diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index e2453089..4fbb81fe 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -39,7 +39,7 @@ remembers doctrine; the branch remembers the blade. - `epiphany-openai-runtime` worker result ingress now parses assistant output directly into typed role/reorient ingress structs selected from the durable launch document, stores nested `statePatch` and `selfPatch` as typed MessagePack in `EpiphanyRuntimeRoleWorkerResult`, and no longer passes worker result data through generic `serde_json::Value`. JSON survives there only as the OpenAI text-output edge before typed deserialization. - Agent self-memory review/application now has typed `AgentSelfPatch` core APIs. JSON-value selfPatch functions are compatibility wrappers for CLI/artifact ingress; native callers should parse once at the edge and then call `review_agent_self_patch_document` / `apply_agent_self_patch_document`. Role-result self-persistence no longer exports a JSON-value reviewer; the live API is `review_role_self_patch_document`. - `epiphany-openai-codex-spine` no longer uses Codex's Responses client, model-provider layer, `codex-api`, `codex-model-provider`, `codex-model-provider-info`, or `codex-protocol` for outbound model requests. It reaches `codex-login` only through `epiphany-openai-auth-spine` so credential loading/refresh stays Codex-compatible while request/status/event/runtime surfaces stay typed Epiphany documents. -- `notes/repo-fractal-dataflow-cache-plan.md` is the current repo-model direction drawn from `Fractal Domains And The Cache That Bites`: the repo's semantic architecture/dataflow graph should be a typed CultCache document organ, with Qdrant storing rebuildable embeddings for nodes, edges, conservative summaries, and context cuts. Qdrant is a contribution cache, not truth. The coding lane should eventually receive typed repo context packets for orientation and use source reads mainly for exact patch verification. +- `notes/repo-fractal-dataflow-cache-plan.md` is the current repo-model direction drawn from `Fractal Domains And The Cache That Bites`: the repo's semantic architecture/dataflow graph should be a typed CultCache document organ, with Qdrant storing rebuildable embeddings for nodes, edges, conservative summaries, and context cuts. Qdrant is a contribution cache, not truth. The roadmap's first implementable ticket is typed RepoModel documents plus pure `epiphany-core::repo_model` id/validation/freshness/context-cut tests; scanner, CultCache persistence, Qdrant, CultNet advertisement, and coding-lane integration come after the typed bones exist. - Durable Epiphany state types now live in root crate `epiphany-state-model`. `codex-protocol` re-exports them only so old rollout/API callers keep compiling; do not add new durable `Epiphany*` state structs under `vendor/codex`. `epiphany-core` imports the native model directly and no longer depends on `codex-protocol`. Pressure derives from native `EpiphanyTokenUsageSnapshot`; Codex token telemetry is mapped at the bridge. Codex rollout/event reconstruction now lives in `codex-core::epiphany_rollout`, where the Codex `RolloutItem` / `EventMsg` types belong. Exact retrieval path matching is native to `epiphany-core`, so `epiphany-core` has no direct vendored Codex crate dependency. - State-update contract proof and job launch/interrupt DTO ownership now live in native `epiphany-core`. The old giant `codex_thread.rs` Epiphany state-update test fixture was cut, and `epiphany-codex-bridge` no longer imports Epiphany job launch request types from `codex_core`; vendored `CodexThread` may call the native mutation/launch law for compatibility, but it must not regain ownership of state-update semantics, heartbeat launch-plan policy, or Epiphany DTOs. - MCP remains JSON because MCP is a JSON protocol. The latest processor cut only moved MCP refresh/OAuth/status/resource/tool-call route handling into `codex_message_processor/mcp_routes.rs`, reducing the root processor to about 8,977 lines; it did not claim MCP payloads are CultNet or make MCP an Epiphany-owned runtime contract. diff --git a/notes/repo-fractal-dataflow-cache-plan.md b/notes/repo-fractal-dataflow-cache-plan.md index 99f45786..481d79e9 100644 --- a/notes/repo-fractal-dataflow-cache-plan.md +++ b/notes/repo-fractal-dataflow-cache-plan.md @@ -382,3 +382,472 @@ The target is not "faster search." The target is: The renderer from the article does not wake every branch of the fractal tree. Epiphany should not wake the whole repo every time it wants to move one bolt. + +## Implementation Roadmap + +The plan above is architecturally concrete, but not yet implementation-concrete. +This roadmap is