Bound Imagination proposal fanout

epiphany-core/src/admitted_model_direction_consideration.rs

@@ -9,6 +9,7 @@ pub const REQUEST_CONTRACT: &str = "epiphany.admitted_model_direction_considerat
 pub const RESULT_SCHEMA: &str =
     "epiphany.imagination.admitted_model_direction_consideration_result.v0";
 pub const RESULT_CONTRACT: &str = "epiphany.admitted_model_direction_consideration_result.v0";
+pub const MAX_OPTION_DRAFTS: usize = 3;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
@@ -252,6 +253,9 @@ pub fn validate_result(
     {
         bail!("model direction suggestion requires at least one option");
     }
+    if result.option_drafts.len() > MAX_OPTION_DRAFTS {
+        bail!("model direction result exceeds bounded option fan-out");
+    }
     Ok(())
 }
 
@@ -314,6 +318,20 @@ mod tests {
         }
     }
 
+    #[test]
+    fn result_refuses_unbounded_autonomous_proposal_fanout() {
+        let request = request();
+        let mut result = result(&request);
+        result.disposition = AdmittedModelDirectionDisposition::Suggest;
+        result.option_drafts = (0..=MAX_OPTION_DRAFTS)
+            .map(|ordinal| crate::ImaginationOptionDraft {
+                title: format!("Option {ordinal}"),
+                summary: "Bounded option.".into(),
+            })
+            .collect();
+        assert!(validate_result(&request, &result).is_err());
+    }
+
     #[test]
     fn result_requires_exact_request_model_receipt_and_proposal_only_terminal_authority() {
         let request = request();

epiphany-core/src/agent_launch.rs

@@ -1083,7 +1083,7 @@ pub fn epiphany_admitted_model_direction_consideration_output_schema() -> serde_
                 "properties": {
                     "disposition": {"type": "string", "enum": ["suggest", "hold", "no_fit"]},
                     "summary": {"type": "string", "minLength": 1},
-                    "option_drafts": {"type": "array", "items": {"type": "object", "required": ["title", "summary"],
+                    "option_drafts": {"type": "array", "maxItems": crate::admitted_model_direction_consideration::MAX_OPTION_DRAFTS, "items": {"type": "object", "required": ["title", "summary"],
                         "properties": {"title": {"type": "string", "minLength": 1}, "summary": {"type": "string", "minLength": 1}},
                         "additionalProperties": false}},
                     "uncertainties": {"type": "array", "items": {"type": "string"}},
@@ -1690,6 +1690,16 @@ fn epiphany_active_graph_node_ids(state: Option<&EpiphanyThreadState>) -> Vec<St
 mod tests {
     use super::*;
 
+    #[test]
+    fn admitted_direction_schema_bounds_autonomous_proposal_fanout() {
+        let schema = epiphany_admitted_model_direction_consideration_output_schema();
+        assert_eq!(
+            schema["properties"]["admittedModelDirectionConsiderationResult"]["properties"]
+                ["option_drafts"]["maxItems"],
+            crate::admitted_model_direction_consideration::MAX_OPTION_DRAFTS
+        );
+    }
+
     #[test]
     fn live_worker_contracts_contain_no_codex_route_vocabulary() {
         let source = include_str!("agent_launch.rs");

notes/epiphany-current-algorithmic-map.md

@@ -1278,6 +1278,15 @@ creates an inert frontier proposal and its Modeling selection. The generic
 proposal mouth rejects Imagination provenance so it cannot substitute for this
 causal crossing.
 
