Record verdict Modeling identity boundary

notes/epiphany-current-algorithmic-map.md

@@ -1583,3 +1583,15 @@ Ordinary Modeling retains its generic schema. Mind still validates route,
 verdict receipt, frontier identity, hashes, evidence, and mutation content at
 admission. The old path can no longer spend a model turn producing Evolution
 under verdict authority and rely on a later rejection to discover the mismatch.
+
+Exact `61e8be38` proved that operation-level restriction is necessary but not
+sufficient. The inherited frontier-item output schema omitted `adopted_plan`.
+A schema-conforming `revise_frontier` therefore implicitly replaced an adopted
+plan with absence, and Mind correctly rejected it as alteration of execution
+anatomy. Verdict Modeling launch authority must carry both the exact request
+and exact routed item, not merely request identity. The provider schema must
+const-bind all identity anatomy, including the complete adopted plan, while
+leaving only status, evidence references, gap, and update timestamp writable.
+The completed worker result is immutable invalid evidence and cannot be made
+valid by changing admission after the fact. Supersede it only when the corrected
+launch/schema boundary is ready, then run one new inference.

notes/fresh-workspace-handoff.md

@@ -10,10 +10,10 @@ machine at its present memory budget.
 - Pushed source release commit: `6f3cdc6168e5bf8b680e141582152b56ef10debe`
 - Live workspace: `F:\Projects\.epiphany-runtime\shakedown\live-20260808-v53-hands-precedence`
 - Thread: `shakedown-v49-hands-relinquishment-r1`
-- Current release: `sha256-d2e7205a2b714c89892ba623b26c3cc4c98ac6b4f54dfb9a0a2a623f0d92402d`
-- Release witness: `sha256-399d952e5944450775516e612d447be8b2a106e83399f35e2fb6ffb166d17876`
-- Thread-state revision: `56`
-- Current action: causal Modeling job `9d7cd7d8-2d43-4165-b3c5-54381126579e` completed, but Mind rejected and superseded its unauthorized Evolution patch. A typed launch/schema repair is under focused verification; do not relaunch on the old runtime.
+- Current release: `sha256-67ed6c8dbce5dee81dfaf44effb8f499c61ae98bbdff4d997a665f91deeef8a5`
+- Release witness: `sha256-c98e36f35057f902c518167db3f036edb4994b02f15f432510f7e6fde1263853`
+- Thread-state revision: `39`
+- Current action: schema-aware retry job `a89fe1ea-a88b-4108-a299-c99ca9b65fb7` is completed but invalid and unreviewed. Do not launch another worker. Repair exact frontier-item identity binding first, explicitly supersede this result, then launch one corrected attempt.
 - Sealed evidence: v49 through v52. Do not mutate them.
 
 ## Live causal boundary
@@ -82,6 +82,23 @@ Finish focused tests, commit and push, package one authenticated release, then
 relaunch the superseded post-Soul Modeling request without overrides. Do not
 recreate Eyes, Imagination, Hands, or Soul work from this circuit.
 
+Exact commit `61e8be38a3d194b70a4f469e7524653ecab590a8` packaged in 6m50s as
+release `sha256-67ed6c8d...` with witness `sha256-c98e36f3...`. Live launch
+`57272b34-8148-4668-903e-00cfe5fabfdd` proved that Evolution was no longer
+representable, but Mind rejected its frontier revision because the specialized
+schema still inherited an item shape that omitted `adopted_plan`; output thus
+altered adopted execution anatomy. The coordinator superseded it and launched
+retry `a89fe1ea-a88b-4108-a299-c99ca9b65fb7`, which completed. Review without
+automatic supersession failed closed with `generic frontier revision cannot
+alter adopted execution anatomy or own plan adoption`.
+
+Next cut: persist one typed verdict-Modeling launch authority containing the
+exact `RepoFrontierModelingRequest` and routed `RepoFrontierItem`. Generate
+provider `const` constraints for every identity-bearing field, especially the
+full adopted plan. Only verdict-owned status, evidence refs, gap, and updated_at
+may vary. The completed retry is immutable invalid evidence; supersede it only
+after the repair is ready, then pay for one corrected model turn.
+
 After the Modeling boundary lands, continue attacking the iteration path:
 
