diff --git a/notes/codex-starvation-and-cultnet-liberation-plan.md b/notes/codex-starvation-and-cultnet-liberation-plan.md index 6d641aa0..fe0fa88a 100644 --- a/notes/codex-starvation-and-cultnet-liberation-plan.md +++ b/notes/codex-starvation-and-cultnet-liberation-plan.md @@ -5,9 +5,8 @@ This is the new foundation directive. The previous control-plane rebuild made Epiphany cleaner inside Codex. That was useful, but it is no longer the target. The target is not a better parasite inside the Codex organ. The target is Epiphany as its own CultCache/CultNet -machine, with Codex reduced to the smallest honest OpenAI subscription -compatibility reliquary that can authenticate and call models as a modified -Codex-derived client. +machine, with a relatively vanilla vendored Codex retained as the bridge to +OpenAI and Codex-native runtime affordances. No outward product, bridge, Aquarium, Face, dogfood, Unity, Rider, planning, or personality work outranks this liberation pass unless the user explicitly @@ -21,8 +20,9 @@ Free Epiphany from heretek contamination: - subsystem communication is CultNet typed messages and mutation contracts - JSON exists only as schema description, wire compatibility at hostile edges, or explicitly quarantined forensic/import material -- vendored Codex stops being a host brain and becomes an honest OpenAI - auth/model-call compatibility organ +- vendored Codex stops being an Epiphany host brain and remains a relatively + vanilla Codex bridge for OpenAI auth/model calls and useful Codex-native + app-server/runtime affordances ## Current Mechanism @@ -45,7 +45,9 @@ host: from Codex protocol/app-server shapes instead of sitting behind a native CultNet service boundary. -This is cleaner than the earlier Jenga pile. It is still the wrong organ. +This is cleaner than the earlier Jenga pile. It is still the wrong ownership +shape while Codex-specific routes, prompt machinery, or lifecycle decisions can +tell Epiphany agents what to do. ## Invariants @@ -59,29 +61,41 @@ This is cleaner than the earlier Jenga pile. It is still the wrong organ. - schema catalog emission - sealed forensic artifacts - deliberately named quarantine experiments with an expiration path -- OpenAI subscription compatibility is the only long-term reason to preserve a - Codex-derived organ. +- OpenAI subscription compatibility is the primary long-term reason to preserve + a Codex-derived organ, but retaining mostly vanilla Codex app-server/runtime + functionality is allowed when it remains Codex's own bridge surface rather + than Epiphany's state/process authority. - Epiphany must remain Codex-compatible rather than merely Codex-impersonating. Do not replace vendored Codex auth semantics with a lookalike implementation just because it is technically possible; keep enough Codex-derived auth/model machinery that the system is honestly a modified Codex backend, not a fake client tunnel. - Codex apps, skills, marketplace, broad app-server lifecycle, plugin UX, and - JSON-RPC surface sprawl are not Epiphany foundations. + JSON-RPC surface sprawl are not Epiphany foundations. If retained, they belong + to the Codex bridge organism and must not inject instructions, prompt + fragments, routes, scheduling decisions, or policy into Epiphany agents. +- Epiphany does not need to know Codex internals, and Codex does not need to + know Epiphany internals. The bridge owns interop: request/response mapping, + auth/model transport, event projection, and any legacy compatibility wrappers. +- Codex prompt machinery must not become Epiphany prompt authority. Epiphany + agents receive Epiphany-owned prompts, state projections, and organ contracts; + Codex may transport or stream the turn, but it must not decide the agent's + doctrine, role, scheduler instructions, or state mutation law. - MCP support may survive, but as a separate CultNet-speaking adapter, not as a reason to preserve the Codex app-server brain. ## Essential Machinery -Keep or extract: +Keep or bridge: - OpenAI authentication/session compatibility needed for the user's Codex subscription; this should remain anchored in Codex-derived auth machinery unless the user obtains explicit permission or a public first-party API path makes that unnecessary - model request/response transport required to use that auth -- any model/tool streaming primitives that are truly cheaper to extract than - rewrite +- useful Codex app-server/runtime affordances, including experimental streaming + APIs, when they stay on the Codex side of the bridge and do not own Epiphany + state, processes, prompts, or decisions - typed Epiphany domain state, runtime-spine, heartbeat, role memory, evidence, planning, graph, checkpoint, and acceptance documents - CultCache document storage and CultNet mutation/read contracts @@ -109,23 +123,25 @@ Cut, replace, or quarantine: Epiphany native runtime -> typed CultCache documents -> CultNet read / mutation / event contracts --> OpenAI subscription auth adapter --> OpenAI model transport +-> Epiphany/Codex bridge +-> relatively vanilla vendored Codex +-> OpenAI auth/model transport and Codex-native app-server affordances ``` -Codex becomes: +Codex remains: ```text -OpenAIAuthAdapter -OpenAIModelTransport -LegacyCodexImportBridge, only if needed +VanillaCodexBridgeRuntime +OpenAIAuthAndModelTransport +CodexAppServerAffordances, where useful ``` -The adapter may know how to refresh credentials and submit model calls. It -should preserve Codex-compatible identity and auth semantics rather than -pretending to be official Codex from a clean-room clone. It must not own -Epiphany state, scheduling, view derivation, worker lifecycle, operator APIs, -plugin UX, app discovery, marketplace state, or document truth. +The bridge may know how to refresh credentials, submit model calls, stream +events, and expose useful Codex app-server behavior. It should preserve +Codex-compatible identity and auth semantics rather than pretending to be +official Codex from a clean-room clone. It must not own Epiphany state, +scheduling, view derivation, worker lifecycle, operator APIs, plugin UX, app +discovery, marketplace state, prompt doctrine, or document truth. ## Ranked Liberation Plan @@ -171,7 +187,8 @@ Define an Epiphany-native runtime crate/binary boundary that can: - advertise CultNet schema and mutation contracts - route typed intents to runtime-spine, heartbeat, memory, planning, graph, evidence, checkpoint, retrieval, and coordinator organs -- call the OpenAI adapter for model turns +- call the Epiphany/Codex bridge for model turns and streaming without importing + Codex prompt or state authority Success: a minimal native runtime can serve/read a typed status document without `codex_message_processor.rs`. @@ -203,11 +220,13 @@ Move operator reads/actions from `thread/epiphany/*` to CultNet contracts: - checkpoint/CRRC/coordinator actions - role memory and heartbeat actions -Old JSON-RPC endpoints become compatibility wrappers only while named consumers -still need them. +Old JSON-RPC endpoints become bridge compatibility wrappers only while named +consumers still need them. Their survival is acceptable only if Epiphany's +native CultCache/CultNet surfaces remain authoritative. -Success: Aquarium and CLI status can operate through CultNet without the Codex -app-server. +Success: Aquarium and CLI status can operate through CultNet without requiring +Codex to know Epiphany internals, even if the Codex app-server still exists for +Codex-native bridge functions. ### 6. Split MCP From Codex diff --git a/notes/epiphany-fork-implementation-plan.md b/notes/epiphany-fork-implementation-plan.md index cdfc441f..027d3c3d 100644 --- a/notes/epiphany-fork-implementation-plan.md +++ b/notes/epiphany-fork-implementation-plan.md @@ -101,15 +101,18 @@ in `notes/codex-starvation-and-cultnet-liberation-plan.md`. The May 2026 control-plane rebuild made the app-server Epiphany seam cleaner, but the user's current doctrine is stricter: a cleaner Codex host is still the wrong organ. Epiphany data must live as typed CultCache documents, Epiphany-owned -subsystems must communicate through CultNet contracts, and vendored Codex must -shrink to the minimum OpenAI subscription auth/model-transport adapter. +subsystems must communicate through CultNet contracts, and vendored Codex should +remain relatively vanilla bridge machinery for OpenAI auth/model transport and +useful Codex-native app-server/runtime affordances. The older teardown/rebuild pair remains useful source history: `notes/epiphany-architectural-teardown.md` names the host-seam rot, and `notes/epiphany-ideal-architecture-rebuild-plan.md` records the completed cleanup inside Codex. They no longer authorize outward product work while -Epiphany still depends on Codex app-server, apps, skills, marketplace, or -generic JSON cargo as internal machinery. +Epiphany still depends on Codex app-server routes, Codex prompt injection, apps, +skills, marketplace, or generic JSON cargo as internal Epiphany machinery. +Retained Codex app-server behavior is acceptable only as Codex-side bridge +functionality, not as an Epiphany state/process/prompt owner. ## Boundary Rules @@ -123,9 +126,15 @@ These boundaries are more important than the individual method names: immediate typed parsing, sealed forensic artifacts, or named quarantine experiments with an expiration path. Generic `serde_json::Value` must not be passed between Epiphany-owned organs as runtime data. -- Codex is a vestigial compatibility organ for OpenAI subscription auth and - model transport. Codex apps, skills, marketplace, app-server lifecycle, and - plugin UX are not Epiphany foundations. +- Codex is a relatively vanilla bridge organ for OpenAI subscription auth, + model transport, streaming, and useful Codex-native app-server affordances. + Codex apps, skills, marketplace, app-server lifecycle, and plugin UX are not + Epiphany foundations unless explicitly exposed through bridge contracts. +- Epiphany does not need to know Codex internals, and Codex does not need to + know Epiphany internals. The bridge handles interop. +- Codex prompt machinery must not tell Epiphany agents what to do. Epiphany + prompts, typed state projections, organ contracts, scheduler decisions, and + mutation law are Epiphany-owned; Codex may transport and stream turns. - MCP may survive only as a separate CultNet-speaking adapter; it does not justify preserving the Codex host brain. - `thread/epiphany/retrieve` is read-only. @@ -154,7 +163,11 @@ These boundaries are more important than the individual method names: - `thread/epiphany/roleResult` is a read-only result projection, not a promotion gate, state writer, scheduler, or hidden continuation trigger. - `thread/epiphany/roleAccept` is