Record Idunn projection authority cut

notes/epiphany-current-algorithmic-map.md

@@ -52,6 +52,13 @@ runtime and name the actual invariant: immutable poke identities, monotonic
 latest selection, and Bifrost intent/receipt/Hands-proof correlation. The two
 specialized projector policy writers are the only writers; no test-only generic
 writer recreates the forbidden generic policy path.
+
+Idunn deployment truth is not mirrored into invented Epiphany-local envelopes.
+Odin/Idunn owns `gamecult.idunn.deployment_manifest.v3` and signed daemon-health
+admission. Cross-repository inspection found no producer for Epiphany's former
+v0 deployment and aftercare DTOs; Epiphany had no writer, test, or consumer for
+them. Those schemas, registry entries, context fields, loaders, and key helpers
+are deleted rather than advertising a crossing that never existed.
 The model-provider boundary explicitly selects a
 typed provider dialect and internally derives the exact provider request from
 the canonical native request. OpenRouter/Ox is the current Yggdrasil provider;

notes/fresh-workspace-handoff.md

@@ -631,6 +631,14 @@ and workspace-coverage projector writers. Their hostile-command, injected-
 argument, exact-policy, and policy-digest checks remain. This removes 28 lines;
 non-test core and the three focused reserved-policy tests pass.
 
+Exact `c977d149` deletes Epiphany's unused v0 Idunn deployment-receipt and
+aftercare-audit families. VoidBot, `gamecult-ops`, and the local Odin/Idunn body
+show that live authority is `gamecult.idunn.deployment_manifest.v3` plus signed
+daemon-health admission; nothing produces the Epiphany-local envelopes. They
+had no writer, test, or consumer beyond unused context slots and loaders. The
+cut removes 151 lines; non-test core, CultMesh 27/27, and prompt projection 1/1
+pass.
+
 Preserve cluster topology while it owns the runtime-bound Body domain and
 bootstrap evidence. Separately split the
 remaining daemon supervisor's

