diff --git a/epiphany-codex-bridge/src/mutation_service.rs b/epiphany-codex-bridge/src/mutation_service.rs index f000a411..f62a2514 100644 --- a/epiphany-codex-bridge/src/mutation_service.rs +++ b/epiphany-codex-bridge/src/mutation_service.rs @@ -22,7 +22,6 @@ use epiphany_core::EpiphanyTokenUsageSnapshot; use epiphany_core::apply_coordinator_state_update_to_state; use epiphany_core::build_epiphany_reorient_launch_request_with_dynamic_context; use epiphany_core::build_epiphany_role_launch_request_with_dynamic_context; -use epiphany_core::clear_epiphany_job_binding_backend; use epiphany_core::epiphany_role_label; use epiphany_core::evaluate_promotion; use epiphany_state_model::EpiphanyEvidenceRecord; @@ -208,49 +207,12 @@ pub async fn interrupt_epiphany_job_on_thread( thread: &impl EpiphanyMutationHost, request: EpiphanyJobInterruptRequest, ) -> BridgeResult { - if request.binding_id.trim().is_empty() { - return Err(EpiphanyBridgeError::InvalidRequest( - "epiphany job interrupt binding_id must be non-empty".to_string(), - )); - } - let current_state = thread.epiphany_state().await.unwrap_or_default(); - validate_expected_revision(request.expected_revision, current_state.revision)?; - - let Some(binding_index) = current_state - .job_bindings - .iter() - .position(|binding| binding.id == request.binding_id) - else { - return Err(EpiphanyBridgeError::InvalidRequest(format!( - "epiphany job binding {:?} was not found", - request.binding_id - ))); - }; - let interrupted_thread_ids = Vec::new(); - let cancel_requested = false; - - let next_job_bindings = clear_epiphany_job_binding_backend( - current_state.job_bindings.clone(), - binding_index, - "No active heartbeat turn is currently bound; launch explicitly to resume specialist work.", - ); - let epiphany_state = apply_epiphany_state_update_to_thread( - thread, - EpiphanyStateUpdate { - expected_revision: request.expected_revision, - job_bindings: Some(next_job_bindings), - ..Default::default() - }, - ) - .await?; - - Ok(EpiphanyJobInterruptResult { - epiphany_state, - binding_id: request.binding_id, - cancel_requested, - interrupted_thread_ids, - }) + let store = thread.epiphany_runtime_spine_store_path().await; + let thread_id = thread.epiphany_thread_id().await; + epiphany_core::EpiphanyCoordinatorService::new(&store, &store) + .interrupt_job(&thread_id, ¤t_state, request) + .map_err(|error| EpiphanyBridgeError::InvalidRequest(error.to_string())) } pub async fn apply_thread_epiphany_update( @@ -607,6 +569,29 @@ fn validate_expected_revision( #[cfg(test)] mod acceptance_architecture_tests { + #[test] + fn interrupt_route_delegates_binding_mutation_to_native_service() { + let source = include_str!("mutation_service.rs"); + let start = source + .find("pub async fn interrupt_epiphany_job_on_thread") + .unwrap(); + let end = source + .find("pub async fn apply_thread_epiphany_update") + .unwrap(); + let interrupt = &source[start..end]; + assert_eq!(interrupt.matches(".interrupt_job(").count(), 1); + for forbidden in [ + ["clear", "epiphany", "job", "binding", "backend"].join("_"), + ["job_bindings", "Some"].join(": "), + ["apply", "epiphany", "state", "update", "to", "thread"].join("_"), + ] { + assert!( + !interrupt.contains(&forbidden), + "interrupt route regrew binding policy {forbidden:?}" + ); + } + } + #[test] fn launch_route_delegates_planning_to_the_native_organ() { let source = include_str!("mutation_service.rs"); diff --git a/epiphany-core/src/coordinator_interrupt.rs b/epiphany-core/src/coordinator_interrupt.rs index 90225a2d..17c3f546 100644 --- a/epiphany-core/src/coordinator_interrupt.rs +++ b/epiphany-core/src/coordinator_interrupt.rs @@ -9,6 +9,13 @@ pub fn interrupt_coordinator_job( state: &EpiphanyThreadState, request: EpiphanyJobInterruptRequest, ) -> Result { + if let Some(persisted) = read_coordinator_state(store)? + && persisted != *state + { + return Err(anyhow!( + "authoritative coordinator state changed before interrupt commit" + )); + } if request.binding_id.trim().is_empty() { return Err(anyhow!( "epiphany job interrupt binding_id must be non-empty" diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 7e39d898..c276c0ce 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -1882,8 +1882,11 @@ historical-input fixture. Native `--interrupt-binding` is now live: `interrupt_coordinator_job` owns revision/binding validation and canonical binding mutation, while status reports `cancelRequested=false` honestly. A focused core test and status-command test prove the transition. Explicit -`--codex` retains compatibility. The bridge still duplicates interruption -choreography; delegate it to `EpiphanyCoordinatorService::interrupt_job` next. +`--codex` retains compatibility. The bridge now delegates interruption to +`EpiphanyCoordinatorService::interrupt_job`; nine bridge tests prove no local +binding mutation policy remains, and the vendored app-server compiles. General +update/promotion persistence still uses the host hook and is the next surviving +state-authority seam. ## Immediate Re-entry Instruction diff --git a/notes/native-coordinator-liberation-map.md b/notes/native-coordinator-liberation-map.md index 591e5d08..fbf866b9 100644 --- a/notes/native-coordinator-liberation-map.md +++ b/notes/native-coordinator-liberation-map.md @@ -269,5 +269,8 @@ Interruption now has a native owner. `interrupt_coordinator_job` validates the binding and revision, records the operator reason through the canonical state owner, and reports `cancelRequested=false` rather than inventing backend cancellation. `epiphany-mvp-status --interrupt-binding` uses this path by -default; `--codex` selects the compatibility route explicitly. The bridge still -contains its older interruption choreography and should delegate next. +default; `--codex` selects the compatibility route explicitly. The bridge now +delegates interruption to `EpiphanyCoordinatorService::interrupt_job`; a source +guard rejects local binding mutation, and stale unified state is refused before +commit. General update/promotion routes still persist through the host hook and +are the next surviving state-authority seam. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 2ab61efd..168a9c55 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 9c8227a7..af0f82b2 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -659,4 +659,4 @@ current_status: - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. Gjallar readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - next_action: Delete the compatibility bridge's duplicate interruption choreography by delegating it to `EpiphanyCoordinatorService::interrupt_job`, then source-guard the bridge against regrowing binding mutation policy. Native status interruption is live by default; `--codex` is explicit compatibility. + next_action: Move the compatibility bridge's general update and promotion persistence behind `EpiphanyCoordinatorService::apply_state_update`, then demote `epiphany_persist_state` to client projection/legacy rollout only. Launch, acceptance, and interruption already delegate to native owners with source guards.