Validate Bifrost readiness publication
This commit is contained in:
Meta Vens
parent
dfdbad9e4b
commit
a80093d512
6 changed files with 210 additions and 23 deletions
|
|
@ -208,6 +208,48 @@ fn run_smoke(args: Args) -> Result<Value> {
|
|||
],
|
||||
&root,
|
||||
)?;
|
||||
let close_receipt = repo
|
||||
.join(".epiphany")
|
||||
.join("work")
|
||||
.join(format!("work-close-{item}.json"));
|
||||
cargo_json(
|
||||
&manifest,
|
||||
"epiphany-work",
|
||||
&[
|
||||
"publish",
|
||||
"--workspace",
|
||||
path_str(&repo)?,
|
||||
"--epiphany-root",
|
||||
path_str(&root)?,
|
||||
"--item",
|
||||
item,
|
||||
"--closure-receipt",
|
||||
path_str(&close_receipt)?,
|
||||
"--local-verse-store",
|
||||
path_str(&local_verse)?,
|
||||
"--change-summary",
|
||||
"Repo-work readiness smoke Bifrost publication proof.",
|
||||
"--justification",
|
||||
"Disposable Bifrost publication proof for the repo-work readiness smoke.",
|
||||
"--verification-receipt",
|
||||
"soul-verdict:repo-work-readiness-smoke",
|
||||
"--review-receipt",
|
||||
"mind-review:repo-work-readiness-smoke",
|
||||
"--author-agent",
|
||||
"epiphany.Hands",
|
||||
"--credit-subject",
|
||||
"epiphany.Hands",
|
||||
"--ledger-entry-id",
|
||||
"repo-work-readiness-smoke-ledger",
|
||||
"--pull-request-url",
|
||||
"https://example.invalid/GameCult/repo-work-readiness-smoke/pull/1",
|
||||
"--pull-request-number",
|
||||
"1",
|
||||
"--pull-request-title",
|
||||
"Repo work readiness smoke proof",
|
||||
],
|
||||
&root,
|
||||
)?;
|
||||
let deployment_aftercare_fixture = repo
|
||||
.join(".epiphany")
|
||||
.join("work")
|
||||
|
|
@ -285,7 +327,7 @@ fn run_smoke(args: Args) -> Result<Value> {
|
|||
"epiphany.repo_work_readiness.v0",
|
||||
)?;
|
||||
require_eq(&readiness, &["status"], "not-ready")?;
|
||||
require_u64(&readiness, &["missingRequiredCount"], 2)?;
|
||||
require_u64(&readiness, &["missingRequiredCount"], 1)?;
|
||||
require_bool(&readiness, &["authority", "sightOnly"], true)?;
|
||||
require_bool(
|
||||
&readiness,
|
||||
|
|
@ -332,7 +374,9 @@ fn run_smoke(args: Args) -> Result<Value> {
|
|||
21,
|
||||
)?;
|
||||
require_row(&readiness, "public-proof", true)?;
|
||||
require_row(&readiness, "bifrost-publication", false)?;
|
||||
require_row(&readiness, "bifrost-publication", true)?;
|
||||
require_row_field_u64(&readiness, "bifrost-publication", "creditReceiptCount", 1)?;
|
||||
require_row_field_u64(&readiness, "bifrost-publication", "changedPathCount", 1)?;
|
||||
require_row(&readiness, "upstream-main-sync", false)?;
|
||||
require_row(&readiness, "idunn-lifecycle", true)?;
|
||||
require_row(&readiness, "deployment-aftercare", true)?;
|
||||
|
|
|
|||
|
|
@ -37,6 +37,8 @@ use epiphany_core::load_epiphany_cultmesh_idunn_aftercare_audit_receipt;
|
|||
use epiphany_core::load_epiphany_cultmesh_idunn_deployment_receipt;
|
||||
use epiphany_core::load_epiphany_cultmesh_repo_work_overviews;
|
||||
use epiphany_core::load_epiphany_cultmesh_swarm_brake;
|
||||
use epiphany_core::load_latest_epiphany_cultmesh_bifrost_body_change_publication_receipt;
|
||||
use epiphany_core::load_latest_epiphany_cultmesh_bifrost_github_publication_receipt;
|
||||
use epiphany_core::load_latest_epiphany_cultmesh_idunn_aftercare_audit_receipt;
|
||||
use epiphany_core::load_latest_epiphany_cultmesh_idunn_deployment_receipt;
|
||||
use epiphany_core::load_latest_epiphany_cultmesh_repo_work_overview;
|
||||
|
|