the cut order. Do not jump to Qdrant first. A fast lie is still +a lie; it just gets to the wrong answer with better posture. + +### Phase 0: Name The Contract + +Objective: make the target type surface explicit before any scanner, model, or +vector store can smuggle authority into the system. + +Files: + +- `epiphany-state-model/src/lib.rs` +- `schemas/cultnet/` +- `epiphany-core/src/lib.rs` + +Add typed state-model structs: + +- `EpiphanyRepoModelSnapshot` +- `EpiphanyRepoDomain` +- `EpiphanyRepoNode` +- `EpiphanyRepoEdge` +- `EpiphanyRepoSummary` +- `EpiphanyRepoSourceHash` +- `EpiphanyRepoEmbeddingManifest` +- `EpiphanyRepoFreshness` +- `EpiphanyRepoContextQuery` +- `EpiphanyRepoContextPacket` +- `EpiphanyRepoModelPatchCandidate` +- `EpiphanyRepoModelReceipt` + +Minimum fields: + +- stable id +- schema version +- workspace/repo id +- source hash identity +- owner domain id +- kind enum +- confidence/freshness status +- code refs +- evidence refs where applicable +- summary text where applicable + +Tests: + +- serde round trip for every document type +- JSON schema generation or schema catalog inclusion for every public contract +- stable defaults do not serialize empty ballast + +Exit criteria: + +- The repo-model document vocabulary compiles without Qdrant. +- The contracts can be advertised without any scanner implementation. + +### Phase 1: Pure Repo Model Core + +Objective: build the in-memory law engine that can validate and select graph +context without touching disk, Qdrant, Ollama, Codex, or app-server routing. + +Files: + +- `epiphany-core/src/repo_model.rs` +- `epiphany-core/src/repo_model/ids.rs` +- `epiphany-core/src/repo_model/validation.rs` +- `epiphany-core/src/repo_model/freshness.rs` +- `epiphany-core/src/repo_model/context_cut.rs` +- `epiphany-core/src/lib.rs` + +Functions: + +- `repo_model_domain_id(kind, path_or_name) -> String` +- `repo_model_node_id(domain_id, kind, path, symbol) -> String` +- `repo_model_edge_id(source_id, target_id, kind, code_refs) -> String` +- `validate_repo_model_snapshot(snapshot) -> Vec` +- `derive_repo_model_freshness(snapshot, source_hashes, dirty_paths) -> EpiphanyRepoFreshness` +- `plan_repo_context_cut(snapshot, query, budget) -> EpiphanyRepoContextPacket` + +Tests: + +- node ids are stable from domain/path/symbol +- edge ids are stable and collision-resistant for kind/source/target +- edges referencing missing nodes are rejected +- summaries referencing missing child ids are rejected +- dirty source hashes mark affected nodes and summaries stale +- context planner returns a parent summary when it is fresh, high-confidence, + and within task scope +- context planner descends into children when summary confidence is low, + freshness is stale, task relevance is high, or exact refs are required +- context packet carries required verification seams when nodes name tests + +Exit criteria: + +- `cargo test --manifest-path .\epiphany-core\Cargo.toml --lib repo_model` + passes. +- Repo context packets can be produced from fixture documents without Qdrant. + +### Phase 2: Deterministic Scanner + +Objective: populate a useful repo model from deterministic source facts before +model-assisted semantic extraction enters the room wearing perfume. + +Files: + +- `epiphany-core/src/repo_model/scanner.rs` +- `epiphany-core/src/repo_model/rust_scanner.rs` +- `epiphany-core/src/repo_model/doc_scanner.rs` +- `epiphany-core/src/repo_model/git_snapshot.rs` +- `epiphany-core/src/bin/epiphany-repo-model.rs` + +Command: + +```powershell +cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-repo-model -- scan --workspace . +``` + +Scanner output: + +- crate/workspace domains from Cargo manifests +- module/file domains from Rust source paths +- binary/test/example domains where discoverable +- schema/prompt/doc domains from known Epiphany paths +- deterministic ownership edges from workspace/module nesting +- dependency edges from manifests +- test edges from obvious test modules/files +- source hashes for every scanned path + +Do not parse all Rust semantics by hand. Start with conservative file/module +domain facts. Pull in `syn` later only where it earns its cost. + +Tests: + +- fixture workspace produces expected domains and ownership edges +- ignored/build paths stay excluded +- dirty git snapshot maps to relative paths +- scanner output validates through Phase 1 validation + +Exit criteria: + +- A fresh scan can produce a valid typed snapshot and context packet for a + fixture repo without embeddings. + +### Phase 3: CultCache Store And Native CLI + +Objective: make repo-model state durable as typed MessagePack documents, not a +JSON export hiding under a nicer noun. + +Files: + +- `epiphany-core/src/repo_model/store.rs` +- `epiphany-core/src/bin/epiphany-repo-model.rs` +- `state/` only as runtime output, not checked-in sample sludge + +Commands: + +```powershell +cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-repo-model -- scan --workspace . --store .