Record RepoModel vocabulary cuts

notes/epiphany-current-algorithmic-map.md

@@ -467,8 +467,9 @@ work.
 ## RepoModel projection
 
 RepoModel persistence is keyed by semantic identity: identity/body binding,
-domain, node, edge, summary, frontier, lifecycle receipt, and per-node claim-
-obligation guard.
+seed-owned domain, node, edge, frontier, and per-node claim-obligation guard.
+Domains cannot be model-mutated. The producerless summary and lifecycle-receipt
+families are deleted.
 
 `EpiphanyRepoModelView` sorts and assembles those documents. Frontier dependency
 and cycle checks include the exact reachable closure in strong reads. Per-node

notes/epiphany-fork-implementation-plan.md

@@ -224,10 +224,12 @@ Delete or demote:
 
 Keep the five-day shakedown, Ox17 deployment, and Model Atlas operational Gate
 1 paused. Continue the source-subtraction and test-authority audit from exact
-`856648de`. That cut deletes the unused semantic-memory/workspace-coverage
-projection system, its four binaries, its local daemon supervisor, and 32,866
-net source lines. Modeling now consumes typed Body and keyed RepoModel state
-directly. Persona consumes keyed memory and social state directly. No
+`ab1afc27`. The current sequence deletes the semantic-memory/workspace-coverage
+projection system, its local daemon supervisor, and the surviving generic
+RepoModel profile, impossible lifecycle, producerless receipt/summary, and
+decorative scoring axes. Modeling consumes typed Body and keyed RepoModel state
+directly. Domains are seed-owned; model passes mutate only live keyed operations.
+Persona consumes keyed memory and social state directly. No
 Epiphany-owned Rider or Unity bridge exists: Brokkr owns Unity through typed
 Eve/CultMesh capabilities, and a future Rider daemon will own Rider. Do not
 admit a fresh package until the remaining production surfaces and tests have

notes/fresh-workspace-handoff.md

@@ -2,8 +2,8 @@
 
 Updated: 2026-08-23
 Branch: `codex/epiphany-shakedown-live`
-Latest committed implementation cut: `856648de`
-Current worktree: documentation repair and continuing source/test-authority audit; Ox17 remains paused
+Latest committed implementation cut: `ab1afc27`
+Current worktree: continuing source/test-authority audit; Ox17 remains paused
 
 ## Orientation
 
@@ -64,6 +64,24 @@ Eve/CultMesh; a future Rider daemon will own Rider. Historical architecture
 snapshots retain their dated record but cannot be mistaken for executable or
 current authority.
 
+Four subsequent cuts narrow RepoModel to what Modeling can actually decide:
+
+- `6ea4ff3c` removes the redundant memory-profile axis, dead SHA-1 ID factory,
+  empty profile module, seven cache/Persona-only node kinds, seven cache-only
+  edge kinds, and seventeen impossible lifecycle states.
+- `5218cf2c` deletes the producerless RepoModel lifecycle-receipt document
+  family and all of its empty projection/fixture plumbing.
+- `8bb039af` makes domain creation seed-only and deletes the unreachable summary
+  operation, summary document family, validation, registry contract, and the
+  test cargo that alone produced it. The retained atomic graph test now follows
+  the live seeded-domain then node/edge path.
+- `ab1afc27` removes node salience/confidence and edge confidence because no
+  owner read, validated, routed, or displayed them; they merely perturbed exact
+  document identity.
+
+Affected targets check cleanly. Core remains 165/165; focused RepoModel tests
+pass 5/5 and reasoning-context tests pass 8/8.
+
 The global thread-state authority is gone.
 
