Record typed Discord operator core

notes/epiphany-discord-operator-nerve.md

@@ -0,0 +1,184 @@
+# Epiphany Discord Operator Nerve
+
+## Objective
+
+Yggdrasil must continue operating while Starfire is packed. The operator must
+be able to inspect and direct Epiphany through Discord without turning ordinary
+conversation into command authority or giving VoidBot access to Epiphany's
+private stores.
+
+Persona feedback and operator command are different nerves:
+
+- Persona conversation is `feedback_only` at VoidBot/Bifrost and
+  `resident-pressure-only` in Epiphany. It may provoke attention and an
+  Imagination proposal. It cannot adopt Mind state or grant consequence.
+- Operator commands are explicit owner-authenticated slash commands. They cross
+  Bifrost as signed, expiring, target-bound typed intent and invoke one named
+  Epiphany owner primitive. They are never inferred from prose.
+
+## Authority map
+
+### Discord / VoidBot
+
+Owner: Discord interaction capture and owner authentication.
+
+Inputs: one explicit `/epiphany` subcommand, Discord actor/guild/channel and
+interaction identity, and command fields allowed by that subcommand.
+
+Outputs: one immutable operator-command observation for Bifrost, or an
+immediate authentication/shape refusal.
+
+Does not own: Epiphany state, brake transitions, pressure admission, Mind
+review, Bifrost signing, release, deployment, or arbitrary command execution.
+
+### Bifrost / Heimdall
+
+Owner: outside identity/capability association and governed crossing.
+
+Inputs: the exact Discord observation, an operator capability associated with
+the actor, configured target binding, current time, and command policy.
+
+Outputs: one signed, expiring, nonce-bound command admission; later, one sealed
+result delivery bound to the exact command admission.
+
+Does not own: the resulting Epiphany transition or receipt. A Bifrost signature
+proves who requested what crossing; it does not prove that Epiphany applied it.
+
+### Epiphany operator-command ingress
+
+Owner: target validation and dispatch to one existing Epiphany owner primitive.
+
+Inputs: Bifrost trust anchor, signed command admission, exact runtime/repository,
+nonce, expiry, expected prior state/revision when required, and the command's
+bounded payload.
+
+Outputs: an Epiphany-owned typed result receipt containing applied/refused/no-op,
+the exact owner receipt or snapshot reference, and no private state.
+
+Does not own: Discord identity, Bifrost capability, generic process execution,
+release authorization, or deployment.
+
+### Existing Epiphany owners
+
+- Status: read-only operator-safe projection over release, brake, resident,
+  pending pressure/review counts, and provider health. It exposes no raw worker
+  state or transcripts.
+- Sleep: swarm-brake owner engages the named cognitive/action surfaces.
+- Wake: swarm-brake owner releases the brake only. Wake does not issue a grant,
+  enqueue a turn, adopt a plan, invoke Hands, speak, release, or deploy.
+- Directive: resident-pressure owner admits one `operator-objective` pressure
+  with exact actor/capability provenance and expiry. It grants attention only.
+- Reviews: the owning Mind/review gate lists bounded pending requests and
+  applies exact `Adopt`, `Refuse`, or `Hold` through its existing commit
+  primitive. Discord and Bifrost cannot mint the resulting receipt.
+
+## Command families
+
+1. `status`: read-only; idempotent; returns a sealed snapshot.
+2. `sleep`: engage brake; requires expected brake identity/revision; repeated
+   exact command is idempotent.
+3. `wake`: release brake; requires expected brake identity/revision; produces
+   no work grant.
+4. `direct`: admits one expiring operator-objective pressure; never parses the
+   text as a command family or consequence grant.
+5. `reviews`: read-only bounded list of pending review summaries.
+6. `review`: exact request id plus `Adopt|Refuse|Hold`, expected revision, and
+   optional bounded rationale.
+
+Every mutating command carries a unique command id/nonce, issued-at, expires-at,
+target runtime/repository, actor identity, Bifrost capability reference,
+expected prior state where relevant, and exact payload digest. Replays return
+the existing result only when command and payload are byte-equivalent.
+
+## Forbidden writers and cut line
+
+- No natural-language command inference, regex tribunal, or magic prefix.
