GameCult/Epiphany
Archived
Watch
9
0
Fork
You've already forked Epiphany
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Stop advertising unbacked surface capabilities

Browse source
This commit is contained in:
Meta Vens 2026-07-15 17:14:39 +01:00
commit dd4bb9d30d
5 changed files with 85 additions and 318 deletions
Download patch file Download diff file Expand all files Collapse all files

344
epiphany-core/src/runtime_spine.rs
View file

@ -165,23 +165,6 @@ pub const MODEL_RECEIPT_TYPE: &str = "epiphany.model_receipt.v0";
pub const TOOL_CAPABILITY_TYPE: &str = "epiphany.tool_capability.v0";
pub const TOOL_INVOCATION_INTENT_TYPE: &str = "epiphany.tool_invocation_intent.v0";
pub const TOOL_INVOCATION_RECEIPT_TYPE: &str = "epiphany.tool_invocation_receipt.v0";
pub const SURFACE_SCENE_TYPE: &str = "epiphany.surface.scene";
pub const SURFACE_FRESHNESS_TYPE: &str = "epiphany.surface.freshness";
pub const SURFACE_CONTEXT_TYPE: &str = "epiphany.surface.context";
pub const SURFACE_GRAPH_QUERY_TYPE: &str = "epiphany.surface.graph_query";
pub const SURFACE_PRESSURE_TYPE: &str = "epiphany.surface.pressure";
pub const SURFACE_REORIENT_TYPE: &str = "epiphany.surface.reorient";
pub const SURFACE_CRRC_TYPE: &str = "epiphany.surface.crrc";
pub const SURFACE_JOBS_TYPE: &str = "epiphany.surface.jobs";
pub const SURFACE_ROLES_TYPE: &str = "epiphany.surface.roles";
pub const SURFACE_ROLE_RESULT_TYPE: &str = "epiphany.surface.role_result";
pub const SURFACE_REORIENT_RESULT_TYPE: &str = "epiphany.surface.reorient_result";
pub const SURFACE_PLANNING_TYPE: &str = "epiphany.surface.planning";
pub const SURFACE_COORDINATOR_TYPE: &str = "epiphany.surface.coordinator";
pub const SURFACE_PERSONA_TYPE: &str = "epiphany.surface.persona";
pub const SURFACE_VOID_MEMORY_TYPE: &str = "epiphany.surface.void_memory";
pub const SURFACE_REPO_INITIALIZATION_TYPE: &str = "epiphany.surface.repo_initialization";
pub const SURFACE_REPO_BIRTH_RUNNER_TYPE: &str = "epiphany.surface.repo_birth_runner";
pub const RUNTIME_IDENTITY_KEY: &str = "self";
pub const RUNTIME_SWARM_BINDING_TYPE: &str = "epiphany.runtime.swarm_binding";
pub const RUNTIME_SWARM_BINDING_KEY: &str = "runtime-swarm-binding";
@ -205,24 +188,6 @@ pub const MODEL_RECEIPT_SCHEMA_VERSION: &str = "epiphany.model_receipt.v0";
pub const TOOL_CAPABILITY_SCHEMA_VERSION: &str = "epiphany.tool_capability.v0";
pub const TOOL_INVOCATION_INTENT_SCHEMA_VERSION: &str = "epiphany.tool_invocation_intent.v0";
pub const TOOL_INVOCATION_RECEIPT_SCHEMA_VERSION: &str = "epiphany.tool_invocation_receipt.v0";
pub const SCENE_SURFACE_SCHEMA_VERSION: &str = "epiphany.scene_surface.v0";
pub const FRESHNESS_SURFACE_SCHEMA_VERSION: &str = "epiphany.freshness_surface.v0";
pub const CONTEXT_SURFACE_SCHEMA_VERSION: &str = "epiphany.context_surface.v0";
pub const GRAPH_QUERY_SURFACE_SCHEMA_VERSION: &str = "epiphany.graph_query_surface.v0";
pub const PRESSURE_SURFACE_SCHEMA_VERSION: &str = "epiphany.pressure_surface.v0";
pub const REORIENT_SURFACE_SCHEMA_VERSION: &str = "epiphany.reorient_surface.v0";
pub const CRRC_SURFACE_SCHEMA_VERSION: &str = "epiphany.crrc_surface.v0";
pub const JOBS_SURFACE_SCHEMA_VERSION: &str = "epiphany.jobs_surface.v0";
pub const ROLES_SURFACE_SCHEMA_VERSION: &str = "epiphany.roles_surface.v0";
pub const ROLE_RESULT_SURFACE_SCHEMA_VERSION: &str = "epiphany.role_result_surface.v0";
pub const REORIENT_RESULT_SURFACE_SCHEMA_VERSION: &str = "epiphany.reorient_result_surface.v0";
