Record proposal Modeling first-result proof

notes/epiphany-current-algorithmic-map.md

@@ -3886,3 +3886,40 @@ The three failed attempts are not accepted reliability evidence. The next cut
 belongs to role-result schema construction/model ingress: preserve strict
 duplicate-field rejection while making the first model-produced result conform
 to its one-owner schema.
+
+## Runtime-owned proposal Modeling publication
+
+Proposal Modeling owns semantic frontier judgment, not RepoModel causality.
+
+- Owner: authenticated runtime launch context owns request/proposal identity,
+  model base, Body observation basis, patch identity, deterministic frontier
+  identity, evidence binding, and publication time. Modeling owns only the
+  closed `proposalFrontierDraft` plus ordinary role verdict/summary sight.
+- Inputs: one immutable proposal Modeling request and launch context, the
+  current RepoModel projection, and one strict semantic draft.
+- Outputs: one ordinary role result containing a runtime-composed
+  `RepoModelPatch` with exactly one active frontier upsert.
+- Derived state: provider response-format strictness is derived recursively
+  from the closed schema. Every constant declares its JSON type; this is a
+  provider contract, not a relaxation of runtime admission.
+- Forbidden writers: the model cannot author request IDs, proposal IDs, Body
+  basis, patch IDs, base hashes/revisions, timestamps, evidence provenance, or
+  arbitrary patch operations. A retry parser cannot merge duplicate fields or
+  repair missing anatomy.
+- Shared paths: direct provider completion and replay both pass through
+  `role_worker_result_from_ingress` and existing runtime role-result admission.
+- Cut line: the generic proposal full-`RepoModelPatch` schema is absent.
+  Legacy non-proposal Modeling schemas remain separate and retain their
+  downstream gates.
+- Verification: exact `e723058a`, release
+  `sha256-6428f9194c261806a8859ccff9efeb9bb041a0103c5bbd8fac617aae265a651e`,
+  witness
+  `sha256-7ee2e14548bad526e946fbd79b555b7891d2eb6e2917856fefb1ebb7aeebd995`
+  produced one first-attempt outer Modeling result on fresh copied state, zero
+  open jobs, and no Hands/Eyes authority. The copied owners stopped at exit
+  zero under the restored brake.
+
+The proposal grant and outer worker are single-attempt proven. Downstream
+coordinator review is not yet single-consumption proven: the live run emitted
+two receipt-bound `reviewModelingResult` continuation grants for the same
+proposal-bound result before settlement. That route is the next ownership cut.

notes/fresh-workspace-handoff.md

@@ -1,5 +1,51 @@
 # Fresh workspace handoff
 
+## Runtime-owned proposal Modeling first-result accepted - 2026-08-11
+
+Actual c006 remains exact `c9a2a979`, alive and cognitively braked. All live
+work below used fresh named-volume copies. The actual resident, Heartbeat,
+runtime, and local-Verse stores were not mutated or stopped.
+
+The repeated duplicate-field failures were a symptom of the wrong output
+owner. Generic proposal Modeling asked the model to author a complete
+`RepoModelPatch`, including runtime identity, model base, Body observation
+basis, request/proposal provenance, patch timestamps, deterministic frontier
+identity, evidence binding, and nested patch anatomy. Pushed `9f82ee38`
+removes that mouth. Proposal Modeling now returns one closed semantic
+`proposalFrontierDraft`; runtime derives and authenticates every causal patch
+field and publishes the exact patch through the existing admission path.
+Duplicate JSON keys still fail closed.
+
+The exact `9f82ee38` package passed 24-binary inspection, but its fresh copied
+gate exposed a provider-subset error before inference: `roleId` used `const`
+without the `type` OpenAI requires. Pushed `e723058a` adds the type and a
+recursive test that every constant in the dedicated schema declares one.
+Focused core coverage passes. Persistent-cache packaging completed with Cargo
+at 28.40s and produced exact 24-binary release
+`sha256-6428f9194c261806a8859ccff9efeb9bb041a0103c5bbd8fac617aae265a651e`
+and witness
+`sha256-7ee2e14548bad526e946fbd79b555b7891d2eb6e2917856fefb1ebb7aeebd995`
+with zero warnings. Receipts are under `.epiphany-run/linux-package-e723058a`.
+
+On a new copy, request
+`repo-frontier-proposal-modeling-c6e584188580f373360a1b9d5113e2df67a22dd16c7cefcd97361067862b6d4b`
+launched exactly one outer Modeling job,
+`75a69738-b694-411c-bb6d-f823b39bd9e9`. It used five internal read-only model
+tool follow-ups, produced one admitted runtime-owned frontier result on the
+first attempt, and terminalized the exact proposal grant. Runtime ended with
+zero open jobs and no actionable Hands or Eyes frontier. The copied brake was
+restored; resident and Heartbeat both exited zero. Final state hashes and logs
+are under `.epiphany-run/proposal-strict-live3-e723058a`.
+
+Do not flatten the remaining coordination wound. Heartbeat subsequently issued
+two receipt-bound `reviewModelingResult` continuation grants for the same
+completed proposal-bound result before the coordinator settled sleeping with
+`modelingResultProposalBound=true` and
+`modelingResultFailureReviewed=true`. This was not a second Modeling launch,
+but it is not clean single-consumption review either. Next map the result-review
+owner and require one proposal grant, one outer worker, at most one review
+continuation, and exact settlement on a fresh copy. Yggdrasil never builds.
+
 ## Governed directory inventory accepted live - 2026-08-11
 
