Demote synthetic service runbooks

epiphany-core/src/bin/epiphany-verse-query.rs

@@ -3204,6 +3204,49 @@ fn run_cli() -> Result<()> {
                     "local Verse query smoke did not demote missing service runbook artifacts to non-elevated regeneration"
                 );
             }
+            let synthetic_runbook_action = ServiceExecutionRunbookAction {
+                family: "cluster-service-execution-runbook".to_string(),
+                route:
+                    "epiphany-cluster-daemon-services::cluster-windows-service-execution-runbook"
+                        .to_string(),
+                artifact_ref:
+                    "smoke://cluster-service-execution-audit/cluster-windows-service-execution-runbook"
+                        .to_string(),
+                follow_up_command: WRAPPER_CLUSTER_SERVICE_EXECUTION_RUNBOOK_COMMAND.to_string(),
+                private_state_exposed: false,
+                failed_check_count: 5,
+                missing_check_count: 0,
+                service_id: "epiphany-cluster-daemon-services".to_string(),
+                completion_audit_wrapper_mode: "cluster-service-execution-audit".to_string(),
+                completion_audit_wrapper_command: WRAPPER_CLUSTER_SERVICE_EXECUTION_AUDIT_COMMAND
+                    .to_string(),
+            };
+            let (synthetic_artifact_rows, _) = swarm_action_rows(
+                "ready",
+                &[],
+                &ready_policy_report,
+                &[],
+                &[],
+                &[synthetic_runbook_action],
+            );
+            if !synthetic_artifact_rows.iter().any(|row| {
+                row.priority == 50
+                    && row.family == "service-execution-authority"
+                    && row.status == "runbook-artifact-missing"
+                    && row.wrapper_mode == "cluster-service-execution-runbook"
+                    && row.effect_class == "service-lifecycle-runbook-regeneration"
+                    && row.operator_artifact_status == "missing"
+                    && row.operator_artifact_sha256 == "none"
+                    && row.operator_artifact_execution_command == "none"
+                    && row.operator_aftercare_command == "none"
+                    && !row.mutates_state
+                    && !row.requires_elevated_authority
+                    && !row.private_state_exposed
+            }) {
+                anyhow::bail!(
+                    "local Verse query smoke treated a synthetic service runbook artifact as elevated authority"
+                );
+            }
             println!(
                 "{}",
                 serde_json::to_string_pretty(&json!({
@@ -4203,7 +4246,8 @@ fn swarm_action_rows(
         });
     }
     for (index, runbook_action) in service_execution_runbook_actions.iter().enumerate() {
-        let artifact_status = operator_artifact_status(&runbook_action.artifact_ref).to_string();
+        let artifact_status =
+            service_execution_runbook_artifact_status(&runbook_action.artifact_ref).to_string();
         let (
             status,
             action,
@@ -4480,6 +4524,14 @@ fn operator_artifact_status(artifact_ref: &str) -> &'static str {
     }
 }
 
+fn service_execution_runbook_artifact_status(artifact_ref: &str) -> &'static str {
+    if artifact_ref.starts_with("smoke://") {
+        "missing"
+    } else {
+        operator_artifact_status(artifact_ref)
+    }
+}
+
 fn daemon_restart_policy_directory_report(
     context: &EpiphanyLocalVerseContext,
 ) -> DaemonRestartPolicyDirectoryReport {

