Add repo manifest work family

epiphany-core/src/bin/epiphany-repo-manifest-family-smoke.rs

@@ -0,0 +1,379 @@
+use anyhow::Context;
+use anyhow::Result;
+use anyhow::anyhow;
+use chrono::Utc;
+use serde_json::Value;
+use serde_json::json;
+use std::env;
+use std::fs;
+use std::path::Path;
+use std::path::PathBuf;
+use std::process::Command;
+
+fn main() -> Result<()> {
+    let args = Args::parse()?;
+    let result = run_smoke(args)?;
+    println!("{}", serde_json::to_string_pretty(&result)?);
+    Ok(())
+}
+
+#[derive(Clone, Debug)]
+struct Args {
+    root: PathBuf,
+    smoke_root: PathBuf,
+}
+
+impl Args {
+    fn parse() -> Result<Self> {
+        let mut root = env::current_dir().context("failed to resolve current directory")?;
+        let mut smoke_root = root.join(".epiphany-smoke");
+        let mut args = env::args().skip(1).peekable();
+        while let Some(arg) = args.next() {
+            match arg.as_str() {
+                "--root" => root = take_path(&mut args, "--root")?,
+                "--smoke-root" => smoke_root = take_path(&mut args, "--smoke-root")?,
+                other => return Err(anyhow!("unexpected argument {other:?}")),
+            }
+        }
+        Ok(Self { root, smoke_root })
+    }
+}
+
+fn run_smoke(args: Args) -> Result<Value> {
+    let root = args
+        .root
+        .canonicalize()
+        .with_context(|| format!("failed to resolve {}", args.root.display()))?;
+    let manifest = root.join("epiphany-core").join("Cargo.toml");
+    if !manifest.exists() {
+        return Err(anyhow!(
+            "could not find epiphany-core manifest at {}",
+            manifest.display()
+        ));
+    }
+    fs::create_dir_all(&args.smoke_root)
+        .with_context(|| format!("failed to create {}", args.smoke_root.display()))?;
+    let stamp = Utc::now().format("%Y%m%d-%H%M%S").to_string();
+    let smoke_dir = args
+        .smoke_root
+        .join(format!("repo-manifest-family-{stamp}"));
+    if smoke_dir.exists() {
+        fs::remove_dir_all(&smoke_dir)
+            .with_context(|| format!("failed to clear {}", smoke_dir.display()))?;
+    }
+    fs::create_dir_all(&smoke_dir)
+        .with_context(|| format!("failed to create {}", smoke_dir.display()))?;
+
+    let repo = smoke_dir.join("repo-body");
+    fs::create_dir_all(&repo).with_context(|| format!("failed to create {}", repo.display()))?;
+    git(["init"], &repo)?;
+    git(
+        ["config", "user.email", "epiphany-smoke@example.invalid"],
+        &repo,
+    )?;
+    git(["config", "user.name", "Epiphany Smoke"], &repo)?;
+    fs::write(
+        repo.join("README.md"),
+        "# Repo Manifest Family Smoke\n\nThis repository proves branch-local Epiphany Body manifests.\n",
+    )
+    .with_context(|| format!("failed to seed {}", repo.join("README.md").display()))?;
+    git(["add", "README.md"], &repo)?;
+    git(["commit", "-m", "Seed repo manifest smoke body"], &repo)?;
+    git(["switch", "-c", "epiphany/repo-manifest-family"], &repo)?;
+
+    let item = "repo-manifest-family";
+    let local_verse = repo.join(".epiphany").join("local-verse.ccmp");
+    cargo_json(
+        &manifest,
+        "epiphany-repo",
+        &[
+            "init",
+            "--workspace",
+            path_str(&repo)?,
+            "--epiphany-root",
+            path_str(&root)?,
+            "--swarm-id",
+            "repo-manifest-family-smoke",
+            "--topic",
+            "repo-manifest-family",
+        ],
+        &root,
+    )?;
+    cargo_json(
+        &manifest,
+        "epiphany-swarm",
+        &[
+            "online",
+            "--workspace",
+            path_str(&repo)?,
+            "--epiphany-root",
+            path_str(&root)?,
