From eae695879bcef4678623166dd91b1e6bbd04d2ad Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Fri, 19 Jun 2026 02:53:34 +0100 Subject: [PATCH] Demote synthetic service runbooks --- epiphany-core/src/bin/epiphany-verse-query.rs | 54 +++++++++++++++++- notes/fresh-workspace-handoff.md | 1 + state/ledgers.msgpack | Bin 294194 -> 294815 bytes state/map.yaml | 1 + 4 files changed, 55 insertions(+), 1 deletion(-) diff --git a/epiphany-core/src/bin/epiphany-verse-query.rs b/epiphany-core/src/bin/epiphany-verse-query.rs index 7817b052..ef5ff924 100644 --- a/epiphany-core/src/bin/epiphany-verse-query.rs +++ b/epiphany-core/src/bin/epiphany-verse-query.rs @@ -3204,6 +3204,49 @@ fn run_cli() -> Result<()> { "local Verse query smoke did not demote missing service runbook artifacts to non-elevated regeneration" ); } + let synthetic_runbook_action = ServiceExecutionRunbookAction { + family: "cluster-service-execution-runbook".to_string(), + route: + "epiphany-cluster-daemon-services::cluster-windows-service-execution-runbook" + .to_string(), + artifact_ref: + "smoke://cluster-service-execution-audit/cluster-windows-service-execution-runbook" + .to_string(), + follow_up_command: WRAPPER_CLUSTER_SERVICE_EXECUTION_RUNBOOK_COMMAND.to_string(), + private_state_exposed: false, + failed_check_count: 5, + missing_check_count: 0, + service_id: "epiphany-cluster-daemon-services".to_string(), + completion_audit_wrapper_mode: "cluster-service-execution-audit".to_string(), + completion_audit_wrapper_command: WRAPPER_CLUSTER_SERVICE_EXECUTION_AUDIT_COMMAND + .to_string(), + }; + let (synthetic_artifact_rows, _) = swarm_action_rows( + "ready", + &[], + &ready_policy_report, + &[], + &[], + &[synthetic_runbook_action], + ); + if !synthetic_artifact_rows.iter().any(|row| { + row.priority == 50 + && row.family == "service-execution-authority" + && row.status == "runbook-artifact-missing" + && row.wrapper_mode == "cluster-service-execution-runbook" + && row.effect_class == "service-lifecycle-runbook-regeneration" + && row.operator_artifact_status == "missing" + && row.operator_artifact_sha256 == "none" + && row.operator_artifact_execution_command == "none" + && row.operator_aftercare_command == "none" + && !row.mutates_state + && !row.requires_elevated_authority + && !row.private_state_exposed + }) { + anyhow::bail!( + "local Verse query smoke treated a synthetic service runbook artifact as elevated authority" + ); + } println!( "{}", serde_json::to_string_pretty(&json!({ @@ -4203,7 +4246,8 @@ fn swarm_action_rows( }); } for (index, runbook_action) in service_execution_runbook_actions.iter().enumerate() { - let artifact_status = operator_artifact_status(&runbook_action.artifact_ref).to_string(); + let artifact_status = + service_execution_runbook_artifact_status(&runbook_action.artifact_ref).to_string(); let ( status, action, @@ -4480,6 +4524,14 @@ fn operator_artifact_status(artifact_ref: &str) -> &'static str { } } +fn service_execution_runbook_artifact_status(artifact_ref: &str) -> &'static str { + if artifact_ref.starts_with("smoke://") { + "missing" + } else { + operator_artifact_status(artifact_ref) + } +} + fn daemon_restart_policy_directory_report( context: &EpiphanyLocalVerseContext, ) -> DaemonRestartPolicyDirectoryReport { diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 12f97011..761d7485 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -120,6 +120,7 @@ remembers doctrine; the branch remembers the blade. - `gjallar` is the non-mutating whole-Verse herald to run first when reorienting; `swarm-overview` remains its compatibility name. It locates agents, cluster/private-Verse topology, daemon liveness, Eve surfaces, and daemon tools in one compact report without opening private Verse state or full-context