pub const PLANNING_SURFACE_SCHEMA_VERSION: &str = "epiphany.planning_surface.v0";
pub const COORDINATOR_SURFACE_SCHEMA_VERSION: &str = "epiphany.coordinator_surface.v0";
pub const PERSONA_SURFACE_SCHEMA_VERSION: &str = "epiphany.persona_surface.v0";
pub const VOID_MEMORY_SURFACE_SCHEMA_VERSION: &str = "epiphany.void_memory_surface.v0";
pub const REPO_INITIALIZATION_SURFACE_SCHEMA_VERSION: &str =
"epiphany.repo_initialization_surface.v0";
pub const REPO_BIRTH_RUNNER_SURFACE_SCHEMA_VERSION: &str = "epiphany.repo_birth_runner_surface.v0";
pub const AGENT_MEMORY_PAYLOAD_SCHEMA_VERSION: &str = "epiphany.agent_memory.v0";
pub const CULTNET_SCHEMA_INDEX_RELATIVE: &str = "schemas/cultnet/index.json";
@ -6338,7 +6303,8 @@ pub fn runtime_spine_status(store_path: impl AsRef<Path>) -> Result<EpiphanyRunt
.filter(|intent| !receipt_intent_ids.contains(intent.intent_id.as_str()))
.count(),
supported_document_types: identity
.map(|item| item.supported_document_types)
.is_some()
.then(runtime_registered_document_types)
.unwrap_or_default(),
})
}
@ -6402,7 +6368,7 @@ pub fn runtime_hello_frame(store_path: impl AsRef<Path>) -> Result<Vec<u8>> {
agent_id: Some("self".to_string()),
role: Some("coordinator".to_string()),
display_name: Some(identity.display_name),
supported_document_types: Some(identity.supported_document_types),
supported_document_types: Some(runtime_registered_document_types()),
supported_mutation_contracts: Some(epiphany_mutation_contracts()),
supported_message_versions: Some(vec![
"cultnet.hello.v0".to_string(),
@ -6559,44 +6525,6 @@ fn mutation_contract(
}
}
fn read_only_surface_contract(
document_type: impl Into<String>,
payload_schema_version: impl Into<String>,
notes: Vec<&str>,
) -> CultNetDocumentMutationContract {
mutation_contract(
document_type,
payload_schema_version,
vec![CultNetDocumentOperation::Snapshot],
CultNetMutationAuthority::ReadOnly,
vec![],
vec![],
notes,
)
}
fn coordinator_surface_contract(
document_type: impl Into<String>,
payload_schema_version: impl Into<String>,
intent_document_types: Vec<&str>,
receipt_document_types: Vec<&str>,
notes: Vec<&str>,
) -> CultNetDocumentMutationContract {
mutation_contract(
document_type,
payload_schema_version,
vec![
CultNetDocumentOperation::Snapshot,
CultNetDocumentOperation::IntentSubmit,
CultNetDocumentOperation::ReceiptWatch,
],
CultNetMutationAuthority::Coordinator,
intent_document_types,
receipt_document_types,
notes,
)
}
fn epiphany_mutation_contracts() -> Vec<CultNetDocumentMutationContract> {
vec![
mutation_contract(
@ -7507,194 +7435,6 @@ fn epiphany_mutation_contracts() -> Vec<CultNetDocumentMutationContract> {
"Referenced artifacts remain evidence; the receipt is the native completion contract.",
],
),
read_only_surface_contract(
SURFACE_SCENE_TYPE,
SCENE_SURFACE_SCHEMA_VERSION,
vec![
"Operator-safe scene reflection over typed Epiphany state.",
"Aquarium should read this before offering live coordination actions.",
],
),
read_only_surface_contract(
SURFACE_FRESHNESS_TYPE,
FRESHNESS_SURFACE_SCHEMA_VERSION,
vec![
"Freshness reflection over retrieval, watcher, and graph staleness signals.",
"Use this to visualize retrieval and graph staleness without inventing a hidden refresh daemon.",
],
),
read_only_surface_contract(
SURFACE_CONTEXT_TYPE,
CONTEXT_SURFACE_SCHEMA_VERSION,
vec![
"Targeted graph, frontier, checkpoint, observation, and evidence context shard over typed Epiphany state.",
"Aquarium should inspect bounded state shards here instead of scraping state blobs by superstition.",