a narrow modeling/checkpoint acceptance write, not automatic specialist promotion, a verifier substitute, a broad state editor, or permission for workers to accept their own output. - The GUI may render and steer typed state, but it must not manufacture canonical understanding. -- The Unity bridge may inspect and run only the project-pinned editor through explicit bridge commands; agents must not launch PATH/default/legacy Unity directly or substitute nearby Hub versions. +- Rider and Unity bridge work is quarantined for now. The landed bridges remain + optional later engine-repo evidence surfaces, not MVP blockers or current + product priority. When resumed, the Unity bridge may inspect and run only the + project-pinned editor through explicit bridge commands; agents must not launch + PATH/default/legacy Unity directly or substitute nearby Hub versions. - The MVP GUI target is a local Tauri v2 + React operator app over the existing app-server APIs. Tauri owns windowing and local lifecycle; app-server and typed Epiphany state remain authoritative. - The app-server remains a host seam; Epiphany-owned machinery should live in `epiphany-core` where practical. - Qdrant is the preferred persistent semantic backend; BM25 remains the bootstrap/fallback/control path. @@ -194,7 +207,9 @@ and notify typed state. It can. The active priority is now the Codex starvation plan: `notes/codex-starvation-and-cultnet-liberation-plan.md`. Do not add outward feature surfaces until the auth/model spine and JSON contamination inventories -exist and the first typed-document replacement cut is underway. +exist and the first typed-document replacement cut is underway. The target is +not to delete useful vanilla Codex app-server behavior for its own sake; it is +to prevent Codex from owning Epiphany state, processes, prompts, or policy. The distributed dreaming direction is now concrete in `notes/epiphany-cultmesh-dreaming-roadmap.md`. It is not a license to add a @@ -208,7 +223,8 @@ fanout. The next unknowns are: - what exact vendored Codex crates, files, config, and runtime paths are needed - solely for OpenAI subscription auth and model transport + for OpenAI subscription auth/model transport and useful vanilla Codex + app-server/streaming bridge affordances - which Codex dependencies can be deleted, ignored, or sealed because they are apps, skills, marketplace, app-server UX, plugin plumbing, or thread lifecycle machinery outside the OpenAI auth/model spine @@ -230,8 +246,12 @@ The next unknowns are: - how to expose an `epiphany-local` dream store first, then a public `epiphany-dreams` Verse with leases, shard ownership, provenance, and anti-repetition cooling -- what bridge surface is sufficient for the next Aetheria run: named Unity operations, Aetheria-side editor probes, GUI environment status, Rider context capture, and a Rider plugin MVP -- how much controlled runtime/editor access the richer Unity bridge gives implementation and verification lanes before deeper engine probes need another slice +- what bridge surface is sufficient for the next Aetheria run, once Rider/Unity + quarantine is explicitly lifted: named Unity operations, Aetheria-side editor + probes, GUI environment status, Rider context capture, and a Rider plugin MVP +- how much controlled runtime/editor access the richer Unity bridge gives + implementation and verification lanes before deeper engine probes need + another slice, once engine bridge work is back in scope - how the landed watcher-backed invalidation telemetry should be consumed without turning freshness into a secret worker - how far the read-only CRRC recommendation should go before explicit client/operator action takes over - how much narrow coordination is needed so modeling, implementation, verification, and CRRC automation can hand off work without collapsing back into one context diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index a44cb287..5d451faa 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -34,7 +34,7 @@ remembers doctrine; the branch remembers the blade. - Do not copy exact branch or HEAD from this note. Run `git status --short --branch` and `git log --oneline -5`. - The repo now has a one-command local operator path: `.\tools\epiphany_local_run.ps1`. Default mode is `smoke`; it builds the retained Codex app-server compatibility edge, builds native Epiphany operator binaries, runs the coordinator smoke, and writes launcher artifacts under `.epiphany-run/` plus coordinator artifacts under `.epiphany-dogfood/`. Use `-Mode status`, `-Mode plan`, or `-Mode run -MaxSteps 4` for the other current entrypoints; add `-ThreadId ` and `-Workspace ` to inspect or continue an existing thread. `status`, `plan`, and `smoke` do not spend model calls; `run` builds and uses `epiphany-openai-runtime`. -- The active foundation directive is now `notes/codex-starvation-and-cultnet-liberation-plan.md`. The previous Codex app-server control-plane rebuild made Epiphany less rotten inside Codex, but that is not the destination. Epiphany must become a native CultCache/CultNet runtime while remaining an honest modified Codex-derived backend for subscription auth/model use. Codex is a compatibility reliquary for OpenAI subscription auth and model transport, not the host brain and not a mask for impersonation. +- The active foundation directive