Seal bounded worker runtime failures

epiphany-openai-runtime/src/bin/epiphany-openai-runtime.rs

@@ -155,7 +155,9 @@ async fn main() -> Result<()> {
                 )
                 .await
                 {
-                    Ok(result) => result?,
+                    Ok(result) => {
+                        seal_worker_runtime_result(&timeout_store, &timeout_job_id, result)?
+                    }
                     Err(_) => {
                         let summary = format!("Worker runtime timed out after {seconds} seconds.");
                         let result = fail_worker_and_openai_jobs(
@@ -176,14 +178,11 @@ async fn main() -> Result<()> {
                     }
                 }
             } else {
-                match run_worker_options(options).await {
-                    Ok(summary) => summary,
-                    Err(err) => fail_worker_for_runtime_error(
-                        &timeout_store,
-                        &timeout_job_id,
-                        err.to_string(),
-                    )?,
-                }
+                seal_worker_runtime_result(
+                    &timeout_store,
+                    &timeout_job_id,
+                    run_worker_options(options).await,
+                )?
             };
             timeout_guard.store(true, Ordering::SeqCst);
             print_json(&summary)?;
@@ -614,6 +613,17 @@ fn fail_worker_for_runtime_error(
     }))
 }
 
+fn seal_worker_runtime_result(
+    store_path: &Path,
+    job_id: &str,
+    result: Result<serde_json::Value>,
+) -> Result<serde_json::Value> {
+    match result {
+        Ok(summary) => Ok(summary),
+        Err(error) => fail_worker_for_runtime_error(store_path, job_id, error.to_string()),
+    }
+}
+
 fn fail_worker_job_with_retry(
     store_path: &Path,
     job_id: &str,
@@ -1047,7 +1057,7 @@ mod tests {
     }
 
     #[test]
-    fn runtime_error_seals_outer_worker_job() -> Result<()> {
+    fn bounded_runtime_error_seals_outer_worker_job() -> Result<()> {
         let temp = tempdir()?;
         let store = temp.path().join("runtime.msgpack");
         open_runtime_spine_heartbeat_job(
@@ -1108,10 +1118,10 @@ mod tests {
             },
         )?;
 
-        let status = fail_worker_for_runtime_error(
+        let status = seal_worker_runtime_result(
             &store,
             "worker-job-runtime-error",
-            "tool adapter exploded".to_string(),
+            Err(anyhow!("tool adapter exploded")),
         )?;
 
         assert_eq!(status["status"], "runtime-error");

notes/fresh-workspace-handoff.md

@@ -1,6 +1,6 @@
 # Fresh Workspace Handoff
 
-## Current authority — 2026-08-07 v27 contract boundary
+## Current authority — 2026-08-07 v28 Continuity fault
 
 The active branch is `codex/epiphany-shakedown-live`. Exact pushed commit
 `17d4ae47ca6faa1613707010d19261a75a6b74ee` is authenticated and published as
@@ -25,28 +25,44 @@ only `epiphany-mvp-coordinator.rs`. It created an active frontier recommending
 Hands. Self therefore emitted ready route
 `repo-frontier-route-2a6f1480b9fa431e26dee6db5290b3b234d7bbb541947737d08dcb2e9f0cb48e`.
 