+            "--runtime-id",
+            "repo-manifest-family-smoke",
+            "--local-verse-store",
+            path_str(&local_verse)?,
+        ],
+        &root,
+    )?;
+    cargo_json(
+        &manifest,
+        "epiphany-work",
+        &[
+            "accept",
+            "--workspace",
+            path_str(&repo)?,
+            "--from",
+            "persona",
+            "--item",
+            item,
+            "--summary",
+            "Publish a branch-local Epiphany Body manifest with private, local, public Verse ids and an Eve surface.",
+            "--candidate-action-ref",
+            "candidate-action://repo-manifest-family/body-manifest",
+            "--public-discussion-ref",
+            "eve://epiphany/persona/repo-manifest-family",
+        ],
+        &root,
+    )?;
+    let plan = cargo_json(
+        &manifest,
+        "epiphany-work",
+        &[
+            "derive-plan",
+            "--workspace",
+            path_str(&repo)?,
+            "--item",
+            item,
+            "--action-family",
+            "repo-manifest",
+            "--model-ref",
+            "repo-manifest-family-smoke-imagination-v1",
+            "--model-authored",
+        ],
+        &root,
+    )?;
+    for _ in 0..4 {
+        cargo_json(
+            &manifest,
+            "epiphany-work",
+            &[
+                "tick",
+                "--workspace",
+                path_str(&repo)?,
+                "--epiphany-root",
+                path_str(&root)?,
+                "--item",
+                item,
+                "--cooldown-seconds",
+                "0",
+            ],
+            &root,
+        )?;
+    }
+    let close_path = repo
+        .join(".epiphany")
+        .join("work")
+        .join(format!("work-close-{item}.json"));
+    let close = read_json(&close_path)?;
+    let manifest_text = fs::read_to_string(repo.join("epiphany.toml"))
+        .with_context(|| format!("failed to read {}", repo.join("epiphany.toml").display()))?;
+
+    require_eq(
+        &plan,
+        &["derivation", "safeActionFamily"],
+        "repo.body_manifest",
+    )?;
+    require_eq(&close, &["status"], "closed")?;
+    require_eq(&close, &["soul", "verdict"], "passed")?;
+    require_eq(
+        &close,
+        &["closureReview", "familyAssertions", "status"],
+        "passed",
+    )?;
+    require_bool(
+        &close,
+        &["closureReview", "sourceGrounding", "pathScopeMatched"],
+        true,
+    )?;
+    require_bool(&close, &["privateStateExposed"], false)?;
+    require_text(
+        &manifest_text,
+        "schema_version = \"epiphany.repo_body_manifest.v0\"",
+    )?;
+    require_text(
+        &manifest_text,
+        "safe_action_family = \"repo.body_manifest\"",
+    )?;
+    require_text(&manifest_text, "[body]")?;
+    require_text(&manifest_text, "domain = \"repo:repo-manifest-family\"")?;
+    require_text(&manifest_text, "[verses]")?;
+    require_text(
+        &manifest_text,
+        "private = \"epiphany.repo.repo-manifest-family.private\"",
+    )?;
+    require_text(&manifest_text, "local = \"gamecult-local\"")?;
+    require_text(&manifest_text, "public = \"epiphany-global\"")?;
+    require_text(&manifest_text, "[eve]")?;
+    require_text(
+        &manifest_text,
+        "surface = \"eve://epiphany/repo/repo-manifest-family\"",
+    )?;
+    require_text(&manifest_text, "private_state_exposed = false")?;
+    require_text(&manifest_text, "arbitrary_shell_authority = false")?;
+
+    let summary = json!({
+        "schemaVersion": "epiphany.repo_work_manifest_family_smoke.v0",
+        "status": "ok",
+        "smokeDir": smoke_dir,
+        "repo": repo,
+        "branch": git_output(["branch", "--show-current"], &repo)?,
+        "item": item,
+        "safeActionFamily": plan["derivation"]["safeActionFamily"],
+        "targetPath": "epiphany.toml",
+        "closeStatus": close["status"],
+        "soulVerdict": close["soul"]["verdict"],
+        "familyAssertionsStatus": close["closureReview"]["familyAssertions"]["status"],
+        "pathScopeMatched": close["closureReview"]["sourceGrounding"]["pathScopeMatched"],
+        "manifestHasBodyDomain": true,
+        "manifestHasVerseIds": true,
+        "manifestHasEveSurface": true,
+        "privateStateExposed": false,
+    });
+    write_json(&smoke_dir.join("summary.json"), &summary)?;
+    Ok(summary)
+}
+
+fn cargo_json(manifest: &Path, bin: &str, args: &[&str], cwd: &Path) -> Result<Value> {
+    let output = Command::new("cargo")
+        .arg("run")
+        .arg("--quiet")
+        .arg("--manifest-path")
+        .arg(manifest)
+        .arg("--bin")
+        .arg(bin)
+        .arg("--")
+        .args(args)
+        .current_dir(cwd)
+        .output()
+        .with_context(|| format!("failed to run cargo bin {bin}"))?;
+    if !output.status.success() {
+        return Err(anyhow!(
+            "{bin} failed with status {:?}\nstdout:\n{}\nstderr:\n{}",
+            output.status.code(),
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        ));
+    }
+    serde_json::from_slice(&output.stdout).with_context(|| {
+        format!(
+            "{bin} did not emit JSON on stdout:\n{}",
+            String::from_utf8_lossy(&output.stdout)
+        )
+    })
+}
+
+fn git<const N: usize>(args: [&str; N], cwd: &Path) -> Result<()> {
+    let output = Command::new("git")
+        .args(args)
+        .current_dir(cwd)
+        .output()
+        .with_context(|| format!("failed to run git in {}", cwd.display()))?;
+    if output.status.success() {
+        Ok(())
+    } else {
+        Err(anyhow!(
+            "git failed in {} with status {:?}\nstdout:\n{}\nstderr:\n{}",
+            cwd.display(),
+            output.status.code(),
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        ))
+    }
+}
+
+fn git_output<const N: usize>(args: [&str; N], cwd: &Path) -> Result<String> {
+    let output = Command::new("git")
+        .args(args)
+        .current_dir(cwd)
+        .output()
+        .with_context(|| format!("failed to run git in {}", cwd.display()))?;
+    if output.status.success() {
+        Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
+    } else {
+        Err(anyhow!(
+            "git failed in {} with status {:?}\nstdout:\n{}\nstderr:\n{}",
+            cwd.display(),
+            output.status.code(),
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        ))
+    }
+}
+
+fn read_json(path: &Path) -> Result<Value> {
+    let bytes = fs::read(path).with_context(|| format!("failed to read {}", path.display()))?;
+    serde_json::from_slice(&bytes).with_context(|| format!("failed to parse {}", path.display()))
+}
+
+fn write_json(path: &Path, value: &Value) -> Result<()> {
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)
+            .with_context(|| format!("failed to create {}", parent.display()))?;
+    }
+    fs::write(path, serde_json::to_vec_pretty(value)?)
+        .with_context(|| format!("failed to write {}", path.display()))
+}
+
+fn require_eq(value: &Value, path: &[&str], expected: &str) -> Result<()> {
+    let actual = path
+        .iter()
+        .try_fold(value, |current, key| current.get(*key))
+        .and_then(Value::as_str)
+        .unwrap_or("<missing>");
+    if actual == expected {
+        Ok(())
+    } else {
+        Err(anyhow!(
+            "expected {} to be {expected:?}, got {actual:?}",
+            path.join(".")
+        ))
+    }
+}
+
+fn require_bool(value: &Value, path: &[&str], expected: bool) -> Result<()> {
+    let actual = path
+        .iter()
+        .try_fold(value, |current, key| current.get(*key))
+        .and_then(Value::as_bool);
+    if actual == Some(expected) {
+        Ok(())
+    } else {
+        Err(anyhow!(
+            "expected {} to be {expected}, got {:?}",
+            path.join("."),
+            actual
+        ))
+    }
+}
+
+fn require_text(haystack: &str, needle: &str) -> Result<()> {
+    if haystack.contains(needle) {
+        Ok(())
+    } else {
+        Err(anyhow!("expected manifest text to contain {needle:?}"))
+    }
+}
+
+fn take_path(
+    args: &mut std::iter::Peekable<impl Iterator<Item = String>>,
+    flag: &str,
+) -> Result<PathBuf> {
+    args.next()
+        .map(PathBuf::from)
+        .with_context(|| format!("missing value for {flag}"))
+}
+
+fn path_str(path: &Path) -> Result<&str> {
+    path.to_str()
+        .ok_or_else(|| anyhow!("path is not valid UTF-8: {}", path.display()))
+}

epiphany-core/src/bin/epiphany-work.rs

@@ -1871,8 +1871,11 @@ fn derive_safe_plan_family(input: DeriveSafePlanInput<'_>) -> Result<DerivedSafe
             derive_repo_status_section_plan(input, &action_family)
         }
         "task-card" | "action-card" | "plan-card" => derive_task_card_plan(input, &action_family),
+        "repo-manifest" | "body-manifest" | "epiphany-manifest" => {
+            derive_repo_manifest_plan(input, &action_family)
+        }
         other => Err(anyhow!(
-            "unsupported derive-plan action family {other:?}; supported families are append-worklog, planning-note, checklist-note, section-note, repo-status-section, and task-card"
+            "unsupported derive-plan action family {other:?}; supported families are append-worklog, planning-note, checklist-note, section-note, repo-status-section, task-card, and repo-manifest"
         )),
     }
 }
@@ -2263,6 +2266,111 @@ fn derive_task_card_plan(
     })
 }
 
+fn derive_repo_manifest_plan(
+    input: DeriveSafePlanInput<'_>,
+    action_family: &str,
+) -> Result<DerivedSafePlan> {
+    let item_slug = sanitize(input.item);
+    let target_path = validate_toml_target_path(input.target_path.unwrap_or("epiphany.toml"))?;
+    let candidate_refs =
+        string_array_from_json(input.accept_receipt, &["feedback", "candidateActionRefs"]);
+    let public_refs =
+        string_array_from_json(input.accept_receipt, &["feedback", "publicDiscussionRefs"]);
+    let now = Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true);
+    let body_domain = format!("repo:{item_slug}");
+    let private_verse_id = format!("epiphany.repo.{item_slug}.private");
+    let local_verse_id = "gamecult-local".to_string();
+    let public_verse_id = "epiphany-global".to_string();
+    let eve_surface_id = format!("eve://epiphany/repo/{item_slug}");
+    let lines = vec![
+        "# Epiphany repo Body manifest.".to_string(),
+        "# Branch-local public routing cargo; not private state, publication, merge, service, or cross-repo authority.".to_string(),
+        format!(
+            "schema_version = {}",
+            toml_basic_string("epiphany.repo_body_manifest.v0")
+        ),
+        format!("item = {}", toml_basic_string(input.item)),
+        format!("created_at = {}", toml_basic_string(&now)),
+        format!("source = {}", toml_basic_string(input.source)),
+        format!("summary = {}", toml_basic_string(&compact_line(input.summary))),
+        format!(
+            "safe_action_family = {}",
+            toml_basic_string("repo.body_manifest")
+        ),
+        format!("model_authored = {}", input.model_authored),
+        format!(
+            "model_ref = {}",
+            toml_basic_string(input.model_ref.unwrap_or("deterministic-fallback"))
+        ),
+        "operator_authored_shell_details = false".to_string(),
+        "hands_authority_granted = false".to_string(),
+        "durable_state_admitted = false".to_string(),
+        "publication_authorized = false".to_string(),
+        "merge_authorized = false".to_string(),
+        "service_lifecycle_authority = false".to_string(),
+        "cross_repo_mutation = false".to_string(),
+        "private_state_exposed = false".to_string(),
+        format!("candidate_action_refs = {}", toml_array(&candidate_refs)),
+        format!("public_discussion_refs = {}", toml_array(&public_refs)),
+        String::new(),
+        "[body]".to_string(),
+        format!("domain = {}", toml_basic_string(&body_domain)),
+        "authority_owner = \"Epiphany Self\"".to_string(),
+        "hosted_by_daemon = false".to_string(),
+        "branch_local_only = true".to_string(),
+        String::new(),
+        "[verses]".to_string(),
+        format!("private = {}", toml_basic_string(&private_verse_id)),
+        format!("local = {}", toml_basic_string(&local_verse_id)),
+        format!("public = {}", toml_basic_string(&public_verse_id)),
+        "private_state_may_leave_repo = false".to_string(),
+        String::new(),
+        "[eve]".to_string(),
+        format!("surface = {}", toml_basic_string(&eve_surface_id)),
+        "agent_friendly_tui = true".to_string(),
+        "public_discussion_allowed = true".to_string(),
+        String::new(),
+        "[capabilities]".to_string(),
+        "advertised = [\"repo-work-overview\", \"repo-work-public-proof\"]".to_string(),
+        "requires_receipts = true".to_string(),
+        "arbitrary_shell_authority = false".to_string(),
+        String::new(),
+        "[verification]".to_string(),
+        "asks = [".to_string(),
+        "  \"Soul verifies the repo manifest path changed and contains the accepted pressure summary.\","
+            .to_string(),
+        "  \"Soul verifies the manifest names body, Verse, and Eve routing ids without private-state exposure.\","
+            .to_string(),
+        "  \"Soul verifies no paths outside the declared manifest changed.\"".to_string(),
+        "]".to_string(),
+        String::new(),
+        "[rollback]".to_string(),
+        "hints = [\"Remove epiphany.toml if the repo Body manifest was misderived.\"]"
+            .to_string(),
+        String::new(),
+    ];
+    let command = powershell_set_lines_command(&target_path, &lines);
+    Ok(DerivedSafePlan {
+        safe_action_family: "repo.body_manifest".to_string(),
+        target_path,
+        plan_summary: format!(
+            "Imagination derived a repo Body manifest from accepted {} pressure.",
+            input.source
+        ),
+        command,
+        commit_message: format!("Add Epiphany repo manifest for work item {}", input.item),
+        verification_asks: vec![
+            "Soul verifies the repo Body manifest path changed and contains the accepted pressure summary.".to_string(),
+            "Soul verifies the manifest publishes body, Verse, and Eve routing ids while sealing private state.".to_string(),
+            "Soul verifies no paths outside the declared manifest changed.".to_string(),
+        ],
+        rollback_hints: vec![
+            "Remove the generated repo Body manifest if the accepted pressure was misinterpreted.".to_string(),
+        ],
+        derivation: plan_derivation_receipt(input, action_family, "repo.body_manifest"),
+    })
+}
+
 fn closure_family_assertions(
     workspace: &Path,
     commit_sha: &str,
@@ -2441,6 +2549,62 @@ fn closure_family_assertions(
                 "Committed task card preserves the private-state seal.".to_string(),
             );
         }
+        "repo.body_manifest" => {
+            push_assertion(
+                &mut assertions,
+                "repo-manifest-schema-present",
+                content.contains("schema_version = \"epiphany.repo_body_manifest.v0\""),
+                "Committed repo manifest carries the Body manifest schema version.".to_string(),
+            );
+            push_assertion(
+                &mut assertions,
+                "repo-manifest-family-present",
+                content.contains("safe_action_family = \"repo.body_manifest\""),
+                "Committed repo manifest carries the Body manifest safe family.".to_string(),
+            );
+            push_assertion(
+                &mut assertions,
+                "repo-manifest-summary-present",
+                content.contains(&compact_summary),
+                "Committed repo manifest contains the accepted pressure summary.".to_string(),
+            );
+            push_assertion(
+                &mut assertions,
+                "repo-manifest-body-domain",
+                content.contains("[body]") && content.contains("domain = \"repo:"),
+                "Committed repo manifest names the repo Body domain.".to_string(),
+            );
+            push_assertion(
+                &mut assertions,
+                "repo-manifest-verses-present",
+                content.contains("[verses]")
+                    && content.contains("private = \"epiphany.repo.")
+                    && content.contains("local = \"gamecult-local\"")
+                    && content.contains("public = \"epiphany-global\""),
+                "Committed repo manifest names private, local, and public Verse ids.".to_string(),
+            );
+            push_assertion(
+                &mut assertions,
+                "repo-manifest-eve-surface",
+                content.contains("[eve]") && content.contains("surface = \"eve://epiphany/repo/"),
+                "Committed repo manifest names the Eve surface.".to_string(),
+            );
+            push_assertion(
+                &mut assertions,
+                "repo-manifest-private-seal",
+                content.contains("private_state_exposed = false")
+                    && content.contains("private_state_may_leave_repo = false"),
+                "Committed repo manifest preserves private-state seals.".to_string(),
+            );
+            push_assertion(
+                &mut assertions,
+                "repo-manifest-no-arbitrary-shell",
+                content.contains("arbitrary_shell_authority = false")
+                    && content.contains("requires_receipts = true"),
+                "Committed repo manifest keeps arbitrary shell authority sealed behind receipts."
