Record runtime registry ownership cut

notes/epiphany-current-algorithmic-map.md

@@ -1,7 +1,7 @@
 # Epiphany current algorithmic map
 
 Updated: 2026-08-23
-Latest committed implementation cut: `f10f7fb3` on `codex/epiphany-shakedown-live`
+Latest committed implementation cut: `03140a47` on `codex/epiphany-shakedown-live`
 Current worktree cut: canonical map/evidence sync; Ox17 remains paused
 
 This document describes the live machine. Historical cuts, rejected paths, and
@@ -66,8 +66,8 @@ tested.
 The schema registry contains no `epiphany.surface.*` families. Exact
 `f10f7fb3` deletes the final twelve schemas and ten catalog entries after a
 producer/consumer audit found no live owner on either side; several still
-claimed global revisions or artifact-directory state. The native schema catalog
-rebuilds successfully with zero surface documents. Persona's portable state
+claimed global revisions or artifact-directory state. The publication index
+contains zero surface documents. Persona's portable state
 remains `gamecult.persona_state.v0`; Eve/CultMesh providers retain their own
 typed contracts.
 
@@ -95,10 +95,12 @@ Provider requests are derived internally from canonical native requests in
 tests as well as production; no fixture may manufacture native ancestry from a
 caller-authored provider document.
 
-Runtime spine is the sole live CultNet mutation-contract publisher. Exact
-`a4af4734` deletes six parallel organ contract DTO/factories, the callerless
-local-Verse context query/seed bundle, and fixed Verse/room policy prose. No
-conversion layer replaces them.
+Live providers own their CultMesh/CultNet schema catalogs. Exact `03140a47`
+deletes the standalone runtime-spine CLI, its callerless Hello/catalog writers,
+and its hand-maintained mutation-contract mirror. Runtime status and model
+preflight derive accepted document types from the same CultCache registration
+that opens the Mind store. The typed runtime documents remain; a command-line
+facsimile no longer impersonates their service owner.
 
 Persisted cluster topology is also gone. Its writer became dead when the
 callerless seed bundle was removed, while the supervisor merely accepted any

notes/epiphany-fork-implementation-plan.md

@@ -224,7 +224,7 @@ Delete or demote:
 
 Keep the five-day shakedown, Ox17 deployment, and Model Atlas operational Gate
 1 paused. Continue the source-subtraction and test-authority audit from exact
-`ab1afc27`. The current sequence deletes the semantic-memory/workspace-coverage
+`03140a47`. The current sequence has deleted the semantic-memory/workspace-coverage
 projection system, its local daemon supervisor, and the surviving generic
 RepoModel profile, impossible lifecycle, producerless receipt/summary, and
 decorative scoring axes. Modeling consumes typed Body and keyed RepoModel state
@@ -333,8 +333,9 @@ Cut in this order:
    `MindGatewayReview`, `MindStateCommitReceipt` v0, their generic interpreter
    prompt, runtime registration/read APIs, phantom thought/state-effect/public-
    adoption CultNet mouths, and stale launch receipt profiles are gone.
-   CultMesh and runtime schema catalogues expose only reasoning basis, decision
-   context, and exact Mind commit receipt as read-only audit projections.
+   CultMesh exposes reasoning basis, decision context, and exact Mind commit
+   receipt as read-only audit projections; no runtime schema-catalog mirror
+   survives.
 14. **Model-backed Planning failure repaired at `1c9aafd8`; generic role patch
    deleted at `e0e75a30`:** the runtime seals
    one exact terminal decision context before writing a typed frontier-Planning
@@ -513,6 +514,13 @@ Cut in this order:
    hardcoded package map that does not drive the build. Exact `b95a3266`
    separately deletes the superseded OpenAI debug executable; exact `c04c3aff`
    deletes the auth re-export crate.
+38. **Runtime document registration has one owner at `03140a47`:** the packaged
+   runtime-spine CLI, callerless Hello/schema-catalog writers, and hand-written
+   mutation-contract mirror are deleted. CultCache exact `fdbf3bf` exposes its
+   actual registered type identities; runtime status and model preflight read
+   that registry directly. Cargo has 21 executable targets and no duplicate
+   binary-source owner. Brokkr owns Unity editor capability through Eve/CultMesh;
+   a future Rider daemon owns Rider. Epiphany owns neither editor bridge.
 