],
),
read_only_surface_contract(
SURFACE_GRAPH_QUERY_TYPE,
GRAPH_QUERY_SURFACE_SCHEMA_VERSION,
vec![
"Bounded graph traversal over typed architecture/dataflow graph state.",
"Use this for architecture/dataflow inspection and frontier neighborhoods without mutating state.",
],
),
read_only_surface_contract(
SURFACE_PRESSURE_TYPE,
PRESSURE_SURFACE_SCHEMA_VERSION,
vec![
"Current context pressure and compaction posture derived from typed pressure inputs.",
"This is a read-only warning surface, not a backdoor to force state mutation.",
],
),
coordinator_surface_contract(
SURFACE_REORIENT_TYPE,
REORIENT_SURFACE_SCHEMA_VERSION,
vec![
"epiphany.reorient_launch_intent.v0",
"epiphany.reorient_accept_intent.v0",
],
vec![
"epiphany.swarm_control_receipt.v0",
"epiphany.reorient_result_surface.v0",
],
vec![
"Reorientation policy is the typed resume/regather verdict surface.",
"Launch and acceptance stay review-gated through explicit typed intents.",
"The transport may carry a reorient launch intent and receipt, but the resume/regather verdict belongs to core.",
],
),
read_only_surface_contract(
SURFACE_CRRC_TYPE,
CRRC_SURFACE_SCHEMA_VERSION,
vec![
"CRRC recommendation surface over continuity, pressure, and reorientation signals.",
"Use this to understand continuity pressure without letting CRRC seize authority.",
],
),
coordinator_surface_contract(
SURFACE_JOBS_TYPE,
JOBS_SURFACE_SCHEMA_VERSION,
vec![
"epiphany.job_launch_intent.v0",
"epiphany.job_interrupt_intent.v0",
],
vec!["epiphany.swarm_control_receipt.v0"],
vec![
"Job reflection over typed job bindings and runtime-spine lifecycle receipts.",
"Heartbeat/runtime-spine owns activation; callers submit typed intents and watch receipts.",
"Launch receipts must name decisionOwner, transportRole, and any hostExecutorRole so transport never grows an unreadable second opinion.",
],
),
coordinator_surface_contract(
SURFACE_ROLES_TYPE,
ROLES_SURFACE_SCHEMA_VERSION,
vec!["epiphany.role_launch_intent.v0"],
vec!["epiphany.swarm_control_receipt.v0"],
vec![
"Role ownership surface for fixed Epiphany lanes and launch affordances.",
"Treat this as the discoverable lane catalog for Aquarium.",
],
),
coordinator_surface_contract(
SURFACE_ROLE_RESULT_TYPE,
ROLE_RESULT_SURFACE_SCHEMA_VERSION,
vec!["epiphany.role_accept_intent.v0"],
vec!["epiphany.swarm_control_receipt.v0"],
vec![
"Role findings are typed review surfaces accepted through explicit role acceptance intents.",
"Semantic findings remain explicitly review-gated.",
],
),
coordinator_surface_contract(
SURFACE_REORIENT_RESULT_TYPE,
REORIENT_RESULT_SURFACE_SCHEMA_VERSION,
vec!["epiphany.reorient_accept_intent.v0"],
vec!["epiphany.swarm_control_receipt.v0"],
vec![
"Completed reorientation findings are typed review surfaces accepted through explicit reorientation acceptance intents.",
],
),
coordinator_surface_contract(
SURFACE_PLANNING_TYPE,
PLANNING_SURFACE_SCHEMA_VERSION,
vec![
"epiphany.planning_update_intent.v0",
"epiphany.objective_adoption_intent.v0",
],
vec!["epiphany.swarm_control_receipt.v0"],
vec![
"Planning projection over captures, backlog, roadmap streams, and Objective Drafts.",
"Backlog, captures, and Objective Drafts are planning state until explicit adoption.",
],
),
read_only_surface_contract(
SURFACE_COORDINATOR_TYPE,
COORDINATOR_SURFACE_SCHEMA_VERSION,
vec![
"Fixed-lane recommendation surface derived from typed role, pressure, reorientation, and result signals.",
