GameCult/Epiphany
Archived
Watch
9
0
Fork
You've already forked Epiphany
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add repo verification request safe family

Browse source
This commit is contained in:
Meta Vens 2026-06-20 16:27:59 +01:00
commit f1d321a6c9
6 changed files with 699 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

439
epiphany-core/src/bin/epiphany-repo-verification-request-family-smoke.rs Normal file
View file

@ -0,0 +1,439 @@
use anyhow::Context;
use anyhow::Result;
use anyhow::anyhow;
use chrono::Utc;
use serde_json::Value;
use serde_json::json;
use std::env;
use std::fs;
use std::path::Path;
use std::path::PathBuf;
use std::process::Command;
fn main() -> Result<()> {
let args = Args::parse()?;
let result = run_smoke(args)?;
println!("{}", serde_json::to_string_pretty(&result)?);
Ok(())
}
#[derive(Clone, Debug)]
struct Args {
root: PathBuf,
smoke_root: PathBuf,
}
impl Args {
fn parse() -> Result<Self> {
let mut root = env::current_dir().context("failed to resolve current directory")?;
let mut smoke_root = root.join(".epiphany-smoke");
let mut args = env::args().skip(1).peekable();
while let Some(arg) = args.next() {
match arg.as_str() {
"--root" => root = take_path(&mut args, "--root")?,
"--smoke-root" => smoke_root = take_path(&mut args, "--smoke-root")?,
other => return Err(anyhow!("unexpected argument {other:?}")),
}
}
Ok(Self { root, smoke_root })
}
}
fn run_smoke(args: Args) -> Result<Value> {
let root = args
.root
.canonicalize()
.with_context(|| format!("failed to resolve {}", args.root.display()))?;
let manifest = root.join("epiphany-core").join("Cargo.toml");
if !manifest.exists() {
return Err(anyhow!(
"could not find epiphany-core manifest at {}",
manifest.display()
));
}
fs::create_dir_all(&args.smoke_root)
.with_context(|| format!("failed to create {}", args.smoke_root.display()))?;
let stamp = Utc::now().format("%Y%m%d-%H%M%S").to_string();
let smoke_dir = args
.smoke_root
.join(format!("repo-verification-request-family-{stamp}"));
if smoke_dir.exists() {
fs::remove_dir_all(&smoke_dir)
.with_context(|| format!("failed to clear {}", smoke_dir.display()))?;
}
fs::create_dir_all(&smoke_dir)
.with_context(|| format!("failed to create {}", smoke_dir.display()))?;
let repo = smoke_dir.join("repo-body");
fs::create_dir_all(&repo).with_context(|| format!("failed to create {}", repo.display()))?;
git(["init"], &repo)?;
git(
["config", "user.email", "epiphany-smoke@example.invalid"],
&repo,
)?;
git(["config", "user.name", "Epiphany Smoke"], &repo)?;
fs::write(
repo.join("README.md"),
"# Repo Verification Request Family Smoke\n\nThis repository proves branch-local Hands verification-request requests.\n",
)
.with_context(|| format!("failed to seed {}", repo.join("README.md").display()))?;
git(["add", "README.md"], &repo)?;
git(
["commit", "-m", "Seed repo verification request smoke body"],
&repo,
)?;
git(
["switch", "-c", "epiphany/repo-verification-request-family"],
&repo,
)?;
let item = "repo-verification-request-family";
let target_path = ".epiphany/verification-requests/repo-verification-request-family.toml";
let local_verse = repo.join(".epiphany").join("local-verse.ccmp");
cargo_json(
&manifest,
"epiphany-repo",
&[
"init",
"--workspace",
path_str(&repo)?,
"--epiphany-root",
path_str(&root)?,
"--swarm-id",
"repo-verification-request-family-smoke",
"--topic",
"repo-verification-request-family",
],
&root,
)?;
cargo_json(
&manifest,
"epiphany-swarm",
&[
"online",
"--workspace",
path_str(&repo)?,
"--epiphany-root",
path_str(&root)?,
"--runtime-id",
"repo-verification-request-family-smoke",
"--local-verse-store",
path_str(&local_verse)?,
],
&root,
)?;
cargo_json(
&manifest,
"epiphany-work",
&[
"accept",
"--workspace",
path_str(&repo)?,
"--from",
"persona",
"--item",
item,
