Record Ygg deployment authority repair

notes/fresh-workspace-handoff.md

@@ -3089,3 +3089,42 @@ inactive with no current link, active-release document, or deployment witness.
 The next cut is not an observer bypass. Modeling must identify the owner of the
 typed runtime-to-repository Body binding and make that binding available to
 terminal observer authentication, preserving projector-only coverage authority.
+
+The Body-binding correction is committed and pushed as `67f0fe0b44357c56c98f82499cdfa3ae7b944e09`.
+The supervisor bootstrap already published the typed runtime-store binding and
+repository Body-store binding; the live fault was reversed arguments at the
+terminal-sight call site. The corrected candidate proved
+`terminal-observer-alive`, three stable services, the all-scope brake, and a
+healthy pre-witness check. It did not receive a deployment witness because
+Idunn's automatic target worker published a newer request while the manual
+deployment still owned the actuator, superseding the typed current-request
+head. The candidate authority was revoked and exact process group terminated;
+rollback left all Epiphany units, current pointers, active release, and
+deployment witness absent.
+
+Idunn's authority split is repaired in Odin commit
+`eefd47f` (`codex/ygg-organizational-idunn`). A per-target local gate serializes
+manual and automatic command lifetimes. More importantly, the persistent
+current-request CAS chain refuses replacement until the exact predecessor
+request has an exact terminal result, so restart or duplicate processes cannot
+steal a live head. All 48 Idunn tests pass and an independent Soul re-audit found
+no release blocker. Ygg now runs that binary as PID `1673938`, zero restarts,
+SHA-256 `49e09d1989342737f6c996be267894555e8c23886f090a5ae5d334e4aa29ff8d`;
+the prior binary is `/usr/local/bin/idunn.20260719-072532.bak`.
+
+Bifrost correctly refuses reauthorization of revoked immutable authority for
+`67f0fe0`. The next action is therefore to commit/push this persisted Epiphany
+state as a new exact successor, authorize only that commit, and perform one
+Idunn-owned Ygg deployment under the all-scope brake. Certification requires a
+single stable deployment request head, `terminal-observer-alive`, three stable
+services, exact signed health admission, and final `deployment.env` witness.
+
+After certification, treat the organizational loop as normal product behavior,
+not an experiment. The existing runtime autonomously turns admitted Modeling
+direction into an Imagination option, and Persona feedback is authenticated
+additional pressure. The missing bridge is option result -> immutable
+`RepoFrontierWorkProposal` with exact model causality -> automatic Self
+selection for Modeling review -> admitted frontier item -> existing Imagination
+planning -> explicit Mind adoption -> Hands. Proposals and conversation must
+remain structurally unable to grant Mind, Hands, Persona public speech,
+Bifrost release, or Idunn deployment authority. No host reboot is authorized.

state/map.yaml

@@ -796,4 +796,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "Live candidate 84e648eb was refused because the Ygg runtime has no repository Body-store binding; its exact Bifrost authority was revoked, exact Idunn PGID 1597264 was terminated, and rollback removed the service/current link/active release/deployment witness. Map the typed runtime-to-repository Body binding owner and feed that binding into terminal observer authentication; do not weaken the observer or let terminal sight fall through to recovery. Then recertify an exact successor under the all-scope brake before the Starfire-offline ordinary-product rehearsal: persistent Modeling map -> autonomous bounded Imagination proposal, with organization feedback through Persona as additional attributed pressure; explicit Mind adoption -> Hands consequence -> Bifrost release -> Idunn deployment remain separate gates. Prove replay/tamper refusal and that conversation alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."
+  next_action: "The runtime-to-repository Body binding cut is committed and pushed at 67f0fe0: supervisor terminal sight now authenticates the runtime store against the separately bound Body store, and 25/25 supervisor tests pass. Its live candidate reached terminal-observer-alive, three stable braked services, and a healthy pre-witness check, but final admission was correctly withheld after Idunn's automatic worker superseded the manual deployment request head. Exact authority was revoked and rollback removed all candidate runtime pointers and witnesses. Odin successor eefd47f makes local manual/automatic actuation per-target serialized and makes the persistent request/result CAS chain the durable cross-process authority: a live head cannot be superseded without its exact terminal result; 48/48 Idunn tests and independent Soul audit pass. That Idunn binary is live on Ygg at SHA-256 49e09d1989342737f6c996be267894555e8c23886f090a5ae5d334e4aa29ff8d with rollback binary preserved. Bifrost permanently refuses reauthorization of revoked 67f0fe0, so commit this state successor and certify that new exact Epiphany commit through Bifrost and Idunn under the all-scope brake. Require one stable request head, terminal-observer-alive, three stable services, signed aggregate health, and deployment witness. Then build the ordinary organizational product bridge: autonomous admitted-model option -> immutable frontier proposal -> automatic Self selection for Modeling review -> existing Imagination planning -> explicit Mind adoption -> Hands. Organization feedback through Persona remains additional attributed pressure; conversation/proposal alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."