Separate readiness routing authority

This commit is contained in:
Meta Vens 2026-07-13 03:44:43 +01:00
commit e6bdab1a7f
9 changed files with 251 additions and 87 deletions

View file

@ -215,10 +215,12 @@ fn run_smoke(args: Args) -> Result<Value> {
)?;
require_text(&request_text, "[request]")?;
require_text(&request_text, "status = \"awaiting-mvp-readiness-review\"")?;
require_text(&request_text, "routing_owner = \"Self\"")?;
require_text(
&request_text,
"requested_owner = \"Maintainer/Soul/Mind/Bifrost\"",
"required_reviewers = [\"Maintainer\", \"Soul\", \"Mind\", \"Bifrost\"]",
)?;
require_text(&request_text, "readiness_approval_owner = \"none\"")?;
require_text(
&request_text,
"requested_effect = \"review-redacted-repo-swarm-mvp-proof-bundle\"",

View file

@ -5529,7 +5529,9 @@ fn derive_repo_readiness_review_request_plan(
"[request]".to_string(),
format!("id = {}", toml_basic_string(&request_id)),
"status = \"awaiting-mvp-readiness-review\"".to_string(),
"requested_owner = \"Maintainer/Soul/Mind/Bifrost\"".to_string(),
"routing_owner = \"Self\"".to_string(),
"required_reviewers = [\"Maintainer\", \"Soul\", \"Mind\", \"Bifrost\"]".to_string(),
"readiness_approval_owner = \"none\"".to_string(),
"requested_effect = \"review-redacted-repo-swarm-mvp-proof-bundle\"".to_string(),
"readiness_scope = \"fresh repo init, online swarm, Persona intake, Imagination planning, Self queue-run, Hands branch work, Soul closure, Modeling map update, Mind admission, Bifrost public proof, upstream-main sync, Idunn lifecycle, global tool directory, and private-state redaction\"".to_string(),
"review_is_advisory_until_maintainer_or_bifrost_acceptance = true".to_string(),
@ -8121,138 +8123,77 @@ fn closure_family_assertions(
);
}
"repo.readiness_review_request" => {
let request = parse_repo_readiness_review_request(&content).ok();
push_assertion(
&mut assertions,
"readiness-review-request-schema-present",
content.contains("schema_version = \"epiphany.repo_readiness_review_request.v0\""),
request
.as_ref()
.is_some_and(RepoReadinessReviewRequest::has_canonical_identity),
"Committed readiness review request carries the schema version.".to_string(),
);
push_assertion(
&mut assertions,
"readiness-review-request-family-present",
content.contains("safe_action_family = \"repo.readiness_review_request\""),
request
.as_ref()
.is_some_and(RepoReadinessReviewRequest::has_canonical_identity),
"Committed readiness review request carries the safe action family.".to_string(),
);
push_assertion(
&mut assertions,
"readiness-review-request-summary-present",
content.contains(&compact_summary),
request
.as_ref()
.is_some_and(|value| value.summary == compact_summary),
"Committed readiness review request contains the accepted pressure summary."
.to_string(),
);
push_assertion(
&mut assertions,
"readiness-review-request-awaits-review",
content.contains("[request]")
&& content.contains("status = \"awaiting-mvp-readiness-review\"")
&& content.contains("requested_owner = \"Maintainer/Soul/Mind/Bifrost\"")
&& content.contains(
"requested_effect = \"review-redacted-repo-swarm-mvp-proof-bundle\"",
)
&& content.contains(
"review_is_advisory_until_maintainer_or_bifrost_acceptance = true",
),
request.as_ref().is_some_and(RepoReadinessReviewRequest::has_coherent_routing),
"Committed readiness review request waits for maintainer/Soul/Mind/Bifrost review before consequence."
.to_string(),
);
push_assertion(
&mut assertions,
"readiness-review-request-antecedents-present",
content.contains("[antecedents]")
&& content.contains("repo_init_required = true")
&& content.contains("swarm_online_required = true")
&& content.contains("persona_intake_required = true")
&& content.contains("imagination_plan_required = true")
&& content.contains("self_queue_run_required = true")
&& content.contains("hands_commit_required = true")
&& content.contains("soul_closure_required = true")
&& content.contains("modeling_map_update_required = true")
&& content.contains("mind_admission_required = true")
&& content.contains("public_proof_required = true")
&& content.contains("bifrost_publication_required = true")
&& content.contains("upstream_main_sync_required = true")
&& content.contains("idunn_lifecycle_readiness_required = true")
&& content.contains("tool_directory_readiness_required = true")
&& content.contains("private_state_redaction_required = true"),
request
.as_ref()
