Clarify Bifrost bridge identity boundary

notes/epiphany-investor-readiness-roadmap.md

@@ -20,9 +20,11 @@ The operating todo list is:
 1. Make the local Mom MVP a repeatable proof bundle: Persona entry, Bifrost-linked
    scope, one bounded coordinator action, runtime result, review, receipt, sleep,
    and sealed operator-safe artifacts.
-2. Build the Bifrost-first external-work bridge: topics, work items, dispatch
-   packets, Epiphany execution requests, artifacts, receipts, credit, and ledger
-   entries.
+2. Build the Bifrost-first external-work bridge: topics, work items, Epiphany
+   execution requests, artifacts, receipts, credit, and ledger entries. Bifrost
+   is the GameCult identity provider and bridge policy owner; Heimdall supplies
+   outside-account OAuth/token/capability claims that Bifrost associates with
+   that identity.
 3. Add accounting surfaces: model spend, role time, human review load, accepted
    artifact count, rejected-output reasons, and lessons written to memory.
 4. Keep fresh-repo operation repeatable without supervisor contamination, and
@@ -42,7 +44,7 @@ authority into a draft.
 
 Every investor-scale Objective Draft should answer:
 
-- What Bifrost topic, work item, dispatch, receipt, credit, or ledger surface
+- What Bifrost topic, work item, bridge receipt, credit, or ledger surface
   will own the governed work?
 - What bounded Epiphany execution proves the loop on a fresh or semi-external
   repo?
@@ -64,8 +66,9 @@ Every investor-scale Objective Draft should answer:
    loop toward an external or semi-external repo after Bifrost owns the work
    item bridge.
 2. Bifrost-first private alpha: all external swarm work exists as Bifrost
-   topics/work items/dispatches/receipts/credit before Discord, VoidBot, Persona,
-   or scripts can mirror it.
+   topics/work items/bridge receipts/credit, with Bifrost identity and
+   Heimdall-backed outside-account capability references where needed, before
+   Discord, VoidBot, Persona, or scripts can mirror it.
 3. Public proof sprint: selected consented tasks record scope, roles, model
    spend, review load, artifacts, outcome, memory lessons, and case-study
    permission.

notes/epiphany-repo-swarm-mvp-contract.md

@@ -2153,7 +2153,8 @@ The MVP succeeds only if each organ keeps its throne small enough to deserve it.
 | Gjallar | Whole-Verse/operator-safe sight rows over advertised state. | Discovery ownership, service lifecycle, mutation, private-state inspection. |
 | Odin | Discovery, rendezvous, schema and surface awareness. | Provider ownership, daemon survival, repo mutation. |
 | Idunn | Daemon/service lifecycle physiology, runbooks, scheduler service aftercare. | Repo work planning, branch commits, publication. |
-| Bifrost | Publication, credit, ledger, merge/sync authority receipts. | Local branch implementation, private thought, daemon survival. |
+| Bifrost | GameCult identity, governed external-world crossings, linked-account association, publication, credit, ledger, merge/sync authority receipts. | Local branch implementation, private thought, daemon survival, outside-provider token custody. |
+| Heimdall | Outside-provider OAuth, token custody, linked-account capability/account claims for Bifrost to verify. | GameCult identity, bridge policy, repo execution, publication receipts. |
 | Eve/CultUI | Interface projection of typed state. | Source of truth or hidden action authority. |
 
 ### Tool Availability Doctrine
@@ -2189,6 +2190,9 @@ a publication receipt exists. A repo swarm's public work item reaches the
 upstream-complete state only when:
 
 - Bifrost or maintainer authority records publication/merge permission.
+- The publication receipt names the Bifrost identity and, when the crossing
+  touches GitHub/Discord/Reddit or another outside provider, the
+  Heimdall-backed capability/account reference that made the crossing legal.
 - The Hands commit being published is known.
 - The configured upstream ref, normally `origin/main`, resolves.
 - Git ancestry proves the Hands commit is contained by upstream main.

notes/fresh-workspace-handoff.md

@@ -624,6 +624,17 @@ that change what the next agent should believe.
 
 Do not continue implementation automatically from a rehydrate-only request.
 
+Bridge identity correction from 2026-06-22: Epiphany owns swarm execution,
+repo Body work, branch-local lanes, memory, evidence, and Persona cognition.
+Bifrost owns GameCult identity, governed crossings into GitHub/Discord/Reddit
+and other public worlds, linked-account association, bridge policy, receipts,
+credit, and ledger facts. Heimdall owns outside-provider OAuth, token custody,
+and verifiable capability/account claims that Bifrost associates with a
+Bifrost identity. The old Bifrost dispatch bridge was transitional
+VoidBot-era queueing, not the blessed Epiphany launcher. Future receipts should
+carry Bifrost identity plus Heimdall-backed capability/account references,
+never raw bearer tokens.
+
 The next real move remains Codex starvation, not outward bridge work. The
 inventory and ledger now exist:
 

