From b3c8a4da0ab99fbc847e477ca7d4092fa99bb837 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Mon, 22 Jun 2026 15:51:11 +0100 Subject: [PATCH] Record Bifrost generic bridge request --- notes/fresh-workspace-handoff.md | 16 +++++++++------- state/ledgers.msgpack | Bin 391170 -> 391848 bytes state/map.yaml | 2 +- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index f689a9f3..731ef54f 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -38,7 +38,7 @@ remembers doctrine; the branch remembers the blade. - Current Mom-ready status: the normal MVP pass reaches Persona -> coordinator -> detached runtime -> heartbeat sleep, and modeling workers now complete through the ChatGPT subscription transport. The first failure was a stack of violated observability/runtime invariants: worker prompts prepended the whole shared persistent-memory rite, Responses frame liveness was invisible until completion, and the runtime tried to persist hundreds of text deltas before completing the worker job. Role/reorient workers now get a compact Epiphany worker boundary instead of full persistent memory; runtime-spine records sampled raw Responses frame kinds with small previews; contiguous reasoning/text deltas compact before durable storage; and live proofs completed `2fe38dcd-d99e-4c73-9a58-afcc81f851c7`, `241e3851-e3ea-4877-a63b-0d2bbd96a7e2`, and `85149a26-6975-403f-ac93-092b717c5825` instead of timing out. The second failure was stale lifecycle authority: completed runtime jobs remained as unresolved `runtime_links`, replacement launches treated historical active links as current, and one bad validation path opened an orphan job before rejecting the state patch. Latest-link-wins is now the runtime-link invariant, terminal links project completed jobs, stale active history cannot veto replacement, launch validation happens before opening runtime jobs, and completed-but-unreviewable modeling findings stop for review instead of relaunching the same lane. The Eyes/source-gather fork is now landed: Research is a fixed Eyes lane with launch/result/accept/status/coordinator/protocol support, and `regather-needed` modeling findings route to `LaunchResearch` instead of relaunching blind Modeling. Research statePatch admission is Eyes-shaped only: observations, evidence, scratch, and optional investigationCheckpoint; no graph, planning, objective, or checkpoint authority. Mind admission now leaves typed runtime-spine proof: role/reorient acceptance persists `epiphany.mind.gateway_review` before state admission and `epiphany.mind.state_commit_receipt` after admission with the resulting durable revision. Launch contracts now split the broad receipt catalogue from effect-specific proof profiles for state admission, evidence promotion, repo action, verification, and continuity recovery. Research evidence promotion enforces Substrate Gate read/snapshot grant, Eyes evidence packet, and Mind review before state admission; Verification acceptance enforces Soul verdict and Mind review; Reorient acceptance enforces Continuity recovery receipt and Mind review. `epiphany-mvp-coordinator` now records a typed Substrate Gate grant plus Hands intent/review gate when the coordinator selects `continueImplementation`, including a structured `recordPassCommand` template; `epiphany-hands-action` records patch/command/commit receipts against that gate and refuses mismatched, unapproved, or out-of-scope consequences. `epiphany-mvp-coordinator-smoke` now proves the deterministic path: forced `continueImplementation`, gate emission, and `record-pass` receipts in the smoke runtime-spine store. Live run `local-20260612-133920` proved a receipt-only Verification `needs-evidence` finding can be accepted through `roleAccept` and advance to a Hands gate without granting Soul statePatch authority. Runtime-spine now detects and summarizes a complete post-verification Hands patch/command/commit receipt chain so the coordinator can route Soul after Hands. Verification launches now write that chain into the internal CultMesh Verse as `epiphany.cultmesh.work_loop_telemetry.v0` and render a Soul packet from it; Modeling launches read the latest packet, attach accepted Soul receipt ids, and render the Modeling packet from the same typed state. The telemetry now carries resolved receipt payload previews, stdout/stderr artifact previews, commit diff preview, source proof notes, and verification assertions. The corrected work loop is Hands -> Soul -> Modeling -> Hands: Soul verifies concrete consequence receipts and changed source, then Modeling updates the machine model from verified consequence before another implementation turn. - Fresh scar from the receipt proof dogfood: `epiphany-model-runtime run-worker --auto-tools` must preserve Soul's right to follow a real evidence trail, but distinguish it from stalled repetition using typed tool intent fingerprints. Repeated identical pending tool sets seal as `tool-loop-stalled`; exhausting the explicit hard ceiling still seals as `tool-round-limit`. A failed or completed-but-unreviewable role result is a real lane result and must stop for review; once reviewed through a typed `roleFailureReview` supersession receipt, Self may relaunch the lane instead of manually clearing stale state. Complete Hands receipt triplets (`hands-patch-*`, `hands-command-*`, `hands-commit-*`) are implementation evidence for coverage, so Soul does not have to separately cite the accepted Modeling evidence id when it has verified the Hands chain routed to it through the typed work-loop packet. Soul accepted the bounded proof for commit `ce20529e`, Modeling initially completed without a reviewable `statePatch`, and run `local-20260613-204521` proved the repair: the unreviewable result was superseded, Modeling relaunched with the role schema carried in the model request, Mind accepted the map patch, and only then did Self emit a new Hands gate. `epiphany-hands-action` must resolve commit receipts through `git rev-parse --verify` before storing them, because an almost-correct SHA poisoned Soul's `git show` proof and made the receipt chain untrustworthy. - The investment dossier readiness target is now explicit: `E:\Projects\gamecult-site\docs\gamecult_integrated_dossier.tex` expects Epiphany to be part of a Bifrost-first labor loop, not only a local Mom demo. The external proof bar is: Bifrost owns topics/work items/dispatch packets/receipts/credit/reward pressure; Epiphany executes bounded work; maintainers review artifacts; public/operator evidence records scope, consent, roles, model spend, review load, artifacts, accepted/rejected outcome, memory lessons, and case-study permission; and private worker/operator/agent context stays sealed. Diligence also asks for a live fresh-repo Epiphany demo, Bifrost work item/topic/agent transport/receipt/ledger demo, CultMesh status, VoidBot/Discord swarm demo, compute/output metrics, and security model for secrets/write permissions/public-private exports. -- Bifrost's identity-provider and bridge-ledger slice is now upstream truth on `GameCult/Bifrost` `main` at commit `675c475` after the bridge chain through `19222bd`: `POST /auth/bifrost/register` creates a Bifrost-owned identity without OAuth, signs in with the Bifrost cookie, leaves membership at `Authenticated`, and records `BifrostIdentity` / `NormalizedBifrostIdentity` on `UserAccount`. That native Bifrost identity is the default authenticating identity for GameCult services that accept Bifrost trust. GitHub and Heimdall sign-in paths now ensure new accounts also get a Bifrost identity; Heimdall still owns outside-provider OAuth, account association, token custody, grants, and capability/account claims. Hosted Persona/agent Discord, Reddit, and temporary `Other` future-public-surface bridge actions now require the supplied Bifrost identity to normalize through Bifrost's native identity law, resolve to a registered `UserAccount.NormalizedBifrostIdentity`, have a linked `HeimdallAccountId` on that same account, and carry a Heimdall-shaped reference before Bifrost authorizes the outside-account crossing; named surfaces still require surface-shaped references. Verified with `DOTNET_ROLL_FORWARD=Major dotnet test tests\Bifrost.Web.Tests\Bifrost.Web.Tests.csproj --filter "FullyQualifiedName~PlatformEndpointsTests"` after adding the future-surface gate: 36 passed. Post-push `git status --short --branch` in `E:\Projects\Bifrost` reported `main...origin/main` clean. +- Bifrost's identity-provider and bridge-ledger slice is now upstream truth on `GameCult/Bifrost` `main` at commit `f1f9171` after the bridge chain through `675c475`: `POST /auth/bifrost/register` creates a Bifrost-owned identity without OAuth, signs in with the Bifrost cookie, leaves membership at `Authenticated`, and records `BifrostIdentity` / `NormalizedBifrostIdentity` on `UserAccount`. That native Bifrost identity is the default authenticating identity for GameCult services that accept Bifrost trust. GitHub and Heimdall sign-in paths now ensure new accounts also get a Bifrost identity; Heimdall still owns outside-provider OAuth, account association, token custody, grants, and capability/account claims. Hosted Persona/agent Discord, Reddit, and temporary `Other` future-public-surface bridge actions now require the supplied Bifrost identity to normalize through Bifrost's native identity law, resolve to a registered `UserAccount.NormalizedBifrostIdentity`, have a linked `HeimdallAccountId` on that same account, and carry a Heimdall-shaped reference before Bifrost authorizes the outside-account crossing; named surfaces still require surface-shaped references. `tools/bifrost-bridge.mjs other-request` is now the generic receipt-only CLI mouth for future public worlds: it records `Other`/`Other` bridge actions through the hosted ledger, carries identity/Heimdall/Epiphany