Show tool authority gates in TUI rows

epiphany-core/src/bin/epiphany-verse-query.rs

@@ -1455,6 +1455,7 @@ fn main() -> Result<()> {
                     && row.contains("Hands")
                     && row.contains("repo-action")
                     && row.contains("epiphany.cluster.hands.tool.repo-action")
+                    && row.contains("authority=hands")
                     && row.contains("allAgents=true")
                     && row.contains("receipt=true")
                     && row.contains("private=false")
@@ -3580,8 +3581,13 @@ fn daemon_tool_directory_tui_row(row: &DaemonToolDirectoryRow) -> String {
         "private=false"
     };
     format!(
-        "{compact_status} | {} | {} | {} | {} | {} | {availability} | {receipt} | {private}",
-        row.host_display_name, row.tool_name, row.operation, row.capability_id, row.eve_surface_id
+        "{compact_status} | {} | {} | {} | {} | {} | authority={} | {availability} | {receipt} | {private}",
+        row.host_display_name,
+        row.tool_name,
+        row.operation,
+        row.capability_id,
+        row.eve_surface_id,
+        row.authority_gate
     )
 }
 

notes/fresh-workspace-handoff.md

@@ -62,6 +62,7 @@ remembers doctrine; the branch remembers the blade.
 - Public doctrine source `https://gamecult.org/Blog/purge-the-heretek-from-our-daemonic-swarm` sharpens the current swarm audit: Odin sees but must not own, Gjallar-like surface publishers must produce their own witnesses, Idunn-like ledgers must advance instead of freezing old wounds, and Bifrost is the ledger gate for cross-repo purification receipts rather than transcript archaeology.
 - `tools/epiphany_local_run.ps1` now stamps local run ids as `local-YYYYMMDD-HHMMSS-fff-<guid8>` instead of second-resolution ids, so concurrent operator rites get separate artifact roots and run receipts. Verified: `collaboration-feedback` and `bifrost-publication` launched in parallel in the same second and completed as `local-20260618-064814-171-dc0b8dd9` and `local-20260618-064814-149-2946d675`.
 - `epiphany-verse-query tool-directory` and `tools/epiphany_local_run.ps1 -Mode tool-directory` are the compact read-only daemon tool directory. The report reads the same local Verse capability records used by `invoke-tool`, annotates them with host daemon readiness, and returns TUI rows plus direct `invocationCommand` and wrapper `wrapperInvocationCommand=tools/epiphany_local_run.ps1 -Mode tool-invoke -ToolCapabilityId <capability> -ToolRequestingAgentId <agent> -ToolRequestingClusterId <cluster>`. TUI rows expose the global-tool contract directly, e.g. `READY | Hands | repo-action | submitHandsActionIntent | epiphany.cluster.hands.tool.repo-action | eve://epiphany/hands | allAgents=true | receipt=true | private=false`. Verified: fresh proof store returned sixteen globally available, receipt-gated, private-state-sealed tools with `hostReadyCount=16`, `hostAttentionCount=0`; smoke source-proves the compact Hands contract row and command hints; wrapper proof `local-20260618-181658-927-d351e9bb` printed all sixteen rows in the one-line `toolRows` summary, including Hands `repo-action` and Soul `verify`, with `privateStateExposed=False`.
+- 2026-06-18: Tool-directory TUI rows now render the advertised capability `authorityGate` as `authority=<gate>`, matching the JSON surface and invocation receipt row. Source smoke guards the Hands `repo-action` row with `authority=hands`; live wrapper proof `local-20260618-223032-345-74d9bdb2` printed all sixteen tool rows with authority gates, including `authority=imagination.consensus_discovery` for Eve connection tools, `authority=hands` for Hands repo-action, `authority=soul` for Soul verify, and `authority=none` for read-only status.
