Delegate bridge interruption

epiphany-codex-bridge/src/mutation_service.rs

@@ -22,7 +22,6 @@ use epiphany_core::EpiphanyTokenUsageSnapshot;
 use epiphany_core::apply_coordinator_state_update_to_state;
 use epiphany_core::build_epiphany_reorient_launch_request_with_dynamic_context;
 use epiphany_core::build_epiphany_role_launch_request_with_dynamic_context;
-use epiphany_core::clear_epiphany_job_binding_backend;
 use epiphany_core::epiphany_role_label;
 use epiphany_core::evaluate_promotion;
 use epiphany_state_model::EpiphanyEvidenceRecord;
@@ -208,49 +207,12 @@ pub async fn interrupt_epiphany_job_on_thread(
     thread: &impl EpiphanyMutationHost,
     request: EpiphanyJobInterruptRequest,
 ) -> BridgeResult<EpiphanyJobInterruptResult> {
-    if request.binding_id.trim().is_empty() {
-        return Err(EpiphanyBridgeError::InvalidRequest(
-            "epiphany job interrupt binding_id must be non-empty".to_string(),
-        ));
-    }
-
     let current_state = thread.epiphany_state().await.unwrap_or_default();
-    validate_expected_revision(request.expected_revision, current_state.revision)?;
-
-    let Some(binding_index) = current_state
-        .job_bindings
-        .iter()
-        .position(|binding| binding.id == request.binding_id)
-    else {
-        return Err(EpiphanyBridgeError::InvalidRequest(format!(
-            "epiphany job binding {:?} was not found",
-            request.binding_id
-        )));
-    };
-    let interrupted_thread_ids = Vec::new();
-    let cancel_requested = false;
-
-    let next_job_bindings = clear_epiphany_job_binding_backend(
-        current_state.job_bindings.clone(),
-        binding_index,
-        "No active heartbeat turn is currently bound; launch explicitly to resume specialist work.",
-    );
-    let epiphany_state = apply_epiphany_state_update_to_thread(
-        thread,
-        EpiphanyStateUpdate {
-            expected_revision: request.expected_revision,
-            job_bindings: Some(next_job_bindings),
-            ..Default::default()
-        },
-    )
-    .await?;
-
-    Ok(EpiphanyJobInterruptResult {
-        epiphany_state,
-        binding_id: request.binding_id,
-        cancel_requested,
-        interrupted_thread_ids,
-    })
+    let store = thread.epiphany_runtime_spine_store_path().await;
+    let thread_id = thread.epiphany_thread_id().await;
+    epiphany_core::EpiphanyCoordinatorService::new(&store, &store)
+        .interrupt_job(&thread_id, &current_state, request)
+        .map_err(|error| EpiphanyBridgeError::InvalidRequest(error.to_string()))
 }
 
 pub async fn apply_thread_epiphany_update(
@@ -607,6 +569,29 @@ fn validate_expected_revision(
 
 #[cfg(test)]
 mod acceptance_architecture_tests {
+    #[test]
+    fn interrupt_route_delegates_binding_mutation_to_native_service() {
+        let source = include_str!("mutation_service.rs");
+        let start = source
+            .find("pub async fn interrupt_epiphany_job_on_thread")
+            .unwrap();
+        let end = source
+            .find("pub async fn apply_thread_epiphany_update")
+            .unwrap();
+        let interrupt = &source[start..end];
+        assert_eq!(interrupt.matches(".interrupt_job(").count(), 1);
+        for forbidden in [
+            ["clear", "epiphany", "job", "binding", "backend"].join("_"),
+            ["job_bindings", "Some"].join(": "),
+            ["apply", "epiphany", "state", "update", "to", "thread"].join("_"),
+        ] {
+            assert!(
+                !interrupt.contains(&forbidden),
+                "interrupt route regrew binding policy {forbidden:?}"
+            );
+        }
+    }
+
     #[test]
     fn launch_route_delegates_planning_to_the_native_organ() {
         let source = include_str!("mutation_service.rs");

epiphany-core/src/coordinator_interrupt.rs

@@ -9,6 +9,13 @@ pub fn interrupt_coordinator_job(
     state: &EpiphanyThreadState,
     request: EpiphanyJobInterruptRequest,
 ) -> Result<EpiphanyJobInterruptResult> {
+    if let Some(persisted) = read_coordinator_state(store)?
+        && persisted != *state
+    {
+        return Err(anyhow!(
+            "authoritative coordinator state changed before interrupt commit"
+        ));
+    }
     if request.binding_id.trim().is_empty() {
         return Err(anyhow!(
             "epiphany job interrupt binding_id must be non-empty"

notes/fresh-workspace-handoff.md

@@ -1882,8 +1882,11 @@ historical-input fixture. Native `--interrupt-binding` is now live:
 `interrupt_coordinator_job` owns revision/binding validation and canonical
 binding mutation, while status reports `cancelRequested=false` honestly. A
 focused core test and status-command test prove the transition. Explicit
-`--codex` retains compatibility. The bridge still duplicates interruption
-choreography; delegate it to `EpiphanyCoordinatorService::interrupt_job` next.
+`--codex` retains compatibility. The bridge now delegates interruption to
+`EpiphanyCoordinatorService::interrupt_job`; nine bridge tests prove no local
+binding mutation policy remains, and the vendored app-server compiles. General
+update/promotion persistence still uses the host hook and is the next surviving
+state-authority seam.
 
 ## Immediate Re-entry Instruction
 

notes/native-coordinator-liberation-map.md

@@ -269,5 +269,8 @@ Interruption now has a native owner. `interrupt_coordinator_job` validates the
 binding and revision, records the operator reason through the canonical state
 owner, and reports `cancelRequested=false` rather than inventing backend
 cancellation. `epiphany-mvp-status --interrupt-binding` uses this path by
-default; `--codex` selects the compatibility route explicitly. The bridge still
-contains its older interruption choreography and should delegate next.
+default; `--codex` selects the compatibility route explicitly. The bridge now
+delegates interruption to `EpiphanyCoordinatorService::interrupt_job`; a source
+guard rejects local binding mutation, and stale unified state is refused before
+commit. General update/promotion routes still persist through the host hook and
+are the next surviving state-authority seam.

state/map.yaml

@@ -659,4 +659,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. Gjallar readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Delete the compatibility bridge's duplicate interruption choreography by delegating it to `EpiphanyCoordinatorService::interrupt_job`, then source-guard the bridge against regrowing binding mutation policy. Native status interruption is live by default; `--codex` is explicit compatibility.
+  next_action: Move the compatibility bridge's general update and promotion persistence behind `EpiphanyCoordinatorService::apply_state_update`, then demote `epiphany_persist_state` to client projection/legacy rollout only. Launch, acceptance, and interruption already delegate to native owners with source guards.