@ -12153,14 +12155,7 @@ fn run_readiness(args: ReadinessArgs) -> Result<Value> {
|
|||
public_proof_path.exists(),
|
||||
"Redacted public proof bundle exists.",
|
||||
)?,
|
||||
readiness_path_row(
|
||||
"bifrost-publication",
|
||||
"Bifrost",
|
||||
"gamecult.bifrost.publication_receipt.v0",
|
||||
&publish_receipt_path,
|
||||
publish_receipt.is_some(),
|
||||
"Bifrost/GitHub publication receipt exists.",
|
||||
)?,
|
||||
bifrost_publication_readiness_row(&publish_receipt_path, publish_receipt.as_ref())?,
|
||||
readiness_path_row(
|
||||
"upstream-main-sync",
|
||||
"Bifrost/GitHub",
|
||||
|
|
@ -14178,6 +14173,147 @@ fn readiness_missing_row(kind: &str, owner: &str, required_schema: &str, note: &
|
|||
})
|
||||
}
|
||||
|
||||
fn bifrost_publication_readiness_row(path: &Path, receipt: Option<&Value>) -> Result<Value> {
|
||||
let Some(receipt) = receipt else {
|
||||
return Ok(readiness_missing_row(
|
||||
"bifrost-publication",
|
||||
"Bifrost/GitHub",
|
||||
"epiphany.repo_work_publish_receipt.v0 + gamecult.bifrost.body_change_publication_receipt.v0 + gamecult.bifrost.github_publication_receipt.v0",
|
||||
"Run epiphany-work publish so Bifrost and GitHub publication receipts exist before readiness review.",
|
||||
));
|
||||
};
|
||||
|
||||
let schema_ok = string_from_json(receipt, &["schemaVersion"]).as_deref()
|
||||
== Some("epiphany.repo_work_publish_receipt.v0");
|
||||
let status_ok =
|
||||
string_from_json(receipt, &["status"]).as_deref() == Some("publication-receipts-recorded");
|
||||
let publication_authorized =
|
||||
bool_from_json(receipt, &["authority", "publicationAuthorized"]) == Some(true);
|
||||
let upstream_not_claimed =
|
||||
bool_from_json(receipt, &["authority", "upstreamMainSynced"]) == Some(false);
|
||||
let merge_not_claimed =
|
||||
bool_from_json(receipt, &["authority", "mergeAuthorized"]) == Some(false);
|
||||
let private_sealed = bool_from_json(receipt, &["authority", "privateStateExposed"])
|
||||
== Some(false)
|
||||
&& bool_from_json(receipt, &["privateStateExposed"]).unwrap_or(false) == false;
|
||||
let local_verse_store = path_from_json(receipt, &["localVerseStore"]);
|
||||
let runtime_id =
|
||||
string_from_json(receipt, &["runtimeId"]).unwrap_or_else(|| "repo-swarm-local".to_string());
|
||||
let bifrost_publication_receipt_id =
|
||||
string_from_json(receipt, &["bifrost", "publicationReceiptId"]);
|
||||
let github_publication_receipt_id =
|
||||
string_from_json(receipt, &["bifrost", "githubPublicationReceiptId"]);
|
||||
let ledger_entry_id = string_from_json(receipt, &["bifrost", "ledgerEntryId"]);
|
||||
let pull_request_url = string_from_json(receipt, &["bifrost", "pullRequestUrl"]);
|
||||
let credit_receipt_count = receipt
|
||||
.get("bifrost")
|
||||
.and_then(|bifrost| bifrost.get("creditReceiptIds"))
|
||||
.and_then(Value::as_array)
|
||||
.map(Vec::len)
|
||||
.unwrap_or(0);
|
||||
let changed_path_count = receipt
|
||||
.get("changedPaths")
|
||||
.and_then(Value::as_array)
|
||||
.map(Vec::len)
|
||||
.unwrap_or(0);
|
||||
|
||||
let mut bifrost_latest_matches = false;
|
||||
let mut github_latest_matches = false;
|
||||
let mut bifrost_private_sealed = false;
|
||||
let mut github_private_sealed = false;
|
||||
let mut github_links_bifrost = false;
|
||||
let mut publication_status = "missing".to_string();
|
||||
let mut github_publication_status = "missing".to_string();
|
||||
|
||||
if let (Some(store), Some(bifrost_id), Some(github_id)) = (
