From bcff32827a39ca793c3062cc71e02aeeac1b091f Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 19 Jul 2026 19:00:04 +0100
Subject: [PATCH] Stop coordinator status impersonating readiness

---
 epiphany-core/src/operator_command.rs    |  29 ++++++++++++++++++-----
 notes/epiphany-discord-operator-nerve.md |  10 ++++----
 state/ledgers.msgpack                    | Bin 541128 -> 541963 bytes
 state/map.yaml                           |   1 +
 4 files changed, 30 insertions(+), 10 deletions(-)

diff --git a/epiphany-core/src/operator_command.rs b/epiphany-core/src/operator_command.rs
index 5ee1a72f..9513c681 100644
--- a/epiphany-core/src/operator_command.rs
+++ b/epiphany-core/src/operator_command.rs
@@ -483,11 +483,13 @@ pub fn admit_and_execute_bifrost_operator_command(
                 OperatorCommandResultDisposition::Observed,
                 "operator-snapshot",
                 snapshot.snapshot_id,
-                snapshot.status,
-                snapshot.state_status,
-                snapshot.coordinator_action,
+                format!("coordinator-snapshot/{}", snapshot.status),
+                format!("coordinator-state/{}", snapshot.state_status),
+                format!("coordinator-action/{}", snapshot.coordinator_action),
                 brake_status,
-                String::from("bounded operator-safe status projection"),
+                String::from(
+                    "bounded coordinator snapshot plus independently owned swarm-brake observation; this is not deployment or provider readiness",
+                ),
                 Vec::new(),
                 String::new(),
                 String::new(),
@@ -1140,8 +1142,23 @@ mod tests {
             "2026-07-19T12:00:00Z",
         )?;
         assert_eq!(status_result.consequence_ref, "snapshot-1");
-        assert_eq!(status_result.operator_status, "sleeping");
-        assert_eq!(status_result.state_status, "ready");
+        assert_eq!(
+            status_result.operator_status,
+            "coordinator-snapshot/sleeping"
+        );
+        assert_eq!(status_result.state_status, "coordinator-state/ready");
+        assert_eq!(
+            status_result.coordinator_action,
+            "coordinator-action/none"
+        );
+        assert!([
+            status_result.operator_status.as_str(),
+            status_result.state_status.as_str(),
+            status_result.coordinator_action.as_str(),
+        ]
+        .into_iter()
+        .all(|value| value != "ready" && value != "none"));
+        assert!(status_result.detail.contains("not deployment or provider readiness"));
         assert!(!resident.exists());
         let sleep = signed(
             &signer,
diff --git a/notes/epiphany-discord-operator-nerve.md b/notes/epiphany-discord-operator-nerve.md
index 67b92478..43765b8c 100644
--- a/notes/epiphany-discord-operator-nerve.md
+++ b/notes/epiphany-discord-operator-nerve.md
@@ -70,9 +70,10 @@ release authorization, or deployment.
 
 ### Existing Epiphany owners
 
-- Status: read-only operator-safe projection over release, brake, resident,
-  pending pressure/review counts, and provider health. It exposes no raw worker
-  state or transcripts.
+- Status: read-only operator-safe projection. The deployed v1 result currently
+  carries a coordinator snapshot plus the independently owned brake state. It
+  exposes no raw worker state or transcripts, but it also does not yet compose
+  authenticated release, resident-readiness, Idunn, or Bifrost health.
 - Sleep: swarm-brake owner engages the named cognitive/action surfaces.
 - Wake: swarm-brake owner releases the brake only. Wake does not issue a grant,
   enqueue a turn, adopt a plan, invoke Hands, speak, release, or deploy.
@@ -130,7 +131,8 @@ With Starfire disconnected and no SSH tunnel dependency:
 
