Record selected proposal organ authority

notes/repo-frontier-organ-loop.md

@@ -96,14 +96,16 @@ operation: one proposal-citing `UpsertFrontier`. This keeps the proposal mouth
 from becoming a hidden workflow engine while leaving later Eyes, Imagination,
 Self, Hands, and Soul artifacts free to challenge and reshape the contribution.
 
-## Next Deletion Line
+## Next Organ Line
 
-`RepoWorkModelingRequest`, `RepoWorkModelingRoute`, and
-`RepoWorkModelingFinding` describe post-execution workflow closure, not repository
-anatomy. Their item-slug route and `RepoWorkMapEntry` closure ledger must not
-remain a second Modeling/Self/Mind truth. Preserve useful repo-work planning and
-execution receipts only behind canonical `RepoFrontierRoute` and
-`RepoFrontierHandsAuthority`; use the canonical Hands/Soul/verdict-incorporation
-path; demote the old map to derived closure history or delete it. After that,
-admit typed Eyes challenges and Imagination campaign revisions so blocked
-frontier pressure can circulate to the correct organ.
+The parallel `RepoWorkModelingRequest`/route/finding/map authority has already
+been cut; remaining historical rows are sight-only and cannot feed gates,
+actions, closure, or publication. Do not resurrect that deletion as future
+work.
+
+The next live cut is corrective circulation: admit typed Eyes challenges that
+can invalidate or stale exact RepoModel claims and create evidence pressure
+without giving Eyes model-write authority. Then bind the existing Self planning
+request to a real Imagination worker result and Mind adoption. Only after those
+artifacts circulate cleanly should an adopted plan gain a distinct Self
+execution route.

notes/repo-work-canonical-convergence.md

@@ -50,10 +50,14 @@ canonical `RepoFrontierItem`; it is not another repository model.
 
 ## Bootstrap
 
-Persona/intake emits an immutable proposal, not a work item. Ordinary Modeling
-may cite that proposal in an Evolution patch that creates the frontier item.
-Mind admission makes the wound real. Plan/adopt requires that admitted frontier
-identity; no CLI slug, filesystem path, or old close receipt may synthesize it.
+Direct User intake emits an immutable nonprivate proposal, not a work item.
+Explicit coordinator selection binds that exact proposal to one coordinator-
+owned typed Modeling launch projection and job. Ordinary Evolution cannot
+mutate frontier. Only the selected-proposal Evolution path may create exactly
+one proposal-citing frontier item, and Mind replays the complete persisted
+launch/result/review chain before making the wound real. Plan/adopt requires
+that admitted frontier identity; Persona prose, evidence intersection, CLI
+slug, filesystem path, or old close receipt may not synthesize it.
 
 ## Rebuild Order
 
@@ -64,9 +68,10 @@ identity; no CLI slug, filesystem path, or old close receipt may synthesize it.
    pending Bifrost requests, or accounting. Temporary workflow outage is honest.
 2. **Foundation landed:** immutable inert proposal, typed Self planning request,
    Imagination plan candidate, and Mind plan adoption exist with exact model,
-   admission, frontier, scope, candidate-byte, race, and retry proofs. The
-   selected-proposal Modeling launch and proposal-bound Evolution admission are
-   still absent and must be built explicitly.
+   admission, frontier, scope, candidate-byte, race, and retry proofs. Explicit
+   User intake, exact coordinator selection, coordinator-owned typed Modeling
+   launch projection, immutable job/request/proposal binding, and proposal-bound
+   Evolution admission are also landed and Soul-approved.
 3. Bind adopted plan identity into a distinct Self execution route plus Hands
    authority. Re-enable execution only through that chain.
 4. Rewire verification/closure through canonical Soul and verdict incorporation.

state/map.yaml

@@ -360,6 +360,23 @@ rejected_paths:
 
 current_status:
   summary: Epiphany state, prompts, coordinator policy, runtime spine, receipts, and operator surfaces are native typed Rust/CultCache/CultMesh/CultNet organs. Vendored Codex retains Codex-native app-server plus OpenAI-compatible auth/model transport only. Canonical state has one transaction owner and one coordinator store boundary; native status/coordinator JSON emits `state`, and the extinct Codex Epiphany routes, DTOs, bridge, migration, and compatibility field cannot decide or describe native truth.
+  selected_proposal_authority: >
+    Direct User intake and exact selection are coordinator/runtime-spine
+    artifacts. The coordinator launch transaction alone injects the typed
+    proposal projection into one persisted Modeling launch and atomically binds
+    its exact document hash to job, request, proposal, runtime, and thread.
+    Mind/runtime-spine admission alone changes RepoModel after replaying that
+    complete immutable chain. Prompt text, result echoes, caller request ids,
+    operator surfaces, and repository/workspace labels are correlation or
+    provenance only. Caller-prepopulated projection, Persona prose parsing,
+    evidence intersection, bootstrap objective, ordinary Evolution frontier
+    mutation, second launch/reuse, epiphany-work intake, metadata adapters, and
+    parallel RepoWork maps/routes are forbidden writers. The shared path is
+    User proposal -> exact coordinator selection -> atomic typed Modeling
+    launch projection/binding -> immutable result/review -> full-chain Mind
+    replay -> one proposal-citing frontier contribution. Verification: core
+    302 passed/1 ignored, OpenAI runtime 8 passed, hostile no-write proofs, and
+    independent Soul PASS.
   latest_cut: >
     The bridge host seam has been cut down: target-specific Hands prompt scar
     tissue was purged, bridge manifests carry the retained Codex websocket fork