From d4c951b9bcd491663f8b9afbeb6ba5fca6f30b14 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sat, 18 Jul 2026 22:32:48 +0100 Subject: [PATCH] Close generic service policy deployment mouth --- .../src/bin/epiphany-daemon-supervisor.rs | 9 ++-- epiphany-core/src/cultmesh_integration.rs | 1 + notes/fresh-workspace-handoff.md | 39 ++++++++++++++++++ state/ledgers.msgpack | Bin 530942 -> 531336 bytes state/map.yaml | 26 ++++++++++-- 5 files changed, 66 insertions(+), 9 deletions(-) diff --git a/epiphany-core/src/bin/epiphany-daemon-supervisor.rs b/epiphany-core/src/bin/epiphany-daemon-supervisor.rs index 9f277a80..00aa13a1 100644 --- a/epiphany-core/src/bin/epiphany-daemon-supervisor.rs +++ b/epiphany-core/src/bin/epiphany-daemon-supervisor.rs @@ -47,7 +47,6 @@ use epiphany_core::write_epiphany_cultmesh_daemon_poke_receipt; use epiphany_core::write_epiphany_cultmesh_daemon_restart_policy; use epiphany_core::write_epiphany_cultmesh_daemon_scheduler_receipt; use epiphany_core::write_epiphany_cultmesh_daemon_service_lifecycle_receipt; -use epiphany_core::write_epiphany_cultmesh_managed_service_policy; use epiphany_core::write_epiphany_cultmesh_semantic_projector_service_policy; use epiphany_core::write_epiphany_cultmesh_workspace_coverage_projector_service_policy; use epiphany_core::{ @@ -1792,11 +1791,9 @@ fn write_managed_service_policy(args: Args) -> Result<()> { policy, )? } else { - write_epiphany_cultmesh_managed_service_policy( - &args.store, - args.runtime_id.clone(), - policy, - )? + anyhow::bail!( + "generic managed-service policy writing is retired; use an owning specialized policy command" + ); }; println!( "{}", diff --git a/epiphany-core/src/cultmesh_integration.rs b/epiphany-core/src/cultmesh_integration.rs index 490c17d7..f6f0da7c 100644 --- a/epiphany-core/src/cultmesh_integration.rs +++ b/epiphany-core/src/cultmesh_integration.rs @@ -4092,6 +4092,7 @@ pub fn load_epiphany_cultmesh_daemon_service_lifecycle_receipts( .collect()) } +#[cfg(test)] pub fn write_epiphany_cultmesh_managed_service_policy( store_path: impl AsRef, runtime_id: impl Into, diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index b99822e8..9576c0b2 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -2679,3 +2679,42 @@ readiness window performs zero directive/termination/launch writes, while ExactAlive-to-ExactAlive performs exactly one directive write. Commit and push this cut next; do not replace the live release until its current projection has landed terminal proof or a real failure requires recovery. + +## Current organizational Yggdrasil deployment (2026-07-18) + +This section supersedes earlier live-PID and release-progress instructions. +Release `0601e280480cccc28209fbf0630e921f3ef9056d`, projector PID `145165`, and +their Qdrant counts are historical evidence only. The old deployment transaction +was terminated through its rollback boundary, its release authority was revoked, +and its missing final witness must not be reinterpreted as admission. + +The ordinary organizational feedback path is live on Yggdrasil. VoidBot runs as +its host service identity with portable observer-group access and writes atomic +typed observations through the exact Idunn-admitted CultLib runtime. Bifrost is +healthy, bound to six organization channels, and publishes daemon-owned RUDP +health accepted by Idunn. A labeled bound fixture became an immutable admission +receipt with `grantsWorkAuthority=false` and `grantsAdoptionAuthority=false`; an +unbound fixture was refused. Conversation remains feedback pressure only. + +Idunn and Bifrost deployment authority were repaired from the coherent Odin +schema branch. Idunn now kills timed-out Unix command process groups, treats an +absent deployment witness as first-deployment state while refusing corrupt +witnesses, and rehydrates its preserved typed store. Bifrost's release runtime +uses pinned commits and publishes an exact deployed-revision witness. VoidBot +`7c6f0e9e77ef9d2361c9b7a8368f9fdb0b754458` is deployed and witnessed. + +Epiphany `37df884c6411da10196e59b741a538f792deeee5` is authorized through Bifrost +and is being deployed only through Idunn. The canonical writable Body is +`/var/lib/gamecult/epiphany/workspace`; immutable release provenance is not a +substitute. The actuator now writes an engaged typed `scope=all` swarm brake +before starting any Epiphany service. Releasing that brake is a separate +operator action. Until Idunn admits exact signed aggregate health and publishes +`/srv/epiphany/deploy/deployment.env`, the candidate is not deployed. + +Next action: finish that braked deployment and verify the typed brake, exact +release/witness bindings, all three service owners, signed Idunn health, local +Qdrant/Ollama routes, and final deployment witness. Then run the Starfire-offline +rehearsal before 2026-07-22: organization feedback -> persistent Modeling map -> +bounded Imagination proposal -> explicit review/adoption -> Hands consequence -> +Bifrost release -> Idunn deployment, plus replay/tamper refusal and the negative +chat-only path. No host reboot is authorized. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 28f47002bc34780f4885e8ab24da33376035a8c7..bd749beaf88084a8fb83980fe1ebe8ebd25dc9f6 100644 GIT binary patch delta 465 zcmX|-zityj5XL$4FHKq^QH?~2Z7z<4Bhy)-phGA`3I)>K?%a9gy`5us&*W%aqzDgy zUw|?dk_#&@kcZ$6cnQSVvM4@{b~O8&@0-7C_`ZQ(&$7eg$;oJPGX8Y`;NUr}Uu0jh z?9cV8ceCncs%?F!dZc=+dZK!|S@jP1X!+xAl#gBy^6}vK^nA4Eyv*}Sp5Iz(oOCt$ z^i$@)v(J}RWdlZbAfZCf-!QRwbWjr60?iy6Ofzu2pb1c-T|*Y6h!hsP`94g! z3=$L26)sHzv^B@5q*tvkr1cg8m2E`Vhj+I19zJ|Ldk-^0r*JfenuOla5YGPl10!|A zj-W&rxn$iK6Y9GnPk{~8=&>R@*t%dt(1>Hx0WRA#lfbEa15FUynr)&j#qIJ0s%4=t zR8!i6f_(%pU%|}C%!lxHL7{`PO>H31^MKJwwwMUWSGqCo^G72M4R(ltbAp0O(J%3E K??>H+H2epx+oj6@ delta 67 zcmeC!uJCWO!Ui!$UIQy5b1Or`sACKq61O)iGZr#3zG$Ax)IODo5r{!FGZ3=?F)I+W N0WtgbsZ1Q1;sE8C6rTV9 diff --git a/state/map.yaml b/state/map.yaml index 49cb7fef..22f323f4 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -3,8 +3,8 @@ experiment: repository_body_observer: "Native Rust explicitly binds caller workspace ID to an existing validated runtime/swarm/source identity plus canonical Git root/object format/scope/policy. Bind also installs one immutable runtime-side RuntimeRepositoryBodyStoreBinding naming the canonical external Body-store locator and exact Body-binding hash; every read revalidates runtime/swarm/workspace/path/body identity and refuses a second store. Two equal sanitized temporary-index scans enumerate ignore-aware UTF-8 paths, Git modes, and nonrecursive gitlinks with global excludes disabled; raw regular bytes/lengths and non-followed symlink-target bytes are SHA-256 hashed. The domain-separated ordered raw manifest root, not the clean-filtered auxiliary tree OID, is authoritative Body identity. Every Git subprocess strips ambient repository/worktree/object/ref/index/namespace/replacement/graft/shallow and config-injection authority. Observe cannot mint identity. CultCache MessagePack atomically commits immutable manifest+observation and a manifest-root head by exact CAS. Canonical store-path checks precede writes; corrupt HEAD, sparse checkout, unsafe/unrepresentable paths, racing reads, and repo/runtime substitution fail closed. Only accepted stable observations persist; errors advance no head. Unchanged raw manifest preserves generation; status is read-pure. The observer owns bounded current-state identity, makes no historical continuity claim, and has no Ready field. The runtime route is locator authority only, not proof of model grounding." modeling_body_grounding: "Every coordinator-owned Modeling launch observes and carries one typed RepositoryBodyObservationBasis before worker thought. The immutable launch binds runtime/swarm/workspace/scope, Body-binding hash, observation generation/id/root, and scan interval. Modeling output contract v3 requires the exact worker-authored echo; ingress reloads the immutable launch and rejects missing/swapped basis, while non-Modeling cargo is forbidden. Mind admission review v1 and receipt v5 preserve that basis; admission validates exact launch/result/review equality plus the immutable historical Body artifacts, then copies it into the CAS receipt. Admission never samples current Body as a substitute. Direct Mind plan adoption and legacy migration remain explicitly ungrounded." workspace_retrieval_coverage: "The production-unwired retrieval.rs oracle is deleted. Legacy EpiphanyRetrievalState is presentation-only: clean Ready projects Missing and its indexing job is unavailable/unowned. Native coverage binds an authenticated Repository Body manifest, exhaustive versioned inclusion policy, deterministic chunks/point payloads, immutable Ollama tag+artifact digest identity, vector dimensions, exact Qdrant point/payload/vector observations, and one terminal-CAS receipt/head. A read-only live evidence reader now re-scrolls the exact compatible collection, recomputes payload/vector bindings, and byte-revalidates the entire authority chain after the external read. Coverage success proves only this exact Body projection; Mind alone may join it with the other repository authorities." - workspace_coverage_projector: "The dedicated workspace-coverage projector is the only coverage writer. Repository Body owns observed substrate only: binding, immutable observations/manifests, and the current Body head. Commit 261c7bc8 adds the pinned transactional