state/map.yaml

@@ -48,7 +48,7 @@ current_status:
   package_baseline: Exact d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4 remains the admitted production source and current symlink target. Its native serialized full-workspace gate passed with receipt SHA-256 de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482. Idunn sealed 26 root-owned non-writable binaries plus release-witness.ccmp as release sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06; witness-file SHA-256 is 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357. Source 9b9b5c85 also passed Idunn's native test gate under receipt SHA-256 6c6a71359f8c31297419665d2872f6982a89f84e197d71fc5b36a7fc86216093 and remains sealed as release sha256-30a910785a380224bbdbd56a7b742c8d058fa70cb72dab3562e3907903e0d191 with witness-file SHA-256 75bf52d31c56ea3b08e1a702273301c1db12a4b1ffae45e3d948ce8a29b50e1d. A foreign-target helper restarted Idunn during the Epiphany transaction; rollback restored d2ca, removed deployment.env, and left production Epiphany units inactive. OpenRouter model stealth/ox-alpha and its systemd-injected credential are readiness-proven. Idunn is active with zero restarts and its deployment brake is engaged.
   summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure plus generic job result to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
   public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
-  latest_phase: The fresh-package Ox17 lane remains paused for source subtraction. Exact 4d0db2c7 deletes the final heartbeat scheduler and twenty-one low-value tests. Exact 67a3a57b deletes all nineteen remaining Rust self-source inspection tests plus two argument-vector mirrors. Exact bbe5fcf1 deletes four CultMesh tableaux and their production-absent seven-cluster fixture world. Exact f236e1cd makes each organ's CultNet factory the sole contract author by deleting six parallel CultMesh families. Exact fe591b33 removes persisted fixed Verse/room policy and two literal-copy tests. Exact 4ed3a6e0 deletes four JSON-derived CultMesh mirrors, five unauthenticated legacy provider/tool families, prompt branches, retirement paths, one supervisor migration command, and ten tests: 2,398 net lines. Exact e8bc0382 deletes unused Persona-speech-audit and Weksa-lowering CultMesh shadows plus four tests: 432 lines. Exact db6a7131 deletes unused CultMesh operator-run intent/receipt and generic work-loop telemetry shadows, runtime declarations, prompt branch, and two tests: 829 pure deletions. Exact 75ead942 deletes the abandoned RepoWork aggregates, service-audit helper, Bifrost artifact/metrics/public-proof families, and tests that alone animated them: 1,410 net lines. Exact 753707ff deletes the duplicate CultMesh status bootstrap sentinel so persisted runtime-bound cluster topology alone owns bootstrap: 99 net lines. Exact 967743cc deletes seven test-only daemon-poke/Bifrost loader APIs in favor of the runtime-consumed LocalVerseContext: 85 net lines. Exact 1ab0859b deletes two obsolete tableau tests: 78 lines. Exact ab5b16ec deletes the test-only generic managed-service writer that recreated a forbidden path: 28 lines. Native runtime, keyed Mind, Persona, Weksa, live Bifrost body-change receipts, topology, and specialized policy writers remain owners. Non-test core, CultMesh 27/27, prompt 1/1, affected readiness/Persona tests, and supervisor 10/10 are clean. Old stores containing deleted envelopes refuse; there is no migrator or dual reader. No Idunn build, package, deployment, or Ox root is authorized yet. Ox16 remains sealed historical evidence and must never resume.
+  latest_phase: The fresh-package Ox17 lane remains paused for source subtraction. Exact 4d0db2c7 deletes the final heartbeat scheduler and twenty-one low-value tests. Exact 67a3a57b deletes all nineteen remaining Rust self-source inspection tests plus two argument-vector mirrors. Exact bbe5fcf1 deletes four CultMesh tableaux and their production-absent seven-cluster fixture world. Exact f236e1cd makes each organ's CultNet factory the sole contract author by deleting six parallel CultMesh families. Exact fe591b33 removes persisted fixed Verse/room policy and two literal-copy tests. Exact 4ed3a6e0 deletes four JSON-derived CultMesh mirrors, five unauthenticated legacy provider/tool families, prompt branches, retirement paths, one supervisor migration command, and ten tests: 2,398 net lines. Exact e8bc0382 deletes unused Persona-speech-audit and Weksa-lowering CultMesh shadows plus four tests: 432 lines. Exact db6a7131 deletes unused CultMesh operator-run intent/receipt and generic work-loop telemetry shadows, runtime declarations, prompt branch, and two tests: 829 pure deletions. Exact 75ead942 deletes the abandoned RepoWork aggregates, service-audit helper, Bifrost artifact/metrics/public-proof families, and tests that alone animated them: 1,410 net lines. Exact 753707ff deletes the duplicate CultMesh status bootstrap sentinel so persisted runtime-bound cluster topology alone owns bootstrap: 99 net lines. Exact 967743cc deletes seven test-only daemon-poke/Bifrost loader APIs in favor of the runtime-consumed LocalVerseContext: 85 net lines. Exact 1ab0859b deletes two obsolete tableau tests: 78 lines. Exact ab5b16ec deletes the test-only generic managed-service writer that recreated a forbidden path: 28 lines. Exact c977d149 deletes two counterfeit Idunn receipt families after external audit proved no live producer or consumer: 151 lines. Native runtime, keyed Mind, Persona, Weksa, live Bifrost body-change receipts, topology, specialized policy writers, and Odin/Idunn's actual deployment manifest/signed health remain owners. Non-test core, CultMesh 27/27, prompt 1/1, affected readiness/Persona tests, and supervisor 10/10 are clean. Old stores containing deleted envelopes refuse; there is no migrator or dual reader. No Idunn build, package, deployment, or Ox root is authorized yet. Ox16 remains sealed historical evidence and must never resume.
   persona_social_cut: Pending mentions, immutable requests, terminal receipts, quarantine records, retention heads, and retention plans are separate keyed CultCache documents. Persona derives its own deterministic work identity, reserves and terminalizes through exact batch CAS, cites the exact request envelope as pass-input provenance, and retries failed mentions without a timestamp or global revision. No scheduler can launch, block, retain, or provide pass provenance for Persona work.
   operational_state:
     local_worktree: source_subtraction_commits_landed_ox17_and_deployment_paused
@@ -91,8 +91,8 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
-  unresolved_authority: The final heartbeat scheduler, Rust self-source inspection tests, production-absent provider tableaux, duplicate organ contracts, fixed-policy persistence, JSON-derived shadows, unauthenticated legacy rows, RepoWork aggregates, service-audit helper, unused Bifrost accounting/proof families, duplicate bootstrap status, duplicate latest loaders, obsolete topology/bootstrap tableaux, test-only generic policy writer, and legacy migrators are gone. The daemon supervisor remains a launch/reconcile authority knot; deleted textual tests named real sequencing claims but never proved them. Decompose that body before restoring transition proof. External Idunn receipt projections and the daemon-status writer still need producer/consumer ownership confirmation before subtraction. Cluster topology remains persisted because its Body domain and bootstrap evidence are runtime-bound and consumed by supervision. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until subtraction closes. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Confirm the external producer/consumer ownership of Idunn deployment/aftercare CultMesh receipts and daemon status; delete unused loaders or projections without cutting a real crossing. Then write the daemon supervisor authority map and split launch/reconcile physiology before adding any transition proof. Preserve topology while it owns runtime-bound Body/bootstrap evidence. Do not run a local full-workspace compile, package, deployment, or Ox root.
+  unresolved_authority: The final heartbeat scheduler, Rust self-source inspection tests, production-absent provider tableaux, duplicate organ contracts, fixed-policy persistence, JSON-derived shadows, unauthenticated legacy rows, RepoWork aggregates, service-audit helper, unused Bifrost accounting/proof families, duplicate bootstrap status, duplicate latest loaders, obsolete topology/bootstrap tableaux, test-only generic policy writer, counterfeit Idunn receipts, and legacy migrators are gone. The daemon supervisor remains a launch/reconcile authority knot; deleted textual tests named real sequencing claims but never proved them. Decompose that body before restoring transition proof. The daemon-status producer boundary still needs ownership confirmation before subtraction. Cluster topology remains persisted because its Body domain and bootstrap evidence are runtime-bound and consumed by supervision. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until subtraction closes. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only.
+  next_action: Confirm the daemon-status producer boundary, then write the daemon supervisor authority map and split launch/reconcile physiology before adding any transition proof. Preserve topology while it owns runtime-bound Body/bootstrap evidence. Do not run a local full-workspace compile, package, deployment, or Ox root.
 
 active_subgoals:
   - Complete the fresh exact-package Decision-Auditable Concurrent Mind capstone before any further operational Gate run.