+One admitted Imagination result may expose at most three `option_drafts`.
+`MAX_OPTION_DRAFTS` is the single owner of that fan-out bound: the declared
+worker output schema rejects a larger array before admission, and
+`validate_result` rejects any substituted or legacy result that exceeds it.
+Promotion remains one preserved-authority CAS per option and resident ingestion
+still exposes only the current unbound selection. Scheduler ordering is not a
+backpressure substitute; the producer itself is bounded so one model turn
+cannot mint an unbounded durable proposal/selection/pressure queue.
+
 Proposal Modeling is structurally bounded: its sole frontier upsert must
 recommend `Imagination` and carry no adopted plan. Proposal Evolution is
 insert-only. Ordinary Modeling has one separate standing transition: the typed

notes/fresh-workspace-handoff.md

@@ -3651,3 +3651,33 @@ Next map Native Imagination ingress, restart resident serve onto exact fb873927
 to prove its Body preflight live, then exercise one typed Imagination proposal
 through detached worker, typed candidate, resident fulfillment, and continuation
 without Hands or public consequence. Reengage the brake at the boundary.
+
+## c007d Native Imagination fan-out pressure — 2026-08-11
+
+c007c stopped Heartbeat and resident cleanly with exit zero. Exact fb873927 was
+published into the release Verse, the mounted workspace advanced to current
+`0a3ca20d`, and c007d restarted both owners from authenticated fb873927 with
+bounded Docker `local` logs. Resident production serve passed the new `git`
+Body preflight; both owners were healthy and braked before ingress.
+
+Proposal `proposal-c007-soul-verification-audit-20260811` selected request
+`repo-frontier-proposal-modeling-79838d351edef9f0346ec225377ca5609188b849a478038c0bc85c8b154a481b`.
+It completed one detached Modeling fulfillment. Native Imagination's
+admitted-direction lane then produced several authenticated option drafts;
+runtime promotion created inert autonomous proposals and exact Modeling
+selections one at a time. The first autonomous request
+`repo-frontier-proposal-modeling-460467352543b508aa784f3e110474220be3a037d9c8d066b232cf06bdaf9646`
+also fulfilled once. The brake settled at resident revision 294 with no active
+turn; request
+`repo-frontier-proposal-modeling-ef8245a7349c5cf78e3c2fbd6d4b570912aac522edb93dc695dd257ab448efe1`
+remains pending and untouched. No Hands, Persona, release, deployment, or
+external consequence authority was granted.
+
+The live cascade exposed an ownership gap: admitted Imagination
+`option_drafts` had no structural maximum in either declared output schema or
+runtime validation. Scheduler FIFO and one-at-a-time promotion cannot bound
+the durable queue a single worker result may mint. The active source cut adds
+shared `MAX_OPTION_DRAFTS = 3`, emits that as schema `maxItems`, and rejects
+larger admitted results in Rust. Both focused tests pass. Commit/push and exact
+package/warm replay remain next; c007d stays braked until the bounded body is
+authenticated. Yggdrasil never builds.

state/map.yaml

@@ -36,7 +36,7 @@ invariants:
 
