diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 00dabf46..c0f17a4a 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -2984,9 +2984,16 @@ proves a different later launch receives the original sight byte-for-byte, and the service ordering proof fixes terminal classification before recovery and recovery before new Body work. -Next action: commit and push this successor, revoke exact candidate `5e298e63`, -terminate only Idunn transaction PGID `1485835`, and verify the installed -signal-safe rollback boundary. Then authorize and deploy the exact successor -through Bifrost and Idunn under brake. Require historical terminal-sight reuse, +The terminal-authority correction is committed and pushed as exact successor +`519574ce0d63ffa8fa813885c6629c664a3ae2e0`. + +Candidate `5e298e63` is revoked and its exact Idunn PGID `1485835` completed +the installed signal-safe rollback boundary: all three services, both current +links, both manifests, and the deployment lock were absent afterward. Bifrost +then authorized exact successor `519574ce`, and Idunn command +`manual:redeploy:yggdrasil-epiphany:unix:1784440234` owns its detached build +and deployment under the all-scope brake. + +Next action: monitor Idunn's exact successor transaction. Require historical terminal-sight reuse, three stable services, typed resident readiness, signed aggregate health, and `deployment.env` before beginning the ordinary organizational product loop. diff --git a/state/map.yaml b/state/map.yaml index 785a3f60..110993cd 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -3,7 +3,7 @@ experiment: repository_body_observer: "Native Rust explicitly binds caller workspace ID to an existing validated runtime/swarm/source identity plus canonical Git root/object format/scope/policy. Bind also installs one immutable runtime-side RuntimeRepositoryBodyStoreBinding naming the canonical external Body-store locator and exact Body-binding hash; every read revalidates runtime/swarm/workspace/path/body identity and refuses a second store. Two equal sanitized temporary-index scans enumerate ignore-aware UTF-8 paths, Git modes, and nonrecursive gitlinks with global excludes disabled; raw regular bytes/lengths and non-followed symlink-target bytes are SHA-256 hashed. The domain-separated ordered raw manifest root, not the clean-filtered auxiliary tree OID, is authoritative Body identity. Every Git subprocess strips ambient repository/worktree/object/ref/index/namespace/replacement/graft/shallow and config-injection authority. Observe cannot mint identity. CultCache MessagePack atomically commits immutable manifest+observation and a manifest-root head by exact CAS. Canonical store-path checks precede writes; corrupt HEAD, sparse checkout, unsafe/unrepresentable paths, racing reads, and repo/runtime substitution fail closed. Only accepted stable observations persist; errors advance no head. Unchanged raw manifest preserves generation; status is read-pure. The observer owns bounded current-state identity, makes no historical continuity claim, and has no Ready field. The runtime route is locator authority only, not proof of model grounding." modeling_body_grounding: "Every coordinator-owned Modeling launch observes and carries one typed RepositoryBodyObservationBasis before worker thought. The immutable launch binds runtime/swarm/workspace/scope, Body-binding hash, observation generation/id/root, and scan interval. Modeling output contract v3 requires the exact worker-authored echo; ingress reloads the immutable launch and rejects missing/swapped basis, while non-Modeling cargo is forbidden. Mind admission review v1 and receipt v5 preserve that basis; admission validates exact launch/result/review equality plus the immutable historical Body artifacts, then copies it into the CAS receipt. Admission never samples current Body as a substitute. Direct Mind plan adoption and legacy migration remain explicitly ungrounded." workspace_retrieval_coverage: "The production-unwired retrieval.rs oracle is deleted. Legacy EpiphanyRetrievalState is presentation-only: clean Ready projects Missing and its indexing job is unavailable/unowned. Native coverage binds an authenticated Repository Body manifest, exhaustive versioned inclusion policy, deterministic chunks/point payloads, immutable Ollama tag+artifact digest identity, vector dimensions, exact Qdrant point/payload/vector observations, and one terminal-CAS receipt/head. A read-only live evidence reader now re-scrolls the exact compatible collection, recomputes payload/vector bindings, and byte-revalidates the entire authority chain after the external read. Coverage success proves only this exact Body projection; Mind alone may join it with the other repository authorities." - workspace_coverage_projector: "The dedicated workspace-coverage projector exclusively owns the pinned Redb coverage store and all obligation, plan, claim, attempt, checkpoint, progress, recovery, receipt, and head writes. Repository Body remains read-only substrate authority; local Verse carries signed claim sight and recovery directives, not private coverage truth. Projection advances in waited Qdrant batches of at most 128 points with exact payload/vector readback before each authenticated checkpoint. The supervisor may observe provider-signed claim sight and publish a host-signed recovery directive after exact termination, but may not open or mutate the coverage store. Idunn owns deployment and recovery routing, never projection truth." + workspace_coverage_projector: "The dedicated workspace-coverage projector exclusively owns the pinned Redb coverage store and all obligation, plan, claim, attempt, checkpoint, progress, recovery, receipt, and head writes. Repository Body remains read-only substrate authority; local Verse carries signed claim sight, immutable terminal sight, and recovery directives, not private coverage truth. A succeeded claim and its historical managed launch own durable