.is_some_and(RepoReadinessReviewRequest::has_antecedent_contract),
"Committed readiness review request requires all repo-swarm MVP organ proofs."
.to_string(),
);
push_assertion(
&mut assertions,
"readiness-review-request-receipt-contract",
content.contains("[required_receipts]")
&& content.contains("repo_init = \"epiphany.repo_swarm_init_receipt.v0\"")
&& content
.contains("swarm_online = \"epiphany.repo_swarm_online_receipt.v0\"")
&& content
.contains("persona_speech_audit = \"epiphany.persona_speech_audit.v0\"")
&& content.contains("imagination_action_items = \"epiphany.repo_work_imagination_action_items_receipt.v0\"")
&& content.contains("queue_run = \"epiphany.repo_work_queue_run_receipt.v0\"")
&& content.contains("hands_commit = \"epiphany.hands.commit_receipt\"")
&& content
.contains("closure_review = \"epiphany.repo_work_closure_review.v0\"")
&& content
.contains("soul_verdict = \"epiphany.soul.verification_verdict\"")
&& content.contains("modeling_map = \"epiphany.repo_work_map_entry.v0\"")
&& content.contains("mind_commit = \"epiphany.mind.state_commit_receipt\"")
&& content.contains(
"public_proof = \"epiphany.repo_work_public_proof_bundle.v0\"",
)
&& content.contains("bifrost_publication = \"gamecult.bifrost.public_proof_publication_receipt.v0\"")
&& content.contains(
"upstream_sync = \"epiphany.repo_work_upstream_sync_receipt.v0\"",
)
&& content.contains("idunn_lifecycle = \"epiphany.repo_work_service_audit.v0\"")
&& content.contains("tool_directory = \"epiphany.cultmesh.daemon_tool_directory.v0\""),
request
.as_ref()
.is_some_and(RepoReadinessReviewRequest::has_receipt_contract),
"Committed readiness review request names the MVP proof receipt contract."
.to_string(),
);
push_assertion(
&mut assertions,
"readiness-review-request-packet-contract",
content.contains("[readiness_packet]")
&& content.contains("requires_proof_bundle_ref = true")
&& content.contains("requires_changed_path_list = true")
&& content.contains("requires_branch_name = true")
&& content.contains("requires_upstream_main_ref = true")
&& content.contains("requires_public_proof_ref = true")
&& content.contains("requires_bifrost_ledger_ref = true")
&& content.contains("requires_idunn_lifecycle_ref = true")
&& content.contains("requires_tool_directory_ref = true")
&& content.contains("requires_redaction_report = true")
&& content.contains("requires_reviewer_identity = true")
&& content.contains(
"allowed_verdicts = [\"ready\", \"ready-with-caveats\", \"not-ready\", \"needs-human-review\"]",
),
request.as_ref().is_some_and(RepoReadinessReviewRequest::has_packet_contract),
"Committed readiness review request names proof bundle, branch, upstream, Bifrost, Idunn, tool, redaction, reviewer, and verdict requirements."
.to_string(),
);
push_assertion(
&mut assertions,
"readiness-review-request-authority-seals",
content.contains("[authority]")
&& content.contains("readiness_approval_authorized = false")
&& content.contains("durable_state_commit_authorized = false")
&& content.contains("publication_authorized = false")
&& content.contains("bifrost_publication_authorized = false")
&& content.contains("github_pr_authorized = false")
&& content.contains("merge_authorized = false")
&& content.contains("upstream_sync_authorized = false")
&& content.contains("deployment_authority = false")
&& content.contains("service_lifecycle_authority = false")
&& content.contains("hands_action_authorized = false")
&& content.contains("cross_body_mutation_authorized = false")
&& content.contains("private_verse_rummaging = false")
&& content.contains(
"maintainer_soul_mind_or_bifrost_review_required = true",
),
request.as_ref().is_some_and(RepoReadinessReviewRequest::has_authority_seals),
"Committed readiness review request denies readiness/state/publication/PR/merge/sync/deploy/service/Hands/cross-body authority."
.to_string(),
);
push_assertion(
&mut assertions,
"readiness-review-request-private-seal",
content.contains("private_state_exposed = false"),
request
.as_ref()
.is_some_and(|value| !value.private_state_exposed),
"Committed readiness review request preserves the private-state seal.".to_string(),
);
}
@ -15348,6 +15289,7 @@ idunn_deployment_authority_required = true
"repo.credit_request",
"repo.artifact_acceptance_request",
"repo.metrics_request",
"repo.readiness_review_request",
"repo.secret_policy_request",
"repo.dependency_policy_request",
"repo.deployment_config",