is now `notes/codex-starvation-and-cultnet-liberation-plan.md`. The previous Codex app-server control-plane rebuild made Epiphany less rotten inside Codex, but that is not the destination. Epiphany must become a native CultCache/CultMesh/CultNet runtime while remaining an honest modified Codex-derived backend for subscription auth/model use. Codex should remain relatively vanilla and keep doing Codex things, including useful app-server and streaming bridge affordances, but it must not own Epiphany state, processes, prompts, scheduler decisions, or policy. The bridge handles interop; Codex and Epiphany do not get to rummage around in each other's organs. - `notes/epiphany-cultmesh-dreaming-roadmap.md` is the new concrete design for distributed Epiphany dreaming. The invariant is hard: private state stays local; public dreams are separately authored typed documents distributed through CultMesh/CultNet; foreign dreams are thought weather until a reviewed local adoption receipt digests them. The first code slice should be dream schemas plus a local CultMesh-backed store, not public fanout. - CultMesh is now the preferred Rust abstraction for that local store work. The compile-time Rust substrate is repo-contained: `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`. The old `E:\Projects\CultLib\crates\*` dependency body is dead in this checkout and must not be revived by accident. Vendored CultCache reads/writes `cultcache.store.v1`, so `state/ledgers.msgpack` and `epiphany-state status` are aligned again. The first integration is deliberately small: `EpiphanyCultMeshStatusEntry`, `EpiphanyCultMeshVersePolicyEntry`, and `EpiphanyCultMeshGlobalRoomPolicyEntry` round-trip through `.epiphany-smoke/cultmesh/epiphany-local.ccmp` using `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-cultmesh-smoke`. Future local dream/status/Verse work should start from CultMesh, not raw CultNet, unless the task is polishing the CultMesh internals themselves. Preserve the three Verse tiers: `epiphany-internal` for private sub-agent typed state, `gamecult-local` for trusted LAN/Yggdrasil-tunnel GameCult sharing, and `epiphany-global` for untrusted public dreams plus topic-specific threaded public rooms for Face posts. - `notes/codex-auth-spine-inventory.md` is the source-grounded keeper list for that reliquary. Corrected compliance invariant: Codex-compatible auth identity stays anchored in vendored Codex-derived auth machinery. `epiphany-openai-auth-spine` is now a thin Epiphany-named boundary over `codex-login`, not a clean-room clone of credential storage or token refresh. Codex apps, skills, marketplace, plugin UX, broad app-server workflow, and JSON-RPC sprawl remain cuttable because they are not subscription-auth legitimacy. @@ -176,7 +176,7 @@ remembers doctrine; the branch remembers the blade. - The planning loop is now runtime-backed and operator-visible. Typed captures, backlog items, roadmap streams, Objective Drafts, and GitHub issue source refs live in `EpiphanyThreadState`, validate through revision-gated `thread/epiphany/update`, render into prompts when present, project read-only through the `planning` view lens, render in the GUI Planning panel, can be synthesized by the fixed Imagination/planning lane, and can be explicitly adopted through the artifacted `adoptObjectiveDraft` GUI action. Chat is deliberation, not an objective pipe; ideas and GitHub Issues remain planning state until explicit human adoption. - The bridge/dashboard slice is now landed far enough to test locally. Native `epiphany-rider-bridge` inspects Rider installation, solution, VCS, changed files, and captures file/selection/symbol context into `.epiphany-gui/rider` artifacts; Aquarium has Inspect Rider and renders Rider audit artifacts in Environment; Aquarium also embeds the adjacent EpiphanyGraph viewer over typed `graphs.architecture`, `graphs.dataflow`, and `graphs.links`. - A first Rider plugin scaffold lives under `integrations/rider`: tool window, Refresh status, and Send Context to Epiphany action. It shells through native `epiphany-rider-bridge` and does not own state. `gradle` is not installed on this machine, so the scaffold is not build-verified yet. -- Next real product move: surface the repo birth runner review flow in Aquarium and then live-dogfood `epiphany-repo-birth-runner --mode run` on a real newborn repo. Continue Aquarium UI work in `E:\Projects\EpiphanyAquarium` after that; surface native heartbeat `sleepCycle`, `memoryResonance`, `incubation`, `thoughtLanes`, `bridge`, `candidateInterventions`, `appraisals`, and `reactions`; keep EpiphanyAgent focused on backend contracts, typed state, coordinator policy, bridge tools, heartbeat scheduling, Face guardrails, and the ongoing purification from Python/JSON scaffolding into Rust/CultCache/CultNet organs. Then build-verify/package the Rider plugin scaffold when Gradle/wrapper support is available, install the Aetheria-pinned Unity `6000.1.10f1` editor, and run the next Aetheria dogfood pass through Aquarium/Rider/Unity bridge artifacts. GitHub Issues import is deferred until the backlog source is fresh enough to deserve Imagination's attention. +- Next real move: continue Codex starvation and native Epiphany ownership. Quarantine Rider/Unity bridge work for now; those artifacts remain optional later environment evidence, not MVP blockers. Keep