 - exact `6f3cdc61` packaging rebuilt 21 first-party release binaries in 6m59s;

state/map.yaml

@@ -34,15 +34,15 @@ invariants:
   - Evidence and git retain history; this map retains only state that changes future decisions.
 
 current_status:
-  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Live v53 carries RepoModel revision 6, an exact amended Hands consequence, and an accepted Soul pass. Self correctly derives post-Soul Modeling after repairing verification precedence over generic CRRC/regather routing. Three post-Soul Modeling attempts are superseded: one timeout, one stale Eyes handoff, and one correctly contextualized worker that still escaped through the generic output schema as unauthorized Evolution. The repair now carries exact verdict-request authority in the typed worker launch and specializes the provider schema before inference. Persona consequence, retention, endurance, restart closure, and Linux/Yggdrasil cognition remain open.
+  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Live v53 carries RepoModel revision 6, an exact amended Hands consequence, and an accepted Soul pass. Exact release 61e8be38 now prevents verdict-bound Modeling from escaping into generic Evolution. Live retry proved the remaining schema wound: revise_frontier did not expose or const-bind the adopted plan, so model output implicitly removed execution anatomy and Mind rejected it. Job a89fe1ea-a88b-4108-a299-c99ca9b65fb7 is completed and awaits a coherent typed-authority repair before review. Persona consequence, retention, endurance, restart closure, and Linux/Yggdrasil cognition remain open.
   operational_state:
-    local_worktree: verdict_bound_modeling_schema_repair_verified_pending_release
+    local_worktree: clean_after_partial_verdict_schema_proof
     operator_wireguard: restored
     yggdrasil: canonical_small_public_crossing_body
     starfire: temporary_epiphany_cognition_body
     starfire_runtime_identity: epiphany-starfire
     starfire_swarm_brake: released
-    starfire_release: authenticated_6f3cdc61_release_sha256_d2e7205a
+    starfire_release: authenticated_61e8be38_release_sha256_67ed6c8d
     starfire_repository_body: bound_and_observed
     starfire_verse_topology: bound_to_current_repository_body
     starfire_native_status: supervised_shakedown_active
@@ -53,7 +53,7 @@ current_status:
     yggdrasil_epiphany_services: absent
     resident_physiology: heartbeat_and_self_running
   unresolved_authority: The local execution amendment is user-authorized and packet-hash bound, not Bifrost-signed. Soul passed the amended consequence but reported that derived reorientation checkpoints carry empty evidence_ids; Modeling must preserve that limitation rather than overstate source provenance. The adopted Mind decision also carries a model-supplied 2025 timestamp; coordinator commit-time timestamp ownership remains open. Exact packaging still takes 6m59s after core changes. Removing one redundant RepoModel pull left worker appearance near 48s and full coordinator launch near 83s, so repeated whole-store transactions remain the dominant 40 MiB launch-path defect.
-  next_action: Finish focused verification and publish the verdict-bound Modeling schema repair. Build one authenticated release, relaunch the superseded post-Soul Modeling request without overrides, accept the first valid frontier-verdict result, and inspect Self's next typed action. Continue collapsing launch context onto one transaction-scoped typed read view and split volatile Self policy from the release mega-package without weakening provenance.
+  next_action: Carry the exact routed RepoFrontierItem plus RepoFrontierModelingRequest as one typed verdict-modeling launch authority. Specialize the worker schema so every identity-bearing frontier field, including adopted_plan, is const-bound; only status, evidence_refs, gap, and updated_at may vary. Then explicitly supersede invalid completed job a89fe1ea-a88b-4108-a299-c99ca9b65fb7 and launch one corrected attempt. Preserve the 45.77-second jobCommit timing as the launch-store optimization receipt.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.