 Do not preserve the aggregate for compatibility, manufacture a bootstrap
 thread, release autonomous scheduling, register topology in `gamecult-ops`,

notes/fresh-workspace-handoff.md

@@ -2,8 +2,8 @@
 
 Updated: 2026-08-23
 Branch: `codex/epiphany-shakedown-live`
-Latest committed implementation cut: `ab1afc27`
-Current worktree: continuing source/test-authority audit; Ox17 remains paused
+Latest committed implementation cut: `03140a47`
+Current worktree: canonical map/evidence sync; Ox17 remains paused
 
 ## Orientation
 
@@ -44,6 +44,21 @@ authorize the next capstone or Gate 1.
 
 ## What just landed
 
+Exact `03140a47` deletes the packaged `epiphany-runtime-spine` command and the
+false service authority it carried: 649 lines of operator/debug mutation CLI,
+callerless Hello/schema-catalog writers, a hand-maintained mutation-contract
+mirror, and its source-shape test. CultCache exact `fdbf3bf` now exposes the
+types actually registered in a cache. Runtime status and model preflight derive
+from that single registry instead of a second list. The production Mind store
+and its typed jobs, decisions, and receipts remain; only the duplicate mouth is
+gone. Cargo now has 21 executable targets and zero duplicate binary-source
+owners. Core checks without warnings and release construction passes 17/17.
+
+No Epiphany-owned Rider or Unity code, target, schema, or actuator exists.
+Brokkr owns Unity through Eve/CultMesh. A future Rider daemon owns Rider.
+Epiphany may consume their typed capabilities and receipts; it does not poke
+either editor directly.
+
 Exact `856648de` deletes the unused semantic-memory and workspace-coverage
 projection subsystem: 32,866 net source lines, four binaries, the competing
 local daemon supervisor, Qdrant/Ollama/Postgres configuration, projector
@@ -58,7 +73,7 @@ evidence must earn a typed provider receipt and an explicit reasoning consumer.
 Idunn remains the sole deployment and daemon-survival authority. Core 165/165,
 OpenAI runtime 25/25, and release construction 19/19 pass serially.
 
-The active editor boundary is also clean. Epiphany owns no Rider or Unity
+The active editor boundary is clean. Epiphany owns no Rider or Unity
 bridge, command schema, or editor-specific actuator. Brokkr owns Unity through
 Eve/CultMesh; a future Rider daemon will own Rider. Historical architecture
 snapshots retain their dated record but cannot be mistaken for executable or
@@ -757,8 +772,8 @@ Exact `f10f7fb3` completes that audit: all twelve remaining surface schemas and
 their ten catalog entries had zero producer and zero consumer. The 692-line pure
 deletion includes global-revision status shapes, old Rider/Unity/Void bridges,
 and the artifact-list Persona surface; `gamecult.persona_state.v0` remains the
-portable Persona contract. The native schema-catalog command rebuilds with zero
-`epiphany.surface.*` documents and its temporary audit output was removed.
+portable Persona contract. The publication index contains zero
+`epiphany.surface.*` documents.
 