notes/fresh-workspace-handoff.md

@@ -120,6 +120,7 @@ remembers doctrine; the branch remembers the blade.
 - `gjallar` is the non-mutating whole-Verse herald to run first when reorienting; `swarm-overview` remains its compatibility name. It locates agents, cluster/private-Verse topology, daemon liveness, Eve surfaces, and daemon tools in one compact report without opening private Verse state or full-context debug serialization.
 - Idunn, not Codex/Self/Gjallar, owns daemon survival and service lifecycle physiology. `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now generates an Idunn-owned service lifecycle runbook for the Epiphany hosted body: the artifact verifies each sealed child runbook artifact exists and matches its advertised SHA-256 before launching it with `Start-Process ... -PassThru`, records child exit codes, continues after child failure, runs aftercare audits through `tools\epiphany_local_run.ps1` with explicit arguments instead of string evaluation, and exits nonzero if any child or aftercare step fails. Its wrapper JSON and one-line summary print the exact swarm-level `elevatedCommand=Start-Process PowerShell -Verb RunAs -Wait ...`, parent artifact SHA-256, `verifiesChildArtifactSha256=True`, `usesExplicitAftercareArguments=True`, child/aftercare row counts, aftercare commands, owner, hosted body, and private-state seal; JSON now includes structured `childRunbookRows` and `aftercareRows` with service ids, routes, SHA-256s, audit modes, authority gates, failed-check counts, and private-state seals. Proof `local-20260619-013021-159-c93088be` generated and inspected that guard without mutating services. It still requires explicit elevated operator authority before service mutation.
 - Service execution audits now expose the exact Idunn runbook route at the audit mouth: `cluster-service-execution-audit` and `service-execution-audit` JSON and wrapper summaries include the sealed runbook path, SHA-256, elevated `Start-Process PowerShell -Verb RunAs -Wait ...` command, aftercare command, and `requiresElevatedAuthority=True`. Daemon-supervisor `*smoke` commands default to `.epiphany-smoke/daemon-supervisor-<command>/local-verse.ccmp` unless `--store` is explicit, keeping synthetic smoke receipts out of the shared live local Verse.
+- Gjallar/swarm-overview now demotes `smoke://` service runbook witnesses to non-elevated runbook regeneration rows, not operator authority rows. The live local Verse cluster runbook witness has been repaired through `cluster-service-execution-runbook` plus `cluster-service-execution-audit`; latest Gjallar shows real cluster and single-service runbook paths, SHA-256s, elevated commands, and aftercare.
 - `swarm-triage` is the compact responsibility rite after sight: it no-ops when liveness is ready, carries blocked tool-host/service lifecycle attention plus an ordered action queue as sealed sight, and emits topology-aware typed daemon poke receipts only for current daemon liveness attention rows.
 - `epiphany-openai-runtime` worker result ingress now parses assistant output directly into typed role/reorient ingress structs selected from the durable launch document, stores nested `statePatch` and `selfPatch` as typed MessagePack in `EpiphanyRuntimeRoleWorkerResult`, and no longer passes worker result data through generic `serde_json::Value`. JSON survives there only as the OpenAI text-output edge before typed deserialization.
 - Agent self-memory review/application now has typed `AgentSelfPatch` core APIs. JSON-value selfPatch functions are compatibility wrappers for CLI/artifact ingress; native callers should parse once at the edge and then call `review_agent_self_patch_document` / `apply_agent_self_patch_document`. Role-result self-persistence no longer exports a JSON-value reviewer; the live API is `review_role_self_patch_document`.

