diff --git a/epiphany-core/src/bin/epiphany-repo-work-readiness-smoke.rs b/epiphany-core/src/bin/epiphany-repo-work-readiness-smoke.rs index 8b107cb3..9a6b48c8 100644 --- a/epiphany-core/src/bin/epiphany-repo-work-readiness-smoke.rs +++ b/epiphany-core/src/bin/epiphany-repo-work-readiness-smoke.rs @@ -208,6 +208,48 @@ fn run_smoke(args: Args) -> Result { ], &root, )?; + let close_receipt = repo + .join(".epiphany") + .join("work") + .join(format!("work-close-{item}.json")); + cargo_json( + &manifest, + "epiphany-work", + &[ + "publish", + "--workspace", + path_str(&repo)?, + "--epiphany-root", + path_str(&root)?, + "--item", + item, + "--closure-receipt", + path_str(&close_receipt)?, + "--local-verse-store", + path_str(&local_verse)?, + "--change-summary", + "Repo-work readiness smoke Bifrost publication proof.", + "--justification", + "Disposable Bifrost publication proof for the repo-work readiness smoke.", + "--verification-receipt", + "soul-verdict:repo-work-readiness-smoke", + "--review-receipt", + "mind-review:repo-work-readiness-smoke", + "--author-agent", + "epiphany.Hands", + "--credit-subject", + "epiphany.Hands", + "--ledger-entry-id", + "repo-work-readiness-smoke-ledger", + "--pull-request-url", + "https://example.invalid/GameCult/repo-work-readiness-smoke/pull/1", + "--pull-request-number", + "1", + "--pull-request-title", + "Repo work readiness smoke proof", + ], + &root, + )?; let deployment_aftercare_fixture = repo .join(".epiphany") .join("work") @@ -285,7 +327,7 @@ fn run_smoke(args: Args) -> Result { "epiphany.repo_work_readiness.v0", )?; require_eq(&readiness, &["status"], "not-ready")?; - require_u64(&readiness, &["missingRequiredCount"], 2)?; + require_u64(&readiness, &["missingRequiredCount"], 1)?; require_bool(&readiness, &["authority", "sightOnly"], true)?; require_bool( &readiness, @@ -332,7 +374,9 @@ fn run_smoke(args: Args) -> Result { 21, )?; require_row(&readiness, "public-proof", true)?; - require_row(&readiness, "bifrost-publication", false)?; + require_row(&readiness, "bifrost-publication", true)?; + require_row_field_u64(&readiness, "bifrost-publication", "creditReceiptCount", 1)?; + require_row_field_u64(&readiness, "bifrost-publication", "changedPathCount", 1)?; require_row(&readiness, "upstream-main-sync", false)?; require_row(&readiness, "idunn-lifecycle", true)?; require_row(&readiness, "deployment-aftercare", true)?; diff --git a/epiphany-core/src/bin/epiphany-work.rs b/epiphany-core/src/bin/epiphany-work.rs index 6a3b907f..a9e64e64 100644 --- a/epiphany-core/src/bin/epiphany-work.rs +++ b/epiphany-core/src/bin/epiphany-work.rs @@ -37,6 +37,8 @@ use epiphany_core::load_epiphany_cultmesh_idunn_aftercare_audit_receipt; use epiphany_core::load_epiphany_cultmesh_idunn_deployment_receipt; use epiphany_core::load_epiphany_cultmesh_repo_work_overviews; use epiphany_core::load_epiphany_cultmesh_swarm_brake; +use epiphany_core::load_latest_epiphany_cultmesh_bifrost_body_change_publication_receipt; +use epiphany_core::load_latest_epiphany_cultmesh_bifrost_github_publication_receipt; use epiphany_core::load_latest_epiphany_cultmesh_idunn_aftercare_audit_receipt; use epiphany_core::load_latest_epiphany_cultmesh_idunn_deployment_receipt; use epiphany_core::load_latest_epiphany_cultmesh_repo_work_overview; @@ -12153,14 +12155,7 @@ fn run_readiness(args: ReadinessArgs) -> Result { public_proof_path.exists(), "Redacted public proof bundle exists.", )?, - readiness_path_row( - "bifrost-publication", - "Bifrost", - "gamecult.bifrost.publication_receipt.v0", - &publish_receipt_path, - publish_receipt.is_some(), - "Bifrost/GitHub publication receipt exists.", - )?, + bifrost_publication_readiness_row(&publish_receipt_path, publish_receipt.as_ref())?, readiness_path_row( "upstream-main-sync", "Bifrost/GitHub", @@ -14178,6 +14173,147 @@ fn readiness_missing_row(kind: &str, owner: &str, required_schema: &str, note: & }) } +fn bifrost_publication_readiness_row(path: &Path, receipt: Option<&Value>) -> Result { + let Some(receipt) = receipt else { + return Ok(readiness_missing_row( + "bifrost-publication", + "Bifrost/GitHub", + "epiphany.repo_work_publish_receipt.v0 + gamecult.bifrost.body_change_publication_receipt.v0 + gamecult.bifrost.github_publication_receipt.v0", + "Run epiphany-work publish so Bifrost and GitHub publication receipts exist before readiness review.", + )); + }; + + let schema_ok = string_from_json(receipt, &["schemaVersion"]).as_deref() + == Some("epiphany.repo_work_publish_receipt.v0"); + let status_ok = + string_from_json(receipt, &["status"]).as_deref() == Some("publication-receipts-recorded"); + let publication_authorized = + bool_from_json(receipt, &["authority", "publicationAuthorized"]) == Some(true); + let upstream_not_claimed = + bool_from_json(receipt, &["authority", "upstreamMainSynced"]) == Some(false); + let merge_not_claimed = + bool_from_json(receipt, &["authority", "mergeAuthorized"]) == Some(false); + let private_sealed = bool_from_json(receipt, &["authority", "privateStateExposed"]) + == Some(false) + && bool_from_json(receipt, &["privateStateExposed"]).unwrap_or(false) == false; + let local_verse_store = path_from_json(receipt, &["localVerseStore"]); + let runtime_id = + string_from_json(receipt, &["runtimeId"]).unwrap_or_else(|| "repo-swarm-local".to_string()); + let bifrost_publication_receipt_id = + string_from_json(receipt, &["bifrost", "publicationReceiptId"]); + let github_publication_receipt_id = + string_from_json(receipt, &["bifrost", "githubPublicationReceiptId"]); + let ledger_entry_id = string_from_json(receipt, &["bifrost", "ledgerEntryId"]); + let pull_request_url = string_from_json(receipt, &["bifrost", "pullRequestUrl"]); + let credit_receipt_count = receipt + .get("bifrost") + .and_then(|bifrost| bifrost.get("creditReceiptIds")) + .and_then(Value::as_array) + .map(Vec::len) + .unwrap_or(0); + let changed_path_count = receipt + .get("changedPaths") + .and_then(Value::as_array) + .map(Vec::len) + .unwrap_or(0); + + let mut bifrost_latest_matches = false; + let mut github_latest_matches = false; + let mut bifrost_private_sealed = false; + let mut github_private_sealed = false; + let mut github_links_bifrost = false; + let mut publication_status = "missing".to_string(); + let mut github_publication_status = "missing".to_string(); + + if let (Some(store), Some(bifrost_id), Some(github_id)) = ( + local_verse_store.as_ref(), + bifrost_publication_receipt_id.as_ref(), + github_publication_receipt_id.as_ref(), + ) { + let latest_bifrost = load_latest_epiphany_cultmesh_bifrost_body_change_publication_receipt( + store, + runtime_id.clone(), + )?; + let latest_github = load_latest_epiphany_cultmesh_bifrost_github_publication_receipt( + store, + runtime_id.clone(), + )?; + if let Some(latest) = latest_bifrost.as_ref() { + bifrost_latest_matches = latest.receipt_id == *bifrost_id + && latest.github_publication_receipt_id == *github_id + && latest.bifrost_ledger_entry_id == ledger_entry_id.clone().unwrap_or_default() + && !latest.accepted_changed_paths.is_empty() + && !latest.credit_receipt_ids.is_empty(); + bifrost_private_sealed = !latest.private_state_exposed; + publication_status = latest.status.clone(); + } + if let Some(latest) = latest_github.as_ref() { + github_latest_matches = latest.receipt_id == *github_id + && latest.bifrost_publication_receipt_id == *bifrost_id + && latest.hands_pr_receipt_id + == string_from_json(receipt, &["handsReceipts", "prReceiptId"]) + .unwrap_or_default() + && latest.pull_request_url == pull_request_url.clone().unwrap_or_default() + && !latest.changed_paths.is_empty() + && !latest.ledger_entry_id.trim().is_empty(); + github_links_bifrost = latest.bifrost_publication_receipt_id == *bifrost_id; + github_private_sealed = !latest.private_state_exposed; + github_publication_status = latest.publication_status.clone(); + } + } + + let satisfied = schema_ok + && status_ok + && publication_authorized + && upstream_not_claimed + && merge_not_claimed + && private_sealed + && local_verse_store.is_some() + && bifrost_latest_matches + && github_latest_matches + && bifrost_private_sealed + && github_private_sealed + && github_links_bifrost + && credit_receipt_count > 0 + && changed_path_count > 0 + && ledger_entry_id + .as_ref() + .is_some_and(|id| !id.trim().is_empty()) + && pull_request_url + .as_ref() + .is_some_and(|url| !url.trim().is_empty()); + + Ok(json!