Distill active Epiphany memory
This commit is contained in:
Meta Vens
parent
409de65694
commit
a8456af7b8
4 changed files with 113 additions and 4792 deletions
File diff suppressed because it is too large
Load diff
Binary file not shown.
866
state/map.yaml
866
state/map.yaml
File diff suppressed because one or more lines are too long
208
state/scratch.md
208
state/scratch.md
|
|
@ -1,209 +1,11 @@
|
|||
# Scratch
|
||||
|
||||
This file is disposable working memory for the current bounded subgoal.
|
||||
Disposable working memory for one bounded rite.
|
||||
|
||||
## Current Subgoal
|
||||
|
||||
Make Body-bound workspace coverage operational without letting Qdrant, mutable
|
||||
model tags, process guesses, or service telemetry impersonate truth.
|
||||
No active scratch subgoal.
|
||||
|
||||
Landed checkpoint `aa6b3efe` proves sealed text/vector input validation, exact
|
||||
managed Qdrant metadata, whole-collection point/payload observation, and exact
|
||||
Body/plan/claim/prior-head terminal CAS. The following service work is still
|
||||
uncommitted and under hostile review.
|
||||
|
||||
Current authority map:
|
||||
|
||||
- Repository Body CultCache owns source observation, obligation, plan, claim,
|
||||
attempt, receipt, and coverage head.
|
||||
- The dedicated workspace-coverage projector owns one authenticated execution
|
||||
incarnation. Its fixed supervisor policy derives only runtime store, Verse,
|
||||
interval, Qdrant endpoint, and Ollama tag. It cannot accept workspace,
|
||||
Body-store, collection, dimensions, or arbitrary command authority.
|
||||
- Qdrant is disposable projection. Ollama is an embedding actuator. Neither can
|
||||
mint coverage state.
|
||||
- A claim must bind executor incarnation and startup receipt. Unknown or
|
||||
malformed claim/attempt state refuses overwrite.
|
||||
- Recovery is intentionally absent. A newer launch plus ready heartbeat does
|
||||
not prove the prior owner dead. Add supervisor-issued typed termination/death
|
||||
evidence bound to the prior launch before any recovery CAS exists.
|
||||
|
||||
Soul blockers found 2026-07-15:
|
||||
|
||||
1. Bind authenticated launch runtime id to the runtime Body route before any
|
||||
Body access. This hardening is now in the worktree.
|
||||
2. Observe and hash exact stored vectors, not only point IDs/payloads.
|
||||
3. Bind the plan to immutable Ollama model artifact digest, not mutable tag plus
|
||||
dimensions.
|
||||
4. Replace per-file full Body-store reloads with one authenticated read session
|
||||
and classify exact Current before rematerializing bytes.
|
||||
5. Give failed, fenced, and superseded claim collections an explicit retirement
|
||||
owner; claim/epoch isolation without GC leaks a collection per retry.
|
||||
6. Do not print raw chained backend/filesystem faults while claiming
|
||||
`privateStateExposed=false`; publish typed sanitized fault classes.
|
||||
|
||||
Local backend proof: Ollama is live at `127.0.0.1:11434` with
|
||||
`qwen3-embedding:0.6b`, digest
|
||||
`ac6da0dfba84a81fdbfbaf330198c33cd77c4cdfc53e8bc50eb581914a15621d`,
|
||||
1024 dimensions. Docker container `voidbot-qdrant` uses Qdrant 1.17.1 but is
|
||||
stopped. The hostile proof fixes passed; a real ignored smoke started Qdrant,
|
||||
projected through Ollama, exact-scroll-verified payloads and vectors, classified
|
||||
the result Current, deleted its isolated collection, verified no coverage
|
||||
collection remained, and stopped Qdrant again.
|
||||
|
||||
## Exact native process identity (2026-07-16)
|
||||
|
||||
The process-observation foundation now identifies a process incarnation by PID,
|
||||
native creation token, and canonical executable path. Windows compares identity
|
||||
through a held process handle before classifying it alive or exited; Toolhelp
|
||||
absence is distinct from access denial and query failure. Linux uses boot id,
|
||||
proc starttime, executable identity, and zombie state. Unsupported Unix targets
|
||||
refuse to pretend they have Linux `/proc` evidence.
|
||||
|
||||
The legacy PID-only projection is display-only and can emit only `Alive` or
|
||||
`Missing`; it cannot mint death evidence. Tests prove current-instance life,
|
||||
PID-incarnation replacement, and exact child exit. Next add enrolled OS-host
|
||||
identity, then reserved launch/heartbeat and immutable termination documents
|
||||
before any recovery CAS.
