diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index 503409a4..6c34f87c 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -1,10 +1,11 @@ # Epiphany current algorithmic map Updated: 2026-08-25 -Latest committed implementation cut: `ed4ca58c` on `codex/epiphany-shakedown-live` -Current pass: source subtraction is complete; `state/map.yaml` owns the Idunn -package-only authority gap before fresh Ox17. Atlas Gate 1 and production -remain paused. +Latest committed implementation cut: `27e1dca1` on `codex/epiphany-shakedown-live` +Current pass: Idunn's immutable Ox17 container route is live. The capstone is +braked after three provider failures caused by the now-fixed Docker-to-host +firewall seam. `state/map.yaml` owns resumption authority. Atlas Gate 1 and +production remain paused. This document describes the live machine. Historical cuts, rejected paths, and proof chronology belong in git, `state/ledgers.msgpack`, and bounded smoke @@ -1427,13 +1428,13 @@ Accepted through the local `5b799b12` source boundary: Open before Model Atlas Gate 1 resumes: -1. obtain an Idunn-owned compile-test-seal-only route that cannot publish, - promote, mutate production, or start services, then use it to seal exact - build-affecting source `ed4ca58c`; -2. use that exact package in private fresh-store Ox17; stop after three - provider failures total, and prove direct Body Modeling, typed - refusal-to-retry if exercised, Hands through Verification, exact context - audit, and restart/re-entry without public speech; +1. export and seal the stopped Ox17 root's consequential typed evidence before + any fresh deployment can delete its fixed named volumes; +2. only after explicit operator fresh-retry authority, use immutable exact + `27e1dca1`, verify Connector `80de3acc` plus the bounded `3c2f343` bridge, + reset the failure budget for that new root, and prove direct Body Modeling, + typed refusal-to-retry if exercised, Hands through Verification, exact + context audit, and restart/re-entry without public speech; 3. only then restart Model Atlas Gate 1 from a new external root. diff --git a/notes/epiphany-fork-implementation-plan.md b/notes/epiphany-fork-implementation-plan.md index cd10025b..acaf5c85 100644 --- a/notes/epiphany-fork-implementation-plan.md +++ b/notes/epiphany-fork-implementation-plan.md @@ -67,7 +67,8 @@ transport belong to the independent CodexConnector daemon, not Epiphany's body. ### 0. Federate Decision-Auditable Mind -Status: source-complete; exact-package capstone open. The persisted thread head, +Status: source-complete; immutable Ox17 container deployed; capstone braked +after the three-failure boundary. The persisted thread head, global revision transaction, aggregate RepoModel, generic Mind gateway, and dual readers are deleted. Concrete invariant owners submit exact-envelope `MindMutation` plans; CultCache batch CAS merges disjoint identities and refuses diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 05c7b428..75be77ec 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -2,11 +2,12 @@ Updated: 2026-08-25 Branch: `codex/epiphany-shakedown-live` -Latest committed Epiphany source cut: `ed4ca58c` -Current connector source: `6dc80f6d266db4d82566d2434adcc55a48e8ecad` -Current pass: source subtraction is complete. Ox17 is blocked on an Idunn-owned -compile-test-seal-only route; canonical direction lives in `state/map.yaml`. -Ox17 and Atlas Gate 1 remain paused +Latest committed Epiphany source cut: `27e1dca1` +Current connector source: `80de3acc18e058f649c3b25ce617f8869f038670` +Current pass: the Idunn-owned Ox17 container route is live. The capstone is +braked after three network failures; the exact route defect is fixed and +probe-proven, but no fourth provider attempt was made. Canonical direction +lives in `state/map.yaml`. Production and Atlas Gate 1 remain paused. ## Orientation @@ -17,9 +18,9 @@ Idunn's Yggdrasil CI/CD task with local compiler work, or wake resident cognition without an explicit operator resumption. Epiphany is a supervised engineering alpha. Exact source `d2ca6630` remains the -production symlink body and is inactive. Exact `ed4ca58c` is the current -build-affecting source on this branch. Historical live proofs remain evidence; -they do not authorize the next capstone or Gate 1. +production symlink body and is inactive. Exact `27e1dca1` is packaged only in +the non-production Ox17 container. Historical live proofs remain evidence; +they do not authorize Gate 1. ## Current live deployment @@ -35,6 +36,14 @@ they do not authorize the next capstone or Gate 1. restarts after the hard epoch refusal rollback. The d2ca stores and swarm brake remain historical production state; no newer package is admitted there. +- Non-production Ox17 container `c50a1a83118d` runs immutable image + `sha256:12bc9a30ad455db2709c0b0749bde84e1c763c5cd36d1ea158112fdaa1deed9c` + from exact Epiphany `27e1dca1`. Its named state/work volumes are private and + its root is read-only; it has no production