Prove proposal Modeling receipt-free settlement
This commit is contained in:
Meta Vens
parent
92f383c52c
commit
b2d3f85c2f
5 changed files with 181 additions and 3 deletions
|
|
@ -13723,6 +13723,153 @@ pub(crate) mod tests {
|
|||
Ok(())
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn typed_proposal_fulfillment_settles_receipt_free_resident_authority_once() -> Result<()> {
|
||||
let root = tempfile::tempdir()?;
|
||||
let (runtime_store, result, _) =
|
||||
proposal_admission_fixture(root.path(), "resident-fulfillment")?;
|
||||
let request_id = result
|
||||
.proposal_modeling_request_id
|
||||
.clone()
|
||||
.expect("proposal request echo");
|
||||
put_runtime_role_worker_result(&runtime_store, &result)?;
|
||||
assert!(coordinator_run_receipts(&runtime_store)?.is_empty());
|
||||
|
||||
let resident_store = root.path().join("resident.cc");
|
||||
crate::enqueue_resident_self_pressure(
|
||||
&resident_store,
|
||||
&crate::ResidentSelfPressure {
|
||||
schema_version: crate::RESIDENT_SELF_PRESSURE_SCHEMA_VERSION.into(),
|
||||
pressure_id: "proposal-modeling-resident-pressure".into(),
|
||||
kind: "repo-frontier-proposal-modeling".into(),
|
||||
provenance_ref: format!(
|
||||
"cultcache://repo-frontier-proposal-modeling/{request_id}"
|
||||
),
|
||||
objective: "Settle the exact authenticated proposal Modeling result.".into(),
|
||||
created_at_millis: 1,
|
||||
status: "pending".into(),
|
||||
consumed_by_grant_id: None,
|
||||
private_state_exposed: false,
|
||||
},
|
||||
)?;
|
||||
let grant = crate::heartbeat_issue_resident_self_grant(
|
||||
&resident_store,
|
||||
"proposal-modeling-heartbeat",
|
||||
"proposal-modeling-action",
|
||||
2,
|
||||
)?
|
||||
.expect("proposal Modeling grant");
|
||||
let coordinator = root.path().join("epiphany-mvp-coordinator");
|
||||
std::fs::write(&coordinator, b"witnessed executable")?;
|
||||
let policy = crate::ResidentSelfPolicy {
|
||||
workspace: root.path().to_path_buf(),
|
||||
coordinator_bin: coordinator.clone(),
|
||||
model_runtime_bin: root.path().join("epiphany-model-runtime"),
|
||||
tool_adapter_bin: root.path().join("epiphany-tool-mcp-runtime"),
|
||||
runtime_store: runtime_store.clone(),
|
||||
local_verse_store: root.path().join("local-verse.cc"),
|
||||
agent_memory_store: root.path().join("mind.cc"),
|
||||
artifact_root: root.path().join("artifacts"),
|
||||
codex_home: root.path().join("codex-home"),
|
||||
mcp_config: root.path().join("mcp.toml"),
|
||||
model_provider: "local".into(),
|
||||
max_steps: 2,
|
||||
turn_timeout_seconds: 60,
|
||||
cooldown_seconds: 10,
|
||||
idle_sleep_seconds: 5,
|
||||
failure_backoff_seconds: 20,
|
||||
release_commit: "proposal-modeling-test-release".into(),
|
||||
release_manifest_digest: "sha256:proposal-modeling-test-manifest".into(),
|
||||
release_store: root.path().join("release.cc"),
|
||||
release_runtime_id: "deployment-runtime".into(),
|
||||
release_id: "proposal-modeling-test-release".into(),
|
||||
release_witness_sha256: "sha256:proposal-modeling-test-witness".into(),
|
||||
};
|
||||
let prepared = crate::prepare_resident_self_launch(&resident_store, &policy, 3)?
