GameCult/Epiphany
Archived
Watch
9
0
Fork
You've already forked Epiphany
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record signed provider health boundary

Browse source
This commit is contained in:
Meta Vens 2026-07-19 19:39:00 +01:00
commit f47506abdc
3 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
notes/fresh-workspace-handoff.md
View file

@ -48,6 +48,21 @@ receipts. Do not test Wake while the deployment brake is the intended owner of
sleep. Conversation remains feedback pressure; it does not adopt Mind state or
grant Hands, release, or deployment authority.
Do not expand Discord Status with the current Idunn/Bifrost health packet. The
provider audit found that generic `idunn.daemon_health.v1` is unsigned: Idunn
checks typed shape, daemon id, contract, self-declared publication source and
transport, and freshness, but no pinned publisher identity or signature. Idunn
also exposes no authenticated outward projection for Epiphany to consume. The
deployed Odin lineage is the clean `E:\Projects\Odin-yggdrasil-idunn` worktree,
not the unrelated active Odin branch. Odin commit `cc80cd4` adds the generic
`idunn.signed_daemon_health.v1` and root-owned
`idunn.daemon_health_trust_binding.v1` contract foundations plus
`docs/idunn-signed-daemon-health-authority.md`. Next, wire generic Idunn
verification and monotonic admission, migrate Epiphany and Bifrost publishers,
publish an Idunn-signed outward projection, and only then let Discord Status
compose it. Unsigned legacy health may remain diagnostic during migration but
must lose managed-health authority before this rebuild is complete.
### Unattended continuity aftercare
The Ygg body has no live Starfire reference. Epiphany, operator, heartbeat,

BIN
state/ledgers.msgpack
View file

Binary file not shown.

2
state/map.yaml
View file

@ -18,7 +18,7 @@ experiment:
sleep_brake_semantics: "An engaged swarm brake is sleep mode, not daemon death. Resident services may remain supervised, publish liveness/health, refresh leases, and expose read-only operator sight. The brake blocks cognition launches, scheduling that creates cognitive work, Hands consequences, publication, and deployment action."
swarm_brake_authority: "The only physical brake truth is the runtime-scoped CultMesh key epiphany-local/swarm-brake. Observation uses swarm-brake-status and is byte-pure; mutation uses swarm-brake-set and requires explicit engaged/released status, canonical document id epiphany/swarm-brake, actor, and reason. Legacy swarm-brake/brake commands refuse. The stable owner is epiphany.swarm-brake; command actors are provenance, not owners. Release refuses absent or foreign/legacy identity. Idunn alone may adopt an already-engaged legacy head into the canonical identity during deployment, without any released interval. Discord Sleep preserves foreign brakes; Wake releases only the exact canonical owner. Resident readiness reads the same key, and deployment admission requires brakeEngaged=true before service restart."
discord_mind_review_owner: "The typed Discord operator core routes Reviews/Review into the canonical frontier-plan Mind owner, not a parallel queue. Reviews exposes only bounded request/candidate/model/frontier identities. Exact Adopt/Refuse/Hold revalidates immutable Imagination and current RepoModel bindings; Hold/Refuse are terminal inert receipts; Adopt alone uses the existing RepoModel CAS and creates no Hands authority, Substrate grant, Persona speech, Bifrost release, or Idunn deployment. Decision provenance is typed as Mind worker or authenticated operator command/admission/packet/actor; downstream RepoModel provenance is typed as worker result or frontier-plan decision, with Option absence instead of empty sentinels. Replay time derives from immutable issuance, machine faults are not terminal refusals, CultCache v0 decision tuples decode explicitly, and signed v0 deliveries may drain only the original four commands. The v1 Epiphany/Bifrost/VoidBot chain is deployed on Yggdrasil behind an engaged canonical brake; the remaining proof is operator-safe Discord interaction, not schema or deployment work."
discord_status_truth: "The deployed Status command reads a narrow coordinator snapshot and the independently owned swarm brake. It namespaces the coordinator fields as coordinator-snapshot/<status>, coordinator-state/<status>, and coordinator-action/<action>; VoidBot labels them Coordinator snapshot and Coordinator action. It explicitly refuses to call them deployment/provider readiness and does not authenticate or compose packaged-release, resident-readiness, Idunn, or Bifrost health. The final Discord status product contract requires owner-authenticated typed projections from each named provider; PID sight, generic ready strings, and caller booleans are forbidden substitutes."
discord_status_truth: "The deployed Status command reads a narrow coordinator snapshot and the independently owned swarm brake. It namespaces the coordinator fields as coordinator-snapshot/<status>, coordinator-state/<status>, and coordinator-action/<action>; VoidBot labels them Coordinator snapshot and Coordinator action. It explicitly refuses to call them deployment/provider readiness and does not authenticate or compose packaged-release, resident-readiness, Idunn, or Bifrost health. Audit found no usable Idunn/Bifrost ingress: generic idunn.daemon_health.v1 is typed but unsigned, trusts self-declared publication source/transport, and has no authenticated Idunn outward projection. Odin branch codex/ygg-organizational-idunn now defines generic signed-daemon-health and root trust-binding foundations plus the authority/deletion map at cc80cd4; ingress, publisher migration, outward Idunn signing, and Status consumption remain open. PID sight, generic ready strings, caller booleans, and unsigned typed health are forbidden substitutes."
status: active
phase: phase_6_reflection_boundary
premise: >