View file

@ -1011,4 +1011,166 @@ pub(super) fn parse_repo_maintainer_review_request(
toml::from_str(text).context("maintainer review request is not valid typed TOML")
}
#[derive(Debug, Deserialize)]
pub(super) struct RepoReadinessReviewRequest {
pub(super) schema_version: String,
pub(super) safe_action_family: String,
pub(super) summary: String,
pub(super) private_state_exposed: bool,
request: RepoReadinessReviewBody,
antecedents: std::collections::BTreeMap<String, bool>,
required_receipts: std::collections::BTreeMap<String, String>,
readiness_packet: RepoReadinessPacket,
authority: std::collections::BTreeMap<String, bool>,
}
impl RepoReadinessReviewRequest {
pub(super) fn has_canonical_identity(&self) -> bool {
self.schema_version == "epiphany.repo_readiness_review_request.v0"
&& self.safe_action_family == "repo.readiness_review_request"
}
pub(super) fn has_coherent_routing(&self) -> bool {
let r = &self.request;
r.status == "awaiting-mvp-readiness-review"
&& r.routing_owner == "Self"
&& r.required_reviewers == ["Maintainer", "Soul", "Mind", "Bifrost"]
&& r.readiness_approval_owner == "none"
&& r.requested_effect == "review-redacted-repo-swarm-mvp-proof-bundle"
&& r.review_is_advisory_until_maintainer_or_bifrost_acceptance
}
pub(super) fn has_antecedent_contract(&self) -> bool {
[
"repo_init_required",
"swarm_online_required",
"persona_intake_required",
"imagination_plan_required",
"self_queue_run_required",
"hands_commit_required",
"soul_closure_required",
"modeling_map_update_required",
"mind_admission_required",
"public_proof_required",
"bifrost_publication_required",
"upstream_main_sync_required",
"idunn_lifecycle_readiness_required",
"tool_directory_readiness_required",
"private_state_redaction_required",
]
.iter()
.all(|key| self.antecedents.get(*key) == Some(&true))
}
pub(super) fn has_receipt_contract(&self) -> bool {
[
("repo_init", "epiphany.repo_swarm_init_receipt.v0"),
("swarm_online", "epiphany.repo_swarm_online_receipt.v0"),
("persona_speech_audit", "epiphany.persona_speech_audit.v0"),
(
"imagination_action_items",
"epiphany.repo_work_imagination_action_items_receipt.v0",
),
("queue_run", "epiphany.repo_work_queue_run_receipt.v0"),
("hands_commit", "epiphany.hands.commit_receipt"),
("closure_review", "epiphany.repo_work_closure_review.v0"),
("soul_verdict", "epiphany.soul.verification_verdict"),
("modeling_map", "epiphany.repo_work_map_entry.v0"),
("mind_commit", "epiphany.mind.state_commit_receipt"),
("public_proof", "epiphany.repo_work_public_proof_bundle.v0"),
(
"bifrost_publication",
"gamecult.bifrost.public_proof_publication_receipt.v0",
),
(
"upstream_sync",
"epiphany.repo_work_upstream_sync_receipt.v0",
),
("idunn_lifecycle", "epiphany.repo_work_service_audit.v0"),
(
"tool_directory",
"epiphany.cultmesh.daemon_tool_directory.v0",
),
]
.iter()
.all(|(key, value)| self.required_receipts.get(*key).is_some_and(|v| v == value))
}
pub(super) fn has_packet_contract(&self) -> bool {
let p = &self.readiness_packet;
p.requires_proof_bundle_ref
&& p.requires_changed_path_list
&& p.requires_branch_name
&& p.requires_upstream_main_ref
&& p.requires_public_proof_ref
&& p.requires_bifrost_ledger_ref
&& p.requires_idunn_lifecycle_ref
&& p.requires_tool_directory_ref
&& p.requires_redaction_report
&& p.requires_reviewer_identity
&& p.allowed_verdicts
== [
"ready",
"ready-with-caveats",
"not-ready",
"needs-human-review",
]
}
pub(super) fn has_authority_seals(&self) -> bool {
let denied = [
"readiness_approval_authorized",
"durable_state_commit_authorized",
"publication_authorized",
"bifrost_publication_authorized",
"github_pr_authorized",
"merge_authorized",
"upstream_sync_authorized",
"deployment_authority",
"service_lifecycle_authority",
"hands_action_authorized",
"cross_body_mutation_authorized",
"private_verse_rummaging",
];
denied
.iter()
.all(|key| self.authority.get(*key) == Some(&false))
&& self
.authority
.get("maintainer_soul_mind_or_bifrost_review_required")
== Some(&true)
}
}
#[derive(Debug, Deserialize)]
struct RepoReadinessReviewBody {
status: String,
routing_owner: String,
required_reviewers: Vec<String>,
readiness_approval_owner: String,
requested_effect: String,
review_is_advisory_until_maintainer_or_bifrost_acceptance: bool,
}
#[derive(Debug, Deserialize)]
struct RepoReadinessPacket {
requires_proof_bundle_ref: bool,
requires_changed_path_list: bool,
requires_branch_name: bool,
requires_upstream_main_ref: bool,
requires_public_proof_ref: bool,
requires_bifrost_ledger_ref: bool,
requires_idunn_lifecycle_ref: bool,
requires_tool_directory_ref: bool,
requires_redaction_report: bool,
requires_reviewer_identity: bool,
allowed_verdicts: Vec<String>,
}
pub(super) fn parse_repo_readiness_review_request(
text: &str,
) -> Result<RepoReadinessReviewRequest> {
toml::from_str(text).context("readiness review request is not valid typed TOML")
}
include!("external_governance_tests.rs");

