From 93577e8532e018b2c14e4e536edd7576f6ba95ba Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sat, 30 May 2026 01:21:33 +0100 Subject: [PATCH] Persist Mind acceptance receipts --- epiphany-codex-bridge/src/mutation_service.rs | 51 +++++++++ epiphany-core/src/lib.rs | 6 ++ epiphany-core/src/mind_gateway.rs | 80 ++++++++++++++- epiphany-core/src/runtime_spine.rs | 97 ++++++++++++++++++ notes/fresh-workspace-handoff.md | 17 ++- notes/perfect-machine-audit-roadmap.md | 27 +++-- state/ledgers.msgpack | Bin 168424 -> 168755 bytes state/map.yaml | 8 +- 8 files changed, 267 insertions(+), 19 deletions(-) diff --git a/epiphany-codex-bridge/src/mutation_service.rs b/epiphany-codex-bridge/src/mutation_service.rs index f5ac5b86..0eabe5ed 100644 --- a/epiphany-codex-bridge/src/mutation_service.rs +++ b/epiphany-codex-bridge/src/mutation_service.rs @@ -18,6 +18,9 @@ use epiphany_core::EpiphanyRoleResultRoleId; use epiphany_core::EpiphanyRoleStatePatchDocument; use epiphany_core::EpiphanyStateUpdate; use epiphany_core::EpiphanyStateUpdatedField; +use epiphany_core::mind_state_commit_receipt; +use epiphany_core::put_mind_gateway_review; +use epiphany_core::put_mind_state_commit_receipt; use epiphany_core::EpiphanyTokenUsageSnapshot; use epiphany_core::RuntimeSpineHeartbeatJobOptions; use epiphany_core::RuntimeSpineHeartbeatLaunchPlanOptions; @@ -464,8 +467,32 @@ pub async fn apply_thread_epiphany_role_accept( let accepted_evidence_id = acceptance_update.accepted_evidence_id.clone(); let changed_fields = acceptance_update.changed_fields.clone(); let applied_patch = acceptance_update.applied_patch.clone(); + put_mind_gateway_review(runtime_store_path.as_path(), &acceptance_update.mind_review) + .map_err(|err| { + EpiphanyBridgeError::Fatal(format!( + "failed to persist Mind review receipt before role state admission: {err}" + )) + })?; + let mind_review = acceptance_update.mind_review.clone(); let epiphany_state = apply_epiphany_state_update_to_thread(thread, acceptance_update.state_update).await?; + let commit_receipt = mind_state_commit_receipt( + format!("mind-commit-{accepted_receipt_id}"), + &mind_review, + epiphany_state.revision, + changed_fields + .iter() + .map(|field| format!("{field:?}")) + .collect(), + Utc::now().to_rfc3339_opts(SecondsFormat::Secs, true), + ); + put_mind_state_commit_receipt(runtime_store_path.as_path(), &commit_receipt).map_err( + |err| { + EpiphanyBridgeError::Fatal(format!( + "failed to persist Mind state-commit receipt after role state admission: {err}" + )) + }, + )?; let epiphany_state = thread.client_visible_epiphany_state(epiphany_state).await; Ok(EpiphanyRoleAcceptApplied { @@ -524,8 +551,32 @@ pub async fn apply_thread_epiphany_reorient_accept( let accepted_observation_id = acceptance_update.accepted_observation_id.clone(); let accepted_evidence_id = acceptance_update.accepted_evidence_id.clone(); let changed_fields = acceptance_update.changed_fields.clone(); + put_mind_gateway_review(runtime_store_path.as_path(), &acceptance_update.mind_review) + .map_err(|err| { + EpiphanyBridgeError::Fatal(format!( + "failed to persist Mind review receipt before reorientation state admission: {err}" + )) + })?; + let mind_review = acceptance_update.mind_review.clone(); let epiphany_state = apply_epiphany_state_update_to_thread(thread, acceptance_update.state_update).await?; + let commit_receipt = mind_state_commit_receipt( + format!("mind-commit-{accepted_receipt_id}"), + &mind_review, + epiphany_state.revision, + changed_fields + .iter() + .map(|field| format!("{field:?}")) + .collect(), + Utc::now().to_rfc3339_opts(SecondsFormat::Secs, true), + ); + put_mind_state_commit_receipt(runtime_store_path.as_path(), &commit_receipt).map_err( + |err| { + EpiphanyBridgeError::Fatal(format!( + "failed to persist Mind state-commit receipt after reorientation state admission: {err}" + )) + }, + )?; let epiphany_state = thread.client_visible_epiphany_state(epiphany_state).await; Ok(EpiphanyReorientAcceptApplied { diff --git a/epiphany-core/src/lib.rs b/epiphany-core/src/lib.rs index c2726563..7eb84c7f 100644 --- a/epiphany-core/src/lib.rs +++ b/epiphany-core/src/lib.rs @@ -322,11 +322,13 @@ pub use mind_gateway::MindCultNetContract; pub use mind_gateway::MindGatewayDecision; pub use mind_gateway::MindGatewayReview; pub use mind_gateway::MindInterpreterPromptInput; +pub use mind_gateway::MindStateCommitReceipt; pub use mind_gateway::build_mind_interpreter_prompt; pub use mind_gateway::default_mind_cultnet_contracts; pub use mind_gateway::mind_review_allows_state; pub use mind_gateway::mind_review_reorient_acceptance; pub use mind_gateway::mind_review_role_acceptance; +pub use mind_gateway::mind_state_commit_receipt; pub use organ_dependencies::EPIPHANY_LAUNCH_ORGAN_CONTRACT_SCHEMA_VERSION; pub use organ_dependencies::EPIPHANY_ORGAN_DEPENDENCY_SCHEMA_VERSION; pub use organ_dependencies::EPIPHANY_STANDING_ORGANS; @@ -407,11 +409,15 @@ pub use runtime_spine::initialize_runtime_spine; pub