mounts. The bridge has egress, + so this is storage/authority isolation, not network isolation. +- CodexConnector `80de3acc` admits a separate `epiphany-ox17-yggdrasil` + caller. gamecult-ops `3c2f343` owns fresh volume initialization and the + bounded removable loopback/firewall bridge. - Idunn source `8b972715c47731f2418d0c423cb0dd2076940bd7` is provenance-exact and admits Epiphany through the shared authenticated daemon-health contract. - gamecult-ops `b47f9084` removes Docker from @@ -47,6 +56,15 @@ they do not authorize the next capstone or Gate 1. ## What just landed +Exact `27e1dca1` is the immutable Ox17 source. Direct Body Modeling launched +without Eyes. One wrong provider label failed before transport and remained a +typed terminal refusal. A corrected fresh state root then made exactly three +provider attempts; UFW blocked container-to-host bridge traffic, so each +failed before usable output and exposed a secondary failure-identity collision. +The run stopped with no Hands mutation and no public speech. The bridge route +was then corrected and a bounded TCP start/stop probe passed; no fourth model +attempt was run. + Exact `ed4ca58c` deletes `RepoFrontierAdoptedPlan::effective_action` and `effective_command`; the operator projection and Hands consequence validator read the owning public fields directly. The closing audit found no further @@ -57,14 +75,13 @@ diff check passed; no mixed-worktree compilation is claimed. Prepare the fresh exact Ox17 package capstone next while production and Atlas Gate 1 remain paused. -The subsequent Yggdrasil preflight found that the documented bounded-redeploy -helper grants the complete Epiphany deployment transaction: compile, test, -seal, publish, Body/pointer mutation, service start, health admission, and final -witness. Idunn exposes no package-only action. Do not use bounded redeploy or -the root manifest for the private pre-admission capstone, and do not compile on -Starfire. Obtain an Idunn-owned compile-test-seal-only route first; then run -fresh-store Ox17 from its immutable `ed4ca58c` package. Production and Atlas -Gate 1 remain paused. +The former package-only authority gap is closed by the immutable image witness +and one-shot Idunn target. The failed root is terminal evidence: do not issue a +fourth attempt in it or reuse its volumes. A redeploy deletes the fixed named +volumes, so seal their consequential typed evidence or obtain an explicit +retention-owner disposal classification first. A new fresh-root attempt then +requires operator admission and an explicit reset of its failure budget. +Production and Atlas Gate 1 remain paused. Exact `9f189871` removes the admitted-direction prompt alias from the crate root, makes its renderer and supersession check crate-internal, and makes the diff --git a/state/map.yaml b/state/map.yaml index 2433a0e3..23154c94 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -4,7 +4,7 @@ experiment: purpose: Native, inspectable agent organism with typed state and explicit organ authority. objective: - current: Obtain an Idunn-owned compile-test-seal-only route, then run private fresh-store Ox17 from the immutable exact ed4ca58c package before production admission. Production remains braked and historical Ox roots are never resumed. + current: Preserve the stopped three-attempt Ox17 root as failed substrate evidence; decide whether to authorize one new fresh-root capstone now that exact ops 3c2f343 proves the bounded connector route. Production remains inactive and Atlas Gate 1 paused. architecture: body: Repository, runtime, service processes, stores, interfaces, and deployment substrate. @@ -24,7 +24,7 @@ architecture: idunn: Owns source-change CI/CD observation, compilation, testing, release construction, deployment, and daemon survival. cultmesh: Projects typed state without becoming its owner. brokkr: Owns Unity editor inspection and actuation; Epiphany consumes its typed CultMesh/Eve capabilities and receipts. - model_provider: Owns explicit provider selection and exact provider lowering; OpenRouter/Ox is the admitted Yggdrasil provider, while Codex-derived transport remains an optional OpenAI boundary rather than Epiphany authority. + model_provider: Owns explicit provider selection and exact provider lowering; the independent CodexConnector is the admitted Ox17 credential and transport boundary with a distinct caller identity, while production Epiphany remains inactive on its historical OpenRouter configuration. codex: Retained only where an OpenAI provider needs its earned authentication or transport capability. invariants: @@ -111,11 +111,12 @@ current_status: repo_model_body_cut: Exact a8f3c1f0 makes the authenticated runtime Body route own initial keyed RepoModel binding. Bootstrap derives the digest from the admitted RepositoryBodyObservationBasis, initialization reauthenticates runtime, swarm, workspace, and Body binding before any write, and a hostile seed refuses with the whole store byte-identical. The exact 