 - `epiphany-verse-query swarm-overview` and `tools/epiphany_local_run.ps1 -Mode swarm-overview` are the one-command compact global-agent sight rite. It composes narrow cluster topology, liveness, Odin/Eve surface, daemon tool, restart-policy coverage, receipt-directory service-lifecycle attention, and the shared core service-execution audit report; returns seven agents/daemons, seven clusters, seven private Verse ids, seven Eve surfaces, one public Persona discussion surface, sixteen globally invokable receipt-gated tools, command hints for topology/liveness/surfaces/tools/receipts/poke/connect/invoke/Bifrost-ledger/service-policy-directory/service-execution-audit, sealed `toolHostAttentionRows`/TUI rows for blocked daemon-hosted capabilities, sealed `serviceLifecycleAttentionRows`/TUI rows copied from the receipt directory, explicit `serviceLifecycleRecommended*` fields for service-manager follow-up, ordered `swarmActionRows`/TUI rows with authority/effect/wrapper-command/mutation/elevation metadata plus sealed `operatorArtifactRef`, `operatorArtifactStatus`, `operatorArtifactSha256`, `operatorArtifactExecutionCommand`, `operatorAftercareCommand`, and `completionAuditWrapper*` pointers for operator-runbook rows, `serviceExecutionFailedCheckRows`/TUI rows naming the failed sealed execution checks, and `privateStateExposed=false`; and avoids full local Verse serialization. Live `epiphany-verse-query` defaults to `.epiphany-run\cultmesh\local-verse.ccmp`, matching the wrapper and daemon supervisor; bare `epiphany-verse-query smoke` now uses disposable `.epiphany-smoke\verse-query-default\local-verse.ccmp` unless `--store` is explicit. Verified: live overview artifact `local-20260618-174345-036-0ab0cdc2` returned `status=attention`, `liveness=ready`, `recovery=attention`, `agents=7`, `clusters=7`, `privateVerses=7`, `surfaces=7`, `tools=16`, `nonReady=0`, `toolHostAttentionCount=0`, `policyMissing=0`, `recommended=cluster-service-execution-audit`, `serviceRecommended=cluster-service-execution-audit`, `swarmActionCount=2`, readback row `40:service-lifecycle:cluster-service-execution-audit:attention:command=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit:mutates=False:elevated=False:artifactStatus=none:sha256=none:audit=none:aftercare=none:artifact=none`, elevated row `50:service-execution-authority:operator-elevated-runbook:operator-authority-required:command=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-runbook # refreshes the sealed runbook; execute the generated artifact only with explicit elevated operator authority:mutates=True:elevated=True:artifactStatus=present:sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0:audit=cluster-service-execution-audit:aftercare=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit:artifact=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-161632-376-436227d8\epiphany-cluster-daemon-services-execution-runbook.ps1`, JSON `operatorArtifactExecutionCommand=Start-Process PowerShell -Verb RunAs -Wait -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-File','...epiphany-cluster-daemon-services-execution-runbook.ps1')`, lifecycle routes `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit` and `epiphany-daemon-supervisor-service::windows-service-execution-audit`, and `serviceExecutionFailedChecks=cluster-windows-service-execution-readiness=not-elevated; cluster-windows-service-install=planned; cluster-windows-service-start=execution-refused-not-elevated; cluster-windows-service-execution-audit=incomplete; cluster-windows-service-stop=execution-refused-not-elevated` with `privateStateExposed=False`. Fresh source smoke passes in bare default-store mode, including present-artifact SHA-256, missing-artifact demotion, failed-check anatomy, and compact action commands.
 - `epiphany-verse-query swarm-triage` and `tools/epiphany_local_run.ps1 -Mode swarm-triage` are the compact "see the swarm, then poke only if liveness attention exists" rite. It reads the compact overview first, writes no poke receipt when liveness is ready, routes non-ready daemons through the existing brake-aware `poke-down-daemons` receipt writer, carries overview's sealed service lifecycle attention rows, failed service-execution check rows, explicit service lifecycle recommendation, and ordered/effect-classified action queue with sealed runbook artifact and audit pointers without treating service-manager wounds as daemon-poke authority, and carries sealed `toolHostAttentionRows`/TUI rows so agents can see which advertised tools are blocked by a sick host daemon. Verified: live wrapper artifact `local-20260618-150015-844-aba20563` produced `status=noop`, `overview=attention`, `liveness=ready`, `recovery=attention`, `clusters=7`, `privateVerses=7`, `recommended=cluster-service-execution-audit`, `serviceRecommended=cluster-service-execution-audit`, service readback row `artifactStatus=none`, elevated service authority row `artifactStatus=present`, `completionAuditWrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`, artifact `E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-132257-139-26213a29\epiphany-cluster-daemon-services-execution-runbook.ps1`, `attention=none`, `serviceLifecycleAttention=cluster-service-lifecycle:epiphany-cluster-daemon-services::cluster-windows-service-execution-audit:incomplete; service-lifecycle:epiphany-daemon-supervisor-service::windows-service-execution-audit:incomplete`, `serviceLifecycleAttentionCount=2`, `poked=0`, and `privateStateExposed=False`; degraded Hands proof routes through the topology-aware poke path and exposes blocked Hands tool-host rows plus liveness/tool-host action rows; source smoke `verse-query-completion-audit-row-smoke` proves the degraded single-poke triage path without a post-receipt full-context readback.