workspace-coverage-store foundation: an immutable runtime route plus store-local binding jointly seal runtime/swarm/workspace, canonical path and file identity, exact repository Body route/envelope, Body-binding hash, and repository source identity. The separate store is not operational authority yet: obligation/plan/claim/attempt/checkpoint/progress/receipt/head writers still target Body or Verse and must be migrated together with no fallback. The projector authenticates policy-bound launch, exact process identity, runtime, host, provider key, current Body authority, and the pinned coverage store before acting. Execution follows sealed plan order in bounded batches: embed, waited Qdrant upsert, exact ID payload/vector readback, transactional checkpoint plus progress admission, then resume from the authenticated chain. Terminal success independently whole-scrolls Qdrant before terminal receipt/head. Heartbeat is a separate liveness nerve. Idunn owns deployment admission and recovery routing, not projection truth. Aggregate health is active only for exact terminal current authority and warming only for current lineage plus fresh heartbeat and advancing authenticated checkpoints. Query admission remains absent." - workspace_coverage_checkpoint: "Target ownership is the separately pinned transactional workspace-coverage store, not repository Body and not local Verse. It owns obligation, plan, claim and attempt history/current heads, recovery receipts, checkpoint events/head, progress events/latest, terminal receipt, coverage head, and retirement history. Each checkpoint binds one contiguous plan batch and exact post-wait Qdrant payload/vector readback; checkpoint and its derived progress must commit in one coverage-store transaction. Body is reopened as read-only authority before and after the coverage CAS; a changed Body leaves evidence historical and unable to become current. Same-Body abandoned-owner recovery may advance the claim epoch only through Idunn's exact predecessor termination/replacement authority. A stale running claim for an old Body cannot contend with the current Body generation. Qdrant remains disposable derived state. Commit 261c7bc8 supplies the store/binding and keyed transactional primitives only; projector writers are not migrated yet." + workspace_coverage_projector: "The dedicated workspace-coverage projector exclusively owns the pinned Redb coverage store and all obligation, plan, claim, attempt, checkpoint, progress, recovery, receipt, and head writes. Repository Body remains read-only substrate authority; local Verse carries signed claim sight and recovery directives, not private coverage truth. Projection advances in waited Qdrant batches of at most 128 points with exact payload/vector readback before each authenticated checkpoint. The supervisor may observe provider-signed claim sight and publish a host-signed recovery directive after exact termination, but may not open or mutate the coverage store. Idunn owns deployment and recovery routing, never projection truth." + workspace_coverage_checkpoint: "The pinned Redb workspace-coverage store is operational authority. A checkpoint binds one contiguous plan batch, exact waited Qdrant readback, predecessor lineage, current Body, claim, attempt, launch, provider, and release. Progress derives from the admitted checkpoint. Existing one-point histories remain valid predecessors, while current production cadence is bounded at 128 points to avoid pathological immutable-history amplification. Qdrant remains disposable derived state; counts without authenticated bindings cannot resume work or prove readiness." repository_readiness_join: "Mind owns the implemented race-bounded RepositoryReadinessProjection operation. It freshly observes Body R1; derives canonical RepoModel, the unique current v5 Body-grounded admission, and the complete succeeded Modeling semantic chain from one raw opening CultCache snapshot; authenticates live semantic vectors and live workspace coverage bound to R1; observes Body R2 and requires the same content identity/root; repeats both live reads; derives the closing authority from one raw full snapshot; and atomically appends a historical observed-ready-at projection only if that complete snapshot is unchanged. Stored projections never grant current readiness. A→B→A is acceptable only as equal content-addressed endpoints. CultCache now fences full-snapshot cardinality with tuple (type,key) identity. Legacy retrieval Ready, timestamps, watcher silence, Git OIDs, collection existence/counts, Hands receipts, Eve/Gjallar, and prior readiness projections are forbidden substitutes." coordinator_grounding_loop: "Cold start is owned by one typed