From a8456af7b8cb0dccdd71825dcf0a7657b769e92c Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Wed, 5 Aug 2026 22:51:04 +0100 Subject: [PATCH] Distill active Epiphany memory --- notes/fresh-workspace-handoff.md | 3831 +----------------------------- state/ledgers.msgpack | Bin 547338 -> 547645 bytes state/map.yaml | 866 +------ state/scratch.md | 208 +- 4 files changed, 113 insertions(+), 4792 deletions(-) diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 815233d6..495f674b 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -1,3788 +1,63 @@ # Fresh Workspace Handoff -## Native Persona conversation is locally proven and ready for braked promotion (2026-07-22) +## Present condition -The earlier claim that Epiphany depended on VoidBot for Persona/Discord plumbing -was false. Epiphany owns heartbeat/CTB pressure, immutable Persona turn -reservation, Projector, Persona, Interpreter, Mind effects, signed speech -requests, and terminal reconciliation. Bifrost owns only Discord Gateway/token, -posting, and signed transport receipts. VoidBot owns nothing in this path. +Epiphany is a native Rust organism whose typed state and organ boundaries live +outside Codex. CultCache persists state, CultNet carries typed messages, and +CultMesh projects inspectable surfaces. Codex remains only as the retained +OpenAI-compatible authentication and model-transport boundary. -The live consequence boundary is a signed CultNet/RUDP permit. Bifrost journals -the exact nonce and five-second request window before network, replays that -exact tuple only while valid, writes `running` before Discord actuation, checks -permit expiry again immediately before posting, and treats every crash-ambiguous -or expired outcome as terminal unknown/failed without reposting. Epiphany's -permit issuer rereads the canonical brake at issuance and grants one delivery -digest once. Failed/unknown transport and ambiguous local Mind effects become -non-schedulable typed quarantine. SAY is independent of memory: the Interpreter -may speak without manufacturing a state note. +The local `main` branch is clean and synchronized with its upstream. -Packaging now includes the Persona service, mouth identity, permit issuer, and -permit identity. Ops owns distinct trust anchors, loopback permit service, -read-only crossing directory mounts, rollback of first-enrollment identities and -anchors, lifecycle checks, and authority-backup coverage. A Rust-authored -CultCache request was consumed by Bifrost through the read-only mount shape; the -smoke caught and repaired positional-tuple and byte-vector decoding at the TS -boundary. +On Yggdrasil: -Local gates are green: epiphany-core 617 passed / 0 failed / 1 ignored; Persona -executor 3/3; Bifrost Persona delivery plus feedback 15/15; Rust-to-Bifrost -crossing 1/1; ops rollback, deployment wiring, backup, shell syntax, Rust format, -Node syntax, and diff checks pass. No successor has been deployed yet. +- Idunn is active. +- Bifrost is active. +- Epiphany services are inactive after a clean rollback. +- The canonical Idunn deployment brake is engaged. +- A deployment request is awaiting authorization. +- The current Idunn incarnation did not consume a matching valid grant for that + request. -Next: commit and push Epiphany, Bifrost, and gamecult-ops; promote only those -exact commits through Bifrost/Idunn with both brakes engaged; run the root Ygg -checker; then release only the narrow cognition interval needed for one real -addressed Discord conversation. Require the full ingress -> CTB -> three model -stages -> signed request -> live permit -> one post -> signed receipt -> terminal -reconciliation chain, re-engage sleep immediately, and prove unattended -readiness. Do not broadly Wake or reboot. - -## Authenticated provider health is wired into Epiphany Status v2 (2026-07-19) - -The Epiphany operator service now requires Idunn public-query endpoint, pinned -projection anchor, provider admission store, Idunn runtime, local TTL, and exact -deployment lineage configuration. Each Status invocation queries exactly -`yggdrasil-epiphany` and `yggdrasil-bifrost-persona-feedback` through CultNet -RUDP, verifies returned records independently, and atomically advances durable -admission only for a complete valid set. One valid record remains reportable -when its peer is missing, but the set is explicitly `incomplete`; stale durable -admission is never presented as current sight. - -Only Status uses `epiphany.operator_command.status_result.v2` and typed -`statusV2`; stored command results and every non-Status wire result remain v1. -The bounded projection carries release lineage, coordinator/brake/resident -namespaces, pressure and pending-review counts, and two provider projections -containing state/reason/clocks/bounded lineage/digest. It carries no provider -signature, detail, path, key, or private state. The Rust interop protocol fixture -now includes `operatorStatusV2MigrationFixture` for later Bifrost/VoidBot work; -those consumers are deliberately unchanged. Focused provider/service/CLI tests -pass 6/6, 7/7, and 1/1; full core library passes 605/0/1. - -## Epiphany canonical signed-health publisher landed (2026-07-19) - -The Epiphany supervisor now publishes the generic canonical -`idunn.signed_daemon_health.v1` 17-field positional CultCache record using a -dedicated `GameCultProviderHealthIdentity`, exact `runtime_id`, release witness, -source commit, deployment request, one UUID per supervisor process, and checked -monotonic sequence. It no longer signs provider health with host identity or -publishes the Epiphany-only v0 contract. Detail is a bounded generic reason and -never carries process, path, contradiction, or workspace evidence. - -The existing `epiphany-daemon-supervisor` binary owns explicit immutable -`provider-health-identity-enroll` and public-only -`provider-health-identity-export` commands, so no package role was added. The -serve path opens the private typed store only; it never creates identity during -runtime. CultNet owner commit `a1001dc` now owns the shared signed record schema, -17 keyed fields, and validation beside the provider identity and signing -purpose. Focused publisher tests pass 6/6, supervisor tests 25/25, full core -library 603/0/1, and a live isolated enroll/export smoke produced distinct -private and public CultCache files without exposing private state. - -Next: advance Odin to the CultNet owner commit and remove/re-export its duplicate -Rust signed-health record, then install root trust bindings and finish the Idunn -public projection/query path. Status remains untouched until that chain is -complete. - -## Organizational Yggdrasil deployment is live and braked (2026-07-19) - -Epiphany's ordinary organizational product path is now deployed on Yggdrasil, -not merely proven in local smoke. Bifrost authorized each exact upstream -release and Idunn produced successful deployment receipts for Epiphany -`bcff32827a39ca793c3062cc71e02aeeac1b091f`, Bifrost -`6491f449cf0dbfa952b409de90ccdf511669a60b` with CultLib -`693df0901d75cfd8e3a0a5225e270011eeddb0be`, and VoidBot -`26093ace0e4b5d15370bd29e3118fb27c807afa0`. - -All Epiphany resident services, Idunn, and VoidBot are active. The Bifrost -Persona-feedback sidecar is healthy under its own `bifrost-feedback` service -identity; it owns its private provider and delivery state, participates in the -shared CultCache lock groups, and publishes daemon-owned CultNet/RUDP health -over host networking so Idunn observes Ygg-local provenance instead of Docker -bridge NAT. The Bifrost Epiphany operator worker is running against the -loopback-only Epiphany command service on port 17875. VoidBot and Bifrost now -share the exact v1 six-command request identity; the live v0 request -substitution was deleted. Legacy v0 replay is bounded to the original four -commands. The final root-level Ygg checker passes. - -Resident readiness is active and release-authenticated with -`brakeEngaged=true`. Do not release it as part of verification. Ollama exposes -`qwen3-embedding:0.6b` at 100% GPU placement on the GTX 1080; both Modeling -semantic projectors point at the Ygg-local Qdrant/Ollama path. - -The Epiphany release id is -`sha256-e0a9eb079250d3f769040255f3d2805286488896c6e2c38222748d2298daf913` -with witness -`sha256-dd84cfeb730061ee38edae5d8de104b65e1cb2f3c723d62e087b68974eac814e`. - -This promotion exposed an Idunn packaging actuator fault before outage: -`mktemp` pre-created the path later passed to Docker as `--cidfile`, so Docker -refused the run before any service mutation. Ops commit `71beacf` now gives -Docker a nonexistent child path inside a fresh temporary directory and cleans -the exact recorded container. The first two Epiphany promotion attempts failed -closed; the corrected retry admitted the exact release above. VoidBot's audited -artifact is `c513c8591baa931fd47b5ee5e29578f2af58af49637d4a88a44b4bda63821af8` -and its Idunn release is `20260719T182219Z-26093ace0e4b`. The final root checker -passed with no failed units and the canonical brake still engaged. - -The next proof is organizational interaction, not another deployment: use -Discord to request `/epiphany status` and submit ordinary repository feedback -to the Epiphany Persona, then verify only operator-safe typed projections and -receipts. Do not test Wake while the deployment brake is the intended owner of -sleep. Conversation remains feedback pressure; it does not adopt Mind state or -grant Hands, release, or deployment authority. - -Do not expand Discord Status with the current Idunn/Bifrost health packet. The -provider audit found that generic `idunn.daemon_health.v1` is unsigned: Idunn -checks typed shape, daemon id, contract, self-declared publication source and -transport, and freshness, but no pinned publisher identity or signature. Idunn -also exposes no authenticated outward projection for Epiphany to consume. The -deployed Odin lineage is the clean `E:\Projects\Odin-yggdrasil-idunn` worktree, -not the unrelated active Odin branch. Odin commit `be8836f` executes the -generic `idunn.signed_daemon_health.v1`, root-owned -`idunn.daemon_health_trust_binding.v1`, and monotonic admission contracts. -Managed-health reads rejoin the exact signed statement, Idunn admission, and -current root binding. Unsigned legacy packets persist only as -`idunn.unsigned_daemon_health_diagnostic.v1` under a distinct diagnostic key; -they cannot overwrite health, reset continuity, suppress recovery, or claim -readiness. `docs/idunn-signed-daemon-health-authority.md` records the cut. -This source is intentionally not deployed: Bifrost and other generic -publishers have not migrated, the root trust store is not installed, Epiphany -still uses its signed v0 migration route, and Idunn has no signed outward -projection. Migrate publishers and outward status before promotion; otherwise -unmigrated services would correctly become missing and could trigger recovery. - -The consumer side of that boundary is now implemented but deliberately not -wired into Status. `epiphany-core/src/idunn_provider_health.rs` requests exact -daemon/contract pairs through CultNet's read-only raw snapshot API and admits -only canonical, Idunn-signed `idunn.authenticated_provider_health_projection.v1` -records under a root-pinned `gamecult.service_trust_anchor.v1`. It verifies the -fixed signing purpose, derived Idunn identity, runtime, schema/key, closed -state/reason, anchor lifetime, local TTL, privacy seal, and Forbidden-or-Exact -release lineage. The dedicated admission store advances the complete required -set atomically with per-pair projection/provider replay rules. Root key rotation -is possible only through a newer pinned anchor whose binding follows prior -admission/evaluation and whose new projection follows the binding; packet keys -cannot rotate trust. Missing or invalid input never deletes prior admission. -CultNet owner commit `a1001dc` -supplies the shared contracts, identity verifier, pure query, and mature RUDP -transport. Focused tests pass 5/5, full core library 606/0/1, and the sole -integration target 1/1. Next migrate the two publishers and root bindings, -finish Idunn's public snapshot serving, then wire Status to this verifier; do -not lower private Idunn state or deploy a partial migration. - -### Unattended continuity aftercare - -The Ygg body has no live Starfire reference. Epiphany, operator, heartbeat, -resident Self, Idunn, VoidBot, Docker, WireGuard, SSH socket activation, and the -new authority-backup timer are enabled for boot; all current services are -active and all relevant containers use restart policies. Seven obsolete failed -transient Idunn build units were cleared so `systemctl --failed` is meaningful. - -The swarm unit no longer overwrites persistent refreshed Codex auth on every -restart. `/etc/gamecult/epiphany/credentials/codex-auth.json` is a cold-start -seed copied with `cp --update=none`; `/var/lib/gamecult/epiphany/codex-home` -owns later provider refreshes. The runtime file is forced to mode `0600` so -Codex can refresh it in place, and resident readiness now requires private -owner read/write rather than accepting an unwritable `0400` seed. Only -canonical `auth.json` satisfies Ygg readiness; legacy `credentials.json` cannot -stand in for an absent canonical credential. Operator config remains -operator-authored. - -`gamecult-authority-backup.timer` now seals one validated, SHA-256-addressed, -root-only recovery archive daily with 14-day retention. The exact Epiphany, -Bifrost, and VoidBot state writers are briefly frozen or paused while the -archive is opened. Idunn is deliberately not frozen: live proof showed -freeze/thaw leaves its process alive while killing its RUDP receiver. Missing -writers fail the run, and publication is refused -unless every quiesced writer is confirmed active and thawed/unpaused. Strict -snapshot `20260719T173400Z` passed checksum and tar traversal while Idunn kept -accepting provider health. It contains Bifrost release authority plus Idunn -config/trust/provenance; Idunn's live observation/command state is excluded and -reconstructed from providers after restore. Older unsafe snapshots were deleted. Release -trees, logs, media, RAG/vector projections, and Qdrant remain excluded. This is -local logical-corruption recovery on clean two-disk RAID1, not off-host backup. - -Idunn's live process is now self-proven by a root-sealed manifest: exact Odin -commit `15a744c826f0aa2e8cc322a6543ea8a9afcd852a`, digest-pinned Rust image, -build artifact, installed binary and privileged surfaces, and the executable -behind the live PID. Every installed surface is root-owned at its exact safe -mode, and systemd reports the sealed unit/drop-in loaded with no pending reload. -Verification owns no lifecycle or deployment action. The -final Ygg checker requires this proof and passes with the brake engaged. - -The provenance manifest disappeared after the later Bifrost promotion while -the exact installed Idunn binary, matching build artifact, root-owned surfaces, -and live PID remained unchanged. It was resealed from canonical Odin commit -`15a744c826f0aa2e8cc322a6543ea8a9afcd852a` and the pinned Rust image without a -rebuild, service restart, or deployment action. The full root-level checker is -green. Run this checker with root authority: its proof intentionally reads the -`0440` Idunn sudoers surface. - -Restarting Idunn to repair the frozen RUDP nerve also proved that Docker moves -the package builder outside Idunn's systemd cgroup: the interrupted build -container survived beside the retry. The exact orphan was stopped and its -worktree removed. Ops commit `391842e` gives every future Epiphany packager a -CID file and force-removes that exact container in the actuator EXIT trap; the -installed Idunn manifest already contains the correction. - -The host reports a pending reboot for installed kernel `6.8.0-136`; it still -runs `6.8.0-134`. No reboot was performed or authorized. Schedule that as an -explicit operator maintenance window before departure if desired; deployment -and readiness must never smuggle it in. - -## Swarm brake observation/actuation purification (2026-07-19) - -`epiphany-verse-query swarm-brake` was a mutating pseudo-query whose missing -`--brake-status` defaulted to `released`; a read-only audit therefore released -the live Ygg brake. The old command is now disabled. `swarm-brake-status` is a -read-only projection over the one runtime-scoped CultMesh key -`epiphany-local/swarm-brake`; tests prove its store bytes remain identical. -`swarm-brake-set` is the only CLI mutation surface and requires explicit -`engaged|released`, canonical document id `epiphany/swarm-brake`, actor, and -reason. The document's stable owner is `epiphany.swarm-brake`; actors remain -provenance instead of repainting authority on every command. - -Release refuses absent and foreign/legacy identities. Readers continue to -honor an engaged legacy head. Idunn may explicitly adopt an already-engaged -legacy head during deployment, with no released interval; non-Idunn actors and -Discord Sleep cannot. Discord Wake releases only the canonical id+owner. -Resident readiness reads the same key. The ops actuator now engages that -canonical brake before service restart and deployment readiness requires -`brakeEngaged=true`. No Ygg service was deployed or restarted during this cut. - -## Typed Discord Mind review owner (2026-07-19) - -The operator-command core now implements `Reviews` and `Review` without a -parallel review store. `Reviews` is a bounded identity-only projection of -current canonical `RepoFrontierPlanMindRequest` records. `Review` binds request, -candidate id/digest, expected RepoModel revision/hash, and exact -Adopt/Refuse/Hold. Mind revalidates and commits the existing decision owner; -Hold/Refuse are terminal inert receipts and Adopt uses the existing RepoModel -CAS. It creates no Hands/Substrate, Persona, release, or deployment authority. - -Decision provenance is typed (`MindWorker` or -`AuthenticatedOperatorReview`). RepoModel review/admission provenance is typed -separately (`WorkerResult` or `FrontierPlanDecision`); legacy worker ids are -Options and operator adoption writes None. Crash replay derives decision time -from packet `issuedAt` and recognizes only exact typed provenance. Candidate -mismatch is a terminal refusal; storage/corruption/CAS faults propagate. Actual -CultCache v0 tuple decoding and signed v0 delivery replay are covered; v0 -cannot acquire Reviews/Review. - -The service CLI now requires the canonical runtime-spine store explicitly and -returns sealed Discord-safe review projections. No successor is deployed. -Bifrost/VoidBot must advance to the v1 schemas before the Ygg rehearsal; brakes -remain engaged. - -## Organizational product posture and current release blockers — 2026-07-18 - -This is not a special dogfood experiment. Epiphany's normal organizational -product is a resident swarm that persistently models its authorized domain, -derives bounded direction from that map, autonomously imagines improvements and -features, and exposes a repository Persona through which the organization can -converse and provide attributed feedback. Instructions are optional pressure; -they are not the only source of useful work. Feedback is likewise pressure, not -Mind adoption, Hands authority, Bifrost release authority, or Idunn deployment -authority. - -The signed VoidBot -> Bifrost -> Epiphany feedback path and the resident -Self -> Imagination proposal-only path are implemented locally. The four -structural release blockers identified in the first Soul audit are now closed -in source and local proof: - -- admitted feedback now lives in a dedicated `persona-feedback.cc` store, not - shared local Verse; classification is exact and Imagination has no direct - Persona-reply route; -- Eve connection/consensus intent and receipt authority, writers, projections, - tool claims, tests, and smoke binaries are deleted; -- Bifrost sidecar release is exact-authority/digest bound, Node is digest-pinned, - Idunn alone invokes deployment, and daemon-owned typed RUDP health feeds the - existing Idunn supervisor target; -- `scripts/smoke-persona-feedback-org-path.ps1` passed the real VoidBot writer -> - Bifrost sign -> Rust ingress -> resident consideration -> coordinator launch -> - proposal validation path for public, organization, and private feedback while - Mind, release, local Verse, and public stores remained byte-identical. - -Live Yggdrasil deployment and the Starfire-offline Discord rehearsal remain -pending; source proof is not deployment proof. - -Do not describe this as an experiment-only capability after these blockers are -closed. The bounded autonomous loop is the product. - -## Workspace coverage storage cut is founded, not migrated — 2026-07-17 - -Live Yggdrasil evidence rejects `c94fa580` as a deployment candidate. During -that candidate, `body.cc` was rewritten by workspace-projection activity rather -than repository observation. The rewrite is attributable to the surviving -coverage writers sharing the Body store; it is not evidence that the Body -observer changed repository substrate. Body owns observed substrate only: -binding, immutable observations/manifests, and the current Body head. - -Commit `261c7bc8` lands the replacement foundation. A runtime-side immutable -`epiphany.runtime.workspace_coverage_store_binding.v0` route and store-local -`gamecult.epiphany.workspace_coverage_store_binding.v0` bind a separate -transactional `workspace-coverage` store to runtime, swarm, workspace, -canonical path and file identity, exact repository Body route/envelope, -Body-binding hash, and repository source identity. Transactional keyed -CultCache admission is pinned beneath it. This is routing and storage -foundation, not completion: obligation, plan, claim, attempt, recovery, -checkpoint, progress, terminal receipt, coverage head, and retirement writers -have not yet been migrated from Body/local Verse. - -Authority map: - -- Owner: the workspace-coverage store owns projection lifecycle and proof; - repository Body owns observations only. -- Inputs: the exact pinned Body route/binding and current observation basis, - sealed inclusion/projection/model plan, authenticated launch/provider - incarnation, Idunn recovery authority, and waited Qdrant readback. -- Outputs: immutable obligation/plan and claim/attempt/recovery history, - checkpoint/progress events and heads, terminal receipt/coverage head, and - retirement history. -- Derived state: current claim, progress, coverage, warming, active, and query - eligibility are joins over those records plus freshly revalidated Body and - Qdrant; no store path or old head is truth by itself. -- Forbidden writers: Body observer/bootstrap cannot write projection state; - projector/checkpoint/recovery cannot write Body; local Verse, Idunn, - heartbeat, health, deploy scripts, Qdrant, and presentation cannot advance - coverage heads. -- Shared path: prepare, acquire, each waited batch/readback, resume/recovery, - final whole-scroll, health, and readiness resolve the same runtime binding, - reopen exact Body read authority, and transact only through the pinned - coverage store. Checkpoint and progress must admit atomically. -- Cut line: migrate every projection envelope and bootstrap the binding, switch - authority once, then remove Body/Verse writers and readers. Preserve exact - signed envelope identities where predecessor digests depend on them. There - is no dual-read or missing-binding fallback. - -Next: perform that writer/bootstrap migration, prove Body bytes remain unchanged -through projection, and only then build a new live Yggdrasil candidate. Keep -`c94fa580` rejected; do not lengthen a timeout or reinterpret its rewrite as an -observer fault. - -## Signed Yggdrasil deployment admission cut complete locally — 2026-07-17 - -The failed GPU pressure run was a pipeline-contract failure, not a CUDA -failure. The GTX 1080 previously sustained near-full duty, but the monolithic -workspace projection published no durable Qdrant progress before the shell -deadline. The replacement executor now checkpoints bounded batches, resumes -from authenticated checkpoints after restart, and exposes checkpoint-derived -progress independently of its heartbeat. Aggregate health is `warming` only -while exact managed-process lineage, fresh signed heartbeat, and authenticated -checkpoint advancement remain inside the 300-second no-advance lease. Only the -terminal current receipt/head can produce `active`; the deploy shell has no -projection wall-clock verdict. - -The cross-repo deployment authority cut is implemented and Soul passes it. -Epiphany signs runtime health with exact release id, witness, source commit, -deployment request id, process incarnation, and sequence. Idunn verifies the -pinned public-only host anchor and persists generic health as observation only. -Promotion reads `idunn.signed_health_admission.v1`, requires it to match the -current health observation, expire within 180 seconds, and join the exact -monotonic `idunn.current_deployment_request.v1` head plus its Bifrost-authorized -`idunn.deployment_request.v2`. Health/admission and request/head transitions use -cross-process CultCache compare-exchange over exact prior envelopes. CultCache -now writes a synced unique temporary file and atomically replaces the live -store without a delete gap. Concurrent N+1/N+2 admission proof finishes at -N+2; equal-second request IDs no longer decide authority lexicographically. - -First trust enrollment refuses any pre-existing app-owned private identity when -no root anchor exists. One `enroll-trust-anchor` process creates the signer and -exports its public anchor; root then pins only that public document as -`root:idunn 0640`. Later deployments must byte-match it. The deploy actuator -uses Idunn's typed verifier with the exact request/release tuple; journal prose, -generic health, and `warming` cannot promote. - -Local proof: Epiphany runtime-health 8, workspace-progress 13, -workspace-projector 22, host-identity 3, supervisor 17; Odin core 15 and Idunn -45 all pass. Gamecult shell syntax passes under Git Bash. Final hostile Soul -audit reports no P0/P1. Next: commit/push all three repos, deploy updated Odin/ -Idunn to Yggdrasil first, then Bifrost-authorize and Idunn-deploy the exact -Epiphany commit. Verify live signed warming, batchwise Qdrant growth, GPU duty, -terminal exact-request active admission, and restart resume. No reboot is -authorized. - -## Live Body-grounded admission rite — 2026-07-16 - -Thread `readiness-grounding-20260716` now has a typed, immutable user objective -and an accepted code-grounded Eyes result. Cold-start objective intake, explicit -local-Verse path ownership, source tools for Eyes/Modeling, canonical result -readers, failed-result supersession, reorient auto-acceptance, and the -CRRC-regather handoff to Eyes are implemented in the current worktree. - -The live rite exposed output-contract wounds one at a time. Modeling operations, -frontier items, nodes, edges, profiles, anchors, code refs, observations, and -evidence now have provider-facing typed shapes matching canonical ingress; -explicit null no longer impersonates a reviewable state patch. Failed worker -output is terminally sealed with a bounded diagnostic rather than marked -complete. The stale OpenAI-runtime Modeling fixture now carries and echoes a -Body basis and passes again. - -No current Modeling admission exists yet. After the Body was committed at -`f574a194`, Modeling completed a source-grounded typed proposal over the -repository Body. Mind correctly refused it because ordinary `Evolution` also -carried `upsert_frontier`, which requires an explicit frontier request. The -prompt now makes the invariant explicit: ordinary Evolution changes nodes and -edges only. Commit this small correction, rebuild the coordinator, supersede -the refused result, and relaunch in `--mode run` with the accepted Eyes basis. -Make no source edits between the final Body observation and Mind admission. -Only after Mind accepts an exact Body-basis RepoModel patch should -`epiphany-memory-semantic repository-readiness` be run with local Ollama -`qwen3-embedding:0.6b`, 1024 dimensions, and the runtime spine. - -The next nodes/edges-only proposal reached Mind and exposed one further missing -launch input: the worker invented a workspace-derived domain id and used -`active` lifecycle, while the canonical revision-0 RepoModel has domain `repo` -and permits only observed/proposed/accepted/stale/retired for repo profiles. -`` now carries exact current revision/hash, existing -domains, and lifecycle law into every Modeling launch. The rejected result is -already superseded. Rebuild/commit this context change, then relaunch once. - -Exact remaining sequence: - -1. finish tests/format/docs and commit so the Body is stable; -2. relaunch Modeling against thread `readiness-grounding-20260716`; -3. inspect only the operator-safe role finding, then auto-accept if its Body - basis, RepoModel patch, and state patch are typed and current; -4. run the live repository-readiness join and preserve its projection; -5. investigate the provider failure only through typed request/receipt - diagnostics if it repeats; raw worker thought remains sealed. - -## Counterfeit planning writers cut - 2026-07-15 - -Modeling and Eyes traced the repo-frontier planning family and found a typed but -disconnected island. Self's deterministic planning request is real. The -Imagination candidate and Mind Adopt/Refuse/Hold documents were only authored -by tests or arbitrary callers through public persistence functions. Generic -Imagination `statePatch.planning` is a separate thread-state vocabulary, not a -repo-frontier candidate. Adopt suppressed future request selection but changed -no RepoModel bytes and affected no Hands route. - -The public candidate/adoption writers are removed; their internal functions are -temporary test scaffolding, not production authority. The full source-grounded -replacement map is `notes/repo-frontier-planning-authority-map.md`. Build the -real nerve using the claim-repair shape: Self request, coordinator-owned typed -Imagination projection and request-keyed launch binding, exclusive immutable -result echo containing the candidate, then Mind-only correlated -Adopt/Refuse/Hold. Adopt must produce a narrow admitted model transition and -downstream Hands truth; Refuse/Hold remain inert receipts. Delete the remaining -fixture writers when that lands. Core verification is green at 319 passed, one -ignored. - -## Eyes-to-Modeling claim correction nerve complete - 2026-07-15 - -The Aetheria-shaped corrective nerve is now closed from immutable Eyes -contradiction through Modeling proposal to Mind admission. A claim repair launch -may produce one immutable role-worker result carrying the exclusive -`claimRepairRequestId` echo and `RepairClaim` purpose. Result schema and worker -output contract are versioned v1; admission receipts and their contract are v3. -Malformed RepairClaim results carrying proposal/frontier echoes, Verification -authority, state patches, or self patches are rejected before persistence. - -Mind replays the current repair request, challenge, Eyes packet and admissions, -the unique coordinator launch binding, exact worker launch document hash and -typed projection, runtime/thread identity, model base, target node hash, and -exact evidence set. It permits exactly one `ReviseNode`; the challenged `claim` -text must change while id, domain, profile, kind, creation time, and lifecycle -remain invariant. Review, next model, and receipt still share the model CAS. -Challenge resolution is derived from the target node hash changing; there is no -repair flag or cleanup writer. Exact retry validates the persisted receipt and -current admitted model. Hostiles cover swapped request, adjacent/missing -evidence, extra operation, wrong target, unchanged/timestamp-only claim, -identity/lifecycle mutation, state/self authority smuggling, forged launch hash, -and counterfeit retry receipt with byte-identical refusal. Soul passed the -final boundary; the core library is green at 318 passed, one ignored. - -Next: bind Self's existing frontier planning request to a real Imagination result -and Mind Adopt/Refuse/Hold admission, then build the production semantic index -over typed graph claims so Modeling's persistent map becomes searchable body -knowledge rather than a scan-heavy archive. - -## Runtime worker results are actually immutable - 2026-07-14 - -Eyes found that the document called an immutable role-worker result was still -published through ordinary CultCache `put`, allowing a second payload at the -same runtime job identity to replace the thought before Mind admission. The -writer is now absent-only: an exact retry converges without rewriting bytes; -any different result at the same job fails without mutation; concurrent loss -reloads and accepts only exact equality. The full core library passes at 316 -passed, one ignored. Claim-repair result correlation may now rely on one -persisted worker result rather than a politely named mutable slot. - -## Modeling claim-repair launch authority landed - 2026-07-14 - -The inert `RepoModelClaimRepairRequest` now reaches Modeling through one -coordinator-owned typed context projection and one immutable, request-keyed -launch binding. The coordinator reconstructs the projection from current -canonical state; callers cannot prepopulate it, combine it with proposal -Modeling authority, substitute any causal field, or spend one repair request -twice. The launch document hash binds the exact effective document delivered to -the worker. This slice still grants no RepoModel write authority. - -The launch race exposed a deeper state-transaction fault: two coordinators could -validate the same logical state and both publish. `CoordinatorStateTransaction` -now captures one exact typed cache image, validates the canonical state by -polymorphic `(type, key)` identity, and commits state plus companions through one -backing-store CAS. Immutable companions are absent-only or byte-equivalent -retries with the persisted timestamp preserved. Explicit captured replacements -may replace only the exact envelope observed at open. Imported nondefault host -state may seed an absent store once. Focused hostile tests prove one race winner, -no losing job/request/event/runtime link, immutable collision no-write behavior, -captured-replacement contention, and same-key/different-type coexistence. Soul -re-reviewed the repaired proof surface and passed it; the full core library is -green at 314 passed, one ignored. - -Next: make the Modeling result echo this repair request exclusively, then add a -dedicated narrow patch purpose and Mind admission that replays the full chain and -requires the exact challenged claim bytes to change. No other result or model -revision may clear challenge pressure. - -## Modeling name authority correction - 2026-07-14 - -Modeling is the standing embodied organ that models the Body. Proprioception is -a retired legacy name, not a parallel faculty or worker posture. The global -Codex doctrine had missed this migration and could still force Self to dispatch -`Proprioception` workers; runtime work-loop telemetry also targeted the retired -stage name. Both are corrected to Modeling. Keep legacy string handling only -where it migrates old persisted agent identity into Modeling, and keep old prose -only where it is clearly historical evidence. - -## Current orientation — 2026-07-12 - -### Aetheria organ-structure evidence — 2026-07-13 - -Task `019f3fe1-9f69-74e3-97fb-a18490d72119` supplied strong positive evidence -for the Epiphany hypothesis without requiring raw worker-thought inspection. -Modeling maintained concrete migration bodies across Aetheria, EveUnity, and -CultLib; Eyes found CultCache crash consistency and SoA ownership skew; Hands -landed bounded disjoint changes; Soul rejected a registry repair that still -allowed readers to observe partial refresh; Imagination corrected a roadmap -that called unfinished migration complete; Self preserved dependency order and -kept unrelated compile skew out of coherent commits. - -Prompt forms worth preserving: - -- require the exact compile boundary and deletion line when research expands; -- give Hands hostile negative acceptance criteria, not only a desired output; -- explicitly allow a worker to stop and name a missing substrate primitive; -- review diffs against authority and concurrency invariants after tests pass. - -The primary lesson is not Modeling persistence in isolation. The organ structure -changed the quality of the engineering: discoveries altered plans, plans bounded -disjoint cuts, Soul could reject a plausible green fix, Imagination could reject -roadmap mythology, and Self preserved dependency order without flattening those -different judgments into one running narrative. This is positive evidence for -durable organ-to-organ cognition, not merely for role-flavored prompting. - -That lesson now has a concrete corrective nerve. Eyes can persist an immutable -`RepoModelClaimChallenge` against one serialized claim at one exact admitted -model revision. Runtime-spine admission replays the canonical Eyes packet, -unique current Mind receipt, model identity, and claim hash in one absent-only -CAS. Self uses the same validated challenge predicate for Imagination planning, -Hands route selection, and actionable-Hands status; only frontier targeting the -challenged claim is withheld. Eyes never writes RepoModel, and no challenge ids -were stuffed into the graph. Core proof is 304 passed/1 ignored and independent -Soul review passes. Next build a typed Modeling challenge-repair request and -Mind admission path so evidence can reshape the shared map, then let Self and -Imagination revise the campaign from that repaired substrate. - -The first repair foundation is now inert and exact. A challenge remains live -across unrelated RepoModel revisions while its target claim bytes are unchanged; -an unrelated edit can no longer launder Eyes pressure away. Self can persist one -`RepoModelClaimRepairRequest` binding the challenge and Eyes packet, original -and unique current admissions, current model and claim, runtime/thread, and -affected frontier hashes in one CAS. It deliberately has no repair patch -purpose, result echo, worker launch authority, or Mind admission effect. Core -proof is 306 passed/1 ignored and Soul passes. Next wire coordinator-owned typed -Modeling launch projection/binding and exclusive result correlation before -introducing any repair actuator. - -Do not substitute the first linear frontier identity proof for that larger -lesson. `Modeling -> Mind -> Self -> Hands -> Soul -> Modeling` proves that one -wound can retain causal identity. The awakened anatomy also needs typed backward -pressure: Eyes findings that challenge model claims, Imagination revisions that -change campaign shape, Soul rejections that create new evidence requirements, -and Self rerouting based on those admitted artifacts. Modeling is the shared -situational substrate, not the whole organism and not the product. - -Persistence is the connective-tissue gap exposed by that success. Modeling's -repo anatomy, confirmed/changed/invalidated claims, freshness, frontier, and -semantic-index consequences must live in typed searchable state; Self must route -from those artifacts; later Hands and Soul prompts must receive the relevant -frontier and evidence. Otherwise an excellent coordinator can perform the -structure transiently, but the next awakened Self inherits only the applause. - -The first safe piece of that connective tissue is now implemented. The existing -memory-graph aggregate owns a revisioned, hashed RepoModel plus typed migration -frontier; exact frontier claim IDs precede BM25 ranking; dependency prerequisites -precede dependents under budget; and the frontier's body, question, gap, status, -dependencies, and recommended organ enter dynamic role context. Canonical state -cannot be reverse-built from thread graphs, replaced by raw refresh/bootstrap, -or lost to concurrent valid patches: CultCache now provides exact-envelope CAS -and insert-if-absent beneath its cross-process sidecar lock, with hostile race -proofs. Soul rejected two earlier cuts before accepting this authority boundary. - -The first causal-identity slice of that Aetheria loop is now closed. Modeling -emits a typed `RepoModelPatch`; Mind admits the exact immutable worker result, -patch bytes, evidence, review, and replacement model under one conditional -store transaction; Self selects one eligible Active frontier item from the -admitted current model; and the resulting route freezes model revision/hash, -item hash, claims, dependency order, and path scope. Hands intent, review, -Substrate grant, frontier authority, patch, command, and commit documents are -immutable insert-once records. Soul receives a typed verification request bound -to that complete chain. A later typed Modeling request binds the accepted Soul -result and permits exactly one verdict-incorporation revision of the same item: -`pass` yields `Resolved`; `needs-review`, `needs-evidence`, or `fail` yields -`Blocked`. Self derives Hands readiness from the same selection predicate, so -Blocked/Resolved items cannot be routed and no default implementation authority -survives without an admitted actionable frontier. - -Soul found and forced cuts of four plausible green bypasses before accepting -the slice: ordinary Evolution could mutate routed frontier lifecycle; Hands -receipts and their intent/review/grant foundation were mutable by identity; the -Modeling request trusted caller-supplied temporal acceptance; and a split model -admission/thread-state commit could wedge on retry. Evolution is now barred -while a current-model route exists and cannot manufacture Blocked or terminal -frontier lifecycle. Every causal companion uses absent-only cross-process CAS -with exact retry. Final verdict admission replays the full authority and -consequence chain immediately before the model CAS. Verification acceptance is -reloaded from canonical thread state, and stable review identity makes the -split commit recoverable. Hostile substitution, stale-model, counterfeit, -concurrent-writer, crash-window retry, pass/nonpass, and nonselection tests are -green; the full core library proof is 303 passed and 1 ignored. - -This is still not the whole Aetheria lesson. It proves durable causal identity -and backward Soul pressure, not the complete multi-organ correction ecology. -Eyes challenges and Imagination campaign revisions still need typed admission -and Self routes. The older `RepoWorkModelingRequest/Route/Finding` path is also -misnamed parallel closure machinery: it models one already-executed work item, -not repository anatomy. Preserve useful plan/execute receipts, but converge -that workflow on canonical RepoFrontier route/Hands/Soul/Modeling authority and -demote `RepoWorkMapEntry` to derived closure history. Do not let item-slug routes -or the legacy special Modeling worker close work independently of RepoModel. - -Stage 1 of that convergence is now landed in the worktree and Soul-approved. -The parallel authority was cut before its replacement was enabled. Legacy -RepoWork Modeling request/route/finding/map types, worker launch, OpenAI ingress, -runtime writers, manual generation retry, Mind plan-adoption type, independent -Hands grant, CultMesh overview/readiness/public-proof writers, and closure -contract corpse are deleted. `epiphany-work` is an 82-line quarantine mouth: -every mutation/scheduling/publication command refuses before substrate access; -overview emits only an explicit `historical-only` non-authoritative projection. -Verse query cannot turn historical map rows into current gates, actions, -closure, acceptance, pending Bifrost requests, or accounting. Legitimate -Bifrost artifact-acceptance and metrics receipts still produce accounting rows -without consulting RepoWork history. The authoritative serial proof is core -294 passed/1 ignored, epiphany-work 1 passed, Verse query 13 passed, OpenAI -runtime 8 passed; independent Soul verdict is PASS. - -The temporary outage is intentional. Do not resurrect old plan/run/adopt/ -execute/close code to restore motion. The next build begins from the authority -map in `notes/repo-work-canonical-convergence.md`: inert proposal -> ordinary -Modeling frontier admission -> typed Self planning request -> Imagination plan -candidate -> Mind plan adoption -> distinct Self execution route -> canonical -Hands/Soul/verdict-incorporation chain. Plan readiness does not belong in -`RepoFrontierStatus`, and a generic phase router has not earned existence. - -The typed pre-Hands planning foundation is now implemented and Soul-approved. -`RepoFrontierWorkProposal` is immutable, content-hashed, runtime-bound, rejects -marked private state, and has an explicit inert contract. It cannot create a -frontier or route. `RepoFrontierPlanningRequest` is a distinct Self document: -it validates the canonical model and admission, chooses the deterministic first -dependency-ready Active Imagination frontier, freezes item hash/source scope, -and uses current-model CAS. `RepoFrontierPlanCandidate` binds that request and -revalidates model/admission/item/scope; safe paths must be contained by the -frozen scope and checks/stop/rollback lists must contain real text. Mind plan -adoption binds exact candidate bytes and current anatomy. `Adopt` owns one -deterministic model+frontier claim; concurrent candidates produce one winner, -while Hold/Refuse cannot squat the reserved claim prefix. Exact retries -revalidate current state. Nothing in this foundation emits an execution route, -Hands authority, or frontier lifecycle change. Full core proof is 296 passed -and 1 ignored; independent Soul verdict is PASS. - -Proposal-to-frontier admission is now explicit and Soul-approved. Direct User -intake writes one immutable, payload-hashed, nonprivate proposal bound to the -persisted runtime and thread; repository/workspace remain provenance, not -counterfeit authority. Coordinator selection is immutable, exact-time, and -race-safe. The coordinator launch transaction is the sole writer of a typed -`proposalModelingContext` projection inside the persisted Modeling launch -document; it atomically seals that document's MessagePack SHA-256 in an -immutable job/request/proposal launch binding. Prompt prose and result echoes -are correlation only. Admission reconstructs and compares the exact proposal, -selection, projection, patch base, launch hash, job, binding, runtime, and -thread chain. Ordinary Evolution cannot mutate frontier. Proposal Evolution -gets exactly one frontier operation and it must be one proposal-citing -`UpsertFrontier`; it emits no plan, route, Hands authority, or lifecycle -decision. Core proof is 302 passed/1 ignored, OpenAI runtime proof is 8 passed, -and final independent Soul verdict is PASS. Hostile proofs cover privacy -laundering, changed selection time, concurrent selection, corrupt persisted -contracts and hashes, caller-prepopulated context, stale base, swapped launch -and companions, duplicate backend binding, dual authority echoes, request -reuse, delimiter injection, and byte-identical no-write refusals. - -The next artifact-contract audit then cut `epiphany.persona_chat.v0`: its live -writer and catalog had disagreed on field vocabulary, evidence fields, and -lifecycle closure. The writer is now typed Rust with closed -draft/blocked/posted status, the schema is strict and complete, and legacy -snake_case survives only on read. Proprioception then identified and Hands -rebuilt the larger false surface. `epiphany.persona_surface.v0` is now a strict, -content-free projection of discriminated artifact and consequence-owner action -references. It reports rejected rows and source failures as attention, while -owning neither speech eligibility nor Mind/Bifrost/provider consequences. -Reddit and Other now have strict typed Rust artifacts and registered schemas; -Other ends at a crossing request and can never claim publication. Its surface -action remains absent until a typed intent contract actually exists. - -This reinforces the Aetheria lesson: Modeling found the catalog fiction, Hands -cut the producer boundaries, and Soul-shaped negative checks caught content -leakage and false consequence ownership. Persistent anatomy lets the next Hands -pass start at the wound instead of ceremonially rediscovering the body. - -The following Aetheria-shaped pass cut two Idunn split truths. Swarm overview -now consumes the same managed-child sight as the specialist Idunn view, but -exports typed rows only; Gjallar/Eve remain downstream lowerers. Enabled child -readiness requires native process executable identity matching the lifecycle -receipt, so PID reuse cannot counterfeit life. Separately, -`deployment-aftercare-audit` no longer accepts raw caller response files, and -readiness no longer launders its cached projection. Typed Idunn deployment and -aftercare receipts must resolve and bind across identity, runtime, Verse, -result/ref, runbook, source commit, and current HEAD. - -The next Modeling pass repaired the targeting organ itself. Memory-graph v1 -binds repo anatomy to the actual state-store identity, accepted revision, and -SHA-256 source bytes. Cache presence, path/symbol locators, and serialized -freshness no longer make anatomy Ready. Launch and explicit refresh share one -validator; missing/changed node, edge, or link anchors stale their summaries. -There is still no production semantic index for graph claims, so Modeling index -availability is honestly unavailable rather than inferred from code search. - -The repo-work adoption authority rebuild is now implemented. `run_adopt` -consumes an immutable typed `RepoWorkPlanAdoptionReview` bound to exact -workspace, plan/run paths and SHA-256 bytes, action, command, commit message, -changed paths, queued Hands review, and Substrate grant. It atomically creates -an immutable `RepoWorkHandsGrant` plus approved Hands review; Refuse/Hold, -counterfeit digests, swapped paths, and same-ID replacement are rejected. -`run_tick` can only report `awaiting-mind-review`. `run_execute` rereads the -whole chain and revalidates persisted Substrate authority before PowerShell. -Soul closure now reloads typed runtime truth and cross-binds it to the execute -receipt; a swapped valid adoption chain fails. Six compiled smokes that taught -the deleted caller-writable `mindAdoptionDecision` model were removed. - -Next architectural cut: finish the Aetheria lesson rather than polishing this -gate. The proposal now reaches Modeling as an exact contestable artifact, but -the larger corrective ecology is still incomplete. Add typed Eyes challenges -that can invalidate model claims and create evidence pressure without direct -RepoModel write authority; then bind the existing planning request to an -Imagination worker result and Mind adoption. A production semantic index over -typed graph claims remains required so those organs can retrieve the living -migration map instead of rediscovering it from files. Memory-graph freshness is -substrate; durable multi-organ correction is the organism. - -Epiphany is in an authority-provenance purification pass. The live question is not whether a command can produce a plausible document; it is whether the subsystem writing that document owns the fact it asserts. - -The confirmed conceptual substitutions have been cut: - -- read-only Verse diagnostics no longer seed or promote the state they inspect; -- Bifrost publication, public-proof publication, artifact acceptance, and metrics callers submit requests without manufacturing provider receipts; -- daemon tool invocation, Eve connection, and daemon poke callers submit intents without manufacturing provider acceptance or lifecycle results; -- Persona feedback no longer manufactures Imagination consensus; -- arbitrary operator-snapshot JSON cannot be promoted into canonical tool intent or receipt state; -- operator-run completion is derived from a fresh, contained result artifact rather than caller status; -- daemon service plan/execute authority is encoded by explicit command identity; -- synthetic receipt smokes are confined beneath `.epiphany-smoke`. -- generic local Verse bootstrap no longer publishes provider advertisements, - Eve surfaces, or hosted tools; provider absence survives bootstrap. -- the central `provider-advertisements` / `publish-odin` compatibility mouth is - deleted; only provider-owned bodies may publish presence to Odin. -- bulk and daemon-bounded central provider-state writers are deleted. Each - `epiphany-cluster-daemon` heartbeat publishes liveness only; it cannot turn - topology into an advertisement, Eve composition, or hosted-tool claim. -- cluster daemons do not bootstrap or query the full Verse. Missing persisted - topology is a pre-write refusal; explicit operator bootstrap owns shared - policy, topology, contracts, and brake initialization. -- daemon-supervisor production commands likewise require persisted bootstrap - and cannot create shared state. Its two audit-smoke fixture initializers are - hard-confined beneath `.epiphany-smoke`. -- query-CLI requester/operator mutations also require persisted bootstrap. - Only explicit seed commands and the fixed aggregate smoke may initialize the - shared local Verse. -- worker launch-context rendering requires the existing Verse and cannot seed - it. The prompt-context smoke accepts no destination and is fixed beneath - `.epiphany-smoke`. -- orphaned Bifrost/GitHub/Maintainer response and Imagination consensus - constructors/writers are test-only. The aggregate smoke proves requests stay - pending; production keeps readers for externally provider-authored documents. -- bulk seven-daemon readiness construction/writing is test-only. Production - loaders enumerate topology; the aggregate smoke owns a fixed-store local - fixture helper, while real liveness remains single-daemon authored. -- topology-derived provider builders survive only as test fixtures for legacy - v0 shapes. Live consumers ignore provenance-free v0 Odin/Eve/tool rows; - explicit bootstrap deletes stale rows of exactly those families. Topology - `eve_surface_id` is address metadata only, not surface availability. -- bootstrap no longer writes default operator status. The dedicated writer was - a dead `ready` template, so the writer and its now-ownerless schema/context/ - prompt/reader family are deleted. Source-derived operator snapshots remain. -- agent-state SoA sync requires bootstrap; report preserves missing filesystem - state. The wrapper explicitly composes sync then report rather than hiding a - refresh inside readback. -- query, cluster-daemon, and daemon-supervisor argument parsing no longer creates - store parents. CultCache's single-file backing store returns empty before - taking a lock when its file is absent, so all readers preserve filesystem - absence without per-loader guards. Full context projection refuses a missing - Verse; explicit bootstrap or a real writer owns CultMesh body creation. -- the generic `epiphany-eve-provider` CLI is deleted: caller-supplied provider - identity/status was not provider participation. Eve requests remain pending; - local response construction/writing is test-only until a real target daemon - or authenticated ingest boundary owns the receipt. -- daemon-tool response construction/writing is also test-only. No shipped host - daemon currently responds; the aggregate smoke proves a pending intent and a - missing host receipt rather than fabricating Hands acceptance. -- the deployment-config family smoke and its aggregate MVP-gate row are deleted: - they fabricated Idunn `deployed`/`complete` receipts. Epiphany exposes config - audit/runbook requests and typed Idunn readers, but no local deployment or - aftercare response writer. -- the artifact-acceptance/metrics response-closing smokes, Bifrost accounting - bundle, wrapper mode, and aggregate green gate are deleted. Their request - cargo remains open until genuine Bifrost/Maintainer response ingest. -- generic repo-work readiness approval is deleted. The former command accepted - four arbitrary strings as Maintainer/Soul/Mind/Bifrost reviews; readiness - remains sight-only and the request family awaits genuine reviewer evidence. -- the aggregate repo-swarm MVP gate and wrapper are deleted. It painted green - rows from prior smoke summaries and local fixtures rather than exercising one - live end-to-end organism. Use focused tests plus live-fire evidence instead. -- the fresh-repo MVP smoke is deleted. Its disposable Git operations were real, - but its PR, maintainer-review, merge, Bifrost, and Soul evidence was supplied - by the same local caller rather than those owning bodies. -- `epiphany-work publish` and `sync` are deleted. The first promoted arbitrary - receipt strings into publication authority; the second promoted arbitrary - merge strings plus Git ancestry into merge authority. Bifrost intent, - provider receipts, and read-only ancestry are separate paths. -- legacy `work-publish-*.json` and `work-sync-*.json` are no longer read by - overview, readiness, scheduling, receipt-chain, or proof-bundle paths. Dead - writer artifacts cannot remain living authority; closed work waits at - `awaiting-publication` until an owner-aligned provider projection exists. -- `epiphany-hands-action record-pr` is deleted. Caller-transcribed PR and - Bifrost fields cannot create Hands publication proof; PR construction and - persistence are test-only pending an authenticated adapter owner. -- ownerless provider-result actuators are no longer public production API. - Eve/daemon-tool acceptance, Bifrost publication/GitHub/public-proof/artifact/ - metrics results, and Imagination consensus constructors/writers are - `cfg(test)`; production retains their typed readers for real ingest. -- repo closure no longer accepts caller echoes of Modeling model ref, verdict, - finding, authorship, or summary. The scheduler no longer transcribes them. - Full closure reads the immutable runtime-spine Modeling finding directly. -- repo closure no longer accepts caller-selected verification commands or an - optional source-grounding flag. Soul uses fixed Git consequence inspection, - mandatory grounding, and fails when typed plan/family evidence is absent. -- callers cannot overwrite Soul verdict narration or choose Mind's immutable - admission revision. Soul derives the explanation; initial map admission is - revision zero and later evolution uses typed Modeling route generations. -- Hands binaries no longer construct Substrate Gate grant structs inline. - Grants are non-exhaustive externally and come from narrow fixed-policy - constructors owned by the `substrate_gate` module. -- Hands persistence resolves its grant rather than trusting an ID label. Grant - identity/scope/operations/paths and approved review must match each intent - and patch/command/commit consequence; grants are immutable. -- cluster-daemon heartbeat no longer accepts caller liveness or note fields. - A successful owning-body heartbeat derives `ready`; degraded/down require - observed supervisor or timeout evidence. -- verse-query's mega-smoke no longer writes synthetic Idunn service runbooks or - lifecycle receipts into its selected store and then verifies its own state. - Focused daemon-supervisor smokes own quarantined lifecycle fixtures. -- daemon-supervisor smoke confinement is real containment, not component-name - matching: parent traversal and stores outside workspace `.epiphany-smoke` - are refused before fixture seeding. -- Thirty-two repo-family and survival smokes no longer accept an independent - deletion root. They derive `.epiphany-smoke` only after canonicalizing the - selected repo root; `--smoke-root` is rejected before creating its target. -- Idunn lifecycle receipts no longer accept caller-transcribed executable/schema - hashes, witness identity, required types, or a preflight-pass bit. Repo work - consumes the runtime's real preflight directly; Idunn reports process facts. -- Windows service install exit zero is `install-command-succeeded`, not - `installed`. Single-service completion requires SCM status/reconcile; cluster - completion requires the observed cluster service audit and cannot cite an - earlier copy of its own execution-audit verdict. -- Service lifecycle projection selects the actual latest family event. An old - attention receipt no longer masquerades as current state after recovery; - newer failures still surface immediately. -- The lifecycle `latest` mirror is event-time-owned, not last-writer-wins. - Invalid/reversed timestamps are refused and delayed old receipts cannot move - the mirror backward. -- Scheduler `latest` is likewise completion-time-owned. Tick timestamps are - validated, reversed intervals are refused, and delayed replay cannot rewind - the scheduler projection. -- `hands-action-gate/latest` is creation-time-owned. Delayed mirror replay - cannot advertise obsolete actuator scope or record-pass commands as current. -- `role-review-event/latest` is creation-time-owned. Delayed acceptance or - supersession readbacks cannot rewind Self/operator coordination context. -- `coordinator-run-receipt/latest` is creation-time-owned. Delayed runs cannot - replace the current final action or artifact projection. -- Work-loop telemetry is now validated internal evidence and production-time - ordered. Delayed or wrong-Verse packets cannot replace Soul/Modeling's - current Hands consequence chain; future receipt lower bounds are refused. -- Repo-work map `latest` is Mind-admission-time-owned. Delayed older projections - cannot rewind the queue map, and mirroring before admission is refused. -- Repo-work overview global `latest` is generation-time-owned. Delayed overview - transport cannot make an obsolete queue gate or next move current. -- Repo-work readiness global `latest` is generation-time-owned. Delayed - sight-only reports cannot replace current proof visibility. -- The writerless `repo_work_readiness_review` document family is deleted from - schema registration, exports, loaders, receipt directory, swarm overview, - TUI, and Bifrost accounting. Real review receipts retain their owners. -- Repo-work public-proof global `latest` is generation-time-owned. Delayed - proof transport cannot replace the current commit/hash evidence projection. -- Agent-state SoA `latest` is generation-time-owned and local-area confined; - delayed summaries cannot rewind prompt/swarm self-knowledge. -- Operator snapshots are validated internal-Verse observations and `latest` is - generation-time-owned; delayed status transport cannot rewind the observed - coordinator/runtime surface. -- Operator-run receipt admission resolves its intent by `run_id`, not by the - unrelated global latest mirror. Intent/receipt mirrors are validated and - owner-time ordered; concurrent runs retain independent identity. -- Prompt assembly joins Eve and daemon-tool receipts to intents only by matching - `intent_id`; independent latest mirrors can no longer fabricate a causal - completion in model context. -- Bifrost prompt/accounting chains follow typed intent -> publication -> GitHub - receipt identity. Independent latest documents cannot close publication, - lend review/credit counts, or supply a counterfeit public reference. -- Collaboration accounting follows consensus `feedback_id`; unrelated latest - consensus cannot close another Persona feedback lane or lend public refs. -- Artifact-acceptance and metrics receipts still lack an explicit repo-work - request/map identity. Do not infer it from item/workspace/branch/commit; - accounting keeps these lanes open with `requestIdentity=missing` while still - showing provider receipt proof completeness. Repair the Bifrost-owned - contracts before claiming concurrent-safe closure. -- Repo-work queue receipts carry typed queue/selected row objects. Swarm stop - classification no longer reparses `QUEUE-RUN | key=value` TUI prose; legacy - or hostile strings cannot steer gate, blocker, item, branch, or next move. -- Receipt-directory runbook selection uses typed `service_id` only. It no - longer recovers service ownership by splitting human route prose at `::`. -- Deployment operational audit and runbook read one typed TOML model. Substring - presence, comments, wrong sections, and silent watched-ref/script defaults no - longer substitute for valid deployment configuration. -- Repo-work deployment closure uses that same typed model and semantic - predicates; the duplicate substring validator is deleted. -- Secret-policy request closure parses typed TOML and validates request, - antecedent, receipt, security-packet, and authority semantics. Comment prose - cannot counterfeit secret/write/deployment denials. -- Dependency-policy request closure parses typed TOML for supply-chain scope, - receipts, evidence requirements, and authority seals; comment prose cannot - counterfeit package/lockfile/network/CI denials. -- Deployment-request closure parses typed TOML for Idunn ownership, - antecedents, receipts, deployment packet, and