 - `swarmActionTuiRows` now carry the same audit and artifact-provenance visibility as JSON rows. Fresh source smoke `verse-query-action-tui-audit-smoke` and live artifact `local-20260618-164403-238-dba797ce` prove the compact rows include `artifact=present | sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0 | audit=cluster-service-execution-audit` on the `service-execution-authority` row and `artifact=none | sha256=none | audit=none` on the readback row, while service mutation still requires explicit elevated operator authority and private state remains sealed.

state/map.yaml

@@ -616,7 +616,7 @@ current_status:
   - `epiphany-verse-query restart-policy-directory` and `tools/epiphany_local_run.ps1 -Mode service-policy-directory` provide the compact scheduler coverage sight organ. It reads daemon topology/status plus durable `epiphany.cultmesh.daemon_restart_policy.v0` rows through a narrow CultMesh restart-policy directory loader, reports each daemon as `ENABLED`, `DISABLED`, or `MISSING`, treats disabled and missing policies as recovery attention, returns covered/enabled/disabled/missing/attention counts, and publishes explicit policy-write plus scheduler-tick follow-up commands without creating or mutating policies. Compact TUI rows now expose cooldown, reconcile interval, heartbeat stale threshold, failure count, last result, `followUp=<command>`, and `private=false`; wrapper proof `local-20260618-213147-804-7dec3346` prints the Rust-owned `tuiRows` directly for all seven faculties as `ENABLED` with `last=ready`, `cooldown=30s`, `reconcile=60s`, `stale=300s`, `followUp=tools/epiphany_local_run.ps1 -Mode service-tick`, and `private=false`, instead of rebuilding policy text in PowerShell. Direct and wrapper proof now report seven daemons, seven covered policies, seven enabled policies, zero disabled, zero missing, zero attention, `status=ok`, and `privateStateExposed=false`. This is a real daemon heartbeat body with non-mutating per-organ launch and install artifacts, but not yet executed installed per-organ OS services.
   - `https://gamecult.org/Blog/purge-the-heretek-from-our-daemonic-swarm` is a public doctrine receipt for the Perfect Machine audit pressure: organs must not borrow each other's crowns, witnesses need owning mouths, surfaces reflect rather than rule, and cross-repo purification needs Bifrost-shaped ledger evidence instead of relying on recoverable transcripts or commit trails alone.
   - `tools/epiphany_local_run.ps1` now uses collision-resistant local run ids (`local-YYYYMMDD-HHMMSS-fff-<guid8>`) for artifact roots and operator run receipts. Same-second parallel compact wrapper proofs for `collaboration-feedback` and `bifrost-publication` produce separate artifact drawers and both complete, so operator rites no longer collide on second-resolution run ids.
-  - `epiphany-verse-query tool-directory` and `tools/epiphany_local_run.ps1 -Mode tool-directory` provide the compact daemon tool sight organ over the same local Verse capability records used by `invoke-tool`. It returns sixteen globally available daemon-hosted capabilities, host readiness counts, direct `invocationCommand`, wrapper `wrapperInvocationCommand=tools/epiphany_local_run.ps1 -Mode tool-invoke -ToolCapabilityId <capability> -ToolRequestingAgentId <agent> -ToolRequestingClusterId <cluster>`, and the invariants `availableToAllAgents=true`, `requiresReceipt=true`, `privateStateExposed=false`. Agent-friendly TUI rows now carry the same contract bits, e.g. `READY | Hands | repo-action | submitHandsActionIntent | epiphany.cluster.hands.tool.repo-action | eve://epiphany/hands | allAgents=true | receipt=true | private=false`; wrapper proof `local-20260618-181658-927-d351e9bb` now prints all sixteen rows in the one-line `toolRows` summary, including Hands `repo-action` and Soul `verify`. `invoke-tool` runs through a smaller extracted command handler and emits compact invocation rows with requester/host display names, requesting/host private Verses and Eve surfaces, host daemon id, tool operation, capability id, intent id, receipt id/status, authority gate, `allAgents=true`, `receiptRequired=true`, and `private=false`; live wrapper proof `local-20260618-181426-520-e3b051b8` routed Persona to Hands `repo-action` and printed the full compact row.
