Stop coordinator status impersonating readiness

epiphany-core/src/operator_command.rs

@@ -483,11 +483,13 @@ pub fn admit_and_execute_bifrost_operator_command(
                 OperatorCommandResultDisposition::Observed,
                 "operator-snapshot",
                 snapshot.snapshot_id,
-                snapshot.status,
-                snapshot.state_status,
-                snapshot.coordinator_action,
+                format!("coordinator-snapshot/{}", snapshot.status),
+                format!("coordinator-state/{}", snapshot.state_status),
+                format!("coordinator-action/{}", snapshot.coordinator_action),
                 brake_status,
-                String::from("bounded operator-safe status projection"),
+                String::from(
+                    "bounded coordinator snapshot plus independently owned swarm-brake observation; this is not deployment or provider readiness",
+                ),
                 Vec::new(),
                 String::new(),
                 String::new(),
@@ -1140,8 +1142,23 @@ mod tests {
             "2026-07-19T12:00:00Z",
         )?;
         assert_eq!(status_result.consequence_ref, "snapshot-1");
-        assert_eq!(status_result.operator_status, "sleeping");
-        assert_eq!(status_result.state_status, "ready");
+        assert_eq!(
+            status_result.operator_status,
+            "coordinator-snapshot/sleeping"
+        );
+        assert_eq!(status_result.state_status, "coordinator-state/ready");
+        assert_eq!(
+            status_result.coordinator_action,
+            "coordinator-action/none"
+        );
+        assert!([
+            status_result.operator_status.as_str(),
+            status_result.state_status.as_str(),
+            status_result.coordinator_action.as_str(),
+        ]
+        .into_iter()
+        .all(|value| value != "ready" && value != "none"));
+        assert!(status_result.detail.contains("not deployment or provider readiness"));
         assert!(!resident.exists());
         let sleep = signed(
             &signer,

notes/epiphany-discord-operator-nerve.md

@@ -70,9 +70,10 @@ release authorization, or deployment.
 
 ### Existing Epiphany owners
 
-- Status: read-only operator-safe projection over release, brake, resident,
-  pending pressure/review counts, and provider health. It exposes no raw worker
-  state or transcripts.
+- Status: read-only operator-safe projection. The deployed v1 result currently
+  carries a coordinator snapshot plus the independently owned brake state. It
+  exposes no raw worker state or transcripts, but it also does not yet compose
+  authenticated release, resident-readiness, Idunn, or Bifrost health.
 - Sleep: swarm-brake owner engages the named cognitive/action surfaces.
 - Wake: swarm-brake owner releases the brake only. Wake does not issue a grant,
   enqueue a turn, adopt a plan, invoke Hands, speak, release, or deploy.
@@ -130,7 +131,8 @@ With Starfire disconnected and no SSH tunnel dependency:
 
 1. owner and non-owner Discord actors receive the correct admission/refusal;
 2. status names exact deployed commit/release, brake, resident state, pressure
-   and review counts, and Idunn/Bifrost health without private state;
+   and review counts, and Idunn/Bifrost health without private state; this is an
+   open acceptance item, not a property of the current coordinator snapshot;
 3. sleep engages the brake and is idempotent;
 4. wake releases only the brake and creates no grant, job, Mind change, Hands
    authority, speech, release, or deployment;

state/map.yaml

@@ -18,6 +18,7 @@ experiment:
   sleep_brake_semantics: "An engaged swarm brake is sleep mode, not daemon death. Resident services may remain supervised, publish liveness/health, refresh leases, and expose read-only operator sight. The brake blocks cognition launches, scheduling that creates cognitive work, Hands consequences, publication, and deployment action."
   swarm_brake_authority: "The only physical brake truth is the runtime-scoped CultMesh key epiphany-local/swarm-brake. Observation uses swarm-brake-status and is byte-pure; mutation uses swarm-brake-set and requires explicit engaged/released status, canonical document id epiphany/swarm-brake, actor, and reason. Legacy swarm-brake/brake commands refuse. The stable owner is epiphany.swarm-brake; command actors are provenance, not owners. Release refuses absent or foreign/legacy identity. Idunn alone may adopt an already-engaged legacy head into the canonical identity during deployment, without any released interval. Discord Sleep preserves foreign brakes; Wake releases only the exact canonical owner. Resident readiness reads the same key, and deployment admission requires brakeEngaged=true before service restart."
   discord_mind_review_owner: "The typed Discord operator core routes Reviews/Review into the canonical frontier-plan Mind owner, not a parallel queue. Reviews exposes only bounded request/candidate/model/frontier identities. Exact Adopt/Refuse/Hold revalidates immutable Imagination and current RepoModel bindings; Hold/Refuse are terminal inert receipts; Adopt alone uses the existing RepoModel CAS and creates no Hands authority, Substrate grant, Persona speech, Bifrost release, or Idunn deployment. Decision provenance is typed as Mind worker or authenticated operator command/admission/packet/actor; downstream RepoModel provenance is typed as worker result or frontier-plan decision, with Option absence instead of empty sentinels. Replay time derives from immutable issuance, machine faults are not terminal refusals, CultCache v0 decision tuples decode explicitly, and signed v0 deliveries may drain only the original four commands. The v1 Epiphany/Bifrost/VoidBot chain is deployed on Yggdrasil behind an engaged canonical brake; the remaining proof is operator-safe Discord interaction, not schema or deployment work."
+  discord_status_truth: "The currently deployed Status command reads a narrow coordinator snapshot and the independently owned swarm brake. It does not authenticate or compose packaged-release, resident-readiness, Idunn, or Bifrost health. Successor source namespaces every legacy coordinator display field as coordinator-snapshot/<status>, coordinator-state/<status>, and coordinator-action/<action>, and explicitly refuses to call them deployment/provider readiness. The final Discord status product contract requires owner-authenticated typed projections from each named provider; PID sight, generic ready strings, and caller booleans are forbidden substitutes."
   status: active
   phase: phase_6_reflection_boundary
   premise: >