From d6ebed2c01daa7f8be8316e9d239c27373771ed2 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 12 Jul 2026 05:40:08 +0100 Subject: [PATCH] Map final legacy rollout deletion --- notes/fresh-workspace-handoff.md | 7 ++++++- notes/native-coordinator-liberation-map.md | 10 ++++++++++ state/ledgers.msgpack | Bin 411799 -> 412259 bytes state/map.yaml | 2 +- 4 files changed, 17 insertions(+), 2 deletions(-) diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 505315af..160669d6 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -1925,7 +1925,12 @@ judge whether generic unknown-rollout cargo can remove its final named trace. The rename is complete and tested: all Rust matches say `LegacyEpiphanyState`, serde still emits/reads `epiphany_state`, and migration behavior is unchanged. Next audit a generic unknown historical rollout carrier, -but reject it if it weakens strict decoding of live Codex history. +but reject it if it weakens strict decoding of live Codex history. The audit +rejects it: a catch-all would suppress parse errors across replay, metadata, +listing, state extraction, and agent control. Next remove the named variant +entirely by making app-server's migration quarantine read raw rollout lines, +recognize only `type=epiphany_state`, and strictly decode ordinary Codex +lifecycle items needed for rollback-aware migration. ## Immediate Re-entry Instruction diff --git a/notes/native-coordinator-liberation-map.md b/notes/native-coordinator-liberation-map.md index b38be413..423f04b5 100644 --- a/notes/native-coordinator-liberation-map.md +++ b/notes/native-coordinator-liberation-map.md @@ -332,3 +332,13 @@ The opaque Rust variant is now named `LegacyEpiphanyState`, with an explicit Every remaining Codex match therefore declares that it handles quarantine cargo rather than live Epiphany authority. Protocol shape and app-server migration tests prove the rename did not change old-file compatibility. + +Generic unknown rollout cargo is rejected. `RolloutRecorder::load_rollout_items` +parses each line into strict `RolloutLine`/`RolloutItem`, counts parse failures, +and feeds the result into history replay, metadata, listing, state extraction, +and agent control. A catch-all variant would turn malformed or future live +items into silent success across every consumer to preserve one extinct record. +The deletion path is narrower: app-server's migration quarantine should read +raw rollout lines, recognize only `type=epiphany_state`, decode its payload, +and combine those migration records with strictly decoded Codex lifecycle items. +Then `LegacyEpiphanyState` can leave Codex protocol and all core consumers. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 1ff077f20280f161f37c98e635de12e317617494..82a70699efa011be9e0489eee0d8d81b389f3551 100644 GIT binary patch delta 506 zcmXw#y^0h;5XYVMyuet4%?bpgot<_4!V^Idgo6uYxya-wdunD{d%D}|>fM`Y0|VoO zTQ2tr1OpNCdjj9U7rB~+3#vb;s(=0db#*cQe>wd*E$+WMdcOR4edqA_?XO40*P{6M zZ8!P8n-m)3eOKc^$6yeywAPZ!UQo{s%jAO0RZ*#212XEH)H zAhhI(t%2;n_^|P?3eJTr$3i_AWVXbBjp&&|WI&8h&zf~S&i1db{jUD>oY!5txX58XNCx05$SRdBt jAT%JILeS$D%>Zj;i#opH&?`($=MXtaFu_&2Q<~oZ_>#8| delta 56 zcmaDnMRNK?$qkZ>T;^6LmQlwT*xXAtD>D`{GG1<;%G5rUi4llFG&2yh05R+KsZ4B4 FZU6!k5ZwR( diff --git a/state/map.yaml b/state/map.yaml index 1633a583..49d168c5 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -659,4 +659,4 @@ current_status: - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. Gjallar readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - next_action: Audit whether `RolloutItem` can carry unknown historical item kinds generically, allowing `LegacyEpiphanyState` to leave codex-protocol/core entirely while app-server migration still recognizes `type=epiphany_state`. Do not adopt a generic blob carrier unless it preserves strict decoding for live Codex items and quarantines unknown cargo without turning malformed current rollouts into silent success. + next_action: Delete `LegacyEpiphanyState` from `RolloutItem` by moving raw-line recognition into app-server's migration quarantine. The quarantine reader should recognize only `type=epiphany_state`, decode that payload fail-closed, strictly decode other lines as normal `RolloutLine` lifecycle items for rollback/turn boundaries, and preserve Codex's existing unknown/malformed parse-error behavior everywhere else.