 Actual c006 remains exact `c9a2a979`, alive and cognitively braked. All work

state/map.yaml

@@ -36,7 +36,7 @@ invariants:
 
 current_status:
   summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, exact 16c4b19f coordinator receipt and Heartbeat artifact retention, exact cce2b8ac narrow model-generation retention, exact eea15e82 model-turn JSON ingress, exact b1e8c89a semantic unattempted-generation retention, exact 6bc3ec3f semantic physical-epoch retirement, and exact 44230a05 Persona conversation retention are proven. Gamecult-ops 059821f owns Yggdrasil stream retention and exact 6ee08a4 owns stable Starfire Persona-permit firewall ingress. Exact 16c4b19f genuine idle and exact a987d2f7 active cognition completed 900-pulse bounded plateaus. Runtime-owned typed fulfillment is accepted live under exact 6dd9b132. Yggdrasil is the small public crossing body, never the release forge.
-  latest_phase: Actual c006 remains exact c9a2a979, alive and cognitively braked. Exact pushed 34d75d05 makes the exact ResidentSelfHeartbeatGrant plus resident state the sole owner of a bounded lifecycle projection; scheduling and sight share resident_self_grant_is_pending, while acknowledgements and artifact names remain non-authoritative. Exact Linux release sha256-718316c4372f3caf127579cd8a185fe11717f2370f1418d9a1f465a0efa54b8c with witness sha256-58d4c05c3de5b9c07ea76e06a2f60af94571a0f053da49de65629f413e0cbd92 passed 24-binary inspection with zero warnings. On copied c006, proposal Modeling invoked the typed lifecycle tool. Three attempts failed the strict role-result contract because the model emitted duplicate JSON fields; each failure stayed unfulfilled and was canonically requeued. Attempt four produced an admitted typed result grounded in resident lifecycle state: sampled older terminal grants remained launchable=false and the then-active grant was consumed and launchable=false. After the copied brake engaged, resident Self reconciled that evidence, terminalized the exact original grant once at revision 74, emitted no new grant, and then remained braked. Both copied owners exited zero; actual c006 was untouched.
+  latest_phase: Actual c006 remains exact c9a2a979, alive and cognitively braked. Exact pushed 9f82ee38 removes the generic full-RepoModelPatch mouth from proposal Modeling: the model owns one closed semantic proposalFrontierDraft while runtime derives patch identity, model base, Body observation basis, proposal/request provenance, timestamps, evidence binding, deterministic frontier identity, and patch anatomy. Its first copied live gate exposed that OpenAI requires a type beside every const. Exact pushed e723058a adds that provider-subset invariant. Exact Linux release sha256-6428f9194c261806a8859ccff9efeb9bb041a0103c5bbd8fac617aae265a651e with witness sha256-7ee2e14548bad526e946fbd79b555b7891d2eb6e2917856fefb1ebb7aeebd995 passed 24-binary inspection with zero warnings. On a fresh copied c006, proposal Modeling request repo-frontier-proposal-modeling-c6e584188580f373360a1b9d5113e2df67a22dd16c7cefcd97361067862b6d4b launched exactly one outer Modeling job, completed one runtime-owned typed frontier result on attempt one, terminalized its proposal grant, reached zero open jobs with Hands=false and Eyes=false, and stopped both owners at exit zero under the restored brake. Five read-only model-tool follow-ups occurred inside that one worker. Two later receipt-bound reviewModelingResult continuation grants were required before the coordinator settled sleeping with modelingResultProposalBound=true and modelingResultFailureReviewed=true; that duplicate review continuation is the next live seam, not a second Modeling launch.
   operational_state:
     local_worktree: exact_acd91e6e_imagination_runtime_owned_causality_live_accepted
     operator_wireguard: restored
@@ -70,7 +70,7 @@ current_status:
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: c006_exact_c9a2a979_alive_braked_revision_34_after_two_receipt_bound_continuation_grants
   unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, all three packaged fulfilled-before-receipt lanes, genuine packaged Imagination option generation, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, co-resident resident lifecycle retention, authenticated outer-worker attempt retention, deployed supervisor/projector journald ownership, Docker named-volume atomic snapshot visibility, and deterministic incremental release construction are accepted. Starfire's Docker Desktop F: bind is rejected for mutable authority after an exact packaged lockless reader observed an empty published snapshot during writer interruption. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. One completed Discord consequence remains blocked by the absent Yggdrasil credential. Exact aa841873 also makes legacy coordinator repair one full-snapshot transaction so a later hostile family cannot leave an earlier partial repair.
-  next_action: Keep actual c006 exact c9a2a979 alive under its cognitive brake. Treat exact 34d75d05 lifecycle sight as accepted, but not the three model-schema retries: map why proposal Modeling role-result JSON repeatedly acquired duplicate fields and cut the output-contract failure at its owning schema/ingress boundary without relaxing strict admission. Prove one copied proposal completes on its first attempt, then continue copied autonomous turnover without minting Hands, Persona, or deployment authority. Separately recheck Yggdrasil's Persona credential boundary before attempting the one missing public consequence. Yggdrasil never builds.
+  next_action: Keep actual c006 exact c9a2a979 alive under its cognitive brake. Treat exact e723058a first-attempt proposal Modeling publication as accepted. Map why one proposal-bound result required two receipt-bound reviewModelingResult continuation grants before settlement; make the exact accepted/bound result single-consumption review authority without weakening coordinator review or minting new consequence. Replay on fresh copied state and require one proposal grant, one outer Modeling job, at most one review continuation, exact terminal settlement, zero open jobs, and no Hands, Persona, or deployment authority. Then continue copied autonomous turnover. Separately recheck Yggdrasil's Persona credential boundary before attempting the one missing public consequence. Yggdrasil never builds.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
@@ -80,9 +80,9 @@ active_subgoals:
 
 organ_readiness:
   persona: partial; cross-host request/receipt/permit organs, distinct identities, exact release admission, unique permit completion, signed failure/unknown receipts, and no-repost behavior are live. Exact Bifrost cb3239aa fixes positional permit bodies and binds the Discord bridge command receipt to the signed request. A completed public consequence remains unproven because Yggdrasil has no Discord bot credential.
-  self: partial; proposal recovery, Mind admission, current-model Hands routing, Soul lifecycle precedence, verdict incorporation, proposal preemption, challenge-aware Eyes routing, in-process status ownership, causal Research/Soul-to-Modeling routing, and grant-owned lifecycle projection are live. Exact 34d75d05 proves strict schema failures requeue without granting consequence and a later admitted result terminalizes the original grant once, but first-attempt typed-result reliability remains open.
+  self: partial; proposal recovery, Mind admission, current-model Hands routing, Soul lifecycle precedence, verdict incorporation, proposal preemption, challenge-aware Eyes routing, in-process status ownership, causal Research/Soul-to-Modeling routing, and grant-owned lifecycle projection are live. Exact e723058a proves first-attempt proposal Modeling fulfillment and exact grant terminalization without consequence. The subsequent identical result-review route issued two receipt-bound continuation grants before settlement, so single-consumption downstream review remains open.
   eyes: proven for one bounded Windows challenged-claim circuit and one coordinated Linux resident circuit. Linux Eyes job eaf25324 invoked exactly three governed native read-only source tools, completed a typed role result, and was accepted as evidence ev-research-856fb6d1 with no external consequence. Broader source coverage remains open.
-  modeling: proven for the current bounded Windows circuit, the causal Linux resident Eyes-to-Modeling route, governed live directory observation, and typed resident grant sight. Exact 34d75d05 Modeling used the resident-owned lifecycle projection to establish sampled older terminal grants remained launchable=false after later grants and that its active consumed grant was already non-launchable. Three preceding duplicate-field outputs failed strict admission, so reliable first-attempt structured publication remains open. Broader Body-map coverage remains open.
+  modeling: proven for the current bounded Windows circuit, the causal Linux resident Eyes-to-Modeling route, governed live directory observation, typed resident grant sight, and first-attempt proposal-frontier publication. Exact e723058a gives the model one strict semantic draft and makes runtime own every causal patch field; one outer job produced one admitted frontier on its first attempt. Broader Body-map coverage and single-consumption coordinator review remain open.
   imagination: proven for three bounded live circuits, exact packaged receipt-free settlement, and genuine packaged model-produced option generation. Exact acd91e6e accepted signed public feedback into one proposal-only request, derived all causal identity and quoted-evidence references from authenticated runtime context, atomically published worker result plus candidate companion, settled Self once without retry, and neither adopted the proposal nor granted Hands. The rejected b661ec4b copied run remains evidence that model-authored evidence identifiers were an illicit provenance mouth; its three failed attempts were braked and sealed.
   hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind reviewed path ceilings to exact changed-path subsets.
   soul: proven for the current bounded route-chain consequence; exact d3bfbda0 launched Verification through typed plan-decision provenance, result f23fe2b6 was accepted at revision 57, and Self then derived Modeling before any repeated Hands authority.