553f79d9 package exposed this root after concurrent Persona and terminal Modeling cognition; its result is not transplanted. Exact 79292fe3 makes one authenticated Repository Body snapshot load own runtime route, Body binding, historical observation, and manifest validation. Basis validation, Mind admission, Modeling projection, and manifest consumers no longer validate, reopen, and reconstruct the same head against a second store read. semantic_cache_cut: Exact 856648de deletes the unused semantic-memory and workspace-coverage projection subsystem rather than preserving a second derived model of Mind. Four binaries, the local daemon supervisor, Qdrant/Ollama/Postgres configuration, projector policy/lifecycle/heartbeat/recovery state, semantic query/context packets, aggregate model revision/hash cargo, workspace file-cache reader, and Persona's always-empty semantic-recall fields are gone. No agent request builder or sealed reasoning projection consumed this cache. Modeling now reads the exact typed Body and keyed RepoModel projection directly; future retrieval evidence must enter through an earned typed provider receipt. Idunn remains the sole deployment and daemon-survival authority. Core 165/165, OpenAI runtime 25/25, and release construction 19/19 pass. repo_model_vocabulary_cut: Exact 6ea4ff3c deletes the redundant generic memory profile, dead SHA-1 ID factory, empty profile module, cache-only node/edge kinds, and impossible lifecycle variants. Exact 5218cf2c deletes the producerless RepoModel lifecycle-receipt family. Exact 8bb039af makes domains seed-owned and deletes the unreachable summary mutation/document/validation/registry path plus the test cargo that alone produced it. Exact ab1afc27 removes node salience/confidence and edge confidence because no owner read, validated, routed, or displayed those values. Modeling can author only the keyed repository operations advertised by its provider schema. Affected targets check cleanly; core remains 165/165, RepoModel 5/5, and reasoning-context 8/8. - package_baseline: Exact d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4 remains the admitted production source and current symlink target. Its native serialized full-workspace gate passed with receipt SHA-256 de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482. Idunn sealed 26 root-owned non-writable binaries plus release-witness.ccmp as release sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06; witness-file SHA-256 is 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357. Source 9b9b5c85 also passed Idunn's native test gate under receipt SHA-256 6c6a71359f8c31297419665d2872f6982a89f84e197d71fc5b36a7fc86216093 and remains sealed as release sha256-30a910785a380224bbdbd56a7b742c8d058fa70cb72dab3562e3907903e0d191 with witness-file SHA-256 75bf52d31c56ea3b08e1a702273301c1db12a4b1ffae45e3d948ce8a29b50e1d. A foreign-target helper restarted Idunn during the Epiphany transaction; rollback restored d2ca, removed deployment.env, and left production Epiphany units inactive. OpenRouter model stealth/ox-alpha and its systemd-injected credential are readiness-proven. Idunn is active with zero restarts and its deployment brake is engaged. + package_baseline: Production remains exact d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4, inactive, and braked. Idunn separately constructed exact Epiphany 27e1dca1dc393fd0494f1b5ca98368f02dde59c4 as immutable image sha256:12bc9a30ad455db2709c0b0749bde84e1c763c5cd36d1ea158112fdaa1deed9c and deployed it only to container c50a1a83118d with private named state/work volumes, a read-only root, dropped capabilities, and no production mounts. Storage and authority are isolated; the dedicated Docker bridge has ordinary egress and is not network-isolated. CodexConnector exact 80de3acc18e058f649c3b25ce617f8869f038670 admits a distinct epiphany-ox17-yggdrasil caller. gamecult-ops exact 3c2f343 initializes fresh volume ownership and owns a bounded, removable loopback bridge plus exact firewall aperture. Production units remain inactive. + ox17_capstone_attempt: Container c50a1a83118d on immutable image sha256:12bc9a30ad455db2709c0b0749bde84e1c763c5cd36d1ea158112fdaa1deed9c launched direct Body Modeling from exact Epiphany 27e1dca1. Three corrected provider attempts produced three connector connection failures because host UFW blocked the container-to-host route; a secondary typed model-pass failure identity collision followed. No accepted model result, Mind consequence, Hands mutation, or public speech exists. Exact gamecult-ops 3c2f343 repairs and probes the bounded route, but the failed root is terminal evidence and remains awaiting_operator_fresh_retry_authority. Its fixed named volumes would be deleted by redeploy, so their consequential typed evidence must be exported and sealed or explicitly classified disposable before any fresh deployment. summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. Exact edb5c3a3 deletes the launch, heartbeat, and terminal-result