diff --git a/epiphany-core/src/bin/epiphany-work.rs b/epiphany-core/src/bin/epiphany-work.rs index 734ff780..c0ceef59 100644 --- a/epiphany-core/src/bin/epiphany-work.rs +++ b/epiphany-core/src/bin/epiphany-work.rs @@ -7898,111 +7898,74 @@ fn closure_family_assertions( ); } "repo.pr_request" => { + let request = parse_repo_pr_request(&content).ok(); push_assertion( &mut assertions, "pr-request-schema-present", - content.contains("schema_version = \"epiphany.repo_pr_request.v0\""), + request + .as_ref() + .is_some_and(RepoPrRequest::has_canonical_identity), "Committed PR request carries the schema version.".to_string(), ); push_assertion( &mut assertions, "pr-request-family-present", - content.contains("safe_action_family = \"repo.pr_request\""), + request + .as_ref() + .is_some_and(RepoPrRequest::has_canonical_identity), "Committed PR request carries the safe action family.".to_string(), ); push_assertion( &mut assertions, "pr-request-summary-present", - content.contains(&compact_summary), + request + .as_ref() + .is_some_and(|request| request.summary == compact_summary), "Committed PR request contains the accepted pressure summary.".to_string(), ); push_assertion( &mut assertions, "pr-request-awaits-publication-review", - content.contains("[request]") - && content.contains("status = \"awaiting-pr-publication-review\"") - && content.contains("requested_owner = \"Bifrost/GitHub\"") - && content.contains( - "requested_effect = \"open-or-update-review-pr-from-redacted-proof-and-maintainer-context\"", - ) - && content.contains("maintainer_review_request_ref = ") - && content.contains("publication_request_ref = ") - && content.contains("sync_request_ref = "), + request + .as_ref() + .is_some_and(RepoPrRequest::awaits_owned_review), "Committed PR request waits for Bifrost/GitHub review before consequence." .to_string(), ); push_assertion( &mut assertions, "pr-request-antecedents-present", - content.contains("[antecedents]") - && content.contains("closure_review_required = true") - && content.contains("soul_verdict_required = true") - && content.contains("mind_commit_required = true") - && content.contains("public_proof_required = true") - && content.contains("maintainer_review_required = true") - && content.contains("bifrost_publication_required = true") - && content.contains("credit_ledger_required = true"), + request.as_ref().is_some_and(RepoPrRequest::has_antecedent_contract), "Committed PR request requires closure, Soul, Mind, proof, review, Bifrost, and credit antecedents." .to_string(), ); push_assertion( &mut assertions, "pr-request-receipt-contract", - content.contains("[required_receipts]") - && content.contains( - "closure_review = \"epiphany.repo_work_closure_review.v0\"", - ) - && content.contains( - "soul_verdict = \"epiphany.soul.verification_verdict\"", - ) - && content.contains("mind_commit = \"epiphany.mind.state_commit_receipt\"") - && content.contains( - "public_proof = \"epiphany.repo_work_public_proof_bundle.v0\"", - ) - && content.contains( - "maintainer_review = \"gamecult.maintainer.review_receipt.v0\"", - ) - && content.contains("bifrost_publication = \"gamecult.bifrost.public_proof_publication_receipt.v0\"") - && content.contains("credit_ledger = \"gamecult.bifrost.credit_receipt.v0\"") - && content.contains("pr_publication = \"gamecult.github.pull_request_publication_receipt.v0\""), + request.as_ref().is_some_and(RepoPrRequest::has_receipt_contract), "Committed PR request names closure, proof, review, Bifrost, credit, and PR publication receipts." .to_string(), ); push_assertion( &mut assertions, "pr-request-packet-contract", - content.contains("[pr_packet]") - && content.contains("base_ref = \"origin/main\"") - && content.contains("requires_branch_name = true") - && content.contains("requires_title = true") - && content.contains("requires_body = true") - && content.contains("requires_changed_path_list = true") - && content.contains("requires_public_proof_ref = true") - && content.contains("requires_maintainer_review_ref = true") - && content.contains("requires_credit_ref = true") - && content.contains("requires_private_state_redaction_check = true"), + request.as_ref().is_some_and(RepoPrRequest::has_packet_contract), "Committed PR request names branch, title/body, path, proof, review, credit, and redaction requirements." .to_string(), ); push_assertion( &mut assertions, "pr-request-authority-seals", - content.contains("[authority]") - && content.contains("github_pr_authorized = false") - && content.contains("branch_push_authorized = false") - && content.contains("merge_authorized = false") - && content.contains("publication_authorized = false") - && content.contains("upstream_sync_authorized = false") - && content.contains("hands_action_authorized = false") - && content.contains("cross_body_mutation_authorized = false") - && content.contains("bifrost_or_maintainer_authority_required = true"), + request.as_ref().is_some_and(RepoPrRequest::has_authority_seals), "Committed PR request denies PR/push/merge/publication/sync/action/cross-body authority." .to_string(), ); push_assertion( &mut assertions, "pr-request-private-seal", - content.contains("private_state_exposed = false"), + request + .as_ref() + .is_some_and(|request| !request.private_state_exposed), "Committed PR request preserves the private-state seal.".to_string(), ); } @@ -15458,6 +15421,7 @@ idunn_deployment_authority_required = true "repo.tool_request", "repo.publication_request", "repo.sync_request", + "repo.pr_request", "repo.credit_request", "repo.artifact_acceptance_request", "repo.metrics_request", diff --git a/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs b/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs index 9fb195a6..1802adc8 100644 --- a/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs +++ b/epiphany-core/src/bin/epiphany_work/closure_contracts/external_governance.rs @@ -665,4 +665,26 @@ impl RepoSyncRequest { pub(super) fn parse_repo_sync_request(text:&str)->Result{toml::from_str(text).context("sync request is not valid typed TOML")} +#[derive(Debug, Deserialize)] +pub(super) struct RepoPrRequest { + pub(super) schema_version:String, pub(super) safe_action_family:String, + pub(super) summary:String, pub(super) private_state_exposed:bool, + request:RepoPrRequestBody, antecedents:RepoPrAntecedents, + required_receipts:RepoPrReceipts, pr_packet:RepoPrPacket, authority:RepoPrAuthority, +} +impl RepoPrRequest { + pub(super) fn has_canonical_identity(&self)->bool{self.schema_version=="epiphany.repo_pr_request.v0"&&self.safe_action_family=="repo.pr_request"} + pub(super) fn awaits_owned_review(&self)->bool{let r=&self.request;r.status=="awaiting-pr-publication-review"&&r.requested_owner=="Bifrost/GitHub"&&r.requested_effect=="open-or-update-review-pr-from-redacted-proof-and-maintainer-context"&&!r.maintainer_review_request_ref.is_empty()&&!r.publication_request_ref.is_empty()&&!r.sync_request_ref.is_empty()} + pub(super) fn has_antecedent_contract(&self)->bool{let a=&self.antecedents;a.closure_review_required&&a.soul_verdict_required&&a.mind_commit_required&&a.public_proof_required&&a.maintainer_review_required&&a.bifrost_publication_required&&a.credit_ledger_required} + pub(super) fn has_receipt_contract(&self)->bool{let r=&self.required_receipts;r.closure_review=="epiphany.repo_work_closure_review.v0"&&r.soul_verdict=="epiphany.soul.verification_verdict"&&r.mind_commit=="epiphany.mind.state_commit_receipt"&&r.public_proof=="epiphany.repo_work_public_proof_bundle.v0"&&r.maintainer_review=="gamecult.maintainer.review_receipt.v0"&&r.bifrost_publication=="gamecult.bifrost.public_proof_publication_receipt.v0"&&r.credit_ledger=="gamecult.bifrost.credit_receipt.v0"&&r.pr_publication=="gamecult.github.pull_request_publication_receipt.v0"} + pub(super) fn has_packet_contract(&self)->bool{let p=&self.pr_packet;p.base_ref=="origin/main"&&p.requires_branch_name&&p.requires_title&&p.requires_body&&p.requires_changed_path_list&&p.requires_public_proof_ref&&p.requires_maintainer_review_ref&&p.requires_credit_ref&&p.requires_private_state_redaction_check} + pub(super) fn has_authority_seals(&self)->bool{let a=&self.authority;a.branch_local_only&&!a.github_pr_authorized&&!a.branch_push_authorized&&!a.merge_authorized&&!a.publication_authorized&&!a.upstream_sync_authorized&&!a.hands_action_authorized&&!a.service_lifecycle_authority&&!a.cross_body_mutation_authorized&&!a.private_verse_rummaging&&a.bifrost_or_maintainer_authority_required} +} +#[derive(Debug,Deserialize)] struct RepoPrRequestBody{status:String,requested_owner:String,requested_effect:String,maintainer_review_request_ref:String,publication_request_ref:String,sync_request_ref:String} +#[derive(Debug,Deserialize)] struct RepoPrAntecedents{closure_review_required:bool,soul_verdict_required:bool,mind_commit_required:bool,public_proof_required:bool,maintainer_review_required:bool,bifrost_publication_required:bool,credit_ledger_required:bool} +#[derive(Debug,Deserialize)] struct RepoPrReceipts{closure_review:String,soul_verdict:String,mind_commit:String,public_proof:String,maintainer_review:String,bifrost_publication:String,credit_ledger:String,pr_publication:String} +#[derive(Debug,Deserialize)] struct RepoPrPacket{base_ref:String,requires_branch_name:bool,requires_title:bool,requires_body:bool,requires_changed_path_list:bool,requires_public_proof_ref:bool,requires_maintainer_review_ref:bool,requires_credit_ref:bool,requires_private_state_redaction_check:bool} +#[derive(Debug,Deserialize)] struct RepoPrAuthority{branch_local_only:bool,github_pr_authorized:bool,branch_push_authorized:bool,merge_authorized:bool,publication_authorized:bool,upstream_sync_authorized:bool,hands_action_authorized:bool,service_lifecycle_authority:bool,cross_body_mutation_authorized:bool,private_verse_rummaging:bool,bifrost_or_maintainer_authority_required:bool} +pub(super) fn parse_repo_pr_request(text:&str)->Result{toml::from_str(text).context("PR request is not valid typed TOML")} + include!