use runtime_spine::open_runtime_spine_heartbeat_job; pub use runtime_spine::plan_runtime_spine_heartbeat_launch; pub use runtime_spine::put_coordinator_run_receipt; +pub use runtime_spine::put_mind_gateway_review; +pub use runtime_spine::put_mind_state_commit_receipt; pub use runtime_spine::put_runtime_reorient_worker_result; pub use runtime_spine::put_runtime_role_worker_result; pub use runtime_spine::replace_or_append_epiphany_job_binding; pub use runtime_spine::runtime_hello_frame; pub use runtime_spine::runtime_job_snapshot; +pub use runtime_spine::runtime_mind_gateway_review; +pub use runtime_spine::runtime_mind_state_commit_receipt; pub use runtime_spine::runtime_reorient_worker_result; pub use runtime_spine::runtime_role_worker_result; pub use runtime_spine::runtime_schema_catalog_response; diff --git a/epiphany-core/src/mind_gateway.rs b/epiphany-core/src/mind_gateway.rs index 53e0449c..13f72d2e 100644 --- a/epiphany-core/src/mind_gateway.rs +++ b/epiphany-core/src/mind_gateway.rs @@ -2,6 +2,7 @@ use crate::EpiphanyReorientAcceptanceFinding; use crate::EpiphanyRoleFindingInterpretation; use crate::EpiphanyRoleResultRoleId; use crate::EpiphanyRoleStatePatchDocument; +use cultcache_rs::DatabaseEntry; use serde::Deserialize; use serde::Serialize; @@ -30,20 +31,75 @@ pub enum MindGatewayDecision { Hold, } -#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] -#[serde(rename_all = "camelCase")] +#[derive(Debug, Clone, PartialEq, Eq, DatabaseEntry)] +#[cultcache(type = "epiphany.mind.gateway_review", schema = "MindGatewayReview")] pub struct MindGatewayReview { + #[cultcache(key = 0)] pub schema_version: String, + #[cultcache(key = 1)] pub gateway_id: String, + #[cultcache(key = 2)] pub source_kind: String, + #[cultcache(key = 3)] pub source_role_id: String, + #[cultcache(key = 4)] pub decision: MindGatewayDecision, + #[cultcache(key = 5)] pub allowed_effects: Vec, + #[cultcache(key = 6)] pub refused_effects: Vec, + #[cultcache(key = 7)] pub reasons: Vec, + #[cultcache(key = 8)] pub contract: String, } +#[derive(Debug, Clone, PartialEq, Eq, DatabaseEntry)] +#[cultcache( + type = "epiphany.mind.state_commit_receipt", + schema = "MindStateCommitReceipt" +)] +pub struct MindStateCommitReceipt { + #[cultcache(key = 0)] + pub schema_version: String, + #[cultcache(key = 1)] + pub receipt_id: String, + #[cultcache(key = 2)] + pub gateway_id: String, + #[cultcache(key = 3)] + pub source_kind: String, + #[cultcache(key = 4)] + pub source_role_id: String, + #[cultcache(key = 5)] + pub state_revision: u64, + #[cultcache(key = 6)] + pub changed_fields: Vec, + #[cultcache(key = 7)] + pub committed_at: String, + #[cultcache(key = 8)] + pub contract: String, +} + +pub fn mind_state_commit_receipt( + receipt_id: String, + review: &MindGatewayReview, + state_revision: u64, + changed_fields: Vec, + committed_at: String, +) -> MindStateCommitReceipt { + MindStateCommitReceipt { + schema_version: MIND_STATE_COMMIT_RECEIPT_SCHEMA_VERSION.to_string(), + receipt_id, + gateway_id: review.gateway_id.clone(), + source_kind: review.source_kind.clone(), + source_role_id: review.source_role_id.clone(), + state_revision, + changed_fields, + committed_at, + contract: "Mind admitted reviewed state effects into durable Epiphany state; this receipt is the state-commit proof paired with the gateway review.".to_string(), + } +} + #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] #[serde(rename_all = "camelCase")] pub struct MindInterpreterPromptInput { @@ -231,7 +287,15 @@ pub fn mind_review_role_acceptance( } MindGatewayReview { schema_version: MIND_GATEWAY_REVIEW_SCHEMA_VERSION.to_string(), - gateway_id: format!("mind-role-{binding_id}"), + gateway_id: format!( + "mind-role-{}-{}", + binding_id, + finding + .runtime_job_id + .as_deref() + .filter(|job_id| !job_id.trim().is_empty()) + .unwrap_or("missing-job") + ), source_kind: "roleWorkerResult".to_string(), source_role_id: role_label(role_id).to_string(), decision: if reasons.is_empty() { @@ -293,7 +357,15 @@ pub fn mind_review_reorient_acceptance( } MindGatewayReview { schema_version: MIND_GATEWAY_REVIEW_SCHEMA_VERSION.to_string(), - gateway_id: format!("mind-reorient-{binding_id}"), + gateway_id: format!( + "mind-reorient-{}-{}", + binding_id, + finding + .runtime_job_id + .as_deref() + .filter(|job_id| !job_id.trim().is_empty()) + .unwrap_or("missing-job") + ), source_kind: "reorientWorkerResult".to_string(), source_role_id: "reorientation".to_string(), decision: if reasons.is_empty() { diff --git a/epiphany-core/src/runtime_spine.rs b/epiphany-core/src/runtime_spine.rs index 7da55658..2247e0f9 100644 --- a/epiphany-core/src/runtime_spine.rs +++ b/epiphany-core/src/runtime_spine.rs @@ -36,6 +36,8 @@ use crate::mind_gateway::MIND_THOUGHT_SCHEMA_VERSION; use crate::mind_gateway::MIND_THOUGHT_TYPE; use crate::mind_gateway::MIND_VERSE_ADOPTION_RECEIPT_SCHEMA_VERSION; use crate::mind_gateway::MIND_VERSE_ADOPTION_RECEIPT_TYPE; +use