From b2d3f85c2fe71f85d255f89dc65d19d57bcd29a2 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Mon, 10 Aug 2026 17:00:08 +0100 Subject: [PATCH] Prove proposal Modeling receipt-free settlement --- epiphany-core/src/runtime_spine.rs | 147 ++++++++++++++++++++++ notes/epiphany-current-algorithmic-map.md | 10 ++ notes/fresh-workspace-handoff.md | 21 ++++ state/ledgers.msgpack | Bin 609444 -> 609931 bytes state/map.yaml | 6 +- 5 files changed, 181 insertions(+), 3 deletions(-) diff --git a/epiphany-core/src/runtime_spine.rs b/epiphany-core/src/runtime_spine.rs index 3e99db05..7d8c6859 100644 --- a/epiphany-core/src/runtime_spine.rs +++ b/epiphany-core/src/runtime_spine.rs @@ -13723,6 +13723,153 @@ pub(crate) mod tests { Ok(()) } + #[test] + fn typed_proposal_fulfillment_settles_receipt_free_resident_authority_once() -> Result<()> { + let root = tempfile::tempdir()?; + let (runtime_store, result, _) = + proposal_admission_fixture(root.path(), "resident-fulfillment")?; + let request_id = result + .proposal_modeling_request_id + .clone() + .expect("proposal request echo"); + put_runtime_role_worker_result(&runtime_store, &result)?; + assert!(coordinator_run_receipts(&runtime_store)?.is_empty()); + + let resident_store = root.path().join("resident.cc"); + crate::enqueue_resident_self_pressure( + &resident_store, + &crate::ResidentSelfPressure { + schema_version: crate::RESIDENT_SELF_PRESSURE_SCHEMA_VERSION.into(), + pressure_id: "proposal-modeling-resident-pressure".into(), + kind: "repo-frontier-proposal-modeling".into(), + provenance_ref: format!( + "cultcache://repo-frontier-proposal-modeling/{request_id}" + ), + objective: "Settle the exact authenticated proposal Modeling result.".into(), + created_at_millis: 1, + status: "pending".into(), + consumed_by_grant_id: None, + private_state_exposed: false, + }, + )?; + let grant = crate::heartbeat_issue_resident_self_grant( + &resident_store, + "proposal-modeling-heartbeat", + "proposal-modeling-action", + 2, + )? + .expect("proposal Modeling grant"); + let coordinator = root.path().join("epiphany-mvp-coordinator"); + std::fs::write(&coordinator, b"witnessed executable")?; + let policy = crate::ResidentSelfPolicy { + workspace: root.path().to_path_buf(), + coordinator_bin: coordinator.clone(), + model_runtime_bin: root.path().join("epiphany-model-runtime"), + tool_adapter_bin: root.path().join("epiphany-tool-mcp-runtime"), + runtime_store: runtime_store.clone(), + local_verse_store: root.path().join("local-verse.cc"), + agent_memory_store: root.path().join("mind.cc"), + artifact_root: root.path().join("artifacts"), + codex_home: root.path().join("codex-home"), + mcp_config: root.path().join("mcp.toml"), + model_provider: "local".into(), + max_steps: 2, + turn_timeout_seconds: 60, + cooldown_seconds: 10, + idle_sleep_seconds: 5, + failure_backoff_seconds: 20, + release_commit: "proposal-modeling-test-release".into(), + release_manifest_digest: "sha256:proposal-modeling-test-manifest".into(), + release_store: root.path().join("release.cc"), + release_runtime_id: "deployment-runtime".into(), + release_id: "proposal-modeling-test-release".into(), + release_witness_sha256: "sha256:proposal-modeling-test-witness".into(), + }; + let prepared = crate::prepare_resident_self_launch(&resident_store, &policy, 3)? + .expect("proposal Modeling preparation"); + let process = crate::LaunchedCoordinator { + process_id: u32::MAX - 13, + process_creation_token: 79, + process_executable_path: coordinator, + }; + crate::claim_resident_self_preparation_as_child( + &resident_store, + &prepared.preparation_id, + &process, + 4, + )?; + let lease = crate::acknowledge_resident_self_launch( + &resident_store, + &prepared.preparation_id, + &process, + 5, + )?; + open_coordinator_run( + &runtime_store, + &coordinator_run_session_id(&lease.turn_id, Some(&lease.launch_digest))?, + &lease.turn_id, + Some(&lease.launch_digest), + &format!("Resident coordinator launch {}.", lease.objective_digest), + "1970-01-01T00:00:00.005Z", + )?; + assert_eq!( + crate::verify_resident_self_grant_fulfillment( + &resident_store, + &runtime_store, + &grant.grant_id, + )?, + crate::ResidentSelfGrantFulfillment::Fulfilled + ); + assert_eq!( + crate::settle_resident_self_receipt_free_dead_coordinator( + &resident_store, + &runtime_store, + &lease, + crate::ChildObservation::Missing, + false, + false, + false, + 6, + policy.cooldown_seconds, + )?, + crate::ResidentSelfOutcome::Completed + ); + assert!