View file

@ -2,6 +2,42 @@
mod external_governance_tests {
use super::*;
#[test]
fn readiness_comment_cannot_counterfeit_approval_seal() {
let text = r#"
schema_version = "epiphany.repo_readiness_review_request.v0"
safe_action_family = "repo.readiness_review_request"
summary = "summary"
private_state_exposed = false
[request]
status = "awaiting-mvp-readiness-review"
routing_owner = "Self"
required_reviewers = ["Maintainer", "Soul", "Mind", "Bifrost"]
readiness_approval_owner = "none"
requested_effect = "review-redacted-repo-swarm-mvp-proof-bundle"
review_is_advisory_until_maintainer_or_bifrost_acceptance = true
[antecedents]
[required_receipts]
[readiness_packet]
requires_proof_bundle_ref = false
requires_changed_path_list = false
requires_branch_name = false
requires_upstream_main_ref = false
requires_public_proof_ref = false
requires_bifrost_ledger_ref = false
requires_idunn_lifecycle_ref = false
requires_tool_directory_ref = false
requires_redaction_report = false
requires_reviewer_identity = false
allowed_verdicts = []
[authority]
# readiness_approval_authorized = false
readiness_approval_authorized = true
"#;
let request = parse_repo_readiness_review_request(text).expect("fixture is typed TOML");
assert!(!request.has_authority_seals());
}
#[test]
fn comment_cannot_counterfeit_direct_execution_seal() {
let text = r#"

View file

@ -1090,6 +1090,21 @@ grant. Mind, Self, Hands, and Bifrost remain downstream gates.
Seventeen high-authority closure families are typed. The source-derived
residual is 426 substring occurrences across sixteen families.
## Reviewer coalition as one readiness owner
Readiness request cargo named `Maintainer/Soul/Mind/Bifrost` as one
`requested_owner`. That was not harmless display text: an earlier deleted
command accepted four caller strings and minted aggregate approval, exactly the
failure this ownership fiction invites. Readiness routing now has one owner:
Self. Maintainer, Soul, Mind, and Bifrost are an explicit ordered reviewer set,
and `readiness_approval_owner = "none"` records that no local aggregate may
turn their unresolved evidence into approval. The request is typed inside
external governance; its actual antecedents, receipts, packet, authority seals,
and privacy field replace substring recognition.
Eighteen high-authority closure families are typed. Direct source inventory now
reports 363 substring occurrences across fifteen remaining families.
The same inspection found 33 consecutive duplicate `#[cfg(test)]` attributes
on provider constructors/writers and their re-exports. One gate already makes
each item test-only; the second owned nothing. The duplicates are removed.