\state\repo-model.msgpack +cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-repo-model -- status --store .\state\repo-model.msgpack +cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-repo-model -- context --store .\state\repo-model.msgpack --query "heartbeat scheduling split" +``` + +Tests: + +- MessagePack round trip for snapshot, summaries, manifest, and receipts +- status reports missing, stale, ready, and invalid states correctly +- context command works against a fixture store + +Exit criteria: + +- Repo model can be created, persisted, read, and queried locally with no + app-server and no Qdrant. + +### Phase 4: Summary Construction + +Objective: build conservative summaries that can stand in for child detail +without lying to the coding agent. + +Files: + +- `epiphany-core/src/repo_model/summary.rs` +- `epiphany-core/src/repo_model/context_cut.rs` + +Deterministic summary fields: + +- domain/node title +- owned invariant +- known inputs +- known outputs +- child ids +- source hash set +- public code refs +- test seam refs +- confidence +- freshness +- blast-radius hint + +Model-assisted summaries remain patch candidates only: + +- They cite source refs. +- They include confidence. +- They do not overwrite deterministic ownership. +- They require review before promotion to accepted durable project truth. + +Tests: + +- summary source hash is derived from child hashes +- stale child makes parent summary stale +- missing invariant lowers confidence +- model-assisted summary candidate cannot become accepted graph truth without a + review receipt + +Exit criteria: + +- Context packets can include parent summaries with explicit confidence and + freshness. + +### Phase 5: Split Retrieval Backend + +Objective: stop `retrieval.rs` from being the one-room apartment where BM25, +chunking, Ollama, Qdrant, manifests, and future repo-model cache code all sleep +in the same chair. + +Files: + +- `epiphany-core/src/retrieval.rs` +- `epiphany-core/src/retrieval/chunking.rs` +- `epiphany-core/src/retrieval/bm25.rs` +- `epiphany-core/src/retrieval/embedding.rs` +- `epiphany-core/src/retrieval/qdrant.rs` +- `epiphany-core/src/retrieval/manifest.rs` + +Keep behavior stable: + +- existing retrieve/index APIs continue to work +- Qdrant/Ollama request shape remains covered by tests +- BM25 fallback remains available + +Tests: + +- existing retrieval tests pass +- Qdrant client mock tests move to `retrieval/qdrant.rs` +- embedding mock tests move to `retrieval/embedding.rs` +- manifest freshness tests move to `retrieval/manifest.rs` + +Exit criteria: + +- Repo model can depend on embedding/vector traits without importing the whole + old retrieval monolith. + +### Phase 6: Qdrant Repo-Model Cache + +Objective: add fast vector selection over typed repo-model documents without +letting the vector store own architecture truth. + +Files: + +- `epiphany-core/src/repo_model/embedding_cache.rs` +- `epiphany-core/src/repo_model/context_cut.rs` +- `epiphany-core/src/retrieval/qdrant.rs` +- `epiphany-core/src/retrieval/embedding.rs` + +Documents to embed: + +- repo domains +- repo nodes +- repo edges +- repo summaries +- selected source excerpts +- prior accepted context packets, if useful later + +Qdrant point payloads may contain only: + +- typed document id +- document type +- workspace/repo id +- source hash +- summary label +- freshness +- compact code refs + +They must not contain the full canonical node/edge/summary payload. + +Tests: + +- cache indexes typed document ids and source hashes +- stale source hash marks points stale or schedules refresh +- missing Qdrant falls back to pure graph context planner +- Qdrant hit for missing typed document id is ignored and reported +- vector ranking can influence context-cut order but cannot invent packet + contents absent from typed documents + +Exit criteria: + +- Context query uses Qdrant for candidate ranking when ready. +- Deleting Qdrant preserves correctness with slower graph traversal. + +### Phase 7: CultNet Runtime Surface + +Objective: make repo-model context a native Epiphany contract instead of another +Codex JSON-RPC endpoint. + +Files: + +- `epiphany-core/src/runtime_spine.rs` +- `epiphany-core/src/bin/epiphany-runtime-spine.rs` +- `schemas/cultnet/` +- `epiphany-core/src/repo_model.rs` + +Advertise contracts: + +- `epiphany.repo_model.status` +- `epiphany.repo_model.scan_intent` +- `epiphany.repo_model.scan_receipt` +- `epiphany.repo_model.context_query` +- `epiphany.repo_model.context_packet` +- `epiphany.repo_model.patch_candidate` +- `epiphany.repo_model.accept_receipt` + +Tests: + +- runtime-spine schema catalog includes repo-model documents and mutation + contracts +- status/context query can be represented as typed intent/receipt documents +- read-only context query cannot mutate accepted project state + +Exit criteria: + +- Aquarium and native CLIs have a non-Codex contract to request repo-model + status and context packets. + +### Phase 8: Coding-Lane Integration + +Objective: give the coding agent context packets before ordinary implementation +work so repo orientation stops beginning with blind `rg`. + +Files: + +- `epiphany-core/src/prompt.rs` +- `epiphany-core/src/surfaces/worker_launch.rs` +- `vendor/codex/...` only as compatibility bridge surfaces if still needed + +Behavior: + +- Before a bounded coding/modeling/verification lane starts, request a repo + context packet for the objective/current slice. +- Render compact packet summary into model context. +- Include exact refs and required verification seams. +- Include stale/missing regions as explicit warnings. +- Do not auto-accept repo-model patch candidates. + +Tests: + +- prompt renderer includes context packet summary when present +- stale packet warns instead of pretending certainty +- packet refs do not expose sealed forensic artifacts +- missing repo model degrades to current retrieval/manual orientation path + +Exit criteria: + +- Normal work starts with a typed repo context packet when available. +- Manual grep becomes fallback/exact verification, not primary orientation. + +### Phase 9: Accepted Graph Integration + +Objective: connect repo-model candidates to existing review-gated Epiphany graph +truth without creating a second doctrine source. + +Files: + +- `epiphany-core/src/proposal.rs` +- `epiphany-core/src/promotion.rs` +- `epiphany-core/src/state_update.rs` +- `epiphany-core/src/repo_model/patch.rs` + +Behavior: + +- Repo model can propose graph nodes/edges/summaries as patch candidates. +- Promotion validates source hashes, evidence refs, and freshness. +- Accepted graph remains in `EpiphanyThreadState.graphs`. +- Repo-model documents may reference accepted graph ids, but may not silently + replace them. + +Tests: + +- stale repo-model candidate cannot promote without regather/re-scan +- candidate with missing evidence refs is rejected +- accepted candidate writes typed evidence/observation/graph patch through + existing state-update law +- duplicate graph proposals collapse by stable id/code refs + +Exit criteria: + +- Repo-model output can improve accepted graph truth only through existing + review gates. + +### Phase 10: Consumer Migration And Cuts + +Objective: collapse ordinary orientation around repo-model packets while +keeping exact retrieval as a leaf evidence tool. + +Migration: + +- Native status surfaces show repo-model status/freshness. +- Aquarium consumes repo-model status and context packets. +- Modeling/checkpoint lane requests repo context before proposing graph patches. +- Verification lane requests repo context with test-seam emphasis. +- `thread/epiphany/retrieve` remains compatibility/exact search, not the + conceptual orientation path. + +Cuts: + +- remove any duplicated graph freshness logic once repo-model freshness owns + source hash coverage +- delete any context packet assembly that ranks raw chunks without graph domain + ownership +- remove Qdrant payload fields that duplicate canonical typed docs + +Exit criteria: + +- A coding task can be routed: + +```text +objective +-> repo context query +-> typed context packet +-> coding/modeling/verification lane +-> exact reads only where packet requires descent +-> reviewed patch/evidence/graph updates +``` + +## First Implementable Ticket + +Start here if the user says "build it." + +Title: `Add typed RepoModel documents and pure context-cut validation` + +Scope: + +- Add repo-model document structs to `epiphany-state-model/src/lib.rs`. +- Add `epiphany-core/src/repo_model.rs` plus `ids`, `validation`, + `freshness`, and `context_cut` submodules. +- Export the pure APIs from `epiphany-core/src/lib.rs`. +- Add fixture-only unit tests for stable ids, missing-edge validation, stale + hash propagation, and parent-summary context cuts. + +Out of scope: + +- no Qdrant +- no Ollama +- no scanner +- no app-server route +- no CultNet runtime-spine advertisement +- no prompt integration + +Verification: + +```powershell +cargo fmt --manifest-path .\epiphany-core\Cargo.toml +cargo test --manifest-path .\epiphany-core\Cargo.toml --lib repo_model +cargo check --manifest-path .