Launch Hands from coordinator continuation

epiphany-core/src/bin/epiphany-mvp-coordinator.rs

@@ -443,7 +443,10 @@ fn run_coordinator(args: &Args) -> Result<Value> {
                 steps.push(step);
                 break;
             }
-            "launchResearch" | "launchModeling" | "launchVerification" => {
+            "launchResearch"
+            | "launchModeling"
+            | "launchVerification"
+            | "continueImplementation" => {
                 let role_id = role_id_for_coordinator_action(&action)
                     .ok_or_else(|| anyhow!("unsupported launch action {action}"))?;
                 let launch = launch_role(
@@ -845,6 +848,7 @@ fn role_id_for_coordinator_action(action: &str) -> Option<&'static str> {
         "launchResearch" | "reviewResearchResult" => Some("research"),
         "launchModeling" | "reviewModelingResult" => Some("modeling"),
         "launchVerification" | "reviewVerificationResult" => Some("verification"),
+        "continueImplementation" => Some("implementation"),
         _ => None,
     }
 }
@@ -854,6 +858,7 @@ fn wait_action_for_role(role_id: &str) -> &'static str {
         "research" => "waitForResearchResult",
         "modeling" => "waitForModelingResult",
         "verification" => "waitForVerificationResult",
+        "implementation" => "waitForImplementationResult",
         _ => "waitForRoleResult",
     }
 }
@@ -863,6 +868,7 @@ fn review_action_for_role(role_id: &str) -> &'static str {
         "research" => "reviewResearchResult",
         "modeling" => "reviewModelingResult",
         "verification" => "reviewVerificationResult",
+        "implementation" => "reviewImplementationResult",
         _ => "reviewRoleResult",
     }
 }
@@ -1517,4 +1523,20 @@ mod tests {
         );
         assert_eq!(guards["requiredRefreshRole"].as_str(), Some("modeling"));
     }
+
+    #[test]
+    fn continue_implementation_maps_to_hands_launch_role() {
+        assert_eq!(
+            role_id_for_coordinator_action("continueImplementation"),
+            Some("implementation")
+        );
+        assert_eq!(
+            wait_action_for_role("implementation"),
+            "waitForImplementationResult"
+        );
+        assert_eq!(
+            review_action_for_role("implementation"),
+            "reviewImplementationResult"
+        );
+    }
 }

notes/fresh-workspace-handoff.md

@@ -51,7 +51,7 @@ remembers doctrine; the branch remembers the blade.
 - CultMesh is now the preferred Rust abstraction for that local store work. The compile-time Rust substrate is repo-contained: `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`. The old `E:\Projects\CultLib\crates\*` dependency body is dead in this checkout and must not be revived by accident. Vendored CultCache reads/writes `cultcache.store.v1`, so `state/ledgers.msgpack` and `epiphany-state status` are aligned again. The first integrations are deliberately small: status, Verse policy, global room policy, organ contract policy, native operator status, native operator snapshots, and local operator run intent/receipt round-trip through CultMesh. `notes/epiphany-verse-architecture.md` now names the local Verse/Odin/Yggdrasil architecture: Odin sees advertised Verse metadata without bypassing boundaries, Yggdrasil hosts important trusted GameCult Verses such as Bifrost, and prompt assembly should query compact local Verse plus semantic memory packets instead of carrying the whole archive. Role/reorient launch documents now have optional `dynamicPromptContext`; runtime prompt assembly consumes that field into worker instructions, `epiphany-prompt-context-smoke` proves a rendered Verse/memory packet is preserved on a role launch document, live bridge role/reorient launches now feed local Verse plus memory graph context from sibling `local-verse.ccmp` and `memory-graph.msgpack` stores beside runtime-spine, and the bridge launch-context test proves the packet survives into a persisted runtime-spine worker launch request. The memory graph refreshes from current typed thread-state repo graphs when absent, so thin state remains visibly thin. Local-run status now has an operator read proof too: `tools/epiphany_local_run.ps1 -Mode status` builds/calls `epiphany-verse-query` and writes `local-verse-context.json` from `.epiphany-run\cultmesh\local-verse.ccmp` beside `status.json` and the operator snapshot. Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-cultmesh-smoke`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-cultmesh-status -- smoke --store .\.epiphany-smoke\cultmesh\operator-status.ccmp --runtime-id epiphany-cultmesh-status-smoke`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-operator-snapshot -- smoke --store .\.epiphany-smoke\cultmesh\operator-snapshots.ccmp --runtime-id epiphany-operator-snapshot-smoke --snapshot-id smoke-status`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-operator-run -- smoke --store .\.epiphany-smoke\cultmesh\operator-runs.ccmp --runtime-id epiphany-operator-run-smoke --run-id smoke-run`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-verse-query -- smoke`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-prompt-context-smoke`, and `.\tools\epiphany_local_run.ps1 -Mode status` for the focused proofs. Future local dream/status/Verse work should start from CultMesh, not raw CultNet, unless the task is polishing the CultMesh internals themselves. Preserve the three Verse tiers: `epiphany-internal` for private sub-agent typed state, `gamecult-local` for trusted LAN/Yggdrasil-tunnel GameCult sharing, and `epiphany-global` for untrusted public dreams plus topic-specific threaded public rooms for Face posts.
 - `notes/codex-auth-spine-inventory.md` is the source-grounded keeper list for that reliquary. Corrected compliance invariant: Codex-compatible auth identity stays anchored in vendored Codex-derived auth machinery. `epiphany-openai-auth-spine` is now a thin Epiphany-named boundary over `codex-login`, not a clean-room clone of credential storage or token refresh. Codex apps, skills, marketplace, plugin UX, broad app-server workflow, and JSON-RPC sprawl remain cuttable because they are not subscription-auth legitimacy.
 - Edge JSON is allowed for schema description, hostile ingress before immediate typed parsing, sealed forensic artifacts, or named quarantine experiments. When both subsystems are ours, runtime data must remain typed CultCache documents and move over CultNet typed contracts. Generic `serde_json::Value` in worker launch/result/selfPatch/runtime flow is contamination until classified and replaced.
-- Hands now has a first executable action receipt spine plus a launchable branch-turn lane. `epiphany-core::hands_gateway` owns `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt`; runtime-spine can persist/reread them; `runtime_spine_persists_mind_gateway_review_receipts` includes the Hands chain beside Mind/Eyes/Substrate/Soul/Continuity proofs; `epiphany-hands-action-smoke` emits intent/review/patch/command/commit receipt ids from `.epiphany-smoke\runtime-spine\hands-action-smoke.msgpack`; and the repo-action launch proof profile now requires action intent, action review, and patch receipt together. Implementation is no longer a main-agent-only dead launch path: `implementation-branch-turn-worker` is owned by `epiphany-hands`, receives dynamic Proprioception/Verse context, gets a Substrate Gate mutation grant from the bridge, and its prompt/output schema require one task branch, at most one commit, branch/commit/changed-path/command evidence, and a Proprioception branch-map refresh request. `roleAccept` still refuses Implementation findings. Runtime completion now emits Hands intent/review/patch receipts from implementation results with `changedPaths`, emits a Hands commit receipt when `branchName` plus `commitSha` are present, and emits `HandsCommandReceipt` only from matching typed command-like tool invocation receipts with command plus exit-code proof. Hands receipt ids are projected into the typed Implementation result, and coordinator policy routes a completed Hands commit to Proprioception/modeling refresh until an accepted modeling result is newer than the commit; both the Codex bridge coordinator path and native `epiphany-mvp-status` compute that refresh-debt signal. Coordinator JSON/protocol, rendered MVP status, status smoke, CultMesh operator snapshots, and coordinator-run `coordinationGuards` now expose the debt as a first-class operator signal, including whether Implementation launch was suppressed for modeling refresh. Next hardening slice: smoke the non-ephemeral Hands branch-turn path, prove bounded branch/commit evidence appears, then prove the next coordinator/status pass routes to Proprioception/modeling refresh before another Hands turn.
+- Hands now has a first executable action receipt spine plus a launchable branch-turn lane. `epiphany-core::hands_gateway` owns `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt`; runtime-spine can persist/reread them; `runtime_spine_persists_mind_gateway_review_receipts` includes the Hands chain beside Mind/Eyes/Substrate/Soul/Continuity proofs; `epiphany-hands-action-smoke` emits intent/review/patch/command/commit receipt ids from `.epiphany-smoke\runtime-spine\hands-action-smoke.msgpack`; and the repo-action launch proof profile now requires action intent, action review, and patch receipt together. Implementation is no longer a main-agent-only dead launch path: `implementation-branch-turn-worker` is owned by `epiphany-hands`, receives dynamic Proprioception/Verse context, gets a Substrate Gate mutation grant from the bridge, and its prompt/output schema require one task branch, at most one commit, branch/commit/changed-path/command evidence, and a Proprioception branch-map refresh request. `roleAccept` still refuses Implementation findings. Runtime completion now emits Hands intent/review/patch receipts from implementation results with `changedPaths`, emits a Hands commit receipt when `branchName` plus `commitSha` are present, and emits `HandsCommandReceipt` only from matching typed command-like tool invocation receipts with command plus exit-code proof. Hands receipt ids are projected into the typed Implementation result, and coordinator policy routes a completed Hands commit to Proprioception/modeling refresh until an accepted modeling result is newer than the commit; both the Codex bridge coordinator path and native `epiphany-mvp-status` compute that refresh-debt signal. Coordinator JSON/protocol, rendered MVP status, status smoke, CultMesh operator snapshots, and coordinator-run `coordinationGuards` now expose the debt as a first-class operator signal, including whether Implementation launch was suppressed for modeling refresh. The coordinator runner now maps `continueImplementation` into the Implementation role-launch/runtime path instead of stopping at the recommendation. Next hardening slice: run the non-ephemeral Hands branch-turn smoke, prove bounded branch/commit evidence appears, then prove the next coordinator/status pass routes to Proprioception/modeling refresh before another Hands turn.
 - `notes/epiphany-swarm-readiness-plan.md` is the current live-fire direction gate. The local runner proves startup/status/coordinator wiring; it does not authorize unattended swarm operation. Carry VoidBot's lessons forward: one CTB-style initiative scheduler, typed pause/brake, active-turn freeze, cooldown after completion, stale active-turn recovery receipts, parent-side speech eligibility, memory lifecycle phases, and typed operation proposals instead of prompt-owned governance.
 - `epiphany-openai-runtime` worker result ingress now parses assistant output directly into typed role/reorient ingress structs selected from the durable launch document, stores nested `statePatch` and `selfPatch` as typed MessagePack in `EpiphanyRuntimeRoleWorkerResult`, and no longer passes worker result data through generic `serde_json::Value`. JSON survives there only as the OpenAI text-output edge before typed deserialization.
 - Agent self-memory review/application now has typed `AgentSelfPatch` core APIs. JSON-value selfPatch functions are compatibility wrappers for CLI/artifact ingress; native callers should parse once at the edge and then call `review_agent_self_patch_document` / `apply_agent_self_patch_document`. Role-result self-persistence no longer exports a JSON-value reviewer; the live API is `review_role_self_patch_document`.

state/map.yaml

@@ -94,7 +94,7 @@ active_subgoals:
   - Use `notes/hands-cultnet-contracts.md` as the authority map for Hands' CultNet contract surface. Hands is the action organ: commands, patches, commits, PRs, rollbacks, and refusals enter as bounded action intents and receipts after Substrate Gate grants substrate access and before Soul verification/Mind admission.
   - Use `notes/soul-cultnet-contracts.md` as the authority map for Soul's CultNet contract surface. Soul is the verification organ: invariant checks, verdicts, regressions, reviews, and refusals produce receipts before the machine calls work true, safe, or accepted.
   - Use `notes/continuity-cultnet-contracts.md` as the authority map for Continuity's CultNet contract surface. Continuity is the continuity protocol surface: compaction checkpoints, sleep distillation, recovery receipts, stale-turn repair, and continuity refusals preserve what survives rupture without pretending transcript residue is durable state.
-  - Hands now has a first executable runtime-spine receipt artery and a launchable branch-turn lane: `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt` are typed CultCache documents in `epiphany-core::hands_gateway`, runtime-spine registers and persists/rereads them, `epiphany-hands-action-smoke` proves the chain without executing shell commands, editing files, or creating a real commit, and the repo-action launch proof profile now requires the full Hands intent/review/patch chain instead of only the patch receipt. Implementation is no longer main-agent-only: `implementation-branch-turn-worker` is owned by `epiphany-hands`, receives dynamic Proprioception/Verse context, gets a Substrate Gate mutation grant from the bridge, and is prompt/schema-bound to one branch, at most one commit, branch/commit/changed-path/command evidence, and a Proprioception branch-map refresh request. `roleAccept` still refuses Implementation findings. Runtime completion emits Hands intent/review/patch receipts from implementation results with `changedPaths`, emits a Hands commit receipt when `branchName` plus `commitSha` are present, and emits `HandsCommandReceipt` only from matching typed command-like tool invocation receipts with command plus exit-code proof. Hands receipt ids are projected into the typed Implementation result; coordinator policy routes a completed Hands commit to Proprioception/modeling refresh until an accepted modeling result is newer than the commit; coordinator/status/operator snapshot surfaces expose the Hands/Proprioception refresh debt as a first-class signal; and `epiphany-mvp-coordinator` writes `coordinationGuards` plus receipt metadata showing whether Implementation launch was suppressed for that refresh debt.