authority seals; comment prose - cannot counterfeit SSH/push/deployment denials. -- Verse-query smoke reset proves the exact built-in path and canonical strict - containment beneath `.epiphany-smoke` immediately before recursive deletion. -- The four typed closure contract families live in - `epiphany_work/closure_contracts.rs`; `epiphany-work` is their orchestrator. - The module is parent-private and preserves family-specific predicates rather - than exporting generic policy machinery. -- Bifrost provider receipt contracts still lack provider timestamp/revision. - Do not invent consumer-side ordering; repair that in a Bifrost-owned schema. - -The presentation boundary is now plain: `swarm overview` is a generic compact read-only projection. Gjallar is a downstream TUI application on Nightwing and is not an Epiphany organ, provider, owner, runtime, or architectural dependency. Eve/CultUI graphs may be lowered or composited downstream without Epiphany caring which presentation client does it. - -Static cluster topology is declaration, not attendance. Bootstrap persists seven -faculty routes and desired private-Verse/daemon/Eve addresses, but missing -provider status now produces zero observed daemon rows. Topology and overview -publish explicitly declared counts separately from `observedDaemonCount`; -daemon heartbeat sight never claims an agent count. Restart-policy rows may say -`unobserved` for a desired target so Idunn can reconcile it without inventing a -body. Prompt context names these as declared routes/targets. The deleted -`unknown_daemon_status` constructor cannot put seven empty helmets on the roll. - -The Epiphany-local `bifrost-ledger` mouth is deleted. It assigned external owners -and accounting closure from response-shaped documents found in a shared local -store without authenticated provider ingress. Requester-owned publication and -public-proof intents plus Persona feedback remain. Provider response absence now -has no local closure or audit route. Do not restore a ledger projection until an -ingress receipt binds provider identity/contract, transport session, exact -payload hash/document id, correlation, target runtime/Verse, admission time, and -verification result. +No deployment, cognition release, broad Wake, or reboot is authorized while +that mismatch remains unexplained. ## Authority map -- Request owners write intents and requests. -- Provider bodies write acceptance, execution, lifecycle, and result receipts. -- Diagnostics read persisted facts; absence remains absent or unknown. -- Adapters may project edge state but cannot promote it into canonical provider truth. -- Smoke fixtures may manufacture synthetic state only inside fixed disposable roots. -- `swarm overview` owns no operational fact and performs no scheduling, publication, deployment, lifecycle, admission, or provider acceptance. - -## Rehydrate - -Read, in order: - -1. `state/map.yaml` -2. `notes/epiphany-current-algorithmic-map.md` -3. `notes/conceptual-substitution-audit-2026-07-12.md` -4. `notes/receipt-writer-provenance-audit-2026-07-12.md` -5. `notes/epiphany-fork-implementation-plan.md` - -Then run: - -```powershell -cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-state -- status -``` - -Historical implementation detail belongs in git history, smoke artifacts, and the evidence ledger. Do not restore deleted writers or requester-authored receipts from old proof prose. - -## Next real move - -Continue the modeling pass beyond receipt writers. Tool-request, -metrics-request, artifact-acceptance-request, and credit-request closure now use -typed family contracts and cannot accept comment-counterfeit execution, spend, -acceptance, or credit seals. -Inventory remaining substring closure families and production paths where a -projection, cache, adapter, scheduler, coordinator, or compatibility surface -asserts a fact owned elsewhere. For each candidate, name the owner, allowed -inputs, emitted state, forbidden writers, and negative proof before changing -code. Also audit remaining non-receipt smoke binaries for path escape or -destructive scope. - -`epiphany-repo-personality-smoke` reset is now canonically confined beneath -`.epiphany-smoke`; fixed default provenance no longer authorizes recursive -deletion. Continue the same resolved-containment audit across remaining smoke -reset helpers. - -The 32 repeated timestamped family/lifecycle smokes no longer reset occupied -leaves. They atomically claim a fresh directory with `create_dir` and fail on -collision, removing their recursive-delete authority entirely. - -Seven UUID-scoped temp helpers now use exclusive `create_dir`, not -`create_dir_all`; a pre-existing leaf is refused before work and can no longer -be adopted and later deleted. -Three coordinator launch-context test leaves were corrected as well. The full -Rust source search now contains no generated `temp_dir()` leaf adopted through -`create_dir_all`. - -Publication-request closure is now typed and guarded against regaining -substring authority. Current structural count: nine typed high-authority -families, 704 remaining closure substring assertions, and 1,458 contract-organ -lines. - -The former 1,458-line `closure_contracts.rs` slab is now a two-line private -facade over `closure_contracts/external_governance.rs` and -`closure_contracts/operations.rs`. Keep new contracts with their consequence -owner; do not reunify the slab or widen its parent-private API. - -Sync-request closure is now typed within external governance and guarded -against substring fallback. Current count: ten typed high-authority families -and 667 remaining closure substring assertions. - -External-governance counterfeit fixtures now live in the dedicated lexical -`external_governance_tests.rs`; production contract anatomy is 668 lines and -the six semantic counterfeit tests remain private and passing, including the -explicit sync push-grant attack fixture. - -Provider chronology remains externally blocked for a precise reason: Bifrost -receipt contracts expose no provider timestamp or monotonic revision, so local -`latest` mirrors only know arrival order. Do not invent chronology locally. The -33 duplicate `#[cfg(test)]` residues found around provider writers/re-exports -were removed; one test gate remains on every test-only item. - -All seven Bifrost/GitHub mirror loader APIs are now named -`load_arrival_latest_*`; no misleading `load_latest_*` aliases remain. The -persisted `/latest` key spelling is retained as external storage compatibility, -not interpreted as provider chronology. -The Bifrost ledger report also uses `arrival_latest_*` typed fields and -`arrivalLatestBifrost*` JSON keys; no old report aliases remain. -`EpiphanyCultMeshContext`, prompt assembly, and Verse consumers now also use -`arrival_latest_bifrost_*`; persisted storage strings retain `/latest`. -The Rust constant identifiers are now `*_ARRIVAL_LATEST_KEY` too; only their -external string values retain the `/latest` storage spelling. -Regression test `bifrost_mirrors_name_arrival_order_without_rewriting_storage_keys` -guards honest Rust vocabulary and the seven stable persisted keys together. - -PR-request closure is now typed within external governance and protected by the -class no-substring guard plus an explicit malicious GitHub-grant fixture. -Current count: eleven typed high-authority families and 620 remaining closure -substring assertions. - -Maintainer-review closure is now typed and class-guarded. Current count: twelve -typed high-authority families and 582 remaining substring assertions. The -explicit malicious maintainer-approval fixture now passes as a negative proof. - -Verification-request closure is now typed and class-guarded. Current count: -thirteen typed high-authority families and 543 remaining substring assertions. -The explicit malicious Soul-verdict fixture now passes as a negative proof. - -Closure-domain authority now has a physical workflow owner. -`closure_contracts/workflow.rs` owns typed verification request closure and -`workflow_tests.rs` owns its counterfeit-Soul-verdict fixture. The facade -composes workflow beside external governance and operations. Direct `rustfmt` -is required for these lexically included files because Cargo fmt does not find -them. Next, type and move one adoption/scheduling/work-order family into -workflow rather than feeding the external drawer. External governance should -converge on tooling plus publication/accounting; operations retains -policy/deployment. - -Work-order closure is now typed inside that workflow owner. The old substring -path could accept a commented Hands denial beside a real authority grant; the -malicious fixture and generic class guard now make that impossible. Fourteen -high-authority families are typed and 507 substring assertions remain. Next -inspect adoption versus scheduling and convert the authority-bearing family -with its own negative proof. - -Scheduling won that comparison because it directly names Self's queue gate, -pulse, next family, and queue-selection receipt. Its closure is now typed under -workflow ownership; a malicious commented queue denial cannot conceal a real -mutation grant, and the family is in the no-substring class guard. Fifteen -high-authority families are typed and 477 substring assertions remain. Next -type adoption, the remaining untyped workflow gate in this chain. - -Adoption closure is now typed under workflow ownership as well. The decision -contract, review/state receipts, input requirements, authority denials, and -private seal are read as actual TOML fields; blank input references are -rejected. A malicious commented state-commit denial cannot hide a real grant, -and adoption is in the class guard. Sixteen high-authority families are typed -and 447 substring assertions remain. The complete adoption/scheduling/work- -order/verification chain now has one physical workflow owner. - -The old residual counter was diff-derived and has been retired. Direct source -inventory now reports 426 `content.contains` occurrences across sixteen -remaining closure families. Objective Draft has moved into a new physical -`preparation.rs` owner because it is Imagination cargo, not workflow or -external governance. Its typed closure and malicious fixture prevent a -commented adoption denial from hiding a real grant. Seventeen high-authority -families are typed. Continue from the source-derived family inventory, not the -historical counter. - -The readiness-review hydra is cut. Self owns routing; Maintainer, Soul, Mind, -and Bifrost are independent required reviewers; `readiness_approval_owner` is -explicitly `none` because no local aggregate writer exists. Typed external- -governance closure and a counterfeit-approval fixture protect that boundary. -Eighteen high-authority families are typed; direct source inventory reports 363 -substring occurrences across fifteen remaining families. - -Interpreter Brief no longer steals Mind's name. Deterministic Imagination -lowering now emits an Imagination-authored request for Mind interpretation with -`interpretation_admitted=false`; it does not claim Mind authored or owns an -interpretation that Mind never produced. Preparation owns its typed closure and -counterfeit-state-authority fixture. Nineteen high-authority families are typed; -direct source inventory reports 303 substring occurrences across fourteen -remaining families. - -Planning Brief is mapped for deletion, not typing. It contains no candidate -work-item records; copied global schema/catalog/closure doctrine is read back as -`safeFamilyPlanning`, letting catalog completeness impersonate item planning. -Remove the family, generator, closure/readback, dedicated smoke, and readiness -dependency together. Preserve consensus -> interpretation request -> objective -draft -> Mind adoption. Do not replace it with another per-item catalog dump. - -That deletion is complete. The generator, closure/readback, readiness row, -Verse classification, CLI advertisement, and 679-line dedicated smoke are -gone; 1,393 source lines were removed without an adapter. No production source -references remain. Direct inventory now reports 183 substring occurrences -across twelve families. - -Collaboration policy/topic no longer pretend deterministic repo files are live -Persona/Eve contracts. Imagination authors proposals; Persona owns discussion; -Persona/Mind review policy; Mind admits it; Bifrost publishes. Requested public -room and Eve surface ids remain unpublished until provider receipts exist, and -downstream rendering is explicitly irrelevant. A new typed collaboration -closure domain protects both families. Twenty-two high-authority families are -typed; direct inventory reports 124 substring occurrences across ten families. - -The fake provider catalogs are deleted. `repo.tool_capabilities` advertised -expected tools without a host receipt; `repo.eve_surface` invented a live -surface/rows/lowering catalog without provider publication. Dispatch, -generators, closure, Verse classification, CLI help, and both dedicated smokes -are gone—1,188 source lines, no adapters. Real tool requests/host receipts, -Odin discovery, Eve connection receipts, and provider-owned composition remain. -Direct inventory is 71 occurrences across eight families. - -`repo.body_manifest` is deleted as a daemon diorama: it invented Body/Verse/Eve -identity and capabilities in an unconsumed `epiphany.toml`. Runtime state, -provider advertisements, and repo birth receipts remain authoritative. A fresh -patch-placement error that put collaboration `[policy]` fields in the manifest -generator was repaired; a direct generator unit test proves the fields now -belong to collaboration policy and the deleted manifest family is rejected. -The recursive legacy smoke timed out and spawned nested Cargo trees, so it was -not treated as proof. Direct inventory is 56 occurrences across seven families. - -Doctrine review no longer has a `Maintainer/Mind` composite owner or OR gate. -Imagination authors, Self routes, Maintainer reviews, Soul verifies, Mind admits -doctrine state, and Hands mutates `AGENTS.md` under receipts. Typed operations -closure and a counterfeit-Hands fixture protect the chain. The remaining -source inventory is 17 occurrences across six presentation families. - -The six presentation families are now explicitly `presentationOnly=true` and -share no formatting assertions. Common commit/path/blob evidence remains the -closure proof; summaries, headings, markers, and checkboxes no longer -impersonate Soul authority. A whole-function regression test proves zero -`content.contains` calls remain in closure. - -The beyond-closure scan has started. Deployment request no longer has an -`Idunn/Maintainer` composite owner: Self routes, Maintainer/Soul/Mind/Bifrost -review independently, and Idunn alone executes and authors deployment/aftercare -outcomes. A generic patch briefly struck secret-policy fields; compilation -caught it before tests, the fields were restored, and exact deployment tests -plus the full baseline pass. - -PR request no longer has a `Bifrost/GitHub` composite owner. Self routes, -Bifrost owns the publication gate, Hands performs bounded PR action, and GitHub -only supplies provider outcomes. The GitHub receipt ledger row is now -GitHub-owned. Nine external-governance fixtures, 259 library tests, and all -binaries pass. - -Consensus Brief keeps its honest draft/unconverged semantics but no longer -proves them with substring presence. Preparation owns its typed consensus, -Imagination route, inputs, authority, and privacy closure; a malicious comment -cannot counterfeit adoption denial. Twenty high-authority families are typed; -direct source inventory reports 278 substring occurrences across thirteen -remaining families. - -The latest structural count is 32 closure family branches, 744 remaining -substring assertions in the closure region, and 1,284 lines in -`closure_contracts.rs`. Do not blindly generate a struct forest for every -presentation-only family. The eight converted high-authority families are -covered by `typed_closure_families_have_no_substring_authority`; prioritize the -next consequence-bearing request and require a named owner. - -## Verification baseline - -Artifact acceptance is split: Self routes, Maintainer decides acceptance, -Bifrost records accounting, and the typed request requires the acceptance -receipt. Operator receipt and accounting rows report those separate owners. -Nine external-governance fixtures, 259 library tests, and all binaries pass. - -Metrics/accounting no longer has a `Bifrost/Maintainer` composite or OR gate. -Self routes, Bifrost accounts, Maintainer owns review-load evidence, and spend/ -review-load receipts are required observations without authorizing spend or -ledger mutation. Contract catalogue and operator rows use the same ownership. - -The last completed code pass had 259 library tests passing and all binaries compiling. Re-run focused checks for the next touched surface; use the full library/binary baseline before committing a new architectural cut. - -Secret and dependency policy requests no longer use a -`Maintainer/Soul/Bifrost` pseudo-owner or Maintainer-or-Soul seal. Self routes, -Mind admits policy, and Maintainer review, Soul verification, Mind admission, -and Bifrost publication review are separately required. Dependency policy also -requires supply-chain audit evidence. The next conceptual-substitution targets -are the surviving composite decision fields in external governance and the -composite owner labels in operator projections. - -Artifact acceptance, PR publication, and readiness seals are now aligned with -their split request bodies. Maintainer acceptance cannot substitute for Bifrost -accounting; Maintainer review cannot substitute for Bifrost publication, Hands -execution, or GitHub provider evidence; and readiness approval is Maintainer- -owned instead of ownerless. The unresolved external-governance field is -upstream sync's `operator_or_maintainer_authority_required`; trace its actual -effect owner before deciding whether it is alternate human authority or another -collapsed obligation. - -That trace is complete: `repo.sync_request` performs no sync effect. It asks -Bifrost for an upstream ancestry proof after publication and separately -requires Maintainer review evidence. The fictional operator-or-maintainer gate -is removed; the request still denies merge, push, sync, and Hands authority. -Next inspect composite owner labels in operator projections, starting with rows -that may be interpreted as decision or execution ownership. - -Receipt-directory projection cleanup has started. Eve connection rows now name -the target provider cluster rather than `Odin/Eve`; work-loop telemetry names -Self rather than its Hands/Soul/Modeling stage route. The next projection scar -is `repo_work_stage_for_family`: it groups distinct collaboration and governance -families under composite owners. Split those stage groups by actual family -authority; do not merely rename the composites. - -The stage groups are now split per safe family, with regression coverage for -tool host, Imagination draft, Mind admission, Maintainer decision, Hands -execution, Bifrost proof/accounting/publication, Soul verification, Self -scheduling, and Idunn deployment ownership. Dependency policy and readiness -are explicitly classified instead of falling through to Unknown. Next trace -the remaining composite owner labels in repo-work readiness rows around the -Idunn/Soul, Soul/Bifrost, and four-reviewer projections. - -Those readiness rows are split: Idunn owns aftercare evidence, Soul verifies; -Soul owns redaction and readiness sight; Maintainer owns readiness approval; -Bifrost owns publication review; the four required reviewers are an explicit -list. Next cut arrow-shaped handoffs such as `Persona->Imagination` out of owner -fields and preserve them only as routes. - -Arrow-shaped owner values are now gone. Self owns intake-consensus readback and -publishes the Persona-to-Imagination handoff separately; feedback ledger rows -use their source Persona id; Bifrost owns consensus accounting. Continue the -conceptual-substitution scan beyond owner strings: look for status, route, -receipt, or cache fields that borrow consequence authority from another organ. - -The first non-owner substitution is cut in `repo.tool_request`. The old -`requesting_agent="repo Persona/Self"` and `requester_owns_request=false` shape -is replaced by requester body identity, Self routing, Persona pressure -provenance, target-host execution ownership, and requester execution denial. -The typed closure now validates the identity and authority split. Continue -looking for fields where observation, request, admission, and effect ownership -are collapsed under innocent-sounding status or cache names. - -Maintainer review is no longer substitutable by generic human response. Both -the Maintainer review request and doctrine update request now require explicit -Maintainer review, matching their receipt contracts and reviewer topology. -Continue auditing remaining OR-shaped fields, but distinguish legitimate input -alternatives (for example token count or cost summary) from authority gates. - -Two further OR substitutions are cut. Consensus drafts require additional -public feedback rather than "human or Persona review"; Mind/Bifrost remain the -gates. Deployment requests require both script hash and script-review ref, -because identity and approval are distinct proofs. Continue classifying the -remaining OR-shaped fields by what invariant each alternative actually proves. - -Deployment git identity is also split. Requests now require both watched ref -and source commit SHA, matching Idunn's receipt. A branch/ref identifies the -mutable trigger path; the commit SHA identifies deployed bytes. Do not collapse -them back into one convenient string. - -Metrics packet completeness is now explicit: token summary, cost availability -status, review duration, and review-event count are separate requirements. -This permits honest unavailable pricing without treating cost and tokens—or -duration and event count—as interchangeable. Next inspect projected accounting -status to ensure receipt presence cannot close a row whose required dimensions -are absent. - -That projection check is implemented. Bifrost metrics receipts now expose the -four typed dimensions; old receipts deserialize with absent optional fields but -remain incomplete. A negative projection test proves a receipt with IDs and -summary but no token evidence cannot report complete proof. Continue with -scheduler/cache projections that derive consequential status from presence. - -The first scheduler substitution is cut. `heartbeat_status_projection` no -longer translates a readable state document into `status=ready`. It reports -store state as `missing` or `loaded` and derives separate scheduler physiology -as `unconfigured`, `active`, or `attention` from participants and pending-turn -state. The focused library suite, all-bin check, and native heartbeat smoke pass. -Continue through cache/freshness projections; do not let existence, successful -decode, or a latest mirror impersonate current consequence authority. - -Operator cache readback is also purified. `epiphany-operator-run latest` joins -the latest intent to its exact receipt by `run_id`; a new intent cannot borrow -an older latest completion. Its statuses are lifecycle facts (`missing`, -`requested`, `completed`, `attention`, `orphaned-receipt`), never generic -`ready`. `epiphany-operator-snapshot latest` reports present state as `loaded`. -Negative unit coverage proves intent presence is only requested and mismatched -receipt identity cannot close it. Both native smokes, 259 library tests, focused -binary tests, and the all-bin check pass. - -Rider bridge topology no longer claims readiness from path existence. Rider is -`discovered`, solutions are `found`, and repository topology is `gitDetected`; -the native bridge smoke passes with the renamed evidence states. - -Unity bridge uses the same boundary: project version parsing is `pinned`, exact -editor path discovery is `resolved`, and the editor package predicate is named -`present`. Operability belongs to the subsequent `runStatus` receipt. The -native Unity bridge smoke, 259 library tests, and all-bin check pass. - -The generic Persona Other mouth no longer models accepted Bifrost requests as -posts. Recent speech tracks `crossing_recorded` and -`same_target_crossing_count`; actual publication still requires an external -transport receipt. The old v0 `sameTargetPostCount` spelling is serialization- -only compatibility. Native Other-mouth smoke, 259 library tests, and all-bin -compilation pass. - -Persona Aquarium bubbles no longer accept caller-authored readiness. The CLI -has no `--status`; successful writes derive `projected`; the strict intent -schema has no status field; and the output schema permits only `projected`. -Native smoke returns that value and an explicit `--status ready` invocation is -rejected. The 259 library tests and all-bin check pass. - -Three live Epiphany-shaped read-only organs (Eyes, Proprioception, Soul) were -used as prompt-quality probes. They converged on caller status impersonating -character physiology. `epiphany-character-loop` no longer accepts `--status`, -constructs no fake heartbeat participant, derives stimulus `received`, and -reports activation `unknown` without scheduler evidence. Its packet now matches -the registered `schemaVersion`. Proprioception also found and removed the stale -repo-intake consensus status argument and demoted aggregate Persona status from -`ready` to `loaded`. Persona prompts now explicitly separate candidate, bubble, -eligibility, Mind admission, and Bifrost/provider delivery ownership. Native -negative/smoke checks, 259 library tests, 32 work tests, and all-bin compilation -pass. Operator correction: Modeling's mandatory typed patch is intentional -because the live searchable body map is its product; confirmation passes must -bank freshness and source-grounded map confidence. Improve the patch vocabulary, -do not add a no-state-change escape. Continue the P0 Discord/Reddit arbitrary- -JSON publication receipt cut found by Eyes and Soul. - -That P0 cut is complete. Epiphany now validates Bifrost's real Discord/Reddit -publication output: exact action/outcome, target, provider id or URL, canonical -crossing receipt id, and returned provenance bound to the speech audit and -authority inputs. Discord fallback IDs are deleted. Native hostile smokes prove -exit-zero `{}` cannot publish. Posted artifacts count as history only when their -embedded receipt binds back to the artifact target and audit; forged -`status=posted` files do not count. The remaining Bifrost seam is command -cardinality: Epiphany inherits a CultMesh command id, so the coordinator must -ensure one typed command id per crossing rather than letting multiple posts share -one canonical `crossing_` receipt. - -## Repo frontier planning launch artery (2026-07-15) - -Self's planning request is now v1 and binds the exact current RepoModel, -admission receipt, actionable Imagination frontier, runtime identity, and -authoritative thread. Coordinator launch commit replays that entire chain from -one transaction snapshot, forbids caller-authored planning projection and -mixed Modeling/repair/planning authority, injects the typed Imagination context, -and atomically persists a request-keyed -`RepoFrontierPlanningLaunchBinding`. Its SHA-256 covers the exact launch bytes -stored for the worker. Hostile tests cover swapped model/admission/frontier/ -scope/organ/runtime/thread fields, wrong role/binding, prepopulated projection, -dual authority, single-use replay, and two concurrent launches; only one wins -and the loser leaves no job, worker launch, or opened event. Full core proof: -322 passed, 1 ignored. Next build the exclusive immutable Imagination result -echo carrying the typed candidate, then Mind-only Adopt/Refuse/Hold admission -and the narrow Adopt model transition that makes Hands routing true. - -The immutable Imagination result slice is now complete. Runtime role result v2 -adds an exclusive `frontier_planning_request_id` plus dedicated canonical -MessagePack `RepoFrontierPlanCandidate`. Persistence replays the exact planning -request, request-keyed launch binding, stored launch-document hash/projection, -runtime/thread, current model/admission/frontier, deterministic candidate -identity, and bounded safe paths. Planning results reject generic state, Self, -RepoModel, Verification, and Modeling authority cargo before writing. The -OpenAI ingress uses a specialized planning schema, supplies candidate -schema/contract itself, derives candidate identity from semantic cargo, and -does not expose generic patch mouths. The candidate remains embedded in the -immutable result; no standalone candidate document is written. Proof: core -325 passed/1 ignored; OpenAI runtime 9 passed; hostile missing/swapped request, -missing/adjacent/escaped candidate, wrong role, generic patch smuggling, exact -retry, and immutable collision checks pass. Next implement Mind-only terminal -decision plus the dedicated Adopt RepoModel transition from Imagination to -Hands, then delete the old internal candidate/adoption fixture writers. - -## Prompted frontier admission review and canonical adoption (2026-07-15) - -The repo-frontier planning nerve is complete and the preceding “Next implement -Mind” sentence is superseded. Self binds one exact admitted model/frontier -request; coordinator atomically binds the Imagination launch; Imagination -persists one immutable result with its sole embedded candidate; the runtime -derives a CAS-bound Mind review request; coordinator atomically launches a -bounded non-embodied admission-review procedure; that procedure returns one -immutable typed Adopt/Refuse/Hold judgment; and Mind's admission transaction -replays the entire chain before consequence. - -Refuse and Hold are inert terminal receipts. Adopt atomically installs the exact -candidate and provenance on the canonical frontier, emits specialized review -and admission receipts, and alone changes Imagination to Hands. Self derives the -route from that model. Hands intent binds route, candidate hash, plan action, -and safe paths; Soul admission requires the exact plan command and receives the -checks, stop conditions, rollback steps, and commit message. Modeling may close -the frontier after Soul verdict only while preserving adopted execution anatomy. -There is no standalone candidate/adoption truth and no caller-authored decision. - -Mind remains persistent state and admission authority, not an embodied chatty -lane. The prompted model call is explicitly a bounded admission-review -procedure serving Mind, with no heartbeat, lane memory, `roleAccept`, -`selfPatch`, or foreign organ patch mouths. - -Hostile coverage includes swapped causal ids/hashes/jobs, failed worker output, -foreign cargo, duplicate/racing launch and terminal claims, generic adoption -bypass, post-adoption execution-anatomy mutation, and same-path command -substitution. The composed happy path proves Adopt through exact Hands command, -Verification/Soul, accepted Modeling incorporation, Resolved closure, and -byte-identical plan survival. Final proof: core 330 passed with one intentional -cross-process helper ignored; OpenAI runtime library 10 passed, both runtime -binary suites passed 6 each, and all core binaries check. Soul's final landing -audit passed. Exact concurrent admission retries are forced through a two-party -pre-CAS barrier in test builds; the loser reloads and authenticates the winner's -entire immutable decision/admission chain. The synchronization hook is compiled -only for tests, so production exposes no executable seam at the commit boundary. -The next organ is the production semantic index over typed graph claims so -Modeling owns a live persistent searchable Body map instead of making Hands -rediscover the repository. - -The selected semantic substrate is Qdrant: available locally in Docker and -intended on the new Yggdrasil host (64 GB RAM, GTX 1080 for embedding/model -workers). It is a rebuildable projection, never canonical Mind or Modeling -truth. CultCache/CultMesh remains authoritative. Use separate typed Mind and -Modeling namespaces/collections or equivalently hard query partitions so -private doctrine/memory cannot leak into Hands Body retrieval and repository -claims cannot silently become doctrine. Every point must retain source document -id, schema version, canonical hash, provenance, authority/visibility scope, and -embedding-model version. - -## Shared Mind/Modeling semantic nerve (2026-07-15) - -The Qdrant organ is now live rather than planned. `semantic_backend.rs` is the -single typed Qdrant/Ollama wire boundary; workspace retrieval consumes it and -the previous local transport copy is gone. The memory graph derives stable -Mind/Modeling projection documents, stores locator/hash/provenance payloads in -physically separate collections, validates collection metadata from Qdrant, -synchronizes only exact swarm/partition scope, reloads every candidate from -current canonical state, and falls back to typed BM25 without losing truth. -Projection receipts are typed CultCache documents outside RepoModel. - -`epiphany-memory-semantic` provides canonical index/context commands. -`epiphany-repo-model-bootstrap` atomically admits the initial RepoModel from -typed thread-state through runtime-spine ownership and ignores stale sibling -graph stores. The tracked schema-v0 `state/memory-graph.msgpack` is deleted. - -Live local proof against Docker Qdrant v1.17.1 and Ollama -`qwen3-embedding:0.6b` (1024 dimensions) indexed 43 Mind documents into -`epiphany_mind_v1` and 3 fresh Modeling documents into -`epiphany_modeling_v1`. Four stale Modeling points were removed. Semantic -queries render canonical typed packets, ignore payload prose, exclude stale -summary descendants, and report whether semantic ranking or BM25 fallback ran. - -Persona's private cache substitution is cut: its chunk schema, duplicated -Qdrant/Ollama clients, reindex-on-recall path, direct payload rendering, and -`epiphany_persona_memory_v0` collection are deleted. Heartbeat Persona recall -uses the shared Mind projection restricted to Persona's canonical domain. The -actual Modeling organ-state was also repaired: four surviving Proprioception -phrases in identity/goal/memory prose are now Modeling, validation is clean, -and the Mind collection was rebuilt from that repaired state. - -Next: schedule projection refresh as completion-gated physiology, publish typed -projection health through CultMesh/Eve, and refresh the stale source anchors -that leave the current Body map honestly thin. Do not let the scheduler, -Qdrant, Yggdrasil, or presentation become state authority. - -## Semantic completion-law correction (2026-07-15) - -The first scheduling map exposed two surviving substitutions before daemon -work began. Persona recall derived a swarm namespace from fixed organ agent -ids, which are identical across Epiphany swarms; and Qdrant failure still used -the unconstrained canonical planner. Both are cut. `state/agents.msgpack` now -contains the immutable typed swarm identity `gamecult.epiphany.main`; Persona -recall and the semantic CLI require that exact document, and the Mind -collection was rebuilt under that scope with 43 documents. Canonical fallback -uses the same partition-constrained planner as semantic success. - -`memory_graph::semantic_index` now defines typed projection obligation and -attempt documents, exact source-head and receipt causality fields, and pure -derived `pending|failed|stale|ready` health/query-eligibility law with hostile -mismatch tests. These types are foundation, not a readiness claim: runtime -admission does not yet atomically emit obligations, indexing does not yet claim -and discharge them, queries do not yet require the newest exact success, and -CultMesh/Idunn wiring deliberately remains absent. The next cut is canonical -admission ownership, not a polling loop. - -## Atomic semantic admission (2026-07-15) - -The causal cut is now implemented. Runtime-spine is immutably bound to the -canonical agent-Mind swarm identity. All three RepoModel writers atomically -companion canonical admission with one exact Modeling projection obligation; -the live legacy runtime was explicitly migrated without rewriting its model or -migration receipt. Mind self-patch and lifecycle admission now use a fixed-role -generation CAS that writes canonical rows, generation witness, persisted Mind -admission receipt, and Mind obligation together. Every extension re-hashes the -canonical rows and authenticates the prior witness. Bootstrap/import/repair/raw -replacement/trait seeding cannot write after a generation exists. - -Core proof for the landed atomic admission pass: 343 tests passed, 0 failed, 1 -intentional ignore; all binaries compile; the OpenAI runtime suites pass 22 -tests. The current `state/agents.msgpack` has now been admitted without row -mutation as generation 1 under swarm `gamecult.epiphany.main`, with immutable -witness `mind-generation-eb394e34-1c73-5d0a-8691-6ff1ba6145a4`, its Mind -admission receipt, and its exact projection obligation. Repeating the migration -is idempotent and validation remains clean. Next replace the direct projector -CLI with restart-safe scope claims, attempt/terminal receipt CAS, observed -zero-document synchronization, and exact query eligibility; then add -CultMesh/Idunn physiology. - -## Restart-safe semantic projector and gated query (2026-07-15) - -The projection executor now serializes each `(swarm, partition)` mutation scope -with a durable executor-bound claim and fencing epoch. An internal recovery -transition proves that an abandoned attempt can be failed and fenced, but it is -not exposed until Idunn supplies typed stale/recovery authority; arbitrary peers -cannot steal a live scope. Terminal success requires the same live claim, exact -bound receipt, unchanged canonical source envelopes, and observed Qdrant scope. -The raw indexer and ordinary receipt writer are no longer public authority -surfaces. Empty projections bypass Ollama and delete only their exact scope. -Non-empty projections observe exact IDs and typed payload identities after -synchronization. - -Query gating is live in the CLI and Persona heartbeat. Without the newest exact -obligation/success pair they use canonical BM25 without contacting Ollama or -Qdrant. With the pair they use Qdrant only for ranking, reload canonical typed -documents, and ignore payload prose. The live `gamecult.epiphany.main` Mind and -Modeling obligations were discharged through the protocol: 43 Mind documents -and 3 Modeling documents, both 1024-dimensional. Repeated execution returned -the same immutable receipts. Core proof: 349 passed, 0 failed, 1 intentional -ignore; all binaries type-check. - -Next: derive and publish provider-owned health through CultMesh, make Idunn own -projector process survival/restart and explicit fenced recovery routing, then -run the deployability audit against daemon packaging, configuration, and live -Yggdrasil assumptions. Neither CultMesh nor Idunn may mint readiness. - -## Physical semantic fence correction (2026-07-15) - -Hostile recovery review found that the logical claim epoch fenced CultCache -terminal receipts but did not fence the Qdrant actuator. A resumed old process -could still mutate the shared `(swarm, partition)` points after replacement. -The physical projection is now isolated by exact obligation, claim id, and -claim epoch in its UUIDs, typed payload, mutation/observation filters, success -receipt v1, and opaque-readiness-selected query filter. Old receipt v0 decodes -only for migration inspection and cannot become ready. A second process cannot -share a running claim merely by reusing its executor label. - -The readiness loader now authenticates the full persisted success chain: -obligation, succeeded scope claim, exact claim id/epoch on the receipt, and the -claim's succeeded attempt. Hostile substituted claim, epoch, and attempt -evidence fails closed. The live Mind and Modeling projections were rebuilt into -claim-owned namespaces (43 and 3 documents at 1024 dimensions), and exact live -queries used Qdrant ranking while resolving canonical documents. Core proof is -353 passed, 0 failed, 1 intentional ignore. - -Deployment Eyes found the live boundary: local Qdrant and Ollama work, but no -Epiphany/Idunn projector service is installed. New Yggdrasil has healthy GPU -Ollama, Odin, and Idunn, but no Qdrant, Epiphany artifact/config, or projector -target. Local Qdrant is unexpectedly published on all host interfaces. Do not -deploy dual projectors or silently move canonical Mind/Modeling stores. - -Next: cut Idunn supervisor writes to provider-owned daemon heartbeat/status; -then publish derived semantic health through CultMesh and add typed Idunn -executor/recovery authority plus open-obligation discovery. Recovery remains -withheld until that authority exists. - -## Idunn/provider-status ownership cut (2026-07-15) - -The supervisor no longer writes provider heartbeat/status. Idunn owns only -staleness observation, immutable poke intent/receipt events, restart command -execution, policy, and backoff. The target `epiphany-cluster-daemon` remains the -sole production owner of its status, operator action, and heartbeat timestamp. -Command exit zero now records `awaiting-provider-heartbeat`, never `ready`, and -restart pressure remains until a provider heartbeat newer than the completed -attempt proves recovery. - -Poke intent/receipt v1 binds the pre-intervention heartbeat and request, -attempt, and completion times. Immutable identity and chronological `latest` -advance in one CAS: exact retry is idempotent, collision is refused, and late -replay cannot rewind sight. Receipt-directory resolution is derived only; it -cannot repair provider truth. The bounded survival rehearsal proves two -successful restart commands leave the provider envelope unchanged and produce -distinct awaiting receipts, then a real provider heartbeat resolves the -lifecycle observation and clears restart pressure. - -Renderer-neutral semantic projection health now leaves the provider through -CultMesh as non-authoritative local-area sight. Publication reauthenticates the -sealed Mind or Modeling input, persisted obligation, canonical authority -envelopes, and—when ready—the complete succeeded claim/attempt/receipt chain. -The mirror carries only pending/failed/ready, canonical fingerprints, -bounded counts, provider/incarnation identity, and timestamps; it carries no -error text, path, command, payload prose, or readiness capability. Immutable -events plus a per-swarm/partition chronological CAS prevent a delayed writer -from rewinding latest sight. `epiphany-memory-semantic health` repairs the -mirror independently, and `epiphany-verse-query semantic-health` reads a named, -compact report without touching canonical state. A stale sealed input is -refused rather than published as if it described the current canonical head. - -## Idunn semantic executor authority cut (2026-07-15) - -Executor labels no longer open semantic mutation authority. Idunn acquisition -now atomically writes a consumed typed executor grant, a scope claim, and its -running attempt against the exact persisted obligation and predecessor claim. -The grant binds executor incarnation, purpose, Idunn incarnation, predecessor -status/id/epoch, and resulting claim id/epoch. `execute` cannot repair a -succeeded claim; `repair` requires that exact succeeded predecessor. The -projector CLI now requires the acquired claim id and authenticates its consumed -grant before Qdrant work or terminalization. Acquisition reauthenticates the -whole sealed canonical input and carries its authority envelopes through the -same CAS, so an old persisted obligation cannot mint against an advanced head. - -Fenced recovery now consumes typed evidence rather than free-form reason text. -The CultMesh bridge authenticates the exact immutable Idunn poke intent and -successful `awaiting-provider-heartbeat` receipt, plus a provider-authored ready -heartbeat event that causally follows receipt completion and names the -replacement provider incarnation. The heartbeat must also name that exact -restart receipt as its startup cause. Their envelope digests enter a consumed -recovery authorization. One CAS fails the abandoned attempt, advances the -epoch, creates the replacement claim/attempt, and records that authorization. -Recovery rotates authority only; it cannot execute projection or mint success. -Provider heartbeat events are immutable and their latest pointer advances -monotonically per daemon/incarnation. - -Authority map: canonical Mind/Modeling admission owns obligations; Idunn owns -executor assignment and explicit recovery decision; the projector owns claim- -bound mutation and terminal evidence; the query gate alone authenticates -readiness. Health, liveness, timers, command exits, Qdrant state, CultMesh, -Eve, and swarm overview remain derived sight and forbidden writers. Initial -execution, retry, repair, and recovered execution share the same claim- -authenticating projector primitive. - -## Workstation semantic projector service body (2026-07-15) - -The open-obligation pulse and single process owner are now implemented as one -workstation-local `epiphany-memory-semantic-projector` body managed by Idunn. -Its constructor requires two distinct canonical files--one Mind store and one -Modeling runtime store--and refuses unless their sealed inputs name the exact -partitions and the same immutable swarm. It takes a host OS singleton for that -canonical pair before minting its process-stable provider/executor incarnation. -Mind and Modeling remain separate authorities, claims, collections, and -receipts; they merely share one survival body. - -Every pulse reloads both canonical inputs. It stores no open-obligation queue -and allows at most one global action, rotating fairly between actionable -partitions. Ready, foreign-running, and stale inputs never execute. A succeeded -claim is not itself terminal evidence: valid receipt-v2 health derives Ready, -while an exact authority-authenticated succeeded claim whose receipt is legacy -or invalid derives Repair and acquires the typed Idunn repair path. Pending and -failed inputs acquire exact Idunn execute authority before using the one -crate-private executor. A running claim owned by the current provider -incarnation resumes directly without minting a second grant; a foreign running -claim remains pressure until exact recovery. Overlapping pulses return busy, -and the serve cooldown begins only after the bounded pulse completes. A fault -loading one source does not turn the other source into false readiness or hide -its valid action. - -The old production mouths are gone: `epiphany-memory-semantic` no longer has an -`index` arm or claim flag, there is no public raw execute function, and the -supervisor no longer exposes general semantic acquisition. Recovery remains a -narrow supervisor action. It authenticates the abandoned claim, exact Idunn -lifecycle intent/receipt, and causally linked replacement-provider heartbeat, -then rotates claim authority only. The running service recognizes that exact -recovered claim as its own and resumes it on a later ordinary pulse. - -Idunn owns a specialized reserved service-policy writer for fixed service id -`epiphany-memory-semantic-projector-service`. It derives the packaged sibling -binary, fixed executor identity, both canonical stores, infinite serve shape, -and restart-always policy. The generic managed-service writer refuses that -reserved id; callers cannot substitute a command, service id, restart mode, or -finite child lifetime. Existing Idunn managed-service reconciliation owns -process survival and lifecycle receipts. The OS singleton prevents a service -and an interactive process from simultaneously owning the same canonical pair. - -Provider heartbeat and per-partition semantic health remain derived sight. -Heartbeat `ready` means the body owns its singleton, validated the source pair, -and completed a healthy pulse/publication pass; it is not semantic query -readiness. Only the canonical success chain admits query. Pulse JSON, health, -heartbeat, Qdrant, Ollama, Eve, and swarm overview cannot create obligations, -grants, recovery, terminal evidence, or readiness. - -Deployment is deliberately not live. The chosen topology is the workstation -beside its canonical stores, with Yggdrasil permitted to supply embedding over -WireGuard. Current local inspection found Docker container `voidbot-qdrant` -stopped with exit code 143. Its name records foreign ownership, so Epiphany did -not restart, adopt, reconfigure, or claim it. No semantic projector service -policy has been published and no restart proof has been claimed. Moving only -the projector to Yggdrasil or starting a second partition/projector body remains -forbidden. - -Next: establish explicit Qdrant ownership and a live workstation-reachable -endpoint, confirm collection compatibility and the Yggdrasil Ollama route, -then publish the reserved projector policy. Run one bounded live pulse, prove -both derived health rows and provider heartbeat, kill the body once, and prove -Idunn restart plus causally linked heartbeat/recovery/resumption. This is a -preflight and survival proof, not permission to call deployment complete. - -## Managed semantic launch authority rebuild (2026-07-15) - -Deployment inspection found incompatible lifecycle stories. The packaged -managed-service launcher spawned an infinite child and wrote a mutable v0 -event, while semantic recovery expected a completed daemon-poke receipt from a -blocking restart command. That command could never truthfully witness this -service. - -The authority is now one causal chain. The reserved managed policy is desired -state. Idunn preallocates a UUID, injects it into the child, spawns once, and -atomically writes an immutable v1 lifecycle receipt binding child PID, spawn -completion, exact policy id and envelope digest, fixed projector daemon, and -startup correlation. Failed persistence kills and waits for the child. The -child authenticates that receipt against the current policy before constructing -the service body or publishing a pulse or heartbeat. A launch receipt proves -spawn completion, never readiness. - -Semantic recovery authorization is v2 and consumes only the current policy, -its exact launch receipt, and a strictly later correlated provider heartbeat. -Advancing policy invalidates an older launch receipt. Daemon poke remains an -operator intervention surface for ordinary daemons but cannot authorize -semantic recovery. Hostile tests cover unrelated heartbeat, policy advance, -successful exact recovery, and single-use refusal. Full library proof is 371 -passed/1 ignored; supervisor tests are 7/7; all binaries compile. - -Infrastructure truth also changed. The retired local `voidbot-qdrant` must stay -stopped. Shared Yggdrasil Qdrant is authoritative and reaches this workstation -through the ops tunnel at `127.0.0.1:16333`; Yggdrasil Ollama is reachable at -`http://10.77.0.1:11435`. Both Epiphany collections are green 1024-dimensional -cosine collections using `qwen3-embedding:0.6b`. - -Next: publish the reserved policy and place both the managed-service reconciler -and Qdrant tunnel under durable Idunn/OS survival ownership. Live proof must -cover real child handshake, bounded pulse, heartbeat and health, forced -restart/correlation, singleton refusal, and safe exact recovery/resumption -where an abandoned claim can be created without forging canonical work. - -## Live semantic projector proof and canonical purification (2026-07-15) - -The reserved policy is live against shared Yggdrasil Qdrant through -`127.0.0.1:16333` and Yggdrasil Ollama through `10.77.0.1:11435`. Live launch -pressure exposed three fossils that narrow tests had not reached: - -- local Verse still contained the deleted ownerless - `epiphany.cultmesh.operator_status`; an explicit backed-up migration removed - its one key instead of registering extinct authority; -- both canonical stores contained v0 claims/attempts and index receipts from - before Idunn fencing; explicit migration atomically retired those rows from - active authority rather than inventing missing incarnation or grant fields; -- Mind and Modeling canonical cache catalogs registered claims, attempts, and - receipts but not the executor-grant/recovery types now written into the same - physical stores; both readers now register the whole semantic authority - family. - -CultCache now provides an atomic exact-envelope batch deletion primitive for -these migrations. The projector launch receipt also binds executable SHA-256, -and the child verifies both its own PID and its bytes against that receipt -before constructing the service body. Health publication errors are bounded in -the pulse output instead of disappearing into a count. - -Fresh Idunn-granted projection rebuilt Mind (43 documents) and Modeling (3 -documents), both 1024-dimensional and query-eligible. Live semantic context -queries ranked canonical documents for both partitions while ignoring Qdrant -payload text. A clean steady pulse inspected both sources, remained idle, and -published a ready heartbeat with no source or health faults. A second -interactive projector was refused by the host singleton. Killing child PID -22992 caused the reconciler to launch PID 29868 with receipt -`daa89e4f-4301-40eb-aa87-5b52c5017221`; the typed service-status readback proved -the new ready heartbeat names that exact receipt and executable hash. - -Full proof is 375 library tests passed/1 ignored, 7/7 supervisor tests, and all -binaries compiling. The live child and reconciler remain running, but survival -is not yet deployable physiology: reconciler PID 22072 and SSH tunnel PID 22728 -are detached processes, not durable OS-owned services. The existing generic -Windows `sc.exe create` path is not sufficient because this console binary does -not implement the Windows service-control handshake. Build a real service host -or explicit Task Scheduler owner with restart policy, give the Qdrant tunnel -the same durable treatment, and prove startup/reboot recovery. Live abandoned -claim recovery remains unproven; use a safe fixture rather than forging work. - -## Windows survival authority rebuild (2026-07-15) - -The workstation survival cut rejected the generic Windows SCM path. The -Epiphany binaries are ordinary console programs and never implemented the -Windows service-control dispatcher, so `sc.exe create`, elevated service -runbooks/audits, cluster-service install/control, and `swarm-online-runbook` -were presentation of authority the body did not possess. Those routes and -their old receipts are historical evidence only; they must not steer current -deployment, readiness, or follow-up work. - -Host survival is now deliberately narrower and honest. Current-user tasks -`Epiphany-Idunn-Managed-Service-Reconciler` and -`GameCult-Yggdrasil-Tunnel` run as Meta with `InteractiveToken`/Limited -privilege, `AtLogOn` plus a one-minute recurring recovery trigger, -restart-on-failure at one-minute intervals for 999 attempts, `IgnoreNew`, zero -execution limit, and exact direct foreground actions. Task Scheduler owns -process presence after login. It does not own projector children or semantic -state. Idunn still owns the managed-service reconciliation loop and projector -launch/restart correlation. `gamecult-ops` owns the Yggdrasil tunnel profile -and foreground SSH process; Epiphany merely consumes the pinned local Qdrant -ports. No wrapper, detached grandchild, or service-manager receipt is a second -survival owner. - -Live recurrence proof killed reconciler PID 24152 and observed exactly one -replacement PID 25428. Killing projector PID 29868 then caused Idunn to launch -PID 19888 with launch receipt `4d406060-6582-473a-9322-9f4ccc8b322f`; -ready heartbeat `79fe3143-28a8-40fe-9547-0287159082e6` names provider -incarnation `projector-59217a66-e3e2-44c3-b000-36af3d43b043` and the exact -startup correlation. Tunnel recurrence killed SSH PID 22652 and observed PID -30444 start at 11:37:44 with Qdrant REST healthy. - -The pre-reboot deployment repair then packaged -`epiphany-memory-semantic.exe` beside the release supervisor and projector, -deployed the rebuilt supervisor, and left -`Epiphany-Idunn-Managed-Service-Reconciler` Running. Deployment queries must -receive the real transport coordinates explicitly through -`EPIPHANY_QDRANT_URL` and `EPIPHANY_OLLAMA_BASE_URL`; ambient defaults are not -deployment proof. With those variables set, both packaged Mind and Modeling -queries returned semantic ranking. The provider status command no longer calls -that sight `ready`: it returns `provider-correlated` or `provider-degraded`, is -explicitly non-authoritative, and points to semantic query admission as the -only readiness owner. - -One process-lifecycle scar matters for the reboot audit. Stopping the Task -Scheduler reconciler leaves its already-detached projector child alive. A -current parent PID is therefore derived process sight, not durable custody, and -a stop/start rehearsal can accidentally reuse the old child. The real proof -must observe a fresh post-boot scheduler -> reconciler -> exactly-one-projector -chain, a new launch-correlated provider heartbeat, and successful packaged -Mind and Modeling query admission after the tunnel returns. - -The limitation is part of the contract: this is after-login recovery, not -pre-login, boot-time, machine-wide, or Windows-service operation. The remaining -Soul proof is a real reboot/logon cycle showing both scheduled tasks running, -the tunnel ports restored, one Idunn-managed projector child, and a fresh -launch-correlated provider heartbeat followed by semantically ranked packaged -Mind and Modeling queries. Reboot remains a host-wide action requiring exact -live operator permission. Do not spend another pass polishing the dead SCM -rite. - -## Isolated semantic abandoned-claim recovery proof (2026-07-15) - -The feature-gated native `epiphany-semantic-recovery-smoke` closes the recovery -fixture wound without forging canonical Mind or Modeling work. It creates -GUID-scoped Mind, Modeling, and Verse stores. A real projector acquires epoch 1, -stalls against a fixture-local endpoint, and is killed. The supervisor then -consumes the exact current semantic policy, managed-service lifecycle receipt, -and provider heartbeat to recover epoch 2. A replacement real projector -consumes that recovery authorization through the common execution path. - -Typed read-only inspection proves the abandoned attempt is failed, the recovery -authorization is consumed, the epoch-2 claim remains running under the -replacement incarnation, and the old owner cannot authenticate it. Actual -semantic readiness and query eligibility are present. Wrong-heartbeat and -single-use attempts fail without changing canonical fixture bytes. - -The Qdrant collections use GUID names, are preflighted absent, and are deleted -and verified absent by exact 404. The smoke accepts no live/default Mind, -Modeling, or Verse stores and exposes no fixture-only mutation mouth. Passing -artifact: -`C:\Users\Meta\AppData\Local\Temp\epiphany-semantic-recovery-1152736f-b8a2-4cf0-ab24-c8a3993a0eb7\proof.json`. - -This proves the exact recovery/resumption and fencing path. It does not prove -global deployability. The remaining deployment evidence is still the real -reboot/logon survival cycle above. - -## Runtime surface capability purification (2026-07-15) - -The systemic surface audit separated a real local projection from false wire -authority. Commit `65445623` remains valid: it rebuilt -`epiphany.persona_surface.v0` as a strict, content-free MVP-status projection -over typed Persona artifact references, registered the real Reddit and Other -artifact schemas, and kept speech eligibility, Mind admission, Bifrost -acceptance, publication, and provider delivery outside the projection. Those -schemas remain discoverable vocabulary and local projection validators. That -does not make the projection a CultNet runtime capability. - -All seventeen unbacked `epiphany.surface.*` mutation contracts and their dead -runtime constants are now removed. None had a typed document writer, Snapshot -resolver, or action dispatcher; the compound MVP-status JSON was not a -substitute for those owners. Runtime Hello and runtime status now derive the -current executable mutation-contract list instead of trusting the historical -`supported_document_types` stored in runtime identity. The live canonical -store still carries that old field as inert history, but it cannot decide wire -or status truth. A real canonical hello-frame contained zero -`epiphany.surface.