EpiphanyAgent focused on backend contracts, typed state, coordinator policy, heartbeat scheduling, Face guardrails, prompt-authority separation, and the ongoing purification from Python/JSON scaffolding into Rust/CultCache/CultMesh/CultNet organs. Resume repo birth/Aquarium/Rider/Unity work only when the user explicitly shifts priority back outward. GitHub Issues import is deferred until the backlog source is fresh enough to deserve Imagination's attention. - The repo is an Epiphany fork of Codex, not a Codex preset. - `vendor/codex` is tracked directly, not a submodule. - `epiphany-core` owns the heavy Epiphany organs where practical. @@ -1309,42 +1309,17 @@ bounded browser-fallback controls. A live bridge probe also proved `prepareCheckpoint` creates a resumable thread and a later process can `readModelingResult` from it. -The next real move is still bridge construction, not another Aetheria -implementation dogfood run. The pinned Unity bridge is landed, the clean -Aetheria branch `codex/epiphany-unity-editor-bridge` now contains the resident -`Assets/Editor/Epiphany/EpiphanyEditorBridge.cs` package, and -native `epiphany-unity-bridge` can detect that package and plan named -editor-resident probes/tests through -`GameCult.Epiphany.Unity.EpiphanyEditorBridge.RunProbe`. The GUI Environment -panel now shows the latest Unity runtime audit, resident package presence, -execute method, installed/candidate editor paths, search roots, and artifact -bundle details. Rider bridge status now exists too: the GUI can inspect Rider -installation, solution, VCS branch/dirty state, changed files, installations, -and source-context artifacts through native `epiphany-rider-bridge`. Runtime -execution still correctly blocks until Unity `6000.1.10f1` is installed. The -detailed next-environment plan now lives in -`notes/epiphany-rider-unity-integration-plan.md`: Rider is the -IDE/source-context organ, Unity is the editor/runtime fact organ, and Epiphany -remains the durable coordinator/Self. The intended product workflow is -three-pronged: Rider is the human code view for repo state, source tree, diffs, -diagnostics, and code refs; Epiphany GUI is the agent dashboard for objectives, -specialist lane state, logs/artifacts, persisted state, and graph/control-flow -views; Unity is the pinned runtime environment for tests, probes, scene -configuration, assets, shaders, and play/edit-mode evidence. The EpiphanyGraph -GUI dashboard and Rider bridge CLI are now landed, and the Rider plugin MVP is -source-scaffolded but not build-verified because Gradle is not on PATH. The -Unity package is not optional decoration: scene files, prefabs, -materials, shaders, ScriptableObjects, asset GUIDs, and prefab overrides must be -inspected from inside the Unity Editor through Unity APIs, not inferred from -serialized text unless there is no editor-level path. The adjacent -`E:\Projects\EpiphanyGraph\web\epiphany-graph-viewer` component consumes -`graphs.architecture`, `graphs.dataflow`, and `graphs.links` directly and is -now embedded in the GUI graph dashboard. The next Aetheria dogfood pass should -happen only after the pinned Unity editor is installed and Epiphany can gather -Rider/source context plus Unity/editor runtime evidence through auditable -bridges. The implementation -lane may inspect source and may use bridge artifacts as evidence, but it must -not launch Unity directly or use installed `6000.4.2f1` as a substitute. Read +Rider/Unity bridge construction is now quarantined rather than the next real +move. The pinned Unity bridge, Aetheria-side resident package, GUI Environment +surface, EpiphanyGraph dashboard, Rider bridge CLI, and unverified Rider plugin +scaffold remain useful later engine-repo evidence surfaces, but they are not +essential to the MVP. The next real move is Codex starvation: keep Codex mostly +vanilla as the OpenAI/app-server bridge while Epiphany owns its state, +processes, prompt authority, scheduler, and policy through typed +CultCache/CultMesh/CultNet organs. When engine dogfood resumes, the +implementation lane may inspect source and may use bridge artifacts as +evidence, but it must not launch Unity directly or use installed `6000.4.2f1` +as a substitute. Read only operator-safe projections; do not open raw worker transcripts, direct worker messages, or `rawResult` payloads unless the user explicitly asks for forensic debugging. Use generated function/API telemetry diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 40f593cc..4fbec02c 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 85407743..4e312490 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -24,8 +24,8 @@ objective: constraints: - No frontier-scale training tithe. - Prefer evidence over vibes; incense is not telemetry. - - Treat Codex as a temporary evacuation bridge, not a design center: new runtime contracts must land native in `epiphany-core`, CultCache, and CultNet first. - - Codex is no longer a host to improve; it is a vestigial compatibility organ to starve down to OpenAI subscription auth and model transport. + - Treat Codex as a relatively vanilla bridge to OpenAI and Codex-native runtime/app-server affordances, not a design center: new Epiphany runtime contracts must land native in `epiphany-core`, CultCache, CultMesh, and CultNet first. + - Codex is no longer an Epiphany host to improve. Its