Cut memory graph context for bridge launches

epiphany-codex-bridge/src/launch_context.rs

@@ -1,21 +1,35 @@
 use chrono::SecondsFormat;
 use chrono::Utc;
 use epiphany_core::EpiphanyMemoryContextPacket;
+use epiphany_core::EpiphanyMemoryContextQuery;
+use epiphany_core::EpiphanyMemoryProfile;
 use epiphany_core::EpiphanyPromptContextInput;
 use epiphany_core::EpiphanyThreadState;
+use epiphany_core::load_memory_graph_snapshot;
+use epiphany_core::memory_graph_from_epiphany_graphs;
+use epiphany_core::plan_memory_graph_context_cut;
 use epiphany_core::query_epiphany_local_verse_context;
 use epiphany_core::render_epiphany_prompt_context;
 use epiphany_core::seed_epiphany_local_verse_context;
+use epiphany_core::write_memory_graph_snapshot;
 use std::path::Path;
 use std::path::PathBuf;
 
 pub const EPIPHANY_LOCAL_VERSE_RUNTIME_ID: &str = "epiphany-local";
 
 pub fn local_verse_store_path(runtime_store_path: &Path) -> PathBuf {
+    sibling_state_store_path(runtime_store_path, "local-verse.ccmp")
+}
+
+pub fn memory_graph_store_path(runtime_store_path: &Path) -> PathBuf {
+    sibling_state_store_path(runtime_store_path, "memory-graph.msgpack")
+}
+
+fn sibling_state_store_path(runtime_store_path: &Path, filename: &str) -> PathBuf {
     runtime_store_path
         .parent()
         .unwrap_or_else(|| Path::new("."))
-        .join("local-verse.ccmp")
+        .join(filename)
 }
 
 pub fn role_launch_context_focus(state: &EpiphanyThreadState, role_label: &str) -> String {
@@ -63,14 +77,13 @@ pub fn render_launch_dynamic_prompt_context(
                     local_verse_store.display()
                 )
             })?;
-    let memory_context = EpiphanyMemoryContextPacket {
-        id: format!("memctx-launch-state-rev-{}", state.revision),
-        query_id: "bridge-launch-local-verse-only".to_string(),
-        warnings: vec![
-            "Semantic memory graph context is not connected to this bridge launch path yet; this packet carries local Verse context only.".to_string(),
-        ],
-        ..Default::default()
-    };
+    let memory_context =
+        launch_memory_context(runtime_store_path, state, focus.as_str()).map_err(|error| {
+            format!(
+                "failed to build launch memory context beside {}: {error}",
+                runtime_store_path.display()
+            )
+        })?;
     Ok(render_epiphany_prompt_context(
         &EpiphanyPromptContextInput {
             focus,
@@ -80,6 +93,59 @@ pub fn render_launch_dynamic_prompt_context(
     ))
 }
 