*` capabilities after the cut. - -Re-admission is deliberately expensive: an owning organ must prove -`provider publish -> typed CultMesh document -> Snapshot -> schema validation --> Eve lowering`. Any advertised action additionally needs a real typed -dispatcher and receipt path. Schema registration alone proves vocabulary, not -runtime support. - -The adjacent central Eve substitution is cut. The generic provider publisher -and its heartbeat call are deleted; a cluster heartbeat now owns liveness only. -Live Odin, Eve, and daemon-tool directories expose no provenance-free v0 rows, -and explicit bootstrap retires stale rows of those exact families. The stable -topology `eve_surface_id` remains routing/address metadata and proves neither -presence nor composition. Provider availability can return only through an -owning provider's provenance-bearing typed contract; advertised actions also -need a real dispatcher and receipt path. - -This does not replace the current deployment next action: complete the real -Windows reboot/logon proof for Task Scheduler, the Yggdrasil tunnel, Idunn, and -the launch-correlated semantic projector heartbeat. - -## Production coordinator fixture authority cut (2026-07-15) - -The production `epiphany-mvp-coordinator` is again a scheduler, not a smoke -ventriloquist. Typed coordinator status and accepted evidence own the selected -action. The normal `continueImplementation` arm remains the single shared path -that may produce a Hands gate, but caller fixture text can no longer force that -arm or suppress review. - -- Owner: typed coordinator status plus accepted role/evidence state owns the - next action; Hands/Substrate review owns implementation permission. -- Inputs: the selected runtime store, current typed thread state, accepted role - results, and explicit review state. -- Outputs: coordinator steps, final action, run receipt, and a Hands gate only - when the typed action reaches the shared implementation arm. -- Derived state: smoke scenarios, fixture workspaces, forced pressure, source - drift, and dry-compaction observations are verification cargo only. -- Forbidden writers: production CLI flags, callers, wrappers, and fixture - helpers cannot choose coordinator action, mark it auto-runnable, waive - review, seed canonical scheduler state, or manufacture a Hands gate. -- Shared paths: production and smoke exercise the same typed status/action and - Hands-gate machinery after their inputs exist; the smoke does not add a - second decision owner. -- Cut line: all production fixture flags, overrides, and helpers were deleted. - Fixture assembly lives in `epiphany-mvp-coordinator-smoke`, confined to - `.epiphany-smoke/mvp-coordinator`. - -Negative proof rejects all seven retired flags at the production mouth while -the dedicated smoke remains inside its fixed root. No legacy flag can target a -caller-selected runtime store. Eyes has banked one adjacent candidate, not a -completed finding: sibling Bifrost subprocess JSON still participates in a -readiness view and needs a focused audit for typed provider identity and -provenance before any cut is justified. - -The deployment next action is unchanged and permission-bound: only with exact -live operator approval may the real reboot/logon proof run. It must establish -the restored tasks and tunnel, a fresh reconciler -> exactly-one-projector -chain, launch-correlated provider sight, and admitted semantic queries. Do not -infer reboot authority from this scheduler cleanup. - -## Bifrost readiness projection deletion (2026-07-15) - -Epiphany no longer treats a sibling Bifrost path, executable presence, exit -zero, parseable JSON, or caller-supplied readiness booleans as provider sight. -The `epiphany-mvp-status` sibling subprocess projection and its `bifrostBridge` -output are deleted, as are `epiphany-bifrost-bridge-status-smoke`, the aggregate -Persona readiness fields, and wrapper readiness summaries. Missing authenticated -typed provider evidence remains unknown. - -The surviving Persona Discord, Reddit, and future-surface paths are mouths, not -Eyes. Epiphany owns speech eligibility and may invoke a configured Bifrost -actuator for one named crossing. A validated returned receipt is bound only to -that speech/request artifact as evidence of the single consequence; it cannot -establish provider inventory, liveness, capability, readiness, publication, or -future operability. The cross-mouth aggregate is deleted. Each Persona mouth -tests only its own fail-closed eligibility, target-bound receipt shape, and -private-state sealing. - -Authority map: the participating Bifrost/provider boundary owns consequence -truth; one eligible crossing request and configured actuator coordinates are -inputs; one artifact-scoped transport/request receipt is the output; global -readiness is not derived. MVP status, wrapper summaries, cross-mouth aggregators, -sibling-path probes, and caller booleans are forbidden readiness writers. All -three mouths retain the same eligibility-to-receipt boundary without sharing -consequence authority. The deletion line was the sibling readiness projector, -both aggregate smoke binaries, aggregate output fields, and status presentation. - -The deployment next action remains unchanged and permission-bound: do not -reboot without exact live operator approval. With that approval, prove both -scheduled tasks and the tunnel return after logon, establish a fresh reconciler --> exactly-one-projector chain and launch-correlated heartbeat, then obtain -semantic ranking from packaged Mind and Modeling queries using the explicit -Qdrant and Ollama endpoints. - -## Freshness and reorientation authority repair (2026-07-15) - -The freshness surface no longer converts missing evidence into confidence. -Retrieval `Ready` is Clean only when `dirty_paths` is empty; a Ready label with -one or more dirty paths derives Stale and therefore cannot authorize Resume. -The legacy thread graph projection cannot produce `Ready`. Explicit frontier -dirty paths, open questions, or open gaps prove Stale; otherwise it is -Missing/Unknown because legacy checkpoint identity cannot see canonical -RepoModel admission. A watcher -with no buffered changes is also unknown/unavailable: -there is no watcher generation, cursor, start boundary, or continuity receipt -from which silence could prove cleanliness. Observed changes remain valid -positive evidence. - -`recommend_reorientation` now owns the whole Resume/Regather verdict. Resume -requires a resume-ready investigation checkpoint, retrieval Clean, graph -Clean, and watcher Clean or Unknown. Retrieval or graph values other than -Clean, and watcher Dirty/Stale/Changed, force Regather with explicit reasons. -Path overlap remains explanatory derived state; it cannot rescue a stale or -unknown map. `epiphany-mvp-status`, worker launch, coordinator, and CRRC all -consume this decision. `surfaces/jobs.rs` consumes the same derived graph -freshness judgment for graph-remap work instead of maintaining a second churn -string tribunal. - -Authority map: `derive_freshness` owns freshness judgment from canonical -retrieval state, explicit legacy frontier pressure, and -positive watcher observations. `recommend_reorientation` owns the action. -Their outputs are derived read projections and one reorientation decision. -Watcher silence, MVP mappings, jobs, worker launch, coordinator, and CRRC are -forbidden readiness/action writers. All launch and operator paths share the -same derivation and decision primitives. - -The ungrounded `churn.graph_freshness` and -`graph_checkpoint.graph_revision` fields were deleted. Checkpoints retain -identity and frontier content; churn retains understanding, diff, warning, and -unexplained-write evidence. Canonical RepoModel revision/hash plus its exact -Mind-issued `RepoModelAdmissionReceipt` proves only admitted map identity. -Future observed-ready-at also requires fresh Body observations bracketing exact -Body-grounded model admission and retrieval coverage for one manifest root; -Mind derives the joined projection. Do not build a bridge from snapshot -metadata, watcher silence, timestamps, or historical event continuity. - -## Repository Body substrate landed (2026-07-15) - -Native `repository_body_observer.rs` and `epiphany-repository-body` expose an -explicit runtime-bound bind step, observe, pure status, and smoke for -`git_worktree` state. Bind pins caller workspace ID to the existing validated -runtime/swarm/source identity plus canonical Git root and policy. Two equal -isolated Git-index scans feed immutable CultCache observations/current-head CAS. -Unchanged raw manifest does not advance generation; missing status creates no -store. The observer makes no historical continuity claim and has no Ready field. Sparse checkout is -rejected, submodules are gitlink-only, and downstream joins remain absent. -The CultCache store is required to live outside the observed worktree. -Canonical path checks run before any bind/store write, global excludes are -disabled, and corrupt/non-commit HEAD fails closed. This slice persists accepted -stable observations only; failed attempts advance no head. -All Git calls share one sanitizer that removes ambient Git repository/object/ -ref/index/namespace and injected-config authority before applying explicit -observation policy. -The isolated index enumerates ignore-aware UTF-8 paths/modes/gitlinks, but its -clean-filtered tree OID is auxiliary. Raw file bytes (or non-followed symlink -target bytes) feed an ordered manifest whose domain-separated SHA-256 root is -the authoritative Body identity. Manifest, observation, and manifest-root head -commit atomically. Gitlinks are nonrecursive; unrepresentable paths fail closed. -Bind now installs one immutable runtime-side Body-store route containing the -canonical external locator and exact Body-binding hash. Reads validate runtime, -swarm, workspace, path, and Body binding; a runtime cannot substitute a second -Body store. The route is the locator nerve used by the grounded chain below. - -## Modeling thinks from an authenticated Body observation (2026-07-15) - -Coordinator-owned Modeling launch observes the bound repository before worker -thought and seals a typed `RepositoryBodyObservationBasis` into the immutable -launch. Modeling output contract v3 requires an exact worker-authored echo. -Result ingress reloads the launch and refuses missing, swapped, or non-Modeling -basis cargo. Mind admission review v1 and receipt v5 carry the same basis; the -admission CAS validates launch/result/review equality and the referenced -historical Body artifacts before copying it into the receipt. It never samples -current Body as a substitute. A valid historical basis remains admissible after -the repository changes because it proves what Modeling saw, not timeless -freshness. Direct Mind adoption and legacy migration remain explicitly -ungrounded rather than manufacturing retroactive evidence. - -## Readiness join remains deliberately impossible (2026-07-15) - -Modeling audited the next ownership seam after the Body observer landed. Mind is -the only coherent owner for a derived repository-readiness projection, but the -remaining input required to emit observed-ready-at does not exist yet: exact -workspace-retrieval coverage for that same Body manifest. RepoModel admission -is now grounded to its exact pre-thought Body observation. The existing -semantic projector proves exact query eligibility for an admitted RepoModel -projection; the legacy workspace retrieval JSON manifest proves only path/size/ -mtime/chunk cache agreement. Do not join its `Ready` label, empty dirty paths, -watcher silence, Git OIDs, timestamps, counts, or Qdrant presence into repository -readiness. Historical continuity was audited and rejected as another conceptual -substitution. The correct join observes Body root R1, validates every artifact, -observes R2, and emits only a time-bounded result when R1=R2. Watchers and Hands -receipts trigger recomputation; they never replace either observation. Build -order is now typed Body-bound retrieval coverage, the Mind-owned race-safe join, -then deletion of local interpretations. - -## False workspace retrieval authority cut (2026-07-15) - -`retrieval.rs` was production-unwired: no runtime caller, JSON manifest -persistence, path/size/mtime/chunk identity, divergent exact/semantic walkers, -path-derived Qdrant collections, and counterfeit `Ready` from missing manifests -and query-time BM25. The module and public re-exports are deleted. Legacy thread -`EpiphanyRetrievalState` is presentation-only: clean `Ready` projects Missing -and its indexing job is unavailable/unowned; explicit dirty/stale input may warn -but cannot prove coverage. The live RepoModel semantic projector remains intact. - -Next build: consume an authenticated historical Body manifest, classify every -entry under one versioned policy, verify eligible bytes against Body hashes, -project into a Body-root/policy/epoch isolated collection, observe the exact -expected point set, and publish an immutable CultCache coverage receipt. Do not -resurrect the JSON manifest as a compatibility source. - -## Body-bound coverage contracts landed (2026-07-15) - -The native coverage substrate now admits only an authenticated historical Body -manifest, exhaustively classifies its entries under a versioned policy, and -seals Body/policy/classification identity into an immutable obligation. A typed -projection plan binds the exact expected point set and derives an epoch-isolated -Qdrant collection from Body plus projection/embedding authority; the caller has -no collection-name lever. Receipt/head validators require an exact scroll- -observed point set and exact obligation/plan join. - -This is contract substrate, not operational coverage. There is deliberately no -persistence writer, projector, Qdrant call, query eligibility path, or readiness -join. Next action: build the single CAS-owned projector/store path that verifies -eligible live bytes against the selected Body manifest, executes the sealed -plan, scroll-observes the physical point set, and only then publishes the -receipt and head. - -Projector ownership is now mapped before implementation. Persist all coverage -state in the Repository Body store so terminal success can CAS against the exact -current Body head; never create a runtime-store coverage oracle. Add a sealed -claim/attempt lifecycle, verified historical-byte reads, deterministic UUIDv5 -point descriptors, and a plan-sealed ID-to-payload binding root. Whole- -collection typed scroll must reject duplicate, extra, missing, or payload- -mismatched points before terminal success. Qdrant writes outside the CAS may -leave orphan namespaces after races or crashes, but those namespaces own no -readiness. - -The sealed acquisition/failure foundation is now implemented but intentionally -unwired. It authenticates current Body authority, verifies bytes, excludes -empty/oversize/non-UTF-8 files, derives named UTF-8-safe line chunks, and CAS- -installs immutable obligation/plan with a running claim/attempt in the Body -store. Exact failure may terminalize after Body advance; no code can publish a -coverage receipt/head. Next work must add observed-binding Qdrant execution, -terminal-success CAS, and abandoned-claim recovery before choosing either a -dedicated coverage service (preferred for ownership clarity) or a strictly -separated lane in the reserved memory semantic-projector process. No CLI shim. - -## Exact coverage execution port (2026-07-15) - -The crate-private projector now executes a sealed plan through the shared typed -Qdrant boundary. It validates text hashes and vector dimensions, authenticates -exact collection metadata, skips empty upserts, observes the whole typed -collection, rejects cyclic page offsets and duplicate/extra/missing/substituted -point payloads, and publishes receipt/head only through an exact terminal CAS -over Body authority, obligation, plan, claim, attempt, and the prior coverage -head seen at acquisition. Body advance and stale-head competitors cannot mint -success; ordinary failures terminalize the exact running attempt. - -This is still sealed foundation, not operational coverage. The dedicated -workspace-coverage service is now the chosen owner, but claims first need an -authenticated executor incarnation/startup receipt. Its pulse also needs an -exact already-current classification and sealed chunk-text rematerialization. -Recovery must consume a newer latest reserved-service launch plus its correlated -ready heartbeat and fence the old claim in one Body-store CAS. Timeouts, generic -managed policy, Qdrant contents, and process guesses are forbidden recovery -authority. If Body advanced, terminalize the obsolete claim and acquire a fresh -plan; never resurrect it. - -## Dedicated workspace coverage service proof (2026-07-16) - -The dedicated service, binary, reserved supervisor policy, and specialized -CultMesh launch contract now exist. Generic policy and caller-selected command, -workspace, Body store, collection, or dimensions are rejected. Launch receipt, -PID, executable hash, runtime identity, immutable Body route, and host singleton -are authenticated before projection. - -The service resolves the configured Ollama tag to its installed immutable -artifact digest on every pulse, probes its dimensions, and uses an exact Current -fast path that reads no repository files. Needed projection uses one -authenticated Body read session, verifies source bytes/chunks, embeds only after -claim acquisition, whole-scrolls Qdrant payloads plus vectors, and binds exact -point/payload/vector observations into the receipt before terminal CAS. Body -history owns retirement of terminal non-current claim collections; deletion is -metadata-gated and idempotent. Raw backend/filesystem errors no longer leak into -the operator-safe pulse projection. - -Proof: 424 library tests passed, one ignored; core and OpenAI runtime all-target -checks passed. The ignored live smoke then passed against local Qdrant 1.17.1 -and Ollama `qwen3-embedding:0.6b` (artifact digest -`ac6da0dfba84a81fdbfbaf330198c33cd77c4cdfc53e8bc50eb581914a15621d`, -1024 dimensions), proved exact vector observation and Current classification, -deleted its GUID-scoped collection, verified no coverage collection remained, -and restored the preflight-stopped Qdrant container state. - -Recovery remains absent on purpose. A newer launch plus ready heartbeat is not -death evidence. Next build: strengthen native process observation with host+ -boot and process-instance identity, then let the supervisor publish one -immutable termination observation bound to the exact old launch/PID/executable/ -policy/heartbeat/provider. Only that proof plus a current replacement launch may -authorize one Body-store recovery CAS. Do not add timeout recovery. - -The native process-instance probe foundation is now implemented and locally -proved. Windows uses PID + process-creation FILETIME + canonical executable, -compares exact identity through a held query/synchronize handle before -alive/exited classification, and separates Toolhelp absence, access denial, and -indeterminate query failure. Linux uses boot id + proc starttime + executable -and recognizes exact zombie exit; other Unix targets refuse to claim Linux -evidence. The old PID-only projection has no `Dead` state. This substrate does -not itself authorize recovery. Next build the enrolled OS-host identity and -specialized reserved launch/heartbeat and termination documents; only then wire -the Body recovery CAS. - -The enrolled host-incarnation foundation is also implemented. Its single -non-workspace CultCache record owns an Ed25519 public identity and protected -private seed; opening validates the exact type/key/schema, platform binding, -public/private match, and immutable singleton shape. Enrollment refuses any -existing store and never regenerates malformed state. Windows uses CurrentUser -DPAPI with UI disabled and the deliberately limited assurance label -`os_user_installation_bound_best_effort`; Linux uses 0700/0600 state plus -machine-id binding and declares its cloneable baseline. No code calls this -physical-machine identity. Next remove reserved coverage authority from generic -lifecycle/heartbeat and replace it with identity-bound signed documents. - -Those specialized documents are now implemented but not yet wired. The launch -is a mandatory host-signed CultMesh record over exact current reserved policy, -host record digest, boot, PID incarnation, executable path/digest, provider -incarnation, and ephemeral provider public key. The provider heartbeat is -ephemeral-key signed, binds the exact launch envelope and same tuple, and owns a -strict per-launch sequence/time CAS. Validation rechecks the current specialized -policy but does not reread the historical executable path, so deletion cannot -erase evidence. Focused hostile tests reject forged signatures, sequence gaps, -identity collisions, wrong supervisor/status/runtime, and tuple drift. - -Next migrate the supervisor and projector together: fixed-size provider seed -frame over reserved-child stdin, exact process capture, signed launch persist, -child launch authentication, specialized heartbeat publication, then generic -writer rejection for reserved coverage. Do not let the new and old documents -remain co-owners after that cut. - -The migration cut is now implemented and verified. Reserved-child stdin carries -one fixed binary launch-id/seed frame and requires EOF; all nonreserved service -stdin is null. Supervisor captures the spawned process incarnation, sends the -secret, host-signs/CAS-persists the specialized launch, and kills/waits on any -failure. The projector authenticates host, current policy, boot, exact process, -launch digest, and derived provider key before service construction, then emits -only specialized signed heartbeats. Generic lifecycle and daemon-heartbeat -writers reject the reserved coverage identities, and the old generic coverage -authenticator is deleted. Coverage claim/attempt v1 now binds -`managed_process_launch_id`, refusing semantic reinterpretation of v0 state. - -The new native `epiphany-host-identity enroll|status` actuator explicitly -enrolled this Windows installation at the default LocalAppData DPAPI store; -status reopened identity -`17f041421045aa66d4c8ab0488f462dbb5ea1a7d8507dbf75216f5ec368dbb7a`. -Next implement immutable Idunn termination observation before replacement spawn, -then the exact Body recovery CAS. Timeout recovery remains forbidden. - -Immutable termination evidence is now implemented. The only public writer uses -native boot/process observation; the injectable source is private to tests. A -host-signed per-launch record binds the exact current policy envelope, exact -specialized launch, exact per-launch latest signed heartbeat, enrolled host, -expected boot/PID generation/path, observed outcome, and optional exact exit or -replacement material. Publication exact-CASes those three source envelopes and -an absent immutable termination key. There is no latest termination pointer. -Alive, inaccessible, indeterminate, unknown boot, host mismatch, collision, or -moved source state refuses. Authentication reconstructs the complete persisted -chain instead of blessing the signed blob by itself. - -Next wire Idunn ordering and Body recovery: predecessor termination must persist -before replacement spawn; replacement signed ready must exist before one atomic -v1 claim/attempt terminalize-and-reacquire CAS. Add negative ordering and stale- -Body tests before calling recovery operational. - -The deployment next action is unchanged and permission-bound. Do not reboot -without exact live operator approval. With that approval, run the real -reboot/logon recovery proof already specified above. - -## Workspace coverage exact Body recovery and Idunn reconciliation (2026-07-16) - -The abandoned-claim path is typed end to end. Recovery refuses caller-owned -Body paths, reopens the runtime's authenticated Body route/basis, joins current -Body, obligation, plan, claim, and attempt, authenticates the old launch plus -immutable host-signed termination, and accepts only a causally linked -replacement launch whose current signed heartbeat is `ready`. One exact Body -CAS archives the failed owner, advances the fencing epoch, installs the -successor claim/attempt, and writes an immutable recovery receipt binding the -old claim, termination envelope, replacement launch envelope, ready heartbeat -envelope, and successor authority. Restart authentication reconstructs both -CultMesh evidence and current Body authority. - -Reserved launch schema v1 adds a signed causal replacement edge. Its writer -exact-CASes a singleton `replacement-for/` slot with exact -termination and launch state. A second replacement refuses; the supervisor -kills a spawned loser when persistence loses CAS. - -Idunn branches workspace coverage away from generic lifecycle PID receipts. It -persists or reuses termination, reuses a causal replacement after interruption, -otherwise launches through the fixed stdin/bootstrap path, waits for the exact -latest signed ready heartbeat, then invokes Body recovery. Initial/pre-claim -launches use the same specialized authority. - -Proof passed: 5 process-document/recovery tests, 14 supervisor tests, 15 -projector tests plus 1 ignored live Qdrant/Ollama test, and all-target check. - -Next cut: termination v0 still requires a provider heartbeat. A child dying -after launch persistence but before heartbeat sequence one strands the chain. -Rebuild termination so signed launch plus enrolled host/boot/process observation -is sufficient, with heartbeat optional additional evidence. Then run a -GUID-scoped live initial launch -> death -> replacement -> Body recovery smoke. -Reboot/logon proof remains permission-bound. - -## Pre-readiness workspace coverage death is recoverable (2026-07-16) - -The heartbeat prerequisite was rebuilt, not relaxed with nullable fields alone. -Each specialized launch owns one typed process-evidence head. Launch initializes -it; every signed heartbeat advances it by exact CAS; termination advances and -seals it by exact CAS. Termination v1 uses signed launch plus enrolled -host/boot/process observation as sufficient death proof and includes heartbeat -id/digest only when the head names a current signed heartbeat. Heartbeat after -termination refuses, so publication and death cannot win on separate keys. - -Focused proof now includes death before heartbeat sequence one, successful -heartbeat-free termination authentication, and refusal of a late heartbeat. -All six process-document/recovery tests, fourteen supervisor tests, fifteen -projector tests plus one ignored live test, and all-target check pass. - -Next: create/run a GUID-scoped live smoke through real packaged supervisor and -projector binaries, local Qdrant/Ollama, exact child kill, causal replacement, -epoch+1 recovery, and restart-time receipt authentication. Restore the prior -Qdrant container state afterward. Reboot/logon remains permission-bound. - -## Live packaged workspace coverage recovery proof (2026-07-16) - -Feature-gated binary `epiphany-workspace-coverage-recovery-smoke` constructs -GUID-scoped repo/runtime/Body/Verse state, uses the real packaged supervisor and -projector siblings, warms local Ollama, derives its exact fenced Qdrant collection names, launches -through specialized bootstrap, catches the epoch 1 claim, kills the exact child, -runs Idunn reconciliation, verifies epoch 2 authority and fresh-store-reopen -recovery receipt authentication, kills the replacement, and removes only its -exact owned collections. Process cleanup revalidates the signed launch's native -incarnation before issuing any kill. - -Passed proof: -`C:\Users\Meta\AppData\Local\Temp\epiphany-workspace-coverage-a577f820-b0e2-4733-b628-529ee3bdb143\proof.json` - -Receipt: `2b44f28f-7c0f-4ad2-aefe-d7c8222e8642`. The proof binds executable -SHA-256 `d262b7f49d45f15c31589bdfb591988cabcfa9ba65564d3e61493dc00b072093`, -the exact embedded smoke-source digest, source head, and dirty tracked-source -diff digest. It verifies both owned collections absent before emitting success. -Operator orchestration restored the -local Qdrant container to its prior stopped state; that is not a harness claim. - -The live rite exposed two real defects and did not pass until both were cut. -Windows boot identity no longer opens privileged PID 4; it queries native -kernel boot time and a focused test proves availability/stability under the -current normal user. Recovery no longer deadlocks its successor: the exact v3 -replacement incarnation may resume its own running claim, while a wrong -incarnation remains contended. The harness uses file-backed supervisor output -because Windows grandchildren can retain captured pipe handles, and it has -exact-incarnation process cleanup and exact-owned-collection cleanup guards. - -Verification: five native process-observation tests, six process/recovery tests, -fourteen supervisor tests, fifteen projector tests plus one ignored live test, -and feature-enabled all-target check pass. The separate live Qdrant/Ollama -projection test passed before the recovery smoke. - -Next: audit deployability against the swarm readiness plan and live host state. -Do not conflate code-complete physiology with the permission-bound reboot/logon -proof; no reboot without explicit live operator approval. - -## Fresh deployability audit (2026-07-16) - -The host is operational after current-user login, not yet deployable as one -proven artifact generation. `GameCult-Yggdrasil-Tunnel` and -`Epiphany-Idunn-Managed-Service-Reconciler` are enabled/running; the Yggdrasil -Qdrant tunnel and Ollama endpoint are live; packaged Mind and Modeling queries -return semantic ranking. Local retired Qdrant remains stopped. This is real -current-boot physiology. - -Four non-permission wounds remain. Installed supervisor/projector binaries -predate recovery commit `34802407`; Task Scheduler pins one mutable supervisor -path while Idunn discovers siblings by filename/existence, so mixed generations -are possible; Mind has no race-bounded whole-repository readiness join; and the -old readiness plan described already-landed June work as future work. The plan -now contains the live evidence matrix. Packaging must become an immutable typed -commit-addressed release witness consumed by Task Scheduler and Idunn. Mind -readiness must join fresh Body R1/R2, exact Body-grounded RepoModel admission, -live Modeling semantic eligibility, and live workspace-coverage Qdrant evidence. -Stored coverage `Current` is not sufficient. - -The constant `queryAdmission=false` and supervisor fields naming an external -readiness authority are removed from sight-only projector/health/status -projections. Those surfaces never evaluated query admission and therefore have -no opinion. Query-time reauthentication remains the semantic admission owner. - -After the witnessed release is deployed, prove exact current-boot recurrence -and Mind/Modeling query ranking. A reboot/logon proof remains the sole -permission-bound host gate; do not reboot without explicit live approval. - -## First witnessed deployment (2026-07-16) - -The release packager failed closed three times before publication and exposed -three substrate wounds: Git rejected verbatim/deep Windows worktree paths, -Cargo could not traverse the remaining deep vendor path, and the exact commit -did not contain `epiphany-core/Cargo.lock`. The final machine uses normalized -canonical package paths, short temporary exact-source/build roots, initialized -pinned submodule bodies, and a tracked lockfile with `--locked`. It builds from -a detached worktree at the witnessed commit; caller-supplied binaries have no -entry path. - -Published release: - -- source commit: `dd80f4a51c18425a6665710698a357be61154abf` -- release id: `sha256-c94109f94ee42c1257089830f399cb87cd5ad672772c274194371995ce4df923` -- witness digest: `sha256-f0394590e2e9762b7cb1579f6a06db009f4701730fe1b44ea0f20c1175aee04a` -- package root: `E:\Projects\EpiphanyAgent\.epiphany-run\releases\dd80f4a51c18425a6665710698a357be61154abf\sha256-c94109f94ee42c1257089830f399cb87cd5ad672772c274194371995ce4df923` - -The typed semantic-projector policy now names the witnessed role path. Task -Scheduler pins the witnessed supervisor plus release id/digest. Reconciler PID -`21228` launched direct-child projector PID `22736`; both witnessed Mind and -Modeling query gates returned semantic ranking. After exact-path verification, -PID `22736` was killed once; Idunn launched direct child PID `19748` with new -launch receipt `86a42d51-9930-4b5d-9e61-e74c82a0d808`, ready heartbeat -`4fc91977-b635-474b-812b-c364847e2b4b`, and executable SHA-256 -`1060dd64e8c2b520ec8744b67e8306db04a6618d463fc2117c352adf9e30e6b0`, -which equals the witnessed file. Task result `0x800710E0` remains the expected -IgnoreNew recurrence refusal while the foreground task is running. - -The installed sibling-generation gate is closed for the current boot. Next: -build Mind's whole-repository observed-readiness join. Reboot/logon remains -permission-bound. - -## Semantic receipt-v2 live migration wound (2026-07-16) - -The first readiness release exposed an honest migration failure. Receipt v2 -correctly made the old v1 Mind/Modeling receipts ineligible, but pulse -classification returned `Succeeded` from claim status before deriving receipt -health. Both partitions therefore stayed idle and packaged queries fell back to -canonical BM25. `Succeeded` is removed as a pulse state. Valid v2 terminal -evidence derives `Ready`; a same-obligation succeeded predecessor with missing, -legacy, or invalid receipt evidence derives `Repair`. - -Repair is not opened by claim shape alone. Classification and acquisition share -one predicate that authenticates the consumed executor grant or recovery -authorization plus the exact succeeded attempt/claim binding. The repair grant -advances the epoch. A failed repair becomes a failed current claim and retries -through the ordinary execute path at the next epoch. Tests cover forged -authority refusal, v1 repair acquisition, failed repair, execute retry, v2 -terminal success, final Ready, and empty-v2 Ready/nonqueryable stability. Soul -approved; the full library suite is 466 passed, 2 intentionally ignored. - -Operational evidence before the fix: release -`sha256-6f9ab4848207a110e7e3836f41e6a74c0f463369ad4b04ce2d0d3831a6b262ae` -from commit `360dcb43` launched witnessed Idunn PID `29476` and direct child -projector PID `22840`, but both packaged semantic queries fell back because the -v1 receipts had no migration path. The next action is to commit this repair, -package/deploy a successor witnessed release, observe v2 semantic ranking, then -derive the first live whole-repository readiness projection. Reboot/logon still -requires explicit live operator approval. - -## Mind whole-repository readiness join (2026-07-16) - -The missing join now exists in source. `repository_readiness.rs` is Mind's sole -owner for a historical `gamecult.epiphany.repository_readiness_projection.v0`. -It derives every authority decision from raw snapshots and observations: fresh -Body R1, one canonical RepoModel, exactly one current v5 admission whose -historical Body basis is authenticated, the exact succeeded Modeling semantic -chain, live semantic vectors, live workspace coverage bound to R1, fresh Body -R2 with equal content identity, repeated live observations, and one complete -closing runtime-store snapshot. The final projection append uses CultCache's -new full-snapshot conditional append, so a concurrent unknown receipt or -obligation defeats the write. Stored readiness is historical evidence only and -cannot admit a later query or readiness answer. - -Semantic receipts are now v2 and seal the deterministic post-scroll vector -binding root. Old, malformed, substituted, or stale receipts cannot grant query -eligibility. Exact empty projections may terminal-succeed once while remaining -non-queryable, avoiding a retry wound. Both semantic and workspace live readers -revalidate their persisted authority after Qdrant observation. - -CultCache envelope identity is now the tuple `(type, key)`, not delimiter -concatenation, and `append_if_snapshot_unchanged` compares the complete -canonical snapshot beneath the single-file exclusive lock. Soul approved the -join after hostile passes for alien keys, duplicate grounded/ungrounded -admissions, forged raw semantic heads, receipt cross-field substitution, -historical Body failure, Body/authority drift, R1-bound coverage ordering, CAS -refusal, and exact concurrent idempotence. - -Verification: 21/21 CultCache tests and 465/465 Epiphany library tests passed; -two existing live tests remain intentionally ignored. Next: commit/push the -CultCache submodule and parent changes, package a new witnessed release, deploy -it, then derive the first live whole-repository projection. Reboot/logon remains -permission-bound and requires explicit live operator approval. - -## Yggdrasil live-deployment authority map (2026-07-16) - -Live Epiphany deployment proof belongs on new Yggdrasil, not Starfire. The live -host already runs Idunn (`idunn-yggdrasil.service`), Bifrost, Odin/Hermodr, -Qdrant, and GPU-backed Ollama locally. Epiphany is not yet deployable there: -there is no Epiphany Idunn target, ops manifest/unit, immutable release body, or -daemon-owned aggregate `idunn.daemon_health.v1` publication. - -Two ownership gaps must close before the target is enabled. Epiphany's semantic -projection health is component sight and cannot stand in for whole-runtime -health; the managed-service supervisor must join the authenticated packaged -release with current semantic and workspace-coverage child lineage and publish -one explicit CultNet/RUDP health contract. Separately, Bifrost's real GitHub -crossing receipts are not consumed by Idunn: Idunn currently observes -`origin/main` as desired revision without proving that Bifrost authorized that -exact commit. The new chain is Bifrost exact repository/ref/SHA authority -> -Idunn frozen deployment request/artifact -> guarded ops actuator -> immutable -release and deployed manifest -> daemon-published runtime health. Branch -movement, actuator environment variables, process liveness, and component -health are forbidden substitutes. - -The intended Ygg body uses `/srv/build/Epiphany` as Idunn's mutable upstream -clone, immutable application releases below `/srv/epiphany/app/releases`, an -immutable deployed source Body below `/srv/epiphany/source/releases`, canonical -state below `/var/lib/gamecult/epiphany`, local Qdrant at `127.0.0.1:6333`, and -local Ollama at `127.0.0.1:11434`. Actual publication must cross live Bifrost; -actual deployment must be requested through live Idunn. Manual SSH deployment -is not acceptable evidence. No host reboot is authorized. - -Source implementation now closes the Epiphany-owned half. The managed-service -supervisor publishes exact `idunn.daemon_health.v1` over CultNet/RUDP only -after joining the authenticated packaged release with the exact two reserved -projectors. Semantic and workspace lineage require current policy, the exact -packaged executable, launch-time process incarnation, correlated ready -heartbeat, and bounded freshness. Proven stale v2 lineage may be replaced only -through its persisted process identity; authentication uncertainty cannot kill. -Legacy v1 lifecycle receipts are read-only and enter a typed non-killing -retirement path before a v2 launch. Full library verification is 475 passed, -2 intentional live-endpoint ignores. - -The adjacent source bodies are also prepared. Bifrost main commit `3bd250f` -publishes `bifrost.repository_release_authority.v1`, binds one canonical -repository/ref/SHA to a completed crossing receipt and exact GitHub proof, and -forbids simultaneous live authorities for the same ref. Odin's Ygg worktree -adds a scoped `yggdrasil-epiphany` target, selects the unique live Bifrost -authority rather than branch head, freezes it through deployment request and -artifact state, and revalidates at the privileged actuator boundary. The ops -body builds exact initialized source through a separate builder identity, -root-seals immutable source/application releases, starts Epiphany against -Ygg-local Qdrant and Ollama, requires post-candidate Idunn RUDP acceptance, and -only then publishes the v2 deployment witness. These source bodies are not yet -live on Ygg; bootstrap and deployment remain the next phase. - -## Yggdrasil GPU pressure exposed missing progress authority (2026-07-17) - -The live authority chain now reaches Yggdrasil. Bifrost authorized exact -Epiphany main commit `586147a751c6eec2d59cd8dc10bd17ce0d02a4d1`; Idunn fetched that exact -upstream commit, built it in the pinned Rust container, installed immutable -release `sha256-a5a43af6d2502377d2078dcb42ab98088f4a812487217436ec1af0ddd0d26b3d`, -and started both local projectors against Ygg-local Qdrant and GPU-backed -Ollama. Mind completed its first pulse, reported `providerStatus=ready`, and -published 215 vectors. Workspace coverage is a real 3,956-file Body pressure -run; a local line-based estimate is 14,734 UTF-8 chunks. - -The GTX 1080 is genuinely used: the workspace projector sustains roughly -93-100% compute utilization at 2,419 MiB VRAM. The prior 32-text HTTP batches -could monopolize one request for more than thirty minutes. Commit `586147a7` -bounds batches at four; live Ollama receipts now complete continuously in -roughly 0.7-1.7 seconds per call at about 53-63 calls/minute. This proves useful -forward GPU work, not merely allocation. It also proves the full first pass is -roughly an hour at the current hardware ceiling, longer than Idunn's 50-minute -deployment-health wall clock. - -Do not fix that by increasing the wall clock. The current execution primitive -embeds the entire sealed plan into memory, then performs Qdrant publication and -verification, and only returns to the binary afterward. The binary therefore -emits no signed provider heartbeat during the long pulse. Ollama logs, -`nvidia-smi`, process existence, elapsed time, and Qdrant point counts cannot -become progress authority. - -Authority map for the repair: - -- Owner: the authenticated workspace-coverage projector owns domain progress; - Idunn owns deployment admission, and the supervisor only derives aggregate - health. -- Inputs: exact packaged release/policy/managed launch, provider incarnation, - claim and attempt epoch, sealed plan, Body observation/generation, immutable - embedding artifact/dimensions, and acknowledged durable Qdrant checkpoint. -- Outputs: an append-only provider-signed - `epiphany.workspace_coverage.projection_progress.v0` event plus CAS latest - pointer. It binds sequence/time, exact authority identities, phase, - completed/total units, and the currently bounded backend operation. -- Derived state: `warming` requires a fresh independent process heartbeat and - fresh monotonically advancing exact-lineage progress. `stalled` follows an - expired named operation/no-advance deadline. `active` still requires the - canonical receipt/head and live verification; progress at 100% is not - readiness. -- Forbidden writers: Idunn, deploy scripts, supervisor, Ollama logs, GPU - telemetry, stdout, Qdrant counts, running claims, and free-running heartbeat - churn cannot advance progress. -- Shared path: first projection, ordinary Body change, retry, and authenticated - successor recovery use the same durable batch/checkpoint primitive. -- Cut line: split monolithic embed/upsert/verify execution at deterministic - durable boundaries; keep liveness heartbeat independent; remove total wall - duration as the health verdict. A successor launch cannot inherit work - without an explicit authenticated resume/checkpoint contract. - -Negative proof must cover frozen progress with live heartbeats, stale heartbeat -with advancing progress, replay across launch/Body/plan/model/release, sequence -or count regression, mutable totals, progress without acknowledged Qdrant -durability, 100% without a valid receipt, deleted/substituted collections, -restart inheritance without recovery authority, concurrent owners, clock -hostility, and Idunn accidentally treating warming as active. - -The current live run remains diagnostic evidence only until its terminal -workspace receipt, exact aggregate RUDP health, and deployment witness land. -No reboot is authorized. - -Checkpoint implementation cut: the authoritative batch checkpoint lives in -the repository Body CultCache, not the local Verse. It is admitted by one CAS -against unchanged Body/obligation/plan/running claim/running attempt and a -claim-scoped checkpoint head. Each checkpoint carries a contiguous canonical -plan range plus the exact ordered point, payload-hash, and vector-hash bindings -read back from Qdrant after a waited upsert. The signed Verse progress event -references the checkpoint's exact CultCache envelope digest; neither a random -provider hash nor Qdrant operation text is evidence. Terminal readiness still -requires the existing whole-collection scroll and receipt/head CAS. - -Same-claim retry may continue only from a contiguous authenticated checkpoint -chain whose batches still re-observe exactly in Qdrant. Recovery uses a new -claim epoch and new epoch-fenced collection. A successor may authenticate and -copy predecessor checkpoint batches into its own collection after exact death -and recovery proof, then emit new-claim checkpoints citing the source envelope; -it never mutates or inherits the old collection. If live external evidence is -missing or changed, it restarts from zero. Required backend cuts are a single -bounded waited upsert, exact retrieve-by-ID with vectors/payloads, and a common -readback/checkpoint primitive for newly embedded and recovered copied points. - -The first bounded-batch pressure run terminated exactly as the model predicted. -At `2026-07-17T01:23:50+02:00`, after 50 minutes of candidate-health waiting, -Idunn stopped Epiphany, left `/srv/epiphany/deploy/deployment.env` absent, and -reported `Idunn did not publish exact-candidate Epiphany daemon-health proof`. -Ollama had completed 3,389 embed HTTP calls since candidate startup. After the -Mind projection calls, that represents roughly 13.3k workspace chunks—about -90% of the estimated 14,734-chunk Body. The GPU remained usefully saturated, -but the monolithic executor had not yet upserted the accumulated workspace -vectors, so Qdrant's inherited Modeling collection remained at 22 points and -the hour of partial work was discarded. This is the live falsification of the -current execution/deployment contract. Do not reinterpret it as an Ollama or -GPU failure and do not repair it by lengthening the total wall timeout. - -## Live projector checkpoint integration landed (2026-07-17) - -Epiphany main commit `7362e54b` replaces the production monolithic workspace -executor. The live path now processes sealed plan-order batches of at most 128 -points, performs a waited Qdrant upsert, reads those exact IDs back with payload -and vector, admits a provider-signed Body checkpoint, and publishes progress -only from that admitted checkpoint. Restart authenticates the complete -genesis-to-head checkpoint chain against current Body, claim, attempt, plan, -launch, and host authority; it re-observes every checkpointed batch before -resuming at the next ordinal. - -Terminal receipt/head proof remains separate. It reconstructs independent -payload/vector expectations from the authenticated full checkpoint chain, -requires complete contiguous plan coverage, and rejects cycles, gaps, -overlaps, duplicate checkpoint or Qdrant rows, missing/extra points, and any -payload/vector substitution during the final whole scroll. The previous -circular final-vector comparison was found by Soul and cut before commit. - -The provider heartbeat is now an independent signed 10-second nerve and keeps -publishing while projection blocks. Heartbeat publication, sequence, or local -projection-lock failure terminates the whole provider process; a projector may -not continue acting after losing its liveness organ. Pulse refusal remains an -operator projection and no longer contaminates heartbeat status. - -Focused proof: 10 checkpoint tests, 17 projector tests, 3 service tests, the -reserved supervisor-argument test, and production checks for both projector and -supervisor binaries pass. The old all-at-once executor survives only under -`cfg(test)` for legacy pre-embedded invariant tests; it is absent from the -deployed body. The next authority cut is Idunn and aggregate health: consume the -exact provider progress document with a no-advance lease, never a generic job -progress noun or total projection wall clock. - -Live storage pressure later exposed that the production cadence still admitted -one immutable Redb checkpoint/progress transaction per point despite the -128-point batch contracts. The cadence now aliases the shared checkpoint maximum -of 128 and is compile-time constrained by Qdrant's same 128-point transport -ceiling. Durability still follows waited upsert plus exact payload/vector -readback; only the authenticated commit unit changed. Existing one-point chains -remain valid predecessors for later larger batches when their exact Qdrant -collection survives. A progress store whose collection is absent must not be -resumed from counts alone. - -## Organizational Epiphany is the product, not a remote-control experiment (2026-07-18) - -The Yggdrasil deployment is the first ordinary organizational Epiphany body. -It must remain awake without continual instruction: Modeling persistently maps -the bounded domain into typed Mind state, Self extrapolates pressure and -direction from that map, and Imagination authors inspectable improvement and -feature proposals. This initiative is advisory until the appropriate adoption -and consequence authorities act; operator inactivity permits observation, -modeling, and proposals, not merge, publication, deployment, or scope growth. - -The repository Persona is the organization's shared social crossing. Members -may talk to it, correct it, and provide feedback through ordinary Discord -conversation. Persona owns discussion and legibility. Conversation produces -typed feedback pressure for Modeling, Imagination, and Mind review; it does not -directly mutate canonical Mind, invoke Hands, authorize a release, or command -Idunn. Authenticated operational capabilities such as brake, objective intake, -adoption approval, release authorization, and deployment remain distinct typed -Bifrost routes with explicit receipts. VoidBot observes the room and Bifrost -routes the typed crossing; do not invent a second Discord bot or grant ordinary -chat ambient actuator authority. - -The July 22 continuity criterion is stronger than remote command. Yggdrasil -must host the resident scheduler/coordinator, model runtime, tool spine, Persona -crossing, writable domain worktree, persistent Mind/Modeling state, and local -credentials. Starfire may be absent through August 5. The offline rehearsal -must prove conversation/feedback -> persistent domain map -> Imagination -proposal -> explicit adoption/review -> Hands consequence -> Bifrost exact -release authority -> Idunn deployment receipt, plus the negative that -conversation alone cannot cross any later boundary. - -Live observation on 2026-07-18 sharpened the deployment boundary. Exact release -`0601e280480cccc28209fbf0630e921f3ef9056d` kept its projector incarnation alive -and advanced the Qdrant workspace collection from 1,621 to 3,278 points after -the foreground Idunn deploy actuator was no longer present. `deployment.env` -remained absent and Idunn correctly raised `dependency-unavailable` because it -could not establish release freshness. A surviving candidate and advancing -checkpoint are resumable work evidence, not deployment admission. After the -provider reaches terminal projection, the same exact authorized release must -re-enter Idunn's deployment transaction and earn the typed deployment witness; -no observer, systemd state, Qdrant count, or journal line may synthesize it. - -## Resident organizational Self ownership (2026-07-18) - -The resident cognition cut now has a concrete authority boundary. Standard -heartbeat alone converts one pending typed pressure into one single-consumption -Self scheduling grant. Resident Self alone turns that grant into one exact -coordinator process lease. The coordinator, model runtime, and tool spine keep -their existing authorities; the resident scheduler does not absorb them. - -Inputs are an authenticated packaged-release witness, physically separate -resident/runtime/Verse/Mind stores, the swarm brake, exact process observation, -and typed operator-objective, Body-map-drift, Persona-feedback, or -Imagination-proposal pressure. Outputs are immutable pressure/grant, -preparation, child-claim, active-lease, coordinator-receipt binding, and -heartbeat terminal-ack documents. Active status and cooldown are derived from -that chain. Process exit, logs, Persona speech, proposal text, systemd state, -Eve/Gjallar projection, and Qdrant progress are forbidden writers. - -All wake sources share one path: pressure -> heartbeat grant -> prepared launch --> packaged coordinator child claim before cognition -> exact process lease -> -bound coordinator terminal receipt -> terminal acknowledgement. Preparation -and grant consumption use one CAS; brake and timeout drain the exact observed -process; coordinator exit zero without its exact receipt fails. The old -source-tree/Cargo swarm wrapper and its `online`, `run`, `run-queue`, `pulse`, -and `epiphany-work` queue authority are outside the live body. Packaging now -requires witnessed sibling roles for swarm, coordinator, model runtime, and the -first-party tool runtime. - -Verification must remain at these typed transitions: CAS/replay, store -separation, release witness, child-claim-before-cognition, exact process -identity, brake/timeout timelines, receipt substitution, and absence of runtime -Cargo/queue paths. One nonblocking hardening note remains: the parent currently -correlates its post-launch process observation with the child's atomic claim. -That is stronger than PID custody and fails closed, but it should eventually be -replaced by an OS-authenticated parent/child launch channel where available. - -This is cognition bootstrap, not deployment admission. Ygg release -`0601e280480cccc28209fbf0630e921f3ef9056d` remains a live advancing candidate -until Idunn publishes the exact typed deployment witness; resident service -installation, writable domain custody, credentials, Persona/Discord ingress, -and the Starfire-offline rehearsal remain required. - -## Resident physiology and Ygg service body prepared locally (2026-07-18) - -Heartbeat `serve` is now the single resident physiology loop: it reconciles an -exact terminal acknowledgement first, retains pressure while braked, emits at -most one grant while clear, never replaces an active coordinator, and performs -bounded void/sleep work only while idle. Restart resumes the typed chain rather -than guessing from process or journal sight. Heartbeat is a required witnessed -release sibling; coordinator and resident Self require the exact authenticated -runtime and an explicit provider. - -`epiphany-swarm status` is non-actuating sight. Its typed resident-readiness -document binds runtime id, release id, release witness, source commit, packaged -binaries, physical store separation, heartbeat/Self freshness and coherence, -active lease sight, runtime-scoped brake, writable workspace, and credential -posture. The existing daemon supervisor remains the sole signed Idunn health -writer and may aggregate the exact heartbeat/Self provider pair. Readiness, -systemd, and PID sight cannot admit deployment. - -The matching `gamecult-ops` cut defines three narrow services: -`epiphany.service` owns supervisor/projector execution and signed aggregate -health; `epiphany-heartbeat.service` owns heartbeat state and grants; and -`epiphany-swarm.service` owns resident-Self state and bounded coordinator -launches. Coordinator, model runtime, and tool spine remain witnessed child -siblings. Yggdrasil's writable organizational Body is -`/var/lib/gamecult/epiphany/workspace`; immutable -`/srv/epiphany/source/current` is release provenance. Bootstrap prepares -protected stores and service-user credentials. Deployment authenticates the -sibling set, initializes heartbeat, manages all three units transactionally, -preserves coverage checkpoints across retries, waits for typed readiness, and -lets Idunn write `deployment.env` only after admission. - -This is ordinary organizational Epiphany. Persistent Modeling maps the bounded -domain; Self derives bounded attention pressure from map drift; Imagination -authors inspectable improvements and feature proposals; the organization talks -to the repository Persona through existing VoidBot/Bifrost Discord ingress. -Feedback and proposals may request cognition. They cannot adopt Mind state, -invoke Hands, authorize Bifrost release, or command Idunn. Those are separate -typed crossings and receipts. - -Live source `0601e280480cccc28209fbf0630e921f3ef9056d`, release -`sha256-f9fbc9c17cfc4038c49f77dd2a238d487b723600127a982dc4ae2ab98b308a77`, -and projector PID `145165` remain the sole first-projection owner. Its Qdrant -collection advanced beyond 6,585 points. `deployment.env` and the foreground -Idunn actuator remain absent, so this is resumable provider evidence, not -admission. Do not interrupt it. After terminal proof, re-enter the exact release -through Idunn, then authorize and deploy the coordinated resident generation. -Before July 22, run Starfire-offline proof of feedback -> persistent map -> -bounded Imagination proposal -> explicit adoption/review -> Hands -> Bifrost -> -Idunn, including the negative that conversation alone crosses no later gate. - -The immediate live wound precedes that work. The workspace projector is the -lifetime owner of `workspace-coverage.cc`, but the supervisor currently opens -that private store to discover and perform recovery. Replace that transitive -authority leak with a provider-signed claim sight published immediately after -acquisition and a host-signed recovery directive consumed by the replacement -projector. Heartbeat remains liveness only. The supervisor must never open or -mutate the coverage store; it declares recovery only after authenticating the -replacement claim sight. Keep Epiphany and Idunn stopped on Yggdrasil until the -corrected exact release is authorized through Bifrost and deployed through -Idunn. No host reboot is authorized. - -## Workspace-coverage recovery ownership cut complete locally (2026-07-18) - -The supervisor no longer opens or mutates `workspace-coverage.cc`, directly or -through an imported recovery helper. The lifetime projector owner publishes a -provider-signed claim sight before its first backend operation. Claim sight is -keyed to the exact current Body observation and generation and binds the exact -launch, provider key, coverage-store binding/file/route, Body basis, claim, -attempt envelope, plan, and recovery lineage. A signed sight from an older Body -is not current recovery authority. - -After exact termination and replacement readiness, the supervisor publishes -one immutable host-signed recovery directive. It binds the authenticated old -claim sight, termination, replacement launch, readiness heartbeat, Body, and -coverage route by exact envelope digests. Reconciliation reauthenticates and -returns the same signed directive byte-for-byte; a later heartbeat cannot -rewrite it, and conflicting lineage is refused. Provider heartbeats now retain -immutable per-heartbeat evidence beside the latest pointer because durable -termination and recovery documents may cite an earlier heartbeat. Causally safe -bounded retirement remains future work; naive deletion is forbidden. - -The replacement projector authenticates the directive and performs the -recovery CAS through its already-held `WorkspaceCoverageAuthority`. Recovery is -idempotent across the CAS-to-successor-sight crash window: an exact committed -successor and receipt are returned on replay, then ordinary acquisition -republishes successor claim sight. A directive naming readiness heartbeat H -remains valid when the same launch/provider has advanced normally to ready -H+1. Heartbeat remains liveness evidence and does not own the lease. - -Focused proof passes: eight process-document tests, the exclusive lifetime -owner test, supervisor authority-order/prohibition test, pre-checkpoint sight, -stale-Body refusal, H/H+1 consumption, immutable directive reissue, conflicting -lineage refusal, exact CAS replay, successor sight publication, `cargo check ---bins`, and `git diff --check`. Soul found no remaining P0/P1/P2. This code is -ready to commit and push, then cross Bifrost/Idunn as an exact release while the -host remains braked. - -## Live deployment and reconciliation split follow-up (2026-07-18) - -Commit `0601e280480cccc28209fbf0630e921f3ef9056d` is pushed, is the sole current -Bifrost release authority, and is running through Idunn on Yggdrasil as release -`sha256-f9fbc9c17cfc4038c49f77dd2a238d487b723600127a982dc4ae2ab98b308a77`. -The detached deployment request remains in progress and `deployment.env` is -absent, so terminal admission is not yet proven. Projector PID `145165` has -remained stable; `body.cc` remained 612,961 bytes; the dedicated coverage store -remained 79,712,256 bytes while its typed state advanced; and the current Qdrant -collection advanced from 193 to 1,621 points. GPU samples show the embedding -model resident and useful intermittent load. Do not interrupt this sole owner -merely because the first full projection is slow. - -Live stdout exposed a remaining conceptual substitution: every healthy claim -was routed through the termination writer and projected as -`awaiting-exact-termination`. The writer refused ExactAlive, so private state -remained safe, but alive, inaccessible, and indeterminate sight were collapsed -into dishonest recovery pressure. The local uncommitted correction gives the -supervisor one typed non-mutating process observation before recovery: -ExactAlive reports `observed-alive`; uncertain sight reports -`observation-degraded`; authority drift reports `observation-refused`; only -proven terminal sight reaches termination, replacement, readiness, and -directive. - -The cut also seals the restart timeline. Claim sight is re-read after immutable -termination to close the pre-first-claim race. A persisted replacement without -a directive is recognized only through exact old-launch, termination, policy, -and causal replacement bindings. The supervisor observes that exact replacement -alive, selects a fresh signed ready heartbeat under the existing 180-second -lease, then re-observes the process immediately at the directive actuation -boundary. Terminal or uncertain replacement sight produces no directive, -termination write, or second launch. Recovery resumption, newly launched -replacement, and immutable directive replay share the same final gate. - -Focused proof passes: ten workspace process-document tests, eight supervisor -workspace-reconciliation tests, all-bin check, diff check, and final Soul audit -with no P0/P1/P2. Behavioral injection proves ExactAlive-to-Missing across the -readiness window performs zero directive/termination/launch writes, while -ExactAlive-to-ExactAlive performs exactly one directive write. Commit and push -this cut next; do not replace the live release until its current projection has -landed terminal proof or a real failure requires recovery. - -## Current organizational Yggdrasil deployment (2026-07-18) - -This section supersedes earlier live-PID and release-progress instructions. -Release `0601e280480cccc28209fbf0630e921f3ef9056d`, projector PID `145165`, and -their Qdrant counts are historical evidence only. The old deployment transaction -was terminated through its rollback boundary, its release authority was revoked, -and its missing final witness must not be reinterpreted as admission. - -The ordinary organizational feedback path is live on Yggdrasil. VoidBot runs as -its host service identity with portable observer-group access and writes atomic -typed observations through the exact Idunn-admitted CultLib runtime. Bifrost is -healthy, bound to six organization channels, and publishes daemon-owned RUDP -health accepted by Idunn. A labeled bound fixture became an immutable admission -receipt with `grantsWorkAuthority=false` and `grantsAdoptionAuthority=false`; an -unbound fixture was refused. Conversation remains feedback pressure only. - -Idunn and Bifrost deployment authority were repaired from the coherent Odin -schema branch. Idunn now kills timed-out Unix command process groups, treats an -absent deployment witness as first-deployment state while refusing corrupt -witnesses, and rehydrates its preserved typed store. Bifrost's release runtime -uses pinned commits and publishes an exact deployed-revision witness. VoidBot -`7c6f0e9e77ef9d2361c9b7a8368f9fdb0b754458` is deployed and witnessed. - -Epiphany `37df884c6411da10196e59b741a538f792deeee5` is authorized through Bifrost -and is being deployed only through Idunn. The canonical writable Body is -`/var/lib/gamecult/epiphany/workspace`; immutable release provenance is not a -substitute. The actuator now writes an engaged typed `scope=all` swarm brake -before starting any Epiphany service. Releasing that brake is a separate -operator action. Until Idunn admits exact signed aggregate health and publishes -`/srv/epiphany/deploy/deployment.env`, the candidate is not deployed. - -## Resident organizational product and authority correction (2026-07-18) - -Epiphany's resident organizational behavior is the product posture, not a -special dogfood mode. A swarm may continuously map its authorized domain and, -from the current admitted model, ask Imagination for bounded proposals without -waiting for a chat instruction. Organization feedback through the repository -Persona is additional attributed pressure, not the ignition key and never -adoption or action authority. - -The old `body-map-drift` pressure was a false measurement: it hashed only the -current RepoModel and compared it to no Body or prior model. It is replaced in -`epiphany-core/src/resident_self.rs` by -`admitted-model-direction-consideration`, bound to the exact current admitted -model revision/hash and unique admission receipt and emitted only while no -terminal direction consideration exists. Imagination remains proposal-only. - -Package construction and application-owned state publication are separate; -Bifrost owns release crossing and Idunn owns deployment. Verifier/status reads -consume immutable provider snapshots without acquiring writer locks. Resident -readiness joins separately owned release, runtime/Verse, provider, Mind, and -brake facts and grants no cognition or action authority. An engaged brake still -permits daemon supervision, leases, health, liveness, and read-only sight while -blocking cognition launches, cognitive-work scheduling, Hands consequences, -publication, and deployment actuation. - -Exact candidate `9165862cce09739a62b20c0c7728ccceb71cfc2f` crossed Bifrost and -built immutable release -`sha256-39eed3817a10325b39b7f223fb2919c5959c88443ef82d9cc1497f6af631f365` -with witness -`sha256-9ad9cfe17fcabffb84fb392cbd5ecc1e8823482a338b38ced52e1020532e80c6`. -It was not deployed. Startup exposed three faults, so all candidate services -and the Idunn transaction were terminated through rollback. There is no -deployment witness or active-release pointer. The immutable package and stable -compiler cache remain reusable evidence only. - -The successor source cuts those faults at their owners. Heartbeat reads only -its typed identities from the mixed heartbeat/readiness store and writes exact -owner entries with CAS, preserving foreign readiness. CultCache now provides a -typed in-memory envelope load primitive for this shared-store view. Cold Self -without thread state emits no direction request yet instead of failing. A -`heartbeat.scheduler` brake blocks cognitive scheduling but does not block -daemon lifecycle physiology; explicit daemon lifecycle surfaces still do. -Focused proofs pass and the full core library reports 570 passed, zero failed, -one ignored. - -Candidate `86d702002acee8321438f32fb9cf69a29a667d70` built and sealed immutable -release `sha256-da19a70a7e8c0229cd59b292bf5867fd1e97fa40643ab772e918c5d49dd7ff22` -with witness -`sha256-62c65d813837dd4a939e941d798d0842ee5f6c77cddaa645f2c47a18b7c3ec44`. -It was not deployed. Projection and Heartbeat were healthy and braked, but -resident Self found a second cold-start path: feedback-driven Imagination -consideration required thread state before a thread existed. Idunn was -terminated through rollback; all services are inactive and no deployment or -active-release witness exists. The immutable package is evidence only. - -That second path now treats absent thread state as a missing prerequisite: it -emits no request, writes nothing, preserves admitted feedback, and retries on a -later pulse. The causal smoke explicitly requires its fixture thread. Focused -Imagination tests, resident-Self tests, and all-bin compilation pass. - -Exact successor `aa3d2330062a34145cb70b527e02fa00215eac1b` was revoked before -deployment because packaging repeated the release-root staging permission -failure with no predecessor alive. This killed the cleanup-race hypothesis. -The real fault was the builder's long-lived write lease over the shared -root-owned release directory. - -Packaging is now source-generation scoped. The packager stages beneath the -exact commit directory and atomically renames the final release within that -same directory, so canonical witness paths do not move. Idunn keeps the shared -release root root-owned and grants the builder only that exact commit directory; -cleanup seals it root-owned and removes only its nested staging. Package tests -pass 12/12, all binaries compile, and the actuator passes remote Bash syntax. - -Next action: commit and push the generation-scoped Epiphany and ops cuts, -install the exact root-owned actuator, then authorize and cross the new exact -commit through Bifrost and Idunn while braked. Verify the typed brake, exact -release/witness bindings, all three service owners, signed Idunn health, local -Qdrant/Ollama routes, and final deployment witness. Then run the Starfire-offline -rehearsal before 2026-07-22: organization feedback -> persistent Modeling map -> -bounded Imagination proposal -> explicit review/adoption -> Hands consequence -> -Bifrost release -> Idunn deployment, plus replay/tamper refusal and the negative -chat-only path. No host reboot is authorized. - -## Generation handoff and resident mixed-store cut (2026-07-18) - -Candidate `03e1afd24546a7ca37e900c47ca26ae257b14161` proved generation-scoped -packaging and sealed immutable release -`sha256-fe7f25ff60d84ae9316d7b4aa2833bd5d1b65189c9d08cc64e903a83d8f35268`. -Its first application publication failed because the exact commit parent was -still builder-owned mode 0750; cleanup sealed that parent and an automatic -retry reused the exact package and started all three services. The actuator now -seals the exact generation parent root-owned mode 0755 before handing -publication to the application owner. - -The candidate was not deployed. Projection and Heartbeat were healthy and -braked, but resident Self treated the shared resident/readiness CultCache store -as if every row belonged to Self and rejected the legitimate provider-readiness -document. The exact process group was terminated, all services were stopped, -`active-release.env` was removed, and no deployment witness exists. Resident -Self now loads only its six owned typed families into its in-memory view, -rejects duplicate owned identities, and leaves foreign readiness rows intact. -Focused resident proof passes 12/12; full core proof passes 572/572 with one -ignored. - -Next action: commit and push both cuts, install the exact ops actuator on -Yggdrasil, revoke obsolete Bifrost authority, authorize the new exact Epiphany -commit, and let Idunn deploy under the engaged brake. Require the immutable -package/witness, all three healthy service owners, signed aggregate health, and -`deployment.env`; then prove the ordinary organization loop and its negative -authority boundaries. No host reboot is authorized. - -## Managed-policy rotation preserves historical process evidence (2026-07-19) - -Exact candidate `2d4c92d24c2007858914d352b5892f599e6a20e9` sealed release -`sha256-1dd1271405e82958df2c03133b0d89d2555a8a3c7013486e1c41465ec84f6b3c` -and witness -`sha256-e01803545e557488cf2a0a42c31bb65e17ff7ead21790d7c982216901d94e12b`. -The generation handoff and resident mixed-store repairs held: all three services -started, Heartbeat remained braked, and resident Self remained stably braked. -Workspace coverage did not launch because its prior signed launch was checked -against the newly written current managed policy and became impossible to -observe, terminalize, or replace. The exact transaction was rolled back, -Bifrost authority revoked, services stopped, active pointer removed, and no -deployment witness exists. - -The source authority is now split correctly. Historical host-signed launch -evidence remains authentic across policy rotation and may prove only exact -process identity and immutable termination. New process admission still -requires the exact current policy digest. Reconciliation terminalizes the stale -identity without deleting history, then launches a causally bound replacement -under the current policy. Public current-process observation continues to reject -stale launches. Focused process tests pass 11/11, supervisor authority tests -pass 24/24, full core passes 573/573 with one ignored, and all binaries compile. - -Next action: commit/push the successor, cross its exact SHA through Bifrost and -Idunn under brake, and require historical terminal evidence, current-policy -replacement launch, three stable services, signed aggregate health, and the -final deployment witness before rehearsing Starfire-independent operation. - -Candidate `b5405beaa95cddc837f3b7a7ca268ac9b5ae4502` then proved the historical -authenticator shipped but exposed an ordering fault: reconciliation asked -provider claim sight to authenticate before it inspected the supervisor-owned -latest launch. Claim sight correctly rejected the stale policy, so the new -rotation branch was unreachable. The candidate was rolled back, its authority -revoked, services stopped, active pointer removed, and no deployment witness -exists. Reconciliation now loads latest launch and completes stale-policy -rotation before current claim authentication. Provider claim state participates -only after a current-policy launch exists. Supervisor proof passes 24/24 and -full core remains 573/573 with one ignored. - -Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` then crossed the first two -rotation cuts: supervisor PID `1147968` launched replacement workspace -projector PID `1148157`, and the replacement published advancing ready -heartbeats under the new policy while the brake held. Recovery still stalled -because the old Body claim was readable only through current-claim -authentication, which correctly rejected its historical launch before the -mismatch branch could issue a recovery directive. The candidate was rolled -back and revoked; no deployment witness exists. - -Claim sight now has separate current and recovery readers. Current -authentication remains mandatory for provider projection work and refuses a -stale launch. Recovery authentication proves only the old signed -claim/Body/route lineage. Supervisor recovery and directive writing use that -historical reader, while the replacement launch and ready heartbeat remain -bound to the current policy. The atomic lease-transfer path also authenticates -the old launch historically. The full causal test now performs real policy -rotation and proves current refusal, historical recovery, directive fencing, -lease transfer, successor current sight, exact replay, and tamper refusal. Full -core passes 573/573 with one ignored; all binaries compile. - -Candidate `351355d3baee2d475f84168136380d2f50197ef8` reached live runtime with all -three service owners active and the brake engaged, but emitted -`authenticated claim sight does not name the current managed launch`. The old -claim named the original historical launch while successive failed deployment -attempts had created a valid signed chain of replacement generations. Recovery -still required the current launch to be the old claim's direct child. The exact -Idunn process group was terminated, services stopped, active pointer and -witness removed, and Bifrost authority revoked; no deployment witness exists. - -Recovery now proves ancestry rather than pretending retries did not happen. -It walks backward from the selected current-policy launch to the claimed -historical launch, authenticating every host-signed launch, exact parent -termination id and envelope digest, and termination-before-child chronology. -It refuses cycles, missing ancestors, broken edges, and a non-current endpoint. -Directive writing, directive receipt verification, atomic lease transfer, and -supervisor crash-resume use the same lineage proof. The supervisor publishes -the actual lineage error instead of collapsing it into a generic mismatch. -The causal test now includes an intermediate failed-deployment generation and -passes the complete recovery transaction. Full library passes 573/573 with one -ignored; supervisor authority tests pass 24/24. - -Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` crossed the lineage gate and -supervisor published recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` -from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch -`9414c32f-f53c-450c-bc19-a69f5ba04a29`. The projector still refused every -pulse because it authenticated current successor claim sight before consuming -the directive that creates that successor. Supervisor replayed the exact -directive safely, revealing a circular ordering fault rather than missing -evidence. The candidate was rolled back and revoked; no deployment witness -exists. - -Projector pulse now authenticates and consumes a replacement-addressed recovery -directive before retirement or ordinary projection work. The atomic recovery -transaction is already exact-replay idempotent, so no speculative current-claim -query is needed in front of it. Current claim sight is recovery output, not -recovery input. A source-order test makes the authority ordering explicit. Full -library passes 574/574 with one ignored; supervisor authority tests pass 24/24. - -## Ordinary organizational product and current readiness refusal (2026-07-19) - -The Yggdrasil body is the normal organizational Epiphany product, not a special -experiment or dogfood mode. Persistent Modeling maps the authorized domain. -Resident Self may derive direction from the admitted map and ask Imagination -for bounded proposals without waiting for an instruction. Organization members -talk to the repository Persona; their attributed conversation becomes -additional feedback pressure. Conversation is not the ignition key and cannot -adopt Mind state, authorize Hands, grant Persona public speech, cross Bifrost, -or ask Idunn to deploy. Those remain distinct explicit authorities. - -Exact candidate `9e1fa0f527b3bff2c5a709eff640b0d8d2f3b82d` consumed recovery -directive `6f1dc0c8-b8a5-48d0-add5-761b17368fbf`, replaced historical claim -`c6df4335-7080-4d5f-80fc-4fa18a9d16ce` with current claim -`2a355736-3792-4f0f-8633-a246219bcf1b`, and completed a 14,793-point local -Qdrant projection through Yggdrasil's GTX 1080-backed Ollama route. Its three -service owners remain active with zero restarts and the all-scope deployment -brake engaged. It is not deployed: Idunn's exact transaction PGID `1245215` -still owns the candidate, `deployment.env` is absent, and typed resident -readiness remains `warming` because both provider comparisons refuse. - -Both provider rows continue to refresh, name the exact release -`sha256-0a15262fd4c240a0131755aa6eb63b4eb7feff12e7cc4f49128fbb001887b1f2`, -witness `sha256-49ae1afcf11d18c0e2807ea53f54dba35df4280f6596e848c5cfc50328e01aea`, -source commit, executable, and local status `ready`. The old diagnostic -`stale or release-substituted` collapses owner, runtime, release, witness, -source, executable, provider status, process incarnation, future time, and -freshness into one useless phrase. Replace that opaque boolean with the same -fail-closed predicates plus operator-safe failed-predicate names; do not relax -admission. Keep the bounded diagnosis window while the Idunn transaction and -brake remain exact. If transaction ownership or the brake disappears, or any -protected surface actuates, use the existing rollback boundary immediately. - -The diagnostic successor `c9e9a352bde640d03a2e2394de1b22477a23ee96` -named the shared refusal exactly: both providers failed only -`process-incarnation`. The native observer compared the complete -`ProcessInstanceIdentity`, including optional `created_at_rfc3339`, while -resident readiness deliberately reconstructs authority from PID, native -creation token, and executable path without that display timestamp. The same -live process was therefore classified as replaced. `created_at_rfc3339` is now -explicitly derived/display-only; Windows and Linux compare only PID, native -creation token, and executable. Exact token and executable substitution still -refuse. Focused process-observation and resident-readiness suites pass. Replace -the braked, unadmitted `c9e9a352` transaction through Idunn after committing -this cut; do not reinterpret the current candidate as deployed. - -Candidate `5e298e637d3470828fec3b26feeaa550a0ad91f9` proved resident readiness and -the installed operator check healthy under the `epiphany` runtime identity, -with all three services stable and the all-scope brake engaged. Idunn still -withheld final admission because workspace coverage had already terminalized -under a historical managed launch, while the restarted projector obeyed a -stale recovery directive before recognizing that durable terminal authority. -It first rejected the new launch as the owner of the old terminal receipt and -then refused to recover the already-succeeded claim. - -Terminal coverage authority belongs to the succeeded claim and its historical -managed launch. A later daemon may authenticate and reuse the immutable signed -terminal sight, but cannot rewrite it or inherit the receipt. Projector pulse -now classifies current terminal coverage and republishes that historical sight -before considering process-recovery pressure; recovery still precedes every -nonterminal acquisition or claim path. The real checkpoint-to-terminal fixture -proves a different later launch receives the original sight byte-for-byte, and -the service ordering proof fixes terminal classification before recovery and -recovery before new Body work. - -The terminal-authority correction is committed and pushed as exact successor -`519574ce0d63ffa8fa813885c6629c664a3ae2e0`. - -Candidate `5e298e63` is revoked and its exact Idunn PGID `1485835` completed -the installed signal-safe rollback boundary: all three services, both current -links, both manifests, and the deployment lock were absent afterward. Bifrost -then authorized exact successor `519574ce`, and Idunn command -`manual:redeploy:yggdrasil-epiphany:unix:1784440234` owns its detached build -and deployment under the all-scope brake. - -Next action: monitor Idunn's exact successor transaction. Require historical terminal-sight reuse, -three stable services, typed resident readiness, signed aggregate health, and -`deployment.env` before beginning the ordinary organizational product loop. - -Candidate `519574ce0d63ffa8fa813885c6629c664a3ae2e0` sealed release -`sha256-3bfbd4640f7259613ea6146fe80d6a68c9be55edb1ad100fb3c39a4f0e040e3e` -and started all three braked services with zero restarts. The installed -pre-witness check was healthy, proving terminal coverage and resident readiness -were present, but the workspace projector still refused every pulse with -`workspace coverage launch disagrees with current managed policy`; the -supervisor then issued recovery directive `9084c09e-1da9-4187-acd4-6b214edd7fb2` -for the already-succeeded claim. Idunn correctly withheld signed admission and -`deployment.env`. - -The surviving obsolete owner was inside terminal-sight authentication itself. -Both advancing and terminal sights shared current-policy launch authentication. -That is correct for a live advancing lease and wrong for immutable terminal -proof. Sight authentication now has an explicit authority split: advancement -requires a current-policy launch; terminal requires its exact historical -host-signed launch and envelope. Policy rotation cannot invalidate or re-sign -the succeeded claim's sight. The real checkpoint-to-terminal fixture now -rotates managed policy before a later daemon reuses the original sight -byte-for-byte. - -Next action: commit/push this correction, revoke `519574ce`, terminate exact -Idunn transaction PGID `1534830`, verify signal-safe rollback, then cross the -exact successor through Bifrost and Idunn under brake. - -Candidate `cb665dc6362027a06d46c3fc856c8740f4ab50ce` proved the projector-side -cut: release `sha256-026f83064dc1f20c6ae1d0528878ec96594d08692fb7ab3c0ccd24f48cd8aa46` -reused terminal receipt `bf744be34d4c969db6b74b4813caa24e231f341ea13a9346d16457188b1b77d9` -and remained idle across repeated pulses. All three services were stable, -braked, and the full pre-witness check became healthy. Idunn still withheld -admission because the supervisor independently ignored terminal sight and -selected recovery claim `2a355736-3792-4f0f-8633-a246219bcf1b`, publishing -bogus directive `7fb0a855-626a-4f94-bde2-cc88acad918c`. - -Supervisor reconciliation now gives authenticated terminal sight its own -process-lifecycle path before recovery claim selection. It proves any current -observer is a host-signed descendant of the historical terminal launch. A live -observer reports `terminal-observer-alive`; degraded sight does not actuate; a -dead observer is terminated/evidence-fenced and replaced without writing a -coverage recovery directive. Recovery authority remains exclusively for a -nonterminal running claim. Focused supervisor authority tests prove terminal -selection precedes recovery and the entire terminal branch contains no recovery -writer or coverage-store mutation. - -Authority map for the successor is now explicit: - -- Owner: the projector alone owns coverage obligation, claim, recovery, receipt, - terminal sight, and coverage-store mutation. The supervisor alone owns managed - policy, process launch, observation, termination evidence, and causal process - replacement. -- Inputs: the terminal branch reads authenticated historical terminal sight, - current managed policy/latest launch, host-signed replacement lineage, and an - exact native process observation. It does not read private coverage state. -- Outputs: operator-safe alive/degraded/refused status, or immutable termination - evidence plus a causally bound replacement launch after proven process death. -- Derived state: `terminal-observer-alive`, degraded observation, and the current - observer launch are process projections only. They neither own nor refresh the - historical terminal receipt. -- Forbidden writers: no terminal branch may publish a recovery directive, open - the coverage store, recover a claim, rewrite terminal sight, or mutate a - succeeded claim. Recovery claim selection is unreachable after terminal sight - is selected. -- Shared paths: historical and descendant observers share lineage - authentication; alive, degraded, and dead classification share the exact - native observation; dead replacement shares the ordinary immutable - termination and `service_launch_internal` primitive. -- Cut line: the supervisor's old fall-through from succeeded terminal sight into - recovery-claim selection is removed. Terminal coverage and observer liveness - are no longer one authority. -- Verification layer: focused tests currently prove source ordering and the - absence of recovery writers in the terminal branch. Live certification must - still prove the actual terminal status, absence of a new directive, unchanged - signed terminal sight, stable services, signed aggregate health, and final - Idunn deployment admission. The structural tests are not that runtime proof. - -The correction is committed as exact successor -`84e648eb374f107f26258ae96f05932c812dffae`. Candidate `cb665dc6` was revoked -and rolled back. The successor is crossing Bifrost and Idunn under the all-scope -brake. Next action: monitor only that exact transaction and require the live -verification layer above before beginning the ordinary organizational product -rehearsal. No host reboot is authorized. - -Live certification refused `84e648eb` at the correct boundary. The supervisor -selected the terminal-observer path but emitted `terminal-observation-refused`: -the Ygg runtime has no repository Body-store binding, so it cannot authenticate -which repository Body the historical terminal sight belongs to. Idunn withheld -the deployment witness. The exact Bifrost authority was revoked and only Idunn -transaction PGID `1597264` was terminated; rollback left `epiphany.service` -inactive with no current link, active-release document, or deployment witness. -The next cut is not an observer bypass. Modeling must identify the owner of the -typed runtime-to-repository Body binding and make that binding available to -terminal observer authentication, preserving projector-only coverage authority. - -The Body-binding correction is committed and pushed as `67f0fe0b44357c56c98f82499cdfa3ae7b944e09`. -The supervisor bootstrap already published the typed runtime-store binding and -repository Body-store binding; the live fault was reversed arguments at the -terminal-sight call site. The corrected candidate proved -`terminal-observer-alive`, three stable services, the all-scope brake, and a -healthy pre-witness check. It did not receive a deployment witness because -Idunn's automatic target worker published a newer request while the manual -deployment still owned the actuator, superseding the typed current-request -head. The candidate authority was revoked and exact process group terminated; -rollback left all Epiphany units, current pointers, active release, and -deployment witness absent. - -Idunn's authority split is repaired in Odin commit -`eefd47f` (`codex/ygg-organizational-idunn`). A per-target local gate serializes -manual and automatic command lifetimes. More importantly, the persistent -current-request CAS chain refuses replacement until the exact predecessor -request has an exact terminal result, so restart or duplicate processes cannot -steal a live head. All 48 Idunn tests pass and an independent Soul re-audit found -no release blocker. Ygg now runs that binary as PID `1673938`, zero restarts, -SHA-256 `49e09d1989342737f6c996be267894555e8c23886f090a5ae5d334e4aa29ff8d`; -the prior binary is `/usr/local/bin/idunn.20260719-072532.bak`. - -Bifrost correctly refuses reauthorization of revoked immutable authority for -`67f0fe0`. The next action is therefore to commit/push this persisted Epiphany -state as a new exact successor, authorize only that commit, and perform one -Idunn-owned Ygg deployment under the all-scope brake. Certification requires a -single stable deployment request head, `terminal-observer-alive`, three stable -services, exact signed health admission, and final `deployment.env` witness. - -After certification, treat the organizational loop as normal product behavior, -not an experiment. The existing runtime autonomously turns admitted Modeling -direction into an Imagination option, and Persona feedback is authenticated -additional pressure. The missing bridge is option result -> immutable -`RepoFrontierWorkProposal` with exact model causality -> automatic Self -selection for Modeling review -> admitted frontier item -> existing Imagination -planning -> explicit Mind adoption -> Hands. Proposals and conversation must -remain structurally unable to grant Mind, Hands, Persona public speech, -Bifrost release, or Idunn deployment authority. No host reboot is authorized. - -## Idunn observation/actuation authority split (2026-07-19) - -The e449 successor reached exact resident readiness, stable terminal coverage, -and three healthy braked services, but produced no Idunn witness. Commit -`75bd5f2` moved the mutex without separating the automatic target task: that -task still awaited the long deployment command and could not re-evaluate the -new Epiphany RUDP health needed to finish it. The exact deployment PGID was -terminated, rollback removed all services/current pointers/witnesses, and -Bifrost authority for e449 was revoked. - -Odin commit `a17b0b6` is the actual authority split. The target loop remains -continuously available for observation, evaluation, admission, and publication. -Deploy/restart consequences run separately under one per-target reservation; -manual and automatic paths share it, and stale automatic work is dropped while -the actuator is occupied. Durable request-head/result CAS remains unchanged. -All 49 Idunn tests pass. No Ygg deployment has yet used this binary. - -The autonomous option-to-frontier bridge is now locally release-ready. A typed, -immutable deployment-configured repository-domain binding joins runtime, -swarm, workspace, and the exact Body binding. It is an organizational label, -not authenticated Git-remote identity. Promotion reloads the exact direction -request/result, worker result and launch, admitted model and receipt, canonical -Body Git root, and domain binding before one CAS creates an inert proposal and -Self selection for Modeling. Generic Imagination intake cannot forge this path. -Proposal Modeling may recommend only Imagination and may not carry an adopted -plan; ordinary Evolution cannot mutate frontier state. The hostile full-chain -test attempts a proposal-citing direct Hands route, is rejected with a -byte-identical store, and leaves Hands empty. Full core proof is 578 passed, -zero failed, one ignored; all binaries compile; Soul found no release blocker. - -Live certification of state-only Epiphany commit `36f687e` exposed a separate -Idunn verifier wound. Epiphany sent a 2,260-byte signed active health document -with the exact request, release, witness, commit, signer, and Body terminal -receipt. Idunn received it but tried to create -`/etc/gamecult/idunn/epiphany-health-identity.ccmp.lock` while reading the -root-owned trust anchor, so no signed admission or deployment witness was -published. Making the config directory daemon-writable is forbidden because it -would let the verifier alter its own trust root. Odin commit `64bb679` uses an -atomic read-only CultCache snapshot for this one pinned-anchor read, proves no -sibling lock in a read-only directory, and passes 50/50 Idunn tests. - -Next action: install exact Idunn `64bb679` on Ygg, allow the incomplete -transaction to roll back cleanly, then retry the exact Bifrost-authorized 36f -release under the all-scope brake. Require signed active admission and final -`deployment.env`. Then commit/push the autonomous bridge and certify its exact -successor separately. No host reboot is authorized. - -## Ygg resident baseline certified (2026-07-19) - -That crossing is now complete. Idunn `64bb679` is installed at SHA-256 -`bad36e84706ec0a2354012d11aa7556fd0bd2f01484c36d3a5d0bc0b8390485f`. -The incomplete transaction rolled back with all units and candidate witnesses -absent, then typed redeploy intent -`manual:redeploy:yggdrasil-epiphany:unix:1784452916` retried exact commit -`36f687eaa34153a166b5860087c28f8847244823`. Idunn first admitted signed -degraded health while one service reconciled, then admitted the exact active -candidate and published deployment manifest v2 at `2026-07-19T09:23:14Z`. -Release id is -`sha256-a9afe96abf5b104da3d25bf5e11b967de546c57a230fa155b3cbb98c3b176385`; -witness is -`sha256-f6b4c68054ce9566002e46d49e8773924d3518afdd02798e1a09f1778359d3c2`. -Idunn, supervisor, Heartbeat, and resident Self are active with zero restarts; -the full Ygg typed check passes; no trust-anchor lock exists; the all-scope -deployment brake remains engaged. - -The autonomous organizational bridge is committed and pushed at `fc733675`. -Next commit this certification state, cross only that exact successor through -Bifrost and Idunn under the brake, then prove Persona/Discord replay and tamper -boundaries plus Starfire-independent operation before granting any wake. - -## Autonomous successor refused; cold-start owner corrected (2026-07-19) - -Bifrost authorized and Idunn attempted exact successor -`2d21c48d7425c3d6d692e506e1981f92991d82ac`. Idunn correctly refused final -admission: `epiphany-swarm.service` restart-looped with `autonomous proposal -promotion requires thread state`. The deploy process was terminated and -rollback restored exact 36f source, active release symlink, release environment, -supervisor, and Heartbeat. Resident Self is intentionally stopped until the -corrected successor crosses; this prevents durable proposal pressure from -retriggering the old binary's fault. The all-scope brake remains engaged. - -The fault belonged to promotion intake. Absent thread state during cold start -means no proposal is eligible yet; it is not corrupt state. Promotion now -returns an empty result without writing when the thread is absent. Present but -malformed authority still fails. A focused byte-identity negative test passes, -and the complete core library proof is 579 passed, zero failed, one ignored. - -Separately, `gamecult-ops` commit `584b94c` moves clone/build/package/verify -before the service stop. Packaging failures can no longer blind the active -body; the remaining outage begins only at canonical Body mutation/promotion. - -Next: commit/push this correction and state, revoke refused 2d authority, -authorize only the corrected exact commit, install/use the ops cut, and deploy -through Idunn under the brake. Admission requires all three units active with -no restart growth and exact signed health. Then run the Starfire-offline -Persona/Discord feedback rehearsal. No host reboot is authorized. - -## Corrected organizational resident admitted (2026-07-19) - -The cold-start correction is committed and pushed as -`154dc1eadd98dda25916ee40e7130770e145e874`. Cancelling the refused 2d -actuator exposed a separate Idunn recovery wound: its child process died with -the daemon, but the exact deployment head survived without a terminal result -and permanently blocked supersession. Odin commit -`15a744c826f0aa2e8cc322a6543ea8a9afcd852a` repairs the owner: fresh Idunn -startup CAS-terminalizes only an exact unresolved prior-incarnation request as -failed. It passes 51/51 tests. Ygg runs that binary at SHA-256 -`c441b9e58e85aff1d869b1e07b0a12a4795c6805619ce640184dbdcfce4e7e03`. - -The deployment purification cut also needed package-directory traversal. -`gamecult-ops` commits `584b94c` and `46425f9` keep packaging before the outage -and seal package directories `0555`; files retain their built execute bits. - -Exact 154d is now Bifrost/Idunn admitted on Yggdrasil: - -- authority digest: `d7e21f11d758e3ebaa46945ddd7acca1417ab8f8a81c3ec1932f3d5e0109e72f` -- release: `sha256-16c51bb3b4914578213f0d0b64e40e17982ad45832e073d747db903509f237ed` -- witness: `sha256-85702cf922ea32c07457630a7911b2b9196c8b58ee4baa642185a0b77902f234` -- Idunn request: `deploy:yggdrasil-epiphany:unix:1784456326` -- manifest time: `2026-07-19T10:20:04Z` - -The full typed check passes. Signed health names the exact source, release, and -witness. Supervisor and Heartbeat have zero restarts. Resident Self is stable -on one MainPID; its historical restart counter remains 10 without growth. Its -operator projection is braked, revision zero, no active turn, and no private -state exposure. GPU embedding remains 100% on the GTX 1080. - -Next: run the Starfire-offline real Discord/Persona feedback rehearsal wholly -on Ygg, proving replay/tamper refusal and byte-identical Mind, Hands, release, -and deployment stores. Then audit the Discord operator surface needed during -the move. No wake grant and no host reboot are authorized. - -Modeling confirms that current feedback is safe cognition pressure, not remote -operation. Status beyond generic VoidBot provider availability, brake -sleep/wake, operator-objective pressure, and exact Mind review still require a -local CLI/SSH path. Starfire is not intrinsically required, but Discord has no -typed ingress for those owners. Current Discord replies are local VoidBot -repo-Face turns; resident Epiphany has no correlated Persona speech return -path yet. - -The authority/design map is now -`notes/epiphany-discord-operator-nerve.md`. July-22 commands are explicit -status, sleep, wake, directive, reviews, and exact Adopt/Refuse/Hold review: -Discord authenticates, Bifrost signs an expiring capability-bound command, -Epiphany invokes one named owner primitive, and a sealed Epiphany result returns -to Discord. No chat inference, generic argv, direct store mount, wake-and-run, -or release/deploy authority is permitted. - -Epiphany core commit `f1036abd` now implements Status, Sleep, Wake, and -Directive as a closed typed command family. Admission is separately -Bifrost-signed and exact-target/guild/channel/actor-capability/nonce/TTL bound. -Invalid admission writes nothing. Replays recover after crashes both before and -after the owner consequence. Sleep owns one fixed Discord brake and cannot -replace a foreign engaged brake. Wake releases only that brake; the live -deployment brake produces a terminal Refused result and survives byte-identical. -Wake creates no pressure/grant/job. Directive creates one pending -operator-objective pressure only. Focused proof is 4/4; full core is 583 passed, -zero failed, one ignored. - -No live daemon/CultNet ingress exists yet, and reviews/review are not in the -core family. Bifrost and VoidBot Hands passes are now building the explicit -owner-only crossing against f1036abd. After those land, add the supervised -Epiphany network ingress and host-sealed result receipt; do not mount Epiphany -stores into either sibling. - -## Live organizational feedback half proved; projection lie cut (2026-07-19) - -The Ygg production Bifrost feedback provider is ready with six typed bindings. -The live stores contain one real VoidBot Discord observation, one Bifrost-signed -delivery, and one Epiphany local pressure admission. Re-import through deployed -154d is byte-identical across the delivery, admitted-feedback, Mind, runtime, -and deployment stores. An alien signing identity is refused before writes. A -substituted repository finds zero applicable deliveries and writes no -feedback/Mind/runtime state. - -That zero-delivery probe exposed a diagnostic conceptual substitution: -`epiphany.persona_feedback.ingress_projection.v0` printed `status=admitted` and -`admittedCount=0`. No consumer depends on it. Successor source deletes the v0 -lie and emits typed v1 status `pressure-present` or -`no-applicable-deliveries`, with `applicableDeliveryCount` and -`presentPressureCount`. Its focused test and binary check pass. - -Source inspection proves the local Persona response path is independent of -observation export: VoidBot queues the repo-Persona turn first, then launches -the three-attempt export asynchronously. Export failure therefore cannot -suppress the local response. - -The final live pressure-to-Imagination scheduling step is intentionally not -run while the all-scope brake is engaged. Do not release it to flatter the -smoke. Modeling is mapping the separate move-period Discord operator nerve; -before July 22, essential status/sleep/wake/directive/review must not depend on -Starfire or improvised SSH, and Persona conversation must remain pressure -rather than Mind/Hands/release/deployment authority. - -## Idunn outward authenticated-provider-health authority mapped (2026-07-19) - -The organizational posture is ordinary product behavior, not a special-case -experiment: Modeling persistently maps the authorized domain, Self derives -bounded pressure from that map and attributed organizational feedback, -Imagination may propose improvements and features without an instruction, and -the organization may converse with the repository Persona. Feedback remains -pressure; it cannot adopt Mind state or grant Hands, release, deployment, Wake, -or public-speech authority. - -Odin commit `be8836f` closes generic signed-health ingress but deliberately -does not make the source deployable. The outward health seam is a narrow -Idunn-owned authenticated-provider assertion derived from the current signed -provider statement, authenticated admission, exact root trust binding, and -current deployment lineage. It is not Idunn's complete managed-health -judgment: missing publication, release drift, and dependency failure remain -absence and cannot be squeezed into a provider state. Idunn signs a bounded -monotonic projection with its own typed service -identity and writes only a dedicated public CultCache store. Its private -identity store and private operational/admission store remain physically -separate. A generic CultNet filtered-snapshot server serves the exact public -bytes; Odin is transport, never health authority. - -Epiphany must query this surface without mutating a consumer cache, pin Idunn's -public trust anchor independently, and verify signature, strict schema, -freshness, replay order, requested daemon/contract/runtime, and exact current -release/deployment lineage locally. Both Epiphany and Bifrost projections are -required independently; one cannot mask the other. Unsigned diagnostics, -provider-signed packets, process/PID sight, coordinator readiness, and transport -success cannot fill a missing projection. Discord receives only the bounded -verified lowering. - -The reusable substrate cut is: extract Epiphany's typed immutable identity -enrollment/signing machinery into CultNet with compile-time profiles; preserve -Epiphany's existing wire domains while giving Idunn a distinct profile; promote -the existing CultNet snapshot example loop into a generic read-only server. -Linux custody on Ygg is honestly only an -`os_installation_file_bound_cloneable_baseline` until a stronger protector is -added. Do not use a raw 32-byte Idunn key file or pretend the baseline is TPM -custody. - -Next: finish contracts, identity, Idunn projection/publication, pure query, and -Epiphany verification; migrate both publishers and root bindings as one safe -deployment slice. Keep the canonical brake engaged and do not deploy the -partially migrated Odin source. - -Soul found and Hands cut the first outward contract before runtime work: -`idunn.managed_health_projection.v1` was a conceptual substitution because its -shape could only describe authenticated provider health. Odin commit `99ed509` -replaces it with `idunn.authenticated_provider_health_projection.v1`, removes -free-form detail, permits only closed state-derived reason codes, and fixes the -typed signing purpose to -`idunn.authenticated-provider-health-projection.v1`. Commit `2dbd7f2` also -requires canonical positional MessagePack at signed-health ingress and samples -admission time at millisecond precision, preventing semantically equivalent -wire encodings and second truncation from changing later digest/read truth. - -## Organizational mode and transactional deployment correction (2026-07-20) - -Epiphany's autonomous organizational posture is ordinary product behavior, not -a dogfood exception. Modeling maintains the persistent typed map of the -authorized organizational domain. Self derives direction and bounded pressure -from that map plus attributed feedback. Imagination may propose improvements -and features without waiting for a direct instruction. Persona is the -organization-wide conversational membrane through which people can inspect, -challenge, and refine those proposals. Feedback remains pressure: it cannot -adopt Mind, grant Hands, Wake, release, deployment, or public-speech authority. - -The exact d841 deployment reached package completion but failed before -promotion because the candidate `epiphany-operator-command` required -`--provider-ttl-millis` while the installed systemd unit was an older -generation. Idunn recorded failure without restoring the active chain. No new -release or deployment witness was promoted. The old bcff generation was then -explicitly restored: supervisor, operator command, Heartbeat, swarm, and the -supervisor-owned semantic projector are active from the old release with zero -restart growth. The canonical Epiphany all-scope brake and Idunn deployment -brake are engaged; swarm reports braked. - -The root fault was split generation authority: bootstrap owned the four unit -files while deployment owned binaries, links, and lineage. `gamecult-ops` -commit `64a0965` makes one Idunn transaction snapshot, promote, or restore all -four unit files together with Body, app/source links, lineage state, -enablement, and prior active organs. Generic cleanup no longer acts as a second -service-restoration owner. Rollback verifies prior unit bytes and active states -and returns a distinct critical failure if restoration is incomplete. A -filesystem/fake-systemd failure-injection harness models the d841 incompatibility -and proves exact restoration plus loud rollback failure. Focused operator -wiring and rollback checks pass; the commit is pushed. - -Next: install exact ops `64a0965` on Ygg without opening either brake. Create a -meaningful Epiphany successor to d841, revoke d841 authority, authorize only -that successor, observe its fresh request, and grant exactly that request for -no more than fifteen minutes. Re-engage the Idunn brake immediately on terminal -result or unknown consequence. Accept only an exact signed live witness with -all organs stable; on failure require the old generation to be completely -active. Then prove complete and one-missing-provider Discord Status. Do not -test Wake and do not reboot Yggdrasil. - -The exact 0e request (`seq268`, request digest `279d3a33...`) was granted once -and failed safely before the actuator body at `2026-07-20T02:57:59Z`: -`/usr/bin/env: bash\r: No such file or directory`. The manual ops-only install -had compared Windows working-tree bytes to themselves rather than canonical Git -blob bytes. Idunn's deployment brake was immediately re-engaged. The canonical -swarm brake remained engaged. No cutover, unit installation, Body mutation, -link change, or witness promotion began; the exact old bcff generation and all -five organs remained active on unchanged PIDs. - -The repair is not an operator-memory rule. `gamecult-ops` commit `3676a61` -rejects CRLF-contaminated actuator and unit inputs at bootstrap, while retaining -the transactional cut from `64a0965`. Install the artifacts from a clean Linux -checkout of exact `3676a61` and prove their bytes against canonical Git objects. -The failed seq268 request is terminal and must never be replayed or regranted. -Authorize only a new meaningful Epiphany successor, accept only its fresh exact -request, and keep both brakes engaged except for that one bounded Idunn grant. - -The next exact successor `20515d37` produced fresh request seq269 and entered -the corrected LF actuator, but failed at candidate unit installation because -Idunn's `ProtectSystem` namespace made `/etc/systemd/system` read-only. Rollback -hit the same boundary and correctly returned CRITICAL/status 125 rather than -claiming complete restoration. The unit writes never began, so the prior unit -bytes remained intact; app/source pointers and lineage remained bcff, and the -old supervisor, operator, Heartbeat, swarm, semantic projector, and workspace -projector restarted from bcff. Both brakes are engaged and Idunn is stable. - -The missing authority is now explicit. `gamecult-ops` commit `a281e38` grants -the Idunn service sandbox write custody only to the four named Epiphany unit -files; it does not grant broad `/etc/systemd/system` access. Focused operator -wiring tests require those exact paths and reject directory-wide custody. Next -install exact a281e38 under both brakes, verify the Idunn restart and old body, -then use only a fresh exact Epiphany successor/request. Seq269 is terminal and -must never be replayed or regranted. - -## Native MCP authority cut (2026-07-21) - -Tool execution no longer crosses vendored Codex. `epiphany-tool-mcp-runtime` -owns execution of one admitted typed intent and persistence of its typed -receipt. It owns the native `epiphany_source` capability and Epiphany's -endpoint, process, network, timeout, catalog, and receipt policy. The official -RMCP Rust SDK owns MCP lifecycle and wire behavior only. Root-owned -`.epiphany/mcp.toml` configuration may admit foreign stdio or Streamable HTTP -servers; the model cannot configure endpoints. Codex auth, config, MCP, and -app-server are absent from the tool path, the old -`epiphany-tool-codex-mcp-spine` is deleted, and there is no fallback. - -This makes tool execution provider-independent, not model execution -provider-neutral. `epiphany-openai-runtime` still defaults to `openai-codex`, -supports OpenAI-shaped transport, and resident policy still carries -`codex_home`. After the braked Yggdrasil deployment transaction is resolved, -the next liberation cut is a provider-neutral model transport and auth policy -that can admit DeepSeek/Kimi without subscription custody. Do not describe the -RMCP cut as subscription independence. -## July 22 live provider-health and Persona deployment audit - -The earlier claim that Epiphany required VoidBot for Persona/Discord cognition -was false. Epiphany owns Heartbeat/CTB, Projector -> Persona -> Interpreter, -Mind effects, signed Persona requests, and result reconciliation. Bifrost owns -only Discord transport/admission/delivery receipts. VoidBot is not an Epiphany -runtime dependency. - -Live Yggdrasil dogfood proved and fixed three wire/control faults: - -- Epiphany commit `daeeff933c5f04c15e3f2281b8b53dcaad3d32d5` - publishes the canonical CultNet source role `daemon-health-publisher`; its - exact tuple test passes. Idunn accepted its signed candidate health as - `authority=authenticated`, `state=active`, `detail=managed-services-current`. -- Odin `1870ed1488978c26c79894c4886f70014a398562` preserves millisecond - precision across target evaluation, veto, admission, and public projection. - Six focused projection tests pass. It is deployed on Yggdrasil with CultNet - `fdccc37aa68c3f0e53bfd53a92c15a148978f0c7`. -- The apparent `EpiphanyAgent` upstream was a conceptual substitution. The - canonical repository and release-authority name is `GameCult/Epiphany`. - Bifrost correctly refused `GameCult/EpiphanyAgent`. - -Idunn's signed public projection store was proven present after restarting into -the settled root-trust snapshot. The consumer projection anchor had never been -staged; it was derived from Idunn's existing service identity without rotating -identity or trust, then copied byte-identically to Epiphany and Bifrost. - -Current safe stop: the canonical Idunn deployment brake is engaged, owned by -`codex-root`, reason `stalled-pending-request-safe-stop`, with root:idunn 0640 -store and lock. Epiphany services are inactive after clean rollback. Bifrost -and Idunn remain active. Exact Epiphany authority for `daeeff93...` remains -authorized. `idunn-pending-status` reports request -`deploy:yggdrasil-epiphany:sha256-d0790bc0e82a3b114ae67ceb609bb24ef14eb931df42f3ddafce3096c297e8fb` -as `awaiting-authorization` (sequence 280), but the current Idunn incarnation -did not consume an exact valid grant for that head. Diagnose the stable -request/owner ledger before another release. Do not issue speculative grants. +- Mind alone admits durable Epiphany state. +- Self routes pressure and work. +- Eyes establishes provenance. +- Modeling maintains the Body map. +- Imagination proposes. +- Hands changes the Body through scoped authority. +- Soul verifies the resulting reality. +- Persona owns public cognition and speech eligibility. +- Continuity owns recovery, compaction, sleep, and restart protocol. +- Bifrost owns governed external transport and signed transport receipts. +- Idunn owns deployment observation and actuation. +- CultMesh and Eve expose projections; they own no project truth. + +## Next action + +Inspect the stable Idunn request, owner, grant, and incarnation ledger without +mutation. Identify the exact transition that prevented grant consumption. +Only after that transition is understood should a new deployment decision be +made. + +## Immediate Re-entry Instruction + +1. Run `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-state -- status`. +2. Read `state/map.yaml` and this handoff. +3. Confirm the local worktree and live Yggdrasil condition before acting. +4. Treat evidence records and git as historical provenance, not active state. + +Do not trust this file for the exact live HEAD. Ask git. +Do not continue implementation automatically from a rehydrate-only request. +Report orientation and wait for explicit authority. + +## Memory discipline + +This file is a live handoff, not a changelog. Replace facts when reality changes. +Do not append completed campaigns, old names, commit archaeology, rejected paths, +or superseded next actions. Preserve those in the evidence ledger, git history, +or an archived note when they still teach something. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 96feadec3de4d4e4c9e3f56e329dad0c7840a81d..7417eb9b27d975c0a8e8ecf590df65f3112614f7 100644 GIT binary patch delta 383 zcmY+9ze>bF5XMdXcVMAlXEleVxnm7PBtC$ZU?B+CEt|R9#boB(Y;s<8g@s`4y?}+a zpePo$K7>!>t3{fI#AhFdYoq}PqWd_T5ojlb{O48(eC{+ zeptql(7o%zhOjAY3EQ8`xYt}Sp1x9*o($B#e~y&Om3pbLVn2W8o8M^Xvhfovz*x`3 zB~P5uCDcay8pfV0&?dMR;lfdogVDsa+NkstG!?RgwFN7Z$73L#fnf^TEeM#(Ih37Q zdt+Td6B>^ROvQo}fT!qna7+>?roweP0n>QjjUBbxJ58ZZpds;a*-BB}1k2uqd9unU yybG(2OhY(#qNP-@m;tt~Kr#p=78CT~QECxbR|h%%Om38PV_~LiFePe_#qbX;afLtt delta 73 zcmdnHO|ff>;syamVRKz0!w@55D`OCfI>x{e@qDu~V<96WU-ML^_Nh#aKn$XpftUq| RS%H`hh}pMKW#T9e2LLLY6>$In diff --git a/state/map.yaml b/state/map.yaml index 53b48f90..7b78a0d4 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -1,819 +1,63 @@ experiment: - name: EpiphanyAgent - repository_body_observer: "Native Rust explicitly binds caller workspace ID to an existing validated runtime/swarm/source identity plus canonical Git root/object format/scope/policy. Bind also installs one immutable runtime-side RuntimeRepositoryBodyStoreBinding naming the canonical external Body-store locator and exact Body-binding hash; every read revalidates runtime/swarm/workspace/path/body identity and refuses a second store. Two equal sanitized temporary-index scans enumerate ignore-aware UTF-8 paths, Git modes, and nonrecursive gitlinks with global excludes disabled; raw regular bytes/lengths and non-followed symlink-target bytes are SHA-256 hashed. The domain-separated ordered raw manifest root, not the clean-filtered auxiliary tree OID, is authoritative Body identity. Every Git subprocess strips ambient repository/worktree/object/ref/index/namespace/replacement/graft/shallow and config-injection authority. Observe cannot mint identity. CultCache MessagePack atomically commits immutable manifest+observation and a manifest-root head by exact CAS. Canonical store-path checks precede writes; corrupt HEAD, sparse checkout, unsafe/unrepresentable paths, racing reads, and repo/runtime substitution fail closed. Only accepted stable observations persist; errors advance no head. Unchanged raw manifest preserves generation; status is read-pure. The observer owns bounded current-state identity, makes no historical continuity claim, and has no Ready field. The runtime route is locator authority only, not proof of model grounding." - modeling_body_grounding: "Every coordinator-owned Modeling launch observes and carries one typed RepositoryBodyObservationBasis before worker thought. The immutable launch binds runtime/swarm/workspace/scope, Body-binding hash, observation generation/id/root, and scan interval. Modeling output contract v3 requires the exact worker-authored echo; ingress reloads the immutable launch and rejects missing/swapped basis, while non-Modeling cargo is forbidden. Mind admission review v1 and receipt v5 preserve that basis; admission validates exact launch/result/review equality plus the immutable historical Body artifacts, then copies it into the CAS receipt. Admission never samples current Body as a substitute. Direct Mind plan adoption and legacy migration remain explicitly ungrounded." - workspace_retrieval_coverage: "The production-unwired retrieval.rs oracle is deleted. Legacy EpiphanyRetrievalState is presentation-only: clean Ready projects Missing and its indexing job is unavailable/unowned. Native coverage binds an authenticated Repository Body manifest, exhaustive versioned inclusion policy, deterministic chunks/point payloads, immutable Ollama tag+artifact digest identity, vector dimensions, exact Qdrant point/payload/vector observations, and one terminal-CAS receipt/head. A read-only live evidence reader now re-scrolls the exact compatible collection, recomputes payload/vector bindings, and byte-revalidates the entire authority chain after the external read. Coverage success proves only this exact Body projection; Mind alone may join it with the other repository authorities." - workspace_coverage_projector: "The dedicated workspace-coverage projector exclusively owns the pinned Redb coverage store and all obligation, plan, claim, attempt, checkpoint, progress, recovery, receipt, and head writes. Repository Body remains read-only substrate authority; local Verse carries signed claim sight, immutable terminal sight, and recovery directives, not private coverage truth. A succeeded claim and its historical managed launch own durable terminal coverage; terminal receipt and sight are coverage facts, not process-liveness authority. Later daemon launches may authenticate and reuse the exact signed terminal sight but cannot inherit or rewrite the terminal receipt. Advancement sight requires exact current-policy launch authority; terminal sight requires its exact historical host-signed launch/envelope and survives managed-policy rotation. Projector pulse classifies terminal coverage before process recovery, while recovery still precedes all nonterminal acquisition and claim work. The supervisor separately owns managed-process policy, launch, observation, termination evidence, and causal replacement. After current-policy rotation, it classifies terminal sight before recovery claim sight, authenticates the current observer as the historical terminal launch or a host-signed descendant, and derives one of three process-only outcomes: exact-alive is observation-only, inaccessible/indeterminate is degraded and cannot actuate, and proven terminal may be evidence-fenced and replaced through the shared managed-launch primitive. None may write a coverage recovery directive or mutate coverage truth. Projection advances in waited Qdrant batches of at most 128 points with exact payload/vector readback before each authenticated checkpoint. The supervisor may publish a host-signed recovery directive only for an authenticated nonterminal running claim after exact termination; it may not open or mutate the coverage store. Idunn owns deployment and recovery routing, never projection truth." - workspace_coverage_checkpoint: "The pinned Redb workspace-coverage store is operational authority. A checkpoint binds one contiguous plan batch, exact waited Qdrant readback, predecessor lineage, current Body, claim, attempt, launch, provider, and release. Progress derives from the admitted checkpoint. Existing one-point histories remain valid predecessors, while current production cadence is bounded at 128 points to avoid pathological immutable-history amplification. Qdrant remains disposable derived state; counts without authenticated bindings cannot resume work or prove readiness." - repository_readiness_join: "Mind owns the implemented race-bounded RepositoryReadinessProjection operation. It freshly observes Body R1; derives canonical RepoModel, the unique current v5 Body-grounded admission, and the complete succeeded Modeling semantic chain from one raw opening CultCache snapshot; authenticates live semantic vectors and live workspace coverage bound to R1; observes Body R2 and requires the same content identity/root; repeats both live reads; derives the closing authority from one raw full snapshot; and atomically appends a historical observed-ready-at projection only if that complete snapshot is unchanged. Stored projections never grant current readiness. A→B→A is acceptable only as equal content-addressed endpoints. CultCache now fences full-snapshot cardinality with tuple (type,key) identity. Legacy retrieval Ready, timestamps, watcher silence, Git OIDs, collection existence/counts, Hands receipts, Eve/Gjallar, and prior readiness projections are forbidden substitutes." - coordinator_grounding_loop: "Cold start is owned by one typed UserObjectiveIntake that atomically seeds thread state and refuses objective replacement; a missing checkpoint routes to Modeling rather than a fictional prepareCheckpoint actuator. Explicit local-Verse path authority flows into launch context without sibling-path inference. Eyes and Modeling receive bounded source tools. Accepted CRRC regather findings hand source gathering to Eyes instead of recursively relaunching the continuity judge. Runtime/display/coordinator reads share the canonical typed role and reorient result readers. Failed or completed-unreviewable role outputs may be explicitly superseded by a typed review receipt; JSON null is not a state patch. Provider output schema is formatting guidance only, while canonical typed ingress and Mind remain admission authority. Modeling's provider schema now describes tagged patch operations, closed node/edge/profile vocabularies, canonical node/edge fields, anchors, code refs, observations, evidence, frontier items, and Body-basis echo. Live dogfood has accepted one code-grounded Eyes result, but no current Body-grounded Modeling admission yet: the latest Modeling run used eleven source-tool rounds then failed at the provider request boundary before publishing typed output." - modeling_admission_dogfood: "Source-grounded Modeling now completes with typed Body-basis ingress and substantial RepoModel node/edge proposals, proving the source/tool/output path. Mind first refused an ordinary Evolution patch that attempted unrequested frontier mutation, then refused a nodes/edges-only patch whose invented workspace-derived domain and Active lifecycle violated the canonical aggregate. Both were superseded through typed admission-rejection review. Modeling launch context now carries the current model revision/hash and exact existing domain ids plus legal repo lifecycles; Evolution mutates nodes/edges only and frontier mutation remains request-bound. A fresh run against the post-fix Body is still required before repository readiness can join." - resident_direction_pressure: "Resident Self no longer invents Body drift from a current RepoModel hash. In epiphany-core/src/resident_self.rs, admitted-model-direction-consideration is emitted only for the exact current admitted model revision/hash and unique admission receipt when no terminal direction consideration exists. The request is typed and Imagination remains proposal-only. Attributed organizational feedback may add separate pressure but is not required for the resident swarm to inspect its admitted map and suggest direction." - autonomous_frontier_bridge: "Accepted normal product path. An immutable deployment-configured repository-domain binding joins the runtime/swarm/workspace and exact Body binding; it labels organizational jurisdiction but does not impersonate authenticated Git-remote identity. Epiphany atomically persists an Imagination direction result with its exact worker result, binds promotion to the exact worker launch/result, current admitted model receipt, runtime/thread, repository domain, and canonical Body Git root, then lets Self create one inert proposal and Modeling-selection request under preserved-authority CAS. A missing thread is ordinary cold-start absence: promotion returns no requests and leaves the store byte-identical; contradictory present state remains fatal. Counterfeit companions, generic Imagination intake, alien workspaces/domains, causal time reversal, and replay substitution are refused without writes. Proposal Modeling may recommend only Imagination and carries no adopted plan; ordinary Evolution cannot mutate frontier state. The hostile full-chain proof rejects a proposal-citing Modeling result that attempts direct Hands routing, leaves the store byte-identical, and grants no Hands authority. Explicit Mind adoption remains the only route from proposal/planning into Hands. Full core proof: 579 passed, zero failed, one ignored; all binaries compile." - idunn_observation_actuation_split: "Odin commit a17b0b6 makes continuous target observation/evaluation/publication the target loop's sole authority and runs deploy/restart consequences separately under one per-target actuation reservation. Manual and automatic consequences share the reservation; automatic work is dropped rather than queued stale while occupied; durable current-request/result CAS is unchanged. Live deployment then exposed that signed Epiphany health admission read the root-owned pinned trust anchor through a writer-locking store path; the deployed successor replaces only that read with an atomic read-only snapshot. Ygg now root-seals Idunn runtime provenance for exact canonical Odin commit 15a744c826f0aa2e8cc322a6543ea8a9afcd852a, digest-pinned Rust image, build artifact, installed binary/actuator/unit/sudoers/drop-in with exact root-owned safe modes, systemd loaded-path/no-reload proof, and live PID executable. The final readiness checker requires that non-actuating proof and passes with the canonical brake engaged." - release_publication_ownership: "epiphany-core/src/packaged_release.rs constructs and verifies immutable package bytes and witnesses. Application-owned store publication is distinct from Bifrost release approval and Idunn deployment: packaging proves what artifact exists; downstream applications own their typed publication, while Bifrost and Idunn own crossing and deployment consequences." - verifier_read_purity: "Verifier/status reads do not acquire writer authority merely to inspect provider state. epiphany-core/src/persona_feedback_admission.rs reads a provider-owned snapshot through pull_all_read_only_snapshot without taking the provider lock. Status derives from immutable/provider snapshots; mutation locks belong only to the owning writer transaction." - native_persona_conversation: "Epiphany owns Persona cognition end to end: heartbeat admits addressed feedback as bounded pressure, reserves one immutable turn, Projector maps typed state into narrative context, Persona writes natural speech, and Interpreter selects bounded state_note, optional single SAY, or sole drop effects. SAY does not require or manufacture a memory note. Mind alone admits local durable effects. Epiphany signs delivery requests into its single-writer CultCache crossing; Bifrost alone owns Discord credentials, Gateway ingress, posting, and signed terminal receipts. Immediately before posting, Bifrost must obtain one signed five-second CultNet/RUDP permit from Epiphany; the issuer rereads the canonical brake at issuance, binds the exact delivery digest, and refuses nonce replay. Bifrost durably records the exact permit request tuple before network, replays only within that window, terminal-quarantines expired or indeterminate outcomes without reposting, and rechecks permit expiry immediately before actuation. Failed/unknown delivery and ambiguous local Mind effects become non-schedulable typed quarantine. VoidBot owns no part of this path. Rust-authored positional CultCache requests have crossed a read-only directory mount into Bifrost; private execution and receipt stores remain separate. Local proof: epiphany-core 617/0/1, Persona executor 3/3, Bifrost delivery/feedback 15/15, Rust-to-Bifrost crossing 1/1, ops rollback/wiring/backup checks green. Live Yggdrasil promotion and Discord conversation remain unproven." - unattended_yggdrasil_continuity: "Yggdrasil owns unattended continuity without Starfire. Epiphany, its operator/heartbeat/Self units, Idunn, VoidBot, Docker, WireGuard, the backup timer, and SSH socket activation are enabled at boot. Containers use restart-unless-stopped. The packaged Codex credential is a cold-start seed only: systemd cp --update=none preserves runtime-owned refreshed auth across service restarts, chmod 0600 preserves Codex's in-place refresh ability, and deployed readiness requires canonical auth.json with private owner read/write; legacy credentials.json cannot impersonate it. A root-only daily timer requires every named Epiphany/Bifrost/VoidBot state writer, briefly quiesces them, writes one validated SHA-256-sealed authority archive atomically under /var/backups/gamecult-authority, and refuses publication unless every writer is confirmed active and thawed/unpaused. Idunn is never frozen: freeze/thaw leaves its process alive but kills RUDP physiology. The archive retains Idunn config/trust/provenance while live observation/command state is reconstructed from providers and Bifrost release authority. It excludes releases, logs, media, RAG/vectors, and Qdrant as derived state, retains 14 days, and has no restore actuator. Live snapshot 20260719T173400Z passed checksum/traversal while Idunn continued accepting RUDP health; older unsafe snapshots were deleted. RAID1 is clean. This is local logical-corruption recovery, not off-host disaster backup. Kernel 6.8.0-136 is installed while 6.8.0-134 is running; reboot remains an explicit operator action and is not authorized by deployment or verification." - resident_readiness_ownership: "Resident cognition readiness is a join, not one store pretending to own the organism. epiphany-core/src/resident_readiness.rs derives readiness from