state/map.yaml

@@ -80,6 +80,7 @@ active_subgoals:
   - Organ state now has a hard profile split: resident Epiphany sub-agents use lean `work_organ` state, public/person-shaped agents use portable `persona` state, and heartbeat/swarm machinery owns scheduling/coordination physiology. Persona is the Epiphany organ; Persona is the shared GameCult contract for Epiphany Persona, VoidBot repo Personas, and Ghostlight characters. Persona documents carry provenance, required public presentation metadata, `date-time` timestamps, typed `candidateActions`, strict anchored thoughts with non-authoritative extensions, custom enum companion labels, and typed affect subrecords for bonds/status reads/doctrine stances. Work organs must not inherit Persona affect/social-bond/status-read machinery just because the old Ghostlight-derived shape had room for it.
   - The Eyes/source-gathering fork exposed by the Mom-ready MVP proof is now landed as a fixed Research lane owned by Eyes. The quarantined Codex MCP spine may execute typed tool intents and emit typed receipts; the model runtime can build and run provider-neutral follow-up turns from those receipts; coordinator run mode passes the quarantined tool adapter into worker runtime with auto-tools enabled by default; worker runtime now enforces max-runtime with one timeout close primitive for both tokio timeout and watchdog paths; inner `openai-worker-*` jobs are opened before async auth/stream waits and sealed with their outer worker on timeout; native status/roles/jobs/coordinator surfaces project failed and completed runtime-linked jobs as terminal without Codex prompt or scheduler authority; direct tiny model-turn transport succeeds; worker requests record request metrics, transport readiness, and sampled raw Responses frame kinds; worker prompts no longer prepend the full shared persistent-memory rite; stream deltas compact before durable storage; live MVP modeling workers complete instead of timing out; stale completed runtime links no longer block replacement launches; jobLaunch validates before opening runtime jobs; completed-but-unreviewable modeling findings now stop for review instead of relaunching the same blind lane; and completed unreviewable modeling findings with verdict `regather-needed` route to `LaunchResearch` instead of relaunching Modeling. Research findings are accepted only when their statePatch is Eyes-shaped: observations, evidence, scratch, and optional investigationCheckpoint, with no graph/planning/objective authority.
   - The GameCult integrated investment dossier at `E:\Projects\gamecult-site\docs\gamecult_integrated_dossier.tex` raises the Mom-ready bar from local demo to diligence-ready loop. Epiphany must be ready to prove Bifrost-first external work: a human/agent work item or topic originates in Bifrost, Epiphany decomposes and executes through bounded roles, maintainers review artifacts, Bifrost records receipts/credit, and operator-safe public evidence can be shown without exporting private worker/operator/agent context. The concrete readiness asks are fresh-repo Epiphany demo, Bifrost work item/topic/agent transport/receipt/ledger demo, compute spend and accepted-artifact metrics, and a security model for secrets, write permissions, and public/private exports. Discord, VoidBot, repo Personas, and ad hoc scripts must not become shadow governance or reward authorities.
+  - Bifrost bridge authority is now clarified: Epiphany owns swarm execution, repo Body work, branch-local lanes, memory, evidence, and Persona cognition; Bifrost owns GameCult identity, governed external-world crossings, linked-account association, publication/credit/ledger receipts, and GitHub/Discord/Reddit bridge policy; Heimdall owns outside-provider OAuth, token custody, and verifiable capability/account claims that Bifrost associates with a Bifrost identity. The old Bifrost dispatch bridge was a transitional VoidBot-era worker queue, not the blessed Epiphany launcher. Local bridge tokens are actuator quarantine, not identity; blessed crossings need Bifrost identity plus Heimdall-backed capability/account references in receipts.
   - Use `notes/epiphany-investor-readiness-roadmap.md` as this Codex operator's investor-scale todo rail and as the optional Epiphany Imagination sub-agent planning rail. Angel capital is fuel for compute, review capacity, legal diligence, infrastructure, and public proof, not a governance throne. The operator roadmap is now: make the local Mom MVP a repeatable proof bundle; build the Bifrost-first external-work bridge; add model-spend/review-load/accepted-artifact accounting; keep fresh-repo operation repeatable without supervisor contamination; and keep public/operator-safe exports sealed against private worker/operator/agent context. Imagination should translate world-scale Colossus pressure into Bifrost-first Objective Drafts with consent, maintainer review, receipts/ledger evidence, compute/output metrics, public/private export safety, and bounded proof artifacts.
   - The May 2026 teardown/rebuild migration is archived under `notes/archive/epiphany-ideal-architecture-rebuild-plan.md` unless a concrete regression reopens it. Preserve the new foundation: Epiphany view/coordinator policy lives in `epiphany-core`, runtime-spine owns job/result lifecycle identity through `runtime_links`, duplicate acceptance is receipt-keyed, public findings stay typed/sealed, view expansion requires a core contract, and app-server remains routing/adaptation rather than a second policy throne.
   - Treat Phase 5 update/distill/propose/promote/read/notification as complete enough unless a concrete regression appears.