Remove fictional sync authority

epiphany-core/src/bin/epiphany-repo-sync-request-family-smoke.rs

@@ -198,7 +198,7 @@ fn run_smoke(args: Args) -> Result<Value> {
     require_text(&request_text, "safe_action_family = \"repo.sync_request\"")?;
     require_text(&request_text, "[request]")?;
     require_text(&request_text, "status = \"awaiting-upstream-main-proof\"")?;
-    require_text(&request_text, "requested_owner = \"Bifrost\"")?;
+    require_text(&request_text, "proof_owner = \"Bifrost\"")?;
     require_text(
         &request_text,
         "requested_effect = \"prove-published-commit-contained-by-upstream-main\"",
@@ -252,6 +252,8 @@ fn run_smoke(args: Args) -> Result<Value> {
     require_text(&request_text, "credit_ledger_authorized = false")?;
     require_text(&request_text, "hands_action_authorized = false")?;
     require_text(&request_text, "cross_body_mutation_authorized = false")?;
+    require_text(&request_text, "bifrost_upstream_proof_required = true")?;
+    require_text(&request_text, "maintainer_review_receipt_required = true")?;
     require_text(&request_text, "private_state_exposed = false")?;
 
     let summary = json!({

epiphany-core/src/bin/epiphany-work.rs

@@ -4107,7 +4107,7 @@ fn derive_repo_sync_request_plan(
         "[request]".to_string(),
         format!("id = {}", toml_basic_string(&request_id)),
         "status = \"awaiting-upstream-main-proof\"".to_string(),
-        "requested_owner = \"Bifrost\"".to_string(),
+        "proof_owner = \"Bifrost\"".to_string(),
         "requested_effect = \"prove-published-commit-contained-by-upstream-main\"".to_string(),
         format!(
             "publication_request_ref = {}",
@@ -4150,7 +4150,8 @@ fn derive_repo_sync_request_plan(
         "service_lifecycle_authority = false".to_string(),
         "cross_body_mutation_authorized = false".to_string(),
         "private_verse_rummaging = false".to_string(),
-        "operator_or_maintainer_authority_required = true".to_string(),
+        "bifrost_upstream_proof_required = true".to_string(),
+        "maintainer_review_receipt_required = true".to_string(),
         String::new(),
         "[verification]".to_string(),
         "asks = [".to_string(),

epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs

@@ -674,7 +674,7 @@ impl RepoSyncRequest {
     }
     pub(super) fn awaits_upstream_proof(&self) -> bool {
         self.request.status == "awaiting-upstream-main-proof"
-            && self.request.requested_owner == "Bifrost"
+            && self.request.proof_owner == "Bifrost"
             && self.request.requested_effect == "prove-published-commit-contained-by-upstream-main"
             && !self.request.publication_request_ref.is_empty()
     }
@@ -715,13 +715,14 @@ impl RepoSyncRequest {
             && !a.service_lifecycle_authority
             && !a.cross_body_mutation_authorized
             && !a.private_verse_rummaging
-            && a.operator_or_maintainer_authority_required
+            && a.bifrost_upstream_proof_required
+            && a.maintainer_review_receipt_required
     }
 }
 #[derive(Debug, Deserialize)]
 struct RepoSyncRequestBody {
     status: String,
-    requested_owner: String,
+    proof_owner: String,
     requested_effect: String,
     publication_request_ref: String,
 }
@@ -762,7 +763,8 @@ struct RepoSyncAuthority {
     service_lifecycle_authority: bool,
     cross_body_mutation_authorized: bool,
     private_verse_rummaging: bool,
-    operator_or_maintainer_authority_required: bool,
+    bifrost_upstream_proof_required: bool,
+    maintainer_review_receipt_required: bool,
 }
 pub(super) fn parse_repo_sync_request(text: &str) -> Result<RepoSyncRequest> {
     toml::from_str(text).context("sync request is not valid typed TOML")

epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance_tests.rs

@@ -320,7 +320,7 @@ summary = "summary"
 private_state_exposed = false
 [request]
 status = "awaiting-upstream-main-proof"
-requested_owner = "Bifrost"
+proof_owner = "Bifrost"
 requested_effect = "prove-published-commit-contained-by-upstream-main"
 publication_request_ref = "publication"
 [antecedents]
@@ -354,7 +354,8 @@ hands_action_authorized = false
 service_lifecycle_authority = false
 cross_body_mutation_authorized = false
 private_verse_rummaging = false
-operator_or_maintainer_authority_required = true
+bifrost_upstream_proof_required = true
+maintainer_review_receipt_required = true
 "#;
         let request = parse_repo_sync_request(text).expect("fixture is typed TOML");
         assert!(!request.has_authority_seals());

notes/conceptual-substitution-audit-2026-07-12.md

@@ -1333,3 +1333,10 @@ unresolved rather than mechanically renamed. Operator authority and Maintainer
 policy consent may be genuinely different inputs, but the current field does
 not say whether either may execute, approve, or merely request synchronization.
 Map the actual sync consequence path before cutting it.
+
+The sync trace found no synchronization consequence path at all. The family is
+a branch-local request for Bifrost to prove that an already-published commit is
+contained by `origin/main`; it explicitly denies merge, push, and sync. The
+operator half of the old OR seal was fictional. The contract now names Bifrost
+as proof owner and independently requires the Maintainer review receipt. Actual
+publication and push remain outside this request family.

notes/fresh-workspace-handoff.md

@@ -475,3 +475,10 @@ owned instead of ownerless. The unresolved external-governance field is
 upstream sync's `operator_or_maintainer_authority_required`; trace its actual
 effect owner before deciding whether it is alternate human authority or another
 collapsed obligation.
+
+That trace is complete: `repo.sync_request` performs no sync effect. It asks
+Bifrost for an upstream ancestry proof after publication and separately
+requires Maintainer review evidence. The fictional operator-or-maintainer gate
+is removed; the request still denies merge, push, sync, and Hands authority.
+Next inspect composite owner labels in operator projections, starting with rows
+that may be interpreted as decision or execution ownership.

state/map.yaml

@@ -660,4 +660,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Continue the beyond-closure composite-owner purge. Secret/dependency policy, artifact acceptance, PR publication, and readiness now use distinct routing, decision, verification, admission, execution, accounting, publication, and provider-evidence authorities. Next trace upstream sync's unresolved operator_or_maintainer_authority_required through the real consequence path before cutting it, then repair composite owner labels in operator projections. Distinguish genuine alternate human authority from collapsed organ ownership; keep closure's zero-substring invariant intact.
+  next_action: Continue the beyond-closure composite-owner purge. repo.sync_request is now correctly modeled as Bifrost-owned ancestry proof with separate Maintainer review evidence and no operator, push, merge, sync, or Hands authority. Next inspect and repair composite owner labels in operator projections, starting with rows that could be mistaken for decision or execution ownership. Distinguish participant lists from owners and preserve closure's zero-substring invariant.