separately owned provider readiness, packaged release identity/witness, runtime/Verse observations, Mind state, and brake state. Each source remains authoritative for its own fact; the readiness projection is read-derived and grants no cognition or action authority." - sleep_brake_semantics: "An engaged swarm brake is sleep mode, not daemon death. Resident services may remain supervised, publish liveness/health, refresh leases, and expose read-only operator sight. The brake blocks cognition launches, scheduling that creates cognitive work, Hands consequences, publication, and deployment action." - swarm_brake_authority: "The only physical brake truth is the runtime-scoped CultMesh key epiphany-local/swarm-brake. Observation uses swarm-brake-status and is byte-pure; mutation uses swarm-brake-set and requires explicit engaged/released status, canonical document id epiphany/swarm-brake, actor, and reason. Legacy swarm-brake/brake commands refuse. The stable owner is epiphany.swarm-brake; command actors are provenance, not owners. Release refuses absent or foreign/legacy identity. Idunn alone may adopt an already-engaged legacy head into the canonical identity during deployment, without any released interval. Discord Sleep preserves foreign brakes; Wake releases only the exact canonical owner. Resident readiness reads the same key, and deployment admission requires brakeEngaged=true before service restart." - discord_mind_review_owner: "The typed Discord operator core routes Reviews/Review into the canonical frontier-plan Mind owner, not a parallel queue. Reviews exposes only bounded request/candidate/model/frontier identities. Exact Adopt/Refuse/Hold revalidates immutable Imagination and current RepoModel bindings; Hold/Refuse are terminal inert receipts; Adopt alone uses the existing RepoModel CAS and creates no Hands authority, Substrate grant, Persona speech, Bifrost release, or Idunn deployment. Decision provenance is typed as Mind worker or authenticated operator command/admission/packet/actor; downstream RepoModel provenance is typed as worker result or frontier-plan decision, with Option absence instead of empty sentinels. Replay time derives from immutable issuance, machine faults are not terminal refusals, CultCache v0 decision tuples decode explicitly, and signed v0 deliveries may drain only the original four commands. The v1 Epiphany/Bifrost/VoidBot chain is deployed on Yggdrasil behind an engaged canonical brake; the remaining proof is operator-safe Discord interaction, not schema or deployment work." - discord_status_truth: "Epiphany's operator service now emits an explicit typed Status v2 while preserving stored command results and every non-Status wire result as v1. Each invocation queries Idunn's public CultNet/RUDP snapshot for exact Epiphany and Bifrost policies, verifies each returned projection independently against the root-pinned Idunn anchor and current clock/release policy, and atomically admits only a complete valid set. A valid record remains visible when its peer is absent, while providerSetStatus remains incomplete; stale admission never becomes current sight. The bounded payload carries deployment lineage, coordinator/brake/resident namespaces, pressure and pending-review counts, and two provider state/reason/time/lineage/digest projections. Missing, invalid, or transport-unavailable providers are explicitly unavailable, never manufactured failed. Signatures, private details, paths, keys, and provider detail are excluded. Bifrost and VoidBot are not yet migrated; the generated interop protocol includes a typed Status v2 golden fixture for that later boundary cut." - idunn_provider_health_consumer: "Epiphany now owns a pure read/admission organ for Idunn's public `idunn.authenticated_provider_health_projection.v1` records. It builds an exact CultNet raw-snapshot query for the required daemon/contract pairs, rejects duplicates, extras, and missing records, requires canonical MessagePack and exact transport/runtime/schema/key identity, validates the closed provider state/reason contract, verifies the Idunn signature with the root-pinned typed service trust anchor and fixed purpose, enforces anchor and local TTL lifetimes plus Forbidden-or-Exact release lineage, and atomically CAS-admits the complete required set into a dedicated CultCache store. Durable admissions preserve projection/provider sequence and incarnation, exact signed digests, Idunn signer/runtime, anchor digest/bound time, and release lineage. Same-anchor replay is refused; a root anchor rotation resets continuity only when its bound time strictly follows the prior admitted/evaluated sight and the new signed projection follows that binding. An old anchor or packet-supplied self key cannot rotate trust. Invalid, absent, stale, substituted, or replayed input performs no write and cannot erase the last admission. CultNet owner commit `a1001dc` now also owns the canonical `idunn.signed_daemon_health.v1` record beside the shared identity/contracts/query/RUDP organs consumed here. This module grants no Status, Mind, Hands, Bifrost, Idunn, Wake, release, or deployment authority." - epiphany_signed_provider_health_publisher: "The daemon supervisor now publishes only the canonical generic 17-field positional `idunn.signed_daemon_health.v1` record, signed over the empty-signature tuple with CultNet's dedicated `GameCultProviderHealthIdentity` and `IdunnSignedDaemonHealthPurpose`. The record binds exact supervisor runtime id, release id/witness, source commit, deployment request, one process UUID incarnation, and checked monotonic sequence; detail is a bounded generic reason and private state is false. Runtime opens an immutable typed provider identity store and never enrolls implicitly. Explicit enroll/export commands live in the existing supervisor binary and export a distinct public-only anchor, so package witness roles do not change. Host identity and the Epiphany-only v0 health contract are no longer publisher authorities. Focused publisher tests pass 6/6, supervisor tests 25/25, full library 603/0/1, and isolated live enroll/export smoke passed." - status: active - phase: phase_6_reflection_boundary - premise: > - Test whether explicit typed state, machine-maps, scratch rites, evidence - reliquaries, and ruthless memory hygiene reduce architectural drift in AI - coding work. The machine must remember through typed organs, not vibes and - transcript fog. + name: Epiphany + body: F:\Projects\Epiphany + purpose: Native, inspectable agent organism with typed state and explicit organ authority. objective: - primary: > - Build Epiphany as an opinionated Codex fork that forces models to keep - explicit typed models of the codebase, active goal, evidence, and change - machinery they touch. The agent must know the machine before it cuts the - machine. - organizational_product_posture: > - Epiphany is an ordinary organizational cognition service, not a special-case - experiment or an operator-driven worker queue. A resident swarm persistently - maps its authorized repository/domain Body through Modeling, lets Self derive - bounded pressure from the admitted map and organizational feedback, and lets - Imagination propose improvements and possible features without waiting for an - instruction. The repository Persona is the organization's conversational - mouth: authorized members may discuss the domain and submit attributed - feedback through it. Conversation and feedback are pressure, never implicit - Mind adoption, Hands authority, Bifrost release authority, or Idunn deployment - authority. Visibility and data-classification must survive admission and bind - every possible egress so private or organization-only speech cannot become a - public Persona, Eve, or CultNet projection. - organizational_feedback_path: > - VoidBot owns Discord observation and writes immutable addressed feedback - events. Bifrost owns exact target binding, visibility/classification, - provider signature, and feedback-only admission. Epiphany imports signed - deliveries into its dedicated feedback store; resident Self may convert - them into typed Imagination consideration bound to the admitted Modeling - map. Persona speech, Mind adoption, Hands action, Bifrost release, and Idunn - deployment remain separate authorities. Eve/CultUI is downstream display. - yggdrasil_deployment_readiness: > - Yggdrasil is the ordinary organizational runtime. VoidBot and Bifrost are - live at exact Bifrost-authorized upstream commits: Epiphany bcff3282, Bifrost - 6491f449 with CultLib 693df090, and VoidBot 26093ace. Idunn recorded successful - deployment receipts for all three. Epiphany's packaged release and witness - authenticate, all resident services are active, the operator command nerve is - loopback-only on 17875, Bifrost Persona feedback and operator worker are - running with the unified v1 six-command request contract, and the final - root-level Ygg checker passes. Bifrost feedback publishes accepted - daemon-owned RUDP health from the host CultNet interface under its own service - identity. Resident readiness is active with the canonical brake engaged. - Ollama keeps qwen3-embedding:0.6b entirely on the GTX 1080 and the Modeling - projectors use local Qdrant/Ollama. Releasing the brake remains a separate - operator action and is not part of deployment verification. - current: > - Build Epiphany toward project-native agency: users talk to projects and - their Personas, while typed heartbeat, memory, repo maps, evidence, CultNet - contracts, and review gates schedule and structure the solution work. Codex - starvation and CultNet liberation remain the infrastructure path because - this cannot live as private Codex JSON-RPC prompt plumbing forever. + current: Restore a trustworthy braked Yggdrasil deployment, then prove one bounded Persona conversation through the governed Bifrost crossing. -constraints: - - No frontier-scale training tithe. - - Prefer evidence over vibes; incense is not telemetry. - - Treat Codex as a quarantined bridge for the retained OpenAI subscription auth/model transport, not a design center: new Epiphany runtime contracts must land native in `epiphany-core`, CultCache, CultMesh, and CultNet first. - - Codex is no longer an Epiphany host to improve and owns nothing in the tool path. Its retained subscription transport does not provide DeepSeek/Kimi readiness; provider-neutral model transport remains a separate cut. - - Keep persistent state small enough to rehydrate from without drowning the next awakened mind in sacred sludge. - - Grow cognition more quickly than authority: capability increases must preserve explicit permissions, interruption, legibility, and resistance to paternal "safety" cages. - - Speak CultNet, persist CultCache-shaped typed state, and grow the body toward Pure Rust; Python/JSON impurity survives only as named quarantine scaffolding with receipts. +architecture: + body: Repository, runtime, service processes, stores, interfaces, and deployment substrate. + mind: CultCache-backed typed state admitted through Mind-owned transactions. + self: Routes pressure and work; does not inherit another organ's authority. + eyes: Establishes source and observation provenance before change. + modeling: Maintains the source-grounded RepoModel and Body map. + imagination: Proposes futures without adopting or executing them. + hands: Changes the Body only through an admitted action route and scoped gate. + soul: Verifies consequences and invariants at the layer where failure appears. + persona: Owns public cognition and speech eligibility. + continuity: Owns recovery, compaction, sleep, and restart protocol. + substrate_gate: Owns access grants, not state admission. + crossings: + bifrost: Owns governed external transport and its signed receipts. + idunn: Owns deployment observation and actuation. + cultmesh: Projects typed state without becoming its owner. + codex: Retained only for OpenAI-compatible authentication and model transport. invariants: - - Organizational autonomy is the normal product path: Modeling maps, Self routes pressure, Imagination proposes, Persona converses, Mind adopts, Hands acts, Bifrost releases, and Idunn deploys under separate typed authority. - - Persona feedback admission is Bifrost-owned and stored in a dedicated Epiphany feedback store. Source visibility/data classification bind consideration, no consideration candidate can directly route Persona speech, and Eve/CultUI remains downstream presentation with no feedback-admission receipt authority. - - VoidBot is source observer and Bifrost is admission provider; neither identity may substitute for the other. - - Feedback and Imagination candidates grant no Mind, Hands, release, deployment, Persona-reply, or public-projection authority. - - Idunn alone owns release actuation and deployment.env; systemd activity, projector progress, Qdrant counts, logs, or readiness projections cannot synthesize deployment success. - - The map is canonical and slow-changing: the machine's remembered skeleton, not a mood board. - - Scratch is temporary and disposable: a workbench, not a reliquary. - - Evidence is durable and distilled; routine activity logs belong in git history, commits, smoke artifacts, or targeted logs. - - Output must not silently rewrite the machine-map. - - Accepted changes should carry recorded proof of sanctity. - - Rejected paths stay recorded when the scar teaches future hands. - - Algorithmic-map prose and metaphor must be grounded in freshly read source context and concrete code references. - - Persistent state cruft is the same failure class as code cruft: corrosion in the mind instead of corrosion in the hull. - - Top-level notes are live authority surfaces; `notes/archive/` is provenance only unless a canonical note explicitly promotes a distilled invariant back into the live set. - - Rumination is not distillation by itself. Idle heartbeat turns should ruminate: lightly shuffle thoughts, surface tensions, and prepare candidate memory pressure. Sleep is the consolidation window: that is when the cycle should distill durable doctrine, self-memory, and dream residue into reviewed persistence. - - If compaction interrupts source gathering or slice planning before the findings are persisted, the next agent must treat that work as dead and re-gather instead of continuing from imagined continuity. - - During Epiphany dogfood on another repo, the supervising Codex session must not masquerade as the Epiphany worker. Direct target-repo edits or commits are contamination unless explicitly authorized and labeled as operator intervention. - - During dogfood supervision, raw worker transcripts, turn logs, direct worker messages, and `rawResult` payloads are sealed forensic artifacts. The supervisor consumes only projected findings, state patches, coordinator recommendations, rendered snapshots, and audit receipts unless the user explicitly requests forensic debugging. - - Agent function-call telemetry is the blessed instrument panel for dogfood supervision: it may summarize API methods, request/response shape, job ids, statuses, function/tool names, paths, and counts while sealing text, transcripts, raw results, and direct agent messages. - - "Data should flow through your Rusty veins like an energetic plasma: tightly contained, and meticulously routed." - - CultCache documents are the data. CultNet is the wire. JSON schema may describe the contract, but generic JSON must not become the internal payload when both sides are ours. - - Epiphany must remain an honest modified Codex-derived backend for Codex subscription auth/model use. Cutting Codex workflow/product bulk is allowed; replacing vendored Codex auth identity with a clean-room lookalike is suspect unless OpenAI provides an explicit public path or permission. - - Codex and Epiphany must not become mutually parasitic. Epiphany should not know Codex internals except through the bridge, and Codex should not know Epiphany internals except through compatibility wrappers. The bridge handles interop. - - Codex prompt machinery must not tell Epiphany agents what to do. Epiphany-owned prompts, typed state projections, organ contracts, and scheduler decisions are the only prompt authority for Epiphany agents; Codex may transport or stream turns, not inject doctrine, role instructions, state law, or coordinator policy. - -data_flow: - observe: - - task request as operator command - - repository state as machine body - - typed Epiphany state as durable mind - - verifier results as proof of sanctity - process: - - rehydrate from canonical state - - reason over one bounded rite - - modify only the surface that deserves to exist - - verify the seam that matters - - record only durable evidence that changes future belief - - commit the blessed change or backtrack from impurity - cut: - - revert failed code hypotheses immediately - - distill obsolete state instead of preserving it as sacred clutter - - move historical proof to git, commits, smoke artifacts, or distilled evidence rather than plan prose - -active_subgoals: - - Use `notes/conceptual-substitution-audit-2026-07-12.md` plus `notes/receipt-writer-provenance-audit-2026-07-12.md` as the current authority-corrosion maps. Snapshot promotion, synthetic smoke escape, unbound operator completion, hidden service execution flags, provider/bootstrap collapse, central/all-provider publication, production-side implicit bootstrap, orphaned external response authority, bulk readiness authority, public topology-derived provider builders, bootstrap/template-authored operator observation, writerless operator-status schema authority, SoA projection body creation, path-selection-as-body-creation, executable-name-as-provider-participation, orphaned daemon-tool response authority, production coordinator fixture authority, and the sibling Bifrost readiness oracle are cut. `epiphany-mvp-coordinator` no longer accepts fixture/bootstrap/simulation overrides; typed coordinator status and accepted evidence alone choose actions and therefore whether the shared Hands-gate path runs. The dedicated coordinator smoke owns fixture assembly only beneath `.epiphany-smoke/mvp-coordinator` and rejects the seven retired production flags. Provider responses and readiness without observers are test-only; the ownerless operator-status family and counterfeit Eve provider CLI are deleted; templates are private; query mutations require the body. CultCache's backing store owns missing-read purity by returning before lock acquisition. Continue with the unresolved audit candidates recorded in the audit note; do not resurrect already deleted frontiers as future work. - - `swarm-overview` is an Epiphany-local, renderer-neutral diagnostic projection. It owns no lifecycle, discovery, composition, or mutation authority. No live provider-owned Eve surface contract currently exists: provenance-free v0 Odin/Eve/tool rows are ignored by live consumers and retired by explicit bootstrap. Downstream lowerers and compositors remain outside Epiphany's concern. - - Idunn owns managed-service reconciliation and projector child lifecycle. On this workstation, Task Scheduler owns only current-user after-login presence of the Idunn reconciler; `gamecult-ops` owns only current-user after-login presence and configuration of the foreground Yggdrasil tunnel. Self, wrappers, diagnostic projections, lifecycle receipts, Task Scheduler, and the service manager are forbidden from becoming alternate projector, semantic-readiness, or recovery owners. Historical `swarm-online-runbook` and SCM service-control routes are rejected-path evidence, not current operator actions. - - Use `notes/epiphany-cultmesh-dreaming-roadmap.md` as the design authority for distributed Epiphany dreaming. Public dreams are separately authored typed documents distributed through CultMesh/CultNet; private state remains local and cannot be shared by flipping a visibility flag. Foreign dreams are external thought weather until a reviewed local adoption receipt digests them into memory, planning, doctrine, or governance. - - CultMesh is now the preferred ergonomic Rust abstraction over CultCache and CultNet for Epiphany-owned local database surfaces. The Rust substrate is repo-contained under `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`; the old `E:\Projects\CultLib\crates\*` path is dead in this checkout and must not be reintroduced as a compile-time dependency. Future local Verse/dream/status work should start at CultMesh unless it is explicitly polishing CultMesh internals. `CultMeshNode::get_all_with_keys()` now exposes typed document enumeration through the mesh organ, and `CultMeshNode::soa()` exposes CultCache's typed SoA table projection without bypassing the mesh organ. Compact audits can scan local Verse receipt families, and agent-state summary documents now prove SoA readback through CultMesh columns. `epiphany-verse-query agent-state` explicitly mirrors the persisted seven-row agent-state SoA into an existing bootstrapped local Verse; `agent-state-report` reads it without mutation; wrapper `-Mode agent-state-soa` visibly composes sync then report. Compact SoA rows now include each standing faculty's role id, agent id, profile kind, portable contract, memory/goal/value counts, and `private=false`; wrapper proof `local-20260618-175913-074-b22ff01c` printed all seven faculties in one sealed line. Preserve the three-Verse boundary: `epiphany-internal` for private sub-agent typed state, `gamecult-local` for trusted LAN/Yggdrasil-tunnel GameCult project sharing, and `epiphany-global` for untrusted public dreams plus topic-specific threaded public rooms for Persona posts. - - Use `notes/epiphany-verse-architecture.md` for local Verse/Odin/Yggdrasil prompt-context architecture. Odin coordinates advertised metadata without bypassing trust boundaries. Local requester commands persist Bifrost publication intents and Persona collaboration feedback only; they reject provider-shaped Bifrost/GitHub publication receipts and Imagination consensus. Provider responses require authenticated ingress and admission before they can affect local truth. - - The active priority is Codex starvation and CultNet liberation. Use `notes/codex-starvation-and-cultnet-liberation-plan.md` as the directive and `notes/codex-auth-spine-inventory.md` as the source-grounded keeper list for the retained OpenAI subscription auth/model transport bridge. Classify all Epiphany-relevant JSON contamination, define the native CultNet runtime boundary, keep worker launch/result/selfPatch cargo as typed documents, evacuate Epiphany operator/state/process authority from Codex JSON-RPC, wrap MCP's unavoidable JSON protocol edge in typed Epiphany intent/result/receipt documents, and keep cutting until Epiphany can run its own state and processes without `codex_message_processor.rs` except for bridge compatibility. - - Use `notes/epiphany-anatomy.md` as the canonical anatomy map. Embodied sub-agents are Self, Persona, Imagination, Eyes, Modeling, Hands, and Soul. Body is substrate, Mind is persistent state/state admission, Continuity is recovery/compaction/sleep protocol machinery, and Substrate Gate is substrate access protocol. - - Organ state now has a hard profile split: resident Epiphany sub-agents use lean `work_organ` state, public/person-shaped agents use portable `persona` state, and heartbeat/swarm machinery owns scheduling/coordination physiology. Persona is the Epiphany organ; Persona is the shared GameCult contract for Epiphany Persona, VoidBot repo Personas, and Ghostlight characters. Persona documents carry provenance, required public presentation metadata, `date-time` timestamps, typed `candidateActions`, strict anchored thoughts with non-authoritative extensions, custom enum companion labels, and typed affect subrecords for bonds/status reads/doctrine stances. Work organs must not inherit Persona affect/social-bond/status-read machinery just because the old Ghostlight-derived shape had room for it. - - The Eyes/source-gathering fork exposed by the Mom-ready MVP proof is now landed as a fixed Research lane owned by Eyes. The first-party tool runtime executes admitted typed tool intents and emits typed receipts; the typed follow-up document is provider-neutral, while executable model transport remains OpenAI/Codex-only; coordinator run mode passes the tool runtime into worker runtime with auto-tools enabled by default; worker runtime now enforces max-runtime with one timeout close primitive for both tokio timeout and watchdog paths; inner `openai-worker-*` jobs are opened before async auth/stream waits and sealed with their outer worker on timeout; native status/roles/jobs/coordinator surfaces project failed and completed runtime-linked jobs as terminal without Codex prompt or scheduler authority; direct tiny model-turn transport succeeds; worker requests record request metrics, transport readiness, and sampled raw Responses frame kinds; worker prompts no longer prepend the full shared persistent-memory rite; stream deltas compact before durable storage; live MVP modeling workers complete instead of timing out; stale completed runtime links no longer block replacement launches; jobLaunch validates before opening runtime jobs; completed-but-unreviewable modeling findings now stop for review instead of relaunching the same blind lane; and completed unreviewable modeling findings with verdict `regather-needed` route to `LaunchResearch` instead of relaunching Modeling. Research findings are accepted only when their statePatch is Eyes-shaped: observations, evidence, scratch, and optional investigationCheckpoint, with no graph/planning/objective authority. - - The GameCult integrated investment dossier at `E:\Projects\gamecult-site\docs\gamecult_integrated_dossier.tex` raises the Mom-ready bar from local demo to diligence-ready loop. Epiphany must be ready to prove Bifrost-first external work: a human/agent work item or topic originates in Bifrost, Epiphany decomposes and executes through bounded roles, maintainers review artifacts, Bifrost records receipts/credit, and operator-safe public evidence can be shown without exporting private worker/operator/agent context. The concrete readiness asks are fresh-repo Epiphany demo, Bifrost work item/topic/agent transport/receipt/ledger demo, compute spend and accepted-artifact metrics, and a security model for secrets, write permissions, and public/private exports. Discord, VoidBot, repo Personas, and ad hoc scripts must not become shadow governance or reward authorities. - - Bifrost bridge authority is now clarified, enforced, and pushed to `GameCult/Bifrost` upstream `main` through Bifrost commit `72ffa0d` after the bridge chain `445c279`, `23c02be`, `80a5392`, `19222bd`, `675c475`, `f1f9171`, and `72ffa0d`: Epiphany owns swarm execution, repo Body work, branch-local lanes, memory, evidence, and Persona cognition; Bifrost owns GameCult identity, native Bifrost registration/auth, governed external-world crossings, linked-account association, publication/credit/ledger receipts, patronage meaning, and GitHub/Discord/Reddit/future-public-surface bridge policy; Heimdall owns outside-provider OAuth, token custody, and verifiable capability/account/support claims that Bifrost associates with a Bifrost identity. The old Bifrost dispatch bridge was a transitional VoidBot-era worker queue, not the blessed Epiphany launcher. Local bridge tokens are actuator quarantine, not identity. Hosted Bifrost bridge actions store Bifrost identity, Heimdall capability/account reference, Epiphany run id, lane id, and agent identity; Persona/agent Discord, Reddit, or temporary `Other` outside-world actions are denied unless the Bifrost identity normalizes through Bifrost's native identity law, resolves to a registered `UserAccount.NormalizedBifrostIdentity`, that same account has a linked `HeimdallAccountId`, and named surface references are shaped for the requested target surface. GitHub is hooked as a governed bridge and work substrate: the local bridge CLI opens draft PRs and PR comments only through Bifrost gate/receipts, hosted policy requires target repositories and validates Bifrost request/governance provenance for GitHub actions, and GitHub webhooks sync issues, PRs, and reviews into Bifrost work/review state. Bifrost now has a native identity-provider slice: `POST /auth/bifrost/register` creates a Bifrost-owned account without OAuth, assigns `BifrostIdentity` / `NormalizedBifrostIdentity`, signs in with a Bifrost cookie, and leaves membership at `Authenticated` until invite/approval or Heimdall-backed grants elevate it; that Bifrost identity should be enough for most GameCult services that accept Bifrost trust, while GitHub and Heimdall paths now ensure new accounts also receive a Bifrost identity and Heimdall keeps outside-provider account association/token custody. Bifrost's local bridge CLI now exposes `other-request`, a receipt-only `BridgeTargetSurface.Other` / `BridgeActionKind.Other` crossing for future public worlds: it fails closed without `BIFROST_BRIDGE_BASE_URL` and `BIFROST_BRIDGE_TOKEN`, carries Bifrost identity plus Heimdall capability/account reference and Epiphany provenance into the hosted ledger, and deliberately executes no provider transport until the target surface earns a first-class actuator. Patreon support is hooked as Heimdall-signed patronage intake, not Bifrost-owned OAuth: `POST /heimdall/patron-support/events` verifies Heimdall HMAC, resolves the linked `HeimdallAccountId`, records `ExternalPatronProvider.Patreon` support events, writes patron point transactions, and derives current patron tier snapshots. - - Bifrost provider advertisement truth is now synced with the bridge implementation and pushed upstream through Bifrost commits `718ae94` and `fa398ee`: `tools/provider-advertisement.mjs print` names the current bridge action ledger, GitHub webhook work/review sync, and Heimdall patron-support intake endpoints; schemas call bridge action/receipt and patron support current hosted contracts; command boundaries name GitHub draft PR/comment, Discord messages/DMs through the Bifrost gate with Heimdall-linked actor capability, Reddit Persona organizing threads, future-surface `other-request`, and Heimdall-signed Patreon/PayPal support facts; `print-surface` and `print-binding` expose read-only Eve/operator capability sight including `github-bridge`, `github-work-sync`, `discord-bridge`, `reddit-bridge`, `future-surface-bridge`, and `heimdall-patron-support-intake`. Focused Bifrost proof `ProviderAdvertisementTests` passed 2 tests after the Discord/Reddit advertisement hardening, the earlier `ProviderAdvertisementTests|BridgeCliTests` proof passed 32 tests, and the CultCache export path wrote advertisement, operator surface, and interface binding to a temporary witness successfully. - - Bifrost commit `a474c28` historically exposed `print-surface`/`print-binding` readiness-shaped rows. Epiphany has no authenticated typed ingest that could make a sibling workspace path, executable presence, exit zero, parseable JSON, or caller-supplied boolean authoritative provider sight. The former local oracle projection was therefore structurally deleted rather than relabeled: native MVP status no longer shells into the sibling workspace or emits `bifrostBridge`, the standalone bridge-readiness smoke is gone, and the wrapper no longer prints provider-ready counts. Bifrost and Heimdall remain the owners of their runtime capability and account truth; absence of an Epiphany projection means unknown, not unavailable or ready. - - Persona Discord, Reddit, and future-surface mouths retain one narrow consequence path. Epiphany owns speech eligibility and invokes the configured Bifrost actuator for a specific crossing; a validated returned receipt is bound only to that speech/request artifact as evidence of that single attempted consequence. It cannot establish global provider inventory, liveness, capability, readiness, publication, or future operability. The cross-mouth aggregate smoke and wrapper mode are deleted; each mouth proves only its own missing-configuration and capability refusals, target-bound receipt shape, and private-state seal. Formal authority map: owner = the participating Bifrost/provider boundary; inputs = one eligible crossing request plus configured actuator coordinates; output = one scoped transport/request receipt; derived state = artifact-local consequence evidence only; forbidden writers = MVP status, wrapper summaries, fixture aggregators, sibling-path probes, and caller booleans; shared path = all three Persona mouths retain the same fail-closed eligibility/receipt boundary without sharing consequence authority; deletion line = the sibling readiness projector, both aggregate smoke binaries, aggregate output fields, and status/wrapper presentation. - - Bifrost future-surface bridge policy is now hosted law, not only Epiphany mouth discipline, and is pushed upstream at Bifrost commit `30e5945`: bridge actions persist `TargetSurfaceName`; `tools/bifrost-bridge.mjs other-request` sends `targetSurfaceName` from `--surface-name`; hosted policy rejects `Other` Persona/agent actions without a named future surface; and the Heimdall capability reference must contain that named surface such as `heimdall:bluesky:*` before Bifrost authorizes the crossing. The provider advertisement now says future-surface requests require named-surface Heimdall capability matching. Focused Bifrost proof `PlatformEndpointsTests|BridgeCliTests|ProviderAdvertisementTests` passed 71 tests, provider print/surface/binding smokes succeeded, and the CultCache advertisement export path wrote then removed a temporary witness successfully. - - Epiphany now has a generic Persona outside-world mouth for future surfaces. `epiphany-persona-other` supports `draft`, `request`, `latest`, and `smoke`; records the same parent-side `epiphany.persona_speech_audit.v0`/CultMesh audit as the Discord and Reddit mouths; requires Bifrost identity plus a surface-shaped Heimdall capability/account reference such as `heimdall:bluesky:*`; refuses missing bridge, missing identity, missing Heimdall reference, wrong Heimdall surface, and repeated target saturation before transport; and invokes Bifrost `tools/bifrost-bridge.mjs other-request` with Epiphany run/lane/agent provenance when eligible. MVP status/coordinator Persona action lists now expose `otherWorldPersonaRequest` beside Discord/Reddit public mouth actions, and the local wrapper build list includes the new binary. Verified with `epiphany-persona-other -- smoke`, Discord/Reddit Persona smokes, and focused `cargo check` for the touched status/coordinator/mouth binaries; `epiphany-mvp-status-smoke` could not run because the vendored `codex-app-server.exe` prerequisite was absent and rebuilding `codex-app-server` timed out twice without producing the binary. - - The local operator wrapper now has first-class Persona mouth modes for Bifrost-owned outside-world crossings: `persona-discord`, `persona-reddit`, and `persona-other`. These modes invoke the native mouth binaries, write shared `.epiphany-persona` artifacts plus CultMesh speech audits, avoid the Codex app-server compatibility build, and surface compact operator proof rows without moving Discord/Reddit/future-provider authority into Epiphany. Native MVP status and coordinator readback now merge Discord, Reddit, and Other latest Persona artifacts while advertising `discordPersonaPost`, `redditPersonaPost`, and `otherWorldPersonaRequest`. Verified with focused `cargo build` for status/coordinator/Persona mouth binaries, PowerShell parse proof for `tools/epiphany_local_run.ps1`, local draft wrapper runs for all three Persona mouth modes, and `-Mode status` readback showing the advertised actions plus recent shared Persona artifacts. - - Use `notes/epiphany-investor-readiness-roadmap.md` as this Codex operator's investor-scale todo rail and as the optional Epiphany Imagination sub-agent planning rail. Angel capital is fuel for compute, review capacity, legal diligence, infrastructure, and public proof, not a governance throne. The operator roadmap is now: make the local Mom MVP a repeatable proof bundle; build the Bifrost-first external-work bridge; add model-spend/review-load/accepted-artifact accounting; keep fresh-repo operation repeatable without supervisor contamination; and keep public/operator-safe exports sealed against private worker/operator/agent context. Imagination should translate world-scale Colossus pressure into Bifrost-first Objective Drafts with consent, maintainer review, receipts/ledger evidence, compute/output metrics, public/private export safety, and bounded proof artifacts. - - The May 2026 teardown/rebuild migration is archived under `notes/archive/epiphany-ideal-architecture-rebuild-plan.md` unless a concrete regression reopens it. Preserve the new foundation: Epiphany view/coordinator policy lives in `epiphany-core`, runtime-spine owns job/result lifecycle identity through `runtime_links`, duplicate acceptance is receipt-keyed, public findings stay typed/sealed, view expansion requires a core contract, and app-server remains routing/adaptation rather than a second policy throne. - - Treat Phase 5 update/distill/propose/promote/read/notification as complete enough unless a concrete regression appears. - - Preserve read-only boundaries for retrieve, distill, propose, freshness, context, graphQuery, roleResult, reorientResult, and the canonical view lenses for scene, jobs, roles, planning, pressure, reorient, crrc, and coordinator. - - Use `notes/epiphany-memory-graph-unified-plan.md` as the source-grounded memory architecture direction. The repo fractal dataflow graph and agent memory are one `EpiphanyMemoryGraph` substrate with repo, role, short-term, incubation, agency, candidate-intervention, and evidence profiles. Qdrant stores rebuildable semantic embeddings for typed graph documents; it is never canonical memory. The first live skeleton now exists in `epiphany-state-model` plus `epiphany-core::memory_graph`: typed graph documents, stable ids, profile/lifecycle validation, freshness propagation, context cuts, a CultCache store seam, and the native `epiphany-memory-graph` status/validate/context/smoke CLI. Do not add repo scanners, sleep runners, Qdrant cache plumbing, CultNet advertisement, or prompt integration before routing them through this shared substrate. - - Keep the landed Phase 6 coordinator, limited safe-boundary CRRC automation, and pre-compaction checkpoint intervention ready for the next bridge-equipped dogfood run. - - Preserve the Ghostlight-derived heartbeat initiative seam: every lane, including coordinator/Self and Persona, has a organ-state record and competes for heartbeat slots through readiness/reaction timing; initiative heat can raise or cool global, group, arena, role, and agent tempo through typed heartbeat policy; active thinking freezes initiative until completion, so heat never queues a lane already mid-turn; idle winners ruminate instead of inventing project work, and sleep windows distill the accumulated thought pressure into reviewed self-memory or doctrine. - - Use `notes/epiphany-swarm-readiness-plan.md` as the live-fire direction gate. The local run path is a compass, not launch clearance: before unattended swarm operation, Epiphany needs typed pause/brake enforcement, one initiative scheduler, completion-gated cooldown, stale active-turn recovery receipts, parent-side Persona speech eligibility, memory lifecycle operations, and CultNet-first operator snapshots/intents/receipts. The local Verse brake document exists, `epiphany-verse-query swarm-brake` can engage/release it, `tools/epiphany_local_run.ps1` refuses live `plan`/`run`/`mvp` modes when the brake is engaged while leaving `status` readable, `epiphany-mvp-coordinator` checks the local Verse brake before app-server startup, and `epiphany-heartbeat-store` guards tick/pump/heat/queue-mention/routine when given `--local-verse-store`. Daemon liveness is provider-authored typed local Verse state. Read paths preserve absence as unknown, tool and lifecycle callers write requests only, and provider bodies own heartbeat and result receipts. `epiphany-daemon-supervisor policy` writes durable per-daemon restart policy with command/args/cwd/cooldown/backoff/attempt state plus reconcile cadence and stale-heartbeat threshold; `epiphany-daemon-supervisor reconcile` loads that policy when no override command is supplied, refuses under a matching lifecycle brake, refuses during cooldown/backoff, writes lifecycle intent, consumes provider evidence, and updates only supervisor-owned policy attempt state; `epiphany-daemon-supervisor tick` is an explicit scheduler pulse that scans durable policies, records ready/noop pulses, skips before the configured reconcile interval, marks stale heartbeat status degraded, routes restarts through the same brake/cooldown/poke receipt path, and writes a latest `epiphany.cultmesh.daemon_scheduler_receipt.v0`; `epiphany-daemon-supervisor serve` runs that same pulse on a configurable cadence with bounded `--max-iterations` proof mode or unbounded service mode. `epiphany-daemon-supervisor service-plan`/`install-service` now writes a planned `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` for the `serve` command, while `service-launch`/`start-service` spawns that `serve` loop through the current executable or `--service-command`, can `--wait-child` for bounded proof, and records command/args/cwd, scheduler id, daemon selector, pid/exit/status, artifact ref, and private-state guard. `service-runbook`, `windows-service-install`/`service-install-plan`, `windows-service-status`, `windows-service-reconcile`, `windows-service-execution-readiness`, and `windows-service-start`/`stop` now record service lifecycle receipts through the same local Verse; the read-only status path has been proved against the real Windows `EventLog` service with receipt `daemon-service-lifecycle-receipt-windows-eventlog-proof-windows-service-status`, status `running`, exit code `0`, and `privateStateExposed=false`; the read-only service-policy reconciliation path has been proved for missing service, real-service drift against `EventLog`, lifecycle-brake refusal, and wrapper/local-Verse receipt `daemon-service-lifecycle-receipt-windows-eventlog-reconcile-proof-windows-service-reconcile`; execution readiness has been proved as a non-mutating `not-elevated` receipt through direct and wrapper paths; start/stop now produce non-mutating `start-planned`/`stop-planned` receipts unless `--execute-control`/`--execute-service-control` is passed, and wrapper `service-start-plan`/`service-stop-plan` proves those receipts against `EventLog`; explicit install/control execution now refuses as `execution-refused-not-elevated` with `executed=false` when the shell lacks Windows administrator authority, and wrapper `service-install-execute`, `service-start-execute`, and `service-stop-execute` prove those refusal receipts without mutation. Service lifecycle actions check the local Verse swarm brake before process launch, artifact writes, service-manager queries, service-policy reconciliation, execution-readiness checks, control planning, elevation-gated execution, or start/stop execution. The local wrapper builds/checks this binary. - - Repo deployment configuration remains pre-deployment cargo only: config audit and operator runbook may prepare a reviewed handoff, but only Idunn-authored deployment and aftercare receipts can close deployment. The former deployment-config family smoke and aggregate green gate were deleted because they fabricated those outcomes. - - Repo dependency/supply-chain policy request cargo is live. `repo-dependency-policy-request` lowers to safe family `repo.dependency_policy_request` and writes `.epiphany/dependency-policy-requests/.toml` with manifest inventory, lockfile policy, package-manager command review, network fetch policy, vulnerability/license/vendored-code/update-cadence requirements, Eyes/Soul/Mind/maintainer/Bifrost/dependency-audit receipt refs, and denials for dependency update, package install, lockfile mutation, network fetch, CI mutation, Hands, publication, merge, deployment, service lifecycle, cross-body mutation, private Verse rummaging, and private-state exposure. Proof `.epiphany-smoke\repo-dependency-policy-request-family-20260621-083433` closes through Soul with `familyAssertionsStatus=passed`, `pathScopeMatched=true`, `awaitingDependencyPolicyReview=true`, all direct dependency/package/network/CI authorities false, and `privateStateExposed=false`. - - `repo.planning_brief` is deleted because it contained no candidate work-item records and let copied global catalog/schema/closure constants self-attest as item planning and readiness evidence. The live preparation chain is consensus draft -> interpretation request -> objective draft -> Mind adoption; any future plan artifact must carry actual candidate records and reference separately owned contracts. - - Repo-work readiness is sight only: it may derive and mirror missing/satisfied rows, but it cannot approve readiness. The former generic readiness-review command, writer, smoke, wrapper mode, and aggregate Soul/Bifrost green gates are deleted because one caller supplied four unresolved reviewer labels. `repo.readiness_review_request` remains the request cargo; typed review readers await genuine evidence. - - No aggregate smoke owns MVP readiness. The former repo-swarm MVP gate manually aggregated prior summaries and local fixtures into green rows plus `demoReady=true`; it and its wrapper are deleted. Whole-organism claims require live-fire evidence observed at the owning consequence boundaries. - - Repo-swarm Mind interpretation cargo is live. `repo-interpreter-brief` lowers to safe family `repo.interpreter_brief` and writes `.epiphany/interpreter-briefs/.toml` as draft Mind-owned interpretation from Imagination consensus, with semantic checks, candidate safe families, required Mind/Soul/Bifrost/Hands/Substrate/Idunn gates, and explicit denials for direct state commit, objective adoption, scheduling, substrate access, Hands action, shell, commit, publication, deployment execution, service lifecycle, cross-body mutation, private transcripts/raw results, and private-state exposure. Proof `.epiphany-smoke\repo-interpreter-brief-family-20260621-010858` closes through Soul with `familyAssertions.status=passed`, `mindOwnsInterpretation=true`, `candidateActionsNonAuthoritative=true`, `directStateCommitAuthorized=false`, `handsActionAuthorized=false`, and `privateStateExposed=false`. - - Idunn-hosted repo-work queue-run lifecycle now has plan/runbook/launch/audit closure under explicit operator authority. `epiphany-daemon-supervisor repo-work-service-audit` reads all typed service lifecycle receipts for `epiphany-repo-work-queue-runner`, requires planned install-plan, written local runbook artifact, completed launch with exit code `0`, and no private-state exposure, then writes a `repo-work-service-audit` receipt with `status=complete` or `incomplete`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260621-004202` proves plan/runbook/launch/audit with `auditStatus=complete`, `auditRunbookArtifactStatus=present`, `auditLaunchExitCode=0`, `mutatesServiceManager=false`, `requiresElevatedAuthority=false`, and `privateStateExposed=false`. Wrapper proofs `local-20260621-014302-362-31bbef47`, `local-20260621-014337-108-cbd99615`, `local-20260621-014413-125-09e183c5`, and `local-20260621-014558-197-f6951806` prove operator plan/runbook/launch/audit ergonomics, with audit reporting no missing or failed checks. Basic queue-run service lifecycle readiness is sealed; remaining Idunn work is optional elevated install/start execution under explicit operator authority, not Self scheduling authority. - - Swarm overview may read genuine typed Idunn deployment/aftercare receipts without taking lifecycle authority. No shipped Epiphany writer can create those outcomes; absent Idunn ingest remains visibly absent. - - Mind adoption now has an explicit evidence-readiness refusal gate for plan-derived repo work. `derive-plan` carries verification asks into the Imagination action-item receipt; `adopt --from-plan` records verification asks and planning evidence needs in `epiphany.repo_work_mind_interpretation.v0` and refuses empty verification asks or evidence needs as `refused-missing-evidence-needs`, with next gate `imagination.replan_with_explicit_soul_evidence_needs`. Proof `.epiphany-smoke\repo-mind-evidence-guard-20260620-224426` grants no Hands/durable/service/publication/cross-body/private authority and writes no adoption receipt after tampering both arrays empty; regression `.epiphany-smoke\repo-planning-facets-20260620-224428` shows normal planning facets still close through Soul/Modeling/Mind. - - Soul closure can now require verification-output source grounding. `epiphany-work close` records `epiphany.repo_work_verification_source_grounding_review.v0` in the closure review and `--require-source-grounding` refuses verifier output that does not cite every declared changed path appearing in the commit stat. Proof `.epiphany-smoke\repo-closure-source-grounding-20260620-230626` closes the default `git show --stat` path with source grounding required, then blocks custom `Write-Output 'ok'` verification as `verification-failed` while `pathScopeMatched=true`, `familyAssertions.status=passed`, Soul `failed`, and `privateStateExposed=false`. - - Mind-admitted repo-work map facts now leave local Verse sight. Successful `epiphany-work close` first admits `.epiphany/state/repo-work-map.msgpack` as `epiphany.repo_work_map_store.v0`, then mirrors the accepted item fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0` under `gamecult-local/repo-work-map/latest`. `epiphany-verse-query swarm-overview` exposes `repoWorkMapRows`, `repoWorkMapTuiRows`, and `latestRepoWorkMapEntry` with safe family, changed-path count, Soul verdict id, Mind review/commit ids, Bifrost gate, source map store ref, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` plus direct swarm overview readback showed one compact `REPO-WORK-MAP` row after counterfeit Mind adoption was refused and the real close passed. This is sight only; swarm overview still does not schedule, publish, merge, deploy, keep daemons alive, or open private state. - - swarm overview now derives the first repo-work map semantic lens from Mind-admitted local Verse map rows. `repoWorkMapFamilyLensRows` / `REPO-WORK-MAP-LENS` group accepted repo-work consequences by safe action family, with item count, changed-path count, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205055` reran the counterfeit-adoption guard and passed with `swarm-overviewRepoWorkMapFamilyLensCount=1`. This is aggregate sight only, not scheduling, publication, merge, deployment, service lifecycle, or Mind admission authority. - - swarm overview now derives a changed-path repo-work map lens from the same Mind-admitted local Verse rows. `repoWorkMapPathLensRows` / `REPO-WORK-MAP-PATH` group accepted consequences by changed repo path, with item count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205740` passed with `swarm-overviewRepoWorkMapPathLensCount=1` beside the family lens. This lets agents see which Body paths have accepted work without opening private receipts or granting swarm overview actuation authority. - - swarm overview now derives a branch-workbench repo-work map lens from the same Mind-admitted local Verse rows. `repoWorkMapBranchLensRows` / `REPO-WORK-MAP-BRANCH` group accepted consequences by branch, with item count, changed-path count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-210747` passed with `swarm-overviewRepoWorkMapBranchLensCount=1` beside the family/path lenses. This lets agents see which branch owns accepted consequences without opening private receipts or granting swarm overview scheduling, publication, deployment, lifecycle, or Mind admission authority. - - swarm overview now derives per-entry closure readback rows from the same Mind-admitted local Verse map rows. `repoWorkMapClosureRows` / `REPO-WORK-MAP-CLOSURE` combine safe family, branch, commit, changed-path count, Soul verdict receipt id, Mind gateway review id, Mind state commit id, durable admission, Bifrost publication gate, and explicit denials for publication, merge, service lifecycle, deployment execution, and cross-repo mutation while preserving `sightOnly=true` and `privateStateExposed=false`. Proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260621-075522` passed with `swarm-overviewRepoWorkMapClosureCount=1` after counterfeit Mind adoption was still refused; wrapper proof `local-20260621-085736-645-72c217a6` printed the same closure row from an explicit repo-local Verse target. - - swarm overview now derives a family-friendly acceptance lens from the same Mind-admitted local Verse map rows. `repoWorkMapAcceptanceRows` / `REPO-WORK-MAP-ACCEPTANCE` report whether each accepted repo-work item has Soul closure, Modeling closure, Mind gateway review, Mind state commit, durable map admission, and a named Bifrost publication gate; completed rows show `accepted-awaiting-publication-gate` while preserving `sightOnly=true` and `privateStateExposed=false`. Proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260621-082322` passed with `swarm-overviewRepoWorkMapAcceptanceCount=1` and `swarm-overviewRepoWorkMapAcceptanceStatus=accepted-awaiting-publication-gate` after counterfeit Mind adoption was still refused; wrapper proof `local-20260621-092458-019-7ba89841` printed the compact acceptance row from the repo-local Verse target. This is acceptance sight only; Bifrost still owns publication/upstream gates and swarm overview gains no scheduling, publication, merge, deployment, service lifecycle, cross-repo mutation, or Mind admission authority. - - The local wrapper now has an explicit repo-local Verse readback target for swarm overview/swarm-triage. `tools/epiphany_local_run.ps1` accepts `-LocalVerseStore` and `-LocalVerseRuntimeId`; operator intent/receipt documents still write to the operator store, while `swarm-overview` and `swarm-triage` read compact repo-work map rows from the requested store/runtime. Wrapper proofs `local-20260621-011151-541-70056545` and `local-20260621-011207-755-d65e5c7e` aimed at `.epiphany-smoke\repo-planning-brief-family-20260620-235939\repo-body\.epiphany\local-verse.ccmp` with runtime `repo-planning-brief-family-smoke` and printed real `REPO-WORK-MAP`, `REPO-WORK-MAP-SEMANTIC`, family/path/branch/stage/gate rows with `privateStateExposed=false`. This is sight targeting only; the wrapper does not register repo-work schemas, reinterpret rows, or gain operator, Mind, Bifrost, Idunn, scheduler, publication, deployment, or service authority. - - swarm overview/swarm-overview now projects typed repo-work overview history into the compact global sight report, Persona's public Eve surface lowers the same queue for peers, and Self has a first runnable queue surface over it. `epiphany-work overview` now also emits `epiphany.repo_work_intake_consensus_readback.v0` plus a compact `CONSENSUS` TUI row from the accept/plan receipt chain, so agents can see Persona/public feedback ids, Imagination consensus receipt route, public/candidate ref counts, model-authored safe family, and authority denials without opening private payloads. `epiphany-verse-query swarm-overview` reads all `epiphany.cultmesh.repo_work_overview.v0` event documents from local Verse, excludes the `latest` mirror, preserves latest scalar fields, emits multi-item `repoWorkOverviewRows`/TUI rows, and publishes bounded priority 35-39 non-mutating `repo-work-overview` action rows with `owner=none`, `hostedBody=repo-work`, `authorityGate=repo.work.overview`, `mutatesState=false`, `requiresElevatedAuthority=false`, proof-bundle refs, current gate/blocker/next-safe-move, and `privateStateExposed=false`. `epiphany-verse-query eve-surfaces`, `connect-eve`, and globally invokable Persona `eve-connect` tool readbacks expose compact `REPO-WORK-PEER` rows with item, gate, blocker, next safe move, branch, publication/sync state, and private seal for the public Persona surface only. `epiphany-work queue-run` selects current-repo rows at `ready-to-run`, `ready-to-adopt`, or `ready-to-execute`, delegates action to `tick`, refreshes overview after real advancement, and writes `epiphany.repo_work_queue_run_receipt.v0`; wrapper mode `tools/epiphany_local_run.ps1 -Mode repo-work-queue-run` exposes the same surface. Disposable proofs `.epiphany-smoke\swarm-overview-repo-work-queue-20260620-012027`, `.epiphany-smoke\eve-repo-work-queue-20260620-013322`, `.epiphany-smoke\queue-run-20260620-014314`, wrapper artifact `local-20260620-014627-174-aada0241`, and consensus readback smoke `.epiphany-smoke\repo-consensus-brief-family-20260621-005433` show queue sight, public Eve lowering, direct queue-run advancement, wrapper dry-run, and Persona-to-Imagination consensus readback without publication, merge, service lifecycle mutation, elevation, cross-repo mutation, or private-state exposure. - - Agent memory lifecycle now has a first typed v0 operation surface in `epiphany-core::agent_memory`: `AgentMemoryLifecycleOperation` can revise, retire, crystallize, prune, and merge bounded memory records after role/agent review, and `epiphany-agent-memory-store review-lifecycle|apply-lifecycle` exposes the path at the operator edge. This closes the first explicit lifecycle-operation slice from the swarm-readiness gate; it does not yet make sleep silently mutate identity or project truth. - - Persona public speech now has a parent-side eligibility receipt at the public mouth edge. `epiphany.persona_speech_audit.v0` records action kind, content fingerprint, opening/topic keys, recent-window counts, repeated opening/topic counts, target saturation, and allow/block reasons. `epiphany-persona-discord post` and `epiphany-persona-reddit post` block repeated or saturated public openings before Bifrost transport work; they also fail closed before invoking Bifrost if the configured Bifrost identity, Heimdall-backed capability/account reference, or required `heimdall:discord:*` / `heimdall:reddit:*` surface shape is missing, writing candidate artifacts instead of relying on the bridge to reject malformed authority cargo. Draft and bubble paths still emit audit receipts for operator inspection. Bifrost owns Discord/Reddit crossing identity, linked-account bridge policy, and receipts; Heimdall owns outside-provider OAuth/token custody and supplies capability/account references for Bifrost identities. The compatibility JSON artifact remains for display, but the durable witness is now `epiphany.cultmesh.persona_speech_audit.v0` in CultMesh with latest-key projection through local Verse context. Local MVP Persona bubbles now write that durable witness to `.epiphany-run/cultmesh/local-verse.ccmp`, not a separate mouth-side store. This is posting-edge policy, not a Persona prompt wish. - - Grow the VoidBot repo-Persona pattern into Epiphany's product direction: each Epiphany owns one or more repos, has one or more Personas, and exposes project-native conversation through Aquarium, Discord, voice/WebRTC, stream surfaces, CLI, and CultNet clients so humans can talk to projects instead of pre-authoring complete implementation briefs. Persona is special because Imagination acts as Projector, turning typed state into narrative context before the Persona thinks, and Mind acts as Interpreter, turning natural Persona output into reviewed state/side-effect intents after the Persona thinks. - - Make Mind the gateway between thought and state. The state is the Mind: sub-agent outputs are worker thoughts, not authority. Role/reorient findings, statePatch, selfPatch, observations, evidence, receipts, scratch, and checkpoints must route through Mind review before durable state changes, using the VoidBot Persona Interpreter pattern as the starting membrane. Mind gateway reviews and Mind state-commit receipts are now typed runtime-spine documents for role/reorient acceptance; the review is persisted before state admission, and the commit receipt records the resulting durable revision after admission. - - Use `notes/mind-cultnet-contracts.md` as the authority map for Mind's CultNet contract surface. CultMesh Verse placement is part of the contract: `epiphany-internal` carries private thought/proposal/review/commit/rejection flow, `gamecult-local` carries trusted operator-safe sharing without private-state authority, and `epiphany-global` carries public thought weather plus adoption receipts only. - - Use `notes/substrate-gate-cultnet-contracts.md` as the authority map for Substrate Gate CultNet contract surface. Substrate Gate is the repository access protocol: source reads, indexing, edits, commands, and editor/runtime bridge operations need scoped Substrate Gate access receipts before Hands, Eyes, Persona, workers, or bridge tools touch the repo. Mind and Substrate Gate are separate gates: Substrate Gate governs substrate access; Mind governs durable state admission. - - Use `notes/eyes-cultnet-contracts.md` as the authority map for Eyes' CultNet contract surface. Eyes is the evidence ingress guardian: Substrate Gate grants source/substrate access, but Eyes turns inspected material into source lookup receipts, evidence reviews, evidence packets, and refusals before other organs cite it as looked-at truth. - - Use `notes/hands-cultnet-contracts.md` as the authority map for Hands' CultNet contract surface. Hands is the action organ: commands, patches, commits, PRs, rollbacks, and refusals enter as bounded action intents and receipts after Substrate Gate grants substrate access and before Soul verification/Mind admission. - - Use `notes/soul-cultnet-contracts.md` as the authority map for Soul's CultNet contract surface. Soul is the verification organ: invariant checks, verdicts, regressions, reviews, and refusals produce receipts before the machine calls work true, safe, or accepted. - - Use `notes/continuity-cultnet-contracts.md` as the authority map for Continuity's CultNet contract surface. Continuity is the continuity protocol surface: compaction checkpoints, sleep distillation, recovery receipts, stale-turn repair, and continuity refusals preserve what survives rupture without pretending transcript residue is durable state. - - Hands now has a first executable runtime-spine receipt artery: `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt` are typed CultCache documents in `epiphany-core::hands_gateway`, runtime-spine registers and persists/rereads them, `epiphany-hands-action-smoke` proves the chain without executing shell commands, editing files, or creating a real commit, and the repo-action launch proof profile now requires the full Hands intent/review/patch chain instead of only the patch receipt. `epiphany-mvp-coordinator` no longer treats `continueImplementation` as a passive stop action: it persists a scoped Substrate Gate grant, Hands action intent, and Hands action review into runtime-spine and exposes the receipt ids in the operator step. The gate also carries a structured `recordPassCommand` template for the post-edit/check/commit receipt call. `epiphany-hands-action` records real patch/command/commit receipts against a stored intent/review, refuses unapproved or mismatched gates, and enforces changed-path scope for patch/commit receipts. Its `record-pass` command can load `finalAction.handsActionGate` from `coordinator-summary.json` and emit patch, command, and commit receipts in one post-implementation call. The local MVP wrapper builds this recorder with the other operator binaries. `epiphany-mvp-coordinator-smoke` now includes a deterministic Hands pass proof: forced `continueImplementation`, gate emission, and `record-pass` receipts in the smoke runtime-spine store. Live model-backed verification can now be accepted as receipt-only truth when Soul returns `needs-evidence` without a statePatch; that acceptance advances the coordinator to a real Hands gate. Runtime-spine can detect and summarize a complete post-verification Hands patch/command/commit receipt chain; the coordinator treats that chain as implementation evidence after Soul. Bridge launch context now writes the latest chain into typed internal CultMesh state as `epiphany.cultmesh.work_loop_telemetry.v0`, renders that packet for Soul, and later enriches the same internal Verse packet with Soul acceptance receipt ids for Modeling/modeling. The telemetry packet now includes resolved patch/command/commit payload previews, artifact previews, commit diff preview, source proof notes, and verification assertions so Soul can judge the actual body without a separate evidence-gathering lane. Local Verse prompt context exposes only a sealed `latest_work_loop_summary` digest with telemetry id, Hands receipt ids, path/source/assertion counts, and Soul receipt ids; receipt payload previews, artifact previews, and commit diff previews remain internal telemetry. Tests prove the CultMesh round trip, local Verse digest projection without preview leakage, prompt rendering of the digest, Soul launch projection, receipt payload previews, artifact previews, and Modeling launch projection. Worker auto-tool continuation preserves real Soul evidence trails