crate::mind_gateway::MindGatewayReview; +use crate::mind_gateway::MindStateCommitReceipt; use crate::organ_dependencies::EpiphanyLaunchOrganContract; use crate::soul_gateway::*; use crate::state_ledger::STATE_LEDGER_SCHEMA_VERSION; @@ -707,6 +709,8 @@ pub fn runtime_spine_cache(store_path: impl AsRef) -> Result { cache.register_entry_type::()?; cache.register_entry_type::()?; cache.register_entry_type::()?; + cache.register_entry_type::()?; + cache.register_entry_type::()?; cache.register_entry_type::()?; cache.register_entry_type::()?; cache.register_entry_type::()?; @@ -1118,6 +1122,56 @@ pub fn runtime_reorient_worker_result( cache.get::(job_id) } +pub fn put_mind_gateway_review( + store_path: impl AsRef, + review: &MindGatewayReview, +) -> Result<()> { + validate_non_empty(&review.gateway_id, "Mind gateway review id")?; + validate_non_empty(&review.source_kind, "Mind gateway review source kind")?; + validate_non_empty(&review.source_role_id, "Mind gateway review source role")?; + let mut cache = runtime_spine_cache(store_path)?; + cache.pull_all_backing_stores()?; + require_identity(&cache)?; + cache.put(&review.gateway_id, review)?; + Ok(()) +} + +pub fn runtime_mind_gateway_review( + store_path: impl AsRef, + gateway_id: &str, +) -> Result> { + validate_non_empty(gateway_id, "Mind gateway review id")?; + let mut cache = runtime_spine_cache(store_path)?; + cache.pull_all_backing_stores()?; + cache.get::(gateway_id) +} + +pub fn put_mind_state_commit_receipt( + store_path: impl AsRef, + receipt: &MindStateCommitReceipt, +) -> Result<()> { + validate_non_empty(&receipt.receipt_id, "Mind state commit receipt id")?; + validate_non_empty(&receipt.gateway_id, "Mind state commit gateway id")?; + validate_non_empty(&receipt.source_kind, "Mind state commit source kind")?; + validate_non_empty(&receipt.source_role_id, "Mind state commit source role")?; + validate_non_empty(&receipt.committed_at, "Mind state commit timestamp")?; + let mut cache = runtime_spine_cache(store_path)?; + cache.pull_all_backing_stores()?; + require_identity(&cache)?; + cache.put(&receipt.receipt_id, receipt)?; + Ok(()) +} + +pub fn runtime_mind_state_commit_receipt( + store_path: impl AsRef, + receipt_id: &str, +) -> Result> { + validate_non_empty(receipt_id, "Mind state commit receipt id")?; + let mut cache = runtime_spine_cache(store_path)?; + cache.pull_all_backing_stores()?; + cache.get::(receipt_id) +} + pub fn put_coordinator_run_receipt( store_path: impl AsRef, receipt: &EpiphanyCoordinatorRunReceipt, @@ -3028,6 +3082,49 @@ mod tests { Ok(()) } + #[test] + fn runtime_spine_persists_mind_gateway_review_receipts() -> Result<()> { + let temp = tempdir()?; + let store = temp.path().join("runtime.msgpack"); + initialize_runtime_spine( + &store, + RuntimeSpineInitOptions { + runtime_id: "epiphany-test".to_string(), + display_name: "Epiphany Test".to_string(), + created_at: "2026-05-06T00:00:00Z".to_string(), + }, + )?; + let review = MindGatewayReview { + schema_version: crate::MIND_GATEWAY_REVIEW_SCHEMA_VERSION.to_string(), + gateway_id: "mind-role-modeling-job-1".to_string(), + source_kind: "roleWorkerResult".to_string(), + source_role_id: "modeling".to_string(), + decision: crate::mind_gateway::MindGatewayDecision::Accept, + allowed_effects: vec!["statePatch".to_string()], + refused_effects: Vec::new(), + reasons: Vec::new(), + contract: "Mind review is persisted before state admission.".to_string(), + }; + + put_mind_gateway_review(&store, &review)?; + let commit = crate::mind_state_commit_receipt( + "mind-commit-1".to_string(), + &review, + 42, + vec!["GraphCheckpoint".to_string()], + "2026-05-06T00:04:00Z".to_string(), + ); + put_mind_state_commit_receipt(&store, &commit)?; + + let stored = runtime_mind_gateway_review(&store, "mind-role-modeling-job-1")? + .expect("Mind review receipt should persist"); + assert_eq!(stored, review); + let stored_commit = runtime_mind_state_commit_receipt(&store, "mind-commit-1")? + .expect("Mind state commit receipt should persist"); + assert_eq!(stored_commit, commit); + Ok(()) + } + #[test] fn runtime_spine_opens_heartbeat_job_from_single_typed_call() -> Result<()> { let temp = tempdir()?; diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 69d338f7..c6e2215e 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -34,7 +34,7 @@ remembers doctrine; the branch remembers the blade. - Do not copy exact branch or HEAD from this note. Run `git status --short --branch` and `git log --oneline -5`. - Canonical anatomy now lives in `notes/epiphany-anatomy.md`. Embodied sub-agents are Self, Face, Imagination, Eyes, Proprioception, Hands, and Soul. Body, Mind, Continuity, and Substrate Gate are substrate/state/protocol surfaces, not sub-agent identities. State is split by layer: `work_organ` for resident Epiphany sub-agents, `persona` for portable public/person-shaped state shared by Epiphany Face, VoidBot repo Faces, and Ghostlight characters, and heartbeat/swarm state for scheduling and coordination physiology. Persona state now carries provenance, required public presentation, `date-time` timestamps, typed `candidateActions`, strict anchored thoughts with non-authoritative extensions, custom enum companion labels, and typed affect records for bonds/status reads/doctrine stances. - The repo now has a one-command local operator path: `.