terminal coverage; later daemon launches may authenticate and reuse the exact signed terminal sight but cannot inherit or rewrite the terminal receipt. Projector pulse classifies terminal coverage before process recovery, while recovery still precedes all nonterminal acquisition and claim work. Projection advances in waited Qdrant batches of at most 128 points with exact payload/vector readback before each authenticated checkpoint. The supervisor may observe provider-signed claim sight and publish a host-signed recovery directive after exact termination, but may not open or mutate the coverage store. Idunn owns deployment and recovery routing, never projection truth." workspace_coverage_checkpoint: "The pinned Redb workspace-coverage store is operational authority. A checkpoint binds one contiguous plan batch, exact waited Qdrant readback, predecessor lineage, current Body, claim, attempt, launch, provider, and release. Progress derives from the admitted checkpoint. Existing one-point histories remain valid predecessors, while current production cadence is bounded at 128 points to avoid pathological immutable-history amplification. Qdrant remains disposable derived state; counts without authenticated bindings cannot resume work or prove readiness." repository_readiness_join: "Mind owns the implemented race-bounded RepositoryReadinessProjection operation. It freshly observes Body R1; derives canonical RepoModel, the unique current v5 Body-grounded admission, and the complete succeeded Modeling semantic chain from one raw opening CultCache snapshot; authenticates live semantic vectors and live workspace coverage bound to R1; observes Body R2 and requires the same content identity/root; repeats both live reads; derives the closing authority from one raw full snapshot; and atomically appends a historical observed-ready-at projection only if that complete snapshot is unchanged. Stored projections never grant current readiness. A→B→A is acceptable only as equal content-addressed endpoints. CultCache now fences full-snapshot cardinality with tuple (type,key) identity. Legacy retrieval Ready, timestamps, watcher silence, Git OIDs, collection existence/counts, Hands receipts, Eve/Gjallar, and prior readiness projections are forbidden substitutes." coordinator_grounding_loop: "Cold start is owned by one typed UserObjectiveIntake that atomically seeds thread state and refuses objective replacement; a missing checkpoint routes to Modeling rather than a fictional prepareCheckpoint actuator. Explicit local-Verse path authority flows into launch context without sibling-path inference. Eyes and Modeling receive bounded source tools. Accepted CRRC regather findings hand source gathering to Eyes instead of recursively relaunching the continuity judge. Runtime/display/coordinator reads share the canonical typed role and reorient result readers. Failed or completed-unreviewable role outputs may be explicitly superseded by a typed review receipt; JSON null is not a state patch. Provider output schema is formatting guidance only, while canonical typed ingress and Mind remain admission authority. Modeling's provider schema now describes tagged patch operations, closed node/edge/profile vocabularies, canonical node/edge fields, anchors, code refs, observations, evidence, frontier items, and Body-basis echo. Live dogfood has accepted one code-grounded Eyes result, but no current Body-grounded Modeling admission yet: the latest Modeling run used eleven source-tool rounds then failed at the provider request boundary before publishing typed output." @@ -796,4 +796,4 @@ current_status: - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile. - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24. - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24. - next_action: "Candidate 5e298e63 is braked and unadmitted on Yggdrasil: readiness is healthy, but the restarted workspace projector obeyed stale recovery pressure before recognizing durable terminal coverage owned by the historical succeeded claim and launch. Commit/push the terminal-authority correction, revoke 5e298e63, terminate only Idunn transaction PGID 1485835, and verify the installed signal-safe rollback leaves no services, current links, active-release.env, or deployment.env. Then Bifrost-authorize and Idunn-deploy the exact successor under brake. Require immutable historical terminal-sight reuse, three stable services, typed resident readiness, signed aggregate health, and final deployment.env before the Starfire-offline ordinary-product rehearsal: persistent Modeling map -> autonomous bounded Imagination proposal, with organization feedback through Persona as additional attributed pressure; explicit Mind adoption -> Hands consequence -> Bifrost release -> Idunn deployment remain separate gates. Prove replay/tamper refusal and that conversation alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized." + next_action: "Terminal-authority successor 519574ce0d63ffa8fa813885c6629c664a3ae2e0 is committed, pushed, and Bifrost-authorized. Candidate 5e298e63 was revoked and exact Idunn PGID 1485835 proved signal-safe rollback: no services, current links, active-release.env, deployment.env, or held lock remained. Idunn command manual:redeploy:yggdrasil-epiphany:unix:1784440234 now owns the detached successor transaction under brake. Monitor its process tree and typed state; require immutable historical terminal-sight reuse, three stable services, typed resident readiness, signed aggregate health, and final deployment.env before the Starfire-offline ordinary-product rehearsal: persistent Modeling map -> autonomous bounded Imagination proposal, with organization feedback through Persona as additional attributed pressure; explicit Mind adoption -> Hands consequence -> Bifrost release -> Idunn deployment remain separate gates. Prove replay/tamper refusal and that conversation alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."