+fn launch_memory_context(
+    runtime_store_path: &Path,
+    state: &EpiphanyThreadState,
+    focus: &str,
+) -> Result<EpiphanyMemoryContextPacket, String> {
+    let memory_graph_store = memory_graph_store_path(runtime_store_path);
+    let (snapshot, refreshed_from_state) = match load_memory_graph_snapshot(&memory_graph_store)
+        .map_err(|error| {
+            format!(
+                "failed to load memory graph store {}: {error}",
+                memory_graph_store.display()
+            )
+        })? {
+        Some(snapshot) => (snapshot, false),
+        None => {
+            let snapshot = memory_graph_from_epiphany_graphs(
+                format!("bridge-launch-state-rev-{}", state.revision),
+                &state.graphs,
+            );
+            write_memory_graph_snapshot(&memory_graph_store, &snapshot).map_err(|error| {
+                format!(
+                    "failed to write memory graph store {} from thread state: {error}",
+                    memory_graph_store.display()
+                )
+            })?;
+            (snapshot, true)
+        }
+    };
+
+    let mut packet = plan_memory_graph_context_cut(
+        &snapshot,
+        &EpiphanyMemoryContextQuery {
+            id: format!("bridge-launch-query-state-rev-{}", state.revision),
+            profile: Some(EpiphanyMemoryProfile::RepoArchitecture),
+            text: Some(focus.to_string()),
+            budget: Some(5),
+            ..Default::default()
+        },
+    );
+    if refreshed_from_state {
+        packet.warnings.push(format!(
+            "Memory graph store was refreshed from current thread-state repo graph at {}.",
+            memory_graph_store.display()
+        ));
+    }
+    if packet.nodes.is_empty() && packet.summaries.is_empty() {
+        packet.warnings.push(
+            "Memory graph context is empty for this launch focus; the accepted repo graph may be thin or stale.".to_string(),
+        );
+    }
+    Ok(packet)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -109,8 +175,9 @@ mod tests {
         assert!(rendered.contains("Test launch context."));
         assert!(rendered.contains("Odin"));
         assert!(rendered.contains("Yggdrasil"));
-        assert!(rendered.contains("local Verse context only"));
+        assert!(rendered.contains("Memory graph"));
         assert!(local_verse_store_path(&runtime_store).exists());
+        assert!(memory_graph_store_path(&runtime_store).exists());
         fs::remove_dir_all(&temp)?;
         Ok(())
     }

notes/epiphany-fork-implementation-plan.md

@@ -87,7 +87,7 @@ The landed machine now has:
 - first Codex-independent native runtime vertebra through `epiphany-runtime-spine`, storing runtime identity, sessions, jobs, job results, and events as typed CultCache MessagePack documents, opening/completing native jobs, projecting job-result counts, and emitting a framed CultNet hello message for the native contract
 - first Rust CultMesh local-node integration: `vendor/cultmesh-rs` now provides the repo-contained CultMesh surface over vendored CultCache/CultNet, and `epiphany-core` depends on that surface for local `EpiphanyCultMeshStatusEntry`, `EpiphanyCultMeshVersePolicyEntry`, and `EpiphanyCultMeshGlobalRoomPolicyEntry` round-trip smokes instead of treating raw CultNet as the ergonomic app-facing database layer
 - first local Verse query surface: `notes/epiphany-verse-architecture.md` names Verse/Odin/Yggdrasil ownership, and `epiphany-verse-query` can seed/query a compact CultMesh-backed local Verse context bundle for operator inspection and future dynamic prompt assembly without granting semantic memory, public sharing, or state-admission authority
-- first dynamic prompt launch handoff: role/reorient worker launch documents carry optional `dynamicPromptContext`, runtime prompt assembly consumes that field into worker instructions, `epiphany-prompt-context-smoke` proves rendered Verse/memory context can ride a role launch document without admitting unrelated private-looking text, and live bridge role/reorient launch paths now feed local Verse context from a sibling `local-verse.ccmp` store while leaving semantic memory search as an explicit missing live input
+- first dynamic prompt launch handoff: role/reorient worker launch documents carry optional `dynamicPromptContext`, runtime prompt assembly consumes that field into worker instructions, `epiphany-prompt-context-smoke` proves rendered Verse/memory context can ride a role launch document without admitting unrelated private-looking text, and live bridge role/reorient launch paths now feed local Verse plus memory graph context from sibling `local-verse.ccmp` and `memory-graph.msgpack` stores beside runtime-spine
 - first Hands/Soul/Continuity contract catalogs: action, verification, and continuity now have native `epiphany-core` contract families, runtime-spine advertisement, CultMesh policy documents, and local CultMesh smoke coverage beside Mind/Substrate Gate/Eyes
 - live-specialist runner must be rebuilt around heartbeat/runtime-spine result receipts
 - first Phase 6 Aquarium operator shell extracted to sibling repo `E:\Projects\EpiphanyAquarium`, a Tauri v2 + React/WebGL client over the existing status bridge, dogfood artifacts, and GUI action artifacts, with its own distilled interface state/memory/doctrine plus durable checkpoint preparation, bounded status/coordinator artifact buttons, fixed modeling/verification/reorient launch and read-back buttons, and explicit review-gated reorient acceptance

notes/epiphany-verse-architecture.md

@@ -160,9 +160,11 @@ is executable worker input without becoming durable state authority.
 