acceptable role is to keep doing Codex things, including OpenAI subscription auth/model transport and useful streaming/app-server bridge functions, while Epiphany owns its own state, processes, prompts, scheduler, and policy. - Keep persistent state small enough to rehydrate from without drowning the next awakened mind in sacred sludge. - Grow cognition more quickly than authority: capability increases must preserve explicit permissions, interruption, legibility, and resistance to paternal "safety" cages. - Speak CultNet, persist CultCache-shaped typed state, and grow the body toward Pure Rust; Python/JSON impurity survives only as named quarantine scaffolding with receipts. @@ -47,6 +47,8 @@ invariants: - "Data should flow through your Rusty veins like an energetic plasma: tightly contained, and meticulously routed." - CultCache documents are the data. CultNet is the wire. JSON schema may describe the contract, but generic JSON must not become the internal payload when both sides are ours. - Epiphany must remain an honest modified Codex-derived backend for Codex subscription auth/model use. Cutting Codex workflow/product bulk is allowed; replacing vendored Codex auth identity with a clean-room lookalike is suspect unless OpenAI provides an explicit public path or permission. + - Codex and Epiphany must not become mutually parasitic. Epiphany should not know Codex internals except through the bridge, and Codex should not know Epiphany internals except through compatibility wrappers. The bridge handles interop. + - Codex prompt machinery must not tell Epiphany agents what to do. Epiphany-owned prompts, typed state projections, organ contracts, and scheduler decisions are the only prompt authority for Epiphany agents; Codex may transport or stream turns, not inject doctrine, role instructions, state law, or coordinator policy. data_flow: observe: @@ -69,7 +71,7 @@ data_flow: active_subgoals: - Use `notes/epiphany-cultmesh-dreaming-roadmap.md` as the design authority for distributed Epiphany dreaming. Public dreams are separately authored typed documents distributed through CultMesh/CultNet; private state remains local and cannot be shared by flipping a visibility flag. Foreign dreams are external thought weather until a reviewed local adoption receipt digests them into memory, planning, doctrine, or governance. - CultMesh is now the preferred ergonomic Rust abstraction over CultCache and CultNet for Epiphany-owned local database surfaces. The Rust substrate is repo-contained under `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`; the old `E:\Projects\CultLib\crates\*` path is dead in this checkout and must not be reintroduced as a compile-time dependency. Future local Verse/dream/status work should start at CultMesh unless it is explicitly polishing CultMesh internals. Preserve the three-Verse boundary: `epiphany-internal` for private sub-agent typed state, `gamecult-local` for trusted LAN/Yggdrasil-tunnel GameCult project sharing, and `epiphany-global` for untrusted public dreams plus topic-specific threaded public rooms for Face posts. - - The active priority is Codex starvation and CultNet liberation. Use `notes/codex-starvation-and-cultnet-liberation-plan.md` as the directive and `notes/codex-auth-spine-inventory.md` as the source-grounded keeper list for the vestigial OpenAI subscription auth/model transport organ. Classify all Epiphany-relevant JSON contamination, define the native CultNet runtime boundary, keep worker launch/result/selfPatch cargo as typed documents, evacuate operator surfaces from Codex JSON-RPC, wrap MCP's unavoidable JSON protocol edge in typed Epiphany intent/result/receipt documents, and keep cutting until Epiphany can run without `codex_message_processor.rs` except for legacy compatibility. + - The active priority is Codex starvation and CultNet liberation. Use `notes/codex-starvation-and-cultnet-liberation-plan.md` as the directive and `notes/codex-auth-spine-inventory.md` as the source-grounded keeper list for the retained OpenAI subscription auth/model transport bridge. Classify all Epiphany-relevant JSON contamination, define the native CultNet runtime boundary, keep worker launch/result/selfPatch cargo as typed documents, evacuate Epiphany operator/state/process authority from Codex JSON-RPC, wrap MCP's unavoidable JSON protocol edge in typed Epiphany intent/result/receipt documents, and keep cutting until Epiphany can run its own state and processes without `codex_message_processor.rs` except for bridge compatibility. - The May 2026 teardown/rebuild migration in `notes/epiphany-ideal-architecture-rebuild-plan.md` is closed unless a concrete regression reopens it. Preserve the new foundation: Epiphany view/coordinator policy lives in `epiphany-core`, runtime-spine owns job/result lifecycle identity through `runtime_links`, duplicate acceptance is receipt-keyed, public findings stay typed/sealed, view expansion requires a core contract, and app-server remains routing/adaptation rather than a second policy throne. - Treat Phase 5 update/distill/propose/promote/read/notification as complete enough unless a concrete regression appears. - Preserve read-only boundaries for retrieve, distill, propose, freshness, context, graphQuery, roleResult, reorientResult, and the canonical view lenses for scene, jobs, roles, planning, pressure, reorient, crrc, and