\epiphany-core\Cargo.toml +``` + +Definition of done: + +- The repo-model organ has typed bones and pure tests. +- The next ticket can add deterministic scanning without debating what a node, + edge, summary, freshness record, or context packet is supposed to be. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 8203b41c..39b28f76 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index da2e45c6..6933fcaf 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -75,7 +75,7 @@ active_subgoals: - The May 2026 teardown/rebuild migration in `notes/epiphany-ideal-architecture-rebuild-plan.md` is closed unless a concrete regression reopens it. Preserve the new foundation: Epiphany view/coordinator policy lives in `epiphany-core`, runtime-spine owns job/result lifecycle identity through `runtime_links`, duplicate acceptance is receipt-keyed, public findings stay typed/sealed, view expansion requires a core contract, and app-server remains routing/adaptation rather than a second policy throne. - Treat Phase 5 update/distill/propose/promote/read/notification as complete enough unless a concrete regression appears. - Preserve read-only boundaries for retrieve, distill, propose, freshness, context, graphQuery, roleResult, reorientResult, and the canonical view lenses for scene, jobs, roles, planning, pressure, reorient, crrc, and coordinator. - - Use `notes/repo-fractal-dataflow-cache-plan.md` as the source-grounded repo-model direction when replacing ad hoc grep/source orientation: typed CultCache repo graph documents own project shape; Qdrant stores semantic embeddings for nodes, edges, summaries, and context cuts as a rebuildable contribution cache, not as canonical truth. + - Use `notes/repo-fractal-dataflow-cache-plan.md` as the source-grounded repo-model direction when replacing ad hoc grep/source orientation: typed CultCache repo graph documents own project shape; Qdrant stores semantic embeddings for nodes, edges, summaries, and context cuts as a rebuildable contribution cache, not as canonical truth. The roadmap's first implementable ticket is typed RepoModel documents plus pure `epiphany-core::repo_model` validation/context-cut tests, explicitly before scanner or Qdrant work. - Keep the landed Phase 6 coordinator, limited safe-boundary CRRC automation, and pre-compaction checkpoint intervention ready for the next bridge-equipped dogfood run. - Preserve the Ghostlight-derived heartbeat initiative seam: every lane, including coordinator/Self and Face, has a role dossier and competes for heartbeat slots through readiness/reaction timing; idle winners ruminate instead of inventing project work, and sleep windows distill the accumulated thought pressure into reviewed self-memory or doctrine. - Treat Ghostlight as reference lineage, not a sibling runtime to preserve. The useful organ is Epiphany-native character-loop protocol: any role can project its typed dossier plus visible stimulus into a local turn packet, with Face as the first public-surface actor. @@ -114,7 +114,7 @@ accepted_design: - `thread/epiphany/retrieve`, `thread/epiphany/distill`, `thread/epiphany/propose`, `thread/epiphany/freshness`, `thread/epiphany/context`, `thread/epiphany/graphQuery`, and `thread/epiphany/view` stay read-only. - `thread/epiphany/index` writes the retrieval catalog, not durable Epiphany understanding; catalog is auspex output, not doctrine. - Qdrant is the preferred persistent semantic backend; BM25 remains the bootstrap/fallback/control path. - - `notes/repo-fractal-dataflow-cache-plan.md` applies the mapped-fractal-domain/cache lesson to Epiphany: build a `RepoModel` organ where typed domain/node/edge/summary/context documents own repo architecture and dataflow, while Qdrant indexes embeddings for fast selection. If deleting Qdrant deletes understanding, the design is wrong; the fallback must be slower but still correct typed graph traversal. + - `notes/repo-fractal-dataflow-cache-plan.md` applies the mapped-fractal-domain/cache lesson to Epiphany and now includes an implementation roadmap: build a `RepoModel` organ where typed domain/node/edge/summary/context documents own repo architecture and dataflow, while Qdrant indexes embeddings for fast selection. If deleting Qdrant deletes understanding, the design is wrong; the fallback must be slower but still correct typed graph traversal. Start with typed documents and pure validation/context-cut tests, not vector plumbing. - `epiphany-core` owns prompt rendering, rollout replay helpers, retrieval/indexing, distillation, proposal, promotion policy, scene projection, freshness derivation, pressure derivation, job/progress view derivation, planning view derivation, reorientation