({ + "kind": "bifrost-publication", + "owner": "Bifrost/GitHub", + "requiredSchema": "epiphany.repo_work_publish_receipt.v0 + gamecult.bifrost.body_change_publication_receipt.v0 + gamecult.bifrost.github_publication_receipt.v0", + "evidenceRef": existing_path_value(path), + "artifactStatus": if path.exists() { "present" } else { "missing" }, + "schemaVersion": string_from_json(receipt, &["schemaVersion"]).unwrap_or_else(|| "missing".to_string()), + "documentStatus": string_from_json(receipt, &["status"]).unwrap_or_else(|| "missing".to_string()), + "bifrostPublicationReceiptId": bifrost_publication_receipt_id.unwrap_or_else(|| "missing".to_string()), + "githubPublicationReceiptId": github_publication_receipt_id.unwrap_or_else(|| "missing".to_string()), + "ledgerEntryId": ledger_entry_id.unwrap_or_else(|| "missing".to_string()), + "creditReceiptCount": credit_receipt_count, + "changedPathCount": changed_path_count, + "publicationStatus": publication_status, + "githubPublicationStatus": github_publication_status, + "bifrostLatestMatches": bifrost_latest_matches, + "githubLatestMatches": github_latest_matches, + "githubLinksBifrost": github_links_bifrost, + "publicationAuthorized": publication_authorized, + "upstreamMainSynced": !upstream_not_claimed, + "mergeAuthorized": !merge_not_claimed, + "privateStateExposed": !(private_sealed && bifrost_private_sealed && github_private_sealed), + "satisfied": satisfied, + "status": if satisfied { "satisfied" } else { "missing" }, + "note": "Bifrost and GitHub publication receipts are present in repo-local CultMesh and match the repo publish artifact without claiming upstream-main sync.", + "readinessApprovalAuthorized": false, + "serviceLifecycleAuthority": false, + "handsActionAuthorized": false + })) +} + fn idunn_lifecycle_readiness_row(path: &Path) -> Result { let document = read_json_if_exists(path)?; let schema_version = document diff --git a/notes/epiphany-repo-swarm-mvp-contract.md b/notes/epiphany-repo-swarm-mvp-contract.md index 8a3ccb13..fc79575d 100644 --- a/notes/epiphany-repo-swarm-mvp-contract.md +++ b/notes/epiphany-repo-swarm-mvp-contract.md @@ -1640,15 +1640,22 @@ service-manager mutation, no elevation requirement, and or `--tool-directory-receipt` as `epiphany.cultmesh.daemon_tool_directory.v0`, requiring nonempty globally available receipt-gated capabilities, ready hosts, typed direct/wrapper -invocation commands, and the private-state seal. Native smoke -`.epiphany-smoke\repo-work-readiness-20260621-103427` now reports -`not-ready` with only two missing rows, Bifrost publication and upstream-main -sync; writes readiness id `repo-work-readiness-repo-work-readiness`; and Gjallar -reports `repoWorkReadinessCount=1` without private-state exposure. Wrapper -proof `local-20260621-113642-150-6f7ae7a5` prints the same two-gap readiness -mouth. This is still sight only: Idunn keeps lifecycle ownership, Odin/Gjallar -keep discovery/sight, and no readiness approval, publication, sync, service -mutation, Hands action, or private-state authority is granted. +invocation commands, and the private-state seal. It now validates +`bifrost-publication` from the local publish artifact plus matching repo-local +CultMesh `gamecult.bifrost.body_change_publication_receipt.v0` and +`gamecult.bifrost.github_publication_receipt.v0` rows, requiring matching +Bifrost/GitHub receipt ids, ledger id, Hands PR receipt id, PR URL, nonempty +credit and changed-path evidence, no upstream-main sync claim, no merge claim, +and no private-state exposure. Native smoke +`.epiphany-smoke\repo-work-readiness-20260621-104757` now reports `not-ready` +with only one missing row, `upstream-main-sync`; writes readiness id +`repo-work-readiness-repo-work-readiness`; and Gjallar reports +`repoWorkReadinessCount=1` without private-state exposure. Wrapper proof +`local-20260621-115019-563-f4cec9fa` prints the same one-gap readiness mouth. +This is still sight only: Bifrost/GitHub keep publication ownership, Idunn +keeps lifecycle ownership, Odin/Gjallar keep discovery/sight, and no readiness +approval, publication, sync, service mutation, Hands action, or private-state +authority