"Aquarium should treat this as the primary action oracle, not invent its own scheduler.",
],
),
coordinator_surface_contract(
SURFACE_PERSONA_TYPE,
PERSONA_SURFACE_SCHEMA_VERSION,
vec![
"epiphany.persona_bubble_intent.v0",
"epiphany.character_turn_intent.v0",
"epiphany.discord_persona_post_intent.v0",
"epiphany.reddit_persona_post_intent.v0",
],
vec![
"epiphany.persona_bubble.v0",
"epiphany.persona_chat.v0",
"epiphany.character_turn_packet.v0",
"epiphany.persona_reddit_post.v0",
"epiphany.persona_other_request.v0",
],
vec![
"Persona bubble, Discord chat, Reddit post, and Other crossing-request artifacts are projected as discriminated typed references; public crossings route through Bifrost.",
"The Persona surface owns read projection only. It does not own speech eligibility, Mind admission, Bifrost request acceptance, publication, or provider delivery.",
"Humans talk to Persona; sealed inner thoughts stay behind the projection boundary.",
],
),
read_only_surface_contract(
SURFACE_VOID_MEMORY_TYPE,
VOID_MEMORY_SURFACE_SCHEMA_VERSION,
vec![
"Void-derived memory status/search/context availability is projected from the typed Void memory bridge.",
"This is an inspection surface for the memory organs, not a license to bypass typed Epiphany state.",
],
),
coordinator_surface_contract(
SURFACE_REPO_INITIALIZATION_TYPE,
REPO_INITIALIZATION_SURFACE_SCHEMA_VERSION,
vec![
"epiphany.repo_startup_intent.v0",
"epiphany.repo_initialization_accept_intent.v0",
],
vec![
"epiphany.repo_personality_artifacts.v0",
"epiphany.repo_initialization_record.v0",
],
vec![
"Repo birth/startup status is projected from typed repo-personality startup and accept-init receipts.",
"Birth specialists are startup-only and remain outside the heartbeat lane system.",
],
),
coordinator_surface_contract(
SURFACE_REPO_BIRTH_RUNNER_TYPE,
REPO_BIRTH_RUNNER_SURFACE_SCHEMA_VERSION,
vec!["epiphany.repo_birth_run_intent.v0"],
vec![
"epiphany.repo_birth_runner.v0",
"epiphany.repo_initialization_record.v0",
],
vec![
"Startup-only birth runner plan/run affordances are projected from typed birth-runner receipts.",
"Aquarium should review birth artifacts and accept them explicitly instead of growing a hidden wizard.",
],
),
]
}
@ -11215,6 +10955,14 @@ pub(crate) mod tests {
created_at: "2026-05-06T00:00:00Z".to_string(),
},
)?;
let mut cache = runtime_spine_cache(&store)?;
cache.pull_all_backing_stores()?;
let mut legacy_identity =
cache.get_required::<EpiphanyRuntimeIdentity>(RUNTIME_IDENTITY_KEY)?;
legacy_identity
.supported_document_types
.push("epiphany.surface.persona".to_string());
cache.put(RUNTIME_IDENTITY_KEY, &legacy_identity)?;
let frame = runtime_hello_frame(&store)?;
let payload_len = u32::from_be_bytes([frame[0], frame[1], frame[2], frame[3]]) as usize;
let message =
@ -11230,12 +10978,21 @@ pub(crate) mod tests {
} => {
assert_eq!(runtime_id, "epiphany-test");
assert_eq!(runtime_kind, "epiphany.native");
let supported_document_types = supported_document_types.unwrap();
assert!(supported_document_types.contains(&RUNTIME_JOB_RESULT_TYPE.to_string()));
assert!(
supported_document_types
.unwrap()
.contains(&RUNTIME_JOB_RESULT_TYPE.to_string())
.iter()
.all(|document_type| !document_type.starts_with("epiphany.surface.")),
"Hello must advertise only runtime-backed document capabilities"
);
let contracts = supported_mutation_contracts.unwrap();
assert!(
contracts.iter().all(|contract| {
!contract.document_type.starts_with("epiphany.surface.")
}),
"schema vocabulary is not runtime mutation authority"
);
let heartbeat_contract = contracts
.iter()
.find(|contract| contract.document_type == HEARTBEAT_STATE_TYPE)
@ -11327,30 +11084,6 @@ pub(crate) mod tests {
.iter()
.any(|note| note.contains("evidence ingress guardian"))
}));
let coordinator_contract = contracts
.iter()
.find(|contract| contract.document_type == SURFACE_COORDINATOR_TYPE)
.expect("coordinator surface should advertise a read-only contract");
assert_eq!(
coordinator_contract.authority,
CultNetMutationAuthority::ReadOnly
);
let persona_contract = contracts
.iter()
.find(|contract| contract.document_type == SURFACE_PERSONA_TYPE)
.expect("Persona surface should advertise an interactive contract");
assert_eq!(
persona_contract.authority,
CultNetMutationAuthority::Coordinator
);
assert!(
persona_contract
.receipt_document_types
.as_ref()
.is_some_and(|items| items
.iter()
.any(|item| item == "epiphany.persona_bubble.v0"))
);
let operator_snapshot_contract = contracts
.iter()
.find(|contract| {
@ -11395,16 +11128,6 @@ pub(crate) mod tests {
.operations
.contains(&CultNetDocumentOperation::ReceiptWatch)
);
assert!(
contracts
.iter()
.all(|contract| contract.document_type != "epiphany.surface.rider_bridge")
);
assert!(
contracts
.iter()
.all(|contract| contract.document_type != "epiphany.surface.unity_bridge")
);
let coordinator_run_receipt_contract = contracts
.iter()
.find(|contract| contract.document_type == COORDINATOR_RUN_RECEIPT_TYPE)
@ -11418,18 +11141,6 @@ pub(crate) mod tests {
.operations
.contains(&CultNetDocumentOperation::ReceiptWatch)
);
let birth_contract = contracts
.iter()
.find(|contract| contract.document_type == SURFACE_REPO_BIRTH_RUNNER_TYPE)
.expect("repo birth runner surface should advertise startup actions");
assert!(
birth_contract
.receipt_document_types
.as_ref()
.is_some_and(|items| items
.iter()
.any(|item| item == "epiphany.repo_birth_runner.v0"))
);
let model_contract = contracts
.iter()
.find(|contract| contract.document_type == MODEL_REQUEST_TYPE)
@ -11494,7 +11205,8 @@ pub(crate) mod tests {
}
#[test]
fn runtime_spine_schema_catalog_includes_surface_and_control_receipts() -> Result<()> {
fn schema_catalog_discovers_surface_vocabulary_separately_from_runtime_capabilities()
-> Result<()> {
let registry = epiphany_schema_registry()?;
let schemas = registry.list(&cultnet_rs::CultNetSchemaCatalogOptions {
include_schema_json: false,
@ -11502,12 +11214,12 @@ pub(crate) mod tests {
kinds: None,
});
assert!(schemas.iter().any(|schema| {
schema.document_type.as_deref() == Some(SURFACE_SCENE_TYPE)
&& schema.schema_version.as_deref() == Some(SCENE_SURFACE_SCHEMA_VERSION)
schema.document_type.as_deref() == Some("epiphany.surface.scene")
&& schema.schema_version.as_deref() == Some("epiphany.scene_surface.v0")
}));
assert!(schemas.iter().any(|schema| {
schema.document_type.as_deref() == Some(SURFACE_COORDINATOR_TYPE)
&& schema.schema_version.as_deref() == Some(COORDINATOR_SURFACE_SCHEMA_VERSION)
schema.document_type.as_deref() == Some("epiphany.surface.coordinator")
&& schema.schema_version.as_deref() == Some("epiphany.coordinator_surface.v0")
}));
assert!(schemas.iter().any(|schema| {
schema.document_type.as_deref() == Some("epiphany.role_launch_intent.v0")

19
notes/conceptual-substitution-audit-2026-07-12.md
View file

@ -1697,3 +1697,22 @@ artifact arrays, and no producer writes a document with that schema version.
Real Reddit and Other artifacts exist but are not registered as output
contracts. Rebuild that surface around typed discriminated artifact references,
register the real outputs, or stop advertising them as typed surface outputs.
### Closure update (2026-07-15)
Commit `65445623` closed the local Persona projection wound: the MVP-status
projection now emits strict content-free typed artifact references, and the
real Reddit and Other artifact schemas are registered. The subsequent systemic
audit found the larger substitution: all seventeen `epiphany.surface.*` types
were still Hello-advertised runtime mutation capabilities without providers,
Snapshot resolvers, or action dispatchers. Those unbacked contracts and dead
runtime constants are now cut. Surface schemas may remain discoverable
vocabulary and local projection validators, but cannot claim executable wire
support.
