From cb665dc6362027a06d46c3fc856c8740f4ab50ce Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 19 Jul 2026 07:11:10 +0100
Subject: [PATCH] Authenticate terminal sight against historical launch

---
 .../workspace_coverage_process_documents.rs   |  41 +++++++++++++++---
 notes/fresh-workspace-handoff.md              |  24 ++++++++++
 state/ledgers.msgpack                         | Bin 532605 -> 533063 bytes
 state/map.yaml                                |   4 +-
 4 files changed, 60 insertions(+), 9 deletions(-)

diff --git a/epiphany-core/src/workspace_coverage_process_documents.rs b/epiphany-core/src/workspace_coverage_process_documents.rs
index 4c9a35e6..e4dbf1be 100644
--- a/epiphany-core/src/workspace_coverage_process_documents.rs
+++ b/epiphany-core/src/workspace_coverage_process_documents.rs
@@ -3043,6 +3043,7 @@ fn authenticate_advancement_sight(
         bail!("workspace coverage advancement sight identity disagrees");
     }
     authenticate_sight_common(
+        WorkspaceCoverageSightLaunchAuthority::Current,
         runtime_store,
         local_verse_store,
         runtime_id,
@@ -3083,6 +3084,7 @@ fn authenticate_terminal_sight(
         bail!("workspace coverage terminal sight identity disagrees");
     }
     authenticate_sight_common(
+        WorkspaceCoverageSightLaunchAuthority::HistoricalTerminal,
         runtime_store,
         local_verse_store,
         runtime_id,
@@ -3111,8 +3113,15 @@ fn authenticate_terminal_sight(
     )
 }
 
+#[derive(Clone, Copy)]
+enum WorkspaceCoverageSightLaunchAuthority {
+    Current,
+    HistoricalTerminal,
+}
+
 #[allow(clippy::too_many_arguments)]
 fn authenticate_sight_common(
+    launch_authority: WorkspaceCoverageSightLaunchAuthority,
     runtime_store: &Path,
     local_verse_store: &Path,
     runtime_id: &str,
@@ -3131,13 +3140,24 @@ fn authenticate_sight_common(
     body_generation: u64,
     manifest_root_sha256: &str,
 ) -> Result<()> {
-    let (launch, exact_launch_digest) =
-        authenticate_workspace_coverage_managed_process_launch_with_envelope_digest(
-            local_verse_store,
-            runtime_id,
-            launch_id,
-            host,
-        )?;
+    let (launch, exact_launch_digest) = match launch_authority {
+        WorkspaceCoverageSightLaunchAuthority::Current => {
+            authenticate_workspace_coverage_managed_process_launch_with_envelope_digest(
+                local_verse_store,
+                runtime_id,
+                launch_id,
+                host,
+            )?
+        }
+        WorkspaceCoverageSightLaunchAuthority::HistoricalTerminal => {
+            authenticate_historical_workspace_coverage_managed_process_launch_with_envelope_digest(
+                local_verse_store,
+                runtime_id,
+                launch_id,
+                host,
+            )?
+        }
+    };
     if exact_launch_digest != launch_digest
         || launch.provider_incarnation_id != provider_incarnation_id
         || launch.provider_public_key != provider_public_key
@@ -3909,6 +3929,13 @@ mod tests {
             &provider,
             chrono::Utc::now(),
         )?;
+        let mut rotated_policy = policy.clone();
+        rotated_policy.updated_at_utc = "2026-07-17T00:00:01Z".into();
+        write_epiphany_cultmesh_workspace_coverage_projector_service_policy(
+            &verse,
+            "local",
+            rotated_policy,
+        )?;
         let historical_sight = publish_workspace_coverage_terminal_sight(
             &verse,
             &runtime,
diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md
index c0f17a4a..73cc5f8a 100644
--- a/notes/fresh-workspace-handoff.md
+++ b/notes/fresh-workspace-handoff.md
@@ -2997,3 +2997,27 @@ and deployment under the all-scope brake.
 Next action: monitor Idunn's exact successor transaction. Require historical terminal-sight reuse,
 three stable services, typed resident readiness, signed aggregate health, and
 `deployment.env` before beginning the ordinary organizational product loop.