("external_governance_tests.rs"); diff --git a/notes/conceptual-substitution-audit-2026-07-12.md b/notes/conceptual-substitution-audit-2026-07-12.md index ce74be6b..7f02faea 100644 --- a/notes/conceptual-substitution-audit-2026-07-12.md +++ b/notes/conceptual-substitution-audit-2026-07-12.md @@ -964,6 +964,17 @@ names must remain absent, while exactly seven persisted Bifrost `/latest` key strings must remain. This prevents either semantic regression or accidental storage-contract churn. +## PR-request prose substituted for GitHub authority + +`repo.pr_request` closure now parses exact typed request ownership, +antecedents, receipt chain, PR packet, and authority seals inside external +governance. Bifrost/GitHub and Maintainer remain consequence owners; the +request grants no PR, push, merge, publication, sync, Hands, lifecycle, or +cross-body authority. The class-level guard prevents substring fallback. + +Eleven high-authority closure families are now typed; 620 substring assertions +remain in the measured closure region. + The same inspection found 33 consecutive duplicate `#[cfg(test)]` attributes on provider constructors/writers and their re-exports. One gate already makes each item test-only; the second owned nothing. The duplicates are removed. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index da9c1743..b001b0cd 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -299,6 +299,11 @@ external string values retain the `/latest` storage spelling. Regression test `bifrost_mirrors_name_arrival_order_without_rewriting_storage_keys` guards honest Rust vocabulary and the seven stable persisted keys together. +PR-request closure is now typed within external governance and protected by the +class no-substring guard. Current count: eleven typed high-authority families +and 620 remaining closure substring assertions. Add the explicit malicious PR +grant fixture next so semantic evidence matches the other external contracts. + The latest structural count is 32 closure family branches, 744 remaining substring assertions in the closure region, and 1,284 lines in `closure_contracts.rs`. Do not blindly generate a struct forest for every diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 8ce7b3e7..67740c60 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 0c25c16a..48db9748 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -660,4 +660,4 @@ current_status: - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - next_action: Continue the conceptual-substitution pass. Ten high-authority closure families, including publication and sync requests, are typed and guarded against regaining substring authority; sync has an explicit malicious push-grant fixture. The closure region still has 32 family branches and 667 substring assertions; closure contracts remain a parent-private lexical facade over external_governance and operations authority domains. External governance production anatomy is 668 lines and its counterfeit fixtures live in a dedicated private test include. Do not substitute a blind struct forest for coherent ownership. Provider chronology is explicitly external: Bifrost receipt contracts lack provider timestamp/revision, so Epiphany mirrors know only arrival order; all Rust/operator vocabulary says arrival latest while exactly seven persisted /latest strings remain under a regression invariant. Thirty-three duplicate test gates around provider writers/re-exports are removed while single test-only gates remain. Prioritize consequence-bearing request families and continue auditing evidence/security mirrors and adapters for borrowed authority. + next_action: Continue the conceptual-substitution pass. Eleven high-authority closure families, now including PR request, are typed and guarded against regaining substring authority. The closure region still has 32 family branches and 620 substring assertions; closure contracts remain a parent-private lexical facade over external_governance and operations authority domains. Add the explicit malicious PR authority fixture next, then prioritize remaining consequence-bearing request families without building a blind struct forest. Provider chronology is explicitly external: Bifrost receipt contracts lack provider timestamp/revision, so Epiphany mirrors know only arrival order; all Rust/operator vocabulary says arrival latest while exactly seven persisted /latest strings remain under a regression invariant. Continue auditing evidence/security mirrors and adapters for borrowed authority.