From acf970c4097f1b05074595952af2ccd3b8699dae Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Mon, 22 Jun 2026 14:27:16 +0100 Subject: [PATCH] Clarify Bifrost bridge identity boundary --- notes/epiphany-investor-readiness-roadmap.md | 15 +++++++++------ notes/epiphany-repo-swarm-mvp-contract.md | 6 +++++- notes/fresh-workspace-handoff.md | 11 +++++++++++ state/ledgers.msgpack | Bin 385783 -> 386192 bytes state/map.yaml | 1 + 5 files changed, 26 insertions(+), 7 deletions(-) diff --git a/notes/epiphany-investor-readiness-roadmap.md b/notes/epiphany-investor-readiness-roadmap.md index 5981e5fb..18ad28be 100644 --- a/notes/epiphany-investor-readiness-roadmap.md +++ b/notes/epiphany-investor-readiness-roadmap.md @@ -20,9 +20,11 @@ The operating todo list is: 1. Make the local Mom MVP a repeatable proof bundle: Persona entry, Bifrost-linked scope, one bounded coordinator action, runtime result, review, receipt, sleep, and sealed operator-safe artifacts. -2. Build the Bifrost-first external-work bridge: topics, work items, dispatch - packets, Epiphany execution requests, artifacts, receipts, credit, and ledger - entries. +2. Build the Bifrost-first external-work bridge: topics, work items, Epiphany + execution requests, artifacts, receipts, credit, and ledger entries. Bifrost + is the GameCult identity provider and bridge policy owner; Heimdall supplies + outside-account OAuth/token/capability claims that Bifrost associates with + that identity. 3. Add accounting surfaces: model spend, role time, human review load, accepted artifact count, rejected-output reasons, and lessons written to memory. 4. Keep fresh-repo operation repeatable without supervisor contamination, and @@ -42,7 +44,7 @@ authority into a draft. Every investor-scale Objective Draft should answer: -- What Bifrost topic, work item, dispatch, receipt, credit, or ledger surface +- What Bifrost topic, work item, bridge receipt, credit, or ledger surface will own the governed work? - What bounded Epiphany execution proves the loop on a fresh or semi-external repo? @@ -64,8 +66,9 @@ Every investor-scale Objective Draft should answer: loop toward an external or semi-external repo after Bifrost owns the work item bridge. 2. Bifrost-first private alpha: all external swarm work exists as Bifrost - topics/work items/dispatches/receipts/credit before Discord, VoidBot, Persona, - or scripts can mirror it. + topics/work items/bridge receipts/credit, with Bifrost identity and + Heimdall-backed outside-account capability references where needed, before + Discord, VoidBot, Persona, or scripts can mirror it. 3. Public proof sprint: selected consented tasks record scope, roles, model spend, review load, artifacts, outcome, memory lessons, and case-study permission. diff --git a/notes/epiphany-repo-swarm-mvp-contract.md b/notes/epiphany-repo-swarm-mvp-contract.md index 9a6d0b38..b8b68d03 100644 --- a/notes/epiphany-repo-swarm-mvp-contract.md +++ b/notes/epiphany-repo-swarm-mvp-contract.md @@ -2153,7 +2153,8 @@ The MVP succeeds only if each organ keeps its throne small enough to deserve it. | Gjallar | Whole-Verse/operator-safe sight rows over advertised state. | Discovery ownership, service lifecycle, mutation, private-state inspection. | | Odin | Discovery, rendezvous, schema and surface awareness. | Provider ownership, daemon survival, repo mutation. | | Idunn | Daemon/service lifecycle physiology, runbooks, scheduler service aftercare. | Repo work planning, branch commits, publication. | -| Bifrost | Publication, credit, ledger, merge/sync authority receipts. | Local branch implementation, private thought, daemon survival. | +| Bifrost | GameCult identity, governed external-world crossings, linked-account association, publication, credit, ledger, merge/sync authority receipts. | Local branch implementation, private thought, daemon survival, outside-provider token custody. | +| Heimdall | Outside-provider OAuth, token custody, linked-account capability/account claims for Bifrost to verify. | GameCult identity, bridge policy, repo execution, publication receipts. | | Eve/CultUI | Interface projection of