Expose exact resident readiness refusals

epiphany-core/src/resident_readiness.rs

@@ -482,7 +482,7 @@ fn provider_is_fresh(
         created_at_rfc3339: None,
         executable_path: PathBuf::from(&value.process_executable_path),
     }) == ProcessInstanceObservation::ExactAlive;
-    let ready = provider_matches_authority(
+    let failures = provider_authority_failures(
         &value,
         owner,
         request.release_runtime_id,
@@ -494,12 +494,63 @@ fn provider_is_fresh(
         request.freshness_millis,
         exact_process,
     );
-    if !ready {
+    if !failures.is_empty() {
         reasons.push(format!(
-            "{owner} provider readiness is stale or release-substituted"
+            "{owner} provider readiness failed predicates: {}",
+            failures.join(",")
         ));
     }
-    ready
+    failures.is_empty()
+}
+
+#[allow(clippy::too_many_arguments)]
+fn provider_authority_failures(
+    value: &ResidentProviderReadiness,
+    owner: &str,
+    runtime_id: &str,
+    release_id: &str,
+    witness: &str,
+    source_commit: Option<&str>,
+    executable: Option<&Path>,
+    now_millis: u64,
+    freshness_millis: u64,
+    exact_process_alive: bool,
+) -> Vec<&'static str> {
+    let mut failures = Vec::new();
+    if value.provider != owner {
+        failures.push("owner");
+    }
+    if value.runtime_id != runtime_id {
+        failures.push("runtime");
+    }
+    if value.release_id != release_id {
+        failures.push("release");
+    }
+    if value.release_witness_sha256 != witness {
+        failures.push("witness");
+    }
+    if !source_commit.is_some_and(|commit| commit == value.source_commit) {
+        failures.push("source-commit");
+    }
+    if !executable.is_some_and(|path| {
+            canonical_or_absolute(path)
+                == canonical_or_absolute(Path::new(&value.process_executable_path))
+        })
+    {
+        failures.push("executable");
+    }
+    if value.status != "ready" {
+        failures.push("provider-status");
+    }
+    if !exact_process_alive {
+        failures.push("process-incarnation");
+    }
+    if now_millis < value.observed_at_millis {
+        failures.push("future-observation");
+    } else if now_millis.saturating_sub(value.observed_at_millis) > freshness_millis {
+        failures.push("freshness");
+    }
+    failures
 }
 
 #[allow(clippy::too_many_arguments)]
@@ -515,19 +566,19 @@ fn provider_matches_authority(
     freshness_millis: u64,
     exact_process_alive: bool,
 ) -> bool {
-    value.provider == owner
-        && value.runtime_id == runtime_id
-        && value.release_id == release_id
-        && value.release_witness_sha256 == witness
-        && source_commit.is_some_and(|commit| commit == value.source_commit)
-        && executable.is_some_and(|path| {
-            canonical_or_absolute(path)
-                == canonical_or_absolute(Path::new(&value.process_executable_path))
-        })
-        && value.status == "ready"
-        && exact_process_alive
-        && now_millis >= value.observed_at_millis
-        && now_millis.saturating_sub(value.observed_at_millis) <= freshness_millis
+    provider_authority_failures(
+        value,
+        owner,
+        runtime_id,
+        release_id,
+        witness,
+        source_commit,
+        executable,
+        now_millis,
+        freshness_millis,
+        exact_process_alive,
+    )
+    .is_empty()
 }
 
 fn distinct_physical_paths(left: &Path, right: &Path) -> bool {
@@ -770,6 +821,38 @@ mod tests {
         assert!(reasons[0].contains("PID was reused"));
     }
 
+    #[test]
+    fn provider_authority_reports_exact_failed_predicates() {
+        let mut value = provider();
+        value.runtime_id = "wrong-runtime".into();
+        value.release_id = "wrong-release".into();
+        value.status = "warming".into();
+        value.observed_at_millis = 2_000;
+        let executable = PathBuf::from(&value.process_executable_path);
+
+        assert_eq!(
+            provider_authority_failures(
+                &value,
+                "heartbeat",
+                "ygg",
+                "release-a",
+                &value.release_witness_sha256,
+                Some("commit-a"),
+                Some(&executable),
+                1_500,
+                180_000,
+                false,
+            ),
+            vec![
+                "runtime",
+                "release",
+                "provider-status",
+                "process-incarnation",
+                "future-observation",
+            ]
+        );
+    }
+
     #[test]
     fn aggregate_pair_warms_on_missing_and_rejects_wrong_release() -> Result<()> {
         let temp = tempfile::tempdir()?;