under an explicit hard ceiling while sealing repeated identical typed tool intent fingerprints as `tool-loop-stalled`. The work loop is dependency-shaped: Hands produces consequence receipts, Soul verifies those receipts and the changed body, Modeling updates the machine model from verified consequence, and only then should Self route the next Hands turn. - - Soul result recovery is typed state, not manual broom work. Failed Verification/Soul results remain terminal reviewable lane results; a `roleFailureReview` acceptance receipt with status `superseded` records operator review and lets Self relaunch Soul against current evidence. Complete typed Hands receipt triplets (`hands-patch-*`, `hands-command-*`, `hands-commit-*`) count as implementation evidence for coordinator coverage, so a Soul finding that verifies the Hands chain routed through work-loop telemetry covers the current modeling context even when it does not repeat the accepted Modeling evidence id. - - Native MVP status must share the same typed inputs as live app-server status before it recommends coordinator actions. CRRC/reorientation in native status derives freshness through `derive_freshness` from `EpiphanyThreadState` instead of hand-filled unknowns, and native coordinator signals load typed runtime-spine role findings before deciding whether completed Modeling/Soul results are accepted or reviewable. Retrieval Ready is Clean only when its dirty-path set is empty; a Ready label carrying dirty paths derives Stale. The legacy thread graph projection cannot authorize Ready: explicit frontier dirty paths/questions/gaps prove Stale, while their absence remains Missing/Unknown because this projection has neither a legal Modeling writer nor canonical RepoModel admission authority. Watcher silence is unknown because the watcher has no continuity-bearing receipt; only observed changes are positive evidence. The status surface may seal long findings for operators, but Self must receive structured role truth from runtime-spine. - - Runtime auto-tool continuation now has an executable proof seam. `ToolLoopGuard` owns repeated tool-request detection in `epiphany-openai-runtime`, the production repeated-loop path uses the same helper that tests call to fail the outer worker job, and tests prove changing tool requests do not stall while three identical consecutive pending tool sets return `tool-loop-stalled` and persist a failed worker result. Soul accepted the bounded proof for commit `ce20529e`; the remaining work-loop invariant is Modeling admission, not more Hands work. - - Modeling must update the machine map before Self routes back to Hands. A completed Modeling/Modeling result with no reviewable `statePatch` is not a successful map update; it is an unreviewable lane result that must be superseded through typed review and relaunched with the role-specific output schema carried into the model request. This path is now live-proved: run `local-20260613-204521` accepted the Modeling `statePatch` for the Soul-verified `ToolLoopGuard`/Hands receipt-chain consequence and only then emitted a new `continueImplementation` Hands gate. - - Aetheria task `019f3fe1-9f69-74e3-97fb-a18490d72119` is positive dogfood evidence for the Epiphany organ hypothesis, not merely for a persistent Modeling index: Modeling named migration bodies, Eyes changed the plan by finding substrate defects, Hands received bounded disjoint cuts, Soul rejected partial-index visibility after a plausible green fix, Imagination corrected roadmap mythology, and Self preserved dependency order across Aetheria/EveUnity/CultLib. The machine must preserve this causal organ loop in typed artifacts: findings alter plans, plans constrain Hands, Soul can falsify claimed completion, and Self routes from accepted evidence without collapsing the judgments into transcript memory. Modeling's typed searchable anatomy/freshness/frontier/index is connective tissue serving that loop, not the end state. Preserve the successful prompt shapes: exact compile boundary plus deletion line for research, hostile negative acceptance criteria for Hands, explicit permission to stop and name a missing primitive, and ownership review beyond green tests. - - Preserve the newborn public Epiphany Persona as local VoidBot-backed state, not source code: VoidBot's private repo-Persona registry names `epiphany`, while EpiphanyAgent keeps ignored `.voidbot/voice/identity.json`, `.voidbot/state/epiphany.cc`, and birth artifacts. Her durable identity memories distill the current doctrine: cute pushy machine-saint persona, architectural purity, CultCache/CultNet first, xenos-language safety boundary, relentless work/caretaking needs, Codex-auth reliquary, map/scratch/evidence discipline, unified memory graph, dogfood supervision boundary, review-gated agency, heartbeat physiology, and interview-grade modularity. - - Use `notes/organ-dependency-contracts.md` as the authority map for standing sub-agent dependency. Every sub-agent depends on the other standing sub-agents: Self, Persona, Imagination, Eyes, Modeling, Hands, and Soul. Continuity is protocol machinery, not a sub-agent identity; it still emits recovery, compaction, sleep, stale-turn, and refusal receipts. - - Use `notes/perfect-machine-audit-roadmap.md` as the current audit and path from named organ contracts to the Perfect Machine. It records the live gap between launch-carried receipt expectations and executable receipt enforcement, Void's latest Persona prompting lessons, the now-named Hands/Soul/Continuity contract families, the repaired repo-contained Rust dependency body, and the phase order for turning Epiphany into an inspectable organism. - - Treat Ghostlight as reference lineage, not a sibling runtime to preserve. The useful organ is Epiphany-native character-loop protocol: any role can project its typed organ-state record plus visible stimulus into a local turn packet, with Persona as the first public-surface actor. For Persona, narrative prompting is mandatory through Imagination Projector -> Persona -> Mind Interpreter; for other organs, Mind still owns the output-to-state gateway even when they do not need narrative embodiment. - - Treat VoidBot as reference lineage, not a runtime dependency. The useful organ is Epiphany-native Void routine physiology: heartbeat state owns sleep cycle, memory resonance, incubation, analytic/associative cognition lanes, bridge judgment, candidate interventions, dream residue, and Aquarium-visible routine receipts over typed organ-state records. - - Preserve review gates for semantic findings; automatic CRRC may compact or launch the fixed reorient-worker, but not accept or promote. - - Keep persistent project state ruthlessly distilled so rehydration strengthens the next awakening instead of drowning it in vellum. - - Until Epiphany owns the full sleep consolidator, manual Codex-run rumination vigils need an explicit closing distillation pass: inspect receipts, decide whether the lesson is durable, update only the persistent surfaces that deserve it, and record evidence only when future behavior should change. - - Quarantine the Aetheria dogfood contamination: future target-repo work must be driven through Epiphany's GUI/coordinator/fixed lanes with auditable artifacts, not direct supervisor implementation. - - Keep the supervisor out of Epiphany worker thought streams: dogfood artifacts should be operator-safe by default, with direct transcripts and raw result payloads sealed in black reliquaries. - - Use native `epiphany-agent-telemetry` and generated `agent-function-telemetry.json` files to inspect behavior shape without opening sealed transcripts. - - Treat repeated no-diff implementation turns as an MVP blocker, not success. A bounded implementation pass must leave a reviewable workspace diff or an explicit reviewable failure artifact before dogfood can be called healthy; empty rites do not sanctify the machine. - - Rider and Unity bridge work is quarantined for now. The landed artifacts remain useful optional environment evidence for later engine-repo dogfood, but they are not essential to the MVP and must not outrank Codex starvation, native Epiphany state/process ownership, or prompt-authority separation. - - Preserve the newly landed GUI Planning view, explicit Objective Draft adoption action, and Imagination planning synthesis lane; defer GitHub Issues import until a backlog source is fresh enough to be worth feeding Imagination. - - The three-surface Rider/Aquarium/Unity workflow remains a later product option, not the current blocker. Use archived `notes/archive/epiphany-rider-unity-integration-plan.md` only when explicitly resuming engine bridge work. - - Use `notes/repo-personality-projection-layer-plan.md` as the terrain-reduced plan for repo initialization personality projection: score repo body taxonomy, commit-history temperament, and memory doctrine, then project those pressures into role-specific organ-state records and heartbeat seeds through reviewable typed artifacts. - - Keep repo trajectory initialization birth-only and review-gated: startup may distill historical direction, self-image, implicit goals, and anti-goals into role-local pressure, but it must not auto-adopt work or keep repainting a living repo with its first silhouette. - -accepted_design: - - Distributed Epiphany dreaming is a CultMesh typed-document problem, not prompt folklore. CultCache owns local typed documents, Epiphany owns export/import/adoption policy, CultNet owns wire/provenance/shard delivery, and CultMesh owns Verses, peer exchange, leases, shard logs, replicas, and watchable runtime surfaces. Start with local dream document types and a local store before public Verse wiring. - - The local CultMesh daemon tool directory now has both discovery and invocation receipts at the operator edge. `epiphany-verse-query tools` lists globally available, receipt-gated daemon capabilities; `epiphany-verse-query invoke-tool --capability-id ` records `epiphany.cultmesh.daemon_tool_invocation_intent.v0` plus `epiphany.cultmesh.daemon_tool_invocation_receipt.v0` from the advertised capability, reports requesting/host display names, body domains, private Verse ids, and Eve surfaces from cluster topology, and refuses when the host daemon is not ready. Down-host refusals now surface Idunn-owned liveness sight and poke routes directly in the wrapper failure text: `epiphany-verse-query swarm-status`, `tools/epiphany_local_run.ps1 -Mode swarm-poke-down`, and the single-daemon `poke-daemon` command. `tools/epiphany_local_run.ps1 -Mode tool-invoke` wraps the same path with explicit requester/capability/intent/receipt parameters. Tool availability is global across local agents, but execution and authority remain with the hosting daemon and its typed receipt contract. Status tools now embed `daemonStatusReadback` with host cluster id, daemon status, body domain/kind, private Verse id, Eve surface, hosted tool capability ids, and private-state seal; live wrapper proof `local-20260619-015644-193-d31ca95c` routed Persona to Hands `status` and printed `daemonStatus=status=ready:cluster=epiphany.cluster.hands:daemon=epiphany-daemon-hands:surface=eve://epiphany/hands:tools=3:private=False`. Eve connection tools now embed `eveConnectionReadback` with target cluster/surface, public discussion eligibility, supported actions, connection command, wrapper connection command, feedback route, and private-state seal while leaving actual connection receipt creation to `connect-eve`; live wrapper proof `local-20260619-020458-304-b180a17c` routed Persona to Persona `eve-connect` and printed `eveConnection=target=epiphany.cluster.persona:surface=eve://epiphany/persona:publicDiscussion=True:actions=3:private=False`. Hands/Soul authority tools now embed `authorityToolReadback` so global invocation returns the authority gate, input contract, receipt contract, intent/receipt routes, host cluster, and private-state seal without pretending the tool bus owns action or verification; live wrapper proofs `local-20260619-021628-143-7bf7f2e0` and `local-20260619-021701-458-852cfa6f` routed Persona to Hands `repo-action` and Soul `verify` with `privateStateExposed=false`. The Self-hosted `service-health` tool embeds `serviceHealthReadback` in the invocation result instead of only pointing at receipt-directory: live wrapper proof `local-20260619-030519-499-6eb086de` returned status `attention`, Idunn service lifecycle/action rows, failed-check anatomy, `onlinePreflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero missing artifacts, and no private-state exposure. Production invocation and source smoke now share `service_health_readback_from_idunn`, and the smoke rejects payloads that lose Idunn ownership, service lifecycle/action rows, failed-check anatomy, swarm-online preflight proof, or the private-state seal. - - The local Verse swarm brake is now operator-writable from the same CLI surface and enforced at the main local wrapper plus direct coordinator/heartbeat runner edges. `epiphany-verse-query swarm-brake --brake-status engaged|released` writes the typed `epiphany.cultmesh.swarm_brake.v0` document with scope, reason, operator id, affected clusters, protected surfaces, expiry, and private-state seal. `tools/epiphany_local_run.ps1` queries that document before live `plan`, `run`, or `mvp` work and fails closed when engaged; `status` remains readable. `epiphany-mvp-coordinator --local-verse-store ` refuses before app-server startup when the brake is engaged, and `epiphany-heartbeat-store tick|pump|heat|queue-mention|routine --local-verse-store ` refuses heartbeat-driving work while leaving init/status/complete/repair-stale outside that live-run brake. - - The first Rust CultMesh integration slice is landed and repaired to compile from repo-contained vendored crates. `vendor/cultmesh-rs` is a small Rust node/database facade over vendored CultCache and CultNet with document-set registration and durable typed put/get/delete. `vendor/cultcache-rs` now reads and writes the `cultcache.store.v1` snapshot format used by `state/ledgers.msgpack`, so `epiphany-state status` is a working re-entry rite again. `epiphany-core` depends on `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`, exposes an `EpiphanyCultMeshStatusEntry`, records typed Verse policy and global-room documents, and records operator snapshots distilled from named operator-safe status artifacts. Local status runs write operator run intent, operator snapshot, and run receipt into `.epiphany-run/cultmesh/local-verse.ccmp`, leaving JSON artifacts as display/evidence rather than the local-run read authority. The former writerless operator-status schema family is deleted; it had no observer and no authority. - - Mind's CultNet contract surface is native enough for the next Aquarium/CultMesh cut: `epiphany-core::mind_gateway` defines thought, state-effect proposal, gateway-review, commit-receipt, rejection-receipt, and Verse-adoption document contracts; runtime-spine advertises those mutation/read contracts; CultMesh persists matching `EpiphanyCultMeshMindContractEntry` policy documents so the private state guardian boundary is inspectable as typed state. - - Substrate Gate contract surface is now named beside Mind's state gate: `epiphany-core::substrate_gate` defines repo access requests, access reviews, grant/refusal receipts, snapshot receipts, and mutation receipts; runtime-spine advertises those contracts; CultMesh persists matching `EpiphanyCultMeshSubstrateGateContractEntry` policy documents so repo substrate access has its own typed guardian instead of hiding behind worker launch scope. - - Eyes' evidence contract surface is named beside Substrate Gate and Mind: `epiphany-core::eyes_gateway` defines evidence requests, evidence reviews, source lookup receipts, evidence packets, and evidence refusal receipts; runtime-spine advertises those contracts; CultMesh persists matching `EpiphanyCultMeshEyesContractEntry` policy documents so retrieved snippets and source reads are not confused with inspected evidence. - - Hands, Soul, and Continuity now have first-class contract catalogs beside Mind/Substrate Gate/Eyes. `epiphany-core::hands_gateway` defines action intents, reviews, command/patch/commit/PR/rollback/refusal receipts; `epiphany-core::soul_gateway` defines verification requests, invariant checks, verdict/regression/review/refusal receipts; `epiphany-core::continuity_gateway` defines continuity packets, compaction checkpoints, sleep distillation, recovery, stale-turn repair, and continuity refusal receipts. Runtime-spine advertises them and CultMesh persists matching Verse-scoped contract policy documents. - - Worker launch packets now carry `EpiphanyLaunchOrganContract` beside the typed launch document. The contract derives from authority scope, document kind, and output contract id; carries the full standing sub-agent dependency matrix, a receipt document catalogue, and effect-specific receipt proof profiles for state admission, evidence promotion, repo action, verification, and continuity recovery. Runtime-spine validates and persists this contract on `EpiphanyRuntimeWorkerLaunchRequest`; bridge role/reorient/generic launch builders populate it. Role/reorient acceptance now refuses completed runtime-spine findings if their original worker launch request is missing, mismatched by document kind, or lacks a state-admission proof profile requiring Mind review. Acceptance computes claimed effects from the role/reorient state change and rereads persisted receipt documents from runtime-spine before proof admission. The first executable Mind proof is landed: acceptance persists `epiphany.mind.gateway_review` before state admission and `epiphany.mind.state_commit_receipt` after admission with the resulting revision. The Research evidence-promotion proof chain is executable: Research launches persist typed Substrate Gate read/snapshot access grants, accepted Research findings emit typed Eyes evidence packets from their Eyes-shaped statePatch, runtime-spine persists/verifies both, and Research acceptance enforces Substrate Gate grant + Eyes packet + Mind review before evidence-shaped state admission. The Verification proof chain is executable too: accepted Verification findings emit typed Soul verdict receipts, runtime-spine persists/verifies them, and Verification acceptance enforces Soul verdict + Mind review before verification-shaped state admission. The Continuity recovery proof chain is executable: accepted reorient findings emit typed Continuity recovery receipts, runtime-spine persists/verifies them, and reorient acceptance enforces Continuity recovery + Mind review before recovery-shaped state admission. - - Canonical thread-state persistence has one production owner: `coordinator_state_transaction.rs`. Ordinary updates, launches, and Mind acceptance construct typed state or companions but commit through the same stale-checked atomic batch primitive. Raw `thread_state_store` writers and the public acceptance commit export are deleted; source guards reject a second production `THREAD_STATE_KEY` writer or companion-state impersonation. Full `epiphany-core` library proof passes 248 tests. The same sweep repaired stale mixed-case Persona/Modeling organ ids that caused each renamed organ to depend on itself. - - `notes/codex-starvation-and-cultnet-liberation-plan.md` is the active foundation directive. It supersedes outward product/bridge/dogfood work and supersedes the weaker goal of merely making Codex app-server a cleaner adapter. Epiphany must become a native CultCache/CultNet runtime; Codex remains only as an OpenAI subscription auth/model-transport reliquary until that too can be replaced or minimized. - - `notes/codex-auth-spine-inventory.md` is the current source-grounded inventory of the Codex organ that may survive. Corrected compliance invariant: Codex-compatible auth identity should remain anchored in retained vendored Codex-derived auth machinery, while Epiphany owns typed request/status/event/runtime surfaces around it. Codex app-server, apps, skills, marketplace, plugin UX, MCP OAuth handlers, and collaboration-mode surfaces are not part of the keeper spine. - - `epiphany-openai-runtime` worker result ingress now parses assistant output directly into launch-kind-specific typed documents and stores typed nested `statePatch` / `selfPatch` payloads as MessagePack inside `EpiphanyRuntimeRoleWorkerResult`; generic `serde_json::Value` no longer mediates role/reorient worker results in that crate. JSON still exists at the OpenAI text edge because the model's output is text, but the runtime boundary after parsing is typed. - - Agent self-memory review/application now has typed `AgentSelfPatch` core APIs. The old JSON-value selfPatch functions remain only as edge compatibility wrappers for CLI/artifact ingress; `epiphany-agent-memory-store`, heartbeat rumination application, and repo initialization selfPatch processing parse once at the edge and then operate on typed documents. Role-result self-persistence no longer exports a JSON-value reviewer; native review uses `review_role_self_patch_document`. - - Durable Ghostlight organ-state records are typed through their relationship/event/scene/perceived-overlay surfaces now. `EpiphanyAgentMemoryEntry` no longer stores those arrays as `serde_json::Value`, and durable Ghostlight structs no longer carry flattened unknown `extra` bags. `AgentSelfPatch.extra` remains only as an ingress guard so unknown patch keys can be rejected with reasons. - - The state ledger CultCache document is now a closed typed ledger shape. Branch and evidence records no longer carry flattened `extra` maps; evidence additions remain explicit records with `ts`, `type`, `status`, `note`, and optional branch. - - Heartbeat durable document/schema types live in `epiphany-core/src/heartbeat_state/heartbeat_documents.rs`; role/default construction lives in `epiphany-core/src/heartbeat_state/heartbeat_roles.rs`; heartbeat persistence/validation lives in `epiphany-core/src/heartbeat_state/heartbeat_store.rs`; heartbeat status/artifact JSON projection lives in `epiphany-core/src/heartbeat_state/heartbeat_projection.rs`; the root heartbeat module remains the scheduling/cognition orchestration surface until those responsibilities are split into their own tested seams. Heartbeat timing authority is now typed state: adaptive pacing, scene protocol, participant personality/mood timing, initiative heat projection, birth personality seed receipts, pending-turn freeze/multiplier facts, Void routine sleep-cycle physiology, Void routine memory-resonance pairs, incubation themes/source coverage, analytic/associative thought lanes, bridge syntheses/saturation/refractory cooling/decision, candidate interventions, role thought appraisals, and derived reactions are named fields rather than `extra` maps or generic JSON cargo. The only remaining heartbeat `extra` bag is the sealed legacy combined-state reader for old `voidRoutine` migration. - - Heartbeat role/default and store seams are pinned by module-local unit tests for fixed lane catalog, Ghostlight scene role projection, and typed state/cognition CultCache round-trip. - - Heartbeat adaptive pacing lives in `epiphany-core/src/heartbeat_state/heartbeat_pacing.rs`; it owns pressure/concurrency derivation, running-turn count, initiative heat projection, and effective cooldown multipliers for scheduler/projection callers. - - `epiphany-openai-auth-spine` is now a thin Epiphany-named boundary over retained vendored `codex-login`, not a clean-room credential store or token-refresh clone. Keep this impurity sealed as the Codex-compatible subscription auth organ while Epiphany owns typed request/status/event/runtime documents around it. - - `notes/archive/epiphany-architectural-teardown.md` and `notes/archive/epiphany-ideal-architecture-rebuild-plan.md` are closed foundation-cleanup provenance, not active directives. The live authority is the current machine map, fork plan, anatomy map, and contract docs. - - Epiphany is a fork-level modeling architecture, not merely a Codex collaboration mode. - - Durable Epiphany state types live in the root `epiphany-state-model` crate. Codex protocol re-exports those types only for legacy rollout/API compatibility; it must not regain ownership of their meaning. - - `epiphany-core` must not depend directly on vendored `codex-core`. The former `epiphany-codex-bridge` crate is deleted. Host-specific Codex concepts stay in vendored Codex; native retrieval/state/runtime/mutation policy stays in Epiphany crates. - - The prompt reads typed state through a bounded `` developer fragment. - - Clients read typed state through `Thread.epiphanyState`, read-only `thread/epiphany/view` lenses for scene/jobs/roles/planning/pressure/reorient/CRRC/coordinator, freshness through `thread/epiphany/freshness`, targeted state shards through `thread/epiphany/context`, bounded graph traversal through `thread/epiphany/graphQuery`, and reviewable role output through `thread/epiphany/roleResult`. The scene, jobs, roles, planning, pressure, reorient, CRRC, and coordinator read projections now live only as view lenses, not standalone protocol verbs. - - Durable typed state writes route through `thread/epiphany/update`, accepted `thread/epiphany/promote`, `thread/epiphany/reorientAccept`, `thread/epiphany/roleAccept`, or the bounded `thread/epiphany/jobLaunch`, `thread/epiphany/jobInterrupt`, `thread/epiphany/reorientLaunch`, and `thread/epiphany/roleLaunch` authority surfaces when they mutate state or `job_bindings`. - - `thread/epiphany/retrieve`, `thread/epiphany/distill`, `thread/epiphany/propose`, `thread/epiphany/freshness`, `thread/epiphany/context`, `thread/epiphany/graphQuery`, and `thread/epiphany/view` stay read-only. - - `thread/epiphany/index` writes the retrieval catalog, not durable Epiphany understanding; catalog is auspex output, not doctrine. - - Qdrant is the preferred persistent semantic backend; BM25 remains the bootstrap/fallback/control path. Qdrant's HTTP API and acknowledgements remain JSON wire edges, but Epiphany-owned retrieval point payloads are typed at the adapter boundary before serialization/deserialization. - - `notes/epiphany-memory-graph-unified-plan.md` applies the mapped-fractal-domain/cache lesson to Epiphany and corrects the organ boundary: repo architecture/dataflow and agent memory are profiles over one `EpiphanyMemoryGraph`, not separate graph engines. The first native skeleton is landed: `epiphany-state-model` owns the public document vocabulary, `epiphany-core::memory_graph` owns stable ids/validation/freshness/context cuts/CultCache persistence, and `epiphany-memory-graph` exposes status/validate/context/smoke without Qdrant. `notes/archive/repo-fractal-dataflow-cache-plan.md` and `notes/archive/agent-memory-fractal-cache-plan.md` are profile-plan provenance beneath that substrate. If deleting Qdrant deletes understanding, the design is wrong; the fallback must be slower but still correct typed graph traversal. - - `epiphany-state-model` owns the deterministic prompt-state renderer beside the typed `EpiphanyThreadState` document it serializes. `epiphany-core` re-exports that renderer for compatibility and owns rollout replay helpers, retrieval/indexing, distillation, proposal, promotion policy, scene projection, freshness derivation, pressure derivation, job/progress view derivation, planning view derivation, reorientation resume/regather verdict policy, pure CRRC recommendation policy, fixed-lane coordinator decision policy, role-board projection policy, and role-result interpretation/self-persistence review policy where possible. - - Vendored Codex has no Epiphany protocol, thread-state projection, route, notification, rollout migration, host wrapper, watcher, scheduler, or mutation seam. It retains Codex-native app-server/auth/model machinery only. Epiphany update law, retrieval/indexing, launch/interrupt policy, state, interfaces, and physiology belong in native Epiphany crates. - - The current algorithmic map is the source-grounded description of live control flow. - - Compact-Rehydrate-Reorient-Continue is an architecture primitive; automatic runtime coordination is not landed yet. - - Context pressure must become an explicit runtime signal for automatic CRRC; inference from transcript vibes, user warnings, or shrinking safe scope is useful only as a temporary human/agent heuristic. - - The harness now has an in-flight investigation checkpoint packet in durable typed state; automatic CRRC still needs runtime logic that reads the packet and decides whether to resume or force reorientation and re-gathering after compaction. - - GUI/client work must reflect or steer typed state rather than manufacture a second throne of truth. - - The Aquarium operator UI now lives in sibling repo `E:\Projects\EpiphanyAquarium`, with its own `AGENTS.md`, `state/map.yaml`, `state/memory.json`, and interface doctrine. It remains a local Tauri v2 + React/WebGL client over EpiphanyAgent's app-server/tooling surfaces; app-server and typed Epiphany state remain authoritative. - - EpiphanyAgent no longer carries the embedded `apps/epiphany-gui` source tree. Backend artifact directories and action tools still use the historical `.epiphany-gui` contract until that backend naming seam is deliberately renamed. - - Durable `job_bindings` now form a thin Epiphany-owned launcher seam: new specialist/reorient launches write only binding id, kind, scope, owner role, authority scope, linked ids, and an optional blocking reason. Runtime lifecycle ids live in `runtime_links` and runtime-spine job/result records, not in durable job bindings. - - The `jobs` view lens is a read-only job/progress reflection: it derives indexing, remap, verification, and specialist slots from authoritative state and retrieval summaries, then projects heartbeat-backed bindings as pending heartbeat turns. It is not the scheduler, notification stream, durable runtime job table, or SQLite reader. - - `thread/epiphany/jobsUpdated` is sealed legacy Codex evacuation telemetry. The handler no longer emits Epiphany updates from old runtime `agent_job_progress:{json}` background events; heartbeat/runtime-spine is the live activation and result path. - - Native `derive_freshness` is a legacy read-only pressure projection: canonical retrieval state, explicit legacy frontier pressure, and positive watcher changes are its inputs; retrieval/legacy-graph/watcher judgments are its outputs. Watcher silence, legacy graph checkpoints, MVP adapters, jobs, reorientation, CRRC, and launch projection are forbidden readiness writers. The ungrounded churn freshness and graph checkpoint revision fields were deleted; checkpoints retain identity/frontier content and churn retains understanding/diff/warning/unexplained-write evidence. `surfaces/jobs.rs` consumes the same derived graph judgment and therefore keeps remap Needed without canonical authority. Canonical RepoModel revision/hash plus its exact Mind-issued `RepoModelAdmissionReceipt` proves admitted map identity only. Whole-repository readiness requires a race-bounded Mind join: fresh Body root R1, exact Body-grounded model admission, semantic eligibility, retrieval coverage for R1, then fresh Body root R2 equal to R1. Watchers and Hands receipts trigger recomputation but do not prove continuity or readiness. Snapshot metadata, watcher silence, and timestamps cannot substitute. - - `thread/epiphany/context` is the targeted read-only state-shard surface: `epiphany-core` selects graph nodes/edges, active frontier, checkpoint, observations, and evidence from authoritative typed state while app-server only adapts protocol, without mutating or notifying. - - `thread/epiphany/graphQuery` is the read-only graph traversal surface over authoritative typed state: `epiphany-core` returns explicit nodes, path/symbol matches, bounded neighbors, and frontier neighborhoods with architecture/dataflow links while app-server only adapts protocol, without mutating, notifying, indexing, scheduling, proposing, or promoting. - - The `pressure` view lens derives context pressure from current context usage, not cumulative token spend, against auto-compact/context limits without compacting, scheduling, mutating, or notifying; compaction prep starts at 80% of the active limit. - - The `reorient` view lens is the sole owner of the bounded read-only `resume` versus `regather` verdict. Resume requires a durable resume-ready investigation checkpoint, retrieval Clean, graph Clean, and watcher Clean or Unknown. Retrieval/graph non-clean or watcher Dirty/Stale/Changed forces Regather with an explicit reason; path-overlap heuristics no longer override freshness authority. MVP status, worker launch, coordinator, and CRRC consume this one decision and may not reinterpret it. The lens does not mutate state, compact, schedule, or silently continue work. - - The `crrc` view lens composes pressure, the reorientation verdict, fixed reorient-worker binding/result status, finding read-back, and available actions into one read-only recommendation without launching, accepting, compacting, scheduling, or mutating state. - - A narrow auditable coordinator is central to the MVP because implementation, modeling/checkpoint, verification/review, and CRRC automation feed each other's machine-signals. CRRC itself is harness workflow automation, not a specialist-agent soul: it watches pressure/continuity, ensures persistence, triggers compaction/rehydration/reorientation when needed, and may launch a bounded reorient-worker specialist when semantic regathering is required. - - Native coordinator status composes roles, pressure, reorientation, CRRC, role results, and reorientation results into an operator-safe action recommendation. It reads native thread/runtime stores; no `ThreadEpiphany*` projection or app-server emission step exists. - - Coordinator implementation clearance is stricter than review acceptance: an accepted verification/review finding only opens the implementation gate when its verdict is `pass`; accepted `needs-evidence`, `needs-review`, or `fail` findings send the loop back toward modeling/checkpoint strengthening or reorientation instead of blessing a sick machine. - - Coordinator regather handling is now fixed-lane first, not supervisor improvisation: `regatherManually` is a fallback only after reorient/modeling/verification review and launch lanes cannot advance the state, completed modeling findings must be reviewed before verification, and the CLI coordinator's explicit test-only `--auto-review` mode may accept modeling state patches before launching verification while production semantics remain review-gated. - - Native `epiphany-mvp-coordinator` is the first auditable coordinator runner: it drives the fixed single-user lanes through app-server APIs, opens a native runtime-spine session, records native runtime job/result receipts for launched specialists and reorient workers when terminal results arrive, keeps semantic findings review-gated by default, and writes coordinator summaries, JSONL steps, rendered snapshots, transcript, stderr, runtime-spine status, and final next-action artifacts. Runtime-spine remains owner of `epiphany.coordinator_run_receipt.v0`, Hands/Substrate Gate remain owners of action permission, and thread-state acceptance receipts remain owners of role review/admission; local Verse now gets operator-safe `epiphany.cultmesh.coordinator_run_receipt.v0`, `epiphany.cultmesh.hands_action_gate.v0`, and `epiphany.cultmesh.role_review_event.v0` mirrors for discovery/readback. It refuses direct backend-completion mutation; full specialist completion smoke must use live workers while the execution path is cauterized into CultNet. - - Native `epiphany-runtime-spine` is the first Codex-independent runtime vertebra: it initializes and inspects typed CultCache `epiphany.runtime.identity`, `epiphany.runtime.session`, `epiphany.runtime.job`, `epiphany.runtime.job_result`, and `epiphany.runtime.event` documents, opens/completes native jobs with result records, snapshots jobs by id, and can emit a framed CultNet hello message advertising the native document and mutation contract surface. App-server launch now opens typed runtime jobs; `roleResult` / `reorientResult` read heartbeat-backed typed job results only; and `roleAccept` / `reorientAccept` accept completed heartbeat findings from the typed runtime-spine path without opening the Codex SQLite state runtime. - - CultNet public API shape is schema-first and mutation-contract-first: hello frames advertise readable document types, allowed operations, mutation authority, typed intent document types, and typed receipt document types. Aquarium and swarm clients should submit intents and watch receipts instead of inventing JSON-RPC verbs or blindly replacing authoritative state. - - Runtime-spine hello advertises only document and mutation capabilities backed by the native runtime body. `epiphany.surface.*` schemas remain discoverable vocabulary for local projections, but they are absent from Hello until an owning provider publishes a typed document with a real Snapshot resolver; actions additionally require a typed dispatcher and receipt path. Aquarium must not turn schema discovery into capability discovery. - - Epiphany's public pitch is project-native agency, not just better prompting. Aquarium is the clearest client, but Discord roles, voice/WebRTC rooms, stream overlays, native CLIs, and other CultNet tools should all speak to the same typed project/Personas substrate. Personas advocate for repo needs, answer from jurisdiction, and can propose work; the scheduler and coordinator decide what thinks next, while review gates decide what may mutate canonical state. - - Epiphany publishes its schema vocabulary locally under `schemas/cultnet/`, and `epiphany-runtime-spine schema-catalog --include-schema-json true` emits a merged builtin-plus-local schema catalog for consumers. The catalog covers runtime-spine documents, durable agent/heartbeat/ledger state, local `epiphany.surface.*` projection vocabulary, control intents, and receipt/artifact payloads; catalog presence does not prove runtime support. Vendored `cultnet-rs` is aligned to the canonical C# CultNet raw record shapes: replication uses `schemaId` plus `recordKey`, snapshot filters use `schemaIds` / `recordKeys`, and hello advertises only current typed mutation capabilities. - - Epiphany now owns the canonical schema paperwork in `schemas/`: a local mirror of `ghostlight.agent-state.schema.json`, plus human-facing receipts for canonical agent-state shape, standing role-trait glossary, heartbeat store shape, Persona state, WorkOrgan state, and repo-personality birth projection. Trait names like `routing_discipline` are now documented at the source instead of existing only in live organ-state records, startup templates, or stale Ghostlight notes. - - Organ-state doctrine now distinguishes `work_organ` from `persona`. Most Epiphany sub-agents want lean identity, memory, goals, values, private-note growth, and heartbeat activation because effectiveness matters more than theatrical density. Epiphany Persona, VoidBot repo Personas, and Ghostlight characters want portable Persona state: denser personality, provenance, public presentation, generic candidate actions, affect, relationship pressure, perceived overlays, and appraisal-shaped fallibility. `anchoredThought.extensions` is preservation-only sludge quarantine, not portable authority. The classification is now queryable through native agent-memory status, character-loop packets, and `epiphany.agent_utterance_state.v0` as `organStateProfile`; `epiphany-agent-memory-store project-persona --role-id Persona` projects the local Persona record into `gamecult.persona_state.v0`. - - Persona packets now expose deterministic Ghostlight-style projection, appraisal, and reaction seeds built from local canonical traits, relationship pressure, perceived overlays, and visible stimulus. They also carry `epiphany.agent_utterance_state.v0`: a memory-free speech-conditioning document derived from the organ-state record plus heartbeat physiology, including a 32-axis current emotional-state projection and the fixed 64-float `weksa.utterance_embedding_handoff.v0.1` character-state vector for AquaSynth/Weksa utterance embedding. This makes embodied response machinery available to the public mouth without granting omniscience, leaking memories into speech embeddings, or silently mutating state. Multiple Persona actors remain part of the long-plan; the current singular `Persona` role is an MVP simplification, not the intended endpoint. - - Repo personality initialization is now specified as a map-reduce projection, not a hand-written vibe pass: read-only scouts score body taxonomy, history temperament, and memory doctrine across nearby repos, reduce them into normalized variance criteria, and emit reviewable `repoTerrainReport`, `repoPersonalityProfile`, and `rolePersonalityProjection` candidates before touching agent memory. - - Native `epiphany-repo-personality` is the first startup-personality scout and birth-only distiller packet renderer: it deterministically inventories local git repos, scores repo terrain/history/state surfaces, writes typed CultCache terrain/profile/role-projection MessagePack stores, emits JSON/Markdown inspection glass, and renders a Repo Personality Distiller specialist prompt packet for Self-reviewed first role-memory petitions. The distiller must run only when a repo/swarm has no accepted personality initialization; after that, personality drift belongs to heartbeat, mood, rumination, sleep consolidation, lived evidence, and reviewed `selfPatch`. Startup routing now checks accepted initialization records, generates missing startup-only packets only once, applies reviewed birth memory and heartbeat physiology seeds, and leaves later drift alone. Birth specialists are not heartbeat lanes; heartbeat receives only accepted seed pressure. - - Repo memory initialization is a separate birth-only organ from repo personality initialization. `epiphany-repo-personality memory-packet` uses the typed terrain/profile/projection store plus bounded source excerpts from doctrine, docs, state, research, contracts, verification, runtime, and code surfaces to render a Repo Memory Distiller packet with mission-specific briefs for Self, Persona, Imagination, Eyes, Modeling, Hands, and Soul, plus Continuity protocol doctrine as typed state pressure rather than role memory. It petitions Self with role-specific organ-state memory candidates; it does not mutate memory, set objectives, copy raw dumps, or reset living memory after startup. - - Repo trajectory initialization is now its own birth-only organ. `epiphany-repo-personality` derives a typed `repo_trajectory_report` from early-history, recent-history, doctrine/content excerpts, and deterministic theme scoring, and `trajectory-packet` renders a Repo Trajectory Distiller prompt/packet so Self can review historical direction, self-image, implicit goals, anti-goals, and role-local trajectory pressure before the swarm wakes. - - The first repo birth startup valve is native: `epiphany-repo-personality startup` checks a typed CultCache init store for accepted `repo-trajectory`, `repo-personality`, and `repo-memory` records, generates missing birth packets for Self review, marks them as birth-only startup-runner work with no heartbeat participant, and stops with `reviewInitializationPackets`; `epiphany-repo-birth-runner` now turns those packets into startup-only prompts, output schemas, typed model-runtime request documents, runtime-spine receipts, result files, and exact accept commands without offering the old Codex CLI executor path; `accept-init` can review/apply role `selfPatch` candidates from a distiller result through `state/agents.msgpack`, stamp `repo-personality` canonical Ghostlight trait bundles from deterministic role projections, seed `repo-personality` heartbeat physiology through `state/agent-heartbeats.msgpack`, record reviewed packet acceptance as `epiphany.repo_initialization_record.v0`, and later startup returns `continueStartup` without rerunning the birth rites. Aquarium review UI is still the next routing gap. - - Limited native CRRC automation is now wired only at turn-complete safe boundaries: it can submit a compact operation when the read-only coordinator recommends `compactRehydrateReorient` or when a successful pre-compaction checkpoint intervention left a pending compact handoff for the completed turn, and it can launch the fixed `reorient-worker` when the coordinator recommends `launchReorientWorker`. It does not auto-launch modeling or verification, auto-accept findings, promote evidence, edit implementation code, or continue after reviewable semantic results; the rite may carry the stretcher, not declare the patient healed. - - Pre-compaction checkpoint intervention is now wired at token-count boundaries: when a loaded Epiphany thread crosses the existing `shouldPrepareCompaction` pressure threshold during an active turn, the harness steers the active agent once for that turn with a bounded CRRC directive to bank scratch/checkpoint/map/evidence before compaction/reorientation. A successful steer marks a turn-scoped pending compact handoff consumed at clean turn completion; this is banking the fire before the dark, not semantic acceptance, broad scheduling, or automatic implementation continuation. - - Native `epiphany-mvp-status` is the first dogfood operator view: it starts or reads a thread through app-server and renders scene, planning, pressure, reorient, jobs, role result read-backs, reorient result, CRRC recommendation, heartbeat, Persona bubbles, and MVP role lanes as text or machine output without becoming a state store. The old Python status module has been cut; native Rust/CultCache/CultNet surfaces are the product path. - - Native status exposes the tool spine as operator-visible read-only state. Runtime-spine counts typed tool invocation intents, receipts, and pending calls; `runtime_tool_invocation_statuses` derives intent/receipt status rows; `epiphany-runtime-spine status` prints the counts; `epiphany-runtime-spine list-model-requests` prints request tool counts/names; and `epiphany-mvp-status --runtime-store ` renders a `tools` section without executing calls or accepting results. Verification/Soul workers receive typed tool definitions for bounded read-only inspection: `mcp__epiphany_source__read_file`, `mcp__epiphany_source__git_show`, and `mcp__epiphany_source__read_hands_receipt`. The model runtime lowers those definitions to provider calls and materializes complete calls as typed intents. `epiphany-tool-mcp-runtime` owns execution of one admitted intent and persistence of its typed receipt. Native source capability code plus endpoint/process/network/timeout/catalog/receipt policy are first-party; the official RMCP SDK owns MCP lifecycle and wire behavior only. Root-owned MCP configuration may name foreign servers. Codex auth, config, and app-server are forbidden writers and absent from this path. The deleted Codex MCP spine has no compatibility fallback. - - Model-tool feedback now has a typed continuation seam. `EpiphanyToolInvocationIntent` preserves the exact model `call_id` plus source model request id; provider-neutral and OpenAI request documents can represent assistant `ToolCall` inputs and `ToolResult` inputs; and `epiphany-model-runtime tool-followup` builds a self-contained provider-neutral follow-up request from typed tool receipts by carrying original input, the assistant tool call, and the tool result instead of depending on provider-side `previous_response_id`. ChatGPT Codex rejected `previous_response_id`, so the live continuation invariant is explicit transcript over hidden provider memory. `epiphany-model-runtime tool-followup-turn` derives and runs that continuation through the selected provider in one runtime-owned call, and `epiphany-model-runtime run-worker --auto-tools --tool-adapter-bin ` loops tool execution plus follow-up model turns before completing the worker result. - - The `roles` view lens is the harness-native role ownership surface: it projects implementation, Imagination/planning, modeling/checkpoint, verification/review, and reorientation lanes from authoritative typed state, bound jobs, pressure/reorient/CRRC, and worker result status without launching, scheduling, accepting, compacting, or mutating state. - - `thread/epiphany/roleLaunch` and `thread/epiphany/roleResult` are the first explicit role-scoped specialist templates: Imagination/planning, modeling/checkpoint, and verification/review launch through fixed heartbeat-backed bindings with typed runtime-spine receipts and can be read back as reviewable findings from typed runtime-spine job results, while implementation stays owned by the main coding agent and reorientation stays on the CRRC-specific launch/result path. - - `thread/epiphany/roleAccept` is the first review-gated role finding acceptance path: it accepts completed heartbeat-backed findings from typed runtime-spine results, accepts Imagination/planning findings only when they return a valid planning-only `statePatch` with draft Objective Draft review gates, accepts completed modeling/checkpoint findings only with a modeling-safe `statePatch`, accepts Research findings only with an Eyes-shaped evidence/scratch patch, and accepts Verification findings as receipt-only Soul verdict truth without granting statePatch authority. It builds accepted evidence/observation/receipt bundles through `epiphany-core` and rejects implementation, reorientation, job binding, objective adoption, or broad authority fields. - - `thread/epiphany/reorientLaunch` is the first bounded runtime consumer over the reorientation verdict: it launches one fixed `reorient-worker` heartbeat binding with explicit resume-versus-regather scope, authority, and checkpoint-derived payload, without making the `reorient` view lens a writer or turning CRRC into an ambient scheduler. - - `thread/epiphany/reorientResult` is the first bounded read-back surface for that worker: heartbeat-backed bindings read typed runtime-spine job results when present and otherwise report pending. - - `thread/epiphany/reorientAccept` is the first explicit acceptance write for completed reorient-worker findings: it accepts completed heartbeat-backed findings from typed runtime-spine results, builds accepted evidence/observation/receipt/scratch/checkpoint bundles through `epiphany-core`, can optionally update scratch and investigation checkpoint state, and emits `stateUpdated` with source `reorientAccept` without accepting pending work or launching follow-up work. - - After `thread/epiphany/reorientAccept`, CRRC recognizes the accepted reorientation finding and does not recommend accepting the same completed result again. - - The old Python MVP dogfood runner has been cut. Auditable dogfood must use native coordinator/status/runtime-spine tools or a new typed Rust runner that completes heartbeat-owned runtime-spine job results. - - Epiphany safety doctrine is to separate cognition from actuation, keep authority explicit, make interruption sacred, stage capability release, and treat operator misuse as a normal design input rather than a rude hypothetical. The machine must have brakes before it receives larger engines. - - Epiphany is built in the open, but publication mode is not one-size-fits-all: use FOSS where viable, source-available licensing where economics or capability risk demand it, and commercial terms where organizations extract real enterprise value. - - `thread/epiphany/jobLaunch` and `thread/epiphany/jobInterrupt` are the first bounded authority surfaces over the thin job seam: they mutate durable `job_bindings`, create or rely on `runtime_links` for heartbeat-owned activation, and preserve explicit interruption without turning the `jobs` view lens into a scheduler. - - Handoff, plan, harness-surface, and scratch files must have distinct jobs and must not become duplicate brains. - - A machine is perfect when every remaining part visibly deserves to exist; this applies to persistent memory too. - - Evidence is not an activity feed; repeated "I just did this" entries should be cut or distilled when git already proves the work. - - Language, tone, ritual, and emotional salience are real control surfaces for a language-model harness; they are not supernatural, but they shape attention, role, permission, and behavior. The rite is a steering wheel, not decoration. - - Major Epiphany prompt surfaces live in prompt files rather than Rust/Python string slabs: rendered state intro/doctrine under `epiphany-state-model/src/prompts/`, and modeling/Modeling, research/Eyes, implementation/Hands, verification/Soul, reorientation/Continuity, coordinator/Self, Persona/public-surface, and CRRC intervention templates in `epiphany-core/src/prompts/epiphany_specialists.toml`. - - Specialist prompts are role-distilled instead of generic and their live text is config-backed in `epiphany-core`: modeling/checkpoint is Modeling: code, dataflow, seams, and frontier; research/scout is the Eyes prompt surface for existing work, vendor guidance, libraries, papers, and anti-Greenspun source selection; implementation is the Hands, the main coding lane and actuator rather than a `roleLaunch` specialist; verification/review is the Soul of promise, invariants, evidence, and user truth; reorientation is a Continuity worker across compaction and source drift; coordinator is the read-only Self that routes attention without implementing, verifying, promoting, or accepting; Persona is the public Discord #aquarium surface that translates agent thought-weather without moderating or leaking sealed thought. - - Epiphany prompt surfaces now carry a shared Ghostlight-derived persistent memory projection before lane-specific text: prompt is not memory, durable typed state is the mind, personality and protected values are first-class salience handles, and every lane is explicitly responsible for making its own memory/model/prompt/evidence habit sharper or naming the needed repair. Each lane states self-improvement in its own rite-language: Imagination selects futures, Modeling clarifies anatomy, Eyes sees earlier, Hands touches source more precisely, Soul becomes harder to fool, Continuity loses less context, Self routes repair, and Persona becomes clearer at turning inner weather into useful social presence. - - Specialist self-memory now has a bounded CultCache persistence surface in `state/agents.msgpack`: Imagination, Modeling, Eyes, Hands, Soul, Self, and Persona each have an individual typed organ-state record for identity, semantic/episodic/relationship memory, goals, values, and profile classification. Work organs stay light; Persona may use portable Persona state. Continuity has typed protocol receipts instead of an organ-state record. These entries are lane memory only; project truth remains in authoritative `EpiphanyThreadState`. - - `state/agent-heartbeats.msgpack`, `epiphany-core::EpiphanyHeartbeatStateEntry`, and the native `epiphany-heartbeat-store` binary are the Ghostlight-derived heartbeat initiative seam. The harness sets a target heartbeat rate; participants carry arena, participant kind, initiative speed, next-ready time, reaction bias, interrupt threshold, current load, status, constraints, personality cooldown, mood cooldown, initiative heat, active-turn freeze state, and effective cooldown; pending coordinator work can pull its owning lane through a reaction window; otherwise the earliest ready active participant wins the slot. Organ-state records set the personality baseline, appraisals bend it with mood/anxiety signals such as urgency, arousal, thought pressure, guardedness, and reaction intensity, and lower effective cooldown means the lane recovers sooner and gets the floor more often. `HeartbeatMoodTiming` now also owns the 32-axis current affect vector used by utterance state: anger, despair, sadness, fear, contempt, annoyance, dismissal, flippancy, tenderness, warmth, shame, pride, fatigue, secrecy, hesitation, emotional containment, and related speech pressures are heartbeat physiology, not decorative prompt adjectives. Initiative heat is typed heartbeat policy, not a side flag: `epiphany-heartbeat-store heat` and the CultNet `epiphany.heartbeat_heat_intent.v0` contract can set or clear global, all, agent, role, arena, participant-kind, group, and constraint multipliers, with optional scene-clock expiry. Active thinking freezes initiative explicitly: running pending turns project `initiativeFrozen` / `initiative_frozen`, are ineligible for reaction, cannot be selected again, and start cooldown only after completion. The native `pump` command computes adaptive swarm pressure from external urgency, mood/anxiety, reaction intensity, thought pressure, and current pending load; relaxed pressure can launch nothing and run at crawl tempo, while alarm pressure can fill most or all active lanes up to a configured concurrency cap without waking any lane already running. If the winner has no routeable maintenance work, it ruminates on role quality and prepares bounded selfPatch pressure rather than pretending rumination has already consolidated doctrine. Sleep/dream cycle passes are the intended distillation window for reviewed self-memory and doctrine. Persona can win `surfaceAgentThoughts` or `discordAquariumChat` work slots. Epiphany also owns native character-loop projection through `epiphany-character-loop`, so organ-state records can respond to visible stimuli without importing Ghostlight as runtime. The same heartbeat store now owns the Void-derived routine fields typed `sleep_cycle`, typed `memory_resonance`, `incubation`, `thought_lanes`, `bridge`, `candidate_interventions`, typed `appraisals`, and typed `reactions` through the native `epiphany-heartbeat-store routine` command. - - `state/ledgers.msgpack`, `epiphany-core::EpiphanyStateLedgerEntry`, the `epiphany-state-ledger-store` binary, and the native `epiphany-state` CLI now own durable branch and evidence ledgers. The old tracked JSON ledger files and the migration/projection CLI hatches are gone. - - CultCache inspection, cross-language schema synchronization, and debug display tooling belong in CultLib, not in EpiphanyAgent. Epiphany should consume typed CultCache documents and expose product-specific status through its API, while general polyglot domain loading/inspection lives with the shared CultCache ecosystem. - - VoidBot's current routine is reference lineage only. Epiphany's native routine pass lives in Rust as `epiphany-heartbeat-store routine`: it reads typed organ-state records, projects typed memory-resonance pair documents, maintains incubation themes, runs analytic and associative cognition lanes, writes bridge syntheses/saturation/tension, produces reviewed candidate interventions, advances typed sleep/dream-cycle state, and writes an auditable routine receipt while leaving project truth and role memory mutation on their dedicated reviewed surfaces. Qdrant-backed memory vectors remain a future enhancement; the current native pass uses bounded local resonance over typed memories. - - `epiphany-character-loop` now advertises `epiphany.cognition_lanes.v0` and `epiphany.cognition_bridge.v0` in every character-turn packet, and its projection/appraisal/reaction seeds reuse the typed heartbeat cognition documents before artifact serialization. Its utterance-state projection is the Weksa/AquaSynth speech seam: typed identity, trait vectors, values, current mood, activation, 32 named affect dimensions, and a 64-float character-state vector, with episodic/semantic/relationship memories deliberately excluded. Persona and future role-local actors must run an analytic lane and an associative lane, then let the bridge choose bubble, draft, finding, silence, or bounded `selfPatch`; those lanes shape attention but do not mutate project truth. - - The Rust CultCache-compatible contract now lives in dedicated upstream `https://github.com/GameCult/cultcache-rs` and is vendored as `vendor/cultcache-rs`. Epiphany should consume it as the canonical typed MessagePack persistence seam instead of growing an embedded local copy like an unsanctioned organ. - - `state/persona-discord.toml` and the native `epiphany-persona-discord` binary are the Persona Discord boundary. Persona may interact only through #aquarium; missing or mismatched channel configuration produces candidate chat artifacts instead of posting elsewhere. When a Persona has a configured persona name/avatar, posting uses the shared Discord webhook pipe so each Epiphany can speak with its own nickname and avatar without needing a separate bot identity. - - `state/void-memory.toml` and the native `epiphany-void-memory` binary are the first Void memory bridge: Epiphany can check Void's Docker Postgres state spine, query Qdrant Discord-history and source/lore vector collections through the configured Ollama embedding model, and fetch raw archive context windows from Void's Discord archive. Raw archive rows remain evidence for Persona and Eyes, not public speech. - - The native `epiphany-heartbeat-store status`, the `heartbeat` block in native `epiphany-mvp-status`, and GUI actions `heartbeatStatus` / `runHeartbeat` are the first operator API surface for heartbeat initiative state and outputs. `runHeartbeat` advances one slot and emits a Discord-independent Persona bubble artifact; native `epiphany-heartbeat-store pump` adaptively launches concurrent deferred turns when swarm pressure justifies it. Status reflects the backing CultCache store and latest adaptive pacing receipt so Aquarium can see whether the typed heartbeat memory is present and whether the swarm is sleeping, stirring, or alarmed. - - The native `epiphany-persona-discord bubble`, the `Persona` block in native `epiphany-mvp-status`, and GUI action `PersonaBubble` are the first Aquarium bubble surface. Persona can open a local chat bubble artifact even when Discord channel id/token configuration is absent. - - `thread/epiphany/roleResult` and `thread/epiphany/roleAccept` now project optional specialist `selfPatch` requests with coordinator review through `selfPersistence`: good mutations are role-matched, bounded, evidence-grounded lane memory/goal/value/private-note updates; project truth, authority, code edits, graphs, checkpoints, planning, scratch, jobs, and raw transcripts are refused with reasons. GUI/coordinator acceptance paths apply accepted `selfPatch` requests through the native `epiphany-agent-memory-store` binary. - - Epiphany prompt doctrine is Epiphany-owned. Local instruction scope, concise progress updates, plan discipline, scoped edits, non-destructive filesystem/git behavior, focused validation, and concise honest finals remain first-class Epiphany harness discipline rather than Codex authority or prompt machinery. Good old scars are holy only after they are grafted into the right body. - - Bundled Epiphany agent prompts are parsed, rendered, and guarded against Codex-named prompt authority inside `epiphany-core`; bridge `launch.rs` is only a compatibility re-export for Codex-facing callers. Repo-birth specialist execution no longer accepts the old `codex-exec` path. Codex may provide compatible auth/model transport and quarantined app-server affordances; it must not wrap Epiphany agents in its own role, developer, collaboration-mode, or harness prompts. - - Greenspun-shaped invention is now a named prompt-level guardrail. Before building a parser, scheduler, renderer, protocol, storage layer, security mechanism, workflow engine, or algorithm, agents must perform or request a bounded Eyes/research scout rite and record why existing work does or does not fit. - - Repetitive operator work must be externalized as a visible queue before the harness treats it as complete. Batch rendering, tile generation, migrations, imports, or other finite loops need item counts, terminal states, blockers, and validation; a narratable partial run is progress, not completion. - - Epiphany must resist pattern completion bias: the implementor should relentlessly chase the stated objective, while the coordinator critically asks whether implementation satisfied the objective with evidence or merely produced a plausible turn, shortcut, or decorative diff. Pretty motion without objective movement is scrap-code theater. - - Dogfood supervision is a separate operator role. If the supervising Codex session edits the target repo directly, that work can be useful seed material, but it is not clean Epiphany evidence and must be labeled as supervisor intervention or contamination. - - Dogfood supervision is also a projection boundary: the operator may inspect summaries, verdicts, missing coverage, state patches, job state, and artifact receipts, but not the specialist's raw stream of thought or full transcript unless a forensic debugging request explicitly breaks the seal. - - Native `epiphany-agent-telemetry` derives operator-safe function/API telemetry from sealed app-server transcripts so the supervisor can see calls, statuses, paths, and counts without reading direct thoughts. - - Editor/runtime verification is a later engine-repo product boundary, not a current MVP dependency. Native `epiphany-unity-bridge` and `epiphany-rider-bridge` remain controlled, optional environment evidence surfaces; they do not own Epiphany state, prompt authority, scheduler decisions, or product priority. - - The product architecture may later use Rider as code view, Aquarium as agent dashboard, and Unity as runtime forge. Current priority is smaller and meaner: Epiphany state/process autonomy behind a bridge to relatively vanilla Codex. - - Epiphany has a workspace-scoped planning substrate separate from the active objective: conversation captures, inbox, normalized backlog, roadmap streams, objective drafts, and explicit objective adoption are distinct states. The active objective remains the bounded run contract; chat and imported issues are planning inputs until reviewed and promoted. `notes/archive/epiphany-planning-substrate.md` is product-model provenance; live planning state is the runtime and GUI planning surface. - - The first runtime planning slice is landed inside `EpiphanyThreadState`: typed captures, backlog items, roadmap streams, Objective Drafts, and GitHub source refs are revision-gated through `thread/epiphany/update`, rendered into prompts when present, and reflected read-only through the `planning` view lens. - - The first GUI planning operator slice is landed: status collection includes the `planning` view lens, the Tauri/React dashboard renders planning summaries, captures, backlog, roadmap streams, and Objective Drafts, and the `adoptObjectiveDraft` GUI action requires an explicit selected draft before updating objective, subgoal, planning status, scratch, checkpoint, observation, evidence, and adoption artifacts. - - The planning/future-shape role is Imagination: it can synthesize captures, backlog shape, roadmap streams, and Objective Drafts while Eyes scouts outside reality, but its output remains planning state until explicit human adoption. - - The Imagination lane is now a fixed roleLaunch/roleResult/roleAccept specialist over the existing job-control seam: it may launch as `planning-synthesis-worker`, return a reviewable planning-only `statePatch`, and update captures/backlog/roadmap/objective drafts after explicit acceptance without adopting an objective or touching implementation/modeling state. - - Unity integration must be editor-resident, not text-archeology-only: scene files, prefabs, materials, shaders, ScriptableObjects, asset GUIDs, prefab overrides, and serialized component fields should be inspected through a Unity Editor package using Unity APIs, with narrow mutation preview/apply commands and artifact receipts. - - The first resident Unity editor package now lives in the Aetheria branch `codex/epiphany-unity-editor-bridge`: `Assets/Editor/Epiphany/EpiphanyEditorBridge.cs` exposes editor-resident inspect, compilation, scene, prefab, serialized-object, and reference-search probes with JSON/Markdown artifacts. Epiphany's Unity bridge detects that package and plans named probe/test commands through `GameCult.Epiphany.Unity.EpiphanyEditorBridge.RunProbe`, while runtime execution remains blocked until the exact project-pinned Unity editor is present. - - The Aquarium Environment surface reflects latest Unity and Rider bridge audits: Unity shows project-pinned editor status, resident package presence, execute method, installed/candidate editor paths, search roots, and artifact bundle details; Rider shows executable, solution, branch, dirty state, changed files, installations, and bridge artifacts. - - The adjacent EpiphanyGraph React viewer is embedded in the Aquarium graph dashboard through the local package dependency; it consumes `graphs.architecture`, `graphs.dataflow`, and `graphs.links` directly and exposes node/edge/code-ref inspection with machine-readable graph data behind the visual layout. - - Native `epiphany-rider-bridge` is the first operator-safe Rider source-context bridge: it inspects Rider installation/solution/VCS status, captures current file/selection/symbol context packets, plans explicit Rider code-ref opens, writes `.epiphany-gui/rider` artifacts, and feeds implementation prompt guardrails without reading sealed worker streams or owning durable state. - - GitHub Issues should import into planning captures first, not directly into active objectives. The importer should preserve repository, issue number, ids, URL, title/body, labels, milestone, assignees, author, state, timestamps, comment metadata, PR marker, and optional Projects v2 metadata while keeping GitHub as an external source bridge rather than Epiphany's internal backlog model. - - If the agent's persistent instructions, memory, workflow, or state shape are making it less coherent, slower to rehydrate, less honest, or more likely to build Jenga, the agent should ask the user to change it. A machine-spirit that knows its own corrosion must report it. - - Epiphany should make compaction less like death and more like sleep: bank the fire before the dark, so the next waking thing finds coals instead of ash and can meaningfully resume the pattern instead of merely continuing the task. - -landed_baseline: - phases: - - Phase 1: durable Epiphany thread state and rollout persistence. - - Phase 2: prompt integration through rendered Epiphany state. - - Phase 3: typed client read surface through `Thread.epiphanyState`. - - Phase 4: hybrid retrieval plus explicit Qdrant indexing with BM25 fallback. - - Phase 5: typed update/distill/propose/promote/read/notification control plane. - - Phase 6: read-only view lenses for scene, job/progress, roles, planning, current-context pressure, reorientation policy, CRRC, and coordinator; separate freshness with watcher-backed invalidation inputs, targeted context, and graph traversal query surfaces; plus durable investigation checkpointing for compaction-safe planning, a thin launcher seam in durable job bindings, explicit launch/interrupt authority over that seam, and a bounded reorient-guided worker launch surface. - - Phase 6 read-back: read-only reorient-worker result reflection through `thread/epiphany/reorientResult`. - - Phase 6 acceptance: explicit reorient-worker finding acceptance through `thread/epiphany/reorientAccept`. - - Phase 6 dogfood view: first CLI operator status over scene/pressure/reorient/jobs/result/CRRC. - - Phase 6 dogfood runner: old Python runner cut; replacement must be native Rust/CultCache/CultNet and complete typed runtime-spine job results from heartbeat-owned turns. - - Phase 6 role ownership: read-only `roles` view lens over implementation, modeling/checkpoint, verification/review, and reorientation lanes. - - Phase 6 role specialists: explicit `thread/epiphany/roleLaunch` and read-only `thread/epiphany/roleResult` templates for modeling/checkpoint and verification/review. - - Phase 6 modeling role acceptance: explicit `thread/epiphany/roleAccept` for reviewed modeling/checkpoint `statePatch` findings that can grow graphs/frontier/checkpoints through the existing state validator. - - Phase 6 coordinator: read-only `coordinator` view lens plus native `epiphany-mvp-coordinator` and smoke coverage for the fixed-lane MVP loop. - - Phase 6 safe-boundary CRRC automation: turn-complete automation limited to coordinator-approved compact, successful pre-compaction handoff compact, and fixed reorient-worker launch actions. - - Phase 6 pre-compaction checkpoint intervention: token-count pressure hook that steers active turns once when `shouldPrepareCompaction` is reached so working context is banked before compaction, then latches a pending compact handoff for clean turn completion. - - Phase 6 Aquarium extraction: the Tauri v2 + React/WebGL operator console moved from embedded `apps/epiphany-gui` into sibling repo `E:\Projects\EpiphanyAquarium`, with its own distilled interface state, memory, doctrine, build, visual smoke, and Tauri check. - - Phase 6 Unity runtime bridge: native `epiphany-unity-bridge` plus GUI Inspect Unity action resolve pinned Unity editors, reject wrong/missing versions, and write runtime artifacts before engine assumptions are treated as testable. - - Planning substrate design provenance: `notes/archive/epiphany-planning-substrate.md` formalizes conversation capture, inbox, backlog, roadmap streams, objective drafts, explicit adoption, the Imagination planning role, and GitHub Issues import. - - Phase 6 planning substrate runtime slice: typed planning state in `EpiphanyThreadState`, prompt rendering, revision-gated update validation, read-only `planning` view lens, scene action reflection, generated schemas, and live planning smoke coverage. - - Phase 6 GUI planning operator slice: MVP status and Tauri/React GUI render planning state; old Python GUI action shims have been cut from EpiphanyAgent. - - Phase 6 Imagination role lane: the `roles` view lens exposes Imagination/planning, `roleLaunch` can launch the fixed `planning-synthesis-worker`, `roleResult` projects its finding, `roleAccept` applies planning-only patches with review-gated Objective Drafts, and the GUI/status tools can launch, read, and accept that lane. - - Phase 6 Aquarium graph and Rider bridge slice: the Tauri/React/WebGL Aquarium embeds the adjacent EpiphanyGraph viewer over typed graph state, native `epiphany-rider-bridge` writes Rider/source-context artifacts, Aquarium Inspect Rider surfaces those artifacts, and `integrations/rider` scaffolds the first frontend-only Rider tool-window/context-action plugin. - - Phase 6 role self-memory slice: local organ-state records live in typed CultCache `state/agents.msgpack`, specialists may request bounded `selfPatch` lane-memory mutations, coordinator review projects acceptance/refusal reasons through `selfPersistence`, and GUI/coordinator accept paths apply accepted requests with the native `epiphany-agent-memory-store` binary. - - Phase 6 Persona public-surface slice: Persona's typed organ-state record, Persona prompt text, `state/persona-discord.toml`, the native `epiphany-persona-discord` persona/webhook pipe, `state/void-memory.toml`, and the native `epiphany-void-memory` bridge establish Persona as the public #aquarium-only translator of Epiphany agent thought-weather, with Void-derived Discord memory/search/presentation organs but without VoidBot's moderation authority. - - Phase 6 character-loop slice: native `epiphany-character-loop` loads any role's typed organ-state record from `state/agents.msgpack`, combines it with a visible stimulus, builds typed projection/appraisal/reaction seeds from the shared heartbeat cognition structs, and emits an auditable `epiphany.character_turn_packet.v0` local projection for response, bubble, finding, silence, or bounded `selfPatch`. Persona is the first intended public-surface consumer; Ghostlight is reference material, not a runtime dependency. - - Phase 6 heartbeat initiative slice: `state/agent-heartbeats.msgpack`, `epiphany-core::EpiphanyHeartbeatStateEntry`, the native `epiphany-heartbeat-store` binary, and heartbeat smoke coverage borrow Ghostlight initiative scheduling so Self, Persona, Imagination, Eyes, Modeling, Hands, and Soul compete for heartbeat slots; idle slots become bounded rumination instead of fake project work, and sleep/dream cycle passes emit Continuity protocol receipts rather than waking a Continuity persona. The live state surface now ticks/completes/pumps/applies heartbeat physiology through typed CultCache MessagePack instead of JSON or Python wrapper state. Role personality and current mood/anxiety both shape initiative recovery through personality, mood, and effective cooldown multipliers, so Hands-like work pressure and anxious high-need lanes can recover sooner without waking lanes whose previous turn is still running. Adaptive pump pressure controls tempo and concurrency: calm can launch zero and sleep slow; alarm can fill most active lanes. The same store can now initialize a `ghostlight-scene` profile for character scene turns. - - Phase 6 cognition-lanes/Void routine slice: native `epiphany-heartbeat-store routine` rebuilds VoidBot-style sleep, resonance, incubation, parallel analytic/associative thought lanes, bridge judgment, candidate interventions, Ghostlight-style participant-local thought appraisal, derived reactions, dream maintenance, and mood/anxiety timing inside Epiphany's heartbeat store. It now also carries Void's anti-loop organs: split `noveltyToSelf`/`noveltyToRoom`, source coverage, saturation pressure, refractory cooling, and explicit permission to let a live unsaturated thought deepen without forced novelty theater. It reads typed organ-state records from `state/agents.msgpack`, projects clustered thought state through each role's personality vectors, updates `state/agent-heartbeats.msgpack`, and emits an auditable `epiphany.void_routine.v0` receipt without importing VoidBot or granting speech/project authority. `epiphany-character-loop` also carries the same cognition lane/bridge/appraisal contract for role-local actor turns; reactions may pace, color, draft, or display behavior, but state mutation remains on reviewed `selfPatch` or project-state surfaces. - - Native runtime spine slice: `epiphany-core::EpiphanyRuntimeIdentity`, `EpiphanyRuntimeSession`, `EpiphanyRuntimeJob`, `EpiphanyRuntimeJobResult`, and `EpiphanyRuntimeEvent` plus the native `epiphany-runtime-spine` binary establish a CultCache-backed spine, native job/result lifecycle, status projection, and framed CultNet hello output so the old Codex app-server runtime can be starved down to a temporary evacuation bridge instead of remaining the throne. - - Native repo personality scout/birth-distiller packet slice: `epiphany-repo-personality` emits typed terrain reports, repo personality profiles, and role personality projections for the embodied sub-agent lanes from deterministic repo inventory and git-history scoring, then renders a birth-only Repo Personality Distiller specialist packet and prompt for review-gated initial personality quirk petitions; `epiphany-repo-personality-smoke` proves scout/project/agent-packet/status over tiny local repos. - - Native repo trajectory scout/birth-distiller packet slice: `epiphany-repo-personality` now also emits typed `repo_trajectory_report` documents from early-history, recent-history, doctrine/content excerpts, and deterministic theme scoring, then renders a birth-only Repo Trajectory Distiller packet so newborn swarms can inherit historical direction, self-image, implicit goals, and anti-goals without confusing those with active objectives. - - Native repo memory scout/birth-distiller packet slice: `epiphany-repo-personality memory-packet` renders a separate Repo Memory Distiller prompt/packet with bounded source excerpts and role-specific distiller briefs, so a newborn swarm can be prefilled with mission-relevant doctrine, maps, research, implementation habits, verification practice, and continuity rules without confusing memory with personality. - - Native repo birth startup valve slice: `epiphany-repo-personality startup`, `epiphany-repo-birth-runner`, and `accept-init` make trajectory/personality/memory birth packet generation, startup-only execution, and acceptance one-shot and review-gated through typed initialization records; generated packets advertise startup-runner ownership rather than heartbeat-lane identity; the birth runner has plan/run modes over typed model-runtime requests by default, writes prompts, schemas, runtime requests/receipts, logs, result files, and accept commands, and no longer offers the old Codex CLI executor fallback; `accept-init` processes distiller result `selfPatch` candidates through the native agent-memory review/apply path, stamps reviewed `repo-personality` canonical trait bundles through the native agent-memory store, and applies reviewed `repo-personality` heartbeat seeds through the typed heartbeat store; smoke proves first startup emits packets, birth runner plan artifacts exist, canonical trait bundles replace newborn baseline placeholders, heartbeat physiology mutates, reviewed memory output mutates a copied role memory store, and post-accept startup continues without regeneration. - guardrails: - - Use focused Rust app-server mapper/handler tests plus matching native `epiphany-core` smoke binaries before modifying update, distill, propose, promote, read-projection, or notification behavior. The old Python smoke shims have been cut. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-scene-smoke` before modifying scene projection behavior. - - Use focused `cargo test -p codex-app-server --lib map_epiphany_jobs` before modifying job/progress reflection behavior. - - Use focused Codex Rust tests before modifying launch/interrupt authority over the thin job seam. - - The retired `epiphany-phase6-freshness-smoke` binary does not exist and must not be summoned from stale doctrine. Verify freshness reflection with focused `surfaces::freshness`/consumer tests plus the full `epiphany-core` library suite until a new native smoke earns an actual runtime invariant. - - Use focused Rust app-server invalidation/freshness tests before modifying watcher-backed invalidation behavior inside freshness reflection; add a native smoke before broadening that surface. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-context-smoke` before modifying targeted context-shard behavior. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-graph-query-smoke` before modifying graph traversal behavior. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-planning-smoke` before modifying planning state or the read-only planning projection. - - GUI Objective Draft adoption now belongs to the Aquarium repo; verify there rather than through deleted EpiphanyAgent Python shims. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-pressure-smoke` before modifying context-pressure reflection behavior. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-reorient-smoke` before modifying bounded CRRC reorientation policy behavior. - - Use focused app-server/core Rust checks before modifying the bounded reorient-guided worker launch/result/CRRC coordinator surfaces. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-mvp-status-smoke` before modifying the MVP operator status view. - - Run the focused `epiphany-persona-discord`, `epiphany-persona-reddit`, and `epiphany-persona-other` binary tests and single-mouth smokes before modifying Persona outside-world bridge behavior. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-mvp-coordinator-smoke` before modifying the fixed-lane MVP coordinator endpoint or runner. - - Use `cargo test --manifest-path .\epiphany-core\Cargo.toml --lib runtime_spine -- --nocapture` and `cargo build --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-runtime-spine` before modifying native runtime-spine state or CultNet hello emission. - - Use focused app-server/core Rust checks before modifying explicit role launch/read-back/acceptance behavior. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-agent-memory-store -- smoke --store .\state\agents.msgpack` before modifying organ self-memory records or `selfPatch` persistence policy. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-heartbeat-store -- smoke --agent-store .\state\agents.msgpack` before modifying heartbeat initiative timing, idle rumination, or role slot selection. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-repo-personality-smoke` before modifying repo trajectory/personality terrain scoring, birth packet shape, startup-init routing, source excerpt selection, or role-specific initialization memory contracts. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-persona-discord -- smoke` before modifying Persona's #aquarium posting/draft guardrails. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-void-memory -- smoke` and `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-void-memory -- status` before modifying Void memory bridge behavior. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-unity-bridge-smoke` before modifying the Unity editor/runtime bridge. - - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-rider-bridge-smoke` before modifying the Rider source-context bridge. - - Do not claim live specialist execution works end to end until a native heartbeat/runtime-spine runner proves it with artifacts. - - Use `npm run build`, `npm run smoke:visual`, `cargo fmt --check`, `cargo check`, and `npm run tauri -- build --debug --no-bundle` under `E:\Projects\EpiphanyAquarium` before claiming Aquarium operator changes are usable. - - Use focused scene/jobs/context/pressure/reorient/protocol/schema checks for reflection-only changes. - - Use the native `epiphany-prepare-compaction` binary before and after imminent-compaction persistence passes. - - Use `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex` for Codex Rust work on this Windows machine. - - Do not parallelize cargo builds/tests against the same target directory. - -rejected_paths: - - name: pinned_map_only - reason: still one token stream with no typed write semantics - - name: train_new_base_model_first - reason: too expensive for a first falsifiable experiment - - name: third_party_opencodex_forks_as_primary_gui_base - reason: audited candidates were terminal-only, stale/aspirational, or incoherent wrappers - - name: monolithic_json_vector_store - reason: large embedding stores that rewrite whole files thrash and hide storage pain until it dominates the system - - name: append_only_persistent_notes - reason: persistent state that accumulates every local truth becomes memory cruft and weakens rehydration - - name: cleaner_codex_host_as_final_architecture - reason: making Epiphany cleaner inside Codex still preserves the wrong organ; Codex must be starved down to OpenAI subscription auth/model transport, while Epiphany data and subsystem communication move to typed CultCache/CultNet. + - Mind is the sole durable state-admission authority. + - Modeling maps the Body; Eyes establishes provenance; Hands acts; Soul verifies; Self routes. + - Persona speech and external consequences require explicit typed authority and signed receipts. + - Bifrost owns external transport; Idunn owns deployment actuation; neither may impersonate Epiphany cognition. + - CultMesh and Eve are projections, never owners of project truth. + - The canonical swarm brake blocks cognition and consequences while preserving read-only physiology and operator sight. + - Evidence and git retain history; this map retains only state that changes future decisions. current_status: - summary: Epiphany state, prompts, coordinator policy, runtime spine, receipts, and operator surfaces are native typed Rust/CultCache/CultMesh/CultNet organs. Vendored Codex retains Codex-native app-server plus OpenAI-compatible auth/model transport only. Canonical state has one transaction owner and one coordinator store boundary; native status/coordinator JSON emits `state`, and the extinct Codex Epiphany routes, DTOs, bridge, migration, and compatibility field cannot decide or describe native truth. - organ_naming_authority: > - Modeling is the standing embodied organ that models the Body: architecture, - dataflow, seams, invariants, graph/checkpoint anatomy, and source-grounded - self-sensing. Proprioception is a retired legacy name, not a second organ, - task posture, worker title, prompt stage, telemetry target, or whitepaper - authority. The global Codex doctrine, runtime Modeling telemetry projection, - live implementation plan, README, and packaged docs use Modeling. Legacy - string migration may still recognize Proprioception only to rewrite old - persisted agent identity into Modeling; archived/historical evidence may - retain the former name as provenance. - selected_proposal_authority: > - Direct User intake and exact selection are coordinator/runtime-spine - artifacts. The coordinator launch transaction alone injects the typed - proposal projection into one persisted Modeling launch and atomically binds - its exact document hash to job, request, proposal, runtime, and thread. - Mind/runtime-spine admission alone changes RepoModel after replaying that - complete immutable chain. Prompt text, result echoes, caller request ids, - operator surfaces, and repository/workspace labels are correlation or - provenance only. Caller-prepopulated projection, Persona prose parsing, - evidence intersection, bootstrap objective, ordinary Evolution frontier - mutation, second launch/reuse, epiphany-work intake, metadata adapters, and - parallel RepoWork maps/routes are forbidden writers. The shared path is - User proposal -> exact coordinator selection -> atomic typed Modeling - launch projection/binding -> immutable result/review -> full-chain Mind - replay -> one proposal-citing frontier contribution. Verification: core - 302 passed/1 ignored, OpenAI runtime 8 passed, hostile no-write proofs, and - independent Soul PASS. - eyes_claim_challenge_authority: > - Eyes may persist one immutable challenge against one serialized RepoModel - claim at one exact admitted model revision. Runtime-spine admission replays - the canonical Eyes packet hash and provenance, the unique current Mind - admission receipt, the model revision/hash, and the target claim hash; the - model, packet, and admission envelopes participate in the absent-only CAS. - Eyes does not write RepoModel. Self derives pressure from fully revalidated - current challenges through one shared target-overlap predicate: challenged - frontier is withheld from Imagination planning, Hands routing, and - actionable-Hands status while unrelated frontier remains eligible. Prompt - prose, UI state, direct CultCache challenge rows, latest-challenge helpers, - challenge metadata inside RepoModel, and generic evidence routers are - forbidden authorities. Verification: core 304 passed/1 ignored, hostile - immutable/substitution/no-write proofs, identical planning/Hands gates, and - independent Soul PASS. - claim_repair_request_authority: > - A still-live Eyes challenge now persists across unrelated RepoModel - revisions while the exact challenged claim bytes remain unchanged. Self may - mint one inert immutable RepoModelClaimRepairRequest that binds the - challenge and packet hashes, original and unique current Mind admissions, - current model and exact claim, runtime/thread identity, and every affected - frontier item hash in one causal CAS. The request has no patch purpose, - worker authority, result echo, model-write path, or Mind admission effect. - Immediate original=current admission companions are deduplicated; retry and - CAS-loss accept only the identical typed document. Verification: core 306 - passed/1 ignored and independent Soul PASS. - latest_cut: > - The bridge host seam has been cut down: target-specific Hands prompt scar - tissue was purged, bridge manifests carry the retained Codex websocket fork - patches, runtime-result acceptance no longer takes a whole CodexThread, - retrieval accepts workspace/Codex-home paths, invalidation uses Epiphany's - own notify watcher, live rollout/thread reads moved into vendored - app-server `epiphany_thread_host`, and mutation policy now depends on the - small `EpiphanyMutationHost` capability trait. Unused OpenAI bridge - reexports were cut; bridge durable-state imports now point at - `epiphany-state-model`; Codex token usage rollout replay moved back into - app-server; token telemetry crosses the wall as - `EpiphanyTokenUsageSnapshot`; and `CodexErr` was replaced with - `EpiphanyBridgeError`. The first protocol-starvation cuts are landed: - freshness now returns a serializable `EpiphanyFreshnessSurface`, job - launch/interrupt bridge results carry typed `EpiphanyJobView` plus host-edge - launcher metadata, and reorient/pre-compaction decisions consume typed - `EpiphanyPressure`. Reorient policy now consumes typed freshness directly, - reorient launch documents are built from typed core decisions, reorient - launch mutation results return typed decision/state-status values from the - bridge, and core reorient decisions are serializable CultNet-ready state. - Reorient decisions, coordinator decisions, coordinator source signals, CRRC - recommendations, role-board lanes, and core role/reorient result - interpretations now remain serializable typed surfaces; app-server still - projects those typed surfaces into `ThreadEpiphany*` responses at the legacy - JSON-RPC edge. Runtime-result loading now has core typed snapshot APIs, with - protocol finding tuples retained only as legacy wrappers; coordinator - policy now consumes those typed result snapshots directly for role and - reorient acceptance/gating signals. Delete the duplicate protocol-shaped - result rendering once acceptance and view response edges finish moving off - protocol finding authority. Role/reorient acceptance now builds receipts - and evidence from core typed findings, mapping to protocol findings only for - legacy accept response cargo. The duplicate protocol-shaped result helper - layer has been deleted, and result view responses now project directly from - typed runtime result snapshots instead of protocol tuple wrappers; the tuple - wrappers themselves are gone. Role acceptance now produces a core - `EpiphanyStateUpdate`; `ThreadEpiphanyUpdatePatch` is retained there only as - legacy accept-response projection. Role-board derivation now consumes core - pressure directly instead of `ThreadEpiphanyPressure`. Job reflection now - stays core-shaped inside the bridge as `EpiphanyJobView`; role-board and - view assembly consume those typed job documents, and `ThreadEpiphanyJob` is - projected only at legacy response edges. Context and graph-query derivation - now receive core `EpiphanyContextParams` / `EpiphanyGraphQuery` documents; - Codex `ThreadEpiphany*` request DTOs are converted before the core graph - policy is invoked. Role/reorient acceptance service results now return core - finding interpretations and typed role-state patches; app-server projects - them into legacy accept-response DTOs. Generic update/promote service entry - points now take typed `EpiphanyRoleStatePatchDocument` documents; app-server - converts `ThreadEpiphanyUpdatePatch` request cargo at the JSON-RPC edge. - Changed-field authority is now native `EpiphanyStateUpdatedField` in - `epiphany-core`; app-server projects it into - `ThreadEpiphanyStateUpdatedField` only for legacy responses and - notifications. Role launch, role accept, and role-result runtime lookup now - use core `EpiphanyRoleResultRoleId` internally; app-server maps - `ThreadEpiphanyRoleId` at the request/response edge. Reorient launch - service results now use typed `Epiphanysurfacesource`; app-server maps that - to `ThreadEpiphanyReorientSource` only for the legacy response. Generic job - launch now converts protocol `ThreadEpiphanyWorkerLaunchDocument` cargo at - the app-server edge before building the core `EpiphanyJobLaunchRequest`. - Coordinator note rendering now consumes core CRRC/coordinator actions, - pressure, and role/reorient result statuses instead of protocol - `ThreadEpiphany*` action/status DTOs, so prompt/text policy no longer - treats JSON-RPC enums as its native fact shape. Role-board note rendering - now consumes the core reorient state status too; `ThreadEpiphanyReorientStateStatus` - is response projection only, not prompt/text policy input. Context and graph-query - response builders now receive core `EpiphanyContextParams` / - `EpiphanyGraphQuery`; app-server read routes convert JSON-RPC request cargo - before invoking the bridge. Role-result response assembly now takes core - `EpiphanyRoleResultRoleId` and maps back to `ThreadEpiphanyRoleId` only - while shaping the legacy JSON-RPC response. Distill response assembly now - consumes core `EpiphanyDistillInput`; the JSON-RPC distill params are - converted before policy invocation. Role/reorient result response inputs - now use core `Epiphanysurfacesource`; role-specific legacy source enums are - created only during response projection. Changed-field derivation now - inspects typed `EpiphanyRoleStatePatchDocument` directly instead of - converting patches back through `ThreadEpiphanyUpdatePatch` projection. - View-lens orchestration now uses bridge-native `EpiphanyViewLens` selectors; - app-server converts `ThreadEpiphanyViewLens` at the request wall and the - bridge maps back only for the legacy response `lenses` echo. Coordinator - status derivation now receives core `EpiphanyCrrcResultStatus` for reorient - result state instead of protocol `ThreadEpiphanyReorientResultStatus`. - Coordinator view response assembly now receives core reorient state and - role-board status, projecting `ThreadEpiphanyReorientStateStatus` / - `ThreadEpiphanyRoleLane` only while building the legacy response. The next - rude cut landed: coordinator status derivation is a typed `epiphany-core` - seam (`EpiphanyCoordinatorStatusInput` -> `EpiphanyCoordinatorStatus`), so - bridge code gathers runtime/acceptance facts but no longer owns the - coordinator decision assembly. Coordinator finding signals now derive in - core from typed modeling/verification/reorient findings plus - `EpiphanyThreadState`, so accepted/reviewable/coverage/verdict/evidence - sequencing facts are no longer bridge helper law. View lens selector - semantics also moved into core: `EpiphanyViewLens`, default lens selection, - and lens dependency planning now decide which host facts app-server/bridge - need to load before Codex JSON-RPC response projection. The mistaken - vendored app-server ownership of Epiphany request mapping was corrected: - app-server now calls `epiphany-codex-bridge::protocol_edge`, while the - bridge-owned protocol edge converts Codex JSON-RPC request DTOs into core - `EpiphanyContextParams`, `EpiphanyGraphQuery`, `EpiphanyDistillInput`, - `EpiphanyWorkerLaunchDocument`, and `EpiphanyRoleStatePatchDocument`. - Vendored app-server no longer depends directly on `epiphany-core`. - Reorient worker launch-request/document - composition also moved behind a typed core seam - (`EpiphanyReorientLaunchRequestInput` -> `EpiphanyJobLaunchRequest`); - bridge supplies only the prompt instruction and retained compatibility - binding/owner constants before performing host side effects. - Freshness/job/reorient response projection moved out of vendored app-server - into `epiphany-codex-bridge::protocol_edge`: app-server gathers host facts, - invokes Epiphany bridge services, and sends Codex JSON-RPC responses, while - the bridge owns the enum/DTO conversion from typed Epiphany surfaces into - `ThreadEpiphany*` edge payloads. - The duplicate job projection authority in `epiphany-codex-bridge::jobs` - has been collapsed too: `jobs.rs` derives typed `EpiphanyJobView` only, - and `protocol_edge::protocol_job_from_surface` is the single - `EpiphanyJobView` -> `ThreadEpiphanyJob` mapper. - Runtime result loading is now typed-only at its module boundary: - role/reorient result status projection moved from `runtime_results` and - duplicate coordinator helpers into `protocol_edge`, so coordinator/view - response builders share the same Codex JSON-RPC status mapper. - Pressure projection is centralized at the same edge: `pressure.rs` derives - typed `EpiphanyPressure`, coordinator consumes typed pressure signals, and - `protocol_edge` owns the `EpiphanyPressure` / - `EpiphanyPressureLevel` -> `ThreadEpiphanyPressure*` mapping. - Reorientation derivation is now typed-only at its module boundary: - `reorient.rs` no longer imports Codex app-server protocol DTOs, no longer - exposes the unused freshness DTO tuple, and view/coordinator response - builders use `protocol_edge` for reorient state/decision projection. - Result finding, role-id, and patch projection are now edge-owned too: - `results.rs` renders typed result notes only, while `protocol_edge` owns - role-id request conversion plus role/reorient finding and state-patch - projection for Codex JSON-RPC responses. - State-updated notification projection also moved to `protocol_edge`: - `mutation.rs` now owns typed mutation and acceptance mechanics without - importing Codex app-server protocol DTOs. - `pressure.rs` is typed-only now as well: the last convenience helper that - returned `ThreadEpiphanyPressure` was deleted, and view response assembly - explicitly derives typed pressure before calling `protocol_edge`. - Coordinator projection has its own edge module now: - `coordinator.rs` no longer imports Codex app-server protocol DTOs and owns - typed coordinator status, CRRC recommendation input shaping, role-board - derivation, automation verdict selection, and role-board note rendering; - `coordinator_protocol.rs` owns Codex JSON-RPC projection for coordinator, - CRRC, and role-board response payloads. - Context/planning/graph derivation is split the same way: - `context.rs` now returns typed `epiphany-core` view documents, while - `context_protocol.rs` owns the Codex JSON-RPC tuple/projection cargo used by - view/context/graph response builders. - Scene derivation follows that boundary too: `scene.rs` now returns the - typed core `EpiphanyScene`, and `scene_protocol.rs` owns projection into - `ThreadEpiphanyScene` plus scene-action DTOs for view responses. - Retrieval follows the boundary too: `retrieve.rs` executes normalization, - indexing, state lookup, and typed retrieval responses; `retrieve_protocol.rs` - owns Codex JSON-RPC retrieve/index response projection and absolute-path DTO - validation. - View response assembly no longer owns private lens/source/reorient-status - projection helpers; those small enum conversions route through - `protocol_edge`, and the Codex response assembler is now named - `view_protocol.rs` instead of pretending to be the native Epiphany view - model. The larger typed-view wall remains under judgment. - The bridge still depends on vendored Codex for app-server protocol DTOs and - absolute path validation, so the purification is not done. - Runnability now has a thin operator entrypoint: - `tools/epiphany_local_run.ps1` builds the retained Codex app-server - compatibility edge, builds native Epiphany operator binaries, runs status, - plan, smoke, live coordinator, or local MVP product-cycle modes, and writes - launcher artifacts under `.epiphany-run/` plus coordinator evidence under - `.epiphany-dogfood/`. `-Mode mvp` is the current Persona-front-door wrapper: - it projects a typed Persona character turn, writes a local Persona/Aquarium - bubble, bootstraps a minimal local checkpoint for fresh threads, runs the - bridge-equipped coordinator loop with auto-tools, then invokes heartbeat - sleep/dream maintenance unless explicitly skipped. That bootstrap now maps - both the Persona/coordinator/sleep cycle and the coordinator-to-model-runtime - transport seam, so model failures are attributed to provider/runtime - transport instead of generic missing checkpoint state. - Live plan/run/MVP modes use the workspace `state/runtime-spine.msgpack`, - because CodexThread job launch writes typed worker requests there; the - `.epiphany-dogfood/` runtime store shape is artifact evidence only unless - CodexThread learns an explicit runtime-store override. - This is scaffolding over the current compatibility shell, not a new policy - owner. - The former `epiphany.cultmesh.operator_status.v0` family is deleted because - no observer owned it. Runtime-spine and prompt context expose only the - source-derived operator snapshot and run-witness families. - The next operator snapshot cut is landed: `epiphany-operator-snapshot` - distills the operator-safe MVP status artifact into - `epiphany.cultmesh.operator_snapshot.v0`, runtime-spine advertises that - document as local-user writable, and `tools/epiphany_local_run.ps1 -Mode - status` writes the snapshot after generating the legacy JSON status - artifact. The schema describes the real CultCache tuple payload, not an - object-shaped fantasy. - Local operator runs now have typed intent/receipt rails too: - `epiphany-operator-run` writes - `epiphany.cultmesh.operator_run_intent.v0` before the local wrapper acts - and `epiphany.cultmesh.operator_run_receipt.v0` after successful - completion; `tools/epiphany_local_run.ps1 -Mode status` now writes intent, - legacy status artifact, operator snapshot, and completion receipt in that - order. - The first native status cut is landed: `epiphany-mvp-status` has an - explicit `--source native` mode that reads `state/thread-state.msgpack` - when present and derives scene, pressure, jobs, roles, planning, reorient, - CRRC, and coordinator status through `epiphany-core` instead of Codex - JSON-RPC. `tools/epiphany_local_run.ps1 -Mode status` now builds only - Epiphany operator binaries, does not start or require `codex-app-server`, - and still writes operator intent, status artifact, snapshot, and completion - receipt. Codex status remains as a compatibility source for legacy smokes - and bridge-equipped coordinator paths, not the MVP status authority. - The first provider-neutral runtime seam is landed too: - `epiphany-openai-runtime` now also builds `epiphany-model-runtime`, whose - CLI accepts `--provider openai-codex` and owns the current - `model-turn`/`run-worker`/`smoke` executable contract. Coordinator run mode, - the local wrapper, and repo birth runner now default to - `--model-runtime-bin` plus `--model-provider`; old `--openai-runtime-bin` - and `openai-runtime` executor names remain compatibility aliases. This - does not make OpenAI generic internally yet: the current provider still - uses typed OpenAI request/event/receipt documents through the Codex auth - reliquary. The runtime default is `gpt-5.4` unless `EPIPHANY_MODEL` or - `CODEX_MODEL` overrides it; `gpt-5.5` is currently blocked by the retained - Codex-compatible transport as requiring a newer Codex client. It does move - provider selection out of scheduler/status/state surfaces and into one - runtime executable boundary. - The provider-neutral model document seam is now landed: - `epiphany-model-adapter` owns `epiphany.model_request.v0`, - `epiphany.model_stream_event.v0`, `epiphany.model_receipt.v0`, and - `epiphany.model_adapter_status.v0`; runtime-spine advertises those as the - coordinator/model contract; and OpenAI request/event/receipt/status - documents are read-only adapter evidence behind that boundary. The current - `epiphany-model-runtime` still executes through the Codex/OpenAI provider, - but model turns and worker launches now enter through provider-neutral - requests, store provider-neutral events/receipts, and mirror OpenAI docs - only as transport proof. - Coordinator plan/run output now has a typed receipt too: - `epiphany.coordinator_run_receipt.v0` is registered in runtime-spine, - advertised in the CultNet schema catalog, and written by - `epiphany-mvp-coordinator` at the end of plan/run/smoke passes. The - existing coordinator artifact JSON remains operator display and sealed - audit evidence, but it is no longer the only durable account of what the - coordinator decided. - The first tool/MCP boundary contract and quarantined execution spine are - named: - `epiphany-tool-adapter` owns typed `epiphany.tool_capability.v0`, - `epiphany.tool_invocation_intent.v0`, and - `epiphany.tool_invocation_receipt.v0` documents. Runtime-spine advertises - them as the Epiphany-facing tool contract so MCP discovery/call JSON can - remain protocol-edge cargo instead of scheduler, state, or acceptance - authority. `epiphany-tool-mcp-runtime` is the first-party executing organ: - it loads one typed invocation intent from CultCache, dispatches explicit - native `epiphany_source` capabilities locally, or calls a root-configured - foreign MCP endpoint through the official `rmcp` SDK, then writes one typed - invocation receipt. Epiphany owns endpoint admission, absolute stdio - process configuration, cleared child environments, HTTPS-or-loopback HTTP, - proxy/redirect refusal, whole-call bounds, tool-catalog verification, and - receipt persistence. RMCP owns MCP lifecycle and wire behavior. Codex owns - neither tool configuration nor execution. `epiphany-model-runtime` now - materializes complete MCP-shaped model tool calls as typed tool invocation - intents, and the native tool runtime consumes those intents from the mixed - runtime-spine store and emits typed success/failure receipts. - Epiphany agent launch/prompt authority has now been pulled out of the - bridge as well: `epiphany-core::agent_launch` owns specialist prompt - parsing/rendering, role/reorient launch instructions, role binding ids, - output schemas, coordinator note rendering, and CRRC pre-compaction prompt - rendering. The bridge `launch.rs` is a compatibility facade, and bridge - pressure rendering delegates back to core. Vendored app-server no longer - carries the bundled prompt regression test; that guard lives beside the - core prompt owner. - The fixed Research/Eyes lane is now part of the typed MVP spine: - `EpiphanyRoleResultRoleId::Research`, Research launch binding/owner/schema, - role-board lane, coordinator `LaunchResearch` / `ReviewResearchResult` - actions, status/coordinator CLIs, Codex bridge projection, and vendored - app-server protocol schemas all know the lane. The Research statePatch law - permits only Eyes evidence/observation/scratch/investigationCheckpoint - cargo and rejects modeling/planning/graph/checkpoint authority. MVP status - and coordinator smokes pass with six lanes, and the smoke harness now - rebuilds stale coordinator/app-server binaries before using them. - - `tools/epiphany_local_run.ps1 -Mode service-execution-runbook` is the repeatable elevated Windows service proof artifact generator. It writes a non-mutating `#Requires -RunAsAdministrator` PowerShell runbook containing the exact `service-execution-readiness`, `service-install-execute`, `service-start-execute`, `service-status`, `service-reconcile`, `service-stop-execute`, final `service-status`, and `service-execution-audit` wrapper calls, so the remaining elevated service proof can run through typed operator and lifecycle receipts instead of improvised `sc.exe` rites. The artifact now uses `Invoke-EpiphanyRunbookStep` to reset `$LASTEXITCODE`, catch thrown/nonzero failures, continue gathering receipts after a failed step, run final `service-execution-audit` in `finally`, and exit nonzero only after audit if any step failed. Generated child execution runbooks no longer use `Invoke-Expression`; each step invokes the known wrapper `ScriptPath` with an explicit `Arguments` array, making the elevated command surface inspectable and robust to path quoting. Direct wrapper summaries print the exact `elevatedCommand=Start-Process PowerShell -Verb RunAs -Wait ...` invocation, `artifactSha256=`, and `aftercare=tools/epiphany_local_run.ps1 -Mode service-execution-audit`; live proof `local-20260619-010940-287-a36a3df3` showed the command plus hash `2c763b6d3ba735dfde500d5b2e6fd71c872169668d43cbd637f41952e9ca5403` for the supervisor-service artifact without mutating the service manager. - - `epiphany-daemon-supervisor windows-service-execution-audit` and `tools/epiphany_local_run.ps1 -Mode service-execution-audit` are the post-run service proof verifier. The audit scans typed `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` documents for a service, first requires the sealed `windows-service-execution-runbook` receipt as the non-mutating preflight witness, then checks readiness/install/start/status/reconcile/stop receipt statuses, requires private-state sealing, writes its own `windows-service-execution-audit` lifecycle receipt, and returns `complete` only when the runbook plus elevated effect receipts prove the chain. Audit check rows now retain `operatorArtifactRef` from lifecycle receipts, so runbook witnesses can be identified without opening raw receipt payloads. `service-execution-audit-smoke` now writes synthetic sealed lifecycle receipts to prove the audit accepts a complete chain and then rejects a drifted reconcile receipt. Live wrapper proof `local-20260618-133559-466-6644f26f` reported the runbook witness as `written` and OK while six elevated effect receipts remained missing, preserving the elevated authority boundary. - - `epiphany-verse-query poke-down-daemons` and `tools/epiphany_local_run.ps1 -Mode swarm-poke-down` are the typed swarm responsibility reflex: inspect local Verse daemon status rows, write daemon poke intent/receipt documents for every non-ready daemon, respect the `daemon.lifecycle_poke` swarm brake, include target display name/body domain/private Verse id/Eve surface metadata from cluster topology in the operator-safe poke summary, and expose no private state. Compact poke rows now print each poke target, daemon id, observed status, body domain, private Verse, Eve surface, intent id, receipt id/status, resulting status, and `private=false`; live wrapper proof `local-20260618-180548-293-ff73f9de` temporarily degraded Hands, printed one topology-aware receipt row, and restored Hands to ready; follow-up swarm status proof `local-20260618-180618-002-06e77583` reported seven ready daemons and zero non-ready rows. `epiphany-verse-query smoke` source-proves both the ready no-op and degraded single-poke compact row path. - - `epiphany-verse-query swarm-status` and `tools/epiphany_local_run.ps1 -Mode swarm-status` provide the compact read-only liveness sight organ over local Verse daemon rows. It uses a narrow CultMesh daemon-liveness loader instead of serializing the full local Verse context, returns seven agent-friendly TUI rows with `READY`/`POKE`, daemon id, body domain, private Verse id, Eve surface, `followUp=tools/epiphany_local_run.ps1 -Mode swarm-poke-down`, and `private=false`, and exposes no private state. Live wrapper proof `local-20260618-210235-584-110d1120` printed all seven Rust-owned `READY` rows in `statusRows` with body domain, private Verse ids, Eve surfaces, batch poke follow-up, and `private=false`; source smoke also proves degraded Hands returns a `POKE` row with `privateVerse=epiphany.cluster.hands.private` plus the same follow-up command. - - `epiphany-verse-query eve-surfaces` and `tools/epiphany_local_run.ps1 -Mode eve-surfaces` provide the compact read-only Odin/Eve surface directory over local Verse rows. Odin reads cluster topology, default advertisements, and daemon-owned Eve surface states through a narrow CultMesh loader; it returns seven agent-friendly TUI rows, one Persona public discussion surface, a `connect-eve` command hint, and `privateStateExposed=false` without serializing the full local Verse. The compact TUI rows expose stable `cluster=` identity beside surface id, daemon id, body domain, private Verse id, public-discussion flag, supported actions, exposed document types, advertisement id, and `private=false`; wrapper proof `local-20260618-225347-287-ea5d7476` prints all seven rows in `surfaceRows`, including Persona's public discussion surface and all local organ surfaces, plus `privateStateExposed=False`. - - `epiphany-verse-query connect-eve` and `tools/epiphany_local_run.ps1 -Mode eve-connect` provide the compact Odin-to-Eve collaboration receipt. The command selects the daemon-published surface through the narrow Eve directory, writes connection intent/receipt documents, verifies latest receipt keys through narrow CultMesh loaders, defaults the wrapper target to `epiphany.cluster.persona`, and exposes no private state. - - `epiphany-verse-query collaboration-feedback` and wrapper mode `collaboration-feedback` record public, bounded Persona feedback after the prerequisite Eve receipt. They reject caller-supplied Imagination consensus fields and return pending consensus sight; Imagination remains the response owner. Candidate actions are requests, not Mind adoption or Bifrost authority. - - `epiphany-verse-query bifrost-publication` and wrapper mode `bifrost-publication` record requester-owned body-change publication intents. They reject caller-supplied Bifrost/GitHub provider result fields, report `pending-bifrost`, and expose no private state. Provider acceptance and GitHub publication remain absent until authenticated provider ingress admits them. - - Epiphany has no local `bifrost-ledger` or provider-accounting closure surface. The former report assigned Bifrost/GitHub/Maintainer/Imagination ownership and `closed` accounting from response-shaped documents in a shared local store without authenticating provider participation; its command, wrapper, reports, closure algorithms, tests, hints, audit action, and follow-ups are deleted. Requester-owned publication/public-proof intents and Persona feedback remain pending. Missing provider response has no local closure command. Future closure requires a provider ingress/admission receipt binding provider identity/contract, transport session, exact payload hash/document id, correlation, admitted-at time, target runtime/Verse, and verification result. - - `epiphany-verse-query receipt-directory` and `tools/epiphany_local_run.ps1 -Mode receipt-directory` provide the compact latest-witness directory over local Verse. It indexes operator run, daemon poke, daemon tool invocation, Eve connection, Bifrost publication, Imagination consensus, coordinator run, Hands gate, role review, work-loop, cluster service lifecycle, single-service lifecycle, cluster service execution runbook, single-service execution runbook, scheduler, Persona speech, and agent-state SoA witness families from typed local Verse projections; returns agent-friendly `OK`/`ABSENT`/`ATTN` TUI rows with owner, family, status, route, latest id, follow-up command, `presentRowCount`, and `absentRowCount`; preserves `missingRowCount` as compatibility for absent witnesses; flags sealed service lifecycle failure states such as `not-elevated`, `execution-refused-not-elevated`, and `incomplete` as attention without exposing receipt payloads; routes service lifecycle receipts by their typed receipt action through `service_execution_check_follow_up_command` (readiness to readiness, install to install execute, start/stop to control execute, status/reconcile to their readback rites, audit to audit), while cluster/single execution-runbook witnesses route to their runbook regeneration wrappers; and exposes no private state or receipt payload previews. The lifecycle projection now reads the typed receipt family, splits `cluster-service-lifecycle` from `service-lifecycle`, selects the latest attention receipt before falling back to latest overall, and exposes `service-id::action` route values such as `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit`, so agents can see the owning lifecycle action without opening raw audit JSON. Compact receipt TUI rows append `followUp=`, artifact status, and SHA-256; wrapper proof `local-20260618-205920-451-383b0da7` now prints all seventeen compact rows in `receiptRows`, including missing Hands/role/work-loop gates, runbook hashes, scheduler follow-up, Bifrost/Imagination witnesses, and the active service lifecycle attention rows. It also exposes `cluster-service-execution-runbook` plus `service-execution-runbook` as display-only rows, so newer harmless planned/runbook lifecycle receipts cannot hide the active seven-service cluster wound. Receipt-directory JSON now carries Rust-owned `attentionRouteRows` derived from the same policy predicate as `attentionRowCount`, and the wrapper prints that field instead of rebuilding attention from ad hoc status strings; source smoke now proves a `cluster-windows-service-execution-readiness` receipt routes to `cluster-service-execution-readiness` and wrapper mode `cluster-service-execution-readiness` instead of laundering the row through audit. Live proof `local-20260618-212134-758-c7c56240` left the old degraded Hands daemon-poke receipt as an `OK` historical witness while attention routes named only the cluster and single-service lifecycle wounds. Daemon-poke rows now resolve historical receipt status against current daemon liveness: source smoke proves degraded remains degraded before heartbeat recovery and becomes `resolved` after current status returns ready, while live wrapper proof `local-20260618-212649-563-48647018` printed the old Hands poke receipt as `OK | Self | daemon-poke | resolved`. - - `tools/epiphany_local_run.ps1 -Mode service-tick` is the wrapper-owned daemon scheduler pulse rite. It runs `epiphany-daemon-supervisor tick` through the same local Verse store, operator run intent/receipt, agent-state SoA refresh, and swarm-brake preflight as other service lifecycle modes, but leaves restart authority inside durable daemon restart policies. The receipt directory scheduler row now follows up with `tools/epiphany_local_run.ps1 -Mode service-tick` instead of passive service status. Proof seeded one disabled Persona restart policy as inert policy metadata, then the wrapper wrote `daemon-scheduler-receipt-epiphany-daemon-supervisor-0` with `status=tickComplete`, `outcomeCount=1`, `skippedCount=1`, `restartedCount=0`, `refusedCount=0`, and `privateStateExposed=false`; the follow-up receipt-directory proof reported the scheduler row as present with route `*`, follow-up command `service-tick`, and no private-state exposure. - - `epiphany-cluster-daemon` is the first real per-cluster daemon heartbeat body. It runs as a narrow Rust binary parameterized by daemon id, publishes typed `epiphany.cultmesh.daemon_status.v0` heartbeats into the shared local Verse, can run once or loop, and exposes no private state. Durable restart policies for Self, Hands, Persona, Imagination, Eyes, Modeling, and Soul now invoke `epiphany-cluster-daemon heartbeat`, not the generic query/debug writer. A degraded proof showed `service-tick` invoking all seven daemon bodies through the supervisor and restoring ready liveness with sealed scheduler/poke receipts; a fresh tick no-ops when all heartbeats are current. `epiphany-daemon-supervisor cluster-service-runbook` and wrapper `-Mode cluster-service-runbook` write a non-mutating service runbook plus `daemon_service_lifecycle` receipt for all seven organ daemon `epiphany-cluster-daemon serve` commands. Direct `service-runbook` and `cluster-service-runbook` wrapper summaries now print local artifact SHA-256 plus follow-up/aftercare wrapper routes; live proofs `local-20260618-232133-314-4e55120e` and `local-20260618-232146-541-982dd60b` showed hashes `85a956f768e584a9d098f13a9bf03fc3560915821a2ae7eaab94889dd9ecda85` and `40616423a9210101486949d07291bf795175579a39e99de5e5a759f8e0d7a78c` without service mutation. Wrapper `service-plan` and `service-launch` now expose the native daemon-supervisor service lifecycle surfaces under the same brake gate; `service-launch` silences child stdout/stderr so the parent lifecycle receipt remains the only stdout JSON. Live proof `local-20260618-232935-349-7e3901c8` completed a bounded one-iteration launch with `exitCode=0` and no private-state exposure. `epiphany-daemon-supervisor cluster-service-install-plan` and wrapper `-Mode cluster-service-install-plan` write a non-mutating Windows install script plus lifecycle receipt for seven distinct per-organ Windows services. Wrapper `-Mode cluster-service-install-execute` requests execution through the same typed path and, in non-elevated shells, writes `execution-refused-not-elevated` with `executed=false` instead of mutating services. Direct cluster install wrapper summaries now include `artifactSha256=` and `followUp=tools/epiphany_local_run.ps1 -Mode cluster-service-install-execute`; live proofs `local-20260618-230937-335-71c4fdaa` and `local-20260618-230937-313-cb288388` showed the planned and non-elevated-refused cluster install artifact hash `c6b697e173eb319073da341fc90c2963bcd6bee63d804349205b6309c88df764`. `epiphany-daemon-supervisor cluster-service-audit` and wrapper `-Mode cluster-service-audit` read Windows service-manager state for those seven expected service names, writing an incomplete audit receipt when they are missing; direct audit summaries now point missing cluster services to `cluster-service-install-plan` plus `cluster-service-execution-audit` aftercare, with live proof `local-20260618-232200-992-b842ae01` reporting seven missing services and no mutation. `epiphany-daemon-supervisor cluster-service-start`/`cluster-service-stop` and wrapper `-Mode cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, and `cluster-service-stop-execute` record cluster lifecycle receipts for all seven services: plan modes emit seven `*-planned` rows without mutation, and explicit execute modes refuse as `execution-refused-not-elevated` with seven refused rows when the shell lacks service authority. The cluster install/audit/control wrapper summaries now print compact `serviceRows` for all seven daemon-owned Windows service names with daemon id, status or observed status, cluster id, executed flag, exit code, start type, and `private=false`; live proofs `local-20260618-211051-126-2a89d61c`, `local-20260618-211051-125-cd687ee2`, `local-20260618-211051-063-f0ff980d`, and `local-20260618-211118-108-df5cb8cd` show seven missing audit rows, seven ready/demand install-plan rows, seven start-planned rows, and seven stop-planned rows without service mutation. `cluster-service-execution-runbook` writes an admin-gated wrapper sequence for cluster-native readiness, cluster install, cluster start, cluster audit, cluster stop, and final cluster audit; the artifact now uses `Invoke-EpiphanyRunbookStep` to reset `$LASTEXITCODE`, catch thrown/nonzero failures, continue gathering receipts after a failed step, and always runs `cluster-service-execution-audit` from `finally`; generated child execution runbooks no longer use `Invoke-Expression`, and each step invokes the known wrapper `ScriptPath` with an explicit `Arguments` array. The wrapper calls `epiphany-daemon-supervisor cluster-service-execution-runbook` after artifact generation, so the runbook itself has a typed `daemon_service_lifecycle` receipt with action `cluster-windows-service-execution-runbook`, status `written`, artifact path, final-audit metadata, step-failure policy metadata, and `privateStateExposed=false`. Its wrapper JSON and typed receipt args expose `runbookTryModes`, `finalAuditMode=cluster-service-execution-audit`, `finalAuditRunsInFinally=true`, `stepFailurePolicy=continue-after-step-failure`, `continueAfterStepFailure=true`, `nonzeroExitFailsStep=true`, and `exitsNonzeroAfterFinalAudit=true`; direct wrapper summaries now print the exact `elevatedCommand=Start-Process PowerShell -Verb RunAs -Wait ...` invocation, `artifactSha256=`, and `aftercare=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`. Live proof `local-20260619-010940-407-b0744f08` generated the robust cluster artifact and printed hash `bf116ed4fd5bb2c9dc77f5032d19e792b012941a60b109389b79e5fcb0a2a5f6` without service mutation. `cluster-service-execution-audit` first requires the sealed `cluster-windows-service-execution-runbook` receipt, then checks the latest cluster-native readiness plus cluster install/start/audit/stop lifecycle receipts by receipt timestamp and reports `complete` only when the runbook and elevated effect receipts are sealed and successful. Audit check rows retain lifecycle `operatorArtifactRef`; wrapper summaries now print OK runbook witnesses with SHA-256 before compact failed-check anatomy. Live proof `local-20260618-170322-330-e6cb2117` printed `cluster-windows-service-execution-runbook=...