"--summary",
"Ask Soul to review required Hands evidence after a bounded branch-local work order exists.",
"--candidate-action-ref",
"candidate-action://repo-verification-request-family/soul-review",
"--candidate-action-ref",
"candidate-action://repo-verification-request-family/hands-evidence-check",
"--public-discussion-ref",
"epiphany-global/persona-collaboration/repo-verification-request-family",
],
&root,
)?;
let plan = cargo_json(
&manifest,
"epiphany-work",
&[
"derive-plan",
"--workspace",
path_str(&repo)?,
"--item",
item,
"--action-family",
"repo-verification-request",
"--model-ref",
"repo-verification-request-family-smoke-imagination-v1",
"--model-authored",
],
&root,
)?;
for _ in 0..4 {
cargo_json(
&manifest,
"epiphany-work",
&[
"tick",
"--workspace",
path_str(&repo)?,
"--epiphany-root",
path_str(&root)?,
"--item",
item,
"--cooldown-seconds",
"0",
],
&root,
)?;
}
let close_path = repo
.join(".epiphany")
.join("work")
.join(format!("work-close-{item}.json"));
let close = read_json(&close_path)?;
let request_text = fs::read_to_string(repo.join(target_path))
.with_context(|| format!("failed to read {}", repo.join(target_path).display()))?;
require_eq(
&plan,
&["derivation", "safeActionFamily"],
"repo.verification_request",
)?;
require_eq(&close, &["status"], "closed")?;
require_eq(&close, &["soul", "verdict"], "passed")?;
require_eq(
&close,
&["closureReview", "familyAssertions", "status"],
"passed",
)?;
require_bool(
&close,
&["closureReview", "sourceGrounding", "pathScopeMatched"],
true,
)?;
require_bool(&close, &["privateStateExposed"], false)?;
require_text(
&request_text,
"schema_version = \"epiphany.repo_verification_request.v0\"",
)?;
require_text(
&request_text,
"safe_action_family = \"repo.verification_request\"",
)?;
require_text(&request_text, "[request]")?;
require_text(&request_text, "status = \"awaiting-soul-review\"")?;
require_text(&request_text, "requested_owner = \"Soul\"")?;
require_text(
&request_text,
"requested_effect = \"verify-branch-local-hands-work\"",
)?;
require_text(&request_text, "work_order_ref = ")?;
require_text(
&request_text,
"verification_scope = \"declared changed paths, Hands receipts, and visible repo diff\"",
)?;
require_text(&request_text, "[antecedents]")?;
require_text(&request_text, "substrate_gate_required = true")?;
require_text(&request_text, "hands_intent_required = true")?;
require_text(&request_text, "hands_review_required = true")?;
require_text(&request_text, "hands_patch_required = true")?;
require_text(&request_text, "hands_command_required = true")?;
require_text(&request_text, "hands_commit_required = true")?;
require_text(&request_text, "work_order_required = true")?;
require_text(&request_text, "[required_receipts]")?;
require_text(
&request_text,
"hands_patch = \"epiphany.hands.patch_receipt\"",
)?;
require_text(
&request_text,
"hands_command = \"epiphany.hands.command_receipt\"",
)?;
require_text(
&request_text,
"hands_commit = \"epiphany.hands.commit_receipt\"",
)?;
require_text(
&request_text,
"soul_verdict = \"epiphany.soul.verification_verdict\"",
)?;
require_text(
&request_text,
"closure_review = \"epiphany.repo_work_closure_review.v0\"",
)?;
require_text(
&request_text,
"mind_review = \"epiphany.mind.gateway_review\"",
)?;
require_text(
&request_text,
"mind_commit = \"epiphany.mind.state_commit_receipt\"",
)?;
require_text(&request_text, "[checks]")?;
require_text(&request_text, "\"declared-paths-match-commit\"")?;
require_text(&request_text, "\"hands-receipts-present\"")?;
require_text(&request_text, "\"visible-diff-supports-summary\"")?;
require_text(&request_text, "\"no-private-state-exposure\"")?;
require_text(&request_text, "\"publication-remains-gated\"")?;
require_text(&request_text, "failure_blocks_mind_admission = true")?;