is granted. Bifrost public-proof publication transport is now the closure after local proof sight. `epiphany-verse-query bifrost-public-proof --public-proof-id @@ -1906,7 +1913,7 @@ temptation wearing clean robes. | Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan`, `repo-work-service-runbook`, `repo-work-service-launch`, and `repo-work-service-audit` write Idunn lifecycle receipts/artifacts for the same queue-run command and prove non-mutating launch/readiness closure. | Keep any future queue-run service install/start mutation behind Idunn and explicit elevated operator authority. | | Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. | | Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, refuses missing/tampered/non-affirmative Mind adoption proof, runs known safe-family content assertions, optionally gates on model-authored closure verdicts, can require verification output to cite declared changed paths with `--require-source-grounding`, writes Soul/Modeling/Mind receipts, admits a compact typed repo map entry into `.epiphany/state/repo-work-map.msgpack`, and mirrors that admitted fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0`. | Keep extending closure toward source-grounded semantic review and richer semantic map lenses, while preserving deterministic local closure for simple mechanical work. | -| Repo work sight | `overview` emits compact proof rows, an `epiphany.repo_work_intake_consensus_readback.v0` from the accept/plan chain, and typed `epiphany.cultmesh.repo_work_overview.v0` event documents plus a latest key; `readiness` now emits `epiphany.repo_work_readiness_report.v0` and mirrors `epiphany.cultmesh.repo_work_readiness.v0` over the MVP proof rows, including Soul's safe-family planning matrix readback, Idunn repo-work service audit validation, and Odin/Gjallar tool-directory validation while naming the remaining Bifrost publication/upstream-main gaps without approving readiness; the CultMesh TUI rows include compact `CONSENSUS` and `REPO-WORK-READINESS` readbacks showing Persona/public feedback ids, Imagination consensus route, public/candidate ref counts, safe family, readiness gaps, and authority denials without private payloads; `close` mirrors Mind-admitted map facts as `epiphany.cultmesh.repo_work_map_entry.v0`; Gjallar enumerates overview history, readiness rows, map rows, semantic rows, closure rows, family lens rows, path lens rows, branch lens rows, stage lens rows, gate lens rows, and public-proof rows without private-state exposure; Persona's Eve surface and Eve connection readbacks expose peer-readable gate/blocker/next-action rows; `queue-run` consumes the same overview queue for branch-local scheduler pulses. | Deepen Bifrost-first external work accounting and semantic map readback without moving action authority out of Hands/Self/Bifrost. | +| Repo work sight | `overview` emits compact proof rows, an `epiphany.repo_work_intake_consensus_readback.v0` from the accept/plan chain, and typed `epiphany.cultmesh.repo_work_overview.v0` event documents plus a latest key; `readiness` now emits `epiphany.repo_work_readiness_report.v0` and mirrors `epiphany.cultmesh.repo_work_readiness.v0` over the MVP proof rows, including Soul's safe-family planning matrix readback, Idunn repo-work service audit validation, Odin/Gjallar tool-directory validation, and Bifrost/GitHub publication receipt-chain validation while naming upstream-main sync as the remaining readiness gap without approving readiness; the CultMesh TUI rows include compact `CONSENSUS` and `REPO-WORK-READINESS` readbacks showing Persona/public feedback ids, Imagination consensus route, public/candidate ref counts, safe family, readiness gaps, and authority denials without private payloads; `close` mirrors Mind-admitted map facts as `epiphany.cultmesh.repo_work_map_entry.v0`; Gjallar enumerates overview history, readiness rows, map rows, semantic rows, closure rows, family lens rows, path lens rows, branch lens rows, stage lens rows, gate lens rows, and public-proof rows without private-state exposure; Persona's Eve surface and Eve connection readbacks expose peer-readable gate/blocker/next-action rows; `queue-run` consumes