 The bridge launch path now feeds that field for live role/reorient launches.
 It derives a sibling `local-verse.ccmp` CultMesh store from the runtime-spine
-store path, seeds/queries the local Verse context, and renders it into
-`dynamicPromptContext`. Semantic memory search is intentionally not claimed on
-that path yet; the packet says when it is local-Verse-only.
+store path, seeds/queries the local Verse context, refreshes/loads a sibling
+`memory-graph.msgpack` from the current typed thread-state repo graph, cuts a
+bounded semantic memory packet from that graph, and renders both into
+`dynamicPromptContext`. If the graph is thin, the packet says so instead of
+pretending semantic retrieval was rich.
 
 ## Invariants
 
@@ -185,11 +187,9 @@ For swarm migration, the next useful chain is:
 1. Keep `epiphany-verse-query` as the local Verse context smoke.
 2. Add semantic memory graph query packets beside the Verse policy/status
    packet.
-3. Add the real memory graph store input to bridge launch-context rendering so
-   live workers receive semantic context cuts, not only local Verse context.
-4. Add a launch/runtime smoke that proves a persisted worker request includes
+3. Add a launch/runtime smoke that proves a persisted worker request includes
    relevant Verse/memory context and omits unrelated private sludge.
-5. Move one Aquarium/local-run read path to the native Verse query before
+4. Move one Aquarium/local-run read path to the native Verse query before
    increasing swarm cadence.
 