require_text(&request_text, "soul_verdict_authorized = false")?;
require_text(&request_text, "state_commit_authorized = false")?;
require_text(&request_text, "hands_action_authorized = false")?;
require_text(&request_text, "rerun_authorized = false")?;
require_text(&request_text, "publication_authorized = false")?;
require_text(&request_text, "cross_body_mutation_authorized = false")?;
require_text(&request_text, "private_state_exposed = false")?;
let summary = json!({
"schemaVersion": "epiphany.repo_verification_request_family_smoke.v0",
"status": "ok",
"smokeDir": smoke_dir,
"repo": repo,
"branch": git_output(["branch", "--show-current"], &repo)?,
"item": item,
"safeActionFamily": plan["derivation"]["safeActionFamily"],
"targetPath": target_path,
"closeStatus": close["status"],
"soulVerdict": close["soul"]["verdict"],
"familyAssertionsStatus": close["closureReview"]["familyAssertions"]["status"],
"pathScopeMatched": close["closureReview"]["sourceGrounding"]["pathScopeMatched"],
"awaitingSoulReview": true,
"soulVerdictAuthorized": false,
"stateCommitAuthorized": false,
"rerunAuthorized": false,
"handsActionAuthorized": false,
"privateStateExposed": false,
});
write_json(&smoke_dir.join("summary.json"), &summary)?;
Ok(summary)
}
fn cargo_json(manifest: &Path, bin: &str, args: &[&str], cwd: &Path) -> Result<Value> {
let output = Command::new("cargo")
.arg("run")
.arg("--quiet")
.arg("--manifest-path")
.arg(manifest)
.arg("--bin")
.arg(bin)
.arg("--")
.args(args)
.current_dir(cwd)
.output()
.with_context(|| format!("failed to run cargo bin {bin}"))?;
if !output.status.success() {
return Err(anyhow!(
"{bin} failed with status {:?}\nstdout:\n{}\nstderr:\n{}",
output.status.code(),
String::from_utf8_lossy(&output.stdout),
String::from_utf8_lossy(&output.stderr)
));
}
serde_json::from_slice(&output.stdout).with_context(|| {
format!(
"{bin} did not emit JSON on stdout:\n{}",
String::from_utf8_lossy(&output.stdout)
)
})
}
fn git<const N: usize>(args: [&str; N], cwd: &Path) -> Result<()> {
let output = Command::new("git")
.args(args)
.current_dir(cwd)
.output()
.with_context(|| format!("failed to run git in {}", cwd.display()))?;
if output.status.success() {
Ok(())
} else {
Err(anyhow!(
"git failed in {} with status {:?}\nstdout:\n{}\nstderr:\n{}",
cwd.display(),
output.status.code(),
String::from_utf8_lossy(&output.stdout),
String::from_utf8_lossy(&output.stderr)
))
}
}
fn git_output<const N: usize>(args: [&str; N], cwd: &Path) -> Result<String> {
let output = Command::new("git")
.args(args)
.current_dir(cwd)
.output()
.with_context(|| format!("failed to run git in {}", cwd.display()))?;
if output.status.success() {
Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
} else {
Err(anyhow!(
"git failed in {} with status {:?}\nstdout:\n{}\nstderr:\n{}",
cwd.display(),
output.status.code(),
String::from_utf8_lossy(&output.stdout),
String::from_utf8_lossy(&output.stderr)
))
}
}
fn read_json(path: &Path) -> Result<Value> {
let bytes = fs::read(path).with_context(|| format!("failed to read {}", path.display()))?;
serde_json::from_slice(&bytes).with_context(|| format!("failed to parse {}", path.display()))
}
fn write_json(path: &Path, value: &Value) -> Result<()> {
if let Some(parent) = path.parent() {
fs::create_dir_all(parent)
.with_context(|| format!("failed to create {}", parent.display()))?;
}
fs::write(path, serde_json::to_vec_pretty(value)?)
.with_context(|| format!("failed to write {}", path.display()))
}
fn require_eq(value: &Value, path: &[&str], expected: &str) -> Result<()> {
let actual = path
.iter()
.try_fold(value, |current, key| current.get(*key))
.and_then(Value::as_str)
.unwrap_or("<missing>");
if actual == expected {
Ok(())
} else {
Err(anyhow!(
"expected {} to be {expected:?}, got {actual:?}",
path.join(".")
