Record verifier liability cut

notes/fresh-workspace-handoff.md

@@ -1094,11 +1094,18 @@ executable targets; the release-construction library and real release binary
 check cleanly. Each survivor has a deployed lifecycle, external
 protocol/privilege boundary, or live operator/Idunn contract.
 
-The next source cut audits `epiphany-release-construction` tests by the external
-claim each test protects. Preserve package identity, exact sibling bytes,
-clean-source and submodule refusal, path escape/alias refusal, atomic
-publication, and target-specific filename behavior; delete tests that merely
-spell implementation, mirror constants, or duplicate stronger proof.
+Exact `ede5c669` deletes a single-use coordinator runtime-options factory and
+the test that asserted its literal assignments, a stop-policy literal-membership
+test that never exercised continuation, a private Unix credential-mode test
+duplicated by file-level permission proof, and a same-call cache equality.
+Release construction remains 15/15, coordinator 5/5, and core checks cleanly.
+
+The next test-liability pass audits `repository_body_observer` by the external
+Body claim each of its 23 tests protects. Authentication, read-only basis
+loading, no repository-object writes, hostile Git/config refusal, raw-byte
+visibility, binding immutability, stale-head conflict, tamper refusal, and
+generation reuse remain invariants. Private-helper spelling and duplicate
+fixture proof do not.
 
 ## Competitive Eyes/Imagination pass
 

state/map.yaml

@@ -61,7 +61,7 @@ current_status:
   runtime_registry_authority_cut: Exact 03140a47 deletes the 649-line epiphany-runtime-spine operator/debug CLI, its packaged release role, its callerless Hello/schema-catalog service facsimile, the 600-line hand-maintained mutation-contract mirror, and the source-shape test that guarded that mirror. CultCache exact fdbf3bf exposes its registered type identities, so runtime status and model preflight derive accepted documents from the same registration used to open the Mind store. Executable targets fall from 22 to 21 with zero duplicate source owners. Core checks without warnings and release construction passes 17/17. Editor actuation remains entirely provider-owned: Brokkr owns Unity through CultMesh/Eve and a future Rider daemon owns Rider.
   coordinator_status_cut: Exact 500125d5 deletes the unconsumed packaged epiphany-mvp-status executable. Its live projection and operator-sanitization functions move from a binary source textually included by the coordinator into one epiphany-core module. The dead CLI parser, default store, result-file writer, release role, and redundant release assertion are gone. Cargo has 20 executable targets and zero duplicate binary-source owners; the release-owned coordinator checks, the operator thought-sealing test passes, and release construction remains 17/17.
   persona_language_tribunal_cut: Exact 63939fa2 deletes Persona's keyword-based projector-output tribunal, its test-only no-transcript prompt wrapper, and two tests that blessed prompt phrases and forbidden words rather than a consequence. Projector and Persona outputs remain inert private cognition sealed into exact stage contexts. Only the Interpreter's closed typed effect enum can propose state or speech; its channel, cardinality, size, schema, and exact-context validation remain. The three-stage execution/replay, channel-escape refusal, substituted provider/model refusal, retained typed-effect validation, and OpenAI-runtime all-target checks pass.
-  test_authority_cut: Exact bf2f39eb deletes a causal-ID test that compared identical calls and mislabeled the equality provenance independence, plus a duplicate unknown-field test for an already deleted generic patch field. Exact 104bf390 deletes the tool runtime's duplicate immutable-GitHub identity test and a permanently ignored live-network probe pinned to historical README prose. Exact f3360248 deletes a redundant release-cache prefix/determinism assertion, a Git submodule argument-vector mirror plus its single-use helper, and a raw repeated-round predicate test. Exact keyed request identities remain exercised through family lifecycle and admission tests; strict ingress unknown-field refusal remains exercised by runtime-owned Body identity substitution; immutable GitHub parsing remains tested once in epiphany-core; source-cache recovery, cache separation, tool-loop transition, and terminal failed-worker receipts remain proven. Focused owning-package tests pass for each cut.
+  test_authority_cut: Exact bf2f39eb deletes a causal-ID test that compared identical calls and mislabeled the equality provenance independence, plus a duplicate unknown-field test for an already deleted generic patch field. Exact 104bf390 deletes the tool runtime's duplicate immutable-GitHub identity test and a permanently ignored live-network probe pinned to historical README prose. Exact f3360248 deletes a redundant release-cache prefix/determinism assertion, a Git submodule argument-vector mirror plus its single-use helper, and a raw repeated-round predicate test. Exact keyed request identities remain exercised through family lifecycle and admission tests; strict ingress unknown-field refusal remains exercised by runtime-owned Body identity substitution; immutable GitHub parsing remains tested once in epiphany-core; source-cache recovery, cache separation, tool-loop transition, and terminal failed-worker receipts remain proven. Focused owning-package tests pass for each cut. Exact ede5c669 deletes a single-use coordinator runtime-options factory plus the test that merely asserted its field assignments, a literal-membership stop-policy test that never exercised coordinator continuation, a private Unix mode predicate test duplicated by file-level credential permission proof, and a same-call source-cache equality assertion. Release construction remains 15/15, coordinator 5/5, and core checks cleanly.
   tool_runtime_status_cut: Exact 777dd1a5 deletes the callerless epiphany-tool-mcp-runtime smoke command, its fixed JSON self-description, parser branch, and self-affirming branding test. Exact 0bb6a883 removes the run summary's fixed adapter/schema catalogue and caller-supplied store echo; stdout now carries only intent ID, receipt ID, and terminal status. Signed daemon health owns liveness; typed invocation intents and exact receipts own tool execution. With one live command remaining, the one-variant CLI enum collapses into a direct run parser. The four retained release-owned tests pass and exercise typed execution, receipt persistence, Resident-state binding, and unbound refusal.
   repository_body_smoke_cut: Exact 013c3bf1 deletes the callerless epiphany-repository-body smoke command and its temporary-store self-test path. The shipped Body binary retains bootstrap, bind, observe, and status. Authenticated Body binding, exact projection, generation, Git worktree semantics, no repository mutation, and tamper refusal remain proven by 23 focused owner tests.
   model_runtime_smoke_cut: Exact ce90f911 deletes the callerless epiphany-model-runtime smoke route. It opened no provider transport; it wrote a synthetic model request, tool call, completed receipt, and smoke_no_network marker into a writable runtime store, then reported not-opened. Real model-turn, worker, follow-up, decision discovery, and decision audit commands remain. The release-owned model-runtime suite passes 12/12.
@@ -115,7 +115,7 @@ current_status:
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
   unresolved_authority: Generic command, legacy lineage, caller-authored identity, behaviorless policy fields, global lifecycle latest state, timestamp election, Windows Task Scheduler authority, and their false proofs are gone. Semantic and workspace launch owners are separate over shared process mechanics. The remaining daemon supervisor still combines the service loop, aggregate signed-health publication, semantic reconciliation, and the large workspace recovery state machine. Continue decomposing only where ownership becomes smaller; do not create family frameworks or adapters. The false persisted cluster-topology bootstrap sentinel is gone; supervisor admission remains bound to exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until subtraction closes. Bifrost remains Persona and governed external-consequence transport. Its Discord delivery path is a real consumer of Epiphany's short-lived request-bound permit signature, so the distinct permit identity/process is retained as an earned privilege boundary; current Ygg deployment doctrine still points that crossing at the old Starfire endpoint and installs no issuer unit, which the Idunn lane must repair before Persona consequence readiness. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: The executable audit closes at nine targets after exact d2aee1ce; each survivor owns a deployed lifecycle, external protocol/privilege boundary, or live operator/Idunn contract. Begin the test-liability audit in epiphany-release-construction, where large harnesses directly amplify compiler output. For every test, name the externally consequential claim and delete implementation-spelling, constant-mirroring, deterministic-self-equality, source-shape, or duplicate coverage; preserve exact package identity, clean-source/submodule refusal, sibling-set completeness and byte verification, path escape/alias refusal, atomic publication, and target-specific filename behavior. Retain epiphany-persona-discord-permit and its exact Bifrost consumer boundary; its missing Ygg lifecycle remains Idunn deployment drift. Do not run a local full-workspace compile, package, deployment, or Ox root.
+  next_action: Continue the test-liability audit after exact ede5c669. Audit repository_body_observer's 23 tests and their private helpers by externally consequential Body claims: exact authenticated manifest, read-only basis loading, no repository-object writes, hostile Git/config refusal, raw-byte visibility, binding immutability, stale-head conflict, tamper refusal, and generation reuse. Delete repeated fixture setup, private-helper spelling, equality against the same call, or tests whose only surviving effect is to preserve an implementation seam. The executable audit is closed at nine earned targets. Retain the Bifrost-consumed Persona permit boundary; its missing Ygg lifecycle is Idunn deployment drift. Do not run a local full-workspace compile, package, deployment, or Ox root.
 
   runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.
 

state/scratch.md

@@ -99,7 +99,7 @@ and janitors may reduce the symptom but cannot substitute for deleting code.
 15. Done: delete `epiphany-package`. `epiphany-release` already owns the same
    package/inspect operations plus publish, and no live caller names the leaf
    wrapper.
-16. Next: audit `epiphany-release-construction` tests by externally
+16. Done: audit `epiphany-release-construction` tests by externally
    consequential claim. Delete implementation spelling, mirrored constants,
    deterministic self-equality, source-shape assertions, and duplicate proof;
    preserve exact
@@ -107,5 +107,11 @@ and janitors may reduce the symptom but cannot substitute for deleting code.
    The semantic-memory/workspace-coverage projection stack and its local daemon
    supervisor were deleted at `856648de` after proving that no sealed reasoning
    projection consumed them.
-17. Run focused tests after each cut. Only after source subtraction stabilizes
+17. Done: delete the coordinator runtime-options factory and its field-assignment
+   test, the literal-membership stop test, the credential predicate test
+   duplicated by file-level permissions proof, and same-call cache equality.
+18. Next: audit `repository_body_observer` tests and private helpers by exact
+   Body consequence. Preserve authentication, read-only loading, raw-byte and
+   hostile-Git sight, immutable binding, conflict, tamper, and generation proof.
+19. Run focused tests after each cut. Only after source subtraction stabilizes
    should Idunn's build scratch contract be reconsidered.