resume/regather verdict policy, pure CRRC recommendation policy, fixed-lane coordinator decision policy, role-board projection policy, and role-result interpretation/self-persistence review policy where possible. - Vendored Codex keeps the thin typed host seam: protocol types, thread bridges, app-server protocol, request routing, watcher lifecycle, notifications, and rollout integration. Epiphany projection and coordinator policy should keep moving into `epiphany-core` / `epiphany-codex-bridge` instead of living in `codex_message_processor.rs`. - The current algorithmic map is the source-grounded description of live control flow. @@ -291,9 +291,10 @@ rejected_paths: current_status: summary: The Codex starvation pass has five typing receipts, fifty-six processor/foundation cuts, a real physical extraction in `epiphany-codex-bridge`, a root `epiphany-state-model` crate for durable Epiphany state, a source-grounded Codex auth spine inventory, the native `epiphany-openai-adapter` document boundary, a buildable Codex auth/model wrapper in `epiphany-openai-codex-spine`, the first native runtime caller in `epiphany-openai-runtime`, native heartbeat launch planning/job opening in `epiphany-core`, native state-update contract/validation/application in `epiphany-core`, native exact retrieval path matching in `epiphany-core`, and the route-facing mutation/view/coordinator projection services in `epiphany-codex-bridge`. `codex-protocol` no longer defines the durable `Epiphany*` state structs; it re-exports the native model for legacy rollout/API compatibility while `epiphany-core` imports the native model directly. `epiphany-core` now has no direct vendored Codex dependency: pressure derivation accepts native `EpiphanyTokenUsageSnapshot`, Codex rollout replay moved to `codex-core::epiphany_rollout`, and exact retrieval search uses Epiphany-owned workspace walking/path scoring instead of `codex-file-search`. The bridge owns Codex-facing Epiphany adapters for scene, jobs, context/planning/graph query, retrieval/indexing projection, result projection, runtime-spine result adaptation, launch/prompt doctrine, mutation document mechanics, mutation service update/promote/role-accept/reorient-accept/role-launch/reorient-launch/job-launch/job-interrupt application, live-state projection, pressure/pre-compaction rendering, freshness/reorientation projection, CRRC/coordinator/role-board projection, watcher invalidation adaptation, full `thread/epiphany/view` response construction, freshness/context/graph-query response construction, role/reorient result response construction, distill/propose patch-response construction, coordinator status/view construction, and acceptance/evidence signal helpers. Vendored app-server no longer retains root Epiphany modules; `codex_message_processor.rs` still contains route dispatch, JSON-RPC response shaping, watcher registration/snapshotting calls, and notification emission, but its root no longer imports the evacuated Epiphany policy/protocol registry or owns the watcher invalidation manager. Codex product surfaces for apps, skills, plugins, marketplace, and external agent config import are cut from the live app-server/protocol path: list routes return empty lists only where compatibility shells still exist, mutation/detail routes report disabled where they survive, `externalAgentConfig/*` routes and import-completed notification are gone, helper/import modules and stale implementation-shape tests were deleted, runtime feature enablement no longer supports `apps` or `plugins`, config writes no longer emit plugin-toggle analytics, plugin/skill cache invalidation on config writes is gone, plugin startup warmups and app-list refreshes were removed, and app-server no longer directly depends on `codex-plugin`, `codex-chatgpt`, or `codex-core-plugins`. `Config::to_mcp_config` now keeps user-declared MCP servers but no longer accepts `PluginsManager`, folds plugin MCP servers into the runtime, enables Codex apps, enables skill MCP dependency install, or advertises plugin capability summaries; `TurnContext::apps_enabled()` now returns false so model turns cannot awaken Codex Apps through ChatGPT auth or feature flags; session startup and per-turn context no longer load skills, turns receive an empty `SkillLoadOutcome`, internal `Op::ListSkills` is gone from `codex-protocol` / `codex-core` / TUI command routing, the Codex skill watcher has been collapsed to a no-op marker with no file watcher, skill-root registration, cache-clear task, or `SkillsUpdateAvailable` session listener, model turns no longer run skill mention collection, skill env-var prompts, skill MCP dependency installation, skill instruction injection, or implicit