+- No `/queue-codex` or shell proxy.
+- No arbitrary argv, executable path, environment, or store path in a command.
+- No Discord bot mount or filesystem permission for Epiphany stores.
+- No wake-and-run composite.
+- No conversation-derived Mind, Hands, Persona speech, release, deployment, or
+  service-lifecycle authority.
+- No status assembled from PID/process prose when a typed provider owns it.
+- No result success manufactured by VoidBot or Bifrost.
+- Release authorization/revocation remains Bifrost's separate release gate.
+- Deployment and service recovery remain Idunn's separate lifecycle gate.
+
+## Shared paths
+
+Discord interaction -> VoidBot observation -> Bifrost admission -> Epiphany
+ingress -> named owner primitive -> Epiphany result -> Bifrost delivery ->
+VoidBot interaction response.
+
+All six commands use this route. Status/reviews stop at read-only owners.
+Sleep/wake share the brake transition primitive. Directive shares resident
+pressure admission. Review shares the canonical Mind/review commit primitive.
+
+## July 22 proof
+
+With Starfire disconnected and no SSH tunnel dependency:
+
+1. owner and non-owner Discord actors receive the correct admission/refusal;
+2. status names exact deployed commit/release, brake, resident state, pressure
+   and review counts, and Idunn/Bifrost health without private state;
+3. sleep engages the brake and is idempotent;
+4. wake releases only the brake and creates no grant, job, Mind change, Hands
+   authority, speech, release, or deployment;
+5. direct creates exactly one expiring operator-objective pressure and no other
+   authority;
+6. reviews exposes only bounded summaries;
+7. review applies only to the exact current gate and stale/substituted/replayed
+   decisions refuse without writes;
+8. every accepted/refused/no-op command returns a sealed receipt bound to the
+   Discord interaction and Bifrost admission;
+9. signer, target, nonce, expiry, actor capability, and payload tampering fail
+   without changing Epiphany state;
+10. Ygg services survive restart and continue the route without Starfire.
+
+## Current gap
+
+The live Ygg body has the Persona feedback nerve but none of these explicit
+Discord operator command crossings. `epiphany-verse-query swarm-brake` and
+other local CLIs rely on filesystem authority and caller-supplied operator
+labels; they are implementation primitives, not remote authentication. Generic
+VoidBot `provider-status`, `queue-codex`, and job approval operate VoidBot's own
+provider/job system and cannot stand in for Epiphany status, direction, or Mind
+review.
+
+Addressing Epiphany currently queues a local VoidBot repo-Face turn and
+independently exports the visible prompt as remote feedback. There is not yet a
+correlated live Epiphany Persona speech result -> Bifrost Discord receipt ->
+original-message reply path. Describe current replies as the local repo Face;
+do not claim they are round-trip speech from resident Epiphany. That return
+path is later work and must not delay the move-period command nerve.
+
+## Source anchors
+
+- VoidBot interaction/addressing owner:
+  `E:\Projects\VoidBot\apps\bot\src\discord-bot.ts`
+- VoidBot feedback-only document:
+  `E:\Projects\VoidBot\packages\core\src\persona-feedback-observation.ts`
+- VoidBot slash commands and owner job controls:
+  `E:\Projects\VoidBot\apps\bot\src\discord-bot-handlers.ts`
+- Bifrost feedback documents/provider:
+  `E:\Projects\Bifrost\tools\persona-feedback-documents.mjs` and
+  `E:\Projects\Bifrost\tools\persona-feedback.mjs`
+- Bifrost outbound operator alarm seed:
+  `E:\Projects\Bifrost\tools\operator-notification.mjs`
+- Epiphany signature/target admission pattern:
+  `epiphany-core/src/persona_feedback_admission.rs`
+- Epiphany pressure owner:
+  `epiphany-core/src/resident_self.rs` (`enqueue_resident_self_pressure`)
+- Epiphany brake owner:
+  `epiphany-core/src/cultmesh_integration.rs`
+  (`load_epiphany_cultmesh_swarm_brake`,
+  `write_epiphany_cultmesh_swarm_brake`)
+- Epiphany operator-safe status owner:
+  `EpiphanyCultMeshOperatorSnapshotEntry` in the same CultMesh module
+- Epiphany frontier Mind decision owner:
+  `epiphany-core/src/runtime_spine.rs` around
+  `commit_repo_frontier_plan_decision`
+- Ygg deployment/configuration:
+  `E:\Projects\gamecult-ops\compose\voidbot.yggdrasil.yaml`,
+  `compose\bifrost.yggdrasil.yaml`, and
+  `runbooks\epiphany-yggdrasil-deploy.md`