+
+Candidate `519574ce0d63ffa8fa813885c6629c664a3ae2e0` sealed release
+`sha256-3bfbd4640f7259613ea6146fe80d6a68c9be55edb1ad100fb3c39a4f0e040e3e`
+and started all three braked services with zero restarts. The installed
+pre-witness check was healthy, proving terminal coverage and resident readiness
+were present, but the workspace projector still refused every pulse with
+`workspace coverage launch disagrees with current managed policy`; the
+supervisor then issued recovery directive `9084c09e-1da9-4187-acd4-6b214edd7fb2`
+for the already-succeeded claim. Idunn correctly withheld signed admission and
+`deployment.env`.
+
+The surviving obsolete owner was inside terminal-sight authentication itself.
+Both advancing and terminal sights shared current-policy launch authentication.
+That is correct for a live advancing lease and wrong for immutable terminal
+proof. Sight authentication now has an explicit authority split: advancement
+requires a current-policy launch; terminal requires its exact historical
+host-signed launch and envelope. Policy rotation cannot invalidate or re-sign
+the succeeded claim's sight. The real checkpoint-to-terminal fixture now
+rotates managed policy before a later daemon reuses the original sight
+byte-for-byte.
+
+Next action: commit/push this correction, revoke `519574ce`, terminate exact
+Idunn transaction PGID `1534830`, verify signal-safe rollback, then cross the
+exact successor through Bifrost and Idunn under brake.
diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack
index a4094cb197c18634e9814a916e4d9b3607cf4715..c78e967643d757e8dd9f64ece1d9f4161f9773f3 100644
GIT binary patch
delta 508
zcmZWlyH3ME5X9k?h7Qpn&_+<=5Jx0YBBkOJNJV!!FZjT@Gk0r)s}vOc01*;jfkc7m
zC=mP#4WEF-8V3uBVzkoE&hE~9y}<h`JZyMt-9ZoxTEX$#LcOv3xZ_=T-sknKb~CGa
zjG`_wmKe*76~^k*tXBWnTEBg6x7uC5)$@b?s8#N{3mV?$^!`xjP=$gJIzhkFJCF#8
zH5rCLXeUaG7%YlVX><<8DHZG)N-}oer3u<hIb*?*ii^R5VQHis4=BmvYKv2+5rH`2
z1|%j{G6!p>BuE(zW0WFw2tPx<G?NK8MM@EB;x)xi%+Tf#i&V=9gaesc%WM;ll2}ox
ztY}v9eaZo^n3am+d;lWMgqApA)o`w!&R^N9{v7`KJu;4beo6EB@^BMI5eJ0Uu|w|4
t2<3TVlqR2yUwI{T1lnA(LpF%+*Dz;Yrpr<0gudDiON0M%vdD2XzX9@axLyDN

delta 67
zcmX?pMB(oNg$-hiyrxzr7FLF)QO6iK<fAq#GZr#3zG<Gy)IODo5r{!FGZ3=?F)I+W
N0WtgbsZ1O%WC80S6%qgd

diff --git a/state/map.yaml b/state/map.yaml
index 110993cd..f6da6968 100644
--- a/state/map.yaml
+++ b/state/map.yaml
@@ -3,7 +3,7 @@ experiment:
   repository_body_observer: "Native Rust explicitly binds caller workspace ID to an existing validated runtime/swarm/source identity plus canonical Git root/object format/scope/policy. Bind also installs one immutable runtime-side RuntimeRepositoryBodyStoreBinding naming the canonical external Body-store locator and exact Body-binding hash; every read revalidates runtime/swarm/workspace/path/body identity and refuses a second store. Two equal sanitized temporary-index scans enumerate ignore-aware UTF-8 paths, Git modes, and nonrecursive gitlinks with global excludes disabled; raw regular bytes/lengths and non-followed symlink-target bytes are SHA-256 hashed. The domain-separated ordered raw manifest root, not the clean-filtered auxiliary tree OID, is authoritative Body identity. Every Git subprocess strips ambient repository/worktree/object/ref/index/namespace/replacement/graft/shallow and config-injection authority. Observe cannot mint identity. CultCache MessagePack atomically commits immutable manifest+observation and a manifest-root head by exact CAS. Canonical store-path checks precede writes; corrupt HEAD, sparse checkout, unsafe/unrepresentable paths, racing reads, and repo/runtime substitution fail closed. Only accepted stable observations persist; errors advance no head. Unchanged raw manifest preserves generation; status is read-pure. The observer owns bounded current-state identity, makes no historical continuity claim, and has no Ready field. The runtime route is locator authority only, not proof of model grounding."
   modeling_body_grounding: "Every coordinator-owned Modeling launch observes and carries one typed RepositoryBodyObservationBasis before worker thought. The immutable launch binds runtime/swarm/workspace/scope, Body-binding hash, observation generation/id/root, and scan interval. Modeling output contract v3 requires the exact worker-authored echo; ingress reloads the immutable launch and rejects missing/swapped basis, while non-Modeling cargo is forbidden. Mind admission review v1 and receipt v5 preserve that basis; admission validates exact launch/result/review equality plus the immutable historical Body artifacts, then copies it into the CAS receipt. Admission never samples current Body as a substitute. Direct Mind plan adoption and legacy migration remain explicitly ungrounded."
   workspace_retrieval_coverage: "The production-unwired retrieval.rs oracle is deleted. Legacy EpiphanyRetrievalState is presentation-only: clean Ready projects Missing and its indexing job is unavailable/unowned. Native coverage binds an authenticated Repository Body manifest, exhaustive versioned inclusion policy, deterministic chunks/point payloads, immutable Ollama tag+artifact digest identity, vector dimensions, exact Qdrant point/payload/vector observations, and one terminal-CAS receipt/head. A read-only live evidence reader now re-scrolls the exact compatible collection, recomputes payload/vector bindings, and byte-revalidates the entire authority chain after the external read. Coverage success proves only this exact Body projection; Mind alone may join it with the other repository authorities."
-  workspace_coverage_projector: "The dedicated workspace-coverage projector exclusively owns the pinned Redb coverage store and all obligation, plan, claim, attempt, checkpoint, progress, recovery, receipt, and head writes. Repository Body remains read-only substrate authority; local Verse carries signed claim sight, immutable terminal sight, and recovery directives, not private coverage truth. A succeeded claim and its historical managed launch own durable terminal coverage; later daemon launches may authenticate and reuse the exact signed terminal sight but cannot inherit or rewrite the terminal receipt. Projector pulse classifies terminal coverage before process recovery, while recovery still precedes all nonterminal acquisition and claim work. Projection advances in waited Qdrant batches of at most 128 points with exact payload/vector readback before each authenticated checkpoint. The supervisor may observe provider-signed claim sight and publish a host-signed recovery directive after exact termination, but may not open or mutate the coverage store. Idunn owns deployment and recovery routing, never projection truth."
+  workspace_coverage_projector: "The dedicated workspace-coverage projector exclusively owns the pinned Redb coverage store and all obligation, plan, claim, attempt, checkpoint, progress, recovery, receipt, and head writes. Repository Body remains read-only substrate authority; local Verse carries signed claim sight, immutable terminal sight, and recovery directives, not private coverage truth. A succeeded claim and its historical managed launch own durable terminal coverage; later daemon launches may authenticate and reuse the exact signed terminal sight but cannot inherit or rewrite the terminal receipt. Advancement sight requires exact current-policy launch authority; terminal sight requires its exact historical host-signed launch/envelope and survives managed-policy rotation. Projector pulse classifies terminal coverage before process recovery, while recovery still precedes all nonterminal acquisition and claim work. Projection advances in waited Qdrant batches of at most 128 points with exact payload/vector readback before each authenticated checkpoint. The supervisor may observe provider-signed claim sight and publish a host-signed recovery directive after exact termination, but may not open or mutate the coverage store. Idunn owns deployment and recovery routing, never projection truth."
   workspace_coverage_checkpoint: "The pinned Redb workspace-coverage store is operational authority. A checkpoint binds one contiguous plan batch, exact waited Qdrant readback, predecessor lineage, current Body, claim, attempt, launch, provider, and release. Progress derives from the admitted checkpoint. Existing one-point histories remain valid predecessors, while current production cadence is bounded at 128 points to avoid pathological immutable-history amplification. Qdrant remains disposable derived state; counts without authenticated bindings cannot resume work or prove readiness."
   repository_readiness_join: "Mind owns the implemented race-bounded RepositoryReadinessProjection operation. It freshly observes Body R1; derives canonical RepoModel, the unique current v5 Body-grounded admission, and the complete succeeded Modeling semantic chain from one raw opening CultCache snapshot; authenticates live semantic vectors and live workspace coverage bound to R1; observes Body R2 and requires the same content identity/root; repeats both live reads; derives the closing authority from one raw full snapshot; and atomically appends a historical observed-ready-at projection only if that complete snapshot is unchanged. Stored projections never grant current readiness. A→B→A is acceptable only as equal content-addressed endpoints. CultCache now fences full-snapshot cardinality with tuple (type,key) identity. Legacy retrieval Ready, timestamps, watcher silence, Git OIDs, collection existence/counts, Hands receipts, Eve/Gjallar, and prior readiness projections are forbidden substitutes."
   coordinator_grounding_loop: "Cold start is owned by one typed UserObjectiveIntake that atomically seeds thread state and refuses objective replacement; a missing checkpoint routes to Modeling rather than a fictional prepareCheckpoint actuator. Explicit local-Verse path authority flows into launch context without sibling-path inference. Eyes and Modeling receive bounded source tools. Accepted CRRC regather findings hand source gathering to Eyes instead of recursively relaunching the continuity judge. Runtime/display/coordinator reads share the canonical typed role and reorient result readers. Failed or completed-unreviewable role outputs may be explicitly superseded by a typed review receipt; JSON null is not a state patch. Provider output schema is formatting guidance only, while canonical typed ingress and Mind remain admission authority. Modeling's provider schema now describes tagged patch operations, closed node/edge/profile vocabularies, canonical node/edge fields, anchors, code refs, observations, evidence, frontier items, and Body-basis echo. Live dogfood has accepted one code-grounded Eyes result, but no current Body-grounded Modeling admission yet: the latest Modeling run used eleven source-tool rounds then failed at the provider request boundary before publishing typed output."
@@ -796,4 +796,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "Terminal-authority successor 519574ce0d63ffa8fa813885c6629c664a3ae2e0 is committed, pushed, and Bifrost-authorized. Candidate 5e298e63 was revoked and exact Idunn PGID 1485835 proved signal-safe rollback: no services, current links, active-release.env, deployment.env, or held lock remained. Idunn command manual:redeploy:yggdrasil-epiphany:unix:1784440234 now owns the detached successor transaction under brake. Monitor its process tree and typed state; require immutable historical terminal-sight reuse, three stable services, typed resident readiness, signed aggregate health, and final deployment.env before the Starfire-offline ordinary-product rehearsal: persistent Modeling map -> autonomous bounded Imagination proposal, with organization feedback through Persona as additional attributed pressure; explicit Mind adoption -> Hands consequence -> Bifrost release -> Idunn deployment remain separate gates. Prove replay/tamper refusal and that conversation alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."
+  next_action: "Candidate 519574ce is braked and Idunn-owned at PGID 1534830 but unadmitted: all services and pre-witness readiness are healthy, while terminal-sight authentication still treated the historical succeeded launch as current-policy authority, causing projector refusal and a bogus recovery directive. Commit/push the explicit sight-authority split (advancement=current launch; terminal=historical signed launch), revoke 519574ce, terminate only PGID 1534830, and verify signal-safe rollback. Then Bifrost-authorize and Idunn-deploy the exact successor under brake. Require immutable historical terminal-sight reuse, three stable services, typed resident readiness, signed aggregate health, and final deployment.env before the Starfire-offline ordinary-product rehearsal: persistent Modeling map -> autonomous bounded Imagination proposal, with organization feedback through Persona as additional attributed pressure; explicit Mind adoption -> Hands consequence -> Bifrost release -> Idunn deployment remain separate gates. Prove replay/tamper refusal and that conversation alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."