(crate::load_resident_self_state(&resident_store)?.active_turn.is_none()); + let settled = std::fs::read(&resident_store)?; + assert!( + crate::settle_resident_self_receipt_free_dead_coordinator( + &resident_store, + &runtime_store, + &lease, + crate::ChildObservation::Missing, + false, + false, + false, + 7, + policy.cooldown_seconds, + ) + .is_err() + ); + assert_eq!(std::fs::read(&resident_store)?, settled); + for ack in crate::pending_resident_self_acks(&resident_store)? { + crate::heartbeat_consume_resident_self_ack(&resident_store, &ack.ack_id, 8)?; + } + let head = crate::retain_resident_self_lifecycles(&resident_store, 0, 9)? + .expect("closed proposal Modeling lifecycle"); + assert_eq!(head.retired_lifecycle_count, 1); + assert!(crate::pending_resident_self_grant(&resident_store)?.is_none()); + assert!( + crate::heartbeat_issue_resident_self_grant( + &resident_store, + "proposal-modeling-after-retention", + "proposal-modeling-after-retention-action", + 10, + )? + .is_none() + ); + Ok(()) + } + fn claim_repair_admission_fixture( root: &Path, suffix: &str, diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index 3055c2a3..ab6855af 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -3308,3 +3308,13 @@ reopening authority. This proves the candidate companion remains producer-owned: the first fixture attempt without it failed closed before resident settlement. Proposal Modeling remains separate because its fulfillment validator also owns the immutable proposal payload, Modeling context, and Evolution patch shape. + +The proposal Modeling variant now crosses the full resident boundary in source +verification by reusing the runtime admission fixture rather than copying its +policy. Runtime remains owner of proposal/request/payload, Body-bound launch +context and hash, successful Modeling result, Evolution patch, and the single +safe routeable frontier. Resident Self sees only authenticated fulfillment and +owns exact zero-receipt death settlement, replay refusal, lifecycle retirement, +and non-resurrection. Core 663/1 ignored and swarm 7 pass. Direct packaged proof +still requires Linux-native construction because the worker launch's Body basis +cannot truthfully be minted under a Windows path and rebound later. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 03434bab..05e76d4d 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -2601,3 +2601,24 @@ Next: proposal Modeling is the remaining fulfilled-before-receipt variant. Its immutable proposal/request/context/patch/launch/result chain is stronger and must be mapped before constructing live state. Runtime terminal-attempt retention follows. Actual c006 remains braked and stopped. + +## Proposal Modeling fulfilled-before-receipt source gate — 2026-08-10 + +The real runtime proposal-admission fixture now crosses the resident boundary. +It preserves the full immutable chain: user proposal and payload, selected +request, runtime/thread/Body-bound Modeling context, exact launch binding and +launch-document hash, successful Modeling result, Evolution patch, and one +safe proposal-citing routeable frontier. No parallel fulfillment schema exists. + +With zero coordinator receipts, resident Self verifies that runtime-owned chain, +records exact coordinator death recovery, closes the original grant once, and +refuses replay with byte-identical resident state. Heartbeat consumes the ack; +retention removes the lifecycle; and no later grant can appear. Full core tests +pass 663 with one intentional ignore and all seven swarm tests pass. + +Direct packaged proposal evidence remains open. Unlike the two consideration +lanes, its immutable worker launch includes authenticated repository Body basis, +so a faithful fixture must construct it inside the Linux path namespace after +packaged Body binding. Do not add a test-only production writer merely to make +that receipt convenient. Next map terminal-worker-attempt retention and then +choose the smallest Linux-native construction path. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 83ff5a693c6a0f7640103811ba0c4579187ff368..3ad25d8912efbec8d32a515cfca262b31a65413f 100644 GIT binary patch delta 389 zcmYL^KTE?<6va*bQ!|Lr!9fu&NL@^tR3Vi*h>C-if`gOb@S5B-4`1F(-ydx!2L}h& zmf+y#2M`>jU%=1htDqfzT<+y?&bjZe^_RE$$A+^OwZpI-wr;)`+-~-{;|v^U{4}XN zPb!XOHWw{RmSxL|rD|FInpE8NPHjBh5BDQKJoKC4b#vxbhTGMx+Vo0_LMXzZD-vXs z_shErclS}EQK&#?2&rKVq~V(82*sbABso=z3Jxh9Y9p}?G|!DDJvLVb5(fsA4hk}2 zf+QZCie%*XgyD(xmPnEy7F^>{1F delta 71 zcmeC4tGZ;S>IN}JUQ;VmGb=-*sACMA-i@1;84DR1CpS-JYM;u)2*e