From ecfff489fe7e46f6ddcc9d58f0723411e8d94c13 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sat, 8 Aug 2026 03:35:02 +0100 Subject: [PATCH] Bind Modeling tools and output authority --- epiphany-core/src/agent_launch.rs | 49 ++++++++++++++++++++++ epiphany-core/src/resident_self.rs | 5 ++- notes/epiphany-current-algorithmic-map.md | 15 +++++++ notes/fresh-workspace-handoff.md | 16 +++++++ state/ledgers.msgpack | Bin 567311 -> 567954 bytes state/map.yaml | 6 +-- 6 files changed, 87 insertions(+), 4 deletions(-) diff --git a/epiphany-core/src/agent_launch.rs b/epiphany-core/src/agent_launch.rs index ff6bd2b4..2d9dccfb 100644 --- a/epiphany-core/src/agent_launch.rs +++ b/epiphany-core/src/agent_launch.rs @@ -681,6 +681,45 @@ pub fn epiphany_role_launch_output_schema(role_id: EpiphanyRoleResultRoleId) -> }, "required": ["evidenceIds", "repoModelPatch"] } + }, + { + "if": { + "not": { + "anyOf": [ + {"required": ["repoFrontierModelingRequestId"]}, + {"required": ["proposalModelingRequestId"]}, + {"required": ["claimRepairRequestId"]} + ] + } + }, + "then": { + "properties": { + "repoModelPatch": { + "properties": { + "purpose": { + "type": "object", + "required": ["kind"], + "properties": {"kind": {"const": "evolution"}}, + "additionalProperties": false + }, + "operations": { + "items": { + "anyOf": [ + {"type": "object", "required": ["operation", "node"], "properties": {"operation": {"const": "upsert_node"}, "node": repo_model_node_output_schema()}}, + {"type": "object", "required": ["operation", "node"], "properties": {"operation": {"const": "revise_node"}, "node": repo_model_node_output_schema()}}, + {"type": "object", "required": ["operation", "node_id"], "properties": {"operation": {"const": "retire_node"}, "node_id": {"type": "string", "minLength": 1}}}, + {"type": "object", "required": ["operation", "edge"], "properties": {"operation": {"const": "upsert_edge"}, "edge": repo_model_edge_output_schema()}}, + {"type": "object", "required": ["operation", "edge"], "properties": {"operation": {"const": "revise_edge"}, "edge": repo_model_edge_output_schema()}}, + {"type": "object", "required": ["operation", "edge_id"], "properties": {"operation": {"const": "retire_edge"}, "edge_id": {"type": "string", "minLength": 1}}} + ] + } + } + }, + "required": ["purpose", "operations"] + } + }, + "required": ["repoModelPatch"] + } } ]); } @@ -1609,6 +1648,16 @@ mod tests { ["maxContains"], 1 ); + let ordinary_operations = schema["allOf"][3]["then"]["properties"]["repoModelPatch"] + ["properties"]["operations"]["items"]["anyOf"] + .as_array() + .expect("ordinary Modeling operations"); + assert_eq!(ordinary_operations.len(), 6); + assert!(ordinary_operations.iter().all(|operation| { + !operation["properties"]["operation"]["const"] + .as_str() + .is_some_and(|kind| kind.contains("frontier")) + })); let operations = schema["properties"]["repoModelPatch"]["properties"]["operations"]["items"]["anyOf"] .as_array() diff --git a/epiphany-core/src/resident_self.rs b/epiphany-core/src/resident_self.rs index 8411ba97..1c436026 100644 --- a/epiphany-core/src/resident_self.rs +++ b/epiphany-core/src/resident_self.rs @@ -535,7 +535,6 @@ pub fn coordinator_argv( policy.max_steps.to_string(), "--max-runtime-seconds".into(), policy.turn_timeout_seconds.to_string(), - "--no-auto-tools".into(), ]; let ResidentSelfWake::Explicit { objective } = wake; argv.extend(["--objective".into(), objective.clone()]); @@ -1987,6 +1986,10 @@ mod tests { let prepared = prepare_resident_self_launch(&store, &policy, 4)?.expect("prepared launch"); assert_eq!(prepared.grant.grant_id, grant.grant_id); assert!(!prepared.argv.iter().any(|arg| arg == "--objective")); + assert!