\tools\epiphany_local_run.ps1`. Default mode is `smoke`; it builds the retained Codex app-server compatibility edge, builds native Epiphany operator binaries, runs the coordinator smoke, and writes launcher artifacts under `.epiphany-run/` plus coordinator artifacts under `.epiphany-dogfood/`. `-Mode status` is now Epiphany-native: it builds only Epiphany operator binaries, reads `state/thread-state.msgpack` when present, derives status through `epiphany-core`, and does not start or require `codex-app-server`. Use `-Mode plan` or `-Mode run -MaxSteps 4` for the raw bridge-equipped coordinator entrypoints; use `-Mode mvp -FaceInput "" -MaxSteps 4` for the local product cycle that projects Face's character turn, writes a Face/Aquarium bubble, bootstraps a minimal local checkpoint for fresh threads, runs the coordinator with auto-tools, then runs heartbeat sleep/dream maintenance. Live plan/run/mvp modes use the workspace `state/runtime-spine.msgpack`, because CodexThread launch writes worker requests there; the run bundle remains artifact evidence, not runtime lifecycle authority. Add `-ThreadId ` and `-Workspace ` to inspect or continue an existing thread. `status`, `plan`, and `smoke` do not spend model calls; `run` and `mvp` build and use `epiphany-openai-runtime`. Coordinator workers now launch detached and are polled through runtime-spine instead of blocking the coordinator. MVP runs are non-ephemeral by default so `-ThreadId ` can resume and poll later. `-MaxRuntimeSeconds ` is passed into worker runtime; timeout writes a failed worker receipt and exits. Failed modeling now blocks downstream verification until the failed result is reviewed. -- Current Mom-ready status: the normal MVP pass reaches Face -> coordinator -> detached runtime -> heartbeat sleep, and modeling workers now complete through the ChatGPT subscription transport. The first failure was a stack of violated observability/runtime invariants: worker prompts prepended the whole shared persistent-memory rite, Responses frame liveness was invisible until completion, and the runtime tried to persist hundreds of text deltas before completing the worker job. Role/reorient workers now get a compact Epiphany worker boundary instead of full persistent memory; runtime-spine records sampled raw Responses frame kinds with small previews; contiguous reasoning/text deltas compact before durable storage; and live proofs completed `2fe38dcd-d99e-4c73-9a58-afcc81f851c7`, `241e3851-e3ea-4877-a63b-0d2bbd96a7e2`, and `85149a26-6975-403f-ac93-092b717c5825` instead of timing out. The second failure was stale lifecycle authority: completed runtime jobs remained as unresolved `runtime_links`, replacement launches treated historical active links as current, and one bad validation path opened an orphan job before rejecting the state patch. Latest-link-wins is now the runtime-link invariant, terminal links project completed jobs, stale active history cannot veto replacement, launch validation happens before opening runtime jobs, and completed-but-unreviewable modeling findings stop for review instead of relaunching the same lane. The Eyes/source-gather fork is now landed: Research is a fixed Eyes lane with launch/result/accept/status/coordinator/protocol support, and `regather-needed` modeling findings route to `LaunchResearch` instead of relaunching blind Proprioception. Research statePatch admission is Eyes-shaped only: observations, evidence, scratch, and optional investigationCheckpoint; no graph, planning, objective, or checkpoint authority. The next concrete rebuild layer is executable receipt enforcement beyond Mind-review launch admission: Substrate Gate, Eyes, Hands, Soul, and Continuity receipts are named and carried on launch contracts, but runtime/promotion paths still need to prove the required receipts before state/action claims are accepted. +- Current Mom-ready status: the normal MVP pass reaches Face -> coordinator -> detached runtime -> heartbeat sleep, and modeling workers now complete through the ChatGPT subscription transport. The first failure was a stack of violated observability/runtime invariants: worker prompts prepended the whole shared persistent-memory rite, Responses frame liveness was invisible until completion, and the runtime tried to persist hundreds of text deltas before completing the worker job. Role/reorient workers now get a compact Epiphany worker boundary instead of full persistent memory; runtime-spine records sampled raw Responses frame kinds with small previews; contiguous reasoning/text deltas compact before durable storage; and live proofs