-This is not the required adopted-plan proof. Generic user proposals may
-legitimately recommend Hands; only autonomous Imagination-origin proposals are
-structurally restricted to an unadopted Imagination frontier. v27 therefore
-proved generic proposal-to-Hands routing and the no-plan Hands gate, not native
-Modeling-to-Imagination-to-Mind or the repaired adopted-plan identity. Preserve
-v27 as evidence. Do not execute its Hands command as if it proved the requested
-chain.
+v27 remains the generic proposal contract boundary. Fresh v28 lives at
+`F:\Projects\.epiphany-runtime\shakedown\live-20260807-v28`. It cold-started
+through the packaged repository-body surface, with physically separate local
+Verse and release stores. Resident Self started only after receiving the raw
+Bifrost trust-anchor format expected by feedback ingress.
+
+Proposal `shakedown-v28-live-model-admission-r1` launched Modeling job
+`8b35ea3f-55dc-4dd2-8c4a-420b5da374e3`; Mind accepted its first result as
+`accept-modeling-result-worker-8b35ea3f-55dc-4dd2-8c4a-420b5da374e3`. Self
+selected canonical Imagination and launched job
+`b34d21de-6788-4935-8910-75275c257444`, PID `11132`.
+
+PID `11132` exited without a typed result. Repeated coordinator passes continue
+to project `imaginationRunning`. The source cause is in
+`epiphany-openai-runtime/src/bin/epiphany-openai-runtime.rs`: with
+`--max-runtime-seconds` present, `Ok(result) => result?` propagated ordinary
+worker errors out of the process without calling `fail_worker_for_runtime_error`.
+The unbounded branch already sealed the same error correctly.
+
+The local cut routes bounded and unbounded completion through
+`seal_worker_runtime_result`. Success remains success; every ordinary error
+writes the typed failed outer worker and inner OpenAI job before exit. All six
+model-runtime tests and all fourteen coordinator tests pass. v28 is sealed
+failure evidence; do not repair its runtime state manually.
 
 ## Next action
 
-Cold-start a clean generation using the autonomous Imagination-origin proposal
-crossing rather than generic intake. Without overrides, prove:
+Commit and push the terminalization cut, then package and publish that exact
+commit. Cold-start a clean generation. Without overrides, prove:
 
-1. Self derives proposal-bound Modeling and the admission contract requires a
-   canonical unadopted Imagination frontier.
+1. Self derives proposal-bound Modeling and canonical Imagination.
 2. Self selects and launches canonical Imagination.
 3. Dedicated Mind adopts the typed candidate.
 4. Hands intent exactly echoes route id, candidate digest, and plan action.
 5. RepoFrontierHandsAuthority binds route, model, plan, intent, review, grant,
    and sorted scope.
-6. Execute the bounded Continuity crash/restart/closure proof and capture Soul
-   evidence rather than treating the gate as completion.
+6. Deliberately fail one bounded worker and prove typed terminal failure,
+   restart, and Soul-verifiable closure rather than a permanent running state.
 
 Do not add a global rule forcing generic user proposals through Imagination;
 that would destroy their valid direct Hands/Eyes semantics to repair a test

state/map.yaml

@@ -34,9 +34,9 @@ invariants:
   - Evidence and git retain history; this map retains only state that changes future decisions.
 