|
||||
local_verse_store.as_ref(),
|
||||
bifrost_publication_receipt_id.as_ref(),
|
||||
github_publication_receipt_id.as_ref(),
|
||||
) {
|
||||
let latest_bifrost = load_latest_epiphany_cultmesh_bifrost_body_change_publication_receipt(
|
||||
store,
|
||||
runtime_id.clone(),
|
||||
)?;
|
||||
let latest_github = load_latest_epiphany_cultmesh_bifrost_github_publication_receipt(
|
||||
store,
|
||||
runtime_id.clone(),
|
||||
)?;
|
||||
if let Some(latest) = latest_bifrost.as_ref() {
|
||||
bifrost_latest_matches = latest.receipt_id == *bifrost_id
|
||||
&& latest.github_publication_receipt_id == *github_id
|
||||
&& latest.bifrost_ledger_entry_id == ledger_entry_id.clone().unwrap_or_default()
|
||||
&& !latest.accepted_changed_paths.is_empty()
|
||||
&& !latest.credit_receipt_ids.is_empty();
|
||||
bifrost_private_sealed = !latest.private_state_exposed;
|
||||
publication_status = latest.status.clone();
|
||||
}
|
||||
if let Some(latest) = latest_github.as_ref() {
|
||||
github_latest_matches = latest.receipt_id == *github_id
|
||||
&& latest.bifrost_publication_receipt_id == *bifrost_id
|
||||
&& latest.hands_pr_receipt_id
|
||||
== string_from_json(receipt, &["handsReceipts", "prReceiptId"])
|
||||
.unwrap_or_default()
|
||||
&& latest.pull_request_url == pull_request_url.clone().unwrap_or_default()
|
||||
&& !latest.changed_paths.is_empty()
|
||||
&& !latest.ledger_entry_id.trim().is_empty();
|
||||
github_links_bifrost = latest.bifrost_publication_receipt_id == *bifrost_id;
|
||||
github_private_sealed = !latest.private_state_exposed;
|
||||
github_publication_status = latest.publication_status.clone();
|
||||
}
|
||||
}
|
||||
|
||||
let satisfied = schema_ok
|
||||
&& status_ok
|
||||
&& publication_authorized
|
||||
&& upstream_not_claimed
|
||||
&& merge_not_claimed
|
||||
&& private_sealed
|
||||
&& local_verse_store.is_some()
|
||||
&& bifrost_latest_matches
|
||||
&& github_latest_matches
|
||||
&& bifrost_private_sealed
|
||||
&& github_private_sealed
|
||||
&& github_links_bifrost
|
||||
&& credit_receipt_count > 0
|
||||
&& changed_path_count > 0
|
||||
&& ledger_entry_id
|
||||
.as_ref()
|
||||
.is_some_and(|id| !id.trim().is_empty())
|
||||
&& pull_request_url
|
||||
.as_ref()
|
||||
.is_some_and(|url| !url.trim().is_empty());
|
||||
|
||||
Ok(json!({
|
||||
"kind": "bifrost-publication",
|
||||
"owner": "Bifrost/GitHub",
|
||||
"requiredSchema": "epiphany.repo_work_publish_receipt.v0 + gamecult.bifrost.body_change_publication_receipt.v0 + gamecult.bifrost.github_publication_receipt.v0",
|
||||
"evidenceRef": existing_path_value(path),
|
||||
"artifactStatus": if path.exists() { "present" } else { "missing" },
|
||||
"schemaVersion": string_from_json(receipt, &["schemaVersion"]).unwrap_or_else(|| "missing".to_string()),
|
||||
"documentStatus": string_from_json(receipt, &["status"]).unwrap_or_else(|| "missing".to_string()),
|
||||
"bifrostPublicationReceiptId": bifrost_publication_receipt_id.unwrap_or_else(|| "missing".to_string()),
|
||||
"githubPublicationReceiptId": github_publication_receipt_id.unwrap_or_else(|| "missing".to_string()),
|
||||
"ledgerEntryId": ledger_entry_id.unwrap_or_else(|| "missing".to_string()),
|
||||
"creditReceiptCount": credit_receipt_count,
|
||||
"changedPathCount": changed_path_count,
|
||||
"publicationStatus": publication_status,
|
||||
"githubPublicationStatus": github_publication_status,
|
||||