+                    .to_string(),
+            );
+        }
         _ => {
             return Ok((
                 json!({
@@ -6289,7 +6453,7 @@ fn print_usage() {
         "usage: epiphany-work <persona-intake|accept|derive-plan|plan|run|adopt|execute|close|publish|sync|overview|export-proof|tick|queue-run|serve> ...\n\
          persona-intake --workspace <repo> --item <id> --message <text> [--topic <topic>] [--store <local-verse.ccmp>] [--runtime-id <id>]\n\
          accept --workspace <repo> --from <persona|bifrost|persona-or-bifrost> --item <id> [--summary <text>] [--topic <topic>] [--store <local-verse.ccmp>] [--runtime-id <id>] [--online-receipt <path>] [--public-discussion-ref <ref>] [--candidate-action-ref <ref>]\n\
-         derive-plan --workspace <repo> [--item <id>] [--accept-receipt <path>] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card] [--target-path <path>] [--model-ref <ref>] [--model-authored] [--action-summary <text>] [--verification-ask <text>] [--stop-condition <text>] [--escalation-reason <text>]\n\
+         derive-plan --workspace <repo> [--item <id>] [--accept-receipt <path>] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card|repo-manifest] [--target-path <path>] [--model-ref <ref>] [--model-authored] [--action-summary <text>] [--verification-ask <text>] [--stop-condition <text>] [--escalation-reason <text>]\n\
          plan --workspace <repo> [--item <id>] --objective <text> --plan-summary <text> --command <command> --changed-path <path> --commit-message <text> [--adoption-evidence-ref <ref>]\n\
          run --workspace <repo> [--item <id>] [--accept-receipt <path>] [--runtime-store <path>] [--requested-path <path>]\n\
          adopt --workspace <repo> [--item <id>] [--run-receipt <path>] [--from-plan <path>] [--plan-summary <text>] [--adoption-evidence-ref <ref>]\n\

notes/epiphany-repo-swarm-mvp-contract.md

@@ -258,10 +258,13 @@ markers, defaulting to `notes/epiphany-work/<item>-section.md`; and
 `--action-family repo-status-section` creates or replaces one marker-bounded
 operator-safe status section in the repo Body, defaulting to `README.md`; and
 `--action-family task-card` writes a structured TOML task card, defaulting to
-`notes/epiphany-work/<item>-task-card.toml`. Its receipt includes
+`notes/epiphany-work/<item>-task-card.toml`; and
+`--action-family repo-manifest` writes a structured Epiphany Body manifest,
+defaulting to `epiphany.toml`, with body domain, private/local/public Verse ids,
+Eve surface id, capability hints, and authority seals. Its receipt includes
 `epiphany.repo_work_plan_derivation.v0`, mode `append-worklog`,
 `planning-note`, `checklist-note`, `section-note`, `repo-status-section`, or
-`task-card`, a `safeActionFamily`, and an authority seal forbidding
+`task-card`, `repo-manifest`, a `safeActionFamily`, and an authority seal forbidding
 publication, merge, service lifecycle mutation, cross-repo mutation, and private
 state exposure.
 These deterministic families are quarantine scaffolding on the road to
@@ -362,6 +365,18 @@ with `pathScopeMatched=true`; and the README contained both
 `<!-- epiphany-status:repo-status-request:start -->` and
 `<!-- epiphany-status:repo-status-request:end -->` markers.