+  - `epiphany-verse-query tool-directory` and `tools/epiphany_local_run.ps1 -Mode tool-directory` provide the compact daemon tool sight organ over the same local Verse capability records used by `invoke-tool`. It returns sixteen globally available daemon-hosted capabilities, host readiness counts, direct `invocationCommand`, wrapper `wrapperInvocationCommand=tools/epiphany_local_run.ps1 -Mode tool-invoke -ToolCapabilityId <capability> -ToolRequestingAgentId <agent> -ToolRequestingClusterId <cluster>`, and the invariants `availableToAllAgents=true`, `requiresReceipt=true`, `privateStateExposed=false`. Agent-friendly TUI rows now carry the same contract bits and authority gate, e.g. `READY | Hands | repo-action | submitHandsActionIntent | epiphany.cluster.hands.tool.repo-action | eve://epiphany/hands | authority=hands | allAgents=true | receipt=true | private=false`; wrapper proof `local-20260618-223032-345-74d9bdb2` prints all sixteen rows in the one-line `toolRows` summary with authority gates, including `authority=imagination.consensus_discovery` for Eve connection tools, `authority=hands` for Hands `repo-action`, `authority=soul` for Soul `verify`, and `authority=none` for read-only status. `invoke-tool` runs through a smaller extracted command handler and emits compact invocation rows with requester/host display names, requesting/host private Verses and Eve surfaces, host daemon id, tool operation, capability id, intent id, receipt id/status, authority gate, `allAgents=true`, `receiptRequired=true`, and `private=false`; live wrapper proof `local-20260618-181426-520-e3b051b8` routed Persona to Hands `repo-action` and printed the full compact row.
   - `epiphany-verse-query cluster-topology` and `tools/epiphany_local_run.ps1 -Mode cluster-topology` provide the compact cluster/body/private-Verse/daemon sight organ over local Verse topology rows through a narrow CultMesh loader. The report returns seven clusters, seven private Verse ids, seven daemon ids, one public Persona discussion cluster, agent-friendly TUI rows such as `PUBLIC | Persona | epiphany.cluster.persona.private | repo:E:/Projects/EpiphanyAgent | epiphany-daemon-persona | eve://epiphany/persona`, and `privateStateExposed=false`; `epiphany-verse-query smoke` source-proves the compact topology invariants, and wrapper proof `local-20260618-182058-438-0e016e8d` now prints all seven standing-faculty rows in the one-line `topologyRows` summary.
   - `epiphany-verse-query swarm-overview` and `tools/epiphany_local_run.ps1 -Mode swarm-overview` provide the one-command compact global-agent sight rite. It composes narrow cluster topology, liveness, Odin/Eve surface, daemon tool, restart-policy coverage, receipt-directory service-lifecycle attention, and the shared core service-execution audit report without full local Verse serialization, returning seven agents/daemons, seven clusters, seven private Verse ids, seven Eve surfaces, one public Persona discussion surface, sixteen globally invokable receipt-gated tools, command hints for topology/liveness/surfaces/tools/receipts/poke/connect/invoke/Bifrost-ledger/restart-policy coverage, wrapper command hints for overview/receipts/poke/connect/tool-invoke/Bifrost-ledger/service-policy-directory/service-execution-audit, sealed `toolHostAttentionRows`/TUI rows for blocked daemon-hosted capabilities, sealed `serviceLifecycleAttentionRows`/TUI rows copied from the receipt directory, `serviceExecutionFailedCheckRows`/TUI rows naming failed sealed execution checks, explicit `serviceLifecycleRecommended*` fields so service-manager follow-up remains visible even when global `recommendedWrapperMode` is occupied by liveness or policy, and ordered `swarmActionRows`/TUI rows with authority gates, effect class, wrapper command, mutation flag, elevation flag, sealed `operatorArtifactRef`, `operatorArtifactStatus`, `operatorArtifactSha256`, `operatorArtifactExecutionCommand`, `operatorAftercareCommand`, and `completionAuditWrapper*` for operator-runbook rows. Current live overview `local-20260618-174345-036-0ab0cdc2` returns `status=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `recommendedWrapperMode=cluster-service-execution-audit`, `serviceLifecycleRecommendedWrapperMode=cluster-service-execution-audit`, `toolHostAttentionCount=0`, `serviceLifecycleAttentionCount=2`, `swarmActionCount=2`, a non-mutating/non-elevated `priority=40` service lifecycle readback row with `command=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`, and a mutating/elevated `priority=50`, `family=service-execution-authority`, `status=operator-authority-required`, `effectClass=elevated-service-control`, `wrapperMode=operator-elevated-runbook`, `wrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-runbook # refreshes the sealed runbook; execute