the same overview queue for branch-local scheduler pulses. | Deepen Bifrost-first external work accounting and semantic map readback without moving action authority out of Hands/Self/Bifrost. | | Publication | `publish` routes Bifrost/GitHub receipts from closure or explicit Soul/Mind refs. | Keep publication Bifrost-owned; do not let scheduler publish. | | Upstream main sync | `sync` proves the published commit is contained by upstream main after explicit merge/sync authority. | Treat upstream-main sync as a required final proof for published work. | | Daemon survival | Idunn service lifecycle receipts and runbooks exist outside repo-work tick authority. | Preserve Idunn as lifecycle owner; repo swarm may request or inspect service state, not impersonate daemon keeping. | diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index dea1b91c..f2ba6278 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -171,7 +171,7 @@ remembers doctrine; the branch remembers the blade. - 2026-06-21: Idunn-hosted repo-work queue-run lifecycle now has audit/readiness closure. `epiphany-daemon-supervisor repo-work-service-audit` reads the typed service lifecycle receipts for `epiphany-repo-work-queue-runner`, requires planned install-plan, written local runbook artifact, completed launch with exit code `0`, and no private-state exposure, then writes a `repo-work-service-audit` receipt. Native smoke `.epiphany-smoke\repo-work-service-lifecycle-20260621-004202` proves plan/runbook/launch/audit with `auditStatus=complete`, `auditRunbookArtifactStatus=present`, `auditLaunchExitCode=0`, `mutatesServiceManager=false`, `requiresElevatedAuthority=false`, and `privateStateExposed=false`. Wrapper proofs `local-20260621-014302-362-31bbef47`, `local-20260621-014337-108-cbd99615`, `local-20260621-014413-125-09e183c5`, and `local-20260621-014558-197-f6951806` prove plan/runbook/launch/audit ergonomics; the final audit summary reports `missing=none`, `failed=none`, and `nextSafeMove=continue repo-swarm MVP planner/interpreter hardening`. Remaining Idunn service work is optional elevated install/start execution under explicit operator authority, not Self scheduling. - 2026-06-21: Repo-work MVP readiness sight now has a first-class local wrapper. `tools/epiphany_local_run.ps1 -Mode repo-work-readiness -Workspace -RepoWorkItem ` invokes `epiphany-work readiness`, accepts optional `-RepoWorkPublicProof`, `-RepoWorkIdunnLifecycleReceipt`, `-RepoWorkDeploymentAftercareReceipt`, `-RepoWorkDeploymentAftercareReceiptRef`, and `-RepoWorkToolDirectoryReceipt`, and prints satisfied/missing readiness rows plus authority denials. It writes readiness sight only: no readiness approval, publication, service lifecycle, Hands action, deployment, cross-body mutation, or private-state exposure. Wrapper proof `local-20260621-111351-678-c3f7c714` against `.epiphany-smoke\repo-work-readiness-20260621-101053\repo-body` reported `status=not-ready`, missing `bifrost-publication`, `upstream-main-sync`, `idunn-lifecycle`, and `tool-directory`, while `deployment-aftercare` was satisfied and all authority booleans stayed false. `gjallar`/`swarm-overview` and `swarm-triage` wrapper summaries forward Rust-owned `repoWorkReadinessTuiRows`; earlier proof `local-20260621-105450-620-0fc13242` printed the compact `REPO-WORK-READINESS` row through Gjallar. - 2026-06-21: Repo deployment handoff/readback now has first-class local wrappers. `tools/epiphany_local_run.ps1 -Mode repo-deployment-config-audit`, `-Mode repo-deployment-runbook`, and `-Mode repo-deployment-aftercare-audit` invoke the existing Rust `epiphany-work` deployment audit, operator runbook, and aftercare audit surfaces, adding compact summaries for Idunn readiness, the exact operator `git push` route, runbook SHA-256, CultMesh receipt refs, and authority denials. Wrapper proofs `local-20260621-110141-130-fa8f91d7`, `local-20260621-110200-679-a03614ce`, and `local-20260621-110219-492-c870e2da` against `.epiphany-smoke\repo-deployment-config-family-20260620-223203\repo-body` reported `ready-for-idunn-review`, `ready-for-operator-git-push`, and complete Idunn aftercare with deployment/git-push/service/Hands/private-state