Record live organizational Yggdrasil deployment

notes/fresh-workspace-handoff.md

@@ -1,5 +1,36 @@
 # Fresh Workspace Handoff
 
+## Organizational Yggdrasil deployment is live and braked (2026-07-19)
+
+Epiphany's ordinary organizational product path is now deployed on Yggdrasil,
+not merely proven in local smoke. Bifrost authorized each exact upstream
+release and Idunn produced successful deployment receipts for Epiphany
+`b0e8b427e41138a462a8464424d37574d21a8c8d`, Bifrost
+`225859bd7ec3339944841ebbfc67b421eb405727` with CultLib
+`693df0901d75cfd8e3a0a5225e270011eeddb0be`, and VoidBot
+`74abfed109e1d793034796e5eff1562b0aa6c8de`.
+
+All Epiphany resident services, Idunn, and VoidBot are active. The Bifrost
+Persona-feedback sidecar is healthy under its own `bifrost-feedback` service
+identity; it owns its private provider and delivery state, participates in the
+shared CultCache lock groups, and publishes daemon-owned CultNet/RUDP health
+over host networking so Idunn observes Ygg-local provenance instead of Docker
+bridge NAT. The Bifrost Epiphany operator worker is running against the
+loopback-only Epiphany command service on port 17875. The final Ygg checker
+passes.
+
+Resident readiness is active and release-authenticated with
+`brakeEngaged=true`. Do not release it as part of verification. Ollama exposes
+`qwen3-embedding:0.6b` at 100% GPU placement on the GTX 1080; both Modeling
+semantic projectors point at the Ygg-local Qdrant/Ollama path.
+
+The next proof is organizational interaction, not another deployment: use
+Discord to request `/epiphany status` and submit ordinary repository feedback
+to the Epiphany Persona, then verify only operator-safe typed projections and
+receipts. Do not test Wake while the deployment brake is the intended owner of
+sleep. Conversation remains feedback pressure; it does not adopt Mind state or
+grant Hands, release, or deployment authority.
+
 ## Swarm brake observation/actuation purification (2026-07-19)
 