provenance, executes no provider transport, and fails closed without Bifrost bridge base URL/token unless an operator uses the explicit dry-run recovery hatch outside a dispatched turn. Verified with `DOTNET_ROLL_FORWARD=Major dotnet test tests\Bifrost.Web.Tests\Bifrost.Web.Tests.csproj --filter "FullyQualifiedName~BridgeCliTests|FullyQualifiedName~PlatformEndpointsTests"`: 66 passed. A direct CLI smoke of `other-request --allow-unreceipted-activity true --dry-run true` printed the expected identity/Heimdall provenance payload. Post-push `git status --short --branch` in `E:\Projects\Bifrost` reported `main...origin/main` clean. - Persona public mouth crossings now fail closed on missing or wrong-surface authority cargo before any Bifrost CLI invocation. `epiphany-persona-discord post` and `epiphany-persona-reddit post` require a Bifrost identity plus a Heimdall-backed `heimdall:discord:*` or `heimdall:reddit:*` capability/account reference, write blocked candidate artifacts with `missing-bifrost-identity`, `missing-heimdall-capability-ref`, or `wrong-heimdall-capability-surface`, and smokes prove the bridged path still carries identity, run/lane/agent, source, authority, and surface-shaped Heimdall provenance. Verified sequentially with `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-persona-discord -- smoke` and `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-persona-reddit -- smoke`. - This Codex operator's own roadmap/todo posture has been retuned for this scale target, with the Epiphany Imagination specialist as an optional sub-agent rail rather than the whole point. `notes/epiphany-investor-readiness-roadmap.md` now says: make the local Mom MVP a repeatable proof bundle; build the Bifrost-first external-work bridge; add compute/review/accepted-artifact accounting; keep fresh-repo operation repeatable without supervisor contamination; keep public/operator-safe exports sealed; and treat angel capital as fuel for capacity, not command authority. The Imagination specialist prompt was also updated so investor-scale Objective Drafts must name Bifrost provenance, bounded Epiphany proof, maintainer review, receipts/ledger evidence, compute/output metrics, public/private export safety, consent, and legal/security gates. - Local operator status runs now write typed CultMesh operator witnesses into `.epiphany-run/cultmesh/local-verse.ccmp`: `epiphany-operator-run` records the run intent before acting, `epiphany-operator-snapshot` distills the operator-safe MVP status artifact, and `epiphany-operator-run` records the completion receipt after success. The final `local-verse-context.json` is queried after those witnesses exist, so the operator read path sees latest run intent, snapshot, and receipt from the same local Verse vessel instead of treating separate JSON artifacts or side stores as truth. @@ -637,12 +637,14 @@ Bifrost identity. The old Bifrost dispatch bridge was transitional VoidBot-era queueing, not the blessed Epiphany launcher. Future receipts should carry Bifrost identity plus Heimdall-backed capability/account references, never raw bearer tokens. -Bifrost commit `445c279` now makes that partly executable in the hosted bridge -ledger: bridge actions store Bifrost identity, Heimdall capability/account -reference, Epiphany run id, lane id, and agent identity, and Persona/agent -Discord or Reddit actions are denied without the Bifrost identity plus -Heimdall-backed reference. The local bridge token remains an actuator credential, -not identity or provider authority. +Bifrost commits through `f1f9171` now make that partly executable in the hosted +bridge ledger and local CLI: bridge actions store Bifrost identity, Heimdall +capability/account reference, Epiphany run id, lane id, and agent identity; +Persona/agent Discord, Reddit, and temporary `Other` future-surface actions are +denied without Bifrost identity plus same-account Heimdall-backed reference; and +`tools/bifrost-bridge.mjs other-request` gives future public worlds a +receipt-only crossing before they earn a named actuator. The local bridge token +remains an actuator credential, not identity or provider authority. The next real move remains Codex starvation, not outward bridge work. The inventory and ledger now exist: diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index f53251403b3100c98c0d1c3be2e879519ad063be..7422e34522074fed233c97e073ae1373809981d3 100644 GIT binary patch delta 620 zcmZ9Jy^2&p5QV*?6PcN;iv|UT&YeHp5hoE>1VKTR(ZH;yyYAd_`*!#C&+Oi4K@nfT zVNx+NR1Cxy@L4o7S;5Te85hK$X}YOXU!7Agf9`xZ-T8RAxVSf*?v0;+JJE3Yt?s{?cq_f^Cn0*jS@4Jsu`xz2M3kVSxrcN$@C< zTr928EmSEckEKgOaa*CV86{^@dpU^r%21&*gg{h4+MEJ^J3Ap5%V_9JyMU7M!z z`6rdTdSQaIKK7szqytE81Ghe+Slbj~>mBAIAUu8Ya1iYQnjU1x0ip|_C^!*i%^Egr z!eiiU8%WvYW>)3f(kHX=xJ2JVoy+_1j5Dj~FAC09vNeBK(~JWS;B*S>+dsOy^<)B0 w1RiY*7Yydq;(r@CgE>zoCzRKN$Bqm6!G=ww*beR^HA-mxPdwbb)mEtfA4SLEF#rGn delta 53 zcmZ4SRlMng_y!3^ZWCiGQ?saJ46NVoZ&qe3WMo{}Je8?^Dib3RgJ@