notes/fresh-workspace-handoff.md

@@ -2918,3 +2918,36 @@ transaction is already exact-replay idempotent, so no speculative current-claim
 query is needed in front of it. Current claim sight is recovery output, not
 recovery input. A source-order test makes the authority ordering explicit. Full
 library passes 574/574 with one ignored; supervisor authority tests pass 24/24.
+
+## Ordinary organizational product and current readiness refusal (2026-07-19)
+
+The Yggdrasil body is the normal organizational Epiphany product, not a special
+experiment or dogfood mode. Persistent Modeling maps the authorized domain.
+Resident Self may derive direction from the admitted map and ask Imagination
+for bounded proposals without waiting for an instruction. Organization members
+talk to the repository Persona; their attributed conversation becomes
+additional feedback pressure. Conversation is not the ignition key and cannot
+adopt Mind state, authorize Hands, grant Persona public speech, cross Bifrost,
+or ask Idunn to deploy. Those remain distinct explicit authorities.
+
+Exact candidate `9e1fa0f527b3bff2c5a709eff640b0d8d2f3b82d` consumed recovery
+directive `6f1dc0c8-b8a5-48d0-add5-761b17368fbf`, replaced historical claim
+`c6df4335-7080-4d5f-80fc-4fa18a9d16ce` with current claim
+`2a355736-3792-4f0f-8633-a246219bcf1b`, and completed a 14,793-point local
+Qdrant projection through Yggdrasil's GTX 1080-backed Ollama route. Its three
+service owners remain active with zero restarts and the all-scope deployment
+brake engaged. It is not deployed: Idunn's exact transaction PGID `1245215`
+still owns the candidate, `deployment.env` is absent, and typed resident
+readiness remains `warming` because both provider comparisons refuse.
+
+Both provider rows continue to refresh, name the exact release
+`sha256-0a15262fd4c240a0131755aa6eb63b4eb7feff12e7cc4f49128fbb001887b1f2`,
+witness `sha256-49ae1afcf11d18c0e2807ea53f54dba35df4280f6596e848c5cfc50328e01aea`,
+source commit, executable, and local status `ready`. The old diagnostic
+`stale or release-substituted` collapses owner, runtime, release, witness,
+source, executable, provider status, process incarnation, future time, and
+freshness into one useless phrase. Replace that opaque boolean with the same
+fail-closed predicates plus operator-safe failed-predicate names; do not relax
+admission. Keep the bounded diagnosis window while the Idunn transaction and
+brake remain exact. If transaction ownership or the brake disappears, or any
+protected surface actuates, use the existing rollback boundary immediately.

state/map.yaml

@@ -796,4 +796,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "Commit and push projector-first directive consumption, authorize the exact successor through Bifrost, and let Idunn redeploy under the engaged sleep brake. Require directive consumption to mint the exact current successor claim and recovery receipt, followed by advancing authoritative coverage, immutable package inspection, app-owned release publication, three healthy local service owners, signed aggregate health, and the final deployment.env witness. Then run the Starfire-offline rehearsal before 2026-07-22: persistent Modeling map -> autonomous bounded Imagination proposal, with classified organization feedback through Persona as an additional pressure path; explicit Mind adoption -> Hands consequence -> Bifrost release -> Idunn deployment remain separate gates. Prove replay/tamper refusal and that conversation alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."
+  next_action: "Candidate 9e1fa0f remains inside exact Idunn transaction PGID 1245215 with the all-scope brake engaged and no deployment.env witness. Recovery and 14,793-point Yggdrasil-local GPU projection succeeded; three providers are alive with zero restarts. Typed resident readiness still refuses both provider comparisons although their rows refresh and report ready. Finish the fail-closed per-predicate diagnostic cut, terminate only through Idunn's transaction boundary when the successor is ready, then Bifrost-authorize and Idunn-deploy that exact successor under brake. Require exact release/witness/source/process diagnostics, signed aggregate health, and final deployment.env before the Starfire-offline ordinary-product rehearsal: persistent Modeling map -> autonomous bounded Imagination proposal, with organization feedback through Persona as additional attributed pressure; explicit Mind adoption -> Hands consequence -> Bifrost release -> Idunn deployment remain separate gates. Prove replay/tamper refusal and that conversation alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."