 
+The next non-planning safe-family smoke proved structured repo Body manifest
+cargo: `.epiphany-smoke\repo-manifest-family-20260620-141552` ran init ->
+online -> accept -> `derive-plan --action-family repo-manifest --model-ref
+repo-manifest-family-smoke-imagination-v1 --model-authored` -> tick through
+run/adopt/execute/close on a fresh repo. The plan carried
+`safeActionFamily=repo.body_manifest`; Hands committed only `epiphany.toml`;
+Soul passed with `pathScopeMatched=true` and `familyAssertions.status=passed`;
+the committed manifest carried `schema_version =
+"epiphany.repo_body_manifest.v0"`, `domain = "repo:repo-manifest-family"`,
+private/local/public Verse ids, an Eve surface id, receipt-required capability
+hints, arbitrary shell sealed false, and `privateStateExposed=false`.
+
 ### Landed Work Run Gate
 
 The sixth front door exists as native Rust:
@@ -1075,7 +1090,7 @@ temptation wearing clean robes.
 | Repo Body birth | `epiphany-repo init` exists and writes repo-local stores plus branch workbench intent. | Keep birth startup-only, review-gated, and branch-oriented. |
 | Local Verse online | `epiphany-swarm online` seeds repo-local CultMesh, standing-faculty SoA, topology, liveness, Eve, and tool sight. | Keep private Verse sealed while exposing operator-safe repo status. |
 | Persona/Bifrost intake | `epiphany-work accept` records pressure and candidate action refs without Hands authority. `epiphany-work persona-intake` now invokes the Persona bubble speech-audit path, records public discussion and candidate-action refs, then delegates to `accept`; wrapper mode `repo-persona-intake` exposes the operator mouth. | Deepen the intake-to-Imagination interpreter so richer model-authored action items can be proposed without granting Hands, publication, or durable-state authority at the mouth edge. |
-| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, and `task-card` / `repo.task_card`. `plan` remains manual quarantine scaffolding. | Deepen model-authored closure and further non-planning action classes without turning model text into arbitrary shell authority. |
+| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, and `repo-manifest` / `repo.body_manifest`. `plan` remains manual quarantine scaffolding. | Deepen model-authored planning and further useful repo-owned configuration classes without turning model text into arbitrary shell authority. |
 | Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan` and `repo-work-service-runbook` write Idunn lifecycle receipts/artifacts for the same queue-run command without launching it. | Keep any future queue-run service launch/install behind Idunn and explicit operator authority. |
 | Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. |
 | Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, and writes Soul, Modeling, and Mind receipts. | Deepen model-authored closure review beyond the first structured closure-review packet while preserving deterministic local closure for simple mechanical work. |
@@ -1346,11 +1361,12 @@ Required organs before MVP:
   pressure stream, and `derive-plan` now writes typed Imagination action-item
   receipts before safe-family command lowering. `checklist-note`,
   `section-note`, and `task-card` now prove richer model-authored planning cargo
-  without operator shell details. `repo-status-section` now proves the first
-  repo-visible non-planning safe family by updating a marker-bounded README
-  status section with the same authority seals. Remaining work is later
-  model-authored action classes that move beyond documentation/status cargo
-  while preserving the same authority seals.
+  without operator shell details. `repo-status-section` proves repo-visible
+  status cargo, and `repo-manifest` now proves structured repo Body manifest
+  cargo with body domain, private/local/public Verse ids, Eve surface, capability
+  hints, and authority seals. Remaining work is later model-authored action
+  classes that can change useful repo-owned configuration without arbitrary
+  shell authority.
 - Closure depth: `close` now writes a structured
   `epiphany.repo_work_closure_review.v0` packet for Hands commits, records
   model-review provenance when supplied, refuses actual-vs-declared path-scope

notes/fresh-workspace-handoff.md

@@ -119,6 +119,7 @@ remembers doctrine; the branch remembers the blade.
 - 2026-06-20: `notes/epiphany-repo-swarm-mvp-contract.md` now has the explicit functional-swarm answer. The current seventeen front doors are real proof surfaces, not decorative wrapper smoke, but Epiphany is not fully online until the typed artery can run as a living repo organism: deeper model-authored closure review, further non-planning action classes, Idunn-owned queue-run service lifecycle under explicit operator authority. Use that section when answering whether Epiphany is headed toward a functional swarm.