 Exact `ab3cacfb` deletes thirty-one more producerless contracts: abandoned
 RepoWork aggregates, CultMesh operator-run shadows, generic launch/accept
@@ -807,8 +822,9 @@ bootstrap witness: six organ-specific contract DTO/factories, the callerless
 `EpiphanyLocalVerseContext` query/seed bundle, fixed Verse/room policy prose,
 the `mind_contracts` module and its self-affirming test, persisted seven-cluster
 topology, its dead writer/loader, the supervisor's nonempty-row bootstrap check,
-and the diagnostic test that kept the loader alive. Runtime spine is now the
-sole live CultNet mutation-contract publisher. Supervisor readiness continues
+and the diagnostic test that kept the loader alive. Exact `03140a47` later
+deletes the remaining standalone contract mirror; live providers own their
+CultMesh/CultNet catalogs. Supervisor readiness continues
 to depend on exact runtime/store identity, packaged release, brake, service
 policy, process identity, and signed health. Core and release-bundle checks,
 CultMesh 12/12, and supervisor 4/4 pass. The cut removes 1,005 net source lines.
@@ -882,13 +898,18 @@ Exact `6f93134d` makes the release bundle the sole package owner of every
 production entrypoint. Leaf libraries disable automatic binaries, Cargo
 metadata reports no multiply owned binary source, and the release builder's
 hardcoded shadow target map plus two self-affirming tests are gone. The
-packaged body now has 22 executable targets rather than 26. Exact `c04c3aff`
+packaged body reached 22 executable targets rather than 26. Exact `c04c3aff`
 collapses the five-reexport auth wrapper crate into the transport's narrow
 direct `codex-login` imports. Exact `ffcf036f` advances runtime spine to v7 and
 derives the constant native runtime kind instead of persisting it. Focused
 release construction passes 17/17; the three release-owned daemon targets and
 current runtime epoch checks compile and pass.
 
+Exact `03140a47` then deletes the packaged runtime-spine CLI and its duplicate
+Hello/catalog contract mirror, leaving 21 executable targets. Live providers
+own their CultMesh/CultNet catalogs; model preflight derives accepted document
+types from the real CultCache registration.
+
 Exact `8c20f896` reduces Substrate Gate from six advertised contract families to
 its one real immutable repo-access grant. Request, review, refusal, snapshot,
 and mutation were prose-only constants with no typed body, writer, reader, or

schemas/README.md

@@ -20,15 +20,14 @@ only in one Rust struct or one developer's damp recollection.
 - [cultnet/epiphany.work_organ_state.v0.schema.json](./cultnet/epiphany.work_organ_state.v0.schema.json):
   light function-shaped state for Epiphany internal work organs.
 - [cultnet/README.md](./cultnet/README.md):
-  published CultNet-facing state, surface, intent, and receipt schemas that
-  Aquarium and other runtimes can discover through Epiphany's schema-catalog
-  response.
+  JSON Schema publication artifacts for typed CultNet boundaries. Live
+  providers own their schema-catalog responses.
 
 ## Source Of Truth
 
 The living implementation is in code:
 
-- [mind_documents.rs](/E:/Projects/EpiphanyAgent/epiphany-core/src/mind_documents.rs)
+- [mind_documents.rs](/F:/Projects/Epiphany/epiphany-core/src/mind_documents.rs)
 
 The rule is simple:
 

