Add repo objective draft work family

notes/epiphany-repo-swarm-mvp-contract.md

@@ -274,12 +274,15 @@ candidate-action semantics, Mind/Bifrost gates, and authority seals; and
 `--action-family repo-consensus-brief` writes a structured Imagination consensus
 brief under `.epiphany/consensus-briefs/<item>.toml`, preserving public
 discussion and candidate-action inputs as draft, non-authoritative consensus
-cargo that requires review plus Mind/Bifrost gates before consequence. Its
-receipt includes
+cargo that requires review plus Mind/Bifrost gates before consequence; and
+`--action-family repo-objective-draft` writes a structured Objective Draft
+under `.epiphany/objective-drafts/<item>.toml`, shaping consensus into a
+review-required, unadopted objective proposal with Mind, Self, and Bifrost gates
+before scheduling or consequence. Its receipt includes
 `epiphany.repo_work_plan_derivation.v0`, mode `append-worklog`,
 `planning-note`, `checklist-note`, `section-note`, `repo-status-section`, or
 `task-card`, `repo-manifest`, `repo-tool-capabilities`, or
-`repo-collaboration-topic`, or `repo-consensus-brief`, a
+`repo-collaboration-topic`, `repo-consensus-brief`, or `repo-objective-draft`, a
 `safeActionFamily`, and an authority seal forbidding
 publication, merge, service lifecycle mutation, cross-repo mutation, and private
 state exposure.
@@ -436,6 +439,19 @@ consensus state, public discussion refs, candidate action refs,
 adoption/action/publication/cross-body authority, and
 `privateStateExposed=false`.
 
+The next Imagination adoption-boundary smoke proved Objective Draft cargo:
+`.epiphany-smoke\repo-objective-draft-family-20260620-145012` ran init ->
+online -> accept -> `derive-plan --action-family repo-objective-draft
+--model-ref repo-objective-draft-family-smoke-imagination-v1 --model-authored`
+-> tick through run/adopt/execute/close on a fresh repo. The plan carried
+`safeActionFamily=repo.objective_draft`; Hands committed only
+`.epiphany/objective-drafts/repo-objective-draft-family.toml`; Soul passed with
+`pathScopeMatched=true` and `familyAssertions.status=passed`; the committed
+draft carried `schema_version = "epiphany.repo_objective_draft.v0"`,
+`status="review-required"`, `objective_adopted=false`, acceptance criteria,
+public/candidate refs, Mind/Self/Bifrost gates, denied adoption/scheduling/Hands
+action/publication/cross-body authority, and `privateStateExposed=false`.
+
 ### Landed Work Run Gate
 
 The sixth front door exists as native Rust:
@@ -1149,7 +1165,7 @@ temptation wearing clean robes.
 | Repo Body birth | `epiphany-repo init` exists and writes repo-local stores plus branch workbench intent. | Keep birth startup-only, review-gated, and branch-oriented. |
 | Local Verse online | `epiphany-swarm online` seeds repo-local CultMesh, standing-faculty SoA, topology, liveness, Eve, and tool sight. | Keep private Verse sealed while exposing operator-safe repo status. |
 | Persona/Bifrost intake | `epiphany-work accept` records pressure and candidate action refs without Hands authority. `epiphany-work persona-intake` now invokes the Persona bubble speech-audit path, records public discussion and candidate-action refs, then delegates to `accept`; wrapper mode `repo-persona-intake` exposes the operator mouth. | Deepen the intake-to-Imagination interpreter so richer model-authored action items can be proposed without granting Hands, publication, or durable-state authority at the mouth edge. |
-| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-collaboration-topic` / `repo.collaboration_topic`, and `repo-consensus-brief` / `repo.consensus_brief`. `plan` remains manual quarantine scaffolding. | Deepen model-authored planning and further useful repo-owned configuration classes without turning model text into arbitrary shell authority. |
+| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, and `repo-objective-draft` / `repo.objective_draft`. `plan` remains manual quarantine scaffolding. | Deepen model-authored planning and further useful repo-owned configuration classes without turning model text into arbitrary shell authority. |
 | Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan` and `repo-work-service-runbook` write Idunn lifecycle receipts/artifacts for the same queue-run command without launching it. | Keep any future queue-run service launch/install behind Idunn and explicit operator authority. |
 | Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. |
 | Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, and writes Soul, Modeling, and Mind receipts. | Deepen model-authored closure review beyond the first structured closure-review packet while preserving deterministic local closure for simple mechanical work. |
@@ -1433,6 +1449,9 @@ Required organs before MVP:
   `repo-consensus-brief` now proves draft Imagination consensus cargo from
   public discussion and candidate-action refs, still review-gated and
   non-authoritative before Mind/Bifrost gates.
+  `repo-objective-draft` now proves review-required Objective Draft cargo that
+  can shape consensus into a proposed objective without adopting it, scheduling
+  it, or granting Hands authority.
   Remaining work is later model-authored action classes that can change more
   useful repo-owned configuration without arbitrary shell authority.
 - Closure depth: `close` now writes a structured