state/scratch.md

@@ -4,9 +4,9 @@ Disposable working memory for one bounded rite.
 
 ## Current Subgoal
 
-Map and cut the repeated proposal-Modeling role-result duplicate-field failure
-at the schema/ingress owner. Preserve strict typed admission; do not add a
-permissive parser or let retries impersonate first-attempt readiness.
+Map the duplicate receipt-bound `reviewModelingResult` continuation route after
+one proposal-bound Modeling result. Preserve explicit coordinator review while
+making the exact result single-consumption authority.
 
 ## Accepted live boundary
 
@@ -37,14 +37,30 @@ the active consumed grant `launchable=false`. Under an engaged copied brake,
 Self reconciled the completed evidence, cleared the active turn at revision 74,
 and remained braked. No new grant appeared; both copied owners exited zero.
 
+## Accepted first-result publication
+
+Exact pushed `9f82ee38` replaces the generic full-patch proposal mouth with a
+closed semantic draft and runtime-owned causal composition. Exact pushed
+`e723058a` adds the missing provider-required type beside schema constants.
+Release `sha256-6428f9194c261806a8859ccff9efeb9bb041a0103c5bbd8fac617aae265a651e`,
+witness `sha256-7ee2e14548bad526e946fbd79b555b7891d2eb6e2917856fefb1ebb7aeebd995`,
+passed 24-binary inspection. Fresh copied live request
+`repo-frontier-proposal-modeling-c6e584188580f373360a1b9d5113e2df67a22dd16c7cefcd97361067862b6d4b`
+completed through one outer job on attempt one, bound one runtime-owned
+frontier, terminalized its proposal grant, and ended with zero open jobs and no
+Hands/Eyes frontier. Both owners exited zero under the restored brake.
+
 ## Next authority map
 
-- Owner to inspect: role-result schema construction and model-ingress decoding.
-- Inputs: the exact generated schema, role prompt, provider response body, and
-  strict duplicate-field rejection receipts.
-- Output: one canonical typed role-result object on the first valid model turn.
-- Forbidden cut: do not weaken duplicate-field rejection, merge conflicting
-  fields after the fact, or hide failure behind unbounded retry.
-- Verification: the same copied proposal must complete once on attempt one,
-  retain typed lifecycle evidence, terminalize exactly one grant, and remain
-  consequence-free.
+- Owner to inspect: coordinator Modeling-result acceptance/review state and
+  Heartbeat continuation issuance.
+- Inputs: the exact completed result, proposal binding/admission state, prior
+  review receipt, and resident continuation lifecycle.
+- Output: at most one review continuation for one exact result, followed by one
+  terminal settled projection.
+- Forbidden cut: do not suppress review with a cooldown, ack tombstone, log
+  heuristic, or retry ceiling; move the consumed fact to the exact result or
+  its owning typed review transaction.
+- Verification: fresh copied proposal produces one proposal grant, one outer
+  Modeling job, at most one review continuation, exact settlement, zero open
+  jobs, and no Hands, Persona, or deployment consequence.