 - 2026-06-20: Gjallar/swarm-overview now exposes repo-work overview history as first-class compact sight, Persona's public Eve surface lowers the same queue for peer-readable collaboration, and Self has a first runnable queue surface over it. `SwarmOverviewOutput` and `SwarmTriageOutput` include `repoWorkOverviewCount`, `repoWorkOverviewRows`, `repoWorkOverviewTuiRows`, `latestRepoWorkOverview`, `latestRepoWorkGate`, `latestRepoWorkBlocker`, and `latestRepoWorkNextSafeMove`; the shared `swarmActionRows` queue gets priority 35 `repo-work-overview` rows owned by Gjallar, hosted body `repo-work`, authority gate `repo.work.overview`, effect class `repo-work-readback`, no mutation, no elevation, proof-bundle ref, and private-state seal. `eve-surfaces`, direct `connect-eve`, and the globally invokable Persona `eve-connect` daemon tool readback expose public `REPO-WORK-PEER` rows with item, gate, blocker, next safe move, branch, publication, sync, and `private=false`. `epiphany-work queue-run` reads the same typed queue, selects current-repo rows at `ready-to-run`, `ready-to-adopt`, `ready-to-execute`, or `awaiting-closure`, delegates to `tick`, refreshes overview after real advancement, and wrapper `repo-work-queue-run` exposes the operator surface. Disposable proofs `.epiphany-smoke\gjallar-repo-work-queue-20260620-012027`, `.epiphany-smoke\eve-repo-work-queue-20260620-013322`, `.epiphany-smoke\queue-run-20260620-014314`, and wrapper artifact `local-20260620-014627-174-aada0241` prove two-item queue sight, Eve lowering, direct queue-run advancement, and wrapper dry-run without publication, merge, service lifecycle mutation, elevation, cross-repo mutation, or private-state exposure. The next cut is deeper model-authored closure review, further non-planning action classes, or Idunn-owned queue-run service execution; not another queue display surface.
 - 2026-06-20: Deeper model-authored closure review is now live. `epiphany-work close` accepts `--closure-model-verdict passed|failed|needs-work|blocked`, `--closure-model-finding`, and `--require-closure-model-verdict`; the close review embeds `epiphany.repo_work_model_closure_review.v0` under `modelingReview.closureReview`, records reviewed inputs and gate enforcement, and Soul refuses closure when a supplied or required model verdict does not pass. Focused smoke `.epiphany-smoke\closure-model-gate-20260620-135103` created a disposable repo, ran two `repo.status_section` items through public front doors, closed one with required model verdict `passed`, and blocked one with `needs-work` while `familyAssertions.status=passed`, `pathScopeMatched=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are further non-planning action classes, richer model-authored planning depth beyond deterministic safe-family lowering, and Idunn-owned queue-run service lifecycle under explicit operator authority.
+- 2026-06-20: `repo-manifest` is now the next non-planning safe family. `epiphany-work derive-plan --action-family repo-manifest` lowers accepted pressure into a structured `epiphany.toml` Body manifest with safe family `repo.body_manifest`, body domain, private/local/public Verse ids, Eve surface id, receipt-required capability hints, arbitrary shell sealed false, and private-state seals. Soul closure assertions now inspect the committed manifest for schema, safe family, summary, body domain, Verse ids, Eve surface, receipt requirement, no arbitrary shell, and private-state seals. Focused smoke `.epiphany-smoke\repo-manifest-family-20260620-141552` ran a disposable repo through init -> online -> accept -> repo-manifest derive-plan -> tick run/adopt/execute/close; Hands committed only `epiphany.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are richer model-authored planning depth beyond deterministic safe-family lowering, additional useful repo-owned config/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
 - `service-execution-runbook` makes that next cut repeatable: it generates the exact elevated wrapper command sequence without mutating the service manager, continues after per-step failure to preserve more receipts, runs `service-execution-audit` in `finally`, exits nonzero if any step failed, and seals a typed runbook lifecycle receipt. Run the generated artifact only with explicit operator authority.
 - `service-execution-audit` is the non-mutating acceptance proof after the elevated rite: it reports `complete` only when typed lifecycle receipts prove the runbook witness plus expected elevated chain, and otherwise reports the missing/failed sealed checks.
 - `service-tick` is the non-elevated scheduler pulse proof: it writes the latest daemon scheduler receipt through durable policy ownership and local wrapper receipts.