 - `1662a012` makes coordinator policy a pure projection over keyed Mind,

state/map.yaml

@@ -47,6 +47,7 @@ current_status:
   provider_schema_cut: Exact 553f79d9 makes one OpenAI Responses dialect compiler own every role and Persona output schema. Provider-illegal conditional and parent-relative structure is removed, literal-only schemas receive explicit types, supported standard-model constraints remain generation guidance, and UUID formats lower to exact patterns. Full native decoding and family Mind admission remain final authority. Preserved packaged falsifications at 55fb4cf8, edd664db, and 1e01c339 prove refusal before inference, typed failure without Mind writes, successful concurrent Persona cognition, and transcript-free failure audit.
   repo_model_body_cut: Exact a8f3c1f0 makes the authenticated runtime Body route own initial keyed RepoModel binding. Bootstrap derives the digest from the admitted RepositoryBodyObservationBasis, initialization reauthenticates runtime, swarm, workspace, and Body binding before any write, and a hostile seed refuses with the whole store byte-identical. The exact 553f79d9 package exposed this root after concurrent Persona and terminal Modeling cognition; its result is not transplanted.
   semantic_cache_cut: Exact 856648de deletes the unused semantic-memory and workspace-coverage projection subsystem rather than preserving a second derived model of Mind. Four binaries, the local daemon supervisor, Qdrant/Ollama/Postgres configuration, projector policy/lifecycle/heartbeat/recovery state, semantic query/context packets, aggregate model revision/hash cargo, workspace file-cache reader, and Persona's always-empty semantic-recall fields are gone. No agent request builder or sealed reasoning projection consumed this cache. Modeling now reads the exact typed Body and keyed RepoModel projection directly; future retrieval evidence must enter through an earned typed provider receipt. Idunn remains the sole deployment and daemon-survival authority. Core 165/165, OpenAI runtime 25/25, and release construction 19/19 pass.
+  repo_model_vocabulary_cut: Exact 6ea4ff3c deletes the redundant generic memory profile, dead SHA-1 ID factory, empty profile module, cache-only node/edge kinds, and impossible lifecycle variants. Exact 5218cf2c deletes the producerless RepoModel lifecycle-receipt family. Exact 8bb039af makes domains seed-owned and deletes the unreachable summary mutation/document/validation/registry path plus the test cargo that alone produced it. Exact ab1afc27 removes node salience/confidence and edge confidence because no owner read, validated, routed, or displayed those values. Modeling can author only the keyed repository operations advertised by its provider schema. Affected targets check cleanly; core remains 165/165, RepoModel 5/5, and reasoning-context 8/8.
   package_baseline: Exact d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4 remains the admitted production source and current symlink target. Its native serialized full-workspace gate passed with receipt SHA-256 de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482. Idunn sealed 26 root-owned non-writable binaries plus release-witness.ccmp as release sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06; witness-file SHA-256 is 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357. Source 9b9b5c85 also passed Idunn's native test gate under receipt SHA-256 6c6a71359f8c31297419665d2872f6982a89f84e197d71fc5b36a7fc86216093 and remains sealed as release sha256-30a910785a380224bbdbd56a7b742c8d058fa70cb72dab3562e3907903e0d191 with witness-file SHA-256 75bf52d31c56ea3b08e1a702273301c1db12a4b1ffae45e3d948ce8a29b50e1d. A foreign-target helper restarted Idunn during the Epiphany transaction; rollback restored d2ca, removed deployment.env, and left production Epiphany units inactive. OpenRouter model stealth/ox-alpha and its systemd-injected credential are readiness-proven. Idunn is active with zero restarts and its deployment brake is engaged.
   summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure plus generic job result to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
   public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
@@ -105,7 +106,7 @@ current_status:
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
   unresolved_authority: Generic command, legacy lineage, caller-authored identity, behaviorless policy fields, global lifecycle latest state, timestamp election, Windows Task Scheduler authority, and their false proofs are gone. Semantic and workspace launch owners are separate over shared process mechanics. The remaining daemon supervisor still combines the service loop, aggregate signed-health publication, semantic reconciliation, and the large workspace recovery state machine. Continue decomposing only where ownership becomes smaller; do not create family frameworks or adapters. The false persisted cluster-topology bootstrap sentinel is gone; supervisor admission remains bound to exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until subtraction closes. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Continue the source/test-authority audit after exact 856648de. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Delete test-only APIs and fixtures with the tests they animate. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, and family admission owners. Epiphany owns no local daemon supervisor or editor bridge. Do not run a local full-workspace compile, package, deployment, or Ox root.
+  next_action: Continue the source/test-authority audit after exact ab1afc27. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Delete test-only APIs and fixtures with the tests they animate. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, and family admission owners. Epiphany owns no local daemon supervisor or editor bridge. Do not run a local full-workspace compile, package, deployment, or Ox root.
 
   runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.