The next adjacent surface frontier is the generic central Eve template builder,
which synthesizes cluster surface rows and actions while claiming the cluster
daemon owns their contents. A surface earns readmission only through an owning
provider publishing a typed CultMesh document that survives Snapshot, schema
validation, and Eve lowering; advertised actions additionally require a real
typed dispatcher and receipt path.

35
notes/fresh-workspace-handoff.md
View file

@ -1440,3 +1440,38 @@ artifact:
This proves the exact recovery/resumption and fencing path. It does not prove
global deployability. The remaining deployment evidence is still the real
reboot/logon survival cycle above.
## Runtime surface capability purification (2026-07-15)
The systemic surface audit separated a real local projection from false wire
authority. Commit `65445623` remains valid: it rebuilt
`epiphany.persona_surface.v0` as a strict, content-free MVP-status projection
over typed Persona artifact references, registered the real Reddit and Other
artifact schemas, and kept speech eligibility, Mind admission, Bifrost
acceptance, publication, and provider delivery outside the projection. Those
schemas remain discoverable vocabulary and local projection validators. That
does not make the projection a CultNet runtime capability.
All seventeen unbacked `epiphany.surface.*` mutation contracts and their dead
runtime constants are now removed. None had a typed document writer, Snapshot
resolver, or action dispatcher; the compound MVP-status JSON was not a
substitute for those owners. Runtime Hello and runtime status now derive the
current executable mutation-contract list instead of trusting the historical
`supported_document_types` stored in runtime identity. The live canonical
store still carries that old field as inert history, but it cannot decide wire
or status truth. A real canonical hello-frame contained zero
`epiphany.surface.*` capabilities after the cut.
Re-admission is deliberately expensive: an owning organ must prove
`provider publish -> typed CultMesh document -> Snapshot -> schema validation
-> Eve lowering`. Any advertised action additionally needs a real typed
dispatcher and receipt path. Schema registration alone proves vocabulary, not
runtime support.
The adjacent Modeling frontier is the generic central Eve template builder.
It currently synthesizes cluster rows and supported actions while its own prose
claims the cluster daemon owns surface contents. That is the next conceptual
substitution to map and cut or rebuild around provider publication. It does not
replace the current deployment next action: first complete the real Windows
reboot/logon proof for Task Scheduler, the Yggdrasil tunnel, Idunn, and the
launch-correlated semantic projector heartbeat.

BIN
state/ledgers.msgpack
View file

Binary file not shown.

5
state/map.yaml
View file

@ -205,9 +205,9 @@ accepted_design:
- Native `epiphany-mvp-coordinator` is the first auditable coordinator runner: it drives the fixed single-user lanes through app-server APIs, opens a native runtime-spine session, records native runtime job/result receipts for launched specialists and reorient workers when terminal results arrive, keeps semantic findings review-gated by default, and writes coordinator summaries, JSONL steps, rendered snapshots, transcript, stderr, runtime-spine status, and final next-action artifacts. Runtime-spine remains owner of `epiphany.coordinator_run_receipt.v0`, Hands/Substrate Gate remain owners of action permission, and thread-state acceptance receipts remain owners of role review/admission; local Verse now gets operator-safe `epiphany.cultmesh.coordinator_run_receipt.v0`, `epiphany.cultmesh.hands_action_gate.v0`, and `epiphany.cultmesh.role_review_event.v0` mirrors for discovery/readback. It refuses direct backend-completion mutation; full specialist completion smoke must use live workers while the execution path is cauterized into CultNet.
- Native `epiphany-runtime-spine` is the first Codex-independent runtime vertebra: it initializes and inspects typed CultCache `epiphany.runtime.identity`, `epiphany.runtime.session`, `epiphany.runtime.job`, `epiphany.runtime.job_result`, and `epiphany.runtime.event` documents, opens/completes native jobs with result records, snapshots jobs by id, and can emit a framed CultNet hello message advertising the native document and mutation contract surface. App-server launch now opens typed runtime jobs; `roleResult` / `reorientResult` read heartbeat-backed typed job results only; and `roleAccept` / `reorientAccept` accept completed heartbeat findings from the typed runtime-spine path without opening the Codex SQLite state runtime.
- CultNet public API shape is schema-first and mutation-contract-first: hello frames advertise readable document types, allowed operations, mutation authority, typed intent document types, and typed receipt document types. Aquarium and swarm clients should submit intents and watch receipts instead of inventing JSON-RPC verbs or blindly replacing authoritative state.
