GameCult/Epiphany
Archived
Watch
9
0
Fork
You've already forked Epiphany
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Type PR request closure semantics

Browse source
This commit is contained in:
Meta Vens 2026-07-13 03:07:56 +01:00
commit ccf897dbff
6 changed files with 60 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

78
epiphany-core/src/bin/epiphany-work.rs
View file

@ -7898,111 +7898,74 @@ fn closure_family_assertions(
);
}
"repo.pr_request" => {
let request = parse_repo_pr_request(&content).ok();
push_assertion(
&mut assertions,
"pr-request-schema-present",
content.contains("schema_version = \"epiphany.repo_pr_request.v0\""),
request
.as_ref()
.is_some_and(RepoPrRequest::has_canonical_identity),
"Committed PR request carries the schema version.".to_string(),
);
push_assertion(
&mut assertions,
"pr-request-family-present",
content.contains("safe_action_family = \"repo.pr_request\""),
request
.as_ref()
.is_some_and(RepoPrRequest::has_canonical_identity),
"Committed PR request carries the safe action family.".to_string(),
);
push_assertion(
&mut assertions,
"pr-request-summary-present",
content.contains(&compact_summary),
request
.as_ref()
.is_some_and(|request| request.summary == compact_summary),
"Committed PR request contains the accepted pressure summary.".to_string(),
);
push_assertion(
&mut assertions,
"pr-request-awaits-publication-review",
content.contains("[request]")
&& content.contains("status = \"awaiting-pr-publication-review\"")
&& content.contains("requested_owner = \"Bifrost/GitHub\"")
&& content.contains(
"requested_effect = \"open-or-update-review-pr-from-redacted-proof-and-maintainer-context\"",
)
&& content.contains("maintainer_review_request_ref = ")
&& content.contains("publication_request_ref = ")
&& content.contains("sync_request_ref = "),
request
.as_ref()
.is_some_and(RepoPrRequest::awaits_owned_review),
"Committed PR request waits for Bifrost/GitHub review before consequence."
.to_string(),
);
push_assertion(
&mut assertions,
"pr-request-antecedents-present",
content.contains("[antecedents]")
&& content.contains("closure_review_required = true")
&& content.contains("soul_verdict_required = true")
&& content.contains("mind_commit_required = true")
&& content.contains("public_proof_required = true")
&& content.contains("maintainer_review_required = true")
&& content.contains("bifrost_publication_required = true")
&& content.contains("credit_ledger_required = true"),
request.as_ref().is_some_and(RepoPrRequest::has_antecedent_contract),
"Committed PR request requires closure, Soul, Mind, proof, review, Bifrost, and credit antecedents."
.to_string(),
);
push_assertion(
&mut assertions,
"pr-request-receipt-contract",
content.contains("[required_receipts]")
&& content.contains(
"closure_review = \"epiphany.repo_work_closure_review.v0\"",
)
&& content.contains(
"soul_verdict = \"epiphany.soul.verification_verdict\"",
)
&& content.contains("mind_commit = \"epiphany.mind.state_commit_receipt\"")
&& content.contains(
"public_proof = \"epiphany.repo_work_public_proof_bundle.v0\"",
)
&& content.contains(
"maintainer_review = \"gamecult.maintainer.review_receipt.v0\"",
)
&& content.contains("bifrost_publication = \"gamecult.bifrost.public_proof_publication_receipt.v0\"")
&& content.contains("credit_ledger = \"gamecult.bifrost.credit_receipt.v0\"")
&& content.contains("pr_publication = \"gamecult.github.pull_request_publication_receipt.v0\""),
request.as_ref().is_some_and(RepoPrRequest::has_receipt_contract),
"Committed PR request names closure, proof, review, Bifrost, credit, and PR publication receipts."
.to_string(),
);
push_assertion(
&mut assertions,
"pr-request-packet-contract",
content.contains("[pr_packet]")
&& content.contains("base_ref = \"origin/main\"")
&& content.contains("requires_branch_name = true")
&& content.contains("requires_title = true")
&& content.contains("requires_body = true")
&& content.contains("requires_changed_path_list = true")
&& content.contains("requires_public_proof_ref = true")
&& content.contains("requires_maintainer_review_ref = true")
&& content.contains("requires_credit_ref = true")
&& content.contains("requires_private_state_redaction_check = true"),
request.as_ref().is_some_and(RepoPrRequest::has_packet_contract),
"Committed PR request names branch, title/body, path, proof, review, credit, and redaction requirements."
.to_string(),
);
push_assertion(
&mut assertions,
"pr-request-authority-seals",
content.contains("[authority]")
&& content.contains("github_pr_authorized = false")
&& content.contains("branch_push_authorized = false")
&& content.contains("merge_authorized = false")
&& content.contains("publication_authorized = false")
&& content.contains("upstream_sync_authorized = false")
&& content.contains("hands_action_authorized = false")
&& content.contains("cross_body_mutation_authorized = false")
&& content.contains("bifrost_or_maintainer_authority_required = true"),
request.as_ref().is_some_and(RepoPrRequest::has_authority_seals),
"Committed PR request denies PR/push/merge/publication/sync/action/cross-body authority."
.to_string(),
);
push_assertion(
&mut assertions,
"pr-request-private-seal",
content.contains("private_state_exposed = false"),
request
.as_ref()
.is_some_and(|request| !request.private_state_exposed),
"Committed PR request preserves the private-state seal.".to_string(),
);
}
@ -15458,6 +15421,7 @@ idunn_deployment_authority_required = true
"repo.tool_request",
"repo.publication_request",
"repo.sync_request",
"repo.pr_request",
"repo.credit_request",
"repo.artifact_acceptance_request",
"repo.metrics_request",

22
epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs
View file

@ -665,4 +665,26 @@ impl RepoSyncRequest {
pub(super) fn parse_repo_sync_request(text:&str)->Result<RepoSyncRequest>{toml::from_str(text).context("sync request is not valid typed TOML")}
#[derive(Debug, Deserialize)]
pub(super) struct RepoPrRequest {
pub(super) schema_version:String, pub(super) safe_action_family:String,
pub(super) summary:String, pub(super) private_state_exposed:bool,
request:RepoPrRequestBody, antecedents:RepoPrAntecedents,
required_receipts:RepoPrReceipts, pr_packet:RepoPrPacket, authority:RepoPrAuthority,
}
impl RepoPrRequest {
pub(super) fn has_canonical_identity(&self)->bool{self.schema_version=="epiphany.repo_pr_request.v0"&&self.safe_action_family=="repo.pr_request"}
pub(super) fn awaits_owned_review(&self)->bool{let r=&self.request;r.status=="awaiting-pr-publication-review"&&r.requested_owner=="Bifrost/GitHub"&&r.requested_effect=="open-or-update-review-pr-from-redacted-proof-and-maintainer-context"&&!r.maintainer_review_request_ref.is_empty()&&!r.publication_request_ref.is_empty()&&!r.sync_request_ref.is_empty()}
pub(super) fn has_antecedent_contract(&self)->bool{let a=&self.antecedents;a.closure_review_required&&a.soul_verdict_required&&a.mind_commit_required&&a.public_proof_required&&a.maintainer_review_required&&a.bifrost_publication_required&&a.credit_ledger_required}
pub(super) fn has_receipt_contract(&self)->bool{let r=&self.required_receipts;r.closure_review=="epiphany.repo_work_closure_review.v0"&&r.soul_verdict=="epiphany.soul.verification_verdict"&&r.mind_commit=="epiphany.mind.state_commit_receipt"&&r.public_proof=="epiphany.repo_work_public_proof_bundle.v0"&&r.maintainer_review=="gamecult.maintainer.review_receipt.v0"&&r.bifrost_publication=="gamecult.bifrost.public_proof_publication_receipt.v0"&&r.credit_ledger=="gamecult.bifrost.credit_receipt.v0"&&r.pr_publication=="gamecult.github.pull_request_publication_receipt.v0"}
pub(super) fn has_packet_contract(&self)->bool{let p=&self.pr_packet;p.base_ref=="origin/main"&&p.requires_branch_name&&p.requires_title&&p.requires_body&&p.requires_changed_path_list&&p.requires_public_proof_ref&&p.requires_maintainer_review_ref&&p.requires_credit_ref&&p.requires_private_state_redaction_check}
pub(super) fn has_authority_seals(&self)->bool{let a=&self.authority;a.branch_local_only&&!a.github_pr_authorized&&!a.branch_push_authorized&&!a.merge_authorized&&!a.publication_authorized&&!a.upstream_sync_authorized&&!a.hands_action_authorized&&!a.service_lifecycle_authority&&!a.cross_body_mutation_authorized&&!a.private_verse_rummaging&&a.bifrost_or_maintainer_authority_required}
}
#[derive(Debug,Deserialize)] struct RepoPrRequestBody{status:String,requested_owner:String,requested_effect:String,maintainer_review_request_ref:String,publication_request_ref:String,sync_request_ref:String}
#[derive(Debug,Deserialize)] struct RepoPrAntecedents{closure_review_required:bool,soul_verdict_required:bool,mind_commit_required:bool,public_proof_required:bool,maintainer_review_required:bool,bifrost_publication_required:bool,credit_ledger_required:bool}
#[derive(Debug,Deserialize)] struct RepoPrReceipts{closure_review:String,soul_verdict:String,mind_commit:String,public_proof:String,maintainer_review:String,bifrost_publication:String,credit_ledger:String,pr_publication:String}
#[derive(Debug,Deserialize)] struct RepoPrPacket{base_ref:String,requires_branch_name:bool,requires_title:bool,requires_body:bool,requires_changed_path_list:bool,requires_public_proof_ref:bool,requires_maintainer_review_ref:bool,requires_credit_ref:bool,requires_private_state_redaction_check:bool}
#[derive(Debug,Deserialize)] struct RepoPrAuthority{branch_local_only:bool,github_pr_authorized:bool,branch_push_authorized:bool,merge_authorized:bool,publication_authorized:bool,upstream_sync_authorized:bool,hands_action_authorized:bool,service_lifecycle_authority:bool,cross_body_mutation_authorized:bool,private_verse_rummaging:bool,bifrost_or_maintainer_authority_required:bool}
pub(super) fn parse_repo_pr_request(text:&str)->Result<RepoPrRequest>{toml::from_str(text).context("PR request is not valid typed TOML")}
include!("external_governance_tests.rs");

11
notes/conceptual-substitution-audit-2026-07-12.md
View file

@ -964,6 +964,17 @@ names must remain absent, while exactly seven persisted Bifrost `/latest` key
strings must remain. This prevents either semantic regression or accidental
storage-contract churn.
## PR-request prose substituted for GitHub authority
`repo.pr_request` closure now parses exact typed request ownership,
antecedents, receipt chain, PR packet, and authority seals inside external
governance. Bifrost/GitHub and Maintainer remain consequence owners; the
request grants no PR, push, merge, publication, sync, Hands, lifecycle, or
cross-body authority. The class-level guard prevents substring fallback.
Eleven high-authority closure families are now typed; 620 substring assertions
remain in the measured closure region.
The same inspection found 33 consecutive duplicate `#[cfg(test)]` attributes
on provider constructors/writers and their re-exports. One gate already makes
each item test-only; the second owned nothing. The duplicates are removed.

5
notes/fresh-workspace-handoff.md
View file

@ -299,6 +299,11 @@ external string values retain the `/latest` storage spelling.
Regression test `bifrost_mirrors_name_arrival_order_without_rewriting_storage_keys`
guards honest Rust vocabulary and the seven stable persisted keys together.
PR-request closure is now typed within external governance and protected by the
class no-substring guard. Current count: eleven typed high-authority families
and 620 remaining closure substring assertions. Add the explicit malicious PR
grant fixture next so semantic evidence matches the other external contracts.
The latest structural count is 32 closure family branches, 744 remaining
substring assertions in the closure region, and 1,284 lines in
`closure_contracts.rs`. Do not blindly generate a struct forest for every

BIN
state/ledgers.msgpack
View file

Binary file not shown.

2
state/map.yaml
View file

@ -660,4 +660,4 @@ current_status:
- Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
- `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
next_action: Continue the conceptual-substitution pass. Ten high-authority closure families, including publication and sync requests, are typed and guarded against regaining substring authority; sync has an explicit malicious push-grant fixture. The closure region still has 32 family branches and 667 substring assertions; closure contracts remain a parent-private lexical facade over external_governance and operations authority domains. External governance production anatomy is 668 lines and its counterfeit fixtures live in a dedicated private test include. Do not substitute a blind struct forest for coherent ownership. Provider chronology is explicitly external: Bifrost receipt contracts lack provider timestamp/revision, so Epiphany mirrors know only arrival order; all Rust/operator vocabulary says arrival latest while exactly seven persisted /latest strings remain under a regression invariant. Thirty-three duplicate test gates around provider writers/re-exports are removed while single test-only gates remain. Prioritize consequence-bearing request families and continue auditing evidence/security mirrors and adapters for borrowed authority.
next_action: Continue the conceptual-substitution pass. Eleven high-authority closure families, now including PR request, are typed and guarded against regaining substring authority. The closure region still has 32 family branches and 620 substring assertions; closure contracts remain a parent-private lexical facade over external_governance and operations authority domains. Add the explicit malicious PR authority fixture next, then prioritize remaining consequence-bearing request families without building a blind struct forest. Provider chronology is explicitly external: Bifrost receipt contracts lack provider timestamp/revision, so Epiphany mirrors know only arrival order; all Rust/operator vocabulary says arrival latest while exactly seven persisted /latest strings remain under a regression invariant. Continue auditing evidence/security mirrors and adapters for borrowed authority.