completed `2fe38dcd-d99e-4c73-9a58-afcc81f851c7`, `241e3851-e3ea-4877-a63b-0d2bbd96a7e2`, and `85149a26-6975-403f-ac93-092b717c5825` instead of timing out. The second failure was stale lifecycle authority: completed runtime jobs remained as unresolved `runtime_links`, replacement launches treated historical active links as current, and one bad validation path opened an orphan job before rejecting the state patch. Latest-link-wins is now the runtime-link invariant, terminal links project completed jobs, stale active history cannot veto replacement, launch validation happens before opening runtime jobs, and completed-but-unreviewable modeling findings stop for review instead of relaunching the same lane. The Eyes/source-gather fork is now landed: Research is a fixed Eyes lane with launch/result/accept/status/coordinator/protocol support, and `regather-needed` modeling findings route to `LaunchResearch` instead of relaunching blind Proprioception. Research statePatch admission is Eyes-shaped only: observations, evidence, scratch, and optional investigationCheckpoint; no graph, planning, objective, or checkpoint authority. Mind admission now leaves typed runtime-spine proof: role/reorient acceptance persists `epiphany.mind.gateway_review` before state admission and `epiphany.mind.state_commit_receipt` after admission with the resulting durable revision. The next concrete rebuild layer is effect-specific receipt enforcement beyond Mind: Substrate Gate, Eyes, Hands, Soul, and Continuity receipts are named and carried on launch contracts, but runtime/promotion paths still need to prove the required receipts before state/action claims are accepted. - Local operator runs now write typed CultMesh intent/receipt documents to `.epiphany-run/cultmesh/operator-runs.ccmp` through `epiphany-operator-run`. The wrapper writes intent before acting and a completion receipt after success; this is the local consent/trace rail, not a hidden scheduler queue. - Status-mode local runs now also write a native CultMesh operator snapshot to `.epiphany-run/cultmesh/operator-snapshots.ccmp` through `epiphany-operator-snapshot`. That snapshot distills the operator-safe MVP status artifact into typed fields such as thread id, state status, coordinator action, CRRC action, reorient action, available actions, and artifact refs; it does not preserve the raw JSON status blob as internal state. - `epiphany-mvp-status --source native` is the current provider-neutral status boundary. It projects scene, pressure, jobs, roles, planning, reorient, CRRC, coordinator status, and runtime-linked worker lifecycle from native core surfaces. It reads runtime-spine job/result receipts for linked jobs so failed workers show as failed in role results, jobs, roles, and coordinator source signals, while successful semantic findings still require typed role/reorient worker result documents. Keep future pluggable model-provider work behind launch/result/runtime documents; do not let provider choice leak into status, prompt authority, scheduler policy, or durable `EpiphanyThreadState`. @@ -1421,13 +1421,22 @@ original worker launch request is missing, mismatched by document kind, or lacks a dependency/receipt contract requiring Mind review. This blocks the old naked runtime-spine acceptance path without pretending Substrate Gate/Hands/Soul receipt proof exists before the runtime emits those documents. +Mind review is now a persisted receipt chain for acceptance rather than an +in-memory blessing: the bridge writes `epiphany.mind.gateway_review` before +role/reorient state admission and `epiphany.mind.state_commit_receipt` after +admission, recording the new state revision. The remaining scar is transactional: +state mutation and post-commit receipt persistence are still two writes, so the +next storage-owner pass should collapse that into one state-admission primitive +instead of adding a repair loop. `notes/perfect-machine-audit-roadmap.md` is the current audit/path document. It compares Epiphany's named organ contracts against Void's current Face prompting shape and maps the route from contract catalog to executable organism. Main finding: the boundaries are directionally right, launch packets now carry organ -receipt expectations, and acceptance minimally gates against missing Mind-review -launch contracts, but most gates still need runtime enforcement that proves the -required receipts before state/action promotion. The +receipt expectations, and acceptance now has persisted Mind review/commit proof, +but most non-Mind gates still need runtime enforcement that proves the required +receipts before state/action promotion. Do not blindly require the whole organ +catalog for every result; split required receipts by effect type and then make +those proof profiles executable. The first dependency-body repair is landed: the missing `E:\Projects\CultLib\crates\*` paths were replaced with repo-contained vendored CultCache/CultNet/CultMesh