skill invocation analytics from shell tools, and the turn prompt/router path no longer loads plugin/app capability summaries, injects available-skill/available-plugin/plugin instruction fragments, parses plugin/app mentions, records app/plugin invocation telemetry, or filters MCP tools through Codex app connectors. Skill mutation/list/notification is gone from the app-server edge too: `skills/list`, `skills/config/write`, `skills/changed`, `Op::ListSkills`, `EventMsg::ListSkillsResponse`, `EventMsg::SkillsUpdateAvailable`, the app-server handlers, TUI slash/startup/list/manage-skill surfaces, generated schema entries, core skill-list suite, and fake live-reload/developer-message tests were deleted. Skill mention plumbing is also gone from the live TUI/protocol edge: no `UserInput::Skill` variant, app-server schema branch, TUI skill popup, `skills_all` cache, composer `set_skill_mentions`, skill mention insertion, `skill://` / `SKILL.md` history decoding, or stale skill popup snapshot remains. The `codex-core-skills` crate, core `skills` re-export shim, no-op `skills_watcher`, session `SkillsManager` service, and per-turn `TurnSkillsContext` are deleted; core/protocol no longer keep legacy `` or `` prompt compatibility, memory usage classification, snapshot normalization, or cleanup paths. Remaining product-shaped skill residue is also cut from memory templates, app-server docs/tests/warnings, TUI tooltips/placeholders/warnings/comments, app-server v1 docs, agent-tool schema text, stale `UserInput::Skill` test arms, and obsolete feature flags/schema entries. App-instruction prompt compatibility is cut too: no `APPS_INSTRUCTIONS` protocol constants, no `` snapshot canonicalization, and MCP fixture tests now use neutral `demo_mcp` / `calendar_mcp` names instead of `codex_apps` / `/api/codex/apps` branding. The TUI app connector product path is also deleted: no `/apps` slash command, app-link view, connector AppEvent variants, app connector cache/popup/refresh loop, app mention insertion, `app://` mention codec support, stale app-popup tests, or TUI browser-opening shim remains. The `app/list` route and `app/list/updated` notification are gone from app-server protocol, generated schemas, app-server dispatch, test helpers, and docs; `AppInfo`/app-list metadata schema structs are deleted; the orphaned `codex-connectors` crate and `core::connectors` shim are deleted from the workspace; Codex app analytics no longer tracks `codex_app_mentioned` / `codex_app_used` facts, events, reducer arms, client APIs, or dedupe cache state; `[apps.*]`, `Feature::Apps`, `include_apps_instructions`, app config/read schemas, app managed requirements, app prompt tests, and app file-MCP tests are gone; `Feature::Plugins`, `Feature::RemotePlugin`, `plugin://` structured mentions, plugin instruction tags, and stale plugin popup snapshots are gone too; `[plugins]` / `[marketplaces]`, `PluginConfig`, `MarketplaceConfig`, marketplace edit helpers, stale plugin/external-agent README route claims, and generated schema entries are removed from config; and the bundled `codex-skills` sample-skill crate plus embedded imagegen/openai-docs/plugin-creator/skill-creator/skill-installer payloads are deleted from the workspace. The vendored `vendor/codex/sdk` subtree is deleted as non-spine app-server client/release scaffolding, including stale generated Python SDK route types for removed product surfaces; the root pnpm workspace no longer lists `sdk/typescript`. Live MCP tool approval is named `McpToolApproval`, not `AppToolApproval`, and remains under MCP server config; live structured user-input mentions are MCP-shaped only. `codex_message_processor.rs` is about 1,009 lines after route/lifecycle/projection/resume-helper/config-helper extraction; root `message_processor.rs` is about 1,292 lines after the external-agent/config-product cuts; `epiphany_read_routes.rs` is about 579 lines after the full view and read-response extractions; `epiphany_mutation_routes.rs` is about 694 lines after route-load/notification helper cuts and product-surface starvation; the old vendored `epiphany_state_helpers.rs` rollout-state loader is deleted and its remaining function lives in `epiphany-codex-bridge::state`; and `codex_thread.rs` is about 1,425 lines after state-update law moved native. `epiphany-openai-adapter` defines CultCache `DatabaseEntry` request/event/receipt/auth-status documents with no Codex app-server or generic JSON dependency. `epiphany-openai-codex-spine` owns the native OpenAI model transport path: it exposes `default_codex_home` and `auth_manager`, projects `epiphany-openai-auth-spine` `AuthManager` / `CodexAuth` into typed `EpiphanyOpenAiAdapterStatus`, builds