|
||||
.expect("proposal Modeling preparation");
|
||||
let process = crate::LaunchedCoordinator {
|
||||
process_id: u32::MAX - 13,
|
||||
process_creation_token: 79,
|
||||
process_executable_path: coordinator,
|
||||
};
|
||||
crate::claim_resident_self_preparation_as_child(
|
||||
&resident_store,
|
||||
&prepared.preparation_id,
|
||||
&process,
|
||||
4,
|
||||
)?;
|
||||
let lease = crate::acknowledge_resident_self_launch(
|
||||
&resident_store,
|
||||
&prepared.preparation_id,
|
||||
&process,
|
||||
5,
|
||||
)?;
|
||||
open_coordinator_run(
|
||||
&runtime_store,
|
||||
&coordinator_run_session_id(&lease.turn_id, Some(&lease.launch_digest))?,
|
||||
&lease.turn_id,
|
||||
Some(&lease.launch_digest),
|
||||
&format!("Resident coordinator launch {}.", lease.objective_digest),
|
||||
"1970-01-01T00:00:00.005Z",
|
||||
)?;
|
||||
assert_eq!(
|
||||
crate::verify_resident_self_grant_fulfillment(
|
||||
&resident_store,
|
||||
&runtime_store,
|
||||
&grant.grant_id,
|
||||
)?,
|
||||
crate::ResidentSelfGrantFulfillment::Fulfilled
|
||||
);
|
||||
assert_eq!(
|
||||
crate::settle_resident_self_receipt_free_dead_coordinator(
|
||||
&resident_store,
|
||||
&runtime_store,
|
||||
&lease,
|
||||
crate::ChildObservation::Missing,
|
||||
false,
|
||||
false,
|
||||
false,
|
||||
6,
|
||||
policy.cooldown_seconds,
|
||||
)?,
|
||||
crate::ResidentSelfOutcome::Completed
|
||||
);
|
||||
assert!(crate::load_resident_self_state(&resident_store)?.active_turn.is_none());
|
||||
let settled = std::fs::read(&resident_store)?;
|
||||
assert!(
|
||||
crate::settle_resident_self_receipt_free_dead_coordinator(
|
||||
&resident_store,
|
||||
&runtime_store,
|
||||
&lease,
|
||||
crate::ChildObservation::Missing,
|
||||
false,
|
||||
false,
|
||||
false,
|
||||
7,
|
||||
policy.cooldown_seconds,
|
||||
)
|
||||
.is_err()
|
||||
);
|
||||
assert_eq!(std::fs::read(&resident_store)?, settled);
|
||||
for ack in crate::pending_resident_self_acks(&resident_store)? {
|
||||
crate::heartbeat_consume_resident_self_ack(&resident_store, &ack.ack_id, 8)?;
|
||||
}
|
||||
let head = crate::retain_resident_self_lifecycles(&resident_store, 0, 9)?
|
||||
.expect("closed proposal Modeling lifecycle");
|
||||
assert_eq!(head.retired_lifecycle_count, 1);
|
||||
assert!(crate::pending_resident_self_grant(&resident_store)?.is_none());
|
||||
assert!(
|
||||
crate::heartbeat_issue_resident_self_grant(
|
||||
&resident_store,
|
||||
"proposal-modeling-after-retention",
|
||||
"proposal-modeling-after-retention-action",
|
||||
10,
|
||||
)?
|
||||
.is_none()
|
||||
);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn claim_repair_admission_fixture(
|
||||
root: &Path,
|
||||
suffix: &str,
|
||||
|
|
|
|||
|
|
@ -3308,3 +3308,13 @@ reopening authority. This proves the candidate companion remains producer-owned:
|
|||
the first fixture attempt without it failed closed before resident settlement.
|
||||
Proposal Modeling remains separate because its fulfillment validator also owns
|
||||
the immutable proposal payload, Modeling context, and Evolution patch shape.
|
||||
|
||||
The proposal Modeling variant now crosses the full resident boundary in source
|
||||
verification by reusing the runtime admission fixture rather than copying its
|
||||
policy. Runtime remains owner of proposal/request/payload, Body-bound launch
|
||||
context and hash, successful Modeling result, Evolution patch, and the single
|
||||
safe routeable frontier. Resident Self sees only authenticated fulfillment and
|
||||
owns exact zero-receipt death settlement, replay refusal, lifecycle retirement,
|
||||
and non-resurrection. Core 663/1 ignored and swarm 7 pass. Direct packaged proof
|
||||
still requires Linux-native construction because the worker launch's Body basis
|
||||
cannot truthfully be minted under a Windows path and rebound later.
|
||||
|
|
|
|||
|
|
@ -2601,3 +2601,24 @@ Next: proposal Modeling is the remaining fulfilled-before-receipt variant. Its
|
|||
immutable proposal/request/context/patch/launch/result chain is stronger and
|
||||
must be mapped before constructing live state. Runtime terminal-attempt
|
||||
retention follows. Actual c006 remains braked and stopped.
|
||||
|
||||
## Proposal Modeling fulfilled-before-receipt source gate — 2026-08-10
|
||||
|
||||
The real runtime proposal-admission fixture now crosses the resident boundary.
|
||||
It preserves the full immutable chain: user proposal and payload, selected
|
||||
request, runtime/thread/Body-bound Modeling context, exact launch binding and
|
||||
launch-document hash, successful Modeling result, Evolution patch, and one
|
||||
safe proposal-citing routeable frontier. No parallel fulfillment schema exists.
|
||||
|
||||
With zero coordinator receipts, resident Self verifies that runtime-owned chain,
|
||||
records exact coordinator death recovery, closes the original grant once, and
|
||||
refuses replay with byte-identical resident state. Heartbeat consumes the ack;
|
||||
retention removes the lifecycle; and no later grant can appear. Full core tests
|
||||
pass 663 with one intentional ignore and all seven swarm tests pass.
|
||||
|
||||
Direct packaged proposal evidence remains open. Unlike the two consideration
|
||||
lanes, its immutable worker launch includes authenticated repository Body basis,
|
||||
so a faithful fixture must construct it inside the Linux path namespace after
|
||||
packaged Body binding. Do not add a test-only production writer merely to make
|
||||
that receipt convenient. Next map terminal-worker-attempt retention and then
|
||||
choose the smallest Linux-native construction path.