family identity mirrors: the sealed typed launch owns live pass identity and the archived attempt owns historical request identity. Exact cabdd6c3 separates immutable coordinator incarnation basis/terminality from minimal model-session admission and removes the remaining session prose, clocks, dead states, redundant options, and whole-store coordinator snapshot. Exact a46725a1 reduces runtime jobs to Queued/Completed/Failed admission latches and removes timestamp selection from Research. Exact 10a70afc derives job role/session ownership from sealed launches and model bindings, leaving the generic job as identity plus status. Exact 53e869c0 removes generic job-result evidence/artifact mirrors; exact 8eaa96c5 stops persisting generic result documents for structured worker decisions; exact 2c3335dc deletes the generic result family entirely and makes typed decisions, model receipts/failures, job status, and process claims own their respective terminal facts. Exact dbb00c2b retains the minimal live/archive session pair for explicit phase closure and retired-identity refusal while deleting display echoes and a wrapper. Exact 24023265 makes the sealed Verification projection the sole Hands receipt input and deletes the duplicate live reread path. Exact a01c6842 deletes the coordinator's same-function always-approved Hands review, derives consequence authority through route/intent/grant identities, and refuses ambiguous receipt sets instead of selecting by timestamp. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused. public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets. competitive_launch_signal: The 2026-08-22 Munder Difflin launch analysis in notes/munder-difflin-launch-intelligence-2026-08-23.md is the current Eyes/Imagination owner for this category signal. It establishes strong demand to try a packaged, local, visual multi-agent control plane and supplies repeated qualitative demand for an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness; it does not establish retention, reliable autonomy, or paid product-market fit. Munder is materially ahead in installation, cross-platform reach, provider reuse, category compression, community formation, and feedback velocity. Its public failures make renderer-owned physiology, cross-Body restoration, proxy safety metrics, false consequence receipts, provider parity, and marketed-but-unavailable federation concrete falsification targets. Epiphany does not yet own a general operator UI: Persona projection into shared asynchronous chat is the concrete human surface, while CultMesh remains projection-neutral. Social Aquarium, a dense operator cockpit, TUI, and audit surfaces may use distinct Eve compositions over the same provider-owned facts. A one-hour projection experiment and managed continuity/federation remain evidence-led options rather than adopted roadmap authority; the source-subtraction and test-authority audit remains next. - latest_phase: Fresh-package Ox17 and Model Atlas Gate 1 remain paused while source subtraction continues. Exact a721b763 leaves one canonical native model request/event/receipt family, one model-adapter package owning native contracts plus pure provider lowering, a direct temporary OpenRouter release edge, and a lean authenticated CodexConnector client ABI. The independent CodexConnector daemon owns Codex caller admission, credential custody, provider transport, replay, and transport receipts; Yggdrasil runs it as its own service and Idunn target for Ghostlight, while a live Epiphany caller remains unaccepted. Keyed typed Mind, sealed reasoning bases and decision contexts, exact strong-read batch CAS, state-driven work, direct Body-to-Modeling flow, family-owned admission, Persona state, Hands consequences, Verification audits, and decision-preserving archival remain authoritative. Runtime events, role lanes, timestamps, global revisions, aggregate RepoModel authority, provider-event mirrors, embedded Codex transport, and the one-file OpenAI adapter package own no behavior. The optional epiphany-openai-runtime package remains earned because it isolates model and Persona orchestration from seven unrelated root release binaries. Exact 8086d66f folds single-consumer release construction beneath Core's packaged-release owner and deletes its package target. Exact 1e66e770 deletes the producerless Hands receipt constructors while retaining real consequence admission. Exact fab6a59a deletes the never-called Idunn runtime-health signer/aggregate/RUDP module. Exact 200732e9 deletes the adjacent producerless Idunn provider-health store. Exact 1e4fa533 narrows packaged-release exports to real consumers. Exact e905dcd9 inlines the canonical protected-surface list into the default brake. Exact f962c0bc deletes the test-only resident-provider aggregate, its dead boolean predicate wrapper, and the duplicate test that alone kept the second decision path alive. Exact d0a317bd deletes five family review-ID wrappers and makes one current-work