 `epiphany-verse-query swarm-brake` was a mutating pseudo-query whose missing

state/map.yaml

@@ -16,7 +16,7 @@ experiment:
   resident_readiness_ownership: "Resident cognition readiness is a join, not one store pretending to own the organism. epiphany-core/src/resident_readiness.rs derives readiness from separately owned provider readiness, packaged release identity/witness, runtime/Verse observations, Mind state, and brake state. Each source remains authoritative for its own fact; the readiness projection is read-derived and grants no cognition or action authority."
   sleep_brake_semantics: "An engaged swarm brake is sleep mode, not daemon death. Resident services may remain supervised, publish liveness/health, refresh leases, and expose read-only operator sight. The brake blocks cognition launches, scheduling that creates cognitive work, Hands consequences, publication, and deployment action."
   swarm_brake_authority: "The only physical brake truth is the runtime-scoped CultMesh key epiphany-local/swarm-brake. Observation uses swarm-brake-status and is byte-pure; mutation uses swarm-brake-set and requires explicit engaged/released status, canonical document id epiphany/swarm-brake, actor, and reason. Legacy swarm-brake/brake commands refuse. The stable owner is epiphany.swarm-brake; command actors are provenance, not owners. Release refuses absent or foreign/legacy identity. Idunn alone may adopt an already-engaged legacy head into the canonical identity during deployment, without any released interval. Discord Sleep preserves foreign brakes; Wake releases only the exact canonical owner. Resident readiness reads the same key, and deployment admission requires brakeEngaged=true before service restart."
-  discord_mind_review_owner: "The typed Discord operator core routes Reviews/Review into the canonical frontier-plan Mind owner, not a parallel queue. Reviews exposes only bounded request/candidate/model/frontier identities. Exact Adopt/Refuse/Hold revalidates immutable Imagination and current RepoModel bindings; Hold/Refuse are terminal inert receipts; Adopt alone uses the existing RepoModel CAS and creates no Hands authority, Substrate grant, Persona speech, Bifrost release, or Idunn deployment. Decision provenance is typed as Mind worker or authenticated operator command/admission/packet/actor; downstream RepoModel provenance is typed as worker result or frontier-plan decision, with Option absence instead of empty sentinels. Replay time derives from immutable issuance, machine faults are not terminal refusals, CultCache v0 decision tuples decode explicitly, and signed v0 deliveries may drain only the original four commands. The successor is not deployed and Ygg remains braked pending coherent v1 Bifrost/VoidBot interop and live rehearsal."
+  discord_mind_review_owner: "The typed Discord operator core routes Reviews/Review into the canonical frontier-plan Mind owner, not a parallel queue. Reviews exposes only bounded request/candidate/model/frontier identities. Exact Adopt/Refuse/Hold revalidates immutable Imagination and current RepoModel bindings; Hold/Refuse are terminal inert receipts; Adopt alone uses the existing RepoModel CAS and creates no Hands authority, Substrate grant, Persona speech, Bifrost release, or Idunn deployment. Decision provenance is typed as Mind worker or authenticated operator command/admission/packet/actor; downstream RepoModel provenance is typed as worker result or frontier-plan decision, with Option absence instead of empty sentinels. Replay time derives from immutable issuance, machine faults are not terminal refusals, CultCache v0 decision tuples decode explicitly, and signed v0 deliveries may drain only the original four commands. The v1 Epiphany/Bifrost/VoidBot chain is deployed on Yggdrasil behind an engaged canonical brake; the remaining proof is operator-safe Discord interaction, not schema or deployment work."
   status: active
   phase: phase_6_reflection_boundary
   premise: >
@@ -54,20 +54,17 @@ objective:
     deployment remain separate authorities. Eve/CultUI is downstream display.
   yggdrasil_deployment_readiness: >
     Yggdrasil is the ordinary organizational runtime. VoidBot and Bifrost are
-    live, exact organization-channel admission and unbound rejection are proven,
-    and Idunn accepts Bifrost daemon-owned RUDP health. The prior d4 candidate's
-    deployment authority was revoked and it produced no final witness; it is
-    historical evidence, not a deployed release. No successor is deployed until
-    signed aggregate health and Idunn's exact deployment witness are admitted.
-    Exact successor e4491d86 reached active typed readiness and stable terminal
-    coverage under brake, but Idunn 75bd5f2 could not admit its new signed health
-    because the automatic target task still awaited its own deployment command.
-    The candidate was terminated through signal-safe rollback, its Bifrost
-    authority was revoked, and no deployment witness exists. Odin a17b0b6 is the
-    tested scheduler successor; it must be installed before a new exact Epiphany
-    commit is authorized. Every candidate must write an engaged typed
-    swarm brake before any service starts; releasing it is a separate operator
-    action.
+    live at exact Bifrost-authorized upstream commits: Epiphany b0e8b427, Bifrost
+    225859bd with CultLib 693df090, and VoidBot 74abfed1. Idunn recorded successful
+    deployment receipts for all three. Epiphany's packaged release and witness
+    authenticate, all resident services are active, the operator command nerve is
+    loopback-only on 17875, Bifrost Persona feedback and operator worker are
+    running, and the final Ygg checker passes. Bifrost feedback publishes accepted
+    daemon-owned RUDP health from the host CultNet interface under its own service
+    identity. Resident readiness is active with the canonical brake engaged.
+    Ollama keeps qwen3-embedding:0.6b entirely on the GTX 1080 and the Modeling
+    projectors use local Qdrant/Ollama. Releasing the brake remains a separate
+    operator action and is not part of deployment verification.
   current: >
     Build Epiphany toward project-native agency: users talk to projects and
     their Personas, while typed heartbeat, memory, repo maps, evidence, CultNet
@@ -812,4 +809,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "Build the Bifrost and VoidBot halves against exact operator-command core f1036abd, then add the Epiphany supervised CultNet ingress/result seal. The first live slice is owner-only Discord status/sleep/wake/directive with typed receipts; reviews/review follows through the canonical Mind gate. Keep the all-scope deployment brake engaged: Discord Wake must return Refused against it. Persona conversation remains feedback-only. No generic argv, direct store mount, Starfire dependency, release/deploy authority, or host reboot is authorized."
+  next_action: "Run the operator-safe organizational interaction proof from Discord: request /epiphany status and submit ordinary repository feedback to the Epiphany Persona, then inspect only typed projections and receipts. Keep the canonical deployment brake engaged and do not test Wake. Verify feedback becomes attributed pressure for Self/Imagination without Mind adoption, Hands authority, Persona auto-speech, Bifrost release, or Idunn deployment. No Starfire dependency or host reboot is authorized."