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -36,9 +36,9 @@ invariants:
|
|||
|
||||
current_status:
|
||||
summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, exact 16c4b19f coordinator receipt and Heartbeat artifact retention, exact cce2b8ac narrow model-generation retention, exact eea15e82 model-turn JSON ingress, exact b1e8c89a semantic unattempted-generation retention, exact 6bc3ec3f semantic physical-epoch retirement, and exact 44230a05 Persona conversation retention are proven. Gamecult-ops 059821f owns Yggdrasil stream retention and exact 6ee08a4 owns stable Starfire Persona-permit firewall ingress. Exact 16c4b19f genuine idle and exact a987d2f7 active cognition completed 900-pulse bounded plateaus. Runtime-owned typed fulfillment is accepted live under exact 6dd9b132. Yggdrasil is the small public crossing body, never the release forge.
|
||||
latest_phase: Exact pushed 52ee6b53 release sha256-24a8faee17bc28fa7eca877748cfa14472832881352f251b2d4b4f33db823771 with witness sha256-c1d0f4f1d9a5d0a253eefacf50d1901d2b8de062bcef5e692bda2a6f39d5af48 now directly proves both admitted-model-direction and Imagination fulfilled-before-receipt settlement. Fresh Imagination state authenticated the exact request/model basis/candidate/launch binding/worker launch and result with zero coordinator receipts. Exact packaged Self exited 0 completed, terminalized the original grant recovered-fulfilled, preserved its pressure consumed, and cleared active authority. After Heartbeat consumed the ack, exact packaged zero-window retention exited 0 sleeping, removed the lifecycle, and replay yielded no retry. Source test commit fc13f9ca independently proves pending-before-binding, byte-identical settlement replay refusal, retention, and no resurrection; core 662/1 ignored and swarm 7 pass. Receipts are under .epiphany-run/imagination-fulfillment-52ee6b53. Actual c006 remains braked and stopped.
|
||||
latest_phase: Exact pushed 52ee6b53 release sha256-24a8faee17bc28fa7eca877748cfa14472832881352f251b2d4b4f33db823771 with witness sha256-c1d0f4f1d9a5d0a253eefacf50d1901d2b8de062bcef5e692bda2a6f39d5af48 directly proves admitted-model-direction and Imagination fulfilled-before-receipt settlement plus lifecycle retention without retry. The latest source pass now closes proposal Modeling at the same resident boundary while retaining its stronger runtime contract: immutable proposal and selected request, Body-bound thread/context and launch hash, successful Modeling result, Evolution patch, and exactly one safe proposal-citing routeable frontier. With zero coordinator receipts, resident death recovery closes once, replay is byte-identical, retention removes the lifecycle, and no retry appears. Core 663/1 ignored and swarm 7 pass. Direct packaged proposal Modeling state remains open because its Body-bound launch must be constructed in the Linux path namespace. Actual c006 remains braked and stopped.
|
||||
operational_state:
|
||||
local_worktree: imagination_fulfilled_before_receipt_packaged_accepted_proposal_modeling_next
|
||||
local_worktree: proposal_modeling_fulfilled_before_receipt_source_verified_runtime_retention_map_next
|
||||
operator_wireguard: restored
|
||||
starfire_persona_permit_firewall: persistent_exact_gamecult_ops_6ee08a4
|
||||
yggdrasil: canonical_small_public_crossing_body
|
||||
|
|
@ -70,7 +70,7 @@ current_status:
|
|||
yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
|
||||
resident_physiology: c006_exact_c693aaea_settled_braked_no_active_lease_no_attempt_three_old_processes_stopped
|
||||
unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, deployed supervisor/projector log retention, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, packaged admitted-model-direction and Imagination fulfilled-before-receipt settlement, and packaged co-resident resident lifecycle retention are accepted live. Proposal Modeling fulfilled-before-receipt plus runtime retention of terminal worker attempts remain open. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. Repository Body observation still performs two authenticated full-tree Git index/manifest passes. Execute-mode workers require a persistent process body. Mutable Starfire bind storage still needs the packaged randomized interruption/read-loop proof before recovered c005 authority may be trusted. One completed Discord consequence remains blocked by the absent Yggdrasil credential.
|
||||
next_action: Map and exercise proposal Modeling fulfilled-before-receipt through its stronger immutable proposal/request/context/patch/launch/result chain, then prove runtime retention of terminal worker attempts cannot revive or invalidate resident settlement. Keep actual c006 braked. Yggdrasil never builds.
|
||||
next_action: Map runtime retention ownership for terminal worker attempts and prove it cannot revive or invalidate resident settlement; then choose a Linux-native construction path for direct packaged proposal Modeling evidence without adding a test-only production API. Keep actual c006 braked. Yggdrasil never builds.
|
||||
|
||||
active_subgoals:
|
||||
- Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
|
||||
|
|
|
|||
Reference in a new issue