))
}
}
fn require_bool(value: &Value, path: &[&str], expected: bool) -> Result<()> {
let actual = path
.iter()
.try_fold(value, |current, key| current.get(*key))
.and_then(Value::as_bool);
if actual == Some(expected) {
Ok(())
} else {
Err(anyhow!(
"expected {} to be {expected}, got {:?}",
path.join("."),
actual
))
}
}
fn require_text(haystack: &str, needle: &str) -> Result<()> {
if haystack.contains(needle) {
Ok(())
} else {
Err(anyhow!(
"expected verification request text to contain {needle:?}"
))
}
}
fn take_path(
args: &mut std::iter::Peekable<impl Iterator<Item = String>>,
flag: &str,
) -> Result<PathBuf> {
args.next()
.map(PathBuf::from)
.with_context(|| format!("missing value for {flag}"))
}
fn path_str(path: &Path) -> Result<&str> {
path.to_str()
.ok_or_else(|| anyhow!("path is not valid UTF-8: {}", path.display()))
}

232
epiphany-core/src/bin/epiphany-work.rs
View file

@ -1895,8 +1895,11 @@ fn derive_safe_plan_family(input: DeriveSafePlanInput<'_>) -> Result<DerivedSafe
"repo-work-order" | "work-order" | "hands-work-order" => {
derive_repo_work_order_plan(input, &action_family)
}
"repo-verification-request" | "verification-request" | "soul-verification-request" => {
derive_repo_verification_request_plan(input, &action_family)
}
other => Err(anyhow!(
"unsupported derive-plan action family {other:?}; supported families are append-worklog, planning-note, checklist-note, section-note, repo-status-section, task-card, repo-manifest, repo-tool-capabilities, repo-collaboration-topic, repo-consensus-brief, repo-objective-draft, repo-adoption-request, repo-scheduling-request, and repo-work-order"
"unsupported derive-plan action family {other:?}; supported families are append-worklog, planning-note, checklist-note, section-note, repo-status-section, task-card, repo-manifest, repo-tool-capabilities, repo-collaboration-topic, repo-consensus-brief, repo-objective-draft, repo-adoption-request, repo-scheduling-request, repo-work-order, and repo-verification-request"
)),
}
}
@ -3227,6 +3230,137 @@ fn derive_repo_work_order_plan(
})
}
fn derive_repo_verification_request_plan(
input: DeriveSafePlanInput<'_>,
action_family: &str,
) -> Result<DerivedSafePlan> {
let item_slug = sanitize(input.item);
let default_target = format!(".epiphany/verification-requests/{item_slug}.toml");
let target_path = validate_toml_target_path(input.target_path.unwrap_or(&default_target))?;
let candidate_refs =
string_array_from_json(input.accept_receipt, &["feedback", "candidateActionRefs"]);
let public_refs =
string_array_from_json(input.accept_receipt, &["feedback", "publicDiscussionRefs"]);
let now = Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true);
let request_id = format!("repo-verification-request:{item_slug}");
let work_order_ref = format!(".epiphany/work-orders/{item_slug}.toml");
let lines = vec![
"# Epiphany repo verification request.".to_string(),
"# Branch-local Soul request cargo; not a verdict or Mind admission.".to_string(),
format!(
"schema_version = {}",
toml_basic_string("epiphany.repo_verification_request.v0")
),
format!("item = {}", toml_basic_string(input.item)),
format!("created_at = {}", toml_basic_string(&now)),
format!("source = {}", toml_basic_string(input.source)),
format!("summary = {}", toml_basic_string(&compact_line(input.summary))),
format!(
"safe_action_family = {}",
toml_basic_string("repo.verification_request")
),
format!("model_authored = {}", input.model_authored),
format!(
"model_ref = {}",
toml_basic_string(input.model_ref.unwrap_or("deterministic-fallback"))
),
"operator_authored_shell_details = false".to_string(),
"hands_authority_granted = false".to_string(),
"soul_verdict_granted = false".to_string(),
"durable_state_admitted = false".to_string(),
"publication_authorized = false".to_string(),
"merge_authorized = false".to_string(),
"service_lifecycle_authority = false".to_string(),
"cross_repo_mutation = false".to_string(),
"private_state_exposed = false".to_string(),
format!("candidate_action_refs = {}", toml_array(&candidate_refs)),
format!("public_discussion_refs = {}", toml_array(&public_refs)),
String::new(),
"[request]".to_string(),
format!("id = {}", toml_basic_string(&request_id)),
"status = \"awaiting-soul-review\"".to_string(),
"requested_owner = \"Soul\"".to_string(),
"requested_effect = \"verify-branch-local-hands-work\"".to_string(),
format!("work_order_ref = {}", toml_basic_string(&work_order_ref)),
"verification_scope = \"declared changed paths, Hands receipts, and visible repo diff\""
.to_string(),
String::new(),
"[antecedents]".to_string(),
"substrate_gate_required = true".to_string(),
"hands_intent_required = true".to_string(),
"hands_review_required = true".to_string(),
"hands_patch_required = true".to_string(),
"hands_command_required = true".to_string(),
"hands_commit_required = true".to_string(),
"work_order_required = true".to_string(),
String::new(),
"[required_receipts]".to_string(),