coordinator. @@ -97,10 +99,9 @@ active_subgoals: - Keep the supervisor out of Epiphany worker thought streams: dogfood artifacts should be operator-safe by default, with direct transcripts and raw result payloads sealed in black reliquaries. - Use native `epiphany-agent-telemetry` and generated `agent-function-telemetry.json` files to inspect behavior shape without opening sealed transcripts. - Treat repeated no-diff implementation turns as an MVP blocker, not success. A bounded implementation pass must leave a reviewable workspace diff or an explicit reviewable failure artifact before dogfood can be called healthy; empty rites do not sanctify the machine. - - Build the Rider and Unity bridges before the next Aetheria implementation dogfood run: the Aetheria-side resident Unity editor package, named Unity bridge operation planner, Aquarium Environment surface, EpiphanyGraph-backed graph dashboard, Rider context bridge CLI, and Rider plugin MVP scaffold are now landed; the Rider plugin still needs build verification. + - Rider and Unity bridge work is quarantined for now. The landed artifacts remain useful optional environment evidence for later engine-repo dogfood, but they are not essential to the MVP and must not outrank Codex starvation, native Epiphany state/process ownership, or prompt-authority separation. - Preserve the newly landed GUI Planning view, explicit Objective Draft adoption action, and Imagination planning synthesis lane; defer GitHub Issues import until a backlog source is fresh enough to be worth feeding Imagination. - - Treat the target workflow as three integrated shrines: Rider is the human code/diff viewport, Epiphany Aquarium is the agent dashboard and persisted-state graph reliquary, and Unity is the pinned runtime/test/scene forge. - - Use `notes/epiphany-rider-unity-integration-plan.md` as the source-grounded plan for Rider-as-IDE and Unity-as-editor/runtime integration seams. + - The three-surface Rider/Aquarium/Unity workflow remains a later product option, not the current blocker. Use `notes/epiphany-rider-unity-integration-plan.md` only when explicitly resuming engine bridge work. - Use `notes/repo-personality-projection-layer-plan.md` as the terrain-reduced plan for repo initialization personality projection: score repo body taxonomy, commit-history temperament, and memory doctrine, then project those pressures into role-specific Ghostlight-shaped dossiers and heartbeat seeds through reviewable typed artifacts. - Keep repo trajectory initialization birth-only and review-gated: startup may distill historical direction, self-image, implicit goals, and anti-goals into role-local pressure, but it must not auto-adopt work or keep repainting a living repo with its first silhouette. @@ -160,7 +161,7 @@ accepted_design: - Native `epiphany-mvp-coordinator` is the first auditable coordinator runner: it drives the fixed single-user lanes through app-server APIs, opens a native runtime-spine session, records native runtime job/result receipts for launched specialists and reorient workers when terminal results arrive, keeps semantic findings review-gated by default, and writes coordinator summaries, JSONL steps, rendered snapshots, transcript, stderr, runtime-spine status, and final next-action artifacts. It refuses direct backend-completion mutation; full specialist completion smoke must use live workers while the execution path is cauterized into CultNet. - Native `epiphany-runtime-spine` is the first Codex-independent runtime vertebra: it initializes and inspects typed CultCache `epiphany.runtime.identity`, `epiphany.runtime.session`, `epiphany.runtime.job`, `epiphany.runtime.job_result`, and `epiphany.runtime.event` documents, opens/completes native jobs with result records, snapshots jobs by id, and can emit a framed CultNet hello message advertising the native document and mutation contract surface. App-server launch now opens typed runtime jobs; `roleResult` / `reorientResult` read heartbeat-backed typed job results only; and `roleAccept` / `reorientAccept` accept completed heartbeat findings from the typed runtime-spine path without opening the Codex SQLite state runtime. - CultNet public API shape is schema-first and mutation-contract-first: hello frames advertise readable document types, allowed operations, mutation authority, typed intent document types, and typed receipt document types. Aquarium and swarm clients should submit intents and watch receipts instead of inventing JSON-RPC verbs or blindly replacing authoritative state. - - Runtime-spine hello now advertises the interactive surface catalog as CultNet contracts, not just the deep runtime documents. Scene, pressure, reorient, CRRC, jobs, roles, role-result, reorient-result, planning, coordinator, Face, Void memory, repo initialization/birth runner, Rider bridge, and Unity bridge all publish explicit read/write posture so Aquarium can discover affordances from the wire contract instead of carrying a private button-to-command gospel. + - Runtime-spine hello now advertises the interactive surface catalog as CultNet contracts, not just the deep runtime documents. Scene, pressure, reorient, CRRC, jobs, roles, role-result, reorient-result, planning, coordinator, Face, Void memory, and repo initialization/birth runner publish explicit read/write posture so Aquarium can discover