 No live swarm runner is cleared until pause/brake, stale active-turn recovery,

notes/fresh-workspace-handoff.md

@@ -48,7 +48,7 @@ remembers doctrine; the branch remembers the blade.
 - Native status now exposes that quarantined bridge spine without granting it authority. `runtime_spine_status` counts tool invocation intents, receipts, and pending calls; `runtime_tool_invocation_statuses` derives read-only intent/receipt status rows; `epiphany-runtime-spine status` reports the counts; and `epiphany-mvp-status --runtime-store <path>` renders the latest tool calls under `tools`. This is operator visibility only. The model-runtime feedback seam is also now typed: MCP-shaped model tool calls preserve the original provider `call_id` plus source model request id; `epiphany-model-runtime tool-followup` builds a provider-neutral follow-up `EpiphanyModelRequest` from completed typed tool receipts using the previous provider response id; and `epiphany-model-runtime tool-followup-turn` derives and runs that continuation through the selected provider in one runtime-owned operation. `epiphany-model-runtime run-worker --auto-tools --tool-adapter-bin <path>` now lets a launched worker automatically execute typed MCP intents through the quarantined Codex MCP adapter, feed receipts back through follow-up model turns, and only then parse/complete the worker result. Codex still executes the quarantined MCP edge; Epiphany owns the continuation request shape and invocation boundary.
 - The active foundation directive is now `notes/codex-starvation-and-cultnet-liberation-plan.md`. The previous Codex app-server control-plane rebuild made Epiphany less rotten inside Codex, but that is not the destination. Epiphany must become a native CultCache/CultMesh/CultNet runtime while remaining an honest modified Codex-derived backend for subscription auth/model use. Codex should remain relatively vanilla and keep doing Codex things, including useful app-server and streaming bridge affordances, but it must not own Epiphany state, processes, prompts, scheduler decisions, or policy. The bridge handles interop; Codex and Epiphany do not get to rummage around in each other's organs.
 - `notes/epiphany-cultmesh-dreaming-roadmap.md` is the new concrete design for distributed Epiphany dreaming. The invariant is hard: private state stays local; public dreams are separately authored typed documents distributed through CultMesh/CultNet; foreign dreams are thought weather until a reviewed local adoption receipt digests them. The first code slice should be dream schemas plus a local CultMesh-backed store, not public fanout.
-- CultMesh is now the preferred Rust abstraction for that local store work. The compile-time Rust substrate is repo-contained: `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`. The old `E:\Projects\CultLib\crates\*` dependency body is dead in this checkout and must not be revived by accident. Vendored CultCache reads/writes `cultcache.store.v1`, so `state/ledgers.msgpack` and `epiphany-state status` are aligned again. The first integrations are deliberately small: status, Verse policy, global room policy, organ contract policy, native operator status, native operator snapshots, and local operator run intent/receipt round-trip through CultMesh. `notes/epiphany-verse-architecture.md` now names the local Verse/Odin/Yggdrasil architecture: Odin sees advertised Verse metadata without bypassing boundaries, Yggdrasil hosts important trusted GameCult Verses such as Bifrost, and prompt assembly should query compact local Verse plus semantic memory packets instead of carrying the whole archive. Role/reorient launch documents now have optional `dynamicPromptContext`; runtime prompt assembly consumes that field into worker instructions, `epiphany-prompt-context-smoke` proves a rendered Verse/memory packet is preserved on a role launch document, and live bridge role/reorient launches now feed local Verse context from a sibling `local-verse.ccmp` store beside runtime-spine. Semantic memory search is still not connected to that live bridge launch path. Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-cultmesh-smoke`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-cultmesh-status -- smoke --store .\.epiphany-smoke\cultmesh\operator-status.ccmp --runtime-id epiphany-cultmesh-status-smoke`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-operator-snapshot -- smoke --store .\.epiphany-smoke\cultmesh\operator-snapshots.ccmp --runtime-id epiphany-operator-snapshot-smoke --snapshot-id smoke-status`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-operator-run -- smoke --store .\.epiphany-smoke\cultmesh\operator-runs.ccmp --runtime-id epiphany-operator-run-smoke --run-id smoke-run`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-verse-query -- smoke`, and `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-prompt-context-smoke` for the focused proofs. Future local dream/status/Verse work should start from CultMesh, not raw CultNet, unless the task is polishing the CultMesh internals themselves. Preserve the three Verse tiers: `epiphany-internal` for private sub-agent typed state, `gamecult-local` for trusted LAN/Yggdrasil-tunnel GameCult sharing, and `epiphany-global` for untrusted public dreams plus topic-specific threaded public rooms for Face posts.