notes/fresh-workspace-handoff.md

@@ -123,6 +123,7 @@ remembers doctrine; the branch remembers the blade.
 - 2026-06-20: `repo-tool-capabilities` is now live as repo-owned tool capability configuration cargo. `epiphany-work derive-plan --action-family repo-tool-capabilities` writes `.epiphany/repo-tool-capabilities.toml` with safe family `repo.tool_capabilities`, local CultMesh/Odin discovery flags, daemon tool invocation intent/receipt contracts, expected repo-swarm capability ids, host-daemon execution ownership, Idunn lifecycle ownership, and authority seals for no shell/deploy/service/private-rummaging authority. Soul closure assertions inspect schema, family, summary, tool directory, contracts, expected capability ids, host receipt requirement, authority seals, and private-state seal. Focused smoke `.epiphany-smoke\repo-tool-capabilities-family-20260620-142430` ran init -> online -> accept -> repo-tool-capabilities derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/repo-tool-capabilities.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `hostDaemonOwnsExecution=true`, `idunnOwnsLifecycle=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are richer model-authored planning depth beyond deterministic safe-family lowering, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - 2026-06-20: `repo-collaboration-topic` is now live as public collaboration planning cargo. `epiphany-work derive-plan --action-family repo-collaboration-topic` writes `.epiphany/collaboration-topics/<item>.toml` with safe family `repo.collaboration_topic`, public Persona collaboration room, Eve surface, Imagination consensus route, non-authoritative candidate action semantics, Mind/Bifrost gates, and seals against adoption/action/publication/cross-body/private-rummaging authority. Soul closure assertions inspect schema, family, summary, topic surface, Imagination route, authority seals, and private-state seal. Focused smoke `.epiphany-smoke\repo-collaboration-topic-family-20260620-143342` ran init -> online -> accept -> repo-collaboration-topic derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/collaboration-topics/repo-collaboration-topic-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `candidateActionsNonAuthoritative=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are richer model-authored planning depth beyond deterministic safe-family lowering, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - 2026-06-20: `repo-consensus-brief` is now live as draft Imagination consensus cargo. `epiphany-work derive-plan --action-family repo-consensus-brief` writes `.epiphany/consensus-briefs/<item>.toml` with safe family `repo.consensus_brief`, draft consensus state, public discussion refs, candidate action refs, non-authoritative candidate action semantics, review requirement, Mind/Bifrost gates, and seals against objective adoption, Hands action, publication, cross-body mutation, and private Verse rummaging. Soul closure assertions inspect schema, family, summary, draft state, Imagination route, public/candidate inputs, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-consensus-brief-family-20260620-144212` ran init -> online -> accept -> repo-consensus-brief derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/consensus-briefs/repo-consensus-brief-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `candidateActionsNonAuthoritative=true`, `mindAdoptionRequired=true`, `bifrostPublicationRequired=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are richer model-authored planning depth beyond deterministic safe-family lowering, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
+- 2026-06-20: `repo-objective-draft` is now live as review-required Objective Draft cargo. `epiphany-work derive-plan --action-family repo-objective-draft` writes `.epiphany/objective-drafts/<item>.toml` with safe family `repo.objective_draft`, draft status `review-required`, `objective_adopted=false`, objective statement, acceptance criteria, public/candidate refs, and Mind/Self/Bifrost gates before adoption, scheduling, or publication. Soul closure assertions inspect schema, family, summary, draft review state, acceptance criteria, inputs, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-objective-draft-family-20260620-145012` ran init -> online -> accept -> repo-objective-draft derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/objective-drafts/repo-objective-draft-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `draftReviewRequired=true`, `objectiveAdopted=false`, `mindAdoptionRequired=true`, `selfSchedulingAuthorized=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are richer model-authored planning depth beyond deterministic safe-family lowering, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - `service-execution-runbook` makes that next cut repeatable: it generates the exact elevated wrapper command sequence without mutating the service manager, continues after per-step failure to preserve more receipts, runs `service-execution-audit` in `finally`, exits nonzero if any step failed, and seals a typed runbook lifecycle receipt. Run the generated artifact only with explicit operator authority.
 - `service-execution-audit` is the non-mutating acceptance proof after the elevated rite: it reports `complete` only when typed lifecycle receipts prove the runbook witness plus expected elevated chain, and otherwise reports the missing/failed sealed checks.
 - `service-tick` is the non-elevated scheduler pulse proof: it writes the latest daemon scheduler receipt through durable policy ownership and local wrapper receipts.