"bifrostLatestMatches": bifrost_latest_matches,
|
||||
"githubLatestMatches": github_latest_matches,
|
||||
"githubLinksBifrost": github_links_bifrost,
|
||||
"publicationAuthorized": publication_authorized,
|
||||
"upstreamMainSynced": !upstream_not_claimed,
|
||||
"mergeAuthorized": !merge_not_claimed,
|
||||
"privateStateExposed": !(private_sealed && bifrost_private_sealed && github_private_sealed),
|
||||
"satisfied": satisfied,
|
||||
"status": if satisfied { "satisfied" } else { "missing" },
|
||||
"note": "Bifrost and GitHub publication receipts are present in repo-local CultMesh and match the repo publish artifact without claiming upstream-main sync.",
|
||||
"readinessApprovalAuthorized": false,
|
||||
"serviceLifecycleAuthority": false,
|
||||
"handsActionAuthorized": false
|
||||
}))
|
||||
}
|
||||
|
||||
fn idunn_lifecycle_readiness_row(path: &Path) -> Result<Value> {
|
||||
let document = read_json_if_exists(path)?;
|
||||
let schema_version = document
|
||||
|
|
|
|||
|
|
@ -1640,15 +1640,22 @@ service-manager mutation, no elevation requirement, and
|
|||
or `--tool-directory-receipt` as
|
||||
`epiphany.cultmesh.daemon_tool_directory.v0`, requiring nonempty globally
|
||||
available receipt-gated capabilities, ready hosts, typed direct/wrapper
|
||||
invocation commands, and the private-state seal. Native smoke
|
||||
`.epiphany-smoke\repo-work-readiness-20260621-103427` now reports
|
||||
`not-ready` with only two missing rows, Bifrost publication and upstream-main
|
||||
sync; writes readiness id `repo-work-readiness-repo-work-readiness`; and Gjallar
|
||||
reports `repoWorkReadinessCount=1` without private-state exposure. Wrapper
|
||||
proof `local-20260621-113642-150-6f7ae7a5` prints the same two-gap readiness
|
||||
mouth. This is still sight only: Idunn keeps lifecycle ownership, Odin/Gjallar
|
||||
keep discovery/sight, and no readiness approval, publication, sync, service
|
||||
mutation, Hands action, or private-state authority is granted.
|
||||
invocation commands, and the private-state seal. It now validates
|
||||
`bifrost-publication` from the local publish artifact plus matching repo-local
|
||||
CultMesh `gamecult.bifrost.body_change_publication_receipt.v0` and
|
||||
`gamecult.bifrost.github_publication_receipt.v0` rows, requiring matching
|
||||
Bifrost/GitHub receipt ids, ledger id, Hands PR receipt id, PR URL, nonempty
|
||||
credit and changed-path evidence, no upstream-main sync claim, no merge claim,
|
||||
and no private-state exposure. Native smoke
|
||||
`.epiphany-smoke\repo-work-readiness-20260621-104757` now reports `not-ready`
|
||||
with only one missing row, `upstream-main-sync`; writes readiness id
|
||||
`repo-work-readiness-repo-work-readiness`; and Gjallar reports
|
||||
`repoWorkReadinessCount=1` without private-state exposure. Wrapper proof
|
||||
`local-20260621-115019-563-f4cec9fa` prints the same one-gap readiness mouth.
|
||||
This is still sight only: Bifrost/GitHub keep publication ownership, Idunn
|
||||
keeps lifecycle ownership, Odin/Gjallar keep discovery/sight, and no readiness
|
||||
approval, publication, sync, service mutation, Hands action, or private-state
|
||||
authority is granted.
|
||||
|
||||
Bifrost public-proof publication transport is now the closure after local
|
||||
proof sight. `epiphany-verse-query bifrost-public-proof --public-proof-id <id>
|
||||
|
|
@ -1906,7 +1913,7 @@ temptation wearing clean robes.