UserObjectiveIntake that atomically seeds thread state and refuses objective replacement; a missing checkpoint routes to Modeling rather than a fictional prepareCheckpoint actuator. Explicit local-Verse path authority flows into launch context without sibling-path inference. Eyes and Modeling receive bounded source tools. Accepted CRRC regather findings hand source gathering to Eyes instead of recursively relaunching the continuity judge. Runtime/display/coordinator reads share the canonical typed role and reorient result readers. Failed or completed-unreviewable role outputs may be explicitly superseded by a typed review receipt; JSON null is not a state patch. Provider output schema is formatting guidance only, while canonical typed ingress and Mind remain admission authority. Modeling's provider schema now describes tagged patch operations, closed node/edge/profile vocabularies, canonical node/edge fields, anchors, code refs, observations, evidence, frontier items, and Body-basis echo. Live dogfood has accepted one code-grounded Eyes result, but no current Body-grounded Modeling admission yet: the latest Modeling run used eleven source-tool rounds then failed at the provider request boundary before publishing typed output." modeling_admission_dogfood: "Source-grounded Modeling now completes with typed Body-basis ingress and substantial RepoModel node/edge proposals, proving the source/tool/output path. Mind first refused an ordinary Evolution patch that attempted unrequested frontier mutation, then refused a nodes/edges-only patch whose invented workspace-derived domain and Active lifecycle violated the canonical aggregate. Both were superseded through typed admission-rejection review. Modeling launch context now carries the current model revision/hash and exact existing domain ids plus legal repo lifecycles; Evolution mutates nodes/edges only and frontier mutation remains request-bound. A fresh run against the post-fix Body is still required before repository readiness can join." @@ -35,6 +35,23 @@ objective: authority. Visibility and data-classification must survive admission and bind every possible egress so private or organization-only speech cannot become a public Persona, Eve, or CultNet projection. + organizational_feedback_path: > + VoidBot owns Discord observation and writes immutable addressed feedback + events. Bifrost owns exact target binding, visibility/classification, + provider signature, and feedback-only admission. Epiphany imports signed + deliveries into its dedicated feedback store; resident Self may convert + them into typed Imagination consideration bound to the admitted Modeling + map. Persona speech, Mind adoption, Hands action, Bifrost release, and Idunn + deployment remain separate authorities. Eve/CultUI is downstream display. + yggdrasil_deployment_readiness: > + Yggdrasil is the ordinary organizational runtime. VoidBot and Bifrost are + live, exact organization-channel admission and unbound rejection are proven, + and Idunn accepts Bifrost daemon-owned RUDP health. Epiphany release + 37df884c6411da10196e59b741a538f792deeee5 is crossing the exact + Bifrost-to-Idunn deployment path. No deployment witness exists until signed + aggregate health is admitted. Every candidate must write an engaged typed + swarm brake before any service starts; releasing it is a separate operator + action. current: > Build Epiphany toward project-native agency: users talk to projects and their Personas, while typed heartbeat, memory, repo maps, evidence, CultNet @@ -54,6 +71,9 @@ constraints: invariants: - Organizational autonomy is the normal product path: Modeling maps, Self routes pressure, Imagination proposes, Persona converses, Mind adopts, Hands acts, Bifrost releases, and Idunn deploys under separate typed authority. - Persona feedback admission is Bifrost-owned and stored in a dedicated Epiphany feedback store. Source visibility/data classification bind consideration, no consideration candidate can directly route Persona speech, and Eve/CultUI remains downstream presentation with no feedback-admission receipt authority. + - VoidBot is source observer and Bifrost is admission provider; neither identity may substitute for the other. + - Feedback and Imagination candidates grant no Mind, Hands, release, deployment, Persona-reply, or public-projection authority. + - Idunn alone owns release actuation and deployment.env; systemd activity, projector progress, Qdrant counts, logs, or readiness projections cannot synthesize deployment success. - The map is canonical and slow-changing: the machine's remembered skeleton, not a mood board. - Scratch is temporary and disposable: a workbench, not a reliquary. - Evidence is