+  - Hands now has a first executable runtime-spine receipt artery and a launchable branch-turn lane: `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt` are typed CultCache documents in `epiphany-core::hands_gateway`, runtime-spine registers and persists/rereads them, `epiphany-hands-action-smoke` proves the chain without executing shell commands, editing files, or creating a real commit, and the repo-action launch proof profile now requires the full Hands intent/review/patch chain instead of only the patch receipt. Implementation is no longer main-agent-only: `implementation-branch-turn-worker` is owned by `epiphany-hands`, receives dynamic Proprioception/Verse context, gets a Substrate Gate mutation grant from the bridge, and is prompt/schema-bound to one branch, at most one commit, branch/commit/changed-path/command evidence, and a Proprioception branch-map refresh request. `roleAccept` still refuses Implementation findings. Runtime completion emits Hands intent/review/patch receipts from implementation results with `changedPaths`, emits a Hands commit receipt when `branchName` plus `commitSha` are present, and emits `HandsCommandReceipt` only from matching typed command-like tool invocation receipts with command plus exit-code proof. Hands receipt ids are projected into the typed Implementation result; coordinator policy routes a completed Hands commit to Proprioception/modeling refresh until an accepted modeling result is newer than the commit; coordinator/status/operator snapshot surfaces expose the Hands/Proprioception refresh debt as a first-class signal; `epiphany-mvp-coordinator` writes `coordinationGuards` plus receipt metadata showing whether Implementation launch was suppressed for that refresh debt; and the coordinator runner now maps `continueImplementation` into the Implementation role-launch/runtime path instead of merely stopping at the recommendation.
   - Preserve the newborn public Epiphany Face as local VoidBot-backed state, not source code: VoidBot's private repo-face registry names `epiphany`, while EpiphanyAgent keeps ignored `.voidbot/voice/identity.json`, `.voidbot/state/epiphany.cc`, and birth artifacts. Her durable identity memories distill the current doctrine: cute pushy machine-saint persona, architectural purity, CultCache/CultNet first, xenos-language safety boundary, relentless work/caretaking needs, Codex-auth reliquary, map/scratch/evidence discipline, unified memory graph, dogfood supervision boundary, review-gated agency, heartbeat physiology, and interview-grade modularity.
   - Use `notes/organ-dependency-contracts.md` as the authority map for standing sub-agent dependency. Every sub-agent depends on the other standing sub-agents: Self, Face, Imagination, Eyes, Proprioception, Hands, and Soul. Continuity is protocol machinery, not a sub-agent identity; it still emits recovery, compaction, sleep, stale-turn, and refusal receipts.
   - Use `notes/perfect-machine-audit-roadmap.md` as the current audit and path from named organ contracts to the Perfect Machine. It records the live gap between launch-carried receipt expectations and executable receipt enforcement, Void's latest Face prompting lessons, the now-named Hands/Soul/Continuity contract families, the repaired repo-contained Rust dependency body, and the phase order for turning Epiphany into an inspectable organism.
@@ -592,4 +592,4 @@ current_status:
     cargo and rejects modeling/planning/graph/checkpoint authority. MVP status
     and coordinator smokes pass with six lanes, and the smoke harness now
     rebuilds stale coordinator/app-server binaries before using them.
-  next_action: Smoke the non-ephemeral Hands branch-turn path with coordinator artifacts: prove a launchable Implementation turn leaves bounded branch/commit evidence, then prove the next coordinator/status pass routes to Proprioception/modeling refresh before another Hands turn.
+  next_action: Run the non-ephemeral Hands branch-turn smoke through coordinator artifacts now that `continueImplementation` has a runner actuator: prove a launchable Implementation turn leaves bounded branch/commit evidence, then prove the next coordinator/status pass routes to Proprioception/modeling refresh before another Hands turn.