 current_status:
-  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact pushed 17d4ae47 is authenticated and published as sha256-0afab25c with witness sha256-2e9e8a53. Clean v27 proved local-Verse fail-closure, exact release publication, native proposal-bound Modeling launch, and first-valid Mind acceptance without routing overrides. The accepted generic user proposal legitimately produced a direct Hands frontier, so Self emitted a ready no-plan Hands gate. That proves generic proposal-to-Hands routing but does not prove the repaired adopted-plan binding. v27 is preserved as a test-design boundary: only the autonomous Imagination-origin proposal path structurally requires Modeling to emit an unadopted Imagination frontier, followed by canonical Imagination and dedicated Mind adoption. The next clean generation must use that owner-aligned path. Persona consequence, Continuity execution, retention, long-duration pacing, and Linux/Yggdrasil cognition remain open.
+  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact pushed 17d4ae47 is authenticated and published as sha256-0afab25c with witness sha256-2e9e8a53. v27 proved generic proposal-to-Hands routing but not the repaired adopted-plan binding. Clean v28 then proved resident release-store separation, raw Bifrost trust-anchor startup, live proposal-bound Modeling admission, canonical Imagination selection, and native Imagination launch without overrides. Imagination PID 11132 exited, but the runtime remained permanently imaginationRunning with no result or failure. The cause is exact: the bounded run-worker branch propagated ordinary runtime errors through `Ok(result) => result?`, bypassing the failure commit used by the unbounded branch. The local cut gives both branches one terminalization primitive; all 6 model-runtime tests and all 14 coordinator tests pass. v28 is sealed Continuity failure evidence until the fixed commit is packaged and replayed. Persona consequence, Continuity recovery/closure, retention, long-duration pacing, and Linux/Yggdrasil cognition remain open.
   operational_state:
-    local_worktree: clean_exact_17d4ae47
+    local_worktree: bounded_worker_runtime_terminalization_repair
     operator_wireguard: restored
     yggdrasil: canonical_small_public_crossing_body
     starfire: temporary_epiphany_cognition_body
@@ -52,8 +52,8 @@ current_status:
     bifrost_feedback_crossing: authenticated_transport_only
     yggdrasil_epiphany_services: absent
     resident_physiology: heartbeat_and_self_running
-  unresolved_authority: Exact 17d4ae47 contains the test-proven adopted-plan Hands binding repair, but v27 exercised the generic user-proposal contract and therefore created a direct no-plan Hands route. The live package has not yet proved route-to-adopted-plan-to-intent-to-review-to-grant identity. A clean generation must enter through the autonomous Imagination-origin proposal crossing, whose admission contract makes the required Imagination and Mind stages structurally unavoidable, then execute the bounded Continuity proof. Persona consequence, retention, long-duration behavior, and Linux/Yggdrasil cognition remain open.
-  next_action: Preserve v27 as generic proposal-to-Hands evidence. Cold-start a clean generation through the autonomous Imagination-origin proposal path and prove native proposal Modeling, canonical Imagination, dedicated Mind adoption, and exact adopted-plan Hands authority without overrides. Then execute the Continuity crash/restart/closure plan and capture Soul evidence.
+  unresolved_authority: Exact 17d4ae47 still has not proved adopted-plan Hands identity live. v28 reached native Imagination but exposed a stronger prerequisite: bounded worker errors could exit without terminalizing their runtime jobs, leaving Self in an endless wait. The owner-aligned repair is test-proven but unpublished. Persona consequence, restart/closure, retention, long-duration behavior, and Linux/Yggdrasil cognition remain open.
+  next_action: Commit, push, package, and publish the bounded worker terminalization repair. Preserve v28 as failure evidence. Cold-start a clean generation, replay Modeling-to-Imagination-to-Mind without overrides, prove exact adopted-plan Hands authority, then kill one bounded worker path deliberately and prove typed failure, restart, and Soul-verifiable closure.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
@@ -70,7 +70,7 @@ organ_readiness:
   hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind reviewed path ceilings to exact changed-path subsets.
   soul: proven for the current bounded consequence; the exact 2dd25341 release launched Soul, produced an accepted pass verdict grounded in focused and full-library receipts, and routed verdict incorporation.
   mind: partial; RepoModel admission, thread-state admission, gateway review, state commit, first-valid verdict incorporation, and dedicated frontier-plan adoption are live; broader stale or overstated frontier correction remains open.
-  continuity: partial; heartbeat and resident Self survive sequential cycles, while restart, crash, reboot, closure, and retention remain open.
+  continuity: partial; heartbeat and resident Self survive sequential cycles. v28 proved an ordinary bounded worker error could leave a runtime job falsely running after process death; the owner-local terminalization repair passes focused tests but still needs packaged crash/restart/closure proof.
   nervous_system: partial; detached scheduling, runtime jobs, typed feedback, ordinary Windows coverage-store identity, and operator projection work; long-duration pressure and resource plateau remain open. Exact release packaging took about seventeen minutes and observed more than 3 GiB compiler working set, so Yggdrasil is not a release forge at its current 1.9 GiB RAM.
 
 forbidden_actions: