Record keyed Research Mind migration

notes/epiphany-current-algorithmic-map.md

@@ -5047,3 +5047,53 @@ strong state. The focused lifecycle proves deterministic two-launch convergence,
 sealed context, terminal result, review, admission, disjoint merge, and
 byte-identical stale refusal. Core library 561/561, OpenAI runtime 43/43, Self
 policy 26/26, and coordinator runtime 18/18 pass.
+
+## Keyed frontier Research lifecycle (2026-08-18)
+
+Exact `c7412998` removes Research from the aggregate coordinator state machine.
+The immutable v3 `RepoFrontierResearchRequest` seals the exact current frontier
+document and its dependency closure. The complete keyed RepoModel view remains
+inside the reasoning projection as audit cargo, but it is not a global strong
+read and unrelated graph changes cannot stale the pass.
+
+- Owner: `project_current_work` derives the exact Research continuation;
+  `launch_current_frontier_research_work` publishes its deterministic attempt;
+  `accept_frontier_research_result` alone admits its decision under
+  `Eyes.frontier_research`.
+- Inputs: one explicit external-evidence frontier, its exact dependency document
+  versions, immutable request and launch, terminal runtime result, sealed
+  reasoning basis and decision context, and exact governed public-source
+  receipts actually supplied to the model.
+- Outputs: separate keyed evidence, observation, and optional investigation
+  checkpoint documents; one request/context-bound `EyesEvidencePacket`; and one
+  atomic `EpiphanyMindCommitReceipt`.
+- Derived state: accepted-at timestamps, role boards, latest-result slots,
+  events, generic Research status, and coordinator thread are display or
+  transport projections only.
+- Forbidden writers: generic `roleAccept`, aggregate thread-state mutation,
+  CRRC regather, Modeling regather hints, accepted Eyes state, and a stale role
+  lane cannot create, suppress, review, retry, or admit Research. Eyes acceptance
+  cannot create or gate Modeling work.
+- Shared paths: operator and Resident consume the same exact current-work
+  lifecycle. Runtime fulfillment and archival use the same typed Research
+  request reference as live review.
+- Cut line: Research has no aggregate launch or acceptance fallback. The old
+  accepted/failure/timestamp routing branches are deleted; a missing explicit
+  external-evidence obligation cannot be repaired into Eyes work.
+- Verification: the complete decision remains durable if its strong frontier
+  changes after inference, but admission refuses byte-identically and never
+  reinterprets the output. A disjoint keyed RepoModel change merges; an exact
+  frontier change conflicts. Exact replay returns the original commit, archived
+  fulfillment requires that commit, and accepted Eyes produces no Modeling
+  obligation. CultCache 42/42 active tests, core library 561/561, Self policy
+  26/26, OpenAI runtime 43/43, coordinator runtime 18/18, and all-target core
+  compilation pass.
+
+The proof exposed a substrate-level encoding invariant. Compact positional
+MessagePack is unsafe for nested structs whose middle optional fields are
+omitted: later fields can occupy the wrong schema positions. CultCache exact
+`ba6a487` adds `prepare_entry_named`, which retains the typed numeric-slot
+`DatabaseEntry` envelope while encoding ordinary nested document fields as
+named maps. `prepare_mind_document` is the single Mind boundary, and objective,
+Body, and Research writers use it. This is an encoding owner, not a second state
+format or compatibility path.

notes/epiphany-fork-implementation-plan.md

@@ -239,14 +239,23 @@ Cut in this order:
    accepts disjoint keyed changes but refuses a changed strong frontier without
    mutation. Accepted Eyes timestamps, latest-result slots, aggregate prompt
    construction, and generic role lanes cannot create or suppress this work.
-   Migrate Research, Verification, planning, and reorientation next from
+8. **Frontier Research landed at `c7412998`:** the v3 request seals the exact
+   frontier/dependency document closure, while the full RepoModel projection is
+   audit cargo only. One deterministic attempt, terminal decision context,
+   request-bound Eyes packet, and `Eyes.frontier_research` Mind mutation own
+   Launch/Wait/Review/admission. Stale terminal decisions remain durable, exact
+   strong-state changes refuse admission byte-identically, and disjoint keyed
+   writes merge. Accepted Eyes, role lanes, timestamps, generic regather, and
+   Modeling hints cannot launch Eyes or gate Modeling. CultCache `ba6a487`
+   supplies the shared named nested-document encoding boundary used by Mind.
+   Migrate Verification, planning, and reorientation next from
    aggregate state patches and generic role lanes to family-owned current-work
    projections, exact job identities, `MindMutation` plans, and exact commit
    receipts. Reuse pure invariant primitives, not a generic mutable registry.
-8. Delete `EpiphanyThreadStateEntry`, `coordinator_state_transaction`, global
+9. Delete `EpiphanyThreadStateEntry`, `coordinator_state_transaction`, global
    expected revisions, aggregate update APIs, and all source references from
    production. Refuse old writable stores; add no dual reader or migrator.
-9. Replay fresh-store concurrency and decision-context acceptance. Only then
+10. Replay fresh-store concurrency and decision-context acceptance. Only then
    restart Model Atlas Gate 1 from a new external root.
 
 Do not preserve the aggregate for compatibility, manufacture a bootstrap

notes/fresh-workspace-handoff.md

@@ -1,6 +1,6 @@
 # Fresh workspace handoff
 
-Updated: 2026-08-17
+Updated: 2026-08-18
 
 ## Current state
 
@@ -12,7 +12,7 @@ effects, receipts, Mind admission, brakes, external consequence gates, and
 terminal commit. Focused core and OpenAI-runtime Persona suites pass.
 
 The five-day shakedown remains paused. The active branch includes exact
-`d367e525` on `codex/epiphany-shakedown-live`: the keyed Mind foundation, federated Model Atlas
+`c7412998` on `codex/epiphany-shakedown-live`: the keyed Mind foundation, federated Model Atlas
 vertical slice, ordinary Modeling authoring path, durable publisher identity,
 fresh seven-organ Mind bootstrap, and atomic RepoModel projection bootstrap are
 landed. Historical aggregate RepoModel and partial Gate stores are evidence
@@ -22,9 +22,11 @@ or repair path can restore their authority.
 This is not yet the full Concurrent Mind cut. Persisted
 `EpiphanyThreadStateEntry`, its coordinator transaction, and multiple
 unmigrated launch/acceptance/status readers remain live production authorities.
-Baseline Body, Proposal, and frontier-verdict Modeling are no longer among them:
+Baseline Body, Proposal, frontier-verdict Modeling, and frontier Research are no longer among them:
 keyed Mind owns their work projections, operator and Resident launch, exact job-bound
-continuation, review, and semantic admission. Fresh Gate
+continuation, review, and semantic admission. Research is driven only by an explicit
+external-evidence obligation; accepted Eyes state, timestamps, generic regather, and
+role lanes cannot launch Eyes or gate Modeling. Fresh Gate
 preflight proved the consequence: both keyed semantic partitions reached ready,
 but status still called the organism missing because no thread aggregate
 existed. Model Atlas Gate 1 is therefore paused behind that deletion, not merely
@@ -386,10 +388,27 @@ input only and cannot manufacture Modeling work. The aggregate telemetry prompt,
 accepted-at Research boundary, latest Verification selector, parallel authority
 MessagePack, and generic role-lane review path are gone for this family.
 
-Map and migrate Research acceptance next onto its exact request/launch,
-EyesEvidencePacket, decision context, and family-owned Mind commit. Continue
-with Verification,
-planning, and reorientation; then delete the aggregate schema/transaction. Run the source
+Exact `c7412998` migrates frontier Research onto its v3 request, exact
+frontier/dependency document closure, deterministic attempt, sealed reasoning basis and
+decision context, request-bound `EyesEvidencePacket`, and
+`Eyes.frontier_research` Mind commit. The complete RepoModel projection is immutable
+audit cargo, not one global conflict head. A result may terminalize after its strong
+frontier changes so the decision remains auditable; admission then refuses byte-identically
+instead of rebasing the output. Disjoint keyed writes still merge. Research evidence,
+observations, and optional checkpoints are separate Mind documents, and accepted Eyes
+does not implicitly create Modeling work. The generic coordinator launch/acceptance and
+Self lane/timestamp paths now refuse or ignore Research authority.
+
+The same pass exposed compact positional MessagePack as unsafe for nested structs with
+omitted middle optionals. CultCache exact `ba6a487` adds named nested preparation;
+Mind envelopes retain their typed numeric slots while nested document fields remain named.
+Objective, Body, and Research Mind writers now share that boundary.
+
+Map and migrate Verification next onto its exact Hands consequence, request/launch,
+terminal decision context, typed audit, Soul verdict, and family-owned Mind commit. Delete
+generic role launch/acceptance, latest-result, accepted-at, and thread-state authority for
+that family. Continue with planning and reorientation, then delete the aggregate
+schema/transaction. Run the source
 guards and fresh-store concurrency/decision-context suite. Only after that may
 Model Atlas Gate 1 restart from a new external root. Keep the current fresh and
 partial roots read-only; do not release scheduling, register operational

state/map.yaml

@@ -38,9 +38,9 @@ invariants:
   - Evidence and git retain history; this map retains only state that changes future decisions.
 
 current_status:
-  summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, and complete Body, Proposal, and frontier-verdict Modeling lifecycles are landed on codex/epiphany-shakedown-live, but the broader Concurrent Mind cut is not. Keyed Mind now owns all three families' work discovery, deterministic launch, exact job-bound continuation, review, and semantic admission without persisted thread state. EpiphanyThreadStateEntry and its coordinator transaction remain obsolete production authorities for Research, Verification, planning, reorientation, generic coordinator presence, and residual status paths. Fresh Gate preflight proved publisher identity, fresh organ Mind, atomic RepoModel projection bootstrap, and both semantic partitions, then correctly stopped when status called a ready keyed Mind missing without the legacy aggregate. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 is paused behind deletion of the remaining aggregate authority.
+  summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, and frontier-verdict Modeling lifecycles, and exact frontier Research lifecycle are landed on codex/epiphany-shakedown-live, but the broader Concurrent Mind cut is not. Keyed Mind now owns these families' work discovery, deterministic launch, exact job-bound continuation, review, and semantic admission without persisted thread state. EpiphanyThreadStateEntry and its coordinator transaction remain obsolete production authorities for Verification, planning, reorientation, generic coordinator presence, and residual status paths. Fresh Gate preflight proved publisher identity, fresh organ Mind, atomic RepoModel projection bootstrap, and both semantic partitions, then correctly stopped when status called a ready keyed Mind missing without the legacy aggregate. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 is paused behind deletion of the remaining aggregate authority.
   public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
-  latest_phase: Exact d367e525 migrates the live Soul-verdict-to-Modeling chain onto one deterministic request, exact Soul/Verification/route/frontier authority, sealed typed role projection, deterministic attempt identity, shared Launch/Wait/Review projection, Resident/operator actuation, and the existing Modeling.frontier_verdict MindMutation owner. Soul verdict and request are committed atomically; accepted Research timestamps, latest Verification selection, the aggregate Modeling telemetry prompt, and generic role-lane review no longer create this work. Admission proves its planned strong frontier read is the exact sealed document version, so an unrelated keyed node commit merges while a same-frontier change refuses byte-identically instead of rebasing model output. Accepted Eyes alone cannot manufacture Modeling work. Core library 561/561, OpenAI runtime 43/43, Self policy 26/26, coordinator runtime 18/18, and the focused lifecycle/concurrency proof pass. An unfiltered core package run separately exposed two pre-existing epiphany-hands-action fixture failures because those fixtures omit the production-required RepoFrontierHandsAuthority; the Hands gate was not weakened and fixture repair remains open. Gate 1 remains paused behind the Research and other aggregate families.
+  latest_phase: Exact c7412998 migrates frontier Research onto its immutable v3 request, exact frontier/dependency document authority, deterministic attempt, sealed reasoning basis and decision context, request/context-bound EyesEvidencePacket, and one Eyes.frontier_research MindMutation owner. The complete RepoModel view is audit cargo; only the exact frontier closure is a strong dependency. A terminal Research decision therefore remains durable after state changes, disjoint keyed writes merge at admission, and a changed frontier refuses admission byte-identically without rebasing the output. Eyes launches only from an explicit external-evidence obligation; accepted Eyes, role lanes, accepted-at timestamps, generic regather, and Modeling hints cannot create or gate Modeling. Exact ba6a487 adds named nested MessagePack preparation for Mind documents so omitted optional fields cannot shift later typed values while CultCache envelope slots remain stable. CultCache 42/42 active tests, core library 561/561, OpenAI runtime 43/43, Self policy 26/26, coordinator runtime 18/18, and all-target core compilation pass. The known unrelated epiphany-hands-action fixture failures remain; the production Hands gate was not weakened. Gate 1 remains paused behind Verification and the other aggregate families.
   operational_state:
     local_worktree: clean_at_latest_documentation_handoff
     operator_wireguard: restored
@@ -73,8 +73,8 @@ current_status:
     starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
     yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
-  unresolved_authority: Persisted EpiphanyThreadStateEntry and coordinator_state_transaction remain live production authorities for Research acceptance, Verification, planning, reorientation, and generic coordinator families, including status presence and residual result selection. They own none of the three live Modeling families, and the dormant claim-repair carrier family no longer exists. The residual aggregate still contradicts concurrent keyed Mind and blocks fresh organisms. Model Atlas code and isolated proofs remain accepted, but Gate 1 signed sight/brake acceptance, autonomous cascade, partition exercise, and sustained physiology remain unproven. Operational registration in gamecult-ops remains forbidden. Historical shakedown evidence remains valid; c011 and partial Gate roots remain untouched/read-only. One completed Discord consequence remains blocked by the absent Yggdrasil credential.
-  next_action: Map and migrate Research acceptance from aggregate state patches and generic role-lane receipts onto its existing exact RepoFrontierResearchRequest/launch lifecycle, EyesEvidencePacket, sealed decision context, and a family-owned typed Mind mutation/commit receipt. External public/source observations must already be typed Mind receipts; Research may create an explicit Modeling evidence obligation but accepted Eyes state alone may not launch or gate Modeling. Delete accepted-at selection and aggregate Research acceptance behavior, then continue through Verification, planning, and reorientation; finally delete EpiphanyThreadStateEntry, coordinator_state_transaction, global expected revisions, and every residual behavioral reader/writer. Refuse old writable stores and prove fresh concurrent/restart behavior before restarting Model Atlas Gate 1. Do not add a compatibility aggregate, dual reader, bootstrap thread, migrator, or generic work registry.
+  unresolved_authority: Persisted EpiphanyThreadStateEntry and coordinator_state_transaction remain live production authorities for Verification, planning, reorientation, and generic coordinator families, including status presence and residual result selection. They own none of the migrated Modeling or Research families, and the dormant claim-repair carrier family no longer exists. The residual aggregate still contradicts concurrent keyed Mind and blocks fresh organisms. Model Atlas code and isolated proofs remain accepted, but Gate 1 signed sight/brake acceptance, autonomous cascade, partition exercise, and sustained physiology remain unproven. Operational registration in gamecult-ops remains forbidden. Historical shakedown evidence remains valid; c011 and partial Gate roots remain untouched/read-only. One completed Discord consequence remains blocked by the absent Yggdrasil credential.
+  next_action: Map and migrate Verification from generic role launch/acceptance and aggregate thread-state receipts onto its exact Hands consequence, RepoFrontierVerificationRequest, launch/result/decision context, typed Verification audit, Soul verdict, and a family-owned keyed Mind mutation. The terminal decision must remain durable when a strong route/frontier dependency changes, while admission refuses without partial mutation or rebasing. Delete latest-result and accepted-at selection, aggregate Verification acceptance, and any Eyes dependency. Then continue through planning and reorientation; finally delete EpiphanyThreadStateEntry, coordinator_state_transaction, global expected revisions, and every residual behavioral reader/writer. Refuse old writable stores and prove fresh concurrent/restart behavior before restarting Model Atlas Gate 1. Do not add a compatibility aggregate, dual reader, bootstrap thread, migrator, or generic work registry.
 