|
|||
| Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan`, `repo-work-service-runbook`, `repo-work-service-launch`, and `repo-work-service-audit` write Idunn lifecycle receipts/artifacts for the same queue-run command and prove non-mutating launch/readiness closure. | Keep any future queue-run service install/start mutation behind Idunn and explicit elevated operator authority. |
|
||||
| Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. |
|
||||
| Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, refuses missing/tampered/non-affirmative Mind adoption proof, runs known safe-family content assertions, optionally gates on model-authored closure verdicts, can require verification output to cite declared changed paths with `--require-source-grounding`, writes Soul/Modeling/Mind receipts, admits a compact typed repo map entry into `.epiphany/state/repo-work-map.msgpack`, and mirrors that admitted fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0`. | Keep extending closure toward source-grounded semantic review and richer semantic map lenses, while preserving deterministic local closure for simple mechanical work. |
|
||||
| Repo work sight | `overview` emits compact proof rows, an `epiphany.repo_work_intake_consensus_readback.v0` from the accept/plan chain, and typed `epiphany.cultmesh.repo_work_overview.v0` event documents plus a latest key; `readiness` now emits `epiphany.repo_work_readiness_report.v0` and mirrors `epiphany.cultmesh.repo_work_readiness.v0` over the MVP proof rows, including Soul's safe-family planning matrix readback, Idunn repo-work service audit validation, and Odin/Gjallar tool-directory validation while naming the remaining Bifrost publication/upstream-main gaps without approving readiness; the CultMesh TUI rows include compact `CONSENSUS` and `REPO-WORK-READINESS` readbacks showing Persona/public feedback ids, Imagination consensus route, public/candidate ref counts, safe family, readiness gaps, and authority denials without private payloads; `close` mirrors Mind-admitted map facts as `epiphany.cultmesh.repo_work_map_entry.v0`; Gjallar enumerates overview history, readiness rows, map rows, semantic rows, closure rows, family lens rows, path lens rows, branch lens rows, stage lens rows, gate lens rows, and public-proof rows without private-state exposure; Persona's Eve surface and Eve connection readbacks expose peer-readable gate/blocker/next-action rows; `queue-run` consumes the same overview queue for branch-local scheduler pulses. | Deepen Bifrost-first external work accounting and semantic map readback without moving action authority out of Hands/Self/Bifrost. |
|
||||
| Repo work sight | `overview` emits compact proof rows, an `epiphany.repo_work_intake_consensus_readback.v0` from the accept/plan chain, and typed `epiphany.cultmesh.repo_work_overview.v0` event documents plus a latest key; `readiness` now emits `epiphany.repo_work_readiness_report.v0` and mirrors `epiphany.cultmesh.repo_work_readiness.v0` over the MVP proof rows, including Soul's safe-family planning matrix readback, Idunn repo-work service audit validation, Odin/Gjallar tool-directory validation, and Bifrost/GitHub publication receipt-chain validation while naming upstream-main sync as the remaining readiness gap without approving readiness; the CultMesh TUI rows include compact `CONSENSUS` and `REPO-WORK-READINESS` readbacks showing Persona/public feedback ids, Imagination consensus route, public/candidate ref counts, safe family, readiness gaps, and authority denials without private payloads; `close` mirrors Mind-admitted map facts as `epiphany.cultmesh.repo_work_map_entry.v0`; Gjallar enumerates overview history, readiness rows, map rows, semantic rows, closure rows, family lens rows, path lens rows, branch lens rows, stage lens rows, gate lens rows, and public-proof rows without private-state exposure; Persona's Eve surface and Eve connection readbacks expose peer-readable gate/blocker/next-action rows; `queue-run` consumes the same overview queue for branch-local scheduler pulses. | Deepen Bifrost-first external work accounting and semantic map readback without moving action authority out of Hands/Self/Bifrost. |
|
||||
| Publication | `publish` routes Bifrost/GitHub receipts from closure or explicit Soul/Mind refs. | Keep publication Bifrost-owned; do not let scheduler publish. |
|
||||
| Upstream main sync | `sync` proves the published commit is contained by upstream main after explicit merge/sync authority. | Treat upstream-main sync as a required final proof for published work. |
|
||||
| Daemon survival | Idunn service lifecycle receipts and runbooks exist outside repo-work tick authority. | Preserve Idunn as lifecycle owner; repo swarm may request or inspect service state, not impersonate daemon keeping. |
|
||||
|
|
|
|||
|
|
@ -171,7 +171,7 @@ remembers doctrine; the branch remembers the blade.
|
|||
- 2026-06-21: Idunn-hosted repo-work queue-run lifecycle now has audit/readiness closure. `epiphany-daemon-supervisor repo-work-service-audit` reads the typed service lifecycle receipts for `epiphany-repo-work-queue-runner`, requires planned install-plan, written local runbook artifact, completed launch with exit code `0`, and no private-state exposure, then writes a `repo-work-service-audit` receipt. Native smoke `.epiphany-smoke\repo-work-service-lifecycle-20260621-004202` proves plan/runbook/launch/audit with `auditStatus=complete`, `auditRunbookArtifactStatus=present`, `auditLaunchExitCode=0`, `mutatesServiceManager=false`, `requiresElevatedAuthority=false`, and `privateStateExposed=false`. Wrapper proofs `local-20260621-014302-362-31bbef47`, `local-20260621-014337-108-cbd99615`, `local-20260621-014413-125-09e183c5`, and `local-20260621-014558-197-f6951806` prove plan/runbook/launch/audit ergonomics; the final audit summary reports `missing=none`, `failed=none`, and `nextSafeMove=continue repo-swarm MVP planner/interpreter hardening`. Remaining Idunn service work is optional elevated install/start execution under explicit operator authority, not Self scheduling.