+- CultMesh is now the preferred Rust abstraction for that local store work. The compile-time Rust substrate is repo-contained: `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`. The old `E:\Projects\CultLib\crates\*` dependency body is dead in this checkout and must not be revived by accident. Vendored CultCache reads/writes `cultcache.store.v1`, so `state/ledgers.msgpack` and `epiphany-state status` are aligned again. The first integrations are deliberately small: status, Verse policy, global room policy, organ contract policy, native operator status, native operator snapshots, and local operator run intent/receipt round-trip through CultMesh. `notes/epiphany-verse-architecture.md` now names the local Verse/Odin/Yggdrasil architecture: Odin sees advertised Verse metadata without bypassing boundaries, Yggdrasil hosts important trusted GameCult Verses such as Bifrost, and prompt assembly should query compact local Verse plus semantic memory packets instead of carrying the whole archive. Role/reorient launch documents now have optional `dynamicPromptContext`; runtime prompt assembly consumes that field into worker instructions, `epiphany-prompt-context-smoke` proves a rendered Verse/memory packet is preserved on a role launch document, and live bridge role/reorient launches now feed local Verse plus memory graph context from sibling `local-verse.ccmp` and `memory-graph.msgpack` stores beside runtime-spine. The memory graph refreshes from current typed thread-state repo graphs when absent, so thin state remains visibly thin. Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-cultmesh-smoke`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-cultmesh-status -- smoke --store .\.epiphany-smoke\cultmesh\operator-status.ccmp --runtime-id epiphany-cultmesh-status-smoke`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-operator-snapshot -- smoke --store .\.epiphany-smoke\cultmesh\operator-snapshots.ccmp --runtime-id epiphany-operator-snapshot-smoke --snapshot-id smoke-status`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-operator-run -- smoke --store .\.epiphany-smoke\cultmesh\operator-runs.ccmp --runtime-id epiphany-operator-run-smoke --run-id smoke-run`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-verse-query -- smoke`, and `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-prompt-context-smoke` for the focused proofs. Future local dream/status/Verse work should start from CultMesh, not raw CultNet, unless the task is polishing the CultMesh internals themselves. Preserve the three Verse tiers: `epiphany-internal` for private sub-agent typed state, `gamecult-local` for trusted LAN/Yggdrasil-tunnel GameCult sharing, and `epiphany-global` for untrusted public dreams plus topic-specific threaded public rooms for Face posts.
 - `notes/codex-auth-spine-inventory.md` is the source-grounded keeper list for that reliquary. Corrected compliance invariant: Codex-compatible auth identity stays anchored in vendored Codex-derived auth machinery. `epiphany-openai-auth-spine` is now a thin Epiphany-named boundary over `codex-login`, not a clean-room clone of credential storage or token refresh. Codex apps, skills, marketplace, plugin UX, broad app-server workflow, and JSON-RPC sprawl remain cuttable because they are not subscription-auth legitimacy.
 - Edge JSON is allowed for schema description, hostile ingress before immediate typed parsing, sealed forensic artifacts, or named quarantine experiments. When both subsystems are ours, runtime data must remain typed CultCache documents and move over CultNet typed contracts. Generic `serde_json::Value` in worker launch/result/selfPatch/runtime flow is contamination until classified and replaced.
 - `notes/epiphany-swarm-readiness-plan.md` is the current live-fire direction gate. The local runner proves startup/status/coordinator wiring; it does not authorize unattended swarm operation. Carry VoidBot's lessons forward: one CTB-style initiative scheduler, typed pause/brake, active-turn freeze, cooldown after completion, stale active-turn recovery receipts, parent-side speech eligibility, memory lifecycle phases, and typed operation proposals instead of prompt-owned governance.