notes/fresh-workspace-handoff.md

@@ -3261,6 +3261,39 @@ on Ygg, proving replay/tamper refusal and byte-identical Mind, Hands, release,
 and deployment stores. Then audit the Discord operator surface needed during
 the move. No wake grant and no host reboot are authorized.
 
+Modeling confirms that current feedback is safe cognition pressure, not remote
+operation. Status beyond generic VoidBot provider availability, brake
+sleep/wake, operator-objective pressure, and exact Mind review still require a
+local CLI/SSH path. Starfire is not intrinsically required, but Discord has no
+typed ingress for those owners. Current Discord replies are local VoidBot
+repo-Face turns; resident Epiphany has no correlated Persona speech return
+path yet.
+
+The authority/design map is now
+`notes/epiphany-discord-operator-nerve.md`. July-22 commands are explicit
+status, sleep, wake, directive, reviews, and exact Adopt/Refuse/Hold review:
+Discord authenticates, Bifrost signs an expiring capability-bound command,
+Epiphany invokes one named owner primitive, and a sealed Epiphany result returns
+to Discord. No chat inference, generic argv, direct store mount, wake-and-run,
+or release/deploy authority is permitted.
+
+Epiphany core commit `f1036abd` now implements Status, Sleep, Wake, and
+Directive as a closed typed command family. Admission is separately
+Bifrost-signed and exact-target/guild/channel/actor-capability/nonce/TTL bound.
+Invalid admission writes nothing. Replays recover after crashes both before and
+after the owner consequence. Sleep owns one fixed Discord brake and cannot
+replace a foreign engaged brake. Wake releases only that brake; the live
+deployment brake produces a terminal Refused result and survives byte-identical.
+Wake creates no pressure/grant/job. Directive creates one pending
+operator-objective pressure only. Focused proof is 4/4; full core is 583 passed,
+zero failed, one ignored.
+
+No live daemon/CultNet ingress exists yet, and reviews/review are not in the
+core family. Bifrost and VoidBot Hands passes are now building the explicit
+owner-only crossing against f1036abd. After those land, add the supervised
+Epiphany network ingress and host-sealed result receipt; do not mount Epiphany
+stores into either sibling.
+
 ## Live organizational feedback half proved; projection lie cut (2026-07-19)
 
 The Ygg production Bifrost feedback provider is ready with six typed bindings.