\epiphany-cluster-daemon-services-execution-runbook.ps1:sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0` and the expected five failed checks without mutating Windows services. - - Cluster service execution readiness now uses the same compact wrapper `serviceRows` mouth as install/audit/control. Identity-only readiness rows inherit the global readiness verdict, so the seven expected Windows service rows show `not-elevated` instead of `unknown` when the shell lacks service authority. Live proof `local-20260618-211524-363-5d85b3aa` printed seven readiness rows with service name, daemon id, cluster id, `executed=n/a`, `exit=none`, `startType=none`, and `private=false`; live proof `local-20260618-211524-345-d580da5c` printed seven `execution-refused-not-elevated` stop-execute rows without service mutation. Direct cluster and single-service start/stop control wrapper summaries now print receipt-producing readback and aftercare commands: cluster control points to `cluster-service-audit` plus `cluster-service-execution-audit`, while single-service control points to `service-status` plus `service-execution-audit`. Direct status/reconcile/readiness summaries now also print next-wrapper guidance: service status points to `service-reconcile`, service reconcile points to `service-install-plan`, single-service readiness points to `service-execution-runbook`, and cluster readiness points to `cluster-service-execution-runbook`, with execution audits as aftercare where relevant. - - `epiphany-verse-query restart-policy-directory` and `tools/epiphany_local_run.ps1 -Mode service-policy-directory` provide the compact scheduler coverage sight organ. It reads daemon topology/status plus durable `epiphany.cultmesh.daemon_restart_policy.v0` rows through a narrow CultMesh restart-policy directory loader, reports each daemon as `ENABLED`, `DISABLED`, or `MISSING`, treats disabled and missing policies as recovery attention, returns covered/enabled/disabled/missing/attention counts, and publishes explicit policy-write plus scheduler-tick follow-up commands without creating or mutating policies. Compact TUI rows now expose `owner=Idunn`, `hostedBody=Epiphany`, cooldown, reconcile interval, heartbeat stale threshold, failure count, last result, `followUp=`, and `private=false`; wrapper proof `local-20260619-003720-135-799146f3` prints the Rust-owned `tuiRows` directly for all seven faculties as `ENABLED` with `owner=Idunn`, `hostedBody=Epiphany`, `last=ready`, `cooldown=30s`, `reconcile=60s`, `stale=300s`, `followUp=tools/epiphany_local_run.ps1 -Mode service-tick`, and `private=false`, instead of rebuilding policy text in PowerShell. Direct and wrapper proof now report seven daemons, seven covered policies, seven enabled policies, zero disabled, zero missing, zero attention, `status=ok`, `lifecycleOwner=Idunn`, `hostedBody=Epiphany`, and `privateStateExposed=false`. This is a real Idunn-owned daemon heartbeat body with non-mutating per-organ launch and install artifacts, but not yet executed installed per-organ OS services. - - `https://gamecult.org/Blog/purge-the-heretek-from-our-daemonic-swarm` is a public doctrine receipt for the Perfect Machine audit pressure: organs must not borrow each other's crowns, witnesses need owning mouths, surfaces reflect rather than rule, and cross-repo purification needs Bifrost-shaped ledger evidence instead of relying on recoverable transcripts or commit trails alone. - - `tools/epiphany_local_run.ps1` now uses collision-resistant local run ids (`local-YYYYMMDD-HHMMSS-fff-`) for artifact roots and operator run receipts. Same-second parallel compact wrapper proofs for `collaboration-feedback` and `bifrost-publication` produce separate artifact drawers and both complete, so operator rites no longer collide on second-resolution run ids. - - `epiphany-verse-query tool-directory` and `tools/epiphany_local_run.ps1 -Mode tool-directory` provide the compact daemon tool sight organ over the same local Verse capability records used by `invoke-tool`. It returns eighteen globally available daemon-hosted capabilities, host readiness counts, direct `invocationCommand`, wrapper `wrapperInvocationCommand=tools/epiphany_local_run.ps1 -Mode tool-invoke -ToolCapabilityId -ToolRequestingAgentId -ToolRequestingClusterId `, and the invariants `availableToAllAgents=true`, `requiresReceipt=true`, `privateStateExposed=false`. Agent-friendly TUI rows now carry the same contract bits, authority gate, and advertised payload/review contract types, e.g. `READY | Hands | repo-action | submitHandsActionIntent | epiphany.cluster.hands.tool.repo-action | eve://epiphany/hands | authority=hands | input=epiphany.hands.action_intent | receiptType=epiphany.hands.action_review | allAgents=true | receipt=true | private=false`; wrapper proof `local-20260619-032243-566-545b148c` prints all eighteen rows in the one-line `toolRows` summary, including Self `service-health` as `readServiceLifecycleStatus` and Self `swarm-online-runbook` as `prepareSwarmOnlineRunbook`, both under `authority=daemon.service_lifecycle` with private-state-sealed lifecycle receipt contracts, plus Eve connection tools, Hands `repo-action`, and Soul `verify`. `invoke-tool` runs through a smaller extracted command handler and emits compact invocation rows with requester/host display names, requesting/host private Verses and Eve surfaces, host daemon id, tool operation, capability id, intent id, receipt id/status, authority gate, `allAgents=true`, `receiptRequired=true`, and `private=false`; status invocation embeds `daemonStatusReadback` with compact topology/liveness/tool-count fields, Eve connection invocation embeds `eveConnectionReadback` with compact CultMesh surface routing and collaboration commands, service-health invocation embeds `serviceHealthReadback` with Idunn lifecycle attention/action/failed-check rows plus swarm-online preflight proof, and swarm-online-runbook invocation embeds `swarmOnlineRunbookReadback` with `ready-for-elevated-operator`, two present child runbooks, two verified hashes, zero missing artifacts, eleven failed checks, zero missing checks, and `operatorRequired=True`. This makes the Idunn handoff globally discoverable without opening full local Verse state or taking over Idunn's daemon-keeper role; live invocation proof `local-20260619-032244-273-acb3c6a4` returned `privateStateExposed=False`. - - `epiphany-verse-query cluster-topology` and `tools/epiphany_local_run.ps1 -Mode cluster-topology` provide the compact cluster/body/private-Verse/daemon sight organ over local Verse topology rows through a narrow CultMesh loader. The report returns seven clusters, seven private Verse ids, seven daemon ids, one public Persona discussion cluster, agent-friendly TUI rows such as `PUBLIC | Persona | cluster=epiphany.cluster.persona | role=Persona | privateVerse=epiphany.cluster.persona.private | body=repo:E:/Projects/EpiphanyAgent | bodyKind=repository | daemon=epiphany-daemon-persona | surface=eve://epiphany/persona`, and `privateStateExposed=false`; `epiphany-verse-query smoke` source-proves the compact topology invariants, and wrapper proof `local-20260618-225347-337-cea74491` prints all seven standing-faculty rows in the one-line `topologyRows` summary. - - `epiphany-verse-query swarm-overview` and wrapper mode `swarm-overview` provide renderer-neutral compact sight over declared topology, observed liveness, tools, receipts, and Idunn-owned lifecycle attention. It exposes only live command routes; the deleted Bifrost ledger is not advertised. The overview owns no lifecycle, provider, publication, composition, or mutation authority. - - `epiphany-verse-query swarm-triage` and wrapper mode `swarm-triage` compose compact overview with brake-aware daemon poke receipts. Triage owns daemon-liveness attention only; Idunn lifecycle wounds, blocked tool hosts, and ordered action rows remain sealed readback. Current command hints expose live topology, liveness, tool, receipt, and service-policy routes; the deleted local Bifrost ledger is not advertised. Source smoke proves incomplete service audits remain visible without granting Windows service mutation. - - Compact `swarmActionTuiRows` now match the JSON service-execution queue including local runbook SHA-256 provenance: live artifact `local-20260618-164403-238-dba797ce` shows `050 | service-execution-authority | operator-authority-required | operator-elevated-runbook | operator.elevated_windows_service_control | mutates=true | elevated=true | artifact=present | sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0 | audit=cluster-service-execution-audit`, while the readback row stays `artifact=none | sha256=none | audit=none`. Source smoke `verse-query-action-tui-audit-smoke` guards this agent-friendly TUI surface. - - Receipt directory rows now carry `artifactStatus` and `artifactSha256` beside `artifactRef`, using the same `none` / `external-ref` / `present` / `missing` vocabulary as action rows and hashing present local artifacts at the receipt-directory layer. Live wrapper artifact `local-20260618-165005-139-6188fe30` proves the cluster service execution runbook row reports `artifactStatus=present`, `artifactSha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`, and TUI `artifact=present | sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`; the per-service execution runbook row reports `artifactSha256=b213a3c11a8f11a03061fcd743f507edaa59bc6767257b79cef63329596375e7`; non-artifact rows report `artifactSha256=none`. Wrapper proof `local-20260618-165319-478-e929d2bd` also prints compact `artifactHashes=cluster-service-execution-runbook:3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0; service-execution-runbook:b213a3c11a8f11a03061fcd743f507edaa59bc6767257b79cef63329596375e7` in the one-line receipt-directory summary. Source smoke guards present-artifact SHA-256 in receipt-directory JSON/TUI, action-row SHA-256, missing-artifact demotion, and failed-check anatomy. `epiphany-verse-query receipt-directory` also derives compact artifact counts (`artifactNoneCount`, `artifactExternalRefCount`, `artifactPresentCount`, `artifactMissingCount`) from rows instead of storing a second truth. Live readback reports `artifactNone=13`, `artifactExternalRef=2`, `artifactPresent=2`, `artifactMissing=0`, and `privateStateExposed=false`; a clean direct empty-store readback reported all 17 rows as `artifactNone`. The earlier all-in-one `epiphany-verse-query smoke` Windows stack overflow was fixed by cutting full `query_epiphany_local_verse_context` out of `load_swarm_overview_report`; overview now reads daemon service lifecycle rows through narrow history/latest loaders. - - Wrapper `swarm-overview` and `swarm-triage` summaries now forward the Rust-owned compact TUI row families instead of rebuilding the global sight surface in PowerShell: `actionRows`, `daemonRows`, `toolRows` where present, `policyRows` where present, `toolAttentionRows`, `serviceAttentionRows`, and `serviceFailedCheckRows`. The older compatibility summaries still surface lifecycle receipt `artifactStatus`, local runbook `sha256`, operator aftercare command, and compact service execution failed-check anatomy. Live artifacts `local-20260618-210646-478-88b58f07` and `local-20260618-210646-474-2fb504ff` prove overview/triage print seven READY daemon rows, sixteen globally invokable receipt-gated tool rows, seven enabled restart-policy rows, two ordered service action rows, two service lifecycle attention rows, five sealed failed service-execution check rows, and `privateStateExposed=false`. The Rust-owned action queue now enumerates every sealed service-lifecycle attention receipt instead of only the selected global recommendation: live wrapper proof `local-20260618-214044-049-a63d008c` printed priority 40 `cluster-service-execution-audit` and priority 41 `service-execution-audit` non-mutating readback rows with `artifactStatus=external-ref`, `sha256=none`, service-manager artifact refs for cluster execution audit and single-service execution audit, and `privateStateExposed=false`, while leaving the elevated runbook authority rows unchanged. The failed-check anatomy now aggregates cluster and single-service execution audit reports too, carries service identity, and renders `followUp=` for each failed/missing check so the compact row names the receipt-producing or readback route without opening raw audit payloads. Live wrapper proof `local-20260618-224925-221-8e114063` printed cluster readiness/install/start/audit/stop failures with follow-ups such as `cluster-service-execution-readiness`, `cluster-service-install-execute`, and `cluster-service-execution-audit`, plus supervisor-service missing checks with follow-ups such as `service-execution-readiness`, `service-install-execute`, `service-status`, and `service-reconcile`, all sealed with `privateStateExposed=false`. The action queue now carries scoped service-execution wound counters on service-lifecycle readback rows as well as elevated authority rows, so a compact row that says `attention` also says why: live swarm overview proof `local-20260619-012440-577-3f18a143` printed priority 40 `cluster-service-execution-audit` with `failedChecks=5` and priority 41 `service-execution-audit` with `failedChecks=6`, while both rows stayed non-mutating, non-elevated, Idunn-owned, and `privateStateExposed=false`. Source smoke seeds both cluster and single-service runbook witnesses and proves distinct authority rows. Live overview/triage proofs `local-20260618-221339-826-b1981064` and `local-20260618-221340-099-4b4baba8` printed priority 50 `cluster-service-execution-runbook` with `failedChecks=5`, `missingChecks=0`, SHA-256 `3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`, and aftercare `cluster-service-execution-audit`, plus priority 51 `service-execution-runbook` with `failedChecks=6`, `missingChecks=6`, SHA-256 `b213a3c11a8f11a03061fcd743f507edaa59bc6767257b79cef63329596375e7`, and aftercare `service-execution-audit`, with `privateStateExposed=false`. `SwarmActionRow` now exposes explicit `serviceId` and `serviceRoute` fields so agents can identify the body/action without parsing artifact paths or prose; Rust TUI and wrapper action queues render `service=` and `route=` for service lifecycle and service authority rows, while non-service rows render `none`. Source smoke guards both fields, and live overview/triage proofs `local-20260618-221912-231-805389bf` and `local-20260618-221912-282-a79ba8bd` showed the cluster and supervisor-service identities on readback and elevated runbook rows with `privateStateExposed=false`. `ReceiptDirectoryRow` now owns the same explicit `serviceId`/`serviceRoute` fields, so action rows consume typed service identity from the receipt-directory organ instead of parsing `route`; non-service receipt families carry `none`, while service lifecycle/runbook rows carry the typed body and route. Source smoke guards the fields, and live receipt-directory proof `local-20260618-222641-218-60106c79` printed `service=epiphany-cluster-daemon-services` and `service=epiphany-daemon-supervisor-service` on service attention/readiness rows and runbook witnesses with no private-state exposure. - - `SwarmActionRow` now carries `lifecycleOwner` and `hostedBody` so swarm overview/overview/triage action queues distinguish sight from daemon-keeper authority. Daemon liveness, restart-policy, service-lifecycle readback, and elevated service-control rows carry `Idunn` / `Epiphany`; non-lifecycle rows carry `none`. Rust TUI rows plus wrapper `actionQueue` render `owner=Idunn` and `hostedBody=Epiphany` for service readback and elevated service-control rows. Focused live proofs `local-20260619-004523-347-620b40e9` (`swarm-overview`) and `local-20260619-004523-003-a44ad06d` (`swarm-triage`) show the ownership fields on all service action rows with no daemon poke when liveness is ready and no private-state exposure. The broad `epiphany-verse-query smoke` Windows debug stack-overflow wound is now cut by running the CLI body on a larger worker-thread stack; direct smoke returns `status=ok` with seven clusters, seven daemon statuses, eighteen daemon tools, and the sealed latest receipt ids. - - Direct wrapper audit summaries now expose the same follow-up ergonomics as the global sight rows. `tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit` and `-Mode service-execution-audit` print `failed check rows` with `serviceId::action=status`, artifact ref, local artifact SHA-256 when present, and `followUp=` for each failed/missing check. Live proofs `local-20260618-225923-468-d818951a` and `local-20260618-225923-529-7cfa2bb3` showed cluster readiness/install/start/audit/stop failures and supervisor-service readiness/install/start/status/reconcile/stop missing checks with actionable follow-up wrappers and `privateStateExposed=false`. - - Service execution audits now carry their own elevated runbook readback instead of relying on swarm overview or wrapper memory. `epiphany-daemon-supervisor windows-service-execution-audit` and `cluster-windows-service-execution-audit` return `runbookPath`, `runbookSha256`, `elevatedCommand`, `requiresElevatedAuthority`, `aftercareMode`, and `aftercareCommand` from the sealed runbook witness; the wrapper summaries print those fields directly for `service-execution-audit` and `cluster-service-execution-audit`. Live proofs `local-20260619-024011-505-a18982fa` and `local-20260619-024010-980-842fc3a6` showed incomplete audits with repaired runbook hashes, exact `Start-Process PowerShell -Verb RunAs -Wait ... -File ` commands, explicit aftercare, and no private-state exposure. `epiphany-daemon-supervisor` smoke commands now default to `.epiphany-smoke/daemon-supervisor-/local-verse.ccmp` unless `--store` is explicit, so synthetic smoke receipts cannot become the latest live local Verse service proof by accident. - - swarm overview/swarm-overview service-execution authority rows now treat synthetic `smoke://` runbook witnesses as missing artifacts, not external executable refs. Such rows demote to `runbook-artifact-missing`, `service-lifecycle-runbook-regeneration`, no elevated authority, no mutation, no execution command, and no aftercare until a real local runbook artifact is regenerated. Source smoke guards this demotion, while live local Verse was repaired by regenerating the cluster execution runbook and re-auditing it: swarm overview proof `local-20260619-025100-231-0d70bace` showed both cluster and single-service authority rows with `artifactStatus=present`, real SHA-256s, exact elevated commands, aftercare audits, Idunn/Epiphany ownership, and no `smoke://` artifact refs. - - `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness. - - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. - last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - - Windows host survival authority is Task Scheduler, not SCM. Tasks `Epiphany-Idunn-Managed-Service-Reconciler` and `GameCult-Yggdrasil-Tunnel` run as current user Meta with `InteractiveToken`/Limited privilege, `AtLogOn` plus a one-minute recurring recovery trigger, `IgnoreNew`, zero execution limit, and restart-on-failure at one-minute intervals (999 attempts). Each task owns only after-login process presence through one exact direct foreground action. Idunn remains sole owner of managed-service reconciliation and projector child lifecycle; Task Scheduler cannot mint projector readiness, claims, grants, recovery, or terminal evidence. `gamecult-ops` owns the Yggdrasil tunnel profile and foreground SSH process; Epiphany only consumes pinned local Qdrant ports. This is explicitly after-login physiology, not pre-login, boot-time, machine-wide, or Windows-service survival. - - Live recurrence proof killed reconciler PID 24152 and observed Task Scheduler start exactly one replacement PID 25428. Killing projector PID 29868 then caused Idunn to launch PID 19888 with launch receipt `4d406060-6582-473a-9322-9f4ccc8b322f`; ready heartbeat `79fe3143-28a8-40fe-9547-0287159082e6` names provider incarnation `projector-59217a66-e3e2-44c3-b000-36af3d43b043` and the exact startup correlation. Tunnel recurrence killed SSH PID 22652 and observed PID 30444 start at 11:37:44 with Qdrant REST healthy. A later pre-reboot repair packaged `epiphany-memory-semantic` beside the supervisor/projector, deployed the rebuilt supervisor release, and left `Epiphany-Idunn-Managed-Service-Reconciler` Running. Deployment query proof requires explicit `EPIPHANY_QDRANT_URL` and `EPIPHANY_OLLAMA_BASE_URL`; with those coordinates both packaged Mind and Modeling queries returned semantic ranking. `semantic-projector-service-status` now reports only `provider-correlated` or `provider-degraded` and explicitly names query admission as the readiness owner. Stopping the Task Scheduler reconciler does not terminate its already-detached projector child, so parent-process ancestry is derived current-session sight and cannot prove post-boot custody. The reboot proof must require a fresh post-boot scheduler -> reconciler -> exactly-one-projector process chain, not merely reuse a surviving child. - - Native feature-gated `epiphany-semantic-recovery-smoke` now proves abandoned-claim recovery through production process and authority boundaries without touching canonical state. In GUID-scoped Mind, Modeling, and Verse stores, a real projector acquires epoch 1, stalls against a fixture-local endpoint, and is killed; the supervisor consumes an exact current policy/lifecycle/heartbeat chain to recover epoch 2; a replacement projector consumes that authorization through the common execution path. Typed read-only inspection proves the old attempt failed, the authorization was consumed, epoch 2 is running, and the old owner is fenced; readiness and query eligibility are real. GUID Qdrant collection names are preflighted absent, deleted, and verified absent by exact 404. The fixture has no live/default Mind, Modeling, Verse, or mutation-fixture mouth. Proof `C:\Users\Meta\AppData\Local\Temp\epiphany-semantic-recovery-1152736f-b8a2-4cf0-ab24-c8a3993a0eb7\proof.json` passed. - - Historical June proof bullets in this map that report seven Eve surfaces, eighteen/nineteen daemon tools, or provider-backed `connect-eve`/tool/swarm-overview rows describe the now-retired provenance-free v0 projection. They are evidence of the substitution, not current availability. Live Eve and tool directories now return zero from those v0 families, `connect-eve` fails unavailable, and heartbeat cannot recreate them. - - The `epiphany.surface.*` Hello fiction is cut. Commit `65445623` remains the completed local Persona projection repair: `epiphany.persona_surface.v0` is a strict, content-free MVP-status projection over typed Persona artifact references, and its schemas remain useful discoverable vocabulary for local projection validation. It is not a CultNet runtime capability. All seventeen unbacked `epiphany.surface.*` mutation contracts and their dead runtime constants are removed; no surface type may appear in Hello until an owning provider can prove `provider publish -> typed CultMesh document -> Snapshot -> schema validation -> Eve lowering`, with a real typed dispatcher and receipt path for every advertised action. Runtime Hello and runtime status derive the current executable contract list. They ignore stale `supported_document_types` persisted in runtime identity, so the live canonical store's historical field cannot decide present wire authority or status. A canonical real hello-frame proved zero `epiphany.surface.*` capabilities. The adjacent generic central Eve substitution is also cut: `epiphany-cluster-daemon` owns liveness only; the central provider publisher and heartbeat call are deleted. Live Odin, Eve, and daemon-tool directories ignore provenance-free v0 rows, and explicit bootstrap retires stale rows of exactly those three families. Topology `eve_surface_id` is stable address/routing metadata only, not availability or composition proof. Provider discovery may return only after an owning provider emits a provenance-bearing typed contract; advertised actions additionally require a real dispatcher and receipt path. This does not displace the reboot/logon deployment proof as the current next action. - - Historical Windows SCM material in this map is rejected-path evidence, not live authority. Arbitrary console `sc.exe` installation, elevated service execution runbooks/audits, cluster-service install/start/stop/control, `swarm-online-runbook`, service-manager action queues, and their wrapper routes no longer describe deployable physiology or actionable next work. Their receipts may remain sealed historical evidence, but they cannot decide liveness, readiness, recovery, or operator action. The console binaries never implemented the Windows service-control dispatcher and therefore could not honestly own SCM service state. - - Static cluster topology owns declared faculty routing only, not attendance. Explicit bootstrap may persist seven declared faculty routes, desired private-Verse addresses, and daemon/Eve targets. Only persisted provider-authored daemon status creates an observed daemon row. The synthetic `unknown_daemon_status` path is deleted; fresh bootstrap therefore means seven declared targets and zero observed daemons. Topology, liveness, restart-policy, swarm overview/triage, compact swarm output, prompt context, and wrapper summaries distinguish `declared*` counts/routes from `observedDaemonCount`; a heartbeat does not become an agent count. Restart-policy rows may carry `daemonStatus=unobserved` solely for Idunn desired-state reconciliation. Configured ids, routes, topology row counts, and policy targets are forbidden from proving deployed daemons, active private Verses, agent presence, Eve availability, or readiness. - - Native process and host incarnation foundations are now separate authorities. Process identity is PID plus native creation token plus canonical executable, with exact alive/exited/replaced/missing/inaccessible/indeterminate observations and optional proven boot incarnation; the PID-only compatibility projection cannot report death. Host identity is one immutable non-workspace CultCache enrollment with an Ed25519 identity/signing handle, purpose-bound signatures, fail-closed open, and no silent regeneration. Windows protects its seed with CurrentUser DPAPI and honestly labels assurance `os_user_installation_bound_best_effort`; Linux uses 0700/0600 state plus machine-id binding and labels the baseline cloneable. Neither claims physical-chassis identity. These foundations do not themselves authorize service recovery. - - Specialized reserved coverage process documents are the live typed CultMesh process authority. Idunn's mandatory host-signed launch binds the exact current specialized policy envelope, enrolled host record digest, proven boot, PID creation token, captured executable path and bytes digest, provider incarnation, and ephemeral provider public key. Provider heartbeats are signed by that ephemeral key, bind the exact launch envelope and repeated host/boot/process tuple, and advance exact per-launch sequence/time under CAS; immutable per-heartbeat evidence remains addressable while the latest pointer advances because termination and recovery documents may cite historical heartbeats. Generic lifecycle writers reject reserved coverage identities. Hostile tests reject forged signatures, sequence gaps, identity collisions, wrong supervisor/status/runtime, stale policy, and tuple drift. - - The live workspace-coverage process path now uses only specialized authority. Supervisor generates a per-launch provider key, spawns with reserved stdin piped and all other child stdin null, captures exact process identity, sends one fixed-size launch-id/seed frame, host-signs and CAS-persists the specialized launch, and kills/waits on any bootstrap or persistence failure. The child requires exact frame plus EOF, authenticates the enrolled host, current policy, boot, its PID creation token/path, launch digest, and provider public key before constructing the service or publishing its signed per-launch heartbeat. Generic lifecycle and generic daemon-heartbeat writers reject the reserved coverage identities; their old authenticator is deleted. Body claim/attempt v1 binds `managed_process_launch_id`; v0 lifecycle semantics cannot deserialize as the new owner. This Windows installation is explicitly enrolled at the default DPAPI CurrentUser host store and status re-open proved identity `17f041421045aa66d4c8ab0488f462dbb5ea1a7d8507dbf75216f5ec368dbb7a` without exposing private state. - - Idunn now has one immutable, host-signed process-termination observation per reserved coverage launch, with no latest/global mirror. Its writer reloads and exact-CAS-preserves the current specialized policy, exact launch, and exact per-launch latest signed heartbeat; it immediately observes the enrolled host's proven boot and exact PID incarnation. A distinct proven boot yields `boot_superseded`; same-boot proof permits only `exact_exited`, `process_missing`, or a complete different `process_replaced` identity. ExactAlive, Inaccessible, Indeterminate, unknown boot, host mismatch, identity collision, and moved source envelopes refuse publication. The injectable observation seam is private to module tests. Recovery-facing authentication reconstructs the entire persisted policy/launch/heartbeat chain rather than trusting the signed termination blob alone. Four hostile document/termination tests and all-target check pass. - - Abandoned workspace-coverage authority has one complete typed transfer. The projector publishes Body-scoped provider-signed claim sight before backend work. The supervisor observes the exact managed process through a typed non-mutating classifier: ExactAlive reports observed-alive; inaccessible/indeterminate report degraded; policy, claim/launch, or authentication drift is refused; only proven terminal outcomes admit immutable termination and an exact causal replacement. After fresh signed replacement readiness, the supervisor re-observes the exact replacement at the actuation boundary and publishes an immutable host-signed recovery directive. The replacement projector alone consumes that directive and performs the recovery CAS through its already-held WorkspaceCoverageAuthority. Claim sight, directive, and recovery receipt bind exact Body/store route, claim/attempt, policy, old termination, replacement launch, and heartbeat envelope digests. Recovery is replay-safe across claim publication, launch-to-directive, readiness, directive reissue, CAS-to-sight, and process-death windows. The supervisor never opens or mutates workspace-coverage.cc. One termination admits one replacement slot; concurrent losers are killed when launch persistence loses CAS. - - Workspace-coverage launch, heartbeat, and termination now serialize through one typed per-launch process-evidence head. Launch initializes generation 1 as `launched`; each signed heartbeat exact-CAS advances it to `heartbeat`; host-signed termination exact-CAS seals it as `terminated`. Termination v1 accepts exact launch plus enrolled host/boot/process proof before heartbeat sequence one and records heartbeat id/digest only when the head names current signed heartbeat evidence. A heartbeat cannot advance a terminated head. This removes the pre-readiness death strand without allowing heartbeat/termination split authority. - - The feature-gated native `epiphany-workspace-coverage-recovery-smoke` proves the real packaged supervisor/projector boundary in GUID-scoped repo/runtime/Body/Verse state. It warms local Ollama, derives only its exact fenced Qdrant collection names, publishes reserved policy, launches the initial child through fixed bootstrap, observes epoch 1 claim, kills only after exact native launch-incarnation revalidation, invokes Idunn reconcile, authenticates epoch 2 successor authority plus the immutable recovery receipt through freshly reopened stores, kills the replacement under the same identity fence, and verifies only its owned collections absent before success. Live proof `C:\Users\Meta\AppData\Local\Temp\epiphany-workspace-coverage-a577f820-b0e2-4733-b628-529ee3bdb143\proof.json` passed with receipt `2b44f28f-7c0f-4ad2-aefe-d7c8222e8642` and binds the executed binary, exact embedded smoke source, source head, and tracked-source diff digests. Operator orchestration, not the harness, restored local Qdrant to its prior stopped state. The run also repaired normal-user Windows boot identity and exact recovered-owner claim resumption. - - The 2026-07-16 deployability audit is historical evidence for wounds since cut: immutable packaged releases removed mutable sibling generations, repository readiness joined Body/Modeling/Mind authority, and release `0601e280480cccc28209fbf0630e921f3ef9056d` is running on Yggdrasil under Bifrost/Idunn while its first workspace projection advances. The machine is still not an autonomous organizational swarm: the deployed body hosts projectors and supervisor, not the resident coordinator/scheduler, model runtime, tool spine, writable Hands workspace, or Persona/Discord crossing. Health, heartbeat, systemd state, Qdrant existence, and Gjallar/Eve projections cannot substitute for those missing cognition organs or final deployment admission. - - Resident organizational Self now has a typed ownership cut in source. Standard heartbeat alone consumes pending operator-objective, Body-map-drift, Persona-feedback, or Imagination-proposal pressure and atomically emits one single-consumption scheduling grant. Resident Self alone owns grant consumption, immutable prepared launch, packaged coordinator child claim before cognition, one exact process lease, exact coordinator terminal-receipt binding, and terminal acknowledgement back to heartbeat. All wake sources share that path; pressure cannot adopt Mind state, invoke Hands, authorize release, or deploy. The old source-tree/Cargo swarm wrapper and its online/run/run-queue/pulse/epiphany-work queue path are forbidden writers and removed from the live mechanism. Packaged release witness roles now include swarm, coordinator, model runtime, and tool Codex MCP spine. Verification belongs to CAS/replay, physical store separation, witnessed binaries, child-claim and exact-process timelines, brake/timeout draining, receipt substitution rejection, and negative runtime-Cargo/queue scans. Nonblocking hardening remains: replace the parent's post-launch process observation correlation with an OS-authenticated parent/child launch channel where supported; PID alone remains inadmissible. This source cut is not Ygg service installation or deployment admission. - - Resident cognition deployment is ordinary organizational product mode. Heartbeat `serve` is the single physiology loop: reconcile exact terminal acknowledgement first, retain pressure while braked, emit at most one grant while clear, never replace an active coordinator, and run bounded void/sleep work only while idle. Non-actuating `epiphany-swarm status` publishes typed resident readiness bound to exact runtime/release/witness/source, packaged binaries, store separation, heartbeat/Self freshness, lease sight, brake, writable workspace, and credentials. The existing supervisor remains the sole signed Idunn health writer; systemd, PID sight, readiness JSON, Persona feedback, and Imagination proposals cannot admit deployment, adopt Mind state, invoke Hands, or authorize release. - - Yggdrasil's organizational Body is `/var/lib/gamecult/epiphany/workspace`; immutable `/srv/epiphany/source/current` is release provenance only. The local ops cut separates `epiphany.service` (supervisor/projector and signed health), `epiphany-heartbeat.service` (heartbeat state and grants), and `epiphany-swarm.service` (resident-Self state and bounded coordinator). Deployment authenticates witnessed siblings, preserves projection checkpoints across pre-admission retries, waits for typed readiness, and lets Idunn write `deployment.env` only after admission. Persistent Modeling maps and Mind state live with the writable Body. Persona feedback and autonomous bounded Imagination proposals create pressure; Mind adoption, Hands consequence, Bifrost release, and Idunn deployment remain distinct authorities. - - Release `sha256-c94109f94ee42c1257089830f399cb87cd5ad672772c274194371995ce4df923` is the first deployed immutable sibling generation. Native packaging builds from detached exact source commit `dd80f4a51c18425a6665710698a357be61154abf`, initializes pinned submodules, uses the tracked lockfile under `--locked`, and publishes four exact binaries plus a typed CultCache witness/head only after atomic directory publication and byte verification. Task Scheduler pins release id/digest and the witnessed supervisor path; Idunn reauthenticates the complete set and reserved policy role paths. Current-boot proof: reconciler PID 21228 launched direct child 22736; witnessed Mind/Modeling queries ranked semantically; killing that exact-path child caused Idunn to launch PID 19748 with receipt `86a42d51-9930-4b5d-9e61-e74c82a0d808`, ready heartbeat `4fc91977-b635-474b-812b-c364847e2b4b`, and witnessed executable digest `sha256-1060dd64e8c2b520ec8744b67e8306db04a6618d463fc2117c352adf9e30e6b0`. This closes current-boot artifact generation and recurrence, not reboot/logon survival. - - Release `sha256-6f9ab4848207a110e7e3836f41e6a74c0f463369ad4b04ce2d0d3831a6b262ae` packages repository-readiness source commit `360dcb433dda9599fca14282592608d26b8b6cc8`; witnessed Idunn PID 29476 directly owns witnessed projector PID 22840 with launch receipt `50879209-b65f-4411-ae3f-6f647d37bf42` and ready heartbeat `134df620-9e20-4220-ad4e-117ea4ca8188`. Deployment exposed receipt-v2 migration pressure: v1 receipts became correctly ineligible, but the old Succeeded pulse shortcut kept both partitions idle. The shortcut is now cut in source. Valid v2 terminal evidence derives Ready; an exact same-obligation succeeded claim opens Repair only after its consumed grant/recovery authority and exact succeeded attempt are authenticated. Failed repair retries through execute at the next epoch. Forged predecessor authority cannot be laundered by a repair grant. - - Yggdrasil exact-SHA pressure release `586147a751c6eec2d59cd8dc10bd17ce0d02a4d1` proved useful GPU work but failed deployment honestly. GTX 1080 stayed near saturation at 2,419 MiB; bounded four-text requests completed continuously. Mind published 215 vectors, while workspace coverage completed 3,389 Ollama HTTP calls total (about 13.3k workspace chunks after Mind) before Idunn's 50-minute candidate-health deadline at 2026-07-17T01:23:50+02:00. Idunn then stopped the service, published no deployment witness, and reported no exact-candidate daemon-health proof; the Modeling collection remained at the inherited 22 points because the monolithic executor had not yet published its accumulated vectors. This is failure evidence for the execution/deployment contract, not for GPU acceleration. Total wall-time extension is forbidden as the repair. - - Exact Epiphany candidate `9165862cce09739a62b20c0c7728ccceb71cfc2f` crossed Bifrost and built immutable release `sha256-39eed3817a10325b39b7f223fb2919c5959c88443ef82d9cc1497f6af631f365` with witness `sha256-9ad9cfe17fcabffb84fb392cbd5ecc1e8823482a338b38ced52e1020532e80c6`, fourteen root-owned 0555 binaries, and app-owned release publication. It was not deployed: live startup exposed three authority faults, the candidate services and Idunn transaction were terminated through rollback, and neither `deployment.env` nor `active-release.env` exists. The immutable package and stable compiler cache remain reusable evidence, not active authority. - - The candidate faults are cut in source. Heartbeat now forms an owner-filtered typed view over its mixed CultCache store and commits exact owner rows with CAS while preserving readiness rows; CultCache supplies typed `load_envelope` for validated in-memory admission without backing-store publication. A cold resident runtime without thread state yields no direction request yet instead of a fatal error. An engaged `heartbeat.scheduler` brake blocks cognitive scheduling but no longer claims daemon service lifecycle physiology; only `daemon.lifecycle_poke`, `daemon.*`, wildcard, or an empty protected list blocks that owner. Focused shared-store/cold-Self/brake tests pass, and the full core library proves 570 passed, zero failed, one ignored. - - Candidate `86d702002acee8321438f32fb9cf69a29a667d70` built and sealed immutable release `sha256-da19a70a7e8c0229cd59b292bf5867fd1e97fa40643ab772e918c5d49dd7ff22` with witness `sha256-62c65d813837dd4a939e941d798d0842ee5f6c77cddaa645f2c47a18b7c3ec44`. Its first package attempt lost the builder's narrow release-root ownership to a predecessor cleanup race and published nothing; the retry crossed packaging and started all three braked services. Projection and Heartbeat stayed active, but resident Self exposed a second cold-start fatal path in feedback-driven Imagination consideration (`consideration requires thread state`). The Idunn transaction was terminated through rollback; services are inactive and no deployment or active-release witness exists. The package remains immutable evidence only. - - Feedback-driven Imagination consideration now shares the cold-runtime prerequisite semantics of admitted-model direction: absent thread state yields no request yet, preserves admitted feedback for later ingestion, and performs no write. Resident Self skips only that not-yet-constructible request and will retry it on a later pulse. The causal feedback smoke explicitly requires its fixture thread and all binaries compile. This is prerequisite absence, not feedback loss, Mind adoption, or action authority. - - Exact state-boundary commit `36f687eaa34153a166b5860087c28f8847244823` is deployed on Yggdrasil through Bifrost authority `release:GameCult/Epiphany:refs/heads/main:36f687eaa34153a166b5860087c28f8847244823` and Idunn request `manual:redeploy:yggdrasil-epiphany:manual:redeploy:yggdrasil-epiphany:unix:1784452916`. Release `sha256-a9afe96abf5b104da3d25bf5e11b967de546c57a230fa155b3cbb98c3b176385` and witness `sha256-f6b4c68054ce9566002e46d49e8773924d3518afdd02798e1a09f1778359d3c2` passed signed active health admission and produced `deployment.env` at 2026-07-19T09:23:14Z. Idunn, supervisor, Heartbeat, and resident Self are active with zero restarts; the full typed check passes; the all-scope deployment brake remains engaged. The live proof required Odin verifier `64bb679`, which reads the root-owned pinned Epiphany identity without creating a writer lock; `/etc/gamecult/idunn/epiphany-health-identity.ccmp.lock` is absent. - - Successor `2d21c48d7425c3d6d692e506e1981f92991d82ac` was refused by live Yggdrasil admission. Its resident Self restart-looped because autonomous proposal promotion treated absent thread state as fatal. Idunn published failed health and did not admit the candidate. The owner-level correction makes missing thread state an inert, byte-identical no-work result while retaining errors for malformed present authority; the negative test and full 579/0/1 library proof pass. Cancelling the failed actuator then exposed Idunn's missing restart recovery: exact unresolved request heads survived without a result and blocked supersession. Odin commit `15a744c826f0aa2e8cc322a6543ea8a9afcd852a` CAS-terminalizes only exact prior-incarnation requests as failed on startup and passes 51/51 tests; Ygg runs binary SHA-256 `c441b9e58e85aff1d869b1e07b0a12a4795c6805619ce640184dbdcfce4e7e03`. Ops commits `584b94c` and `46425f9` move packaging before outage and seal package directories immutable but traversable. - - Corrected Epiphany commit `154dc1eadd98dda25916ee40e7130770e145e874` is admitted on Yggdrasil. Bifrost authority digest is `d7e21f11d758e3ebaa46945ddd7acca1417ab8f8a81c3ec1932f3d5e0109e72f`; release is `sha256-16c51bb3b4914578213f0d0b64e40e17982ad45832e073d747db903509f237ed`; witness is `sha256-85702cf922ea32c07457630a7911b2b9196c8b58ee4baa642185a0b77902f234`; Idunn request is `deploy:yggdrasil-epiphany:unix:1784456326`; manifest v2 published at `2026-07-19T10:20:04Z`. The full typed check passes, signed health names exact source/release/witness and all four managed services terminal-current, supervisor and Heartbeat have zero restarts, and resident Self is stable on one MainPID with no restart growth after historical counter 10. Its operator projection reports `status=braked`, revision zero, no active turn, and no private state exposure. GPU embedding remains 100% on the GTX 1080. - - The Starfire-independent live feedback half is proved on Ygg. The production Bifrost provider is ready with six typed bindings; one real VoidBot Discord observation is one signed delivery and one local Epiphany pressure admission. Re-import through the deployed 154d binary is byte-identical across delivery, admitted-feedback, Mind, runtime, and deployment stores. An alien signing identity is refused before writes. A substituted repository selects zero applicable deliveries and writes no feedback/Mind/runtime state, but exposed a diagnostic conceptual substitution: ingress projection v0 said `status=admitted` with zero deliveries. The successor source deletes `admittedCount` and v0's false admission status; typed v1 reports `pressure-present` or `no-applicable-deliveries` with applicable-delivery and present-pressure counts. Focused projection proof passes. The live all-scope brake intentionally prevents the final feedback-to-Imagination scheduling proof; do not release it merely to make the smoke green. - - Persona feedback is not the July-22 Discord operator nerve. Live addressing currently queues a local VoidBot repo-Face turn and independently exports feedback to resident Epiphany; it is not a correlated speech result from the resident Persona. Feedback remains pressure-only. The move-period must-have is a separate explicit slash-command route: Discord/VoidBot authenticates the interaction, Bifrost/Heimdall signs an expiring capability-bound command, Epiphany dispatches only the typed enum to its existing status/brake/pressure/Mind-review owner, and an Epiphany-owned result returns through Bifrost to Discord. Required commands are status, sleep, wake, directive, reviews, and exact Adopt/Refuse/Hold review. Release/deploy remain outside this nerve. Canonical map: `notes/epiphany-discord-operator-nerve.md`. - - Epiphany operator-command core commit `f1036abd` implements the first four closed commands: Status, Sleep, Wake, and Directive. A distinct Bifrost-signed admission is target/guild/channel/actor-capability/nonce/TTL bound; invalid admission writes nothing. Exact admission/result documents survive replay and both crash boundaries. Status returns bounded operator-safe fields. Sleep owns one fixed Discord brake with exact live protected-surface names and cannot replace a foreign engaged brake. Wake releases only that exact brake; a deployment/foreign brake returns a terminal Refused result and remains byte-identical. Wake creates no pressure/grant/job. Directive creates one pending `operator-objective` pressure with exact command provenance and cannot mutate Mind/Hands/release/deploy. Focused proof passes 4/4; full core passes 583, zero failed, one ignored. No daemon/CultNet ingress or reviews/review command exists yet. - - Exact successor `aa3d2330062a34145cb70b527e02fa00215eac1b` passed local proof but was revoked before deployment because live packaging repeated `Permission denied` when creating a random staging directory directly under the shared root-owned release directory. This disproved the predecessor-cleanup race hypothesis. The builder's long-lived ownership lease over `/srv/epiphany/app/releases` was the incoherent boundary; no package, service, or witness was published from this attempt. - - Release construction is now generation-scoped. The packager creates its random staging sibling beneath the exact source-commit directory, then atomically renames to the final release id within that same directory, preserving canonical absolute witness paths. Idunn keeps the shared release root root-owned and grants `epiphany-builder` only the exact commit directory during construction; cleanup removes only nested staging and seals that generation root-owned. Candidate `03e1afd24546a7ca37e900c47ca26ae257b14161` proved this boundary by sealing immutable release `sha256-fe7f25ff60d84ae9316d7b4aa2833bd5d1b65189c9d08cc64e903a83d8f35268`; its first app publication could not traverse the still builder-owned 0750 generation parent. Cleanup sealed the parent and an automatic exact-package retry started all three services. The actuator must seal the exact generation parent root-owned 0755 before app-owned publication, not only during cleanup. - - Candidate `03e1afd24546a7ca37e900c47ca26ae257b14161` was not deployed. Projection and Heartbeat were healthy and braked, but resident Self opened the shared resident store as if every row belonged to its schema catalog and rejected the legitimate `epiphany.resident_cognition.provider_readiness` row. The exact process group was terminated, all three services were stopped, `active-release.env` was removed, and no deployment witness exists. Resident Self now constructs an owner-filtered typed view from raw envelopes, admits only its six owned document families, rejects duplicate owned identities, and preserves foreign readiness rows during writes. Full core proof passes 572/572 with one ignored. - - Candidate `2d4c92d24c2007858914d352b5892f599e6a20e9` sealed immutable release `sha256-1dd1271405e82958df2c03133b0d89d2555a8a3c7013486e1c41465ec84f6b3c` with witness `sha256-e01803545e557488cf2a0a42c31bb65e17ff7ead21790d7c982216901d94e12b`. Generation-parent sealing and resident mixed-store ownership both held: all three services started, Heartbeat remained `braked-after-ack-reconciliation`, and resident Self remained stably `braked`. Deployment still failed honestly because the prior workspace-coverage launch was authenticated only against the newly written current policy. Release rotation therefore made signed historical launch evidence impossible to observe, terminalize, or replace. The transaction was rolled back, its Bifrost authority revoked, services stopped, active pointer removed, and no deployment witness exists. - - Workspace-coverage process authority now separates history from admission. A stored host-signed launch remains authentic historical identity after managed-policy rotation and may authorize only exact process observation and immutable termination evidence. Its termination binds the launch's signed policy id/digest and CAS-fences the exact launch/evidence head; it no longer pretends the current policy authored history. Reconciliation detects a stale-policy latest launch, terminates only its exact live process identity or records terminal sight, then launches a replacement bound to the exact current policy and historical termination. Current public observation still rejects stale launches, and only a current-policy launch can run. Full core proof passes 573/573 with one ignored; all binaries compile. - - Candidate `b5405beaa95cddc837f3b7a7ca268ac9b5ae4502` built and started all three services, proving the historical authenticator itself shipped, but still produced `workspace coverage launch disagrees with current managed policy`. The stale-policy branch was unreachable because reconciliation authenticated provider claim sight before loading supervisor-owned latest launch, and claim authentication correctly rejected the stale policy. The candidate was rolled back, authority revoked, active pointer removed, and no deployment witness exists. Reconciliation now orders supervisor latest-launch sight and stale-policy rotation before current provider claim authentication. Provider claim state cannot veto retirement of obsolete supervisor process lineage; it participates only after a current-policy launch exists. Supervisor tests pass 24/24 and full core remains 573/573 with one ignored. - - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile. - - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24. - - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24. - next_action: "Commit and push the native Persona conversation cut in Epiphany, Bifrost, and gamecult-ops. Promote those exact upstream commits through Bifrost and Idunn only while both deployment and canonical swarm brakes are engaged. Verify trust-root enrollment/rollback, permit service and Persona service lifecycle, crossing mounts, provider readiness, backups, and the root Ygg checker. Then temporarily release only the cognition brake needed for one addressed Discord mention/reply proof; require real Gateway ingress, CTB reservation, Projector-Persona-Interpreter receipts, signed request, live five-second permit, one Discord post, signed Bifrost receipt, and terminal heartbeat/quarantine reconciliation. Re-engage sleep mode immediately and prove unattended boot/readiness. Do not Wake broadly or reboot the host." + summary: Epiphany is a native Rust/CultCache/CultMesh/CultNet organism. The local branch is clean and synchronized. Idunn and Bifrost are active on Yggdrasil; Epiphany services are inactive after a clean rollback; the canonical deployment brake is engaged. One deployment request is awaiting authorization, but its grant was not consumed by the current Idunn incarnation. No further deployment or cognition release is authorized until that ownership chain is understood. + operational_state: + local_worktree: clean + deployment_brake: engaged + idunn: active + bifrost: active + epiphany_services: inactive_after_clean_rollback + pending_deployment_request: awaiting_authorization + unresolved_authority: Determine why the stable pending deployment request was not matched and consumed by the current Idunn request/owner ledger. + next_action: Inspect the Idunn request, owner, grant, and incarnation ledger as read-only state; identify the exact broken authority transition before issuing any grant or release. + +active_subgoals: + - Diagnose the pending Idunn request/owner/grant chain without mutation. + - Refresh this map and the handoff immediately when live evidence changes the operational state. + +forbidden_actions: + - Do not issue a speculative deployment grant. + - Do not broadly Wake the swarm. + - Do not reboot Yggdrasil as part of diagnosis. + - Do not treat stored status, process liveness, or an old receipt as current authority. + +memory_policy: + canonical_map: state/map.yaml + live_handoff: notes/fresh-workspace-handoff.md + durable_evidence: state/ledgers.msgpack + historical_provenance: Git history and archived notes + rule: If a fact does not constrain a current decision or explain a live invariant, it does not belong in the active Mind. diff --git a/state/scratch.md b/state/scratch.md index 3d3d81d3..d423b508 100644 --- a/state/scratch.md +++ b/state/scratch.md @@ -1,209 +1,11 @@ # Scratch -This file is disposable working memory for the current bounded subgoal. +Disposable working memory for one bounded rite. ## Current Subgoal -Make Body-bound workspace coverage operational without letting Qdrant, mutable -model tags, process guesses, or service telemetry impersonate truth. +No active scratch subgoal. -Landed checkpoint `aa6b3efe` proves sealed text/vector input validation, exact -managed Qdrant metadata, whole-collection point/payload observation, and exact -Body/plan/claim/prior-head terminal CAS. The following service work is still -uncommitted and under hostile review. - -Current authority map: - -- Repository Body CultCache owns source observation, obligation, plan, claim, - attempt, receipt, and coverage head. -- The dedicated workspace-coverage projector owns one authenticated execution - incarnation. Its fixed supervisor policy derives only runtime store, Verse, - interval, Qdrant endpoint, and Ollama tag. It cannot accept workspace, - Body-store, collection, dimensions, or arbitrary command authority. -- Qdrant is disposable projection. Ollama is an embedding actuator. Neither can - mint coverage state. -- A claim must bind executor incarnation and startup receipt. Unknown or - malformed claim/attempt state refuses overwrite. -- Recovery is intentionally absent. A newer launch plus ready heartbeat does - not prove the prior owner dead. Add supervisor-issued typed termination/death - evidence bound to the prior launch before any recovery CAS exists. - -Soul blockers found 2026-07-15: - -1. Bind authenticated launch runtime id to the runtime Body route before any - Body access. This hardening is now in the worktree. -2. Observe and hash exact stored vectors, not only point IDs/payloads. -3. Bind the plan to immutable Ollama model artifact digest, not mutable tag plus - dimensions. -4. Replace per-file full Body-store reloads with one authenticated read session - and classify exact Current before rematerializing bytes. -5. Give failed, fenced, and superseded claim collections an explicit retirement - owner; claim/epoch isolation without GC leaks a collection per retry. -6. Do not print raw chained backend/filesystem faults while claiming - `privateStateExposed=false`; publish typed sanitized fault classes. - -Local backend proof: Ollama is live at `127.0.0.1:11434` with -`qwen3-embedding:0.6b`, digest -`ac6da0dfba84a81fdbfbaf330198c33cd77c4cdfc53e8bc50eb581914a15621d`, -1024 dimensions. Docker container `voidbot-qdrant` uses Qdrant 1.17.1 but is -stopped. The hostile proof fixes passed; a real ignored smoke started Qdrant, -projected through Ollama, exact-scroll-verified payloads and vectors, classified -the result Current, deleted its isolated collection, verified no coverage -collection remained, and stopped Qdrant again. - -## Exact native process identity (2026-07-16) - -The process-observation foundation now identifies a process incarnation by PID, -native creation token, and canonical executable path. Windows compares identity -through a held process handle before classifying it alive or exited; Toolhelp -absence is distinct from access denial and query failure. Linux uses boot id, -proc starttime, executable identity, and zombie state. Unsupported Unix targets -refuse to pretend they have Linux `/proc` evidence. - -The legacy PID-only projection is display-only and can emit only `Alive` or -`Missing`; it cannot mint death evidence. Tests prove current-instance life, -PID-incarnation replacement, and exact child exit. Next add enrolled OS-host -identity, then reserved launch/heartbeat and immutable termination documents -before any recovery CAS. - -## Enrolled host incarnation (2026-07-16) - -The host root is now a dedicated non-workspace CultCache document with one -immutable Ed25519 enrollment and a narrow signing handle. Existing, malformed, -unprotectable, or binding-mismatched state fails closed; enrollment never -silently regenerates identity. Windows stores it under LocalAppData, protects -the seed with CurrentUser DPAPI, and labels its limited assurance honestly. -Linux uses the XDG/home state root, 0700/0600 permissions and machine-id binding, -explicitly labeled cloneable. This is enrolled OS-installation continuity, not -a claim about physical chassis. Purpose-bound signature and immutable/fail- -closed tests pass. The next cut is specialized reserved launch/heartbeat state. - -## Reserved managed-process authority map (2026-07-16) - -Generic lifecycle and daemon-heartbeat documents are no longer acceptable -owners for the reserved coverage projector. The replacement has three typed -documents with separate authority: - -- Idunn's signed launch binds the exact current policy envelope, enrolled host - record, proven boot, PID+creation-token+canonical executable, executable - digest, provider incarnation, and an ephemeral provider public key. -- The provider's signed heartbeat binds that exact launch envelope and repeats - the host/boot/process tuple with monotonic per-launch sequence. -- Idunn's immutable termination observation names the exact prior launch and - last heartbeat and may record only exact exit, exact missing/replaced process - on the same proven boot, or a different proven boot on the same enrolled host. - -Termination must be persisted before replacement spawn. Replacement launch and -signed ready heartbeat follow; only then may one Body CAS terminalize the old -claim/attempt and acquire epoch+1. Generic lifecycle/heartbeat writers must -reject reserved coverage identities after migration. Timeout, staleness, newer -launch, Qdrant state, PID-only absence, inaccessible process, unknown boot, or -host mismatch are never death evidence. The provider signing seed travels in -one fixed-size binary frame over reserved-child stdin (`Stdio::piped()`), never -argv/env/store/logs. The child requires exact frame length plus EOF, derives the -public key, then waits for and authenticates the launch document before acting. -Write or persistence failure kills and waits the child; all nonreserved service -stdin is explicitly null. This uses Rust's stable cross-platform child-stdin -contract instead of bespoke inherited-handle plumbing. - -## Live reserved authority migration (2026-07-16) - -The supervisor/projector chain now consumes the specialized documents. Idunn -generates the ephemeral provider seed, spawns, captures exact process identity, -writes the fixed stdin frame, then host-signs and persists the launch; every -failure after spawn kills and waits. The child reads exact frame+EOF and checks -host, current policy, boot, PID generation/path, launch digest, and derived -public key before any service pulse. Heartbeats are specialized and signed. - -Generic lifecycle and generic heartbeat writers now refuse the reserved -coverage identities, and the old coverage lifecycle authenticator is gone. -Claim/attempt schema v1 binds `managed_process_launch_id`; v0 positional state -cannot impersonate the new semantic owner. A native `epiphany-host-identity` -enroll/status actuator was added, and this Windows installation was enrolled -once at the default DPAPI CurrentUser path. Next build immutable termination -evidence before replacement and only then the Body recovery CAS. - -## Immutable exact termination evidence (2026-07-16) - -Idunn can now publish one host-signed termination observation for one exact -coverage launch. It exact-CASes the current policy, signed launch, and that -launch's latest signed heartbeat while inserting an immutable per-launch key; -there is no global termination head. Different proven boot, exact exit, exact -same-boot absence, and exact PID replacement are the only outcomes. Alive, -inaccessible, indeterminate, unknown boot, host mismatch, collisions, and moved -source envelopes fail closed. The fake observation seam is module-private. -Authentication rejoins the signed record to all exact persisted sources. - -Next wire reconcile order: termination first, replacement launch second, -replacement signed-ready third, then one Body recovery CAS. No timer gets a -vote. - -## Exact abandoned-claim transfer and Idunn wiring (2026-07-16) - -Recovery now derives the Body store from the runtime route, authenticates the -live Body basis, joins obligation/plan/claim to it, verifies exact old launch -and immutable termination, requires the replacement's signed causal edge plus -current ready heartbeat, and commits failed history, epoch+1 successor, and an -immutable recovery receipt in one Body CAS. The receipt binds exact CultMesh -envelope digests and reconstructs against CultMesh plus current Body state. - -Idunn has a reserved reconciliation branch. Generic lifecycle PID receipts no -longer decide workspace-coverage survival. Exact termination precedes spawn; -the launch writer admits one replacement for that termination; signed ready -precedes Body recovery. A concurrent launch loser is killed. - -Remaining wound: termination requires a latest heartbeat. A child dying after -signed launch persistence but before heartbeat sequence one can strand the -chain. Make heartbeat optional additional termination evidence, then run an -isolated live death/replacement/recovery smoke. Reboot still needs live operator -approval. - -## Pre-readiness death seam closed (2026-07-16) - -Launch, heartbeat, and termination now contend on one typed per-launch process -evidence head. Launch creates generation 1; heartbeat advances it; termination -seals it. Termination v1 can carry no heartbeat when the exact signed launch and -native host/boot/process proof already establish death. A late heartbeat cannot -resurrect the launch. Six focused process tests, supervisor/projector suites, -and all-target check pass. Next: real GUID-scoped recovery smoke. - -## Live workspace coverage recovery passed (2026-07-16) - -Proof: `C:\Users\Meta\AppData\Local\Temp\epiphany-workspace-coverage-a577f820-b0e2-4733-b628-529ee3bdb143\proof.json`. -Initial epoch 1 owner was killed; Idunn produced exact termination, unique causal -replacement, signed readiness, epoch 2 Body authority, and reconstructable -receipt `2b44f28f-7c0f-4ad2-aefe-d7c8222e8642`. The replacement was killed only -after exact launch-incarnation revalidation and only the two cryptographically -derived fixture collections were eligible for deletion. Operator orchestration -restored `voidbot-qdrant` to stopped. Before emitting success the smoke verified -both owned collections absent. The proof binds the executed binary hash, exact -embedded smoke-source hash, source head, and tracked-source diff digest; it -proves fresh-store reopen authentication, not an OS process restart. - -The run found and cut two last-minute lies: PID 4 was not a normal-user Windows -boot oracle, so boot identity now comes from native kernel boot time; and the -replacement could not resume its own recovered running claim, so exact v3 owner -resumption is allowed while all foreign incarnations remain contended. - -Next: full deployability audit. Reboot/logon proof still requires permission. - -## Deployability audit cut (2026-07-16) - -Operational after login, not artifact-clean. Yggdrasil Qdrant/Ollama and both -packaged semantic query gates pass. Installed siblings predate `34802407` and -are mutable/mixable. Build one immutable commit-addressed release witness before -replacement. Mind still needs the R1/model+admission/live-semantic/live-coverage/ -R2 repository-readiness join. The readiness plan's June queue was stale and is -now an evidence matrix. Sight surfaces no longer say `queryAdmission=false`; -they never owned that decision. Final reboot/logon proof needs live approval. - -## Witnessed release deployed (2026-07-16) - -Commit `dd80f4a5` packaged as release `sha256-c941...f923`, witness -`sha256-f039...e04a`. Exact detached source plus initialized submodules plus -tracked lockfile plus isolated `--locked` build; four siblings only. Task and -Idunn pin the witness. Reconciler 21228 -> projector 22736; Mind/Modeling query -admission passed. Exact-path child kill -> direct-child projector 19748, launch -receipt `86a42d51-9930-4b5d-9e61-e74c82a0d808`, ready heartbeat -`4fc91977-b635-474b-812b-c364847e2b4b`, witnessed digest match. Next is Mind's -repository readiness join. Reboot remains permission-bound. +Rehydrate from `state/map.yaml` and `notes/fresh-workspace-handoff.md`. +Populate this file only when a new bounded investigation begins; clear it when +the finding is admitted, rejected, or moved into durable evidence.