 active_subgoals:
   - Delete persisted thread-state authority and complete the concurrent keyed Mind cut before any further operational Gate run.
@@ -87,8 +87,8 @@ active_subgoals:
 organ_readiness:
   model_atlas: code-complete and locally verified; ordinary Modeling uses runtime-authored proposal v2, authenticated Body-manifest evidence, derived opaque IDs, and exact CAS. Publishers revalidate Body evidence; signed transport, deterministic enriched projection, one Eve tree, local impact admission, Resident Self lane pressure, brakes, partition staleness, cycle policy, and no-Hands boundary pass. Real ordered Starfire Gate 1 and sustained dogfood remain open.
   persona: partial; the live Projector -> Persona -> Interpreter loop now consumes Ghostlight's exact-revision generalized projection membrane, and the Persona receives only one lived narrative stream rather than parallel raw transcript, memory, mention, activity, or typed-state authorities. Epiphany retains stage receipts, effect validation, Mind admission, brakes, Bifrost consequence gates, and terminal commit. Cross-host request/receipt/permit organs, distinct identities, exact release admission, unique permit completion, signed failure/unknown receipts, and no-repost behavior are live. Exact Bifrost cb3239aa fixes positional permit bodies and binds the Discord bridge command receipt to the signed request. A completed public consequence remains unproven because Yggdrasil has no Discord bot credential.
-  self: partial; proposal recovery, Mind admission, current-model Hands routing, Soul lifecycle precedence, verdict incorporation, proposal preemption, challenge-aware Eyes routing, in-process status ownership, causal Research/Soul-to-Modeling routing, and grant-owned lifecycle projection are live. Exact d367e525 makes the Soul-to-Modeling route a deterministic typed current-work lifecycle and proves accepted Eyes alone cannot manufacture Modeling. Exact d4907ee8 proves first-attempt proposal Modeling fulfillment, exact grant terminalization, and one terminal downstream review whose receipt carries the post-transaction awaitFrontierProposal action without replay.
-  eyes: local and copied Linux source-gathering circuits are proven. Immutable GitHub identity, execution revalidation without a grant, frontier-owned continuation, and request-owned exact public-source coverage share typed owners. Exact 3d13b1ea rejects zero, partial, or unrequested public lookup sets. Exact c40aa286 shares terminal receipt validation across provider and Mind. Exact 40beb6a9 and 08383c6d make one Research lifecycle own launch/review projection across Self, status, and coordinator. Exact packaged f90f1186 completed two immutable public lookup and Mind-acceptance cycles, advanced authenticated tool receipts from 53 to 61, produced no Hands consequence, survived process turnover, and stopped braked with both daemons exiting zero.
+  self: partial; proposal recovery, Mind admission, current-model Hands routing, Soul lifecycle precedence, verdict incorporation, proposal preemption, explicit-obligation Eyes routing, in-process status ownership, causal Soul-to-Modeling routing, and grant-owned lifecycle projection are live. Exact c7412998 removes accepted Eyes, generic regather, role lanes, and Modeling hints from Research launch authority; the exact Research lifecycle alone drives Launch/Wait/Review, and accepted Eyes alone cannot manufacture Modeling. Exact d4907ee8 proves first-attempt proposal Modeling fulfillment, exact grant terminalization, and one terminal downstream review whose receipt carries the post-transaction awaitFrontierProposal action without replay.
+  eyes: local and copied Linux source-gathering circuits are proven. Immutable GitHub identity, execution revalidation without a grant, frontier-owned continuation, request-owned exact public-source coverage, sealed decision context, and keyed evidence/observation admission share typed owners. Exact c7412998 makes one Research lifecycle own launch, terminal decision durability, review, and Eyes.frontier_research admission; full RepoModel state is audit cargo while the exact frontier closure owns conflicts. Exact 3d13b1ea rejects zero, partial, or unrequested public lookup sets. Exact c40aa286 shares terminal receipt validation across provider and Mind. Exact packaged f90f1186 completed two immutable public lookup and Mind-acceptance cycles, advanced authenticated tool receipts from 53 to 61, produced no Hands consequence, survived process turnover, and stopped braked with both daemons exiting zero.
   modeling: proven for the current bounded Windows circuit, the causal Linux resident Eyes-to-Modeling route, governed live directory observation, typed resident grant sight, first-attempt proposal-frontier publication, and single-consumption coordinator review. Exact d367e525 proves the full frontier-verdict lifecycle from atomic Soul request through deterministic launch, sealed decision, disjoint keyed merge, same-frontier refusal, and Modeling.frontier_verdict admission. Exact d4907ee8 proves one outer proposal job, one terminal review, post-transaction awaitFrontierProposal publication, and no replay. Broader Body-map coverage remains open.
   imagination: proven for three bounded live circuits, exact packaged receipt-free settlement, and genuine packaged model-produced option generation. Exact acd91e6e accepted signed public feedback into one proposal-only request, derived all causal identity and quoted-evidence references from authenticated runtime context, atomically published worker result plus candidate companion, settled Self once without retry, and neither adopted the proposal nor granted Hands. The rejected b661ec4b copied run remains evidence that model-authored evidence identifiers were an illicit provenance mouth; its three failed attempts were braked and sealed.
   hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind reviewed path ceilings to exact changed-path subsets.