|
||||
|
||||
## Enrolled host incarnation (2026-07-16)
|
||||
|
||||
The host root is now a dedicated non-workspace CultCache document with one
|
||||
immutable Ed25519 enrollment and a narrow signing handle. Existing, malformed,
|
||||
unprotectable, or binding-mismatched state fails closed; enrollment never
|
||||
silently regenerates identity. Windows stores it under LocalAppData, protects
|
||||
the seed with CurrentUser DPAPI, and labels its limited assurance honestly.
|
||||
Linux uses the XDG/home state root, 0700/0600 permissions and machine-id binding,
|
||||
explicitly labeled cloneable. This is enrolled OS-installation continuity, not
|
||||
a claim about physical chassis. Purpose-bound signature and immutable/fail-
|
||||
closed tests pass. The next cut is specialized reserved launch/heartbeat state.
|
||||
|
||||
## Reserved managed-process authority map (2026-07-16)
|
||||
|
||||
Generic lifecycle and daemon-heartbeat documents are no longer acceptable
|
||||
owners for the reserved coverage projector. The replacement has three typed
|
||||
documents with separate authority:
|
||||
|
||||
- Idunn's signed launch binds the exact current policy envelope, enrolled host
|
||||
record, proven boot, PID+creation-token+canonical executable, executable
|
||||
digest, provider incarnation, and an ephemeral provider public key.
|
||||
- The provider's signed heartbeat binds that exact launch envelope and repeats
|
||||
the host/boot/process tuple with monotonic per-launch sequence.
|
||||
- Idunn's immutable termination observation names the exact prior launch and
|
||||
last heartbeat and may record only exact exit, exact missing/replaced process
|
||||
on the same proven boot, or a different proven boot on the same enrolled host.
|
||||
|
||||
Termination must be persisted before replacement spawn. Replacement launch and
|
||||
signed ready heartbeat follow; only then may one Body CAS terminalize the old
|
||||
claim/attempt and acquire epoch+1. Generic lifecycle/heartbeat writers must
|
||||
reject reserved coverage identities after migration. Timeout, staleness, newer
|
||||
launch, Qdrant state, PID-only absence, inaccessible process, unknown boot, or
|
||||
host mismatch are never death evidence. The provider signing seed travels in
|
||||
one fixed-size binary frame over reserved-child stdin (`Stdio::piped()`), never
|
||||
argv/env/store/logs. The child requires exact frame length plus EOF, derives the
|
||||
public key, then waits for and authenticates the launch document before acting.
|
||||
Write or persistence failure kills and waits the child; all nonreserved service
|
||||
stdin is explicitly null. This uses Rust's stable cross-platform child-stdin
|
||||
contract instead of bespoke inherited-handle plumbing.
|
||||
|
||||
## Live reserved authority migration (2026-07-16)
|
||||
|
||||
The supervisor/projector chain now consumes the specialized documents. Idunn
|
||||
generates the ephemeral provider seed, spawns, captures exact process identity,
|
||||
writes the fixed stdin frame, then host-signs and persists the launch; every
|
||||
failure after spawn kills and waits. The child reads exact frame+EOF and checks
|
||||
host, current policy, boot, PID generation/path, launch digest, and derived
|
||||
public key before any service pulse. Heartbeats are specialized and signed.
|
||||
|
||||
Generic lifecycle and generic heartbeat writers now refuse the reserved
|
||||
coverage identities, and the old coverage lifecycle authenticator is gone.
|
||||
Claim/attempt schema v1 binds `managed_process_launch_id`; v0 positional state
|
||||
cannot impersonate the new semantic owner. A native `epiphany-host-identity`
|
||||
enroll/status actuator was added, and this Windows installation was enrolled
|
||||
once at the default DPAPI CurrentUser path. Next build immutable termination
|
||||
evidence before replacement and only then the Body recovery CAS.
|
||||
|
||||
## Immutable exact termination evidence (2026-07-16)
|
||||
|
||||
Idunn can now publish one host-signed termination observation for one exact
|
||||
coverage launch. It exact-CASes the current policy, signed launch, and that
|
||||
launch's latest signed heartbeat while inserting an immutable per-launch key;
|
||||
there is no global termination head. Different proven boot, exact exit, exact
|
||||
same-boot absence, and exact PID replacement are the only outcomes. Alive,
|
||||
inaccessible, indeterminate, unknown boot, host mismatch, collisions, and moved
|
||||
source envelopes fail closed. The fake observation seam is module-private.
|
||||
Authentication rejoins the signed record to all exact persisted sources.
|
||||
|
||||
Next wire reconcile order: termination first, replacement launch second,
|
||||
replacement signed-ready third, then one Body recovery CAS. No timer gets a
|
||||
vote.