"hands_patch = \"epiphany.hands.patch_receipt\"".to_string(),
"hands_command = \"epiphany.hands.command_receipt\"".to_string(),
"hands_commit = \"epiphany.hands.commit_receipt\"".to_string(),
"soul_verdict = \"epiphany.soul.verification_verdict\"".to_string(),
"closure_review = \"epiphany.repo_work_closure_review.v0\"".to_string(),
"mind_review = \"epiphany.mind.gateway_review\"".to_string(),
"mind_commit = \"epiphany.mind.state_commit_receipt\"".to_string(),
String::new(),
"[checks]".to_string(),
"required = [".to_string(),
" \"declared-paths-match-commit\",".to_string(),
" \"hands-receipts-present\",".to_string(),
" \"visible-diff-supports-summary\",".to_string(),
" \"no-private-state-exposure\",".to_string(),
" \"publication-remains-gated\"".to_string(),
"]".to_string(),
"model_verdict_allowed = true".to_string(),
"failure_blocks_mind_admission = true".to_string(),
String::new(),
"[authority]".to_string(),
"branch_local_only = true".to_string(),
"soul_verdict_authorized = false".to_string(),
"state_commit_authorized = false".to_string(),
"hands_action_authorized = false".to_string(),
"rerun_authorized = false".to_string(),
"publication_authorized = false".to_string(),
"merge_authorized = false".to_string(),
"service_lifecycle_authority = false".to_string(),
"cross_body_mutation_authorized = false".to_string(),
"private_verse_rummaging = false".to_string(),
"bifrost_publication_required = true".to_string(),
String::new(),
"[verification]".to_string(),
"asks = [".to_string(),
" \"Soul verifies the verification request path changed and contains the accepted pressure summary.\",".to_string(),
" \"Soul verifies the request names required Hands evidence but does not itself grant a verdict.\",".to_string(),
" \"Soul verifies the request grants no rerun, state commit, publication, or cross-body authority.\"".to_string(),
"]".to_string(),
String::new(),
"[rollback]".to_string(),
"hints = [\"Remove the verification request if no Hands consequence is ready for Soul review.\"]"
.to_string(),
String::new(),
];
let command = powershell_set_lines_command(&target_path, &lines);
Ok(DerivedSafePlan {
safe_action_family: "repo.verification_request".to_string(),
target_path,
plan_summary: format!(
"Imagination derived a Soul verification request from accepted {} pressure.",
input.source
),
command,
commit_message: format!("Add verification request for repo work item {}", input.item),
verification_asks: vec![
"Soul verifies the repo verification request path changed and contains the accepted pressure summary.".to_string(),
"Soul verifies the request names required Hands evidence and closure checks without authorizing a verdict, rerun, state commit, publication, or cross-body mutation.".to_string(),
"Soul verifies no paths outside the declared verification request changed.".to_string(),
],
rollback_hints: vec![
"Remove the generated verification request if there is no Hands consequence ready for Soul review.".to_string(),
],
derivation: plan_derivation_receipt(input, action_family, "repo.verification_request"),
})
}
fn closure_family_assertions(
workspace: &Path,
commit_sha: &str,
@ -3962,6 +4096,100 @@ fn closure_family_assertions(
"Committed work order preserves the private-state seal.".to_string(),
);
}
"repo.verification_request" => {
push_assertion(
&mut assertions,
"verification-request-schema-present",
content.contains("schema_version = \"epiphany.repo_verification_request.v0\""),
"Committed verification request carries the schema version.".to_string(),
);
push_assertion(
&mut assertions,
"verification-request-family-present",
content.contains("safe_action_family = \"repo.verification_request\""),
"Committed verification request carries the safe action family.".to_string(),
);
push_assertion(
&mut assertions,
"verification-request-summary-present",
content.contains(&compact_summary),
"Committed verification request contains the accepted pressure summary."
.to_string(),
);
push_assertion(
&mut assertions,
"verification-request-awaits-soul-review",
content.contains("[request]")
&& content.contains("status = \"awaiting-soul-review\"")
&& content.contains("requested_owner = \"Soul\"")
&& content.contains("requested_effect = \"verify-branch-local-hands-work\"")
&& content.contains("work_order_ref = "),
"Committed verification request waits for Soul review before proof consequence."
.to_string(),
);
push_assertion(
&mut assertions,
"verification-request-antecedents-present",
content.contains("[antecedents]")
&& content.contains("substrate_gate_required = true")
&& content.contains("hands_intent_required = true")
&& content.contains("hands_review_required = true")
&& content.contains("hands_patch_required = true")
&& content.contains("hands_command_required = true")
&& content.contains("hands_commit_required = true")
&& content.contains("work_order_required = true"),
"Committed verification request requires Substrate and Hands antecedents."