snapshot plus one shared attempt rule own review dispatch. Exact 1a9dec56 collapses the five duplicated review consequence branches into one pipeline while retaining five exact family admission owners. Exact fca516f5 deletes two test-only state readers/path validators and makes two resident-readiness internals private while preserving exact typed proofs. Exact e7b66b35 demotes all six causal-work identity constructors and their module re-export to crate visibility. Exact 9f189871 removes the dead admitted-direction prompt root alias and narrows four single-consumer cognition helpers. Continue from exported wrappers that merely rename public fields. + latest_phase: Idunn now owns an immutable, one-shot Epiphany container deployment and CodexConnector owns a distinct Ox17 caller. The exact 27e1dca1 Body launched Modeling directly without Eyes in the existing container. One configuration failure proved typed refusal-to-retry. The corrected fresh state root made three provider attempts; all failed before usable output because UFW blocked the Docker bridge from reaching the host loopback proxy, and the worker then surfaced a secondary failure-identity collision. The run stopped at the three-failure boundary with no Hands mutation and no public speech. gamecult-ops exact 3c2f343 now initializes fresh volumes and derives, opens, probes, and removes the exact bridge/firewall route; a post-brake TCP probe passed. No fourth provider attempt has been authorized or run. execution_binding_authority_cut: Exact ce6bff12 reduces model and tool execution bindings to the only facts they own. A model binding maps one native request to its runtime session and job; a tool binding maps one typed intent to its runtime session and job. Provider identity, source worker, reasoning basis, and model-request ancestry are no longer copied into bindings or compared through timestamp-shaped API arguments. Validation, retention, public-source lookup, worker terminality, decision sealing, and tool continuation reload the exact native request or tool intent. Runtime writable state advances to v37. Core, epoch refusal, transcript-free decision audit, OpenAI tool continuation, and the release-owned tool runtime pass. The cut removes 67 net source lines and leaves runtime_spine.rs at 9,300 physical lines with 50 public functions and 25 public structs. Verification generated 12.713 GiB across 19,134 files; Cargo cleanup restored the single 1.78 MiB state inspector. Atlas is untouched; no live inter-swarm collaboration has run. provider_transport_boundary_cut: Exact ed7357a2 removes Codex transport from Epiphany's compiled body. The complete epiphany-openai-codex-spine package, codex-login/codex-client graph, CODEX_HOME/auth.json readiness, direct Codex HTTP/SSE, and Codex credential creation/argv are gone. Model and Persona entrypoints use the lean typed client from exact CodexConnector 54d8bc2525b7e7fa1b9dd26b95871247ff4c7566 over authenticated loopback MessagePack; Connector owns Codex auth, transport, replay, and exact native/provider digest receipts. Epiphany retains sealed native/provider requests, strict schema/call-ID projection, tool continuation, decision admission, and typed receipt evidence. OpenRouter remains one direct ureq/Rustls boundary with its own credential and terminal-tool dialect. Model receipts advance to v1 and runtime to v38; caller identity, both request digests, and cached-token usage survive transcript deletion. The maintained non-lock source shrinks by 857 lines and Cargo.lock drops 4,830 lines. Core 150/150, runtime 21/21, adapter 5/5, model edge 12/12, Persona 1/1, exact launch checks, and focused no-deps Clippy pass. Two focused build roots totaling 10.8 GiB were removed; only the exact 1,776,640-byte state inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E remains. Atlas is untouched and no collaboration acceptance is claimed. provider_request_authority_cut: Exact c37cae8b replaces the durable generic OpenAI-shaped request with a closed provider-request document. The consumer adapter now lowers the canonical native request directly to either the exact final `CodexProviderRequest` or the exact OpenRouter request before inference and decision-context sealing. The release edge no longer performs Codex schema, tool, call-ID, or output-format lowering; it supplies the already sealed Codex request to the authenticated Connector invocation. Runtime and decision-context writable schemas advance to v47/v3 with no compatibility reader. Exact 87ea81db pins current Connector source 6dc80f6d266db4d82566d2434adcc55a48e8ecad and deletes Epiphany's obsolete 106-line public schema for the dead generic request, leaving two earned portable CultNet contracts. Connector separates contract-only, client, and daemon compile surfaces; Epiphany uses the contract-only surface in the adapter and the client surface only at the release edge. The Epiphany source cuts remove 125 net maintained lines; Core 152/152, runtime 21/21, adapter 5/5, model