crates, and the `epiphany-core` library tests pass diff --git a/notes/perfect-machine-audit-roadmap.md b/notes/perfect-machine-audit-roadmap.md index 7768ceef..10e55213 100644 --- a/notes/perfect-machine-audit-roadmap.md +++ b/notes/perfect-machine-audit-roadmap.md @@ -2,6 +2,8 @@ Date: 2026-05-27 +Updated: 2026-05-30 + Objective: audit Epiphany's current organ shape and map the path from named contracts to the Perfect Machine: a coherent organism where repository access, evidence, projection, public speech, action, verification, continuity, and @@ -128,9 +130,13 @@ carries the full standing sub-agent dependency matrix plus required Mind, Substr Eyes, Hands, Soul, and Continuity receipt document types. Role/reorient acceptance now refuses completed runtime-spine findings if the original launch request is missing, document-kind mismatched, or lacks a dependency/receipt contract that -requires Mind review. Remaining weakness: most organ receipts are still +requires Mind review. Mind's first executable proof chain is now persisted: +acceptance writes `epiphany.mind.gateway_review` before state admission and +`epiphany.mind.state_commit_receipt` after admission with the resulting state +revision. Remaining weakness: the non-Mind organ receipts are still launch-carried expectations, not enforced proof chains before state/action -promotion. +promotion, and the current Mind state mutation plus post-commit receipt is not a +single transaction yet. ### 4. Self Still Shares A Throne With Compatibility Plumbing @@ -219,8 +225,12 @@ organ. - Implement Eyes evidence request/review/packet/refusal documents in CultCache. - Require Eyes packets for claims promoted into Mind state proposals when the claim depends on inspected source. -- Convert existing role/reorient acceptance to create Mind state-effect - proposals before state mutation, not merely a review attached to the old path. +- Landed first slice: role/reorient acceptance persists Mind gateway reviews + before state mutation and Mind state-commit receipts after state mutation. + This is proof, not yet a single transactional admission primitive. +- Convert existing role/reorient acceptance to one Mind-owned state-admission + primitive when the storage layer can atomically pair mutation and commit + receipt. Definition of done: the old direct paths cannot produce repo mutation, evidence promotion, or durable state mutation without the corresponding typed @@ -307,9 +317,12 @@ comfort tunnels. - Landed: role/reorient acceptance refuses completed runtime-spine findings when the original worker launch request is missing, mismatched by document kind, or lacks a dependency/receipt contract requiring Mind review. -- Next: make acceptance refuse results missing required Substrate Gate/Eyes/Hands/Soul/Continuity - receipts for their claimed effect type once those receipt documents are - produced by the live runtime. +- Landed: role/reorient acceptance persists Mind review/commit receipts around + durable state admission. +- Next: split launch-carried receipt expectations into effect-specific proof + profiles, then make acceptance refuse results missing required Substrate + Gate/Eyes/Hands/Soul/Continuity receipts for the claimed effect type once + those receipt documents are produced by the live runtime. - Make Aquarium read the contract catalog and available receipts instead of hard-coding the route zoo. - Starve `codex_message_processor` down to Codex auth/model transport and diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index b5577f827d70409a1551812d239b0d6301773957..89da7200351d9bceb3e761097a9b5f479fb71e62 100644 GIT binary patch delta 329 zcmY+9u}T9$5Qg0=W20SAkU{G^E+>kd&maV}vI(2J*<>)gd+zS#NM&JRDX51{I>A~< zA-;f(FCqv&gJVF5-N5|c{NH>&br#Q^m#$dPdU@~Y{CzFD+gR+0OCi3l+vui^#A_Qx zr?;CAZ&{ih#_2)4pPr>@o;~(I#Ln(^ADt&3u!IvbCCE~f_hb!J&RPY^-p{|cu5xg- z38XRh6&VC$8}Pw8^nevrV`*lIWt_>25+y;hL#uib>7?>s;-K@-5$jJDrc`8%;R3^slQ<<28`vEN~4e0;? diff --git a/state/map.yaml b/state/map.yaml index b6acf826..2dc3551c 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -84,7 +84,7 @@ active_subgoals: - Preserve the Ghostlight-derived heartbeat initiative seam: every lane, including coordinator/Self and Face, has a organ-state record and competes for heartbeat slots through readiness/reaction timing; initiative heat can raise or cool global, group, arena, role, and agent tempo through typed heartbeat policy; active thinking freezes initiative until completion, so heat never queues a lane already mid-turn; idle winners ruminate instead of inventing project work, and sleep windows distill the accumulated thought pressure into reviewed self-memory or doctrine. - Use `notes/epiphany-swarm-readiness-plan.md` as the live-fire direction gate. The local run path is a compass, not launch clearance: before unattended swarm operation, Epiphany needs a typed pause/brake, one initiative scheduler, completion-gated cooldown, stale active-turn recovery receipts, parent-side