state/map.yaml

@@ -628,6 +628,7 @@ current_status:
   - `SwarmActionRow` now carries `lifecycleOwner` and `hostedBody` so Gjallar/overview/triage action queues distinguish sight from daemon-keeper authority. Daemon liveness, restart-policy, service-lifecycle readback, and elevated service-control rows carry `Idunn` / `Epiphany`; non-lifecycle rows carry `none`. Rust TUI rows plus wrapper `actionQueue` render `owner=Idunn` and `hostedBody=Epiphany` for service readback and elevated service-control rows. Focused live proofs `local-20260619-004523-347-620b40e9` (`gjallar`) and `local-20260619-004523-003-a44ad06d` (`swarm-triage`) show the ownership fields on all service action rows with no daemon poke when liveness is ready and no private-state exposure. The broad `epiphany-verse-query smoke` Windows debug stack-overflow wound is now cut by running the CLI body on a larger worker-thread stack; direct smoke returns `status=ok` with seven clusters, seven daemon statuses, seventeen daemon tools, and the sealed latest receipt ids.
   - Direct wrapper audit summaries now expose the same follow-up ergonomics as the global sight rows. `tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit` and `-Mode service-execution-audit` print `failed check rows` with `serviceId::action=status`, artifact ref, local artifact SHA-256 when present, and `followUp=<wrapper command>` for each failed/missing check. Live proofs `local-20260618-225923-468-d818951a` and `local-20260618-225923-529-7cfa2bb3` showed cluster readiness/install/start/audit/stop failures and supervisor-service readiness/install/start/status/reconcile/stop missing checks with actionable follow-up wrappers and `privateStateExposed=false`.
   - Service execution audits now carry their own elevated runbook readback instead of relying on Gjallar or wrapper memory. `epiphany-daemon-supervisor windows-service-execution-audit` and `cluster-windows-service-execution-audit` return `runbookPath`, `runbookSha256`, `elevatedCommand`, `requiresElevatedAuthority`, `aftercareMode`, and `aftercareCommand` from the sealed runbook witness; the wrapper summaries print those fields directly for `service-execution-audit` and `cluster-service-execution-audit`. Live proofs `local-20260619-024011-505-a18982fa` and `local-20260619-024010-980-842fc3a6` showed incomplete audits with repaired runbook hashes, exact `Start-Process PowerShell -Verb RunAs -Wait ... -File <runbook>` commands, explicit aftercare, and no private-state exposure. `epiphany-daemon-supervisor` smoke commands now default to `.epiphany-smoke/daemon-supervisor-<command>/local-verse.ccmp` unless `--store` is explicit, so synthetic smoke receipts cannot become the latest live local Verse service proof by accident.
+  - Gjallar/swarm-overview service-execution authority rows now treat synthetic `smoke://` runbook witnesses as missing artifacts, not external executable refs. Such rows demote to `runbook-artifact-missing`, `service-lifecycle-runbook-regeneration`, no elevated authority, no mutation, no execution command, and no aftercare until a real local runbook artifact is regenerated. Source smoke guards this demotion, while live local Verse was repaired by regenerating the cluster execution runbook and re-auditing it: Gjallar proof `local-20260619-025100-231-0d70bace` showed both cluster and single-service authority rows with `artifactStatus=present`, real SHA-256s, exact elevated commands, aftercare audits, Idunn/Epiphany ownership, and no `smoke://` artifact refs.
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   next_action: Continue the swarm-readiness cuts toward elevated operator install/start execution and completed audit/readiness for the seven installed services. Run generated service execution/install/control runbooks only when the operator grants that authority. The current local Verse proves liveness readiness, scheduler-policy coverage, daemon-body invocation, per-organ launch artifact generation, per-organ install-plan generation, non-elevated install/start/stop execution refusal, read-only installed-service audit, cluster-wide service control planning, service-lifecycle attention surfacing, and cluster execution audit acceptance criteria: `swarm-overview` now reports `status=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `recommendedWrapperMode=swarm-online-runbook`, and `recommendedWrapperCommand=tools/epiphany_local_run.ps1 -Mode swarm-online-runbook`; `service-tick` can refresh all seven daemon heartbeats through sealed scheduler receipts; `cluster-service-runbook` writes seven explicit `epiphany-cluster-daemon serve` commands with `privateStateExposed=false`; `cluster-service-install-plan` writes seven distinct Windows service install commands with `privateStateExposed=false`; `cluster-service-install-execute`, `cluster-service-start-execute`, and `cluster-service-stop-execute` refuse as `execution-refused-not-elevated` with `executed=false` when the shell lacks service authority; `cluster-service-start-plan` and `cluster-service-stop-plan` emit seven non-mutating planned rows; `cluster-service-audit` currently reports `incomplete` with seven missing services in this non-installed environment; `service-execution-runbook` and `cluster-service-execution-runbook` write elevated wrapper sequences that continue after per-step failure, run final audits in `finally`, exit nonzero after audit when any step failed, and seal typed runbook receipts with aftercare args (`stepFailurePolicy`, `continueAfterStepFailure`, `nonzeroExitFailsStep`, `exitsNonzeroAfterFinalAudit`); and `service-execution-audit` plus `cluster-service-execution-audit` now require those runbook witnesses before considering elevated-ready/install/start/audit/status/reconcile/stop effect receipts. Preserve the existing typed local Verse surfaces: `service-plan`, `service-launch`, `service-runbook`, `cluster-service-runbook`, `cluster-service-install-plan`, `cluster-service-install-execute`, `cluster-service-audit`, `cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, `cluster-service-stop-execute`, `cluster-service-execution-readiness`, `cluster-service-execution-runbook`, `cluster-service-execution-audit`, `service-execution-runbook`, `service-execution-audit`, `service-tick`, `service-policy-directory`, `agent-state-soa`, `swarm-status`, `swarm-poke-down`, `swarm-triage`, `cluster-topology`, `eve-surfaces`, `eve-connect`, `collaboration-feedback`, `bifrost-publication`, `bifrost-ledger`, `receipt-directory`, `tool-directory`, `tool-invoke`, `swarm-overview`, `swarm-online-runbook`, `seed-compact`, service manager status/reconcile/readiness/control wrappers, compact daemon scheduler/policy receipt rows, daemon liveness-gated tool routing, Bifrost/Imagination chains, coordinator-run receipts, Hands gates, role review mirrors, and sealed agent-state SoA summary. Keep the seven-standing-faculty SoA, stale-turn repair, memory lifecycle, shared local Verse witnesses, and typed CultMesh Persona speech gate intact.