|
||||
- 2026-06-21: Repo-work MVP readiness sight now has a first-class local wrapper. `tools/epiphany_local_run.ps1 -Mode repo-work-readiness -Workspace <repo> -RepoWorkItem <item>` invokes `epiphany-work readiness`, accepts optional `-RepoWorkPublicProof`, `-RepoWorkIdunnLifecycleReceipt`, `-RepoWorkDeploymentAftercareReceipt`, `-RepoWorkDeploymentAftercareReceiptRef`, and `-RepoWorkToolDirectoryReceipt`, and prints satisfied/missing readiness rows plus authority denials. It writes readiness sight only: no readiness approval, publication, service lifecycle, Hands action, deployment, cross-body mutation, or private-state exposure. Wrapper proof `local-20260621-111351-678-c3f7c714` against `.epiphany-smoke\repo-work-readiness-20260621-101053\repo-body` reported `status=not-ready`, missing `bifrost-publication`, `upstream-main-sync`, `idunn-lifecycle`, and `tool-directory`, while `deployment-aftercare` was satisfied and all authority booleans stayed false. `gjallar`/`swarm-overview` and `swarm-triage` wrapper summaries forward Rust-owned `repoWorkReadinessTuiRows`; earlier proof `local-20260621-105450-620-0fc13242` printed the compact `REPO-WORK-READINESS` row through Gjallar.
|
||||
- 2026-06-21: Repo deployment handoff/readback now has first-class local wrappers. `tools/epiphany_local_run.ps1 -Mode repo-deployment-config-audit`, `-Mode repo-deployment-runbook`, and `-Mode repo-deployment-aftercare-audit` invoke the existing Rust `epiphany-work` deployment audit, operator runbook, and aftercare audit surfaces, adding compact summaries for Idunn readiness, the exact operator `git push` route, runbook SHA-256, CultMesh receipt refs, and authority denials. Wrapper proofs `local-20260621-110141-130-fa8f91d7`, `local-20260621-110200-679-a03614ce`, and `local-20260621-110219-492-c870e2da` against `.epiphany-smoke\repo-deployment-config-family-20260620-223203\repo-body` reported `ready-for-idunn-review`, `ready-for-operator-git-push`, and complete Idunn aftercare with deployment/git-push/service/Hands/private-state authority false. These wrappers do not SSH, deploy, or run `git push`; they are the operator/Idunn handoff and aftercare sight rite.
|
||||
- 2026-06-21: Repo-work readiness now includes the family-friendly safe-family planning depth row plus receipt-shaped Idunn/tool-directory validation. `epiphany-work readiness` inspects `closureReview.familyAssertions.safeFamilyPlanning` from the close receipt and satisfies `safe-family-planning` only for Soul-owned `epiphany.repo_work_safe_family_planning_readback.v0` over `repo.planning_brief` with all expected candidate families, requirements, gates, matrix groups, matrix controls, closure proofs, authority denials, and private-state seal intact. It also satisfies `idunn-lifecycle` only from `epiphany.repo_work_service_audit.v0` with complete Idunn-owned repo-work service proof, zero missing/failed checks, no service-manager mutation, no elevation requirement, and private-state seal; and satisfies `tool-directory` only from `epiphany.cultmesh.daemon_tool_directory.v0` with nonempty globally available receipt-gated daemon tools, ready hosts, invoke command hints, and private-state seal. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-103427` now runs the readiness proof through `repo-planning-brief` cargo and sealed Idunn/tool artifacts, proving `safe-family-planning`, `idunn-lifecycle`, `deployment-aftercare`, and `tool-directory` satisfied with `missingRequiredCount=2` for only Bifrost publication and upstream-main sync. Wrapper proof `local-20260621-113642-150-6f7ae7a5` prints the same two-gap row without granting readiness, scheduling, Hands, publication, deployment, service lifecycle, durable state commit, cross-body mutation, or private-state authority.
