival-rehearsal-20260621-135723` with `serveIterations=2` and scheduler receipt `daemon-scheduler-receipt-epiphany-daemon-survival-rehearsal-2`. `epiphany-repo-swarm-mvp-gate-smoke` now consumes the fresh-repo MVP, repo-work readiness, Bifrost accounting-bundle, daemon survival, Weksa interlingua, and Persona semantic memory recall proofs as one operator-safe MVP gate report; direct proof `.epiphany-smoke\repo-swarm-mvp-gate-20260621-174742` reports `demoReady=true`, `mvpReady=false`, fourteen green gates, one Idunn elevated-service warning gate, zero blockers, `personaMemoryRecall.cacheStatus=qdrant-unavailable`, `personaMemoryRecall.status=fallback`, `personaMemoryRecall.dynamicCacheStatus=qdrant-unavailable`, `personaMemoryRecall.dynamicRecallWired=true`, `personaMemoryRecall.heartbeatRecallWired=true`, Projector/Persona/output-triggered Interpreter prompt coverage, and `privateStateExposed=false`. Repo Persona intake now records both pre-turn semantic recall and `interpreterDynamicRecall` from candidate SAY meaning; this matches VoidBot's two-pass Projector/Face/Interpreter memory membrane while preserving the scaffold seal that repo-intake is not yet a full autonomous model Persona turn. - `epiphany-verse-query receipt-directory` and `tools/epiphany_local_run.ps1 -Mode receipt-directory` provide the compact latest-witness directory over local Verse. It indexes operator run, daemon poke, daemon tool invocation, Eve connection, Bifrost publication, Imagination consensus, coordinator run, Hands gate, role review, work-loop, cluster service lifecycle, single-service lifecycle, cluster service execution runbook, single-service execution runbook, scheduler, Persona speech, and agent-state SoA witness families from typed local Verse projections; returns agent-friendly `OK`/`ABSENT`/`ATTN` TUI rows with owner, family, status, route, latest id, follow-up command, `presentRowCount`, and `absentRowCount`; preserves `missingRowCount` as compatibility for absent witnesses; flags sealed service lifecycle failure states such as `not-elevated`, `execution-refused-not-elevated`, and `incomplete` as attention without exposing receipt payloads; routes service lifecycle receipts by their typed receipt action through `service_execution_check_follow_up_command` (readiness to readiness, install to install execute, start/stop to control execute, status/reconcile to their readback rites, audit to audit), while cluster/single execution-runbook witnesses route to their runbook regeneration wrappers; and exposes no private state or receipt payload previews. The lifecycle projection now reads the typed receipt family, splits `cluster-service-lifecycle` from `service-lifecycle`, selects the latest attention receipt before falling back to latest overall, and exposes `service-id::action` route values such as `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit`, so agents can see the owning lifecycle action without opening raw audit JSON. Compact receipt TUI rows append `followUp=`, artifact status, and SHA-256; wrapper proof `local-20260618-205920-451-383b0da7` now prints all seventeen compact rows in `receiptRows`, including missing Hands/role/work-loop gates, runbook hashes, scheduler follow-up, Bifrost/Imagination witnesses, and the active service lifecycle attention rows. It also exposes `cluster-service-execution-runbook` plus `service-execution-runbook` as display-only rows, so newer harmless planned/runbook lifecycle receipts cannot hide the active seven-service cluster wound. Receipt-directory JSON now carries Rust-owned `attentionRouteRows` derived from the same policy predicate as `attentionRowCount`, and the wrapper prints that field instead of rebuilding attention from ad hoc status strings; source smoke now proves a `cluster-windows-service-execution-readiness` receipt routes to `cluster-service-execution-readiness` and wrapper mode `cluster-service-execution-readiness` instead of laundering the row through audit. Live proof `local-20260618-212134-758-c7c56240` left the old degraded Hands daemon-poke receipt as an `OK` historical witness while attention routes named only the cluster and single-service lifecycle wounds. Daemon-poke rows now resolve historical receipt status against current daemon liveness: source smoke proves degraded remains degraded before heartbeat recovery and becomes `resolved` after current status returns ready, while live wrapper proof `local-20260618-212649-563-48647018` printed the old Hands poke receipt as `OK | Self | daemon-poke | resolved`. - `tools/epiphany_local_run.ps1 -Mode service-tick` is the wrapper-owned daemon scheduler pulse rite. It runs `epiphany-daemon-supervisor tick` through the same local Verse store, operator run intent/receipt, agent-state SoA refresh, and swarm-brake preflight as other service lifecycle modes, but leaves restart authority inside durable daemon restart policies. The receipt directory scheduler row now follows up with `tools/epiphany_local_run.ps1 -Mode service-tick` instead of passive service status. Proof seeded one disabled Persona restart policy as inert policy metadata, then the wrapper wrote `daemon-scheduler-receipt-epiphany-daemon-supervisor-0` with `status=tickComplete`, `outcomeCount=1`, `skippedCount=1`, `restartedCount=0`, `refusedCount=0`, and `privateStateExposed=false`; the follow-up receipt-directory proof reported the scheduler row as present with route `*`, follow-up command `service-tick`, and no private-state exposure. - `epiphany-cluster-daemon` is the first real per-cluster daemon heartbeat body. It runs as a narrow Rust binary parameterized by daemon id, publishes typed `epiphany.cultmesh.daemon_status.v0` heartbeats into the shared local Verse, can run once or loop, and exposes no private state. Durable restart policies for Self, Hands, Persona, Imagination, Eyes, Modeling, and Soul now invoke `epiphany-cluster-daemon heartbeat`, not the generic query/debug writer. A