.to_string(),
);
push_assertion(
&mut assertions,
"verification-request-receipt-contract",
content.contains("[required_receipts]")
&& content.contains("hands_patch = \"epiphany.hands.patch_receipt\"")
&& content.contains("hands_command = \"epiphany.hands.command_receipt\"")
&& content.contains("hands_commit = \"epiphany.hands.commit_receipt\"")
&& content.contains("soul_verdict = \"epiphany.soul.verification_verdict\"")
&& content
.contains("closure_review = \"epiphany.repo_work_closure_review.v0\"")
&& content.contains("mind_review = \"epiphany.mind.gateway_review\"")
&& content.contains("mind_commit = \"epiphany.mind.state_commit_receipt\""),
"Committed verification request names Hands/Soul/closure/Mind receipt chain."
.to_string(),
);
push_assertion(
&mut assertions,
"verification-request-checks-present",
content.contains("[checks]")
&& content.contains("\"declared-paths-match-commit\"")
&& content.contains("\"hands-receipts-present\"")
&& content.contains("\"visible-diff-supports-summary\"")
&& content.contains("\"no-private-state-exposure\"")
&& content.contains("\"publication-remains-gated\"")
&& content.contains("failure_blocks_mind_admission = true"),
"Committed verification request names the closure checks that Soul should run."
.to_string(),
);
push_assertion(
&mut assertions,
"verification-request-authority-seals",
content.contains("[authority]")
&& content.contains("soul_verdict_authorized = false")
&& content.contains("state_commit_authorized = false")
&& content.contains("hands_action_authorized = false")
&& content.contains("rerun_authorized = false")
&& content.contains("publication_authorized = false")
&& content.contains("cross_body_mutation_authorized = false")
&& content.contains("bifrost_publication_required = true"),
"Committed verification request denies verdict/state/action/rerun/publication/cross-body authority."
.to_string(),
);
push_assertion(
&mut assertions,
"verification-request-private-seal",
content.contains("private_state_exposed = false"),
"Committed verification request preserves the private-state seal.".to_string(),
);
}
_ => {
return Ok((
json!({
@ -7810,7 +8038,7 @@ fn print_usage() {
"usage: epiphany-work <persona-intake|accept|derive-plan|plan|run|adopt|execute|close|publish|sync|overview|export-proof|tick|queue-run|serve> ...\n\
persona-intake --workspace <repo> --item <id> --message <text> [--topic <topic>] [--store <local-verse.ccmp>] [--runtime-id <id>]\n\
accept --workspace <repo> --from <persona|bifrost|persona-or-bifrost> --item <id> [--summary <text>] [--topic <topic>] [--store <local-verse.ccmp>] [--runtime-id <id>] [--online-receipt <path>] [--public-discussion-ref <ref>] [--candidate-action-ref <ref>]\n\
derive-plan --workspace <repo> [--item <id>] [--accept-receipt <path>] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card|repo-manifest|repo-tool-capabilities|repo-collaboration-topic|repo-consensus-brief|repo-objective-draft|repo-adoption-request|repo-scheduling-request|repo-work-order] [--target-path <path>] [--model-ref <ref>] [--model-authored] [--action-summary <text>] [--verification-ask <text>] [--stop-condition <text>] [--escalation-reason <text>]\n\
derive-plan --workspace <repo> [--item <id>] [--accept-receipt <path>] [--action-family append-worklog|planning-note|checklist-note|section-note|repo-status-section|task-card|repo-manifest|repo-tool-capabilities|repo-collaboration-topic|repo-consensus-brief|repo-objective-draft|repo-adoption-request|repo-scheduling-request|repo-work-order|repo-verification-request] [--target-path <path>] [--model-ref <ref>] [--model-authored] [--action-summary <text>] [--verification-ask <text>] [--stop-condition <text>] [--escalation-reason <text>]\n\
plan --workspace <repo> [--item <id>] --objective <text> --plan-summary <text> --command <command> --changed-path <path> --commit-message <text> [--adoption-evidence-ref <ref>]\n\
run --workspace <repo> [--item <id>] [--accept-receipt <path>] [--runtime-store <path>] [--requested-path <path>]\n\
adopt --workspace <repo> [--item <id>] [--run-receipt <path>] [--from-plan <path>] [--plan-summary <text>] [--adoption-evidence-ref <ref>]\n\

32
notes/epiphany-repo-swarm-mvp-contract.md
View file

@ -289,16 +289,21 @@ without itself mutating the queue or scheduling work; and `--action-family
repo-work-order` writes a structured Hands work-order request under
`.epiphany/work-orders/<item>.toml`, naming the bounded branch-local
implementation intent and required Substrate/Hands/Soul/Mind receipt chain
without itself granting substrate access, shell, commit, or Hands authority. Its
without itself granting substrate access, shell, commit, or Hands authority; and
`--action-family repo-verification-request` writes a structured Soul verification
request under `.epiphany/verification-requests/<item>.toml`, naming required
Hands evidence, closure checks, and Mind admission gates without itself granting
a Soul verdict, rerun, state commit, publication, or Hands authority. Its
receipt
includes
`epiphany.repo_work_plan_derivation.v0`, mode `append-worklog`,
`planning-note`, `checklist-note`, `section-note`, `repo-status-section`, or
`task-card`, `repo-manifest`, `repo-tool-capabilities`, or
`repo-collaboration-topic`, `repo-consensus-brief`, `repo-objective-draft`, or
`repo-adoption-request`, `repo-scheduling-request`, or `repo-work-order`, a
`safeActionFamily`, and an authority seal forbidding publication, merge, service
lifecycle mutation, cross-repo mutation, and private state exposure.