debug serialization. - Idunn, not Codex/Self/Gjallar, owns daemon survival and service lifecycle physiology. `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now generates an Idunn-owned service lifecycle runbook for the Epiphany hosted body: the artifact verifies each sealed child runbook artifact exists and matches its advertised SHA-256 before launching it with `Start-Process ... -PassThru`, records child exit codes, continues after child failure, runs aftercare audits through `tools\epiphany_local_run.ps1` with explicit arguments instead of string evaluation, and exits nonzero if any child or aftercare step fails. Its wrapper JSON and one-line summary print the exact swarm-level `elevatedCommand=Start-Process PowerShell -Verb RunAs -Wait ...`, parent artifact SHA-256, `verifiesChildArtifactSha256=True`, `usesExplicitAftercareArguments=True`, child/aftercare row counts, aftercare commands, owner, hosted body, and private-state seal; JSON now includes structured `childRunbookRows` and `aftercareRows` with service ids, routes, SHA-256s, audit modes, authority gates, failed-check counts, and private-state seals. Proof `local-20260619-013021-159-c93088be` generated and inspected that guard without mutating services. It still requires explicit elevated operator authority before service mutation. - Service execution audits now expose the exact Idunn runbook route at the audit mouth: `cluster-service-execution-audit` and `service-execution-audit` JSON and wrapper summaries include the sealed runbook path, SHA-256, elevated `Start-Process PowerShell -Verb RunAs -Wait ...` command, aftercare command, and `requiresElevatedAuthority=True`. Daemon-supervisor `*smoke` commands default to `.epiphany-smoke/daemon-supervisor-/local-verse.ccmp` unless `--store` is explicit, keeping synthetic smoke receipts out of the shared live local Verse. +- Gjallar/swarm-overview now demotes `smoke://` service runbook witnesses to non-elevated runbook regeneration rows, not operator authority rows. The live local Verse cluster runbook witness has been repaired through `cluster-service-execution-runbook` plus `cluster-service-execution-audit`; latest Gjallar shows real cluster and single-service runbook paths, SHA-256s, elevated commands, and aftercare. - `swarm-triage` is the compact responsibility rite after sight: it no-ops when liveness is ready, carries blocked tool-host/service lifecycle attention plus an ordered action queue as sealed sight, and emits topology-aware typed daemon poke receipts only for current daemon liveness attention rows. - `epiphany-openai-runtime` worker result ingress now parses assistant output directly into typed role/reorient ingress structs selected from the durable launch document, stores nested `statePatch` and `selfPatch` as typed MessagePack in `EpiphanyRuntimeRoleWorkerResult`, and no longer passes worker result data through generic `serde_json::Value`. JSON survives there only as the OpenAI text-output edge before typed deserialization. - Agent self-memory review/application now has typed `AgentSelfPatch` core APIs. JSON-value selfPatch functions are compatibility wrappers for CLI/artifact ingress; native callers should parse once at the edge and then call `review_agent_self_patch_document` / `apply_agent_self_patch_document`. Role-result self-persistence no longer exports a JSON-value reviewer; the live API is `review_role_self_patch_document`. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 022bf863d10952ff280419a9faa85e4f9bcec95c..5e317f7901a67019bb191eb4e51a1d13b832a8d3 100644 GIT binary patch delta 574 zcmZXRzi!k(5XSMHDIg7L&^3sW=+JHa=gu}hiiiq&Qqk?L$H8R1bL{Tf5<*--fp~zE zB_xzrh@haPqvjz{q%=shG_X!`hfs>uNUQIg`Q|sDe(xUt**zI~J4rm7WY4}`^WVJw ze9wF7c|YH-2k+Jc&%M45zpMxT$5-8leSha>eh@~pb4T~<$8dCG|M3ehCD%cBcHl$z z{=R=}rKp7hYqAKYrX!pM0qCWg6CFWYS%t=+0ZX7rF_hSFi^W!