degraded proof showed `service-tick` invoking all seven daemon bodies through the supervisor and restoring ready liveness with sealed scheduler/poke receipts; a fresh tick no-ops when all heartbeats are current. `epiphany-daemon-supervisor cluster-service-runbook` and wrapper `-Mode cluster-service-runbook` write a non-mutating service runbook plus `daemon_service_lifecycle` receipt for all seven organ daemon `epiphany-cluster-daemon serve` commands. Direct `service-runbook` and `cluster-service-runbook` wrapper summaries now print local artifact SHA-256 plus follow-up/aftercare wrapper routes; live proofs `local-20260618-232133-314-4e55120e` and `local-20260618-232146-541-982dd60b` showed hashes `85a956f768e584a9d098f13a9bf03fc3560915821a2ae7eaab94889dd9ecda85` and `40616423a9210101486949d07291bf795175579a39e99de5e5a759f8e0d7a78c` without service mutation. Wrapper `service-plan` and `service-launch` now expose the native daemon-supervisor service lifecycle surfaces under the same brake gate; `service-launch` silences child stdout/stderr so the parent lifecycle receipt remains the only stdout JSON. Live proof `local-20260618-232935-349-7e3901c8` completed a bounded one-iteration launch with `exitCode=0` and no private-state exposure. `epiphany-daemon-supervisor cluster-service-install-plan` and wrapper `-Mode cluster-service-install-plan` write a non-mutating Windows install script plus lifecycle receipt for seven distinct per-organ Windows services. Wrapper `-Mode cluster-service-install-execute` requests execution through the same typed path and, in non-elevated shells, writes `execution-refused-not-elevated` with `executed=false` instead of mutating services. Direct cluster install wrapper summaries now include `artifactSha256=` and `followUp=tools/epiphany_local_run.ps1 -Mode cluster-service-install-execute`; live proofs `local-20260618-230937-335-71c4fdaa` and `local-20260618-230937-313-cb288388` showed the planned and non-elevated-refused cluster install artifact hash `c6b697e173eb319073da341fc90c2963bcd6bee63d804349205b6309c88df764`. `epiphany-daemon-supervisor cluster-service-audit` and wrapper `-Mode cluster-service-audit` read Windows service-manager state for those seven expected service names, writing an incomplete audit receipt when they are missing; direct audit summaries now point missing cluster services to `cluster-service-install-plan` plus `cluster-service-execution-audit` aftercare, with live proof `local-20260618-232200-992-b842ae01` reporting seven missing services and no mutation. `epiphany-daemon-supervisor cluster-service-start`/`cluster-service-stop` and wrapper `-Mode cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, and `cluster-service-stop-execute` record cluster lifecycle receipts for all seven services: plan modes emit seven `*-planned` rows without mutation, and explicit execute modes refuse as `execution-refused-not-elevated` with seven refused rows when the shell lacks service authority. The cluster install/audit/control wrapper summaries now print compact `serviceRows` for all seven daemon-owned Windows service names with daemon id, status or observed status, cluster id, executed flag, exit code, start type, and `private=false`; live proofs `local-20260618-211051-126-2a89d61c`, `local-20260618-211051-125-cd687ee2`, `local-20260618-211051-063-f0ff980d`, and `local-20260618-211118-108-df5cb8cd` show seven missing audit rows, seven ready/demand install-plan rows, seven start-planned rows, and seven stop-planned rows without service mutation. `cluster-service-execution-runbook` writes an admin-gated wrapper sequence for cluster-native readiness, cluster install, cluster start, cluster audit, cluster stop, and final cluster audit; the artifact now uses `Invoke-EpiphanyRunbookStep` to reset `$LASTEXITCODE`, catch thrown/nonzero failures, continue gathering receipts after a failed step, and always runs `cluster-service-execution-audit` from `finally`; generated child execution runbooks no longer use `Invoke-Expression`, and each step invokes the known wrapper `ScriptPath` with an explicit `Arguments` array. The wrapper calls `epiphany-daemon-supervisor cluster-service-execution-runbook` after artifact generation, so the runbook itself has a typed `daemon_service_lifecycle` receipt with action `cluster-windows-service-execution-runbook`, status `written`, artifact path, final-audit metadata, step-failure policy metadata, and `privateStateExposed=false`. Its wrapper JSON and typed receipt args expose `runbookTryModes`, `finalAuditMode=cluster-service-execution-audit`, `finalAuditRunsInFinally=true`, `stepFailurePolicy=continue-after-step-failure`, `continueAfterStepFailure=true`, `nonzeroExitFailsStep=true`, and `exitsNonzeroAfterFinalAudit=true`; direct wrapper summaries now print the exact `elevatedCommand=Start-Process PowerShell -Verb RunAs -Wait ...` invocation, `artifactSha256=`, and `aftercare=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`. Live proof `local-20260619-010940-407-b0744f08` generated the robust cluster artifact and printed hash `bf116ed4fd5bb2c9dc77f5032d19e792b012941a60b109389b79e5fcb0a2a5f6` without service mutation. `cluster-service-execution-audit` first requires the sealed `cluster-windows-service-execution-runbook` receipt, then checks the latest cluster-native readiness plus cluster install/start/audit/stop lifecycle receipts by receipt timestamp and reports `complete` only when the runbook and elevated effect receipts are sealed and successful. Audit check rows retain lifecycle `operatorArtifactRef`; wrapper summaries now print OK runbook witnesses with SHA-256 before compact failed-check anatomy. Live proof `local-20260618-170322-330-e6cb2117` printed `cluster-windows-service-execution-runbook=...\epiphany-cluster-daemon-services-execution-runbook.ps1:sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0` and the expected five failed checks without mutating Windows services.