state/map.yaml

@@ -799,6 +799,8 @@ current_status:
   - Successor `2d21c48d7425c3d6d692e506e1981f92991d82ac` was refused by live Yggdrasil admission. Its resident Self restart-looped because autonomous proposal promotion treated absent thread state as fatal. Idunn published failed health and did not admit the candidate. The owner-level correction makes missing thread state an inert, byte-identical no-work result while retaining errors for malformed present authority; the negative test and full 579/0/1 library proof pass. Cancelling the failed actuator then exposed Idunn's missing restart recovery: exact unresolved request heads survived without a result and blocked supersession. Odin commit `15a744c826f0aa2e8cc322a6543ea8a9afcd852a` CAS-terminalizes only exact prior-incarnation requests as failed on startup and passes 51/51 tests; Ygg runs binary SHA-256 `c441b9e58e85aff1d869b1e07b0a12a4795c6805619ce640184dbdcfce4e7e03`. Ops commits `584b94c` and `46425f9` move packaging before outage and seal package directories immutable but traversable.
   - Corrected Epiphany commit `154dc1eadd98dda25916ee40e7130770e145e874` is admitted on Yggdrasil. Bifrost authority digest is `d7e21f11d758e3ebaa46945ddd7acca1417ab8f8a81c3ec1932f3d5e0109e72f`; release is `sha256-16c51bb3b4914578213f0d0b64e40e17982ad45832e073d747db903509f237ed`; witness is `sha256-85702cf922ea32c07457630a7911b2b9196c8b58ee4baa642185a0b77902f234`; Idunn request is `deploy:yggdrasil-epiphany:unix:1784456326`; manifest v2 published at `2026-07-19T10:20:04Z`. The full typed check passes, signed health names exact source/release/witness and all four managed services terminal-current, supervisor and Heartbeat have zero restarts, and resident Self is stable on one MainPID with no restart growth after historical counter 10. Its operator projection reports `status=braked`, revision zero, no active turn, and no private state exposure. GPU embedding remains 100% on the GTX 1080.
   - The Starfire-independent live feedback half is proved on Ygg. The production Bifrost provider is ready with six typed bindings; one real VoidBot Discord observation is one signed delivery and one local Epiphany pressure admission. Re-import through the deployed 154d binary is byte-identical across delivery, admitted-feedback, Mind, runtime, and deployment stores. An alien signing identity is refused before writes. A substituted repository selects zero applicable deliveries and writes no feedback/Mind/runtime state, but exposed a diagnostic conceptual substitution: ingress projection v0 said `status=admitted` with zero deliveries. The successor source deletes `admittedCount` and v0's false admission status; typed v1 reports `pressure-present` or `no-applicable-deliveries` with applicable-delivery and present-pressure counts. Focused projection proof passes. The live all-scope brake intentionally prevents the final feedback-to-Imagination scheduling proof; do not release it merely to make the smoke green.
+  - Persona feedback is not the July-22 Discord operator nerve. Live addressing currently queues a local VoidBot repo-Face turn and independently exports feedback to resident Epiphany; it is not a correlated speech result from the resident Persona. Feedback remains pressure-only. The move-period must-have is a separate explicit slash-command route: Discord/VoidBot authenticates the interaction, Bifrost/Heimdall signs an expiring capability-bound command, Epiphany dispatches only the typed enum to its existing status/brake/pressure/Mind-review owner, and an Epiphany-owned result returns through Bifrost to Discord. Required commands are status, sleep, wake, directive, reviews, and exact Adopt/Refuse/Hold review. Release/deploy remain outside this nerve. Canonical map: `notes/epiphany-discord-operator-nerve.md`.
+  - Epiphany operator-command core commit `f1036abd` implements the first four closed commands: Status, Sleep, Wake, and Directive. A distinct Bifrost-signed admission is target/guild/channel/actor-capability/nonce/TTL bound; invalid admission writes nothing. Exact admission/result documents survive replay and both crash boundaries. Status returns bounded operator-safe fields. Sleep owns one fixed Discord brake with exact live protected-surface names and cannot replace a foreign engaged brake. Wake releases only that exact brake; a deployment/foreign brake returns a terminal Refused result and remains byte-identical. Wake creates no pressure/grant/job. Directive creates one pending `operator-objective` pressure with exact command provenance and cannot mutate Mind/Hands/release/deploy. Focused proof passes 4/4; full core passes 583, zero failed, one ignored. No daemon/CultNet ingress or reviews/review command exists yet.
   - Exact successor `aa3d2330062a34145cb70b527e02fa00215eac1b` passed local proof but was revoked before deployment because live packaging repeated `Permission denied` when creating a random staging directory directly under the shared root-owned release directory. This disproved the predecessor-cleanup race hypothesis. The builder's long-lived ownership lease over `/srv/epiphany/app/releases` was the incoherent boundary; no package, service, or witness was published from this attempt.
   - Release construction is now generation-scoped. The packager creates its random staging sibling beneath the exact source-commit directory, then atomically renames to the final release id within that same directory, preserving canonical absolute witness paths. Idunn keeps the shared release root root-owned and grants `epiphany-builder` only the exact commit directory during construction; cleanup removes only nested staging and seals that generation root-owned. Candidate `03e1afd24546a7ca37e900c47ca26ae257b14161` proved this boundary by sealing immutable release `sha256-fe7f25ff60d84ae9316d7b4aa2833bd5d1b65189c9d08cc64e903a83d8f35268`; its first app publication could not traverse the still builder-owned 0750 generation parent. Cleanup sealed the parent and an automatic exact-package retry started all three services. The actuator must seal the exact generation parent root-owned 0755 before app-owned publication, not only during cleanup.
   - Candidate `03e1afd24546a7ca37e900c47ca26ae257b14161` was not deployed. Projection and Heartbeat were healthy and braked, but resident Self opened the shared resident store as if every row belonged to its schema catalog and rejected the legitimate `epiphany.resident_cognition.provider_readiness` row. The exact process group was terminated, all three services were stopped, `active-release.env` was removed, and no deployment witness exists. Resident Self now constructs an owner-filtered typed view from raw envelopes, admits only its six owned document families, rejects duplicate owned identities, and preserves foreign readiness rows during writes. Full core proof passes 572/572 with one ignored.
@@ -808,4 +810,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "Commit/push the honest Persona-feedback ingress v1 projection, then integrate the move-period Discord operator map. Live Ygg already proves real Discord observation -> Bifrost signature -> Epiphany pressure, replay idempotence, alien signer refusal, and no feedback/Mind/runtime/deployment mutation on hostile target selection. Keep the all-scope brake engaged; the feedback-to-Imagination live scheduling step requires a later explicit wake grant. Before July 22, close any mapped gap that would make essential status/sleep/wake/directive/review depend on Starfire or ad hoc SSH while preserving that conversation/proposal alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."
+  next_action: "Build the Bifrost and VoidBot halves against exact operator-command core f1036abd, then add the Epiphany supervised CultNet ingress/result seal. The first live slice is owner-only Discord status/sleep/wake/directive with typed receipts; reviews/review follows through the canonical Mind gate. Keep the all-scope deployment brake engaged: Discord Wake must return Refused against it. Persona conversation remains feedback-only. No generic argv, direct store mount, Starfire dependency, release/deploy authority, or host reboot is authorized."