|
||||
- 2026-06-21: Repo-work readiness now includes the family-friendly safe-family planning depth row, receipt-shaped Idunn/tool-directory validation, and Bifrost/GitHub publication receipt-chain validation. `epiphany-work readiness` inspects `closureReview.familyAssertions.safeFamilyPlanning` from the close receipt and satisfies `safe-family-planning` only for Soul-owned `epiphany.repo_work_safe_family_planning_readback.v0` over `repo.planning_brief` with all expected candidate families, requirements, gates, matrix groups, matrix controls, closure proofs, authority denials, and private-state seal intact. It satisfies `idunn-lifecycle` only from `epiphany.repo_work_service_audit.v0` with complete Idunn-owned repo-work service proof, zero missing/failed checks, no service-manager mutation, no elevation requirement, and private-state seal; satisfies `tool-directory` only from `epiphany.cultmesh.daemon_tool_directory.v0` with nonempty globally available receipt-gated daemon tools, ready hosts, invoke command hints, and private-state seal; and satisfies `bifrost-publication` only when the local publish artifact matches the latest repo-local CultMesh Bifrost body-change and GitHub publication receipts, including ledger id, Hands PR id, PR URL, credit rows, changed paths, no upstream-main sync claim, no merge claim, and no private-state exposure. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-104757` now runs the readiness proof through `repo-planning-brief` cargo, sealed Idunn/tool artifacts, and a real `epiphany-work publish`, proving `safe-family-planning`, `idunn-lifecycle`, `deployment-aftercare`, `tool-directory`, and `bifrost-publication` satisfied with `missingRequiredCount=1` for only upstream-main sync. Wrapper proof `local-20260621-115019-563-f4cec9fa` prints the same one-gap row without granting readiness, scheduling, Hands, publication, deployment, service lifecycle, durable state commit, cross-body mutation, or private-state authority.
|
||||
- 2026-06-20: Mind now has explicit repo-work safe-family and requested-path guards before branch-local Hands authority. `adopt --from-plan` treats unsupported plan-derived safe-family labels as refused interpreter decisions, writes `epiphany.repo_work_mind_adoption_decision.v0` with `status=refused-unsupported-safe-family`, keeps `actionItemAccepted=false` and `safeFamilyRecognized=false`, grants no Hands/durable-state/service/publication/cross-body/private-state authority, and writes no normal adoption receipt. It also compares the sorted action-item `requestedPaths` against the sorted plan action `changedPaths`; mismatches write `status=refused-requested-path-mismatch`, keep `safeFamilyRecognized=true` but `requestedPathsMatchPlan=false`, point the next gate at `imagination.replan_with_matching_requested_paths`, and grant no Hands/durable-state/service/publication/cross-body/private-state authority. Focused smokes `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425` and `.epiphany-smoke\repo-mind-path-guard-20260620-194239` prove both refusal paths; earlier positive smokes `.epiphany-smoke\repo-planning-facets-20260620-190916` and `.epiphany-smoke\closure-model-gate-20260620-190916` prove recognized planning facets and closure model gates still pass. Current remaining repo-swarm MVP organs are deeper interpreter semantics beyond adoption refusal, more useful repo-owned configuration/action families, richer closure depth, and Idunn-owned queue-run service lifecycle under explicit operator authority.
|
||||
- 2026-06-20: Mind now also refuses plan-derived repo work that is not evidence-ready. `derive-plan` embeds verification asks in the Imagination action-item receipt, `adopt --from-plan` records verification asks and planning evidence needs in `epiphany.repo_work_mind_interpretation.v0`, and empty verification asks or evidence needs write `status=refused-missing-evidence-needs` with next gate `imagination.replan_with_explicit_soul_evidence_needs`. The refusal grants no Hands, durable-state, service, publication, cross-body, or private-state authority and writes no adoption receipt. Focused proof `.epiphany-smoke\repo-mind-evidence-guard-20260620-224426` tampers both arrays empty and proves the refusal; regression `.epiphany-smoke\repo-planning-facets-20260620-224428` proves normal planning facets still close through Soul/Modeling/Mind.
|
||||
- 2026-06-20: `repo-eve-surface` is now live as repo-owned Eve/CultUI surface contract cargo. `epiphany-work derive-plan --action-family repo-eve-surface` writes `.epiphany/eve-surfaces/<item>.toml` with safe family `repo.eve_surface`, compact agent TUI and GUI lowering contracts, local/public Verse routing, Odin discovery, provider-owned surface identity, Persona/human collaboration flags, feedback routing to Imagination, and denials for renderer ownership, rendering/state/publication/service/cross-body authority, private Verse rummaging, and private-state exposure. Soul closure assertions inspect schema, family, summary, surface routing, Verse routing, CultUI contracts, collaboration route, authority seals, and private-state seal. Focused smoke `.epiphany-smoke\repo-eve-surface-family-20260620-165927` ran init -> online -> accept -> repo-eve-surface derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/eve-surfaces/repo-eve-surface-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `hasCultUiContracts=true`, `hasVerseRouting=true`, `odinDiscoverable=true`, `feedbackRoutesToImagination=true`, `rendererOwnsTruth=false`, `renderingAuthority=false`, `stateAuthority=false`, `publicationAuthority=false`, `serviceLifecycleAuthority=false`, `crossBodyMutationAuthority=false`, `privateVerseRummaging=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -649,5 +649,5 @@ current_status:
|
|||
- `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness.