authority false. These wrappers do not SSH, deploy, or run `git push`; they are the operator/Idunn handoff and aftercare sight rite. -- 2026-06-21: Repo-work readiness now includes the family-friendly safe-family planning depth row plus receipt-shaped Idunn/tool-directory validation. `epiphany-work readiness` inspects `closureReview.familyAssertions.safeFamilyPlanning` from the close receipt and satisfies `safe-family-planning` only for Soul-owned `epiphany.repo_work_safe_family_planning_readback.v0` over `repo.planning_brief` with all expected candidate families, requirements, gates, matrix groups, matrix controls, closure proofs, authority denials, and private-state seal intact. It also satisfies `idunn-lifecycle` only from `epiphany.repo_work_service_audit.v0` with complete Idunn-owned repo-work service proof, zero missing/failed checks, no service-manager mutation, no elevation requirement, and private-state seal; and satisfies `tool-directory` only from `epiphany.cultmesh.daemon_tool_directory.v0` with nonempty globally available receipt-gated daemon tools, ready hosts, invoke command hints, and private-state seal. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-103427` now runs the readiness proof through `repo-planning-brief` cargo and sealed Idunn/tool artifacts, proving `safe-family-planning`, `idunn-lifecycle`, `deployment-aftercare`, and `tool-directory` satisfied with `missingRequiredCount=2` for only Bifrost publication and upstream-main sync. Wrapper proof `local-20260621-113642-150-6f7ae7a5` prints the same two-gap row without granting readiness, scheduling, Hands, publication, deployment, service lifecycle, durable state commit, cross-body mutation, or private-state authority. +- 2026-06-21: Repo-work readiness now includes the family-friendly safe-family planning depth row, receipt-shaped Idunn/tool-directory validation, and Bifrost/GitHub publication receipt-chain validation. `epiphany-work readiness` inspects `closureReview.familyAssertions.safeFamilyPlanning` from the close receipt and satisfies `safe-family-planning` only for Soul-owned `epiphany.repo_work_safe_family_planning_readback.v0` over `repo.planning_brief` with all expected candidate families, requirements, gates, matrix groups, matrix controls, closure proofs, authority denials, and private-state seal intact. It satisfies `idunn-lifecycle` only from `epiphany.repo_work_service_audit.v0` with complete Idunn-owned repo-work service proof, zero missing/failed checks, no service-manager mutation, no elevation requirement, and private-state seal; satisfies `tool-directory` only from `epiphany.cultmesh.daemon_tool_directory.v0` with nonempty globally available receipt-gated daemon tools, ready hosts, invoke command hints, and private-state seal; and satisfies `bifrost-publication` only when the local publish artifact matches the latest repo-local CultMesh Bifrost body-change and GitHub publication receipts, including ledger id, Hands PR id, PR URL, credit rows, changed paths, no upstream-main sync claim, no merge claim, and no private-state exposure. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-104757` now runs the readiness proof through `repo-planning-brief` cargo, sealed Idunn/tool artifacts, and a real `epiphany-work publish`, proving `safe-family-planning`, `idunn-lifecycle`, `deployment-aftercare`, `tool-directory`, and `bifrost-publication` satisfied with `missingRequiredCount=1` for only upstream-main sync. Wrapper proof `local-20260621-115019-563-f4cec9fa` prints the same one-gap row without granting readiness, scheduling, Hands, publication, deployment, service lifecycle, durable state commit, cross-body mutation, or private-state authority. - 2026-06-20: Mind now has explicit repo-work safe-family and requested-path guards before branch-local Hands authority. `adopt --from-plan` treats unsupported plan-derived safe-family labels as refused interpreter decisions, writes `epiphany.repo_work_mind_adoption_decision.v0` with `status=refused-unsupported-safe-family`, keeps `actionItemAccepted=false` and `safeFamilyRecognized=false`, grants no Hands/durable-state/service/publication/cross-body/private-state