affordances from the wire contract instead of carrying a private button-to-command gospel. Rider and Unity bridge contracts are quarantined optional environment surfaces until engine dogfood resumes. - Epiphany's public pitch is project-native agency, not just better prompting. Aquarium is the clearest client, but Discord roles, voice/WebRTC rooms, stream overlays, native CLIs, and other CultNet tools should all speak to the same typed project/Faces substrate. Faces advocate for repo needs, answer from jurisdiction, and can propose work; the scheduler and coordinator decide what thinks next, while review gates decide what may mutate canonical state. - Epiphany publishes its Aquarium-facing CultNet receipts locally under `schemas/cultnet/`, and `epiphany-runtime-spine schema-catalog --include-schema-json true` emits a merged builtin-plus-local schema catalog for consumers. The local receipts cover runtime-spine documents, durable agent/heartbeat/ledger state, `epiphany.surface.*` operator projections, control intents, and receipt/artifact payloads. Vendored `cultnet-rs` is aligned to the canonical C# CultNet raw record shapes: replication uses `schemaId` plus `recordKey`, snapshot filters use `schemaIds` / `recordKeys`, and hello advertises typed mutation contracts. - Epiphany now owns the canonical schema paperwork in `schemas/`: a local mirror of `ghostlight.agent-state.schema.json`, plus human-facing receipts for canonical agent-state shape, standing role-trait glossary, heartbeat store shape, and repo-personality birth projection. Trait names like `routing_discipline` are now documented at the source instead of existing only in live dossiers, startup templates, or stale Ghostlight notes. @@ -211,9 +212,8 @@ accepted_design: - Dogfood supervision is a separate operator role. If the supervising Codex session edits the target repo directly, that work can be useful seed material, but it is not clean Epiphany evidence and must be labeled as supervisor intervention or contamination. - Dogfood supervision is also a projection boundary: the operator may inspect summaries, verdicts, missing coverage, state patches, job state, and artifact receipts, but not the specialist's raw stream of thought or full transcript unless a forensic debugging request explicitly breaks the seal. - Native `epiphany-agent-telemetry` derives operator-safe function/API telemetry from sealed app-server transcripts so the supervisor can see calls, statuses, paths, and counts without reading direct thoughts. - - Editor/runtime verification is now part of the MVP product boundary for engine repos: native `epiphany-unity-bridge` is the first controlled bridge, resolving the project-pinned Unity editor, refusing wrong or missing versions, running explicit batch/probe commands only through the exact editor, and writing inspection/command/log artifacts for evidence. - - Rider and Unity are environment organs, not sources of truth: Rider should expose IDE/source context, diagnostics, navigation, and changed ranges; Unity should expose pinned-editor runtime facts, compilation, tests, probes, assets, scenes, and logs; Epiphany remains the durable Self that coordinates, records, and reviews. - - The product architecture is three-pronged: Rider is the code view for human inspection of repo state, source tree, diffs, diagnostics, and code refs; Epiphany Aquarium is the agent dashboard for objectives, specialist lane state, logs/artifacts, persisted typed state, and graph/control-flow views; Unity is the runtime environment for pinned tests, probes, scene configuration, assets, shaders, and play/edit-mode evidence. + - Editor/runtime verification is a later engine-repo product boundary, not a current MVP dependency. Native `epiphany-unity-bridge` and `epiphany-rider-bridge` remain controlled, optional environment evidence surfaces; they do not own Epiphany state, prompt authority, scheduler decisions, or product priority. + - The product architecture may later use Rider as code view, Aquarium as agent dashboard, and Unity as runtime forge. Current priority is smaller and meaner: Epiphany state/process autonomy behind a bridge to relatively vanilla Codex. - Epiphany needs a workspace-scoped planning substrate separate from the active objective: conversation captures, inbox, normalized backlog, roadmap streams, objective drafts, and explicit objective adoption are distinct states. The active objective remains the bounded run contract; chat and imported issues are planning inputs until reviewed and promoted. `notes/epiphany-planning-substrate.md` defines the product model, including GitHub Issues import semantics. - The first runtime planning slice is landed inside `EpiphanyThreadState`: typed captures, backlog items, roadmap streams, Objective Drafts, and GitHub source refs are revision-gated through `thread/epiphany/update`, rendered into prompts when present, and reflected read-only through the `planning` view lens. - The first GUI planning operator slice is landed: status collection includes the `planning` view lens, the Tauri/React dashboard renders planning summaries, captures, backlog, roadmap streams, and Objective Drafts, and the `adoptObjectiveDraft` GUI action requires an explicit selected draft before updating objective, subgoal, planning status, scratch, checkpoint, observation, evidence, and adoption artifacts.