state/map.yaml

@@ -58,9 +58,10 @@ current_status:
   operator_surface_subtraction: Exact ef92e853 deletes the callerless view-lens registry, legacy acceptance-bundle builders, test-only raw-JSON result interpreters, and six tests: 797 net lines. Exact a292979d and 77e817c1 delete the duplicate CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. Exact 3b94bf6e and 59c5e3a6 delete the nested duplicate status view, false auxiliary mode, and ignored status arguments. Exact 7c9b0cf3 deletes the fixed synthetic job table, role-board job cargo/mappers, and its test: 338 net lines. Exact 2ce91461 deletes the scene/planning Mind reconstructions, duplicate self-policy crate, unused prompt templates, four counterfeit schemas, and ten producer/source-text tests: 1,723 net lines. Exact 78836f3b deletes eight unconsumed status tableaux, the pressure calculator production only called without telemetry, its unreachable compaction action, one counterfeit schema, and six tests: 518 net lines. Exact f10f7fb3 deletes the final twelve epiphany.surface.* schemas and ten catalog entries after every one proved producerless and consumerless: 692 pure deletions. Exact ab3cacfb deletes thirty-one more producerless contracts, the false runtime-session mutation mouth, every Epiphany-owned Rider/Unity command schema, a callerless prompt-context module, its test-only specialist prompt system, and four self-affirming tests: 3,514 net lines. Exact 16d85b1b deletes six duplicate JSON-schema builder tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. Exact 06f93f70 deletes the test-only inverse OpenAI-to-native request mapper and makes two retained tests follow canonical native-to-provider derivation: sixty net lines. The local catalog now has twenty-three live or portable contracts. Brokkr owns Unity capabilities through CultMesh/Eve; a future Rider daemon owns Rider. Status retains Mind identity, exact current work, one action/reason decision, readable role lanes, and operator thought sealing. Core checks cleanly; retained provider and focused request-flow tests pass.
   immutable_runtime_identity_cut: Exact bf997ce0 removes empty legacy frontier-decision echoes and requires exact worker-result provenance. Exact e00ea70f deletes the lossy PID-only process compatibility API. Exact 87983ffc makes runtime identity immutable bootstrap state: no update time, duplicated capability catalog, temporary metadata, or launch-time reconstruction survives. Current-work launch replays the original identity and existing root-session envelopes byte-for-byte as strong reads, preventing hidden singleton timestamp conflicts while retaining substitution refusal. Exact ffcf036f advances runtime spine to v7 and derives the constant native runtime kind at CultNet publication. The current-work capstone, epoch refusal, and OpenAI-runtime all-target checks pass.
   build_target_ownership_cut: Exact a319146b deletes the public non-atomic worker-launch path used only by test fixtures; exact 76fd259b deletes two source-layout tests while retaining real CLI refusal behavior. Exact b95a3266 deletes the superseded unpackaged OpenAI debug executable and the tests/helper that animated it. Exact 6f93134d makes epiphany-release-bundle the sole package owner for production entrypoints, disables automatic leaf binaries, reduces Cargo executable targets from 26 to 22, and deletes a hardcoded release target map plus two self-affirming tests that did not drive the build. Exact c04c3aff deletes the five-reexport auth wrapper crate; the transport imports its narrow Codex auth surface directly. Cargo metadata reports no binary source with multiple package owners; release construction passes 17/17.
+  runtime_registry_authority_cut: Exact 03140a47 deletes the 649-line epiphany-runtime-spine operator/debug CLI, its packaged release role, its callerless Hello/schema-catalog service facsimile, the 600-line hand-maintained mutation-contract mirror, and the source-shape test that guarded that mirror. CultCache exact fdbf3bf exposes its registered type identities, so runtime status and model preflight derive accepted documents from the same registration used to open the Mind store. Executable targets fall from 22 to 21 with zero duplicate source owners. Core checks without warnings and release construction passes 17/17. Editor actuation remains entirely provider-owned: Brokkr owns Unity through CultMesh/Eve and a future Rider daemon owns Rider.
   bifrost_authority_cut: Exact 203bcc41 deletes Epiphany's producerless Bifrost body-change/GitHub publication family: four document types, three singleton latest heads, constructors, validators, writers, local-Verse advertisement/projection, public exports, and five tests that manufactured both ends. Bifrost owns the real Persona feedback/delivery stores and signed crossing receipts; Epiphany does not publish an alternate Bifrost protocol. Core and release-bundle checks pass; the remaining CultMesh suite passes 13/13.