( + !prepared.argv.iter().any(|arg| arg == "--no-auto-tools"), + "role-scoped tool policy, not resident argv, owns Modeling inspection authority" + ); assert!(prepared.argv.windows(2).any(|pair| pair == [ "--admitted-model-direction-consideration-request-id", diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index 5cc95bf8..d1451339 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -1302,6 +1302,21 @@ intentionally stops before that loop actuates. Its startup handler creates the exact `RepoFrontierProposalModelingLaunchBinding` that resident fulfillment then verifies. +Role tool authority belongs to the role-scoped adapter, not to resident Self. +Resident preparation therefore does not append a blanket `--no-auto-tools`: +Modeling and Eyes must be able to inspect their Body through the adapter's +read-only grants, while the adapter still refuses tools outside the launched +organ contract. Live v41 proved the distinction: tool-starved Modeling twice +returned an empty non-typed payload; the same bounded recovery with native +tools produced a grounded typed result. + +Output shape must also match launch authority. Ordinary Modeling with no typed +proposal, claim-repair, or verdict request exposes only node/edge evolution in +its output schema. Frontier operations remain available only behind the typed +authority fields whose exact identities Mind validates. This moves the first +line of defense from a prose warning plus downstream rejection into the model's +declared output contract; Mind remains the final admission owner. + ## Exact release build cache ownership Release construction has two serialized cache authorities. The graph cache is diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 15f7c661..f0399d75 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -1,5 +1,21 @@ # Fresh Workspace Handoff +Fresh v41 exhausted the selected proposal queue, then exercised failure and +recovery. Two Modeling runs launched with resident `--no-auto-tools` failed +immediately because the assistant payload was empty/non-typed JSON. Supervised +failure review wrote exact supersession receipts and relaunched through the +packaged coordinator. A tool-enabled retry completed with source-grounded +findings, proving the missing input. Mind nevertheless rejected two successive +completed patches because ordinary `evolution` attempted to mutate the current +verdict-owned frontier: `Evolution cannot bypass a current route or own +verdict-driven frontier lifecycle`. The runtime stayed unchanged. + +The current worktree removes resident's blanket tool disable and makes ordinary +Modeling's JSON schema expose only node/edge operations unless a typed proposal, +claim-repair, or verdict authority field is present. Focused schema and +resident-launch tests pass. v41 is sealed as the missing-tools and overbroad +output-contract boundary. + Exact pushed `5f09d35a` packages as `sha256-39a81a35d847fd6b459379d5bf3ef4fa57a3142745a10f13f4b033eea85ca45a` with witness diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 02d51c217e76afd49e242e61e59b7417332e93d5..8d2c7874a76c1bf81c8c64b6ecfe765cf9c4c028 100644 GIT binary patch delta 664 zcmYk4v2GJV5QaIMU`r{GD1eSpQqcH}aZD5iQP9vuNGMgh@$O(RTJIdYvv!Wg1qCG% z!tw(k3OXbTL`g$UL&1B{!(6Zt(v5C!cV_;7zP;Dq_ul;2`*^e1Js2I|J3RY#sr!LH z?HA9B;=#*R>(#1NXf*G(#$}BijVl_R&#PAV#rtb-zYGV%!*Xz>&*@-zd@x#nJ#SxM zUwzl@EPwuDA zwbq4F>Po*kOO>S$r`n;UfMb8r->6Qk8$Fwi?kp#fbFjMlTc!@Om(+uC7C3Rig5em+ zh_6-anJ$`CRp)43Ky5{H_E{VUs8Gz5637$*(zwAk&+jU&!>@tIEpaKg5uU^ zzuLQ<4Vm@B8#}j_#r~5m29G(IsZIr+!