|
||||
- Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
|
||||
- `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
|
||||
last_completed_repo_swarm_cut: Repo-work readiness now validates Idunn lifecycle and global tool-directory proof rows from receipt-shaped artifacts instead of path existence. `epiphany-work readiness` accepts `.epiphany/work/repo-work-service-audit.json` or `--idunn-lifecycle-receipt` only when it is `epiphany.repo_work_service_audit.v0` with complete Idunn-owned repo-work service proof, present plan/runbook/artifact rows, launch ok, zero missing/failed checks, no service-manager mutation, no elevation requirement, and `privateStateExposed=false`; it accepts `.epiphany/work/tool-directory.json` or `--tool-directory-receipt` only when it is `epiphany.cultmesh.daemon_tool_directory.v0` with nonempty globally available receipt-gated daemon tools, ready hosts, direct/wrapper invoke commands, and private-state seal. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-103427` now drives the readiness proof through repo-planning-brief cargo plus those sealed artifacts, proving `safe-family-planning`, `idunn-lifecycle`, `deployment-aftercare`, and `tool-directory` satisfied with `missingRequiredCount=2` for only Bifrost publication and upstream-main sync; wrapper proof `local-20260621-113642-150-6f7ae7a5` printed the same two-gap row at the operator mouth.
|
||||
next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. The next useful cuts are Bifrost-first external-work accounting/publication proof, upstream-main sync proof after explicit publication/merge authority, another useful repo-owned safe action family if the review loop needs more cargo, or explicit elevated/operator Idunn execution proof only when the human grants that authority. Persona-to-Imagination consensus readback, Mind-owned interpreter brief cargo, safe-family planning depth, Gjallar closure/readiness map rows, Bifrost ledger accounting rows, readiness wrapper mouth, repo deployment handoff/readback wrappers, readiness deployment-aftercare closure, readiness safe-family planning closure, and readiness Idunn/tool-directory receipt validation are sealed; preserve Idunn service lifecycle ownership, Bifrost publication/upstream-main ownership, Mind durable-state admission, and existing CultMesh/Odin/Eve tool directories. Windows service install/start/deployment execution still requires explicit elevated operator authority.
|
||||
last_completed_repo_swarm_cut: Repo-work readiness now validates Bifrost/GitHub publication readiness from the local publish artifact plus matching repo-local CultMesh receipts. `epiphany-work readiness` accepts the `bifrost-publication` row only when `.epiphany/work/work-publish-<item>.json` is `epiphany.repo_work_publish_receipt.v0` with publication authorized, upstream-main sync unclaimed, merge unclaimed, and private-state sealed; when latest `gamecult.bifrost.body_change_publication_receipt.v0` and `gamecult.bifrost.github_publication_receipt.v0` rows match the publish artifact's Bifrost/GitHub receipt ids, ledger id, Hands PR receipt id, PR URL, credit rows, and changed paths; and when both receipts keep `privateStateExposed=false`. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-104757` now drives the readiness proof through repo-planning-brief cargo, sealed Idunn/tool artifacts, deployment-aftercare, and a real `epiphany-work publish`, proving `safe-family-planning`, `idunn-lifecycle`, `deployment-aftercare`, `tool-directory`, and `bifrost-publication` satisfied with `missingRequiredCount=1` for only upstream-main sync; wrapper proof `local-20260621-115019-563-f4cec9fa` printed the same one-gap row at the operator mouth.
|
||||
next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. The next useful cuts are upstream-main sync proof after explicit publication/merge authority, deeper Bifrost-first external-work accounting if ledger/publication readback needs more cargo, another useful repo-owned safe action family if the review loop needs more cargo, or explicit elevated/operator Idunn execution proof only when the human grants that authority. Persona-to-Imagination consensus readback, Mind-owned interpreter brief cargo, safe-family planning depth, Gjallar closure/readiness map rows, Bifrost ledger accounting rows, readiness wrapper mouth, repo deployment handoff/readback wrappers, readiness deployment-aftercare closure, readiness safe-family planning closure, readiness Idunn/tool-directory receipt validation, and readiness Bifrost/GitHub publication-chain validation are sealed; preserve Idunn service lifecycle ownership, Bifrost publication/upstream-main ownership, Mind durable-state admission, and existing CultMesh/Odin/Eve tool directories. Windows service install/start/deployment execution still requires explicit elevated operator authority.
|
||||
|
|
|
|||
Reference in a new issue