a local serializable OpenAI Responses request body instead of Codex protocol request/item/config types, opens HTTP Responses streams through `codex-client`, parses Responses SSE frames into typed stream events and receipts, and no longer directly or transitively depends on Codex's Responses client, model-provider stack, `codex-protocol`, `codex-api`, `codex-model-provider`, or `codex-model-provider-info`; it intentionally reaches retained vendored `codex-login` only through `epiphany-openai-auth-spine`. Auth identity, credential storage, and ChatGPT token refresh remain owned by the Codex-compatible auth organ; external bearer command auth and agent identity remain retained Codex auth capabilities to expose only if a typed Epiphany surface needs them. `epiphany-openai-runtime` no longer depends directly on `codex-login`; it writes OpenAI status/request/stream-event/receipt records plus runtime sessions/jobs/results/events into `epiphany-core::runtime_spine_cache`, can emit the assistant text artifact for legacy result consumers, is now the default executor for startup-only repo birth specialists, and now has `run-worker` to load a durable `EpiphanyRuntimeWorkerLaunchRequest`, call the typed OpenAI runtime through the spine, persist typed `EpiphanyRuntimeRoleWorkerResult` / `EpiphanyRuntimeReorientWorkerResult` documents, and complete the original heartbeat/specialist runtime job without Codex worker execution; `codex exec` survives only as explicit fallback in repo-birth startup. `epiphany-mvp-coordinator` now invokes `epiphany-openai-runtime run-worker` for launched runtime job ids and no longer creates a second coordinator-owned shadow runtime job/result as a compensator. `epiphany-core::plan_runtime_spine_heartbeat_launch` validates launch contracts/conflicts and projects durable job bindings/runtime links; `epiphany-core::open_runtime_spine_heartbeat_job` owns the initialize-runtime/ensure-session/create-job sequence and now persists `EpiphanyRuntimeWorkerLaunchRequest` CultCache records keyed by runtime job id, with indexed kind/contract fields plus MessagePack-encoded typed launch documents instead of discarding work intent after queue receipt creation; `roleResult` and `reorientResult` now require typed worker result documents; generic job summaries are lifecycle receipts, not reviewable findings; `epiphany-core::EpiphanyStateUpdate`, `epiphany_state_update_validation_errors`, and `apply_epiphany_state_update` own state-update document shape and mutation law while `codex-core` calls them for compatibility. Vendored `CodexThread::epiphany_launch_job` is now mostly revision check, persistence validation, launch request handoff, and rollout/session writeback for the compatibility route. Vendored `codex-core` no longer has `epiphany_distillation`, `epiphany_promotion`, `epiphany_proposal`, or `epiphany_retrieval` husk modules; it re-exports native surfaces from `epiphany-core` directly, and now owns only the real Codex rollout adapter because it is a host seam. `epiphany-runtime-spine` advertises OpenAI adapter status/model-request/stream-event/receipt CultNet schemas and mutation contracts, so the native caller now has a real storage route instead of only JSON-RPC. MCP itself is correctly JSON at its protocol edge; the target is typed Epiphany intent/result/receipt wrappers around MCP, not replacing MCP JSON. The current OpenAI request path no longer pulls `codex-api`; `codex-login` remains deliberately sealed behind `epiphany-openai-auth-spine`, and the next spine decision is another Epiphany-in-vendor evacuation surface unless a concrete typed auth-status/runtime need requires exposing external bearer or agent-identity auth. latest_cut: > - `notes/repo-fractal-dataflow-cache-plan.md` now captures the repo-model - architecture direction: typed CultCache documents own semantic repo - domains, graph nodes, graph edges, conservative summaries, freshness, and - context packets; Qdrant is only the rebuildable embedding/contribution - cache for fast context-cut selection. + `notes/repo-fractal-dataflow-cache-plan.md` now has an implementation + roadmap for the repo-model feature. The first ticket is typed RepoModel + documents in `epiphany-state-model` plus pure `epiphany-core::repo_model` + id/validation/freshness/context-cut tests, with scanner, CultCache store, + Qdrant cache, CultNet advertisement, and coding-lane integration staged + afterward. next_action: Continue the Codex starvation campaign unless the user directs the next slice into repo modeling. If repo modeling starts, first add typed repo-model document structs and pure `epiphany-core::repo_model` validation/context-cut tests before connecting Qdrant.