<@embiZYxrtsWoF* zXlzi~N*zK`nFSd>mzTYPYg?6ESOcY|8s;eOQr#=JjcL($BMpM;nyaGwKJss0KbLo3 zPltC_1(tj%Z6HZ-$r{uK_k^ey4?$K9f{;sNQEvmb+`u-Z3*J;5F064Fr(qi9ER3gF zl(K1_vSga)$%8T-I}hW_qUv}3&$9aGNkWz;Im>cUWLY{LgNqB7gs;v>qA+CfBw}Ha zg>x<(lIPU+D3Qxe?7%n}j@IS?PoF$uagsW!8$go{8286Zx2fP7FGef6dO?k)+4~E3 CYQk6m delta 49 zcmbRLUvSee!3`3O)8ALIu(CxRV_>P_->l47$jJD%c`8%;R3=6s2GPvhr!uk3tpWhd CT@eld diff --git a/state/map.yaml b/state/map.yaml index daa4e0bd..0276c64e 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -628,6 +628,7 @@ current_status: - `SwarmActionRow` now carries `lifecycleOwner` and `hostedBody` so Gjallar/overview/triage action queues distinguish sight from daemon-keeper authority. Daemon liveness, restart-policy, service-lifecycle readback, and elevated service-control rows carry `Idunn` / `Epiphany`; non-lifecycle rows carry `none`. Rust TUI rows plus wrapper `actionQueue` render `owner=Idunn` and `hostedBody=Epiphany` for service readback and elevated service-control rows. Focused live proofs `local-20260619-004523-347-620b40e9` (`gjallar`) and `local-20260619-004523-003-a44ad06d` (`swarm-triage`) show the ownership fields on all service action rows with no daemon poke when liveness is ready and no private-state exposure. The broad `epiphany-verse-query smoke` Windows debug stack-overflow wound is now cut by running the CLI body on a larger worker-thread stack; direct smoke returns `status=ok` with seven clusters, seven daemon statuses, seventeen daemon tools, and the sealed latest receipt ids. - Direct wrapper audit summaries now expose the same follow-up ergonomics as the global sight rows. `tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit` and `-Mode service-execution-audit` print `failed check rows` with `serviceId::action=status`, artifact ref, local artifact SHA-256 when present, and `followUp=` for each failed/missing check. Live proofs `local-20260618-225923-468-d818951a` and `local-20260618-225923-529-7cfa2bb3` showed cluster readiness/install/start/audit/stop failures and supervisor-service readiness/install/start/status/reconcile/stop missing checks with actionable follow-up wrappers and `privateStateExposed=false`. - Service execution audits now carry their own elevated runbook readback instead of relying on Gjallar or wrapper memory. `epiphany-daemon-supervisor windows-service-execution-audit` and `cluster-windows-service-execution-audit` return `runbookPath`, `runbookSha256`, `elevatedCommand`, `requiresElevatedAuthority`, `aftercareMode`, and `aftercareCommand` from the sealed runbook witness; the wrapper summaries print those fields directly for `service-execution-audit` and `cluster-service-execution-audit`. Live proofs `local-20260619-024011-505-a18982fa` and `local-20260619-024010-980-842fc3a6` showed incomplete audits with repaired runbook hashes, exact `Start-Process PowerShell -Verb RunAs -Wait ... -File ` commands, explicit aftercare, and no private-state exposure. `epiphany-daemon-supervisor` smoke commands now default to `.epiphany-smoke/daemon-supervisor-/local-verse.ccmp` unless `--store` is explicit, so synthetic smoke receipts cannot become the latest live local Verse service proof by accident. + - Gjallar/swarm-overview service-execution authority rows now treat synthetic `smoke://` runbook witnesses as missing artifacts, not external executable refs. Such rows demote to `runbook-artifact-missing`, `service-lifecycle-runbook-regeneration`, no elevated authority, no mutation, no execution command, and no aftercare until a real local runbook artifact is regenerated. Source smoke guards this demotion, while live local Verse was repaired by regenerating the cluster execution runbook and