|
||||
|
||||
## Exact abandoned-claim transfer and Idunn wiring (2026-07-16)
|
||||
|
||||
Recovery now derives the Body store from the runtime route, authenticates the
|
||||
live Body basis, joins obligation/plan/claim to it, verifies exact old launch
|
||||
and immutable termination, requires the replacement's signed causal edge plus
|
||||
current ready heartbeat, and commits failed history, epoch+1 successor, and an
|
||||
immutable recovery receipt in one Body CAS. The receipt binds exact CultMesh
|
||||
envelope digests and reconstructs against CultMesh plus current Body state.
|
||||
|
||||
Idunn has a reserved reconciliation branch. Generic lifecycle PID receipts no
|
||||
longer decide workspace-coverage survival. Exact termination precedes spawn;
|
||||
the launch writer admits one replacement for that termination; signed ready
|
||||
precedes Body recovery. A concurrent launch loser is killed.
|
||||
|
||||
Remaining wound: termination requires a latest heartbeat. A child dying after
|
||||
signed launch persistence but before heartbeat sequence one can strand the
|
||||
chain. Make heartbeat optional additional termination evidence, then run an
|
||||
isolated live death/replacement/recovery smoke. Reboot still needs live operator
|
||||
approval.
|
||||
|
||||
## Pre-readiness death seam closed (2026-07-16)
|
||||
|
||||
Launch, heartbeat, and termination now contend on one typed per-launch process
|
||||
evidence head. Launch creates generation 1; heartbeat advances it; termination
|
||||
seals it. Termination v1 can carry no heartbeat when the exact signed launch and
|
||||
native host/boot/process proof already establish death. A late heartbeat cannot
|
||||
resurrect the launch. Six focused process tests, supervisor/projector suites,
|
||||
and all-target check pass. Next: real GUID-scoped recovery smoke.
|
||||
|
||||
## Live workspace coverage recovery passed (2026-07-16)
|
||||
|
||||
Proof: `C:\Users\Meta\AppData\Local\Temp\epiphany-workspace-coverage-a577f820-b0e2-4733-b628-529ee3bdb143\proof.json`.
|
||||
Initial epoch 1 owner was killed; Idunn produced exact termination, unique causal
|
||||
replacement, signed readiness, epoch 2 Body authority, and reconstructable
|
||||
receipt `2b44f28f-7c0f-4ad2-aefe-d7c8222e8642`. The replacement was killed only
|
||||
after exact launch-incarnation revalidation and only the two cryptographically
|
||||
derived fixture collections were eligible for deletion. Operator orchestration
|
||||
restored `voidbot-qdrant` to stopped. Before emitting success the smoke verified
|
||||
both owned collections absent. The proof binds the executed binary hash, exact
|
||||
embedded smoke-source hash, source head, and tracked-source diff digest; it
|
||||
proves fresh-store reopen authentication, not an OS process restart.
|
||||
|
||||
The run found and cut two last-minute lies: PID 4 was not a normal-user Windows
|
||||
boot oracle, so boot identity now comes from native kernel boot time; and the
|
||||
replacement could not resume its own recovered running claim, so exact v3 owner
|
||||
resumption is allowed while all foreign incarnations remain contended.
|
||||
|
||||
Next: full deployability audit. Reboot/logon proof still requires permission.
|
||||
|
||||
## Deployability audit cut (2026-07-16)
|
||||
|
||||
Operational after login, not artifact-clean. Yggdrasil Qdrant/Ollama and both
|
||||
packaged semantic query gates pass. Installed siblings predate `34802407` and
|
||||
are mutable/mixable. Build one immutable commit-addressed release witness before
|
||||
replacement. Mind still needs the R1/model+admission/live-semantic/live-coverage/
|
||||
R2 repository-readiness join. The readiness plan's June queue was stale and is
|
||||
now an evidence matrix. Sight surfaces no longer say `queryAdmission=false`;
|
||||
they never owned that decision. Final reboot/logon proof needs live approval.
|
||||
|
||||
## Witnessed release deployed (2026-07-16)
|
||||
|
||||
Commit `dd80f4a5` packaged as release `sha256-c941...f923`, witness
|
||||
`sha256-f039...e04a`. Exact detached source plus initialized submodules plus
|
||||
tracked lockfile plus isolated `--locked` build; four siblings only. Task and
|
||||
Idunn pin the witness. Reconciler 21228 -> projector 22736; Mind/Modeling query
|
||||
admission passed. Exact-path child kill -> direct-child projector 19748, launch
|
||||
receipt `86a42d51-9930-4b5d-9e61-e74c82a0d808`, ready heartbeat
|
||||
`4fc91977-b635-474b-812b-c364847e2b4b`, witnessed digest match. Next is Mind's
|
||||
repository readiness join. Reboot remains permission-bound.
|
||||
Rehydrate from `state/map.yaml` and `notes/fresh-workspace-handoff.md`.
|
||||
Populate this file only when a new bounded investigation begins; clear it when
|
||||
the finding is admitted, rejected, or moved into durable evidence.
|
||||
|
|
|
|||
Reference in a new issue