durable and distilled; routine activity logs belong in git history, commits, smoke artifacts, or targeted logs. @@ -757,4 +777,4 @@ current_status: - Release `sha256-c94109f94ee42c1257089830f399cb87cd5ad672772c274194371995ce4df923` is the first deployed immutable sibling generation. Native packaging builds from detached exact source commit `dd80f4a51c18425a6665710698a357be61154abf`, initializes pinned submodules, uses the tracked lockfile under `--locked`, and publishes four exact binaries plus a typed CultCache witness/head only after atomic directory publication and byte verification. Task Scheduler pins release id/digest and the witnessed supervisor path; Idunn reauthenticates the complete set and reserved policy role paths. Current-boot proof: reconciler PID 21228 launched direct child 22736; witnessed Mind/Modeling queries ranked semantically; killing that exact-path child caused Idunn to launch PID 19748 with receipt `86a42d51-9930-4b5d-9e61-e74c82a0d808`, ready heartbeat `4fc91977-b635-474b-812b-c364847e2b4b`, and witnessed executable digest `sha256-1060dd64e8c2b520ec8744b67e8306db04a6618d463fc2117c352adf9e30e6b0`. This closes current-boot artifact generation and recurrence, not reboot/logon survival. - Release `sha256-6f9ab4848207a110e7e3836f41e6a74c0f463369ad4b04ce2d0d3831a6b262ae` packages repository-readiness source commit `360dcb433dda9599fca14282592608d26b8b6cc8`; witnessed Idunn PID 29476 directly owns witnessed projector PID 22840 with launch receipt `50879209-b65f-4411-ae3f-6f647d37bf42` and ready heartbeat `134df620-9e20-4220-ad4e-117ea4ca8188`. Deployment exposed receipt-v2 migration pressure: v1 receipts became correctly ineligible, but the old Succeeded pulse shortcut kept both partitions idle. The shortcut is now cut in source. Valid v2 terminal evidence derives Ready; an exact same-obligation succeeded claim opens Repair only after its consumed grant/recovery authority and exact succeeded attempt are authenticated. Failed repair retries through execute at the next epoch. Forged predecessor authority cannot be laundered by a repair grant. - Yggdrasil exact-SHA pressure release `586147a751c6eec2d59cd8dc10bd17ce0d02a4d1` proved useful GPU work but failed deployment honestly. GTX 1080 stayed near saturation at 2,419 MiB; bounded four-text requests completed continuously. Mind published 215 vectors, while workspace coverage completed 3,389 Ollama HTTP calls total (about 13.3k workspace chunks after Mind) before Idunn's 50-minute candidate-health deadline at 2026-07-17T01:23:50+02:00. Idunn then stopped the service, published no deployment witness, and reported no exact-candidate daemon-health proof; the Modeling collection remained at the inherited 22 points because the monolithic executor had not yet published its accumulated vectors. This is failure evidence for the execution/deployment contract, not for GPU acceleration. Total wall-time extension is forbidden as the repair. - next_action: "Let exact Yggdrasil release 0601e280480cccc28209fbf0630e921f3ef9056d finish its detached checkpointed first projection without interrupting projector PID 145165, the sole store owner. Its collection advanced beyond 6585 points; the foreground Idunn deploy actuator and deployment.env remain absent, so survival is not admission. After terminal provider proof, re-enter the exact authorized release through Idunn and require its typed witness. Then commit/push the coordinated resident source and ops cuts, Bifrost-authorize the exact generation, and Idunn-deploy the three-service body with writable workspace, persistent Mind/Modeling state, and protected local credentials. Wire existing VoidBot/Bifrost Discord Persona feedback as typed pressure while preserving separate Mind, Hands, release, and deploy authority. Complete a Starfire-offline rehearsal before 2026-07-22 proving persistent map formation, bounded Imagination proposals, feedback, explicit adoption/review, consequence, release, and deployment plus the negative chat-only path. No host reboot is authorized." + next_action: "Finish the braked Idunn deployment of exact Epiphany release 37df884c6411da10196e59b741a538f792deeee5 and require signed aggregate health plus the final deployment.env witness. Then run the Starfire-offline rehearsal before 2026-07-22: organization feedback -> persistent Modeling map -> bounded Imagination proposal -> explicit review/adoption -> Hands consequence -> Bifrost release -> Idunn deployment, including replay/tamper refusal and the negative that conversation alone grants no Mind, Hands, Persona-speech, release, or deployment authority. Keep the typed swarm brake engaged until the operator explicitly releases it. No host reboot is authorized."