edge 12/12, Persona 1/1, and Connector contract/client/daemon 8/8, 10/10, 29/29 pass. Atlas is untouched and no live collaboration acceptance is claimed. @@ -124,7 +125,7 @@ current_status: runtime_job_binding_cut: Exact 10a70afc makes EpiphanyRuntimeJob a two-field identity/status latch. The sealed worker launch owns outer-worker role; EpiphanyRuntimeModelExecutionBinding owns model-session membership; outer workers belong to the root session by definition. Role and session disappear from jobs and generic job results, the result's always-empty metadata map is deleted, and heartbeat launch options lose constant root-session plus unused objective/note cargo. Session closure and retention derive their exact job set from model bindings; tool ownership derives from either the sealed launch or one exact model binding; duplicate terminal results refuse instead of sorting by completion time. Runtime advances to v42 without a compatibility reader. Keyed lifecycle, model-failure audit, transcript-free binding, tool continuation, Persona replay, coordinator terminality, epoch refusal, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 73 maintained lines net. Verification created 3.7 GiB across 4,764 Cargo files; cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven. runtime_job_result_cargo_cut: Exact 53e869c0 deletes evidence and artifact mirrors from EpiphanyRuntimeJobResult and its completion API. Structured role/reorientation outcomes remain the sole evidence/artifact owners; the generic result retains only lifecycle verdict, terse summary/next-move account, completion time, and optional decision-context binding for transport and process-death physiology. Reorientation failure display no longer invents generic evidence. Runtime advances to v43 with no compatibility reader. Keyed lifecycle, auditable model failure, epoch refusal, reorientation, typed worker admission, Persona replay, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 51 maintained lines net. Verification created 3.654 GiB across 4,759 Cargo files; Cargo cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven. structured_worker_result_cut: Exact 8eaa96c5 makes typed role/reorientation outcomes the sole durable structured worker decisions. Runtime completion strong-reads and byte-identically replays the exact structured envelope while atomically terminalizing job/process physiology; it persists a generic result only when no structured outcome exists. Fulfilled worker archives retain decision context plus the full typed role result, not a generic companion. Coordinator reorientation success derives from job status and requires the typed reorientation result. Runtime advances to v44 and archived worker attempts to v3 with no compatibility reader. Keyed lifecycle, decision audit, model-failure audit, reorientation, role admission, Persona replay, runtime-error/tool-loop failures, release coordinator, and release model-runtime checks pass. The source cut adds 7 maintained lines because the exact CAS dependency fence replaces a larger durable duplication. Verification created 5.632 GiB across 6,826 Cargo files; Cargo cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven. - standalone_codex_transport_target: Independent GameCult/CodexConnector source exact 6dc80f6d266db4d82566d2434adcc55a48e8ecad owns one Cargo package and one public daemon binary. Its no-feature library is the typed provider/result contract only; the default `client` feature adds authenticated encryption, bounded framing, and one-request socket transport; `daemon` adds the public service, bounded raw Responses transport, the private digest-pinned official codex app-server credential child, and keyed CultCache replay. Active identity is sealed before provider I/O; the exact encrypted completion is durable before reply; completed replay survives restart byte-identically; restart-era active work refuses as indeterminate without consuming current capacity. Callers own native/provider projection, prompts, tools, decisions, and admission. Connector docs exact 8c57be4 describe the three compile surfaces; Ghostlight exact 8e7d980 pins the same source contract. Yggdrasil runs the independent `codex-connector.service` and Idunn target for Ghostlight; Ghostlight cannot deploy or mutate it. Epiphany's source client exists, but a live Epiphany caller admission and round trip remain unaccepted while its current provider edge is OpenRouter. + standalone_codex_transport_target: Independent GameCult/CodexConnector exact 80de3acc18e058f649c3b25ce617f8869f038670 owns one Cargo package and one public daemon binary. Its library owns the typed provider/result contract, authenticated encryption, bounded framing, and one-request socket transport; `daemon` adds the public service, bounded raw Responses transport, the private digest-pinned official codex credential child, and keyed CultCache replay. Active identity is sealed before provider I/O; exact encrypted completion is durable before reply; restart-era