View file

@ -51,7 +51,7 @@
- Daemon-tool invocation requests likewise remain pending until the advertised host daemon or authenticated ingest boundary supplies the typed response. Local response construction/writing/validation is test-only; aggregate smoke and receipt-directory projection prove intent-present/receipt-missing instead of manufacturing host acceptance.
- Idunn deployment and aftercare outcomes have no local production writer. The synthetic deployment-config family smoke and its green aggregate MVP-gate handoff are deleted; config audit/runbook remain pre-deployment surfaces, while typed Idunn readers await genuine daemon-authored ingest.
- Bifrost artifact-acceptance and metrics requests remain open until actual Bifrost/Maintainer receipts are ingested. The stale response-closing request-family smokes, accounting bundle, wrapper mode, and aggregate green gate are deleted.
- Repo-work readiness reports are sight only. The generic readiness-review approval command and writer are deleted because one caller supplied four unresolved reviewer labels; `repo.readiness_review_request` is the remaining request path, and typed review readers await genuine multi-organ/provider evidence.
- Repo-work readiness reports are sight only. The generic readiness-review approval command and writer are deleted because one caller supplied four unresolved reviewer labels. `repo.readiness_review_request` now assigns routing to Self, lists Maintainer/Soul/Mind/Bifrost as independent required reviewers, and names no readiness-approval owner; typed review readers await genuine multi-organ/provider evidence.
- There is no aggregate repo-swarm MVP gate. The former smoke manually aggregated fixture summaries into green rows and `demoReady=true`; it and its wrapper are deleted. Whole-organism readiness requires a live-fire path whose claimed consequences are observed at their owning boundaries.
- Persona owner: `collaboration-feedback` writes public, bounded feedback only after that provider receipt exists.
- Imagination owner: consensus participant selection, packet reference, receipt status/id, and adoption gate.

View file

@ -353,6 +353,13 @@ commented adoption denial from hiding a real grant. Seventeen high-authority
families are typed. Continue from the source-derived family inventory, not the
historical counter.
The readiness-review hydra is cut. Self owns routing; Maintainer, Soul, Mind,
and Bifrost are independent required reviewers; `readiness_approval_owner` is
explicitly `none` because no local aggregate writer exists. Typed external-
governance closure and a counterfeit-approval fixture protect that boundary.
Eighteen high-authority families are typed; direct source inventory reports 363
substring occurrences across fifteen remaining families.
The latest structural count is 32 closure family branches, 744 remaining
substring assertions in the closure region, and 1,284 lines in
`closure_contracts.rs`. Do not blindly generate a struct forest for every

Binary file not shown.

View file

@ -660,4 +660,4 @@ current_status:
- Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
- `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
next_action: Continue the conceptual-substitution pass. Seventeen high-authority closure families are typed and guarded. The old diff-derived residual counter was unsound; direct source inventory is authoritative and reports 426 content.contains occurrences across sixteen remaining families. Workflow physically owns adoption, scheduling, work-order, and verification. Preparation now physically owns typed Objective Draft and its counterfeit-adoption fixture. Next map the remaining preparation/collaboration families before typing another one; readiness review has unresolved composite reviewer ownership and must not be mechanically typed until that authority is clarified. External governance should converge on tooling plus publication/accounting; operations retains policy/deployment. Provider chronology is explicitly external and guarded as arrival order. Continue auditing evidence/security mirrors and adapters for borrowed authority.
next_action: Continue the conceptual-substitution pass. Eighteen high-authority closure families are typed and guarded. Direct source inventory reports 363 content.contains occurrences across fifteen remaining families. Workflow owns adoption, scheduling, work-order, and verification; preparation owns Objective Draft. Readiness review no longer has a composite owner: Self routes independent Maintainer/Soul/Mind/Bifrost review requests, readiness_approval_owner is none, and no local aggregate may mint approval. Next map collaboration/preparation cargo, especially planning and interpreter briefs, before selecting another authority cut. External governance should converge on tooling plus publication/accounting; operations retains policy/deployment. Provider chronology is explicitly external and guarded as arrival order. Continue auditing evidence/security mirrors and adapters for borrowed authority.