From f387a2ca7e7a38c3c7a4d444fed6f917110bc66f Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sat, 11 Jul 2026 19:17:58 +0100 Subject: [PATCH] Reject native coordinator monolith --- notes/fresh-workspace-handoff.md | 8 ++++++ notes/native-coordinator-liberation-map.md | 28 +++++++++++++++++++++ state/ledgers.msgpack | Bin 399738 -> 400074 bytes state/map.yaml | 2 +- 4 files changed, 37 insertions(+), 1 deletion(-) diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 99da4e49..b420a819 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -677,6 +677,14 @@ state update are produced by `epiphany-core::coordinator_service`. The old bridge builders were deleted rather than retained as fallbacks. Bridge receipt persistence/proof enforcement and final state admission still remain to move. +Architecture correction: stop adding to `coordinator_service.rs`. At 1,122 +lines it has nearly recreated the 1,143-line bridge host brain inside core. +Before moving receipt persistence or launch, split the native implementation +into state, results, acceptance, launch, and projection organs behind a thin +facade as specified in `notes/native-coordinator-liberation-map.md`. Preserve +the landed authority moves, but delete the newborn monolithic shape. A smaller +crate address does not make a giant mixed-authority file pure. + Bridge identity correction from 2026-06-22: Epiphany owns swarm execution, repo Body work, branch-local lanes, memory, evidence, and Persona cognition. Bifrost owns GameCult identity, governed crossings into GitHub/Discord/Reddit diff --git a/notes/native-coordinator-liberation-map.md b/notes/native-coordinator-liberation-map.md index 7cba7c04..56fb54f9 100644 --- a/notes/native-coordinator-liberation-map.md +++ b/notes/native-coordinator-liberation-map.md @@ -126,6 +126,34 @@ introduce a second authoritative store or a native/JSON-RPC mode flag. 5. Make Codex JSON-RPC routes delegate to the same service. Remove duplicated route/bridge policy and mapper-only tests that no longer protect a boundary. +## Native Organ Boundary + +The native service is a façade, not a new host brain. The first extraction +proved the authority direction but allowed `epiphany-core/src/coordinator_service.rs` +to grow to 1,122 lines, almost the same size as the 1,143-line bridge mutation +service it is starving. That shape is rejected. Do not continue pouring bridge +functions into one core file. + +The native body must be split before further authority moves: + +- coordinator state owner: CultCache thread-state load, revision gate, + validation, write, and changed-field report +- coordinator result reader: runtime-link selection, runtime-spine lifecycle, + typed finding interpretation, and result notes +- coordinator acceptance organ: completed-finding admission, launch-contract + proof checks, role/reorientation acceptance construction, receipt persistence, + proof enforcement, and Mind commit +- coordinator launch organ: typed dynamic context, launch document construction, + runtime-spine opening/interruption, and state linkage +- coordinator projection organ: freshness, role board, CRRC, and coordinator + views derived from typed inputs without persistence +- coordinator façade: narrow composition over those organs; no policy bodies, + protocol DTOs, JSON, or Codex host hooks + +Each organ owns one invariant and must be testable against injected paths and +typed inputs without starting Codex. A source guard should fail if the façade +regrows policy bodies or if any native organ imports app-server protocol types. + ## Invariants - There is one durable thread-state owner and one runtime lifecycle owner. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index dcd98cc5e8f5b32e68364d0008284df78d771a8a..5c468c4fa12b8314dca3a2437e887ed064b97ae8 100644 GIT binary patch delta 351 zcmX9(Jxat-5H``>!b(t<)oQ>tE@V{}^bR(5HZpmcBv0bJIPYaws}(FffUF)t?8G0u zfrUq~_Yzi4u=p65`R4oieHnhe51%)q)ycvB1o6Cw7 zMekz~_kRWt*Mt6AFYTW0nsj6R$v6=*f%5NY>j;CL(tQ>W=0KN0&;;ukX6T_5H?v%V zaZYl}7@VAXlBqQ`5)YPx1B5h5$K##aGQqiHSKCk}z=Tp?flwnZZ%wBXD(bjUgH*x)M%G)qspDs|VBwmZ3m{Iq9-+LfVakD`{GH!03%G5rUi4llFG&2yh05R+KsZ4B7 F#Q+c;5vTwF diff --git a/state/map.yaml b/state/map.yaml index 09866a1b..3a420a7e 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -659,4 +659,4 @@ current_status: - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass. - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure. last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. Gjallar readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync. - next_action: Execute the native coordinator liberation map in `notes/native-coordinator-liberation-map.md`. Move route-independent mutation, launch, result, acceptance, and view orchestration behind one Epiphany-native typed service; rewire `epiphany-mvp-coordinator` to that owner; then demote `thread/epiphany/*` JSON-RPC routes to delegating Codex compatibility wrappers. Do not introduce a parallel state owner, a native/compatibility mode flag, or new outward bridge work before this control-loop authority is cut from Codex. + next_action: Split the 1,122-line `epiphany-core/src/coordinator_service.rs` into narrow state, result, acceptance, launch, and projection organs behind a policy-free coordinator facade, following `notes/native-coordinator-liberation-map.md`. Preserve the landed native authority and bridge delegation, but do not move more bridge logic into the monolith. After the split is verified, resume receipt persistence/proof enforcement extraction, rewire `epiphany-mvp-coordinator`, and demote `thread/epiphany/*` JSON-RPC to compatibility wrappers.