Face speech eligibility, memory lifecycle operations, and CultNet-first operator snapshots/intents/receipts. - Grow the VoidBot repo-Face pattern into Epiphany's product direction: each Epiphany owns one or more repos, has one or more Faces, and exposes project-native conversation through Aquarium, Discord, voice/WebRTC, stream surfaces, CLI, and CultNet clients so humans can talk to projects instead of pre-authoring complete implementation briefs. Face is special because Imagination acts as Projector, turning typed state into narrative context before the Face thinks, and Mind acts as Interpreter, turning natural Face output into reviewed state/side-effect intents after the Face thinks. - - Make Mind the gateway between thought and state. The state is the Mind: sub-agent outputs are worker thoughts, not authority. Role/reorient findings, statePatch, selfPatch, observations, evidence, receipts, scratch, and checkpoints must route through Mind review before durable state changes, using the VoidBot Face Interpreter pattern as the starting membrane. + - Make Mind the gateway between thought and state. The state is the Mind: sub-agent outputs are worker thoughts, not authority. Role/reorient findings, statePatch, selfPatch, observations, evidence, receipts, scratch, and checkpoints must route through Mind review before durable state changes, using the VoidBot Face Interpreter pattern as the starting membrane. Mind gateway reviews and Mind state-commit receipts are now typed runtime-spine documents for role/reorient acceptance; the review is persisted before state admission, and the commit receipt records the resulting durable revision after admission. - Use `notes/mind-cultnet-contracts.md` as the authority map for Mind's CultNet contract surface. CultMesh Verse placement is part of the contract: `epiphany-internal` carries private thought/proposal/review/commit/rejection flow, `gamecult-local` carries trusted operator-safe sharing without private-state authority, and `epiphany-global` carries public thought weather plus adoption receipts only. - Use `notes/substrate-gate-cultnet-contracts.md` as the authority map for Substrate Gate CultNet contract surface. Substrate Gate is the repository access protocol: source reads, indexing, edits, commands, and editor/runtime bridge operations need scoped Substrate Gate access receipts before Hands, Eyes, Face, workers, or bridge tools touch the repo. Mind and Substrate Gate are separate gates: Substrate Gate governs substrate access; Mind governs durable state admission. - Use `notes/eyes-cultnet-contracts.md` as the authority map for Eyes' CultNet contract surface. Eyes is the evidence ingress guardian: Substrate Gate grants source/substrate access, but Eyes turns inspected material into source lookup receipts, evidence reviews, evidence packets, and refusals before other organs cite it as looked-at truth. @@ -116,8 +116,8 @@ accepted_design: - Substrate Gate contract surface is now named beside Mind's state gate: `epiphany-core::substrate_gate` defines repo access requests, access reviews, grant/refusal receipts, snapshot receipts, and mutation receipts; runtime-spine advertises those contracts; CultMesh persists matching `EpiphanyCultMeshSubstrateGateContractEntry` policy documents so repo substrate access has its own typed guardian instead of hiding behind worker launch scope. - Eyes' evidence contract surface is named beside Substrate Gate and Mind: `epiphany-core::eyes_gateway` defines evidence requests, evidence reviews, source lookup receipts, evidence packets, and evidence refusal receipts; runtime-spine advertises those contracts; CultMesh persists matching `EpiphanyCultMeshEyesContractEntry` policy documents so retrieved snippets and source reads are not confused with inspected evidence. - Hands, Soul, and Continuity now have first-class contract catalogs beside Mind/Substrate Gate/Eyes. `epiphany-core::hands_gateway` defines action intents, reviews, command/patch/commit/PR/rollback/refusal receipts; `epiphany-core::soul_gateway` defines verification requests, invariant checks, verdict/regression/review/refusal receipts; `epiphany-core::continuity_gateway` defines continuity packets, compaction checkpoints, sleep distillation, recovery, stale-turn repair, and continuity refusal receipts. Runtime-spine advertises them and CultMesh persists matching Verse-scoped contract policy documents. - - Worker launch packets now carry `EpiphanyLaunchOrganContract` beside the typed launch document. The contract derives from authority scope, document kind, and output contract id; carries the full standing sub-agent dependency matrix; and names required Mind/Substrate Gate/Eyes/Hands/Soul/Continuity receipt document types before worker output may become durable state or trusted action. Runtime-spine validates and persists this contract on `EpiphanyRuntimeWorkerLaunchRequest`; bridge role/reorient/generic launch builders populate it. Role/reorient acceptance now refuses completed runtime-spine findings if their original worker launch request is missing, mismatched by document kind, or lacks a dependency/receipt contract requiring Mind review. - - `notes/perfect-machine-audit-roadmap.md` is the current architectural audit. The main finding is that organ contracts are now named, launch-carried, and minimally acceptance-gated against naked runtime jobs, but many receipts are still expectations rather than mandatory receipt chains. The Rust dependency body repair is landed: the missing `E:\Projects\CultLib\crates\*` paths were replaced with repo-contained vendored CultCache/CultNet/CultMesh crates, and `cargo test --manifest-path .