 1. owner and non-owner Discord actors receive the correct admission/refusal;
 2. status names exact deployed commit/release, brake, resident state, pressure
-   and review counts, and Idunn/Bifrost health without private state;
+   and review counts, and Idunn/Bifrost health without private state; this is an
+   open acceptance item, not a property of the current coordinator snapshot;
 3. sleep engages the brake and is idempotent;
 4. wake releases only the brake and creates no grant, job, Mind change, Hands
    authority, speech, release, or deployment;
diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack
index 1740e8dbb7f47dc0f7dd1bc3e8af14d2dba8746a..1db59d813ad57daf7f73737c5f5c4f92fd19eba5 100644
GIT binary patch
delta 848
zcmZva&x#X45XPOj{}2Sxi;I_9yl(z3yD^Kam=(c;r^p_>)pl1h4U_J+tH+pA4to&v
znvmBJJcutKK8lZF^(28Hdnjg@uCDJ_-#345j=p_8`hJ+*>z$uI`|$hD!R6l{Pcxs@
zcC(vB?aQK;Nu}pqsU4|ZsXeLvpNrbT$;*fHU!7LxtlsL@+r9Vg?)hnV*?zG1B%3eq
zzuA90!%~|FLswc2uMH~~Gz=ofk|9um*Hjog0tAa8xCtmH4aQ=00obDF+(kf!5m^dG
zf%6oq!$2r~#0-<%6a?C-7~}(}0?n9onoh_wY6fDX$;ReeU0U1hn_+MqAtx+i-he@=
zl#EGwt_+Hxf?^QrEtvWSrum#J`WMHLUWg&)7*n@lumY>e7j8OEf<Cy}C(#Z9v!*=;
z6eEUCl`M>#ZR*O6$LT<BxFL9CCT>7KI83)!iZW!3#<ENR`s@p%L^Mu4>AGB7>Bt=K
z*hJ$jjL<jckN!_bVqUf<JBPEuJEzy?4<m)7xsK@?1Fe=@1$B|=rxo~?Bd=6axv)+=
z=V*!oh!qNr7$Pa$lH<15b|zt4920vK`vK*C%ma!2G(t56ZP*t$g`uHBr=2zA5?hLT
zWm57e#N_$rf2vx6K9*Q8R7+Ig&4k#1D`#|H^6~ONNH|wmnY0c&A+MD#Zy~Sbw-2yd
S9whjboaE3sYxPc0HU0rRwK1{)

delta 65
zcmeC~QasVDxIvPU%h1Z$FzOfshr`m%%8Uh!Of3JKr!uuqWnu(k5X}t4EI`Z(#B4y!
LzI`eahp{~XovagZ

diff --git a/state/map.yaml b/state/map.yaml
index 77b9cc34..1efbe9ab 100644
--- a/state/map.yaml
+++ b/state/map.yaml
@@ -18,6 +18,7 @@ experiment:
   sleep_brake_semantics: "An engaged swarm brake is sleep mode, not daemon death. Resident services may remain supervised, publish liveness/health, refresh leases, and expose read-only operator sight. The brake blocks cognition launches, scheduling that creates cognitive work, Hands consequences, publication, and deployment action."
   swarm_brake_authority: "The only physical brake truth is the runtime-scoped CultMesh key epiphany-local/swarm-brake. Observation uses swarm-brake-status and is byte-pure; mutation uses swarm-brake-set and requires explicit engaged/released status, canonical document id epiphany/swarm-brake, actor, and reason. Legacy swarm-brake/brake commands refuse. The stable owner is epiphany.swarm-brake; command actors are provenance, not owners. Release refuses absent or foreign/legacy identity. Idunn alone may adopt an already-engaged legacy head into the canonical identity during deployment, without any released interval. Discord Sleep preserves foreign brakes; Wake releases only the exact canonical owner. Resident readiness reads the same key, and deployment admission requires brakeEngaged=true before service restart."
   discord_mind_review_owner: "The typed Discord operator core routes Reviews/Review into the canonical frontier-plan Mind owner, not a parallel queue. Reviews exposes only bounded request/candidate/model/frontier identities. Exact Adopt/Refuse/Hold revalidates immutable Imagination and current RepoModel bindings; Hold/Refuse are terminal inert receipts; Adopt alone uses the existing RepoModel CAS and creates no Hands authority, Substrate grant, Persona speech, Bifrost release, or Idunn deployment. Decision provenance is typed as Mind worker or authenticated operator command/admission/packet/actor; downstream RepoModel provenance is typed as worker result or frontier-plan decision, with Option absence instead of empty sentinels. Replay time derives from immutable issuance, machine faults are not terminal refusals, CultCache v0 decision tuples decode explicitly, and signed v0 deliveries may drain only the original four commands. The v1 Epiphany/Bifrost/VoidBot chain is deployed on Yggdrasil behind an engaged canonical brake; the remaining proof is operator-safe Discord interaction, not schema or deployment work."
+  discord_status_truth: "The currently deployed Status command reads a narrow coordinator snapshot and the independently owned swarm brake. It does not authenticate or compose packaged-release, resident-readiness, Idunn, or Bifrost health. Successor source namespaces every legacy coordinator display field as coordinator-snapshot/<status>, coordinator-state/<status>, and coordinator-action/<action>, and explicitly refuses to call them deployment/provider readiness. The final Discord status product contract requires owner-authenticated typed projections from each named provider; PID sight, generic ready strings, and caller booleans are forbidden substitutes."
   status: active
   phase: phase_6_reflection_boundary
   premise: >