active work refuses as indeterminate. Callers own prompts, tools, decisions, and admission. Yggdrasil now admits distinct Ghostlight and epiphany-ox17-yggdrasil caller identities. The Ox17 round trip reached the bounded route only after the three-attempt stop, so caller and network admission are proven but a successful Epiphany model receipt remains unaccepted. fixed_routing_and_retention_cargo_cut: Exact ffd91c20 deletes EyesEvidencePacket.source_role_id, PersonaSocialMention.target_agent_id, and ResidentSelfRetentionHead.retained_at_millis. Each producer supplied one fixed or non-causal value and no consumer read it; the request/context, Persona queue plus turn request, and retention chain remain the real owners. Eyes packet v2, Persona mention v2, Resident Self state v3/retention head v1, and runtime v27 form a hard cut. Core and the three consuming release entrypoints compile; consequential Persona, Research, and epoch-refusal proofs pass. The maintained source delta is 6 net deletions. Atlas is untouched; no live inter-swarm collaboration has run. provider_stream_authority_cut: Exact fe118e13 makes OpenAI/OpenRouter events and receipts transient transport values. The runtime immediately normalizes them into the single persisted native model event/receipt family used by tool continuation, assistant reconstruction, terminal validation, and bounded retention. Duplicate provider writes, registrations, archive requirements, schema IDs, two public schemas/index rows, and the include-only model-runtime shell are gone; the exact provider request remains durable. Runtime advances to v28 and the catalog drops to 18 schemas. The cut removes 270 net maintained lines. Adapter 1/1, provider spine 14/14, reasoning context 8/8, runtime 23/23, model entrypoint 11/11, swarm 4/4, epoch refusal 1/1, and release construction 15/15 pass. Atlas is untouched; live inter-swarm collaboration remains unproven. cultnet_catalog_authority_cut: Exact dbed11b3 and 8bb0719b delete the hand-maintained JSON shadow registry. The nonexistent runtime-event contract and obsolete public archived-session tombstone schema disappear first. Runtime-local identity, session, job, binding, coordinator, native model/tool, and state-ledger schemas then disappear because no live CultNet provider carries them and several contradicted their Rust owners. Typed CultCache registration and owner-projected CultMesh state remain authoritative. The catalog has exactly three earned boundaries: the exact OpenAI-compatible provider request, gamecult.persona_state.v0, and epiphany.work_organ_state.v0. Parse/path/unindexed/forbidden-contract checks pass at 3/3/0/0/0. The cuts remove 850 net maintained lines. Atlas is untouched; live inter-swarm collaboration remains unproven. @@ -226,8 +227,8 @@ current_status: resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255 vendored_codex_eviction: Exact 7a125d78 deletes all 3,592 tracked vendored Codex files and 851,099 lines after Cargo metadata and manifest/source guards prove no build consumer. The seven dirty files contained only rustfmt and blank-line churn, so no semantic work was discarded or preserved as a counterfeit artifact. The root workspace exclusion, obsolete AGENTS search recipes, vendor-specific license clauses, and two superseded live migration notes are gone. The independent Connector contract remains the sole Codex-facing compile dependency. Gamecult-ops exact cb63e77 corrects the Yggdrasil inventory from the extinct Epiphany-branded/Ghostlight-owned daemon to the independent `yggdrasil-codex-connector` Idunn target. Historical archive notes and the explicitly dated June Body whitepaper remain inert history. No compilation or deployment mutation was required. unresolved_authority: `runtime_spine.rs` remains the largest central liability; it still mixes immutable identity, minimal model sessions/jobs, process claims, model/tool execution binding, family admission, consequence receipts, retention, and resurrection fences. Exact a01c6842 removes the counterfeit Hands review; route, Substrate Gate grant, minimal intent, frontier authority, and exact consequences now own that chain. No production actuator authors those receipts, so the coordinator truthfully stops at `awaitingHandsExecutor`. Exact c37cae8b closes the two-stage Codex request seam, exact 7a125d78 removes the excluded implementation corpse, exact 7374be5e removes split-snapshot current-work projection, exact 5f1bea39 removes the second fulfillment/replay store snapshot, and exact 2bcbf268 makes current work the sole coordinator scheduling projection. Ghostlight exact 8e7d980 pins the same Connector source contract. Historical c011 and partial Gate roots stay untouched/read-only. - next_action: Resolve the Idunn package-only authority gap before constructing Ox17. The current bounded-redeploy route continues from compile/test/seal into publication, Body mutation, service start, health admission, and deployment.env, so it cannot prove a