 current_status:
   summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, exact 16c4b19f coordinator receipt and Heartbeat artifact retention, exact cce2b8ac narrow model-generation retention, exact eea15e82 model-turn JSON ingress, exact b1e8c89a semantic unattempted-generation retention, exact 6bc3ec3f semantic physical-epoch retirement, and exact 44230a05 Persona conversation retention are proven. Gamecult-ops 059821f owns Yggdrasil stream retention and exact 6ee08a4 owns stable Starfire Persona-permit firewall ingress. Exact 16c4b19f genuine idle and exact a987d2f7 active cognition completed 900-pulse bounded plateaus. Runtime-owned typed fulfillment is accepted live under exact 6dd9b132. Yggdrasil is the small public crossing body, never the release forge.
-  latest_phase: Exact fb873927 release sha256-b72fbae12b8d02fa00aee50bf41ee195a67d9564addcab5294dfc4a68fe816a2 witness sha256-38aadfd9dc94201fa1892658a6e91badd721058897b9f9177bb359125a99c2e6 passed 24-binary inspection with no warnings. Its cold content-addressed graph took 13m40s and about 4.4 GiB on Starfire; identical warm replay took 8.51s wall/0.83s Cargo. Generic root closure refused exit1 with byte-identical runtime hash; strict packaged repair restored epiphany-main Active and deleted only its exact completion event. c007 attempt 61 then proved the restored root by opening a coordinator job, launching detached Modeling, holding awaiting-fulfillment, accepting exact typed fulfillment once, and completing its continuation review. A subsequent admitted-model-direction consideration also fulfilled and acknowledged exactly once before the canonical brake settled. Final operator-safe action is awaitFrontierProposal targeting Imagination because Mind accepted the current model and no Hands frontier exists. c007c is braked at revision 286 with no active turn. Receipts are .epiphany-run/c007-root-repair-fb873927. Yggdrasil never builds.
+  latest_phase: Exact fb873927 root recovery and resumed Modeling/Imagination proof remains accepted. c007c stopped both owners exit0; authenticated fb873927 was published, the mounted workspace advanced to current 0a3ca20d, and c007d restarted exact fb873927 under bounded local logs. Resident production serve passed its git Body preflight and both owners remained braked/healthy. A fresh Soul-frontier user proposal then completed exact typed Modeling fulfillment. Native Imagination's admitted-direction result produced several autonomous options, which were promoted through authenticated proposal bindings and exposed one at a time. The first autonomous proposal Modeling fulfillment completed once before the brake settled at resident revision 294; another selection repo-frontier-proposal-modeling-ef8245a7349c5cf78e3c2fbd6d4b570912aac522edb93dc695dd257ab448efe1 remains pending. Source inspection found the admitted Imagination option_drafts contract had no structural fan-out bound. The active cut adds one shared maximum of three to model output schema and runtime validation; two focused tests pass. This cut is not yet committed or packaged. Yggdrasil never builds.
   operational_state:
     local_worktree: exact_acd91e6e_imagination_runtime_owned_causality_live_accepted
     operator_wireguard: restored
@@ -70,7 +70,7 @@ current_status:
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: c006_exact_c9a2a979_stopped_cleanly_braked_revision_34_after_36700_pulse_endurance
   unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, genuine-idle and active resource plateaus, exact-grant terminality, restart-persistent cooldown refusal, schedule/action issuance cardinality, runtime-owned typed fulfillment, all three packaged fulfilled-before-receipt lanes, genuine packaged Imagination option generation, narrow model-generation retention, published model-turn JSON ingress, semantic logical/physical retention, Persona conversation retention, stable Starfire firewall ownership, completed model-adapter session archival, normal coordinator lifecycle opening/error closure/legacy repair/archival, co-resident resident lifecycle retention, authenticated outer-worker attempt retention, deployed supervisor/projector journald ownership, Docker named-volume atomic snapshot visibility, and deterministic incremental release construction are accepted. Starfire's Docker Desktop F: bind is rejected for mutable authority after an exact packaged lockless reader observed an empty published snapshot during writer interruption. Historical migrated semantic attempts without recorded physical namespace remain durable and non-retirable. One completed Discord consequence remains blocked by the absent Yggdrasil credential. Exact aa841873 also makes legacy coordinator repair one full-snapshot transaction so a later hostile family cannot leave an earlier partial repair.
-  next_action: Keep c007c braked and map the exact Native Imagination ingress selected by awaitFrontierProposal. Restart the resident body onto authenticated fb873927 before further ingress so live serve itself proves the git Body preflight and root-protected runtime. Then provide one typed Imagination proposal without Hands or public consequence, prove its request/binding/detached worker/typed candidate/fulfillment/continuation chain exactly once, reengage the brake, and inspect the next action. Separately retain the cold 13m40s content-addressed compile as an iteration-cost wound; warm packaging is accepted at 8.51s. Yggdrasil never builds.
+  next_action: Keep exact fb873927 c007d braked at revision 294 with the pending autonomous proposal intact. Finish the bounded Imagination fan-out Soul pass, commit/push, and package exact source through Starfire; require exact inspection and an identical warm replay. Restart c007d only onto that authenticated release. Then drain at most the already-authenticated finite autonomous proposal queue one grant at a time, preserving receipt-bound review continuations, and prove the chain converges to an Imagination planning or Soul verification action without Hands/public consequence. Reengage the brake after each active fulfillment. Cold per-source compilation remains an open architecture cost; Yggdrasil never builds.
 
 active_subgoals:
   - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.