the generated artifact only with explicit elevated operator authority`, `authorityGate=operator.elevated_windows_service_control`, `operatorArtifactStatus=present`, `operatorArtifactSha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`, `operatorArtifactRef=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-161632-376-436227d8\epiphany-cluster-daemon-services-execution-runbook.ps1`, `operatorArtifactExecutionCommand=Start-Process PowerShell -Verb RunAs -Wait -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-File','...epiphany-cluster-daemon-services-execution-runbook.ps1')`, `operatorAftercareCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`, `completionAuditWrapperMode=cluster-service-execution-audit`, `completionAuditWrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`, `privateStateExposed=false`, and compact `serviceExecutionFailedChecks=cluster-windows-service-execution-readiness=not-elevated; cluster-windows-service-install=planned; cluster-windows-service-start=execution-refused-not-elevated; cluster-windows-service-execution-audit=incomplete; cluster-windows-service-stop=execution-refused-not-elevated`. If that local artifact is missing, source smoke proves the same row is demoted to `status=runbook-artifact-missing`, `wrapperMode=cluster-service-execution-runbook`, `effectClass=service-lifecycle-runbook-regeneration`, `operatorArtifactSha256=none`, `operatorArtifactExecutionCommand=none`, `operatorAftercareCommand=none`, `mutatesState=false`, and `requiresElevatedAuthority=false` instead of pretending elevated service authority is actionable. Degraded daemon overview still routes global recommendation to `swarm-poke-down` first while independent action rows preserve the liveness/tool-host duties; liveness action rows are explicitly mutating typed lifecycle pokes but do not require elevation, while service execution authority rows make the operator grant boundary visible. `epiphany-verse-query` defaults to the shared `.epiphany-run\cultmesh\local-verse.ccmp` store for live query/readback, while bare `epiphany-verse-query smoke` now uses a disposable `.epiphany-smoke\verse-query-default\local-verse.ccmp` fixture unless an explicit `--store` is provided.
   - `epiphany-verse-query swarm-triage` and `tools/epiphany_local_run.ps1 -Mode swarm-triage` compose the compact swarm overview with the existing brake-aware daemon poke receipt writer. Triage pokes only daemon liveness attention; service-manager lifecycle wounds are reflected from overview as sealed `serviceLifecycleAttentionRows`/TUI rows, `serviceExecutionFailedCheckRows`/TUI rows, explicit `serviceLifecycleRecommended*` fields, and ordered `swarmActionRows`, but do not cause daemon poke receipts, while blocked daemon-hosted tools ride as sealed `toolHostAttentionRows`/TUI rows so agents can see which advertised capabilities are unavailable because their host body is sick. Current live triage `local-20260618-150015-844-aba20563` returns `status=noop`, `overviewStatus=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `clusterCount=7`, `privateVerseCount=7`, `pokedDaemonCount=0`, `recommendedWrapperMode=cluster-service-execution-audit`, `serviceLifecycleRecommendedWrapperMode=cluster-service-execution-audit`, `swarmActionCount=2`, the same sealed service readback plus operator-elevated runbook rows, including `operatorArtifactStatus=present`, `operatorArtifactRef=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-132257-139-26213a29\epiphany-cluster-daemon-services-execution-runbook.ps1`, and `completionAuditWrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit` on the elevated row, empty daemon/tool-host attention arrays, `serviceLifecycleAttentionCount=2`, routes `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit` and `epiphany-daemon-supervisor-service::windows-service-execution-audit`, direct and wrapper command hints including `wrapperInvokeTool` and `wrapperBifrostLedger=tools/epiphany_local_run.ps1 -Mode bifrost-ledger`, and `privateStateExposed=false`; degraded Hands proof returns `status=ok`, `overviewStatus=attention`, topology and daemon TUI rows, blocked Hands-hosted tool rows, one sealed topology-aware poke receipt for `epiphany-daemon-hands` with `bodyDomain=repo:E:/Projects/EpiphanyAgent`, `privateVerseId=epiphany.cluster.hands.private`, `eveSurfaceId=eve://epiphany/hands`, `observedStatus=degraded`, `attentionDaemonIds=[epiphany-daemon-hands]`, `attentionToolHostDaemonIds=[epiphany-daemon-hands]`, and liveness/tool-host action rows with no private-state exposure. Source smoke `verse-query-service-execution-failed-checks-clean` proves a physical synthetic written runbook plus incomplete service audit receipts expose both service lifecycle readback and failed-check anatomy with no Windows service mutation.