\epiphany-core\Cargo.toml --lib` passes. + - Worker launch packets now carry `EpiphanyLaunchOrganContract` beside the typed launch document. The contract derives from authority scope, document kind, and output contract id; carries the full standing sub-agent dependency matrix; and names required Mind/Substrate Gate/Eyes/Hands/Soul/Continuity receipt document types before worker output may become durable state or trusted action. Runtime-spine validates and persists this contract on `EpiphanyRuntimeWorkerLaunchRequest`; bridge role/reorient/generic launch builders populate it. Role/reorient acceptance now refuses completed runtime-spine findings if their original worker launch request is missing, mismatched by document kind, or lacks a dependency/receipt contract requiring Mind review. The first executable Mind proof is landed: acceptance persists `epiphany.mind.gateway_review` before state admission and `epiphany.mind.state_commit_receipt` after admission with the resulting revision. + - `notes/perfect-machine-audit-roadmap.md` is the current architectural audit. The main finding is that organ contracts are now named, launch-carried, and minimally acceptance-gated against naked runtime jobs, while Mind admission has the first persisted review/commit receipt chain. Substrate Gate, Eyes, Hands, Soul, and Continuity receipts are still expectations rather than mandatory receipt chains. The current Mind receipt write is not transactional across state mutation and receipt persistence; future state admission should collapse mutation plus post-commit receipt into one owner when the storage layer supports it. The Rust dependency body repair is landed: the missing `E:\Projects\CultLib\crates\*` paths were replaced with repo-contained vendored CultCache/CultNet/CultMesh crates, and `cargo test --manifest-path .\epiphany-core\Cargo.toml --lib` passes. - `notes/codex-starvation-and-cultnet-liberation-plan.md` is the active foundation directive. It supersedes outward product/bridge/dogfood work and supersedes the weaker goal of merely making Codex app-server a cleaner adapter. Epiphany must become a native CultCache/CultNet runtime; Codex remains only as an OpenAI subscription auth/model-transport reliquary until that too can be replaced or minimized. - `notes/codex-auth-spine-inventory.md` is the current source-grounded inventory of the Codex organ that may survive. Corrected compliance invariant: Codex-compatible auth identity should remain anchored in retained vendored Codex-derived auth machinery, while Epiphany owns typed request/status/event/runtime surfaces around it. Codex app-server, apps, skills, marketplace, plugin UX, MCP OAuth handlers, and collaboration-mode surfaces are not part of the keeper spine. - `epiphany-openai-runtime` worker result ingress now parses assistant output directly into launch-kind-specific typed documents and stores typed nested `statePatch` / `selfPatch` payloads as MessagePack inside `EpiphanyRuntimeRoleWorkerResult`; generic `serde_json::Value` no longer mediates role/reorient worker results in that crate. JSON still exists at the OpenAI text edge because the model's output is text, but the runtime boundary after parsing is typed. @@ -588,4 +588,4 @@ current_status: cargo and rejects modeling/planning/graph/checkpoint authority. MVP status and coordinator smokes pass with six lanes, and the smoke harness now rebuilds stale coordinator/app-server binaries before using them. - next_action: Continue the Perfect Machine rebuild at the executable receipt-enforcement layer: required organ receipts are now carried on launch packets and Mind-review launch admission blocks naked findings, but Substrate Gate, Eyes, Hands, Soul, and Continuity receipts still need runtime-side proof and promotion gates before state/action claims can call themselves true. + next_action: Continue the Perfect Machine rebuild by turning the non-Mind launch-carried receipt expectations into effect-specific proof profiles. Do not blindly require every listed organ receipt for every finding; split actual required proofs by effect type, then wire the next executable gate through runtime-spine so Substrate Gate/Eyes/Hands/Soul/Continuity receipts can be proven before state/action claims call themselves true.