private pre-admission capstone. Do not invoke that helper, the root manifest, or a Starfire/local build as a substitute. Obtain an Idunn-owned compile-test-seal-only command that structurally cannot mutate production; then run private fresh-store Ox17 from its immutable exact ed4ca58c witness. Atlas Gate 1 and production remain paused. - ox17_package_authority_gap: Read-only Yggdrasil preflight on 2026-08-25 proves Idunn provenance exact and active with zero restarts, Epiphany units loaded but inactive, production witness still exact d2ca6630, 1.8 TiB free, builder cache 1.2 GiB, immutable app releases 6.4 GiB, and no active compiler or Epiphany deployment transaction. The deployment brake denied unrelated pending actuation as expired. The gamecult-ops runbook and live actuator expose only one full Epiphany deployment transaction; Odin Idunn exposes restart/redeploy but no package-only lifecycle action. Granting bounded redeploy would violate the required package-before-admission ordering. This is an Idunn owner/API gap, not permission for shell surgery or local compilation. + next_action: Do not issue a fourth provider attempt in container c50a1a83118d or reuse its volumes. First export and seal the consequential typed evidence, or obtain an explicit retention-owner classification that the volumes are disposable. If the operator authorizes continuation, create a new fresh Ox17 root from immutable image sha256:12bc9a30ad455db2709c0b0749bde84e1c763c5cd36d1ea158112fdaa1deed9c, verify CodexConnector caller 80de3acc and the gamecult-ops 3c2f343 bounded bridge before inference, explicitly reset the provider-failure budget for that new root, and rerun the original capstone criteria. Production and Atlas remain paused. + ox17_package_authority_gap_closed: Idunn/Odin exact fa0057c and gamecult-ops exact 3c2f343 provide an immutable image artifact witness, isolated one-shot container target, fresh private volumes, and bounded Connector route without mutating production. The former package-only blocker is historical evidence, not active direction. source_subtraction_audit_complete: Exact ed4ca58c deletes the final adopted-plan action/command forwarding wrappers and makes the operator projection plus Hands consequence validation read the owning public fields directly. The bounded closing audit found no further unearned public function in runtime_spine, state_model, current_work, resident_readiness, or resident_self: every survivor has a production consumer, and the sole low-fanout candidate authenticates the resident coordinator objective against its prepared grant or active lease. Further helper shaving has crossed into diminishing returns. The campaign stops with 2,111 net code/manifest/test lines removed across the evaluated thirty-commit downsizing sequence, two Cargo package boundaries retired, and no replacement authority, schema, process, or target added. The exact staged diff passed `git diff --cached --check`; no mixed-worktree compilation was claimed. single_snapshot_current_work_cut: Exact 7374be5e makes one pulled CultCache snapshot the sole input to Mind assembly, keyed RepoModel assembly, current-work Research and Planning lifecycles, Hands readiness, Modeling launches, reasoning-basis assembly, and Reorientation request projection. Three path-based wrappers and numerous repeated open/pull sequences are gone; Research and Verification admission also reuse their already authenticated cache for review and public-source consequence checks. The public Codex Connector client remains the earned ABI stub: deleting it would duplicate authenticated encryption and framing in every consumer, while no daemon/auth/HTTP/SSE implementation compiles into Epiphany. The cut is one net maintained line smaller, adds no schema, dependency, target, or process, and passes Core check, current-work 3/3, reasoning-context 8/8, Reorientation 1/1, Mind determinism 1/1, and RepoModel determinism 1/1. The focused run produced 2.0 GiB across 2,867 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E. single_snapshot_fulfillment_cut: Exact 5f1bea39 makes typed fulfillment replay consume the caller's already pulled runtime Mind snapshot. Research, Verification, Proposal Modeling, PlanMind continuation, fulfilled-worker archival, and Resident Self completion no longer reopen the same `.cc` file while validating one immutable result. The generic path-based fulfillment wrapper is deleted. The public provider-runtime role-result function remains the sole path-based CAS writer; cache-local fulfillment can only replay the exact result already present in its supplied snapshot. The cut adds 17 maintained lines net to remove repeated physical reads while adding no schema, dependency, target, process, or decision authority. Core check, current-work 3/3, reasoning-context 8/8, structured-failure refusal, and the release-owned swarm entrypoint pass. Verification produced 2.2 GiB across 3,189 files; cleanup restored the exact authenticated state inspector.