   hands_pr_authority_cut: Exact 11d99de1 deletes the producerless HandsPrReceipt type, registration, dead test-only writer, read path, exports, relinquishment branch, and two contract advertisements. Hands owns local patch, command, and commit consequences; exact remote publication evidence belongs to the provider/Bifrost crossing. Core and release-bundle checks pass, and the rebuilt 43-entry schema catalog contains no deleted PR family.
-  local_verse_contract_cut: Exact a4af4734 makes runtime spine the sole live CultNet mutation-contract publisher by deleting six organ-specific contract DTO/factories, the callerless LocalVerseContext query/seed bundle, fixed Verse/room policy prose, the mind-contract self-test, and persisted cluster topology. The topology writer had no caller; supervision accepted any nonempty fixed-key subset without authenticating Body domain, completeness, or runtime binding. That false bootstrap gate, loader, exports, and its diagnostic test are gone. Exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health remain supervisor prerequisites. The cut removes 1,005 net source lines; core/release checks, CultMesh 12/12, and supervisor 4/4 pass.
+  local_verse_contract_cut: Exact a4af4734 deletes six organ-specific contract DTO/factories, the callerless LocalVerseContext query/seed bundle, fixed Verse/room policy prose, the mind-contract self-test, and persisted cluster topology. The topology writer had no caller; supervision accepted any nonempty fixed-key subset without authenticating Body domain, completeness, or runtime binding. That false bootstrap gate, loader, exports, and its diagnostic test are gone. Exact 03140a47 later deletes the remaining standalone runtime contract mirror; live providers own their CultMesh/CultNet catalogs. Exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health remain supervisor prerequisites. The cut removes 1,005 net source lines; core/release checks, CultMesh 12/12, and supervisor 4/4 pass.
   tool_capability_cut: Exact beb9fd32 deletes the producerless EpiphanyToolCapability DTO/constructor, runtime registration and mutation-contract row, standalone schema/index entry, and MCP smoke-banner claim. No writer, reader, constructor call, admission path, or test existed. Exact model-request tool definitions, RuntimeToolExecutionBinding, invocation intents, and governed receipts remain owners. The canonical catalog drops from 43 to 42 schemas; four affected packages compile and the tool runtime passes 14/14 active tests with one live-source test ignored.
   continuity_contract_cut: Exact ca2d2cf2 deletes four prose-only Continuity mutation contracts and their constants: packet, compaction checkpoint, stale-turn repair, and refusal. None had a typed document, schema, store, writer, reader, or test. ContinuityRecoveryReceipt remains constructed and persisted by accepted reorientation. Core/release checks and decision-auditable reorientation 1/1 pass.
   soul_contract_cut: Exact f8974d52 deletes five prose-only Soul mutation contracts/constants: generic verification request, invariant check, regression receipt, review receipt, and verification refusal. None had a typed document, schema, store, writer, reader, or test. The keyed RepoFrontierVerificationRequest and persisted SoulVerdictReceipt remain the actual request/result path. Core/release checks and focused verification 3/3 pass.
@@ -108,7 +109,7 @@ current_status:
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
   unresolved_authority: Generic command, legacy lineage, caller-authored identity, behaviorless policy fields, global lifecycle latest state, timestamp election, Windows Task Scheduler authority, and their false proofs are gone. Semantic and workspace launch owners are separate over shared process mechanics. The remaining daemon supervisor still combines the service loop, aggregate signed-health publication, semantic reconciliation, and the large workspace recovery state machine. Continue decomposing only where ownership becomes smaller; do not create family frameworks or adapters. The false persisted cluster-topology bootstrap sentinel is gone; supervisor admission remains bound to exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until subtraction closes. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Continue the source/test-authority audit after exact ffcf036f. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Delete test-only APIs and fixtures with the tests they animate. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, immutable runtime identity, single-package binary ownership, and family admission owners. Epiphany owns no local daemon supervisor or editor bridge. Do not run a local full-workspace compile, package, deployment, or Ox root.
+  next_action: Continue the source/test-authority audit after exact 03140a47. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Delete test-only APIs and fixtures with the tests they animate. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, immutable runtime identity, single-package binary ownership, and family admission owners. Epiphany owns no local daemon supervisor, standalone schema service, or editor bridge. Do not run a local full-workspace compile, package, deployment, or Ox root.
 
   runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.