state/map.yaml

@@ -72,7 +72,7 @@ data_flow:
 active_subgoals:
   - Use `notes/epiphany-cultmesh-dreaming-roadmap.md` as the design authority for distributed Epiphany dreaming. Public dreams are separately authored typed documents distributed through CultMesh/CultNet; private state remains local and cannot be shared by flipping a visibility flag. Foreign dreams are external thought weather until a reviewed local adoption receipt digests them into memory, planning, doctrine, or governance.
   - CultMesh is now the preferred ergonomic Rust abstraction over CultCache and CultNet for Epiphany-owned local database surfaces. The Rust substrate is repo-contained under `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`; the old `E:\Projects\CultLib\crates\*` path is dead in this checkout and must not be reintroduced as a compile-time dependency. Future local Verse/dream/status work should start at CultMesh unless it is explicitly polishing CultMesh internals. Preserve the three-Verse boundary: `epiphany-internal` for private sub-agent typed state, `gamecult-local` for trusted LAN/Yggdrasil-tunnel GameCult project sharing, and `epiphany-global` for untrusted public dreams plus topic-specific threaded public rooms for Face posts.
-  - Use `notes/epiphany-verse-architecture.md` as the source note for local Verse/Odin/Yggdrasil prompt-context architecture. Odin is the all-seer discovery/coordinator surface for advertised Verse metadata, not a trust-boundary bypass. Yggdrasil is the hosted spine for important trusted GameCult Verses such as Bifrost. The first native local Verse query surface is `epiphany-verse-query`, which seeds/queries compact CultMesh policy/status/contract context for dynamic prompt assembly; `epiphany-prompt-context-smoke` proves that compact local Verse context plus a semantic memory graph context cut can render a bounded dynamic prompt packet, omit unrelated private-looking text, and preserve the packet inside a role worker launch document. Live bridge role/reorient launch paths now feed `dynamicPromptContext` from a sibling `local-verse.ccmp` store; semantic memory search is still a named gap on that live path.
+  - Use `notes/epiphany-verse-architecture.md` as the source note for local Verse/Odin/Yggdrasil prompt-context architecture. Odin is the all-seer discovery/coordinator surface for advertised Verse metadata, not a trust-boundary bypass. Yggdrasil is the hosted spine for important trusted GameCult Verses such as Bifrost. The first native local Verse query surface is `epiphany-verse-query`, which seeds/queries compact CultMesh policy/status/contract context for dynamic prompt assembly; `epiphany-prompt-context-smoke` proves that compact local Verse context plus a semantic memory graph context cut can render a bounded dynamic prompt packet, omit unrelated private-looking text, and preserve the packet inside a role worker launch document. Live bridge role/reorient launch paths now feed `dynamicPromptContext` from sibling `local-verse.ccmp` and `memory-graph.msgpack` stores beside runtime-spine, refreshing the memory graph from current typed thread-state repo graphs when absent.
   - The active priority is Codex starvation and CultNet liberation. Use `notes/codex-starvation-and-cultnet-liberation-plan.md` as the directive and `notes/codex-auth-spine-inventory.md` as the source-grounded keeper list for the retained OpenAI subscription auth/model transport bridge. Classify all Epiphany-relevant JSON contamination, define the native CultNet runtime boundary, keep worker launch/result/selfPatch cargo as typed documents, evacuate Epiphany operator/state/process authority from Codex JSON-RPC, wrap MCP's unavoidable JSON protocol edge in typed Epiphany intent/result/receipt documents, and keep cutting until Epiphany can run its own state and processes without `codex_message_processor.rs` except for bridge compatibility.
   - Use `notes/epiphany-anatomy.md` as the canonical anatomy map. Embodied sub-agents are Self, Face, Imagination, Eyes, Proprioception, Hands, and Soul. Body is substrate, Mind is persistent state/state admission, Continuity is recovery/compaction/sleep protocol machinery, and Substrate Gate is substrate access protocol.
   - Organ state now has a hard profile split: resident Epiphany sub-agents use lean `work_organ` state, public/person-shaped agents use portable `persona` state, and heartbeat/swarm machinery owns scheduling/coordination physiology. Face is the Epiphany organ; Persona is the shared GameCult contract for Epiphany Face, VoidBot repo Faces, and Ghostlight characters. Persona documents carry provenance, required public presentation metadata, `date-time` timestamps, typed `candidateActions`, strict anchored thoughts with non-authoritative extensions, custom enum companion labels, and typed affect subrecords for bonds/status reads/doctrine stances. Work organs must not inherit Persona affect/social-bond/status-read machinery just because the old Ghostlight-derived shape had room for it.
@@ -591,4 +591,4 @@ current_status:
     cargo and rejects modeling/planning/graph/checkpoint authority. MVP status
     and coordinator smokes pass with six lanes, and the smoke harness now
     rebuilds stale coordinator/app-server binaries before using them.
-  next_action: Add real memory graph store input to live bridge launch-context rendering so role/reorient workers receive semantic context cuts, then choose the next chain carefully: Hands action proof once implementation/action lanes become live versus collapsing Mind review/state mutation/commit into one storage-owner admission primitive.
+  next_action: Add a launch/runtime smoke that proves persisted worker launch requests carry relevant Verse/memory dynamic context through runtime-spine, then choose the next chain carefully: Hands action proof once implementation/action lanes become live versus collapsing Mind review/state mutation/commit into one storage-owner admission primitive.