`repo-adoption-request`, `repo-scheduling-request`, `repo-work-order`, or
`repo-verification-request`, a `safeActionFamily`, and an authority seal
forbidding publication, merge, service lifecycle mutation, cross-repo mutation,
and private state exposure.
These deterministic families are quarantine scaffolding on the road to
model-authored Imagination, but they are no longer operator-authored shell
details.
@ -507,6 +512,20 @@ antecedents, Substrate/Hands/Soul/Mind required receipts, bounded branch-local
scope, denied substrate access, shell command, commit, Hands action,
publication, cross-body authority, and `privateStateExposed=false`.
The next Soul boundary smoke proved verification request cargo:
`.epiphany-smoke\repo-verification-request-family-20260620-152400` ran init ->
online -> accept -> `derive-plan --action-family repo-verification-request
--model-ref repo-verification-request-family-smoke-imagination-v1
--model-authored` -> tick through run/adopt/execute/close on a fresh repo. The
plan carried `safeActionFamily=repo.verification_request`; Hands committed only
`.epiphany/verification-requests/repo-verification-request-family.toml`; Soul
passed with `pathScopeMatched=true` and `familyAssertions.status=passed`; the
committed request carried
`schema_version = "epiphany.repo_verification_request.v0"`,
`status="awaiting-soul-review"`, Hands evidence antecedents, closure checks,
Soul/Mind required receipts, denied Soul verdict, state commit, rerun, Hands
action, publication, cross-body authority, and `privateStateExposed=false`.
### Landed Work Run Gate
The sixth front door exists as native Rust:
@ -1220,7 +1239,7 @@ temptation wearing clean robes.
| Repo Body birth | `epiphany-repo init` exists and writes repo-local stores plus branch workbench intent. | Keep birth startup-only, review-gated, and branch-oriented. |
| Local Verse online | `epiphany-swarm online` seeds repo-local CultMesh, standing-faculty SoA, topology, liveness, Eve, and tool sight. | Keep private Verse sealed while exposing operator-safe repo status. |
| Persona/Bifrost intake | `epiphany-work accept` records pressure and candidate action refs without Hands authority. `epiphany-work persona-intake` now invokes the Persona bubble speech-audit path, records public discussion and candidate-action refs, then delegates to `accept`; wrapper mode `repo-persona-intake` exposes the operator mouth. | Deepen the intake-to-Imagination interpreter so richer model-authored action items can be proposed without granting Hands, publication, or durable-state authority at the mouth edge. |
| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, and `repo-work-order` / `repo.work_order`. `plan` remains manual quarantine scaffolding. | Deepen model-authored planning and further useful repo-owned configuration classes without turning model text into arbitrary shell authority. |
| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, and `repo-verification-request` / `repo.verification_request`. `plan` remains manual quarantine scaffolding. | Deepen model-authored planning and further useful repo-owned configuration classes without turning model text into arbitrary shell authority. |
| Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan` and `repo-work-service-runbook` write Idunn lifecycle receipts/artifacts for the same queue-run command without launching it. | Keep any future queue-run service launch/install behind Idunn and explicit operator authority. |
| Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. |
| Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, and writes Soul, Modeling, and Mind receipts. | Deepen model-authored closure review beyond the first structured closure-review packet while preserving deterministic local closure for simple mechanical work. |
@ -1516,6 +1535,9 @@ Required organs before MVP:
`repo-work-order` now proves Hands-facing work-order request cargo that names
the required Substrate/Hands/Soul/Mind receipt chain while granting no
substrate, shell, commit, Hands, publication, or cross-body authority.
`repo-verification-request` now proves Soul-facing verification request cargo
that names Hands evidence and closure checks while granting no verdict, rerun,
state commit, Hands, publication, or cross-body authority.
Remaining work is later model-authored action classes that can change more
useful repo-owned configuration without arbitrary shell authority.
- Closure depth: `close` now writes a structured

1
notes/fresh-workspace-handoff.md
View file

@ -127,6 +127,7 @@ remembers doctrine; the branch remembers the blade.
