Reject native coordinator monolith

notes/fresh-workspace-handoff.md

@@ -677,6 +677,14 @@ state update are produced by `epiphany-core::coordinator_service`. The old
 bridge builders were deleted rather than retained as fallbacks. Bridge receipt
 persistence/proof enforcement and final state admission still remain to move.
 
+Architecture correction: stop adding to `coordinator_service.rs`. At 1,122
+lines it has nearly recreated the 1,143-line bridge host brain inside core.
+Before moving receipt persistence or launch, split the native implementation
+into state, results, acceptance, launch, and projection organs behind a thin
+facade as specified in `notes/native-coordinator-liberation-map.md`. Preserve
+the landed authority moves, but delete the newborn monolithic shape. A smaller
+crate address does not make a giant mixed-authority file pure.
+
 Bridge identity correction from 2026-06-22: Epiphany owns swarm execution,
 repo Body work, branch-local lanes, memory, evidence, and Persona cognition.
 Bifrost owns GameCult identity, governed crossings into GitHub/Discord/Reddit

notes/native-coordinator-liberation-map.md

@@ -126,6 +126,34 @@ introduce a second authoritative store or a native/JSON-RPC mode flag.
 5. Make Codex JSON-RPC routes delegate to the same service. Remove duplicated
    route/bridge policy and mapper-only tests that no longer protect a boundary.
 
+## Native Organ Boundary
+
+The native service is a façade, not a new host brain. The first extraction
+proved the authority direction but allowed `epiphany-core/src/coordinator_service.rs`
+to grow to 1,122 lines, almost the same size as the 1,143-line bridge mutation
+service it is starving. That shape is rejected. Do not continue pouring bridge
+functions into one core file.
+
+The native body must be split before further authority moves:
+
+- coordinator state owner: CultCache thread-state load, revision gate,
+  validation, write, and changed-field report
+- coordinator result reader: runtime-link selection, runtime-spine lifecycle,
+  typed finding interpretation, and result notes
+- coordinator acceptance organ: completed-finding admission, launch-contract
+  proof checks, role/reorientation acceptance construction, receipt persistence,
+  proof enforcement, and Mind commit
+- coordinator launch organ: typed dynamic context, launch document construction,
+  runtime-spine opening/interruption, and state linkage
+- coordinator projection organ: freshness, role board, CRRC, and coordinator
+  views derived from typed inputs without persistence
+- coordinator façade: narrow composition over those organs; no policy bodies,
+  protocol DTOs, JSON, or Codex host hooks
+
+Each organ owns one invariant and must be testable against injected paths and
+typed inputs without starting Codex. A source guard should fail if the façade
+regrows policy bodies or if any native organ imports app-server protocol types.
+
 ## Invariants
 
 - There is one durable thread-state owner and one runtime lifecycle owner.

state/map.yaml

@@ -659,4 +659,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. Gjallar readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Execute the native coordinator liberation map in `notes/native-coordinator-liberation-map.md`. Move route-independent mutation, launch, result, acceptance, and view orchestration behind one Epiphany-native typed service; rewire `epiphany-mvp-coordinator` to that owner; then demote `thread/epiphany/*` JSON-RPC routes to delegating Codex compatibility wrappers. Do not introduce a parallel state owner, a native/compatibility mode flag, or new outward bridge work before this control-loop authority is cut from Codex.
+  next_action: Split the 1,122-line `epiphany-core/src/coordinator_service.rs` into narrow state, result, acceptance, launch, and projection organs behind a policy-free coordinator facade, following `notes/native-coordinator-liberation-map.md`. Preserve the landed native authority and bridge delegation, but do not move more bridge logic into the monolith. After the split is verified, resume receipt persistence/proof enforcement extraction, rewire `epiphany-mvp-coordinator`, and demote `thread/epiphany/*` JSON-RPC to compatibility wrappers.