- Runtime-spine hello now advertises the interactive surface catalog as CultNet contracts, not just the deep runtime documents. Scene, pressure, reorient, CRRC, jobs, roles, role-result, reorient-result, planning, coordinator, Persona, Void memory, and repo initialization/birth runner publish explicit read/write posture so Aquarium can discover affordances from the wire contract instead of carrying a private button-to-command gospel. Rider and Unity bridge contracts are quarantined optional environment surfaces until engine dogfood resumes.
- Runtime-spine hello advertises only document and mutation capabilities backed by the native runtime body. `epiphany.surface.*` schemas remain discoverable vocabulary for local projections, but they are absent from Hello until an owning provider publishes a typed document with a real Snapshot resolver; actions additionally require a typed dispatcher and receipt path. Aquarium must not turn schema discovery into capability discovery.
- Epiphany's public pitch is project-native agency, not just better prompting. Aquarium is the clearest client, but Discord roles, voice/WebRTC rooms, stream overlays, native CLIs, and other CultNet tools should all speak to the same typed project/Personas substrate. Personas advocate for repo needs, answer from jurisdiction, and can propose work; the scheduler and coordinator decide what thinks next, while review gates decide what may mutate canonical state.
- Epiphany publishes its Aquarium-facing CultNet receipts locally under `schemas/cultnet/`, and `epiphany-runtime-spine schema-catalog --include-schema-json true` emits a merged builtin-plus-local schema catalog for consumers. The local receipts cover runtime-spine documents, durable agent/heartbeat/ledger state, `epiphany.surface.*` operator projections, control intents, and receipt/artifact payloads. Vendored `cultnet-rs` is aligned to the canonical C# CultNet raw record shapes: replication uses `schemaId` plus `recordKey`, snapshot filters use `schemaIds` / `recordKeys`, and hello advertises typed mutation contracts.
- Epiphany publishes its schema vocabulary locally under `schemas/cultnet/`, and `epiphany-runtime-spine schema-catalog --include-schema-json true` emits a merged builtin-plus-local schema catalog for consumers. The catalog covers runtime-spine documents, durable agent/heartbeat/ledger state, local `epiphany.surface.*` projection vocabulary, control intents, and receipt/artifact payloads; catalog presence does not prove runtime support. Vendored `cultnet-rs` is aligned to the canonical C# CultNet raw record shapes: replication uses `schemaId` plus `recordKey`, snapshot filters use `schemaIds` / `recordKeys`, and hello advertises only current typed mutation capabilities.
- Epiphany now owns the canonical schema paperwork in `schemas/`: a local mirror of `ghostlight.agent-state.schema.json`, plus human-facing receipts for canonical agent-state shape, standing role-trait glossary, heartbeat store shape, Persona state, WorkOrgan state, and repo-personality birth projection. Trait names like `routing_discipline` are now documented at the source instead of existing only in live organ-state records, startup templates, or stale Ghostlight notes.
- Organ-state doctrine now distinguishes `work_organ` from `persona`. Most Epiphany sub-agents want lean identity, memory, goals, values, private-note growth, and heartbeat activation because effectiveness matters more than theatrical density. Epiphany Persona, VoidBot repo Personas, and Ghostlight characters want portable Persona state: denser personality, provenance, public presentation, generic candidate actions, affect, relationship pressure, perceived overlays, and appraisal-shaped fallibility. `anchoredThought.extensions` is preservation-only sludge quarantine, not portable authority. The classification is now queryable through native agent-memory status, character-loop packets, and `epiphany.agent_utterance_state.v0` as `organStateProfile`; `epiphany-agent-memory-store project-persona --role-id Persona` projects the local Persona record into `gamecult.persona_state.v0`.
- Persona packets now expose deterministic Ghostlight-style projection, appraisal, and reaction seeds built from local canonical traits, relationship pressure, perceived overlays, and visible stimulus. They also carry `epiphany.agent_utterance_state.v0`: a memory-free speech-conditioning document derived from the organ-state record plus heartbeat physiology, including a 32-axis current emotional-state projection and the fixed 64-float `weksa.utterance_embedding_handoff.v0.1` character-state vector for AquaSynth/Weksa utterance embedding. This makes embodied response machinery available to the public mouth without granting omniscience, leaking memories into speech embeddings, or silently mutating state. Multiple Persona actors remain part of the long-plan; the current singular `Persona` role is an MVP simplification, not the intended endpoint.