typed state. | Source of truth or hidden action authority. | ### Tool Availability Doctrine @@ -2189,6 +2190,9 @@ a publication receipt exists. A repo swarm's public work item reaches the upstream-complete state only when: - Bifrost or maintainer authority records publication/merge permission. +- The publication receipt names the Bifrost identity and, when the crossing + touches GitHub/Discord/Reddit or another outside provider, the + Heimdall-backed capability/account reference that made the crossing legal. - The Hands commit being published is known. - The configured upstream ref, normally `origin/main`, resolves. - Git ancestry proves the Hands commit is contained by upstream main. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index aba40066..b410f01a 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -624,6 +624,17 @@ that change what the next agent should believe. Do not continue implementation automatically from a rehydrate-only request. +Bridge identity correction from 2026-06-22: Epiphany owns swarm execution, +repo Body work, branch-local lanes, memory, evidence, and Persona cognition. +Bifrost owns GameCult identity, governed crossings into GitHub/Discord/Reddit +and other public worlds, linked-account association, bridge policy, receipts, +credit, and ledger facts. Heimdall owns outside-provider OAuth, token custody, +and verifiable capability/account claims that Bifrost associates with a +Bifrost identity. The old Bifrost dispatch bridge was transitional +VoidBot-era queueing, not the blessed Epiphany launcher. Future receipts should +carry Bifrost identity plus Heimdall-backed capability/account references, +never raw bearer tokens. + The next real move remains Codex starvation, not outward bridge work. The inventory and ledger now exist: diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 11c03b87156b2117f480502fe79fe9721a21b28c..2992f000969537097cd4dd525f633916d6bd445b 100644 GIT binary patch delta 456 zcmYk2zfJ-{5XL=(-b4-UB(@v}r&2&A#z?1ymEGRnaJOM^cilgpR1_Ar7NW0VVquK6 zCccG<4`J(a5wVy|F*D!%zVG|3dHd0P+zdA2v+iy`-tX^q&)?S?U&Yf-a1jLe*Yn!V zycYOc^mSkL=XtG>d~V;p#GSYoc6wpFx_vl(t#8fbkd3u8781?U3_+FxwaJ+RDz!#x zG3~>VVk#$Mx|kX;CD8@o6;fxJ6hK4@8kK~hOs7yvJsH4KwK_N^1s*zXfu$%cvr|yq z8Lwb*rUl_ZJ%M2&Gm-y@Oj$F45wapBoP%*nafSw@v&Jiggi`5*g_8qk^T^5xiii?L z62=$WloM8%_8-Epv86HySpp?mPpgf}`;x1*a;lw(I1w0;%rk@1@)89R6k98@e@``z fO{+@cnAwp_e0oK}Y(#x*8K$8kHit2x*0g^By-lR7 delta 58 zcmbPmQvCZ-@eRU^0)`=m7FLF4Rwjl~#~4^2UfHb7SjfmYwRtL2`&1@IAO_LQK+Ljz JDidqc0{}!x6EFY( diff --git a/state/map.yaml b/state/map.yaml index 3d11f31b..fb3f4529 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -80,6 +80,7 @@ active_subgoals: - Organ state now has a hard profile split: resident Epiphany sub-agents use lean `work_organ` state, public/person-shaped agents use portable `persona` state, and heartbeat/swarm machinery owns scheduling/coordination physiology. Persona is the Epiphany organ; Persona is the shared GameCult contract for Epiphany Persona, VoidBot repo Personas, and Ghostlight characters. Persona documents carry provenance, required public presentation metadata, `date-time` timestamps, typed `candidateActions`, strict anchored thoughts with non-authoritative extensions, custom enum companion labels, and typed affect subrecords for bonds/status reads/doctrine stances. Work organs must not inherit Persona affect/social-bond/status-read machinery just because the old Ghostlight-derived shape had room for it. - The Eyes/source-gathering fork exposed by the Mom-ready MVP proof is now landed as a fixed Research lane owned by Eyes. The quarantined Codex MCP spine may execute typed tool intents and emit typed receipts; the model runtime can build and run provider-neutral follow-up turns from those receipts; coordinator run mode passes the quarantined tool adapter into worker runtime with auto-tools enabled by default; worker runtime now enforces max-runtime with one timeout close primitive for both tokio timeout and watchdog paths; inner `openai-worker-*` jobs are opened before async auth/stream waits and sealed with their outer worker on timeout; native status/roles/jobs/coordinator