re-auditing it: Gjallar proof `local-20260619-025100-231-0d70bace` showed both cluster and single-service authority rows with `artifactStatus=present`, real SHA-256s, exact elevated commands, aftercare audits, Idunn/Epiphany ownership, and no `smoke://` artifact refs. - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. next_action: Continue the swarm-readiness cuts toward elevated operator install/start execution and completed audit/readiness for the seven installed services. Run generated service execution/install/control runbooks only when the operator grants that authority. The current local Verse proves liveness readiness, scheduler-policy coverage, daemon-body invocation, per-organ launch artifact generation, per-organ install-plan generation, non-elevated install/start/stop execution refusal, read-only installed-service audit, cluster-wide service control planning, service-lifecycle attention surfacing, and cluster execution audit acceptance criteria: `swarm-overview` now reports `status=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `recommendedWrapperMode=swarm-online-runbook`, and `recommendedWrapperCommand=tools/epiphany_local_run.ps1 -Mode swarm-online-runbook`; `service-tick` can refresh all seven daemon heartbeats through sealed scheduler receipts; `cluster-service-runbook` writes seven explicit `epiphany-cluster-daemon serve` commands with `privateStateExposed=false`; `cluster-service-install-plan` writes seven distinct Windows service install commands with `privateStateExposed=false`; `cluster-service-install-execute`, `cluster-service-start-execute`, and `cluster-service-stop-execute` refuse as `execution-refused-not-elevated` with `executed=false` when the shell lacks service authority; `cluster-service-start-plan` and `cluster-service-stop-plan` emit seven non-mutating planned rows; `cluster-service-audit` currently reports `incomplete` with seven missing services in this non-installed environment; `service-execution-runbook` and `cluster-service-execution-runbook` write elevated wrapper sequences that continue after per-step failure, run final audits in `finally`, exit nonzero after audit when any step failed, and seal typed runbook receipts with aftercare args (`stepFailurePolicy`, `continueAfterStepFailure`, `nonzeroExitFailsStep`, `exitsNonzeroAfterFinalAudit`); and `service-execution-audit` plus `cluster-service-execution-audit` now require those runbook witnesses before considering elevated-ready/install/start/audit/status/reconcile/stop effect receipts. Preserve the existing typed local Verse surfaces: `service-plan`, `service-launch`, `service-runbook`, `cluster-service-runbook`, `cluster-service-install-plan`, `cluster-service-install-execute`, `cluster-service-audit`, `cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, `cluster-service-stop-execute`, `cluster-service-execution-readiness`, `cluster-service-execution-runbook`, `cluster-service-execution-audit`, `service-execution-runbook`, `service-execution-audit`, `service-tick`, `service-policy-directory`, `agent-state-soa`, `swarm-status`, `swarm-poke-down`, `swarm-triage`, `cluster-topology`, `eve-surfaces`, `eve-connect`, `collaboration-feedback`, `bifrost-publication`, `bifrost-ledger`, `receipt-directory`, `tool-directory`, `tool-invoke`, `swarm-overview`, `swarm-online-runbook`, `seed-compact`, service manager status/reconcile/readiness/control wrappers, compact daemon scheduler/policy receipt rows, daemon liveness-gated tool routing, Bifrost/Imagination chains, coordinator-run receipts, Hands gates, role review mirrors, and sealed agent-state SoA summary. Keep the seven-standing-faculty SoA, stale-turn repair, memory lifecycle, shared local Verse witnesses, and typed CultMesh Persona speech gate intact.