@ -717,5 +717,6 @@ current_status:
- Windows host survival authority is Task Scheduler, not SCM. Tasks `Epiphany-Idunn-Managed-Service-Reconciler` and `GameCult-Yggdrasil-Tunnel` run as current user Meta with `InteractiveToken`/Limited privilege, `AtLogOn` plus a one-minute recurring recovery trigger, `IgnoreNew`, zero execution limit, and restart-on-failure at one-minute intervals (999 attempts). Each task owns only after-login process presence through one exact direct foreground action. Idunn remains sole owner of managed-service reconciliation and projector child lifecycle; Task Scheduler cannot mint projector readiness, claims, grants, recovery, or terminal evidence. `gamecult-ops` owns the Yggdrasil tunnel profile and foreground SSH process; Epiphany only consumes pinned local Qdrant ports. This is explicitly after-login physiology, not pre-login, boot-time, machine-wide, or Windows-service survival.
- Live recurrence proof killed reconciler PID 24152 and observed Task Scheduler start exactly one replacement PID 25428. Killing projector PID 29868 then caused Idunn to launch PID 19888 with launch receipt `4d406060-6582-473a-9322-9f4ccc8b322f`; ready heartbeat `79fe3143-28a8-40fe-9547-0287159082e6` names provider incarnation `projector-59217a66-e3e2-44c3-b000-36af3d43b043` and the exact startup correlation. Tunnel recurrence killed SSH PID 22652 and observed PID 30444 start at 11:37:44 with Qdrant REST healthy.
- Native feature-gated `epiphany-semantic-recovery-smoke` now proves abandoned-claim recovery through production process and authority boundaries without touching canonical state. In GUID-scoped Mind, Modeling, and Verse stores, a real projector acquires epoch 1, stalls against a fixture-local endpoint, and is killed; the supervisor consumes an exact current policy/lifecycle/heartbeat chain to recover epoch 2; a replacement projector consumes that authorization through the common execution path. Typed read-only inspection proves the old attempt failed, the authorization was consumed, epoch 2 is running, and the old owner is fenced; readiness and query eligibility are real. GUID Qdrant collection names are preflighted absent, deleted, and verified absent by exact 404. The fixture has no live/default Mind, Modeling, Verse, or mutation-fixture mouth. Proof `C:\Users\Meta\AppData\Local\Temp\epiphany-semantic-recovery-1152736f-b8a2-4cf0-ab24-c8a3993a0eb7\proof.json` passed.
- The `epiphany.surface.*` Hello fiction is cut. Commit `65445623` remains the completed local Persona projection repair: `epiphany.persona_surface.v0` is a strict, content-free MVP-status projection over typed Persona artifact references, and its schemas remain useful discoverable vocabulary for local projection validation. It is not a CultNet runtime capability. All seventeen unbacked `epiphany.surface.*` mutation contracts and their dead runtime constants are removed; no surface type may appear in Hello until an owning provider can prove `provider publish -> typed CultMesh document -> Snapshot -> schema validation -> Eve lowering`, with a real typed dispatcher and receipt path for every advertised action. Runtime Hello and runtime status derive the current executable contract list. They ignore stale `supported_document_types` persisted in runtime identity, so the live canonical store's historical field cannot decide present wire authority or status. A canonical real hello-frame proved zero `epiphany.surface.*` capabilities. The generic centrally authored Eve templates are the next adjacent conceptual-substitution frontier: they currently synthesize cluster surface rows while claiming daemon ownership. Map and cut that authority before treating them as live provider surfaces, but do not displace the reboot/logon deployment proof as the current next action.
- Historical Windows SCM material in this map is rejected-path evidence, not live authority. Arbitrary console `sc.exe` installation, elevated service execution runbooks/audits, cluster-service install/start/stop/control, `swarm-online-runbook`, service-manager action queues, and their wrapper routes no longer describe deployable physiology or actionable next work. Their receipts may remain sealed historical evidence, but they cannot decide liveness, readiness, recovery, or operator action. The console binaries never implemented the Windows service-control dispatcher and therefore could not honestly own SCM service state.
next_action: Prove this Task Scheduler boundary across a real reboot and user logon: both tasks must return to Running, the gamecult-ops foreground tunnel must restore `127.0.0.1:16333`/`:16334`, Idunn must reconcile exactly one projector child, and that child must publish a fresh launch-correlated ready heartbeat without operator-shell custody. Record that this proves after-login recovery only; the isolated abandoned-claim recovery proof is complete but does not establish global deployability. Do not resume SCM hardening or resurrect cluster-service/elevated-runbook wrappers.