surfaces project failed and completed runtime-linked jobs as terminal without Codex prompt or scheduler authority; direct tiny model-turn transport succeeds; worker requests record request metrics, transport readiness, and sampled raw Responses frame kinds; worker prompts no longer prepend the full shared persistent-memory rite; stream deltas compact before durable storage; live MVP modeling workers complete instead of timing out; stale completed runtime links no longer block replacement launches; jobLaunch validates before opening runtime jobs; completed-but-unreviewable modeling findings now stop for review instead of relaunching the same blind lane; and completed unreviewable modeling findings with verdict `regather-needed` route to `LaunchResearch` instead of relaunching Modeling. Research findings are accepted only when their statePatch is Eyes-shaped: observations, evidence, scratch, and optional investigationCheckpoint, with no graph/planning/objective authority. - The GameCult integrated investment dossier at `E:\Projects\gamecult-site\docs\gamecult_integrated_dossier.tex` raises the Mom-ready bar from local demo to diligence-ready loop. Epiphany must be ready to prove Bifrost-first external work: a human/agent work item or topic originates in Bifrost, Epiphany decomposes and executes through bounded roles, maintainers review artifacts, Bifrost records receipts/credit, and operator-safe public evidence can be shown without exporting private worker/operator/agent context. The concrete readiness asks are fresh-repo Epiphany demo, Bifrost work item/topic/agent transport/receipt/ledger demo, compute spend and accepted-artifact metrics, and a security model for secrets, write permissions, and public/private exports. Discord, VoidBot, repo Personas, and ad hoc scripts must not become shadow governance or reward authorities. + - Bifrost bridge authority is now clarified: Epiphany owns swarm execution, repo Body work, branch-local lanes, memory, evidence, and Persona cognition; Bifrost owns GameCult identity, governed external-world crossings, linked-account association, publication/credit/ledger receipts, and GitHub/Discord/Reddit bridge policy; Heimdall owns outside-provider OAuth, token custody, and verifiable capability/account claims that Bifrost associates with a Bifrost identity. The old Bifrost dispatch bridge was a transitional VoidBot-era worker queue, not the blessed Epiphany launcher. Local bridge tokens are actuator quarantine, not identity; blessed crossings need Bifrost identity plus Heimdall-backed capability/account references in receipts. - Use `notes/epiphany-investor-readiness-roadmap.md` as this Codex operator's investor-scale todo rail and as the optional Epiphany Imagination sub-agent planning rail. Angel capital is fuel for compute, review capacity, legal diligence, infrastructure, and public proof, not a governance throne. The operator roadmap is now: make the local Mom MVP a repeatable proof bundle; build the Bifrost-first external-work bridge; add model-spend/review-load/accepted-artifact accounting; keep fresh-repo operation repeatable without supervisor contamination; and keep public/operator-safe exports sealed against private worker/operator/agent context. Imagination should translate world-scale Colossus pressure into Bifrost-first Objective Drafts with consent, maintainer review, receipts/ledger evidence, compute/output metrics, public/private export safety, and bounded proof artifacts. - The May 2026 teardown/rebuild migration is archived under `notes/archive/epiphany-ideal-architecture-rebuild-plan.md` unless a concrete regression reopens it. Preserve the new foundation: Epiphany view/coordinator policy lives in `epiphany-core`, runtime-spine owns job/result lifecycle identity through `runtime_links`, duplicate acceptance is receipt-keyed, public findings stay typed/sealed, view expansion requires a core contract, and app-server remains routing/adaptation rather than a second policy throne. - Treat Phase 5 update/distill/propose/promote/read/notification as complete enough unless a concrete regression appears.