authority, and writes no normal adoption receipt. It also compares the sorted action-item `requestedPaths` against the sorted plan action `changedPaths`; mismatches write `status=refused-requested-path-mismatch`, keep `safeFamilyRecognized=true` but `requestedPathsMatchPlan=false`, point the next gate at `imagination.replan_with_matching_requested_paths`, and grant no Hands/durable-state/service/publication/cross-body/private-state authority. Focused smokes `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425` and `.epiphany-smoke\repo-mind-path-guard-20260620-194239` prove both refusal paths; earlier positive smokes `.epiphany-smoke\repo-planning-facets-20260620-190916` and `.epiphany-smoke\closure-model-gate-20260620-190916` prove recognized planning facets and closure model gates still pass. Current remaining repo-swarm MVP organs are deeper interpreter semantics beyond adoption refusal, more useful repo-owned configuration/action families, richer closure depth, and Idunn-owned queue-run service lifecycle under explicit operator authority. - 2026-06-20: Mind now also refuses plan-derived repo work that is not evidence-ready. `derive-plan` embeds verification asks in the Imagination action-item receipt, `adopt --from-plan` records verification asks and planning evidence needs in `epiphany.repo_work_mind_interpretation.v0`, and empty verification asks or evidence needs write `status=refused-missing-evidence-needs` with next gate `imagination.replan_with_explicit_soul_evidence_needs`. The refusal grants no Hands, durable-state, service, publication, cross-body, or private-state authority and writes no adoption receipt. Focused proof `.epiphany-smoke\repo-mind-evidence-guard-20260620-224426` tampers both arrays empty and proves the refusal; regression `.epiphany-smoke\repo-planning-facets-20260620-224428` proves normal planning facets still close through Soul/Modeling/Mind. - 2026-06-20: `repo-eve-surface` is now live as repo-owned Eve/CultUI surface contract cargo. `epiphany-work derive-plan --action-family repo-eve-surface` writes `.epiphany/eve-surfaces/.toml` with safe family `repo.eve_surface`, compact agent TUI and GUI lowering contracts, local/public Verse routing, Odin discovery, provider-owned surface identity, Persona/human collaboration flags, feedback routing to Imagination, and denials for renderer ownership, rendering/state/publication/service/cross-body authority, private Verse rummaging, and private-state exposure. Soul closure assertions inspect schema, family, summary, surface routing, Verse routing, CultUI contracts, collaboration route, authority seals, and private-state seal. Focused smoke `.epiphany-smoke\repo-eve-surface-family-20260620-165927` ran init -> online -> accept -> repo-eve-surface derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/eve-surfaces/repo-eve-surface-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `hasCultUiContracts=true`, `hasVerseRouting=true`, `odinDiscoverable=true`, `feedbackRoutesToImagination=true`, `rendererOwnsTruth=false`, `renderingAuthority=false`, `stateAuthority=false`, `publicationAuthority=false`, `serviceLifecycleAuthority=false`, `crossBodyMutationAuthority=false`, `privateVerseRummaging=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 3683c4b4..33a33f30 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 2ee73b47..74805600 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -649,5 +649,5 @@ current_status: - `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness. - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. - last_completed_repo_swarm_cut: Repo-work readiness now validates Idunn lifecycle and global tool-directory proof rows from receipt-shaped artifacts instead of path existence. `epiphany-work readiness` accepts `.epiphany/work/repo-work-service-audit.json` or `--idunn-lifecycle-receipt` only when it is `epiphany.repo_work_service_audit.v0` with complete Idunn-owned repo-work service proof, present plan/runbook/artifact rows, launch ok, zero missing/failed checks, no service-manager mutation, no elevation requirement, and `privateStateExposed=false`; it accepts `.epiphany/work/tool-directory.json` or `--tool-directory-receipt` only when it is `epiphany.cultmesh.daemon_tool_directory.v0` with nonempty globally available receipt-gated daemon tools, ready hosts, direct/wrapper invoke commands, and private-state seal. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-103427` now drives the readiness proof through repo-planning-brief cargo plus those sealed artifacts, proving `safe-family-planning`, `idunn-lifecycle`, `deployment-aftercare`, and `tool-directory` satisfied with `missingRequiredCount=2` for only Bifrost publication and upstream-main sync; wrapper proof `local-20260621-113642-150-6f7ae7a5` printed the same two-gap row at the operator mouth. - next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. The next useful cuts are Bifrost-first external-work accounting/publication proof, upstream-main sync proof after explicit publication/merge authority, another useful repo-owned safe action family if the review loop needs more cargo, or explicit elevated/operator Idunn execution proof only when the human grants that authority. Persona-to-Imagination consensus readback, Mind-owned interpreter brief cargo, safe-family planning depth, Gjallar closure/readiness map rows, Bifrost ledger accounting rows, readiness wrapper mouth, repo deployment handoff/readback wrappers, readiness deployment-aftercare closure, readiness safe-family planning closure, and readiness Idunn/tool-directory receipt validation are sealed; preserve Idunn service lifecycle ownership, Bifrost publication/upstream-main ownership, Mind durable-state admission, and existing CultMesh/Odin/Eve tool directories. Windows service install/start/deployment execution still requires explicit elevated operator authority. + last_completed_repo_swarm_cut: Repo-work readiness now validates Bifrost/GitHub publication readiness from the local publish artifact plus matching repo-local CultMesh receipts. `epiphany-work readiness` accepts the `bifrost-publication` row only when `.epiphany/work/work-publish-.json` is `epiphany.repo_work_publish_receipt.v0` with publication authorized, upstream-main sync unclaimed, merge unclaimed, and private-state sealed; when latest `gamecult.bifrost.body_change_publication_receipt.v0` and `gamecult.bifrost.github_publication_receipt.v0` rows match the publish artifact's Bifrost/GitHub receipt ids, ledger id, Hands PR receipt id, PR URL, credit rows, and changed paths; and when both receipts keep `privateStateExposed=false`. Native smoke `.epiphany-smoke\repo-work-readiness-20260621-104757` now drives the readiness proof through repo-planning-brief cargo, sealed Idunn/tool artifacts, deployment-aftercare, and a real `epiphany-work publish`, proving `safe-family-planning`, `idunn-lifecycle`, `deployment-aftercare`, `tool-directory`, and `bifrost-publication` satisfied with `missingRequiredCount=1` for only upstream-main sync; wrapper proof `local-20260621-115019-563-f4cec9fa` printed the same one-gap row at the operator mouth. + next_action: Continue repo-swarm MVP work from the documented Epiphany Online cut order in `notes/epiphany-repo-swarm-mvp-contract.md`. The next useful cuts are upstream-main sync proof after explicit publication/merge authority, deeper Bifrost-first external-work accounting if ledger/publication readback needs more cargo, another useful repo-owned safe action family if the review loop needs more cargo, or explicit elevated/operator Idunn execution proof only when the human grants that authority. Persona-to-Imagination consensus readback, Mind-owned interpreter brief cargo, safe-family planning depth, Gjallar closure/readiness map rows, Bifrost ledger accounting rows, readiness wrapper mouth, repo deployment handoff/readback wrappers, readiness deployment-aftercare closure, readiness safe-family planning closure, readiness Idunn/tool-directory receipt validation, and readiness Bifrost/GitHub publication-chain validation are sealed; preserve Idunn service lifecycle ownership, Bifrost publication/upstream-main ownership, Mind durable-state admission, and existing CultMesh/Odin/Eve tool directories. Windows service install/start/deployment execution still requires explicit elevated operator authority.