- 2026-06-20: `repo-adoption-request` is now live as Mind-facing adoption request cargo. `epiphany-work derive-plan --action-family repo-adoption-request` writes `.epiphany/adoption-requests/<item>.toml` with safe family `repo.adoption_request`, status `awaiting-mind-review`, allowed verdicts `adopted|refused|needs-more-consensus`, Mind review/state-commit receipt requirements, objective/consensus antecedents, and seals against objective adoption, state commit, Self scheduling, Hands action, publication, cross-body mutation, and private Verse rummaging. Soul closure assertions inspect schema, family, summary, request state, decision contract, inputs, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-adoption-request-family-20260620-145823` ran init -> online -> accept -> repo-adoption-request derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/adoption-requests/repo-adoption-request-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `awaitingMindReview=true`, `doesNotModifyState=true`, `stateCommitAuthorized=false`, `selfSchedulingAuthorized=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are richer model-authored planning depth beyond deterministic safe-family lowering, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
- 2026-06-20: `repo-scheduling-request` is now live as Self-facing scheduling request cargo. `epiphany-work derive-plan --action-family repo-scheduling-request` writes `.epiphany/scheduling-requests/<item>.toml` with safe family `repo.scheduling_request`, status `awaiting-mind-adoption`, Objective Draft/adoption request refs, Mind review/state-commit receipt requirements, a bounded one-item queue pulse contract, and seals against Self scheduling, queue mutation, Hands action, publication, cross-body mutation, and private Verse rummaging. Soul closure assertions inspect schema, family, summary, request state, queue contract, receipt contract, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-scheduling-request-family-20260620-150758` ran init -> online -> accept -> repo-scheduling-request derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/scheduling-requests/repo-scheduling-request-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `awaitingMindAdoption=true`, `queueMutationAuthorized=false`, `selfSchedulingAuthorized=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are richer model-authored planning depth beyond deterministic safe-family lowering, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
- 2026-06-20: `repo-work-order` is now live as Hands-facing work-order request cargo. `epiphany-work derive-plan --action-family repo-work-order` writes `.epiphany/work-orders/<item>.toml` with safe family `repo.work_order`, status `awaiting-hands-review`, Objective Draft/adoption/scheduling antecedents, Substrate/Hands/Soul/Mind required receipts, bounded branch-local scope, and seals against substrate access, shell command, commit, Hands action, publication, cross-body mutation, and private Verse rummaging. Soul closure assertions inspect schema, family, summary, work-order state, antecedents, receipt contract, scope bounds, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-work-order-family-20260620-151643` ran init -> online -> accept -> repo-work-order derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/work-orders/repo-work-order-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `awaitingHandsReview=true`, `substrateAccessAuthorized=false`, `shellCommandAuthorized=false`, `commitAuthorized=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are richer model-authored planning depth beyond deterministic safe-family lowering, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
- 2026-06-20: `repo-verification-request` is now live as Soul-facing verification request cargo. `epiphany-work derive-plan --action-family repo-verification-request` writes `.epiphany/verification-requests/<item>.toml` with safe family `repo.verification_request`, status `awaiting-soul-review`, Hands evidence antecedents, closure checks, Soul/Mind required receipts, and seals against Soul verdict, state commit, rerun, Hands action, publication, cross-body mutation, and private Verse rummaging. Soul closure assertions inspect schema, family, summary, request state, antecedents, receipt contract, checks, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-verification-request-family-20260620-152400` ran init -> online -> accept -> repo-verification-request derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/verification-requests/repo-verification-request-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `awaitingSoulReview=true`, `soulVerdictAuthorized=false`, `stateCommitAuthorized=false`, `rerunAuthorized=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are richer model-authored planning depth beyond deterministic safe-family lowering, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority.
- `service-execution-runbook` makes that next cut repeatable: it generates the exact elevated wrapper command sequence without mutating the service manager, continues after per-step failure to preserve more receipts, runs `service-execution-audit` in `finally`, exits nonzero if any step failed, and seals a typed runbook lifecycle receipt. Run the generated artifact only with explicit operator authority.
- `service-execution-audit` is the non-mutating acceptance proof after the elevated rite: it reports `complete` only when typed lifecycle receipts prove the runbook witness plus expected elevated chain, and otherwise reports the missing/failed sealed checks.
- `service-tick` is the non-elevated scheduler pulse proof: it writes the latest daemon scheduler receipt through durable policy ownership and local wrapper receipts.

BIN
state/ledgers.msgpack
View file

Binary file not shown.

4
state/map.yaml
View file

File diff suppressed because one or more lines are too long