$ga$OU)#zaRFxHd5qrI_f?Z1vZpc`ZpKH8 zDjq>a6Bw*;?7Wk@50AILw=g%PAgT8mLRj)bfyZnVY||SmiZdrkU0Aw9c0&J+%s~@! zP)7;q9E~(&D^BQpU_8268L2`Sd&+AI0`z959MuiD1eP=}lI_DIHaU^Ky>)^L|KAU> NAt991Nrfr({{YYh@pAwG delta 65 zcmbPqRjL1i(gq1eZUZwb6XU333>?eeY*uD0WMs5%p32ldm5C9EK{PWEvj8zG5VHX> L`}V0!992sJ!5S2z diff --git a/state/map.yaml b/state/map.yaml index f6764205..380da042 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -34,9 +34,9 @@ invariants: - Evidence and git retain history; this map retains only state that changes future decisions. current_status: - summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact 5f09d35a packages as sha256-39a81a35d847fd6b459379d5bf3ef4fa57a3142745a10f13f4b033eea85ca45a with witness sha256-9cf82d9c1bdf018c36d199838598f5476acbc43818beb9fdb68840dc00be7f9b. v40 proved proposal Modeling creates its exact launch binding before resident success: resident stayed running through worker life, completed afterward, and typed queue ownership advanced from request 4b9414 to e75b60 only after that binding. The worker result failed and remains unaccepted, so proposal result review/recovery is the next live boundary. Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open. + summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact 5f09d35a packages as sha256-39a81a35d847fd6b459379d5bf3ef4fa57a3142745a10f13f4b033eea85ca45a with witness sha256-9cf82d9c1bdf018c36d199838598f5476acbc43818beb9fdb68840dc00be7f9b. v40 proved proposal binding-before-success and ordered queue consumption. v41 proved failed Modeling results can be supervised, superseded, and relaunched, but resident's blanket no-tools flag starved Modeling and the generic output schema offered frontier mutations ordinary evolution could never admit. Tool-enabled retries produced grounded results; Mind correctly rejected both forbidden frontier patches. The current worktree restores role-scoped tools and structurally restricts ordinary Modeling to node/edge evolution. Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open. operational_state: - local_worktree: clean_after_live_v40_binding_proof + local_worktree: modeling_tool_and_output_authority_repair_verified_pending_commit operator_wireguard: restored yggdrasil: canonical_small_public_crossing_body starfire: temporary_epiphany_cognition_body @@ -53,7 +53,7 @@ current_status: yggdrasil_epiphany_services: absent resident_physiology: heartbeat_and_self_running unresolved_authority: v31's generic user proposal produced a lawful direct Hands gate, but the active objective requires the autonomous Imagination-origin path and dedicated Mind adoption, so that gate remains inert. v37 proved single-owner pressure ordering but exposed that generic coordinator completion could consume a typed pressure without its requested launch consequence. The fulfillment repair is locally verified but not packaged/live. Canonical proposal Modeling, dedicated Mind adoption, exact Hands binding, bounded-worker failure/restart/closure, Persona consequence, retention, endurance, and Linux/Yggdrasil cognition remain open. - next_action: Record and push the v40 binding-before-success proof, then drive the failed proposal Modeling result through typed failure review/recovery without accepting it. Continue the remaining proposal queue into canonical Imagination planning, dedicated Mind, Hands, and bounded-worker failure/restart/Soul closure. + next_action: Commit, package, and authenticate the Modeling tool/output-authority repair; replay the sealed v41 recovery and prove ordinary Modeling emits an admissible node/edge-only patch, then follow CRRC into Reorientation acceptance and Continuity recovery receipt before Soul closure. Continue canonical Imagination planning, dedicated Mind, Hands, Persona, endurance, and Linux/Yggdrasil. active_subgoals: - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.