Record provider transport boundary cut
This commit is contained in:
Meta Vens
parent
a6cf9383d8
commit
f532c3ad00
5 changed files with 62 additions and 10 deletions
|
|
@ -646,6 +646,18 @@ Codex-derived code remains only where an OpenAI provider needs its earned
|
|||
authentication or transport. Neither owns Epiphany Mind, scheduler, route, or
|
||||
interface authority.
|
||||
|
||||
Exact `a6cf9383` makes that boundary physical in the package graph. The pure
|
||||
`epiphany-openai-runtime` library opens the exact model execution, derives the
|
||||
provider request, normalizes typed provider events, emits governed tool
|
||||
intents, and records terminal physiology/audit without depending on a Codex
|
||||
crate. One shared source module at the release-bundle edge owns concrete
|
||||
Codex/OpenRouter authentication, credential reading, and network calls for the
|
||||
model and Persona entrypoints. Persona keeps its three-stage family executor;
|
||||
the service owns its concrete runner. Workers have one governed tool-capable
|
||||
route, not a tool route plus a parallel no-tools opinion. The remaining broad
|
||||
`codex-login` graph is therefore isolated supply-chain liability, not hidden
|
||||
runtime-library anatomy.
|
||||
|
||||
## Canonical authority map
|
||||
|
||||
| Owner | Inputs | Outputs | Invariant |
|
||||
|
|
@ -657,7 +669,7 @@ interface authority.
|
|||
| `current_work.rs` | keyed Mind view and exact runtime request/job/result/decision families | pure family scheduling and continuation projections | Events, timestamps, role lanes, and thread provenance cannot create or suppress work. |
|
||||
| coordinator policy/status | keyed Mind presence, exact current work, and the accepted continuity decision | one action/reason pair plus operator-readable role lanes | Coordinator presence is derived; no mutable coordinator head, pressure tableau, or duplicate policy wrapper exists. |
|
||||
| runtime worker attempt owner | immutable launch, exact process claim, typed result, job result, archival evidence | one terminal attempt authority | Scheduling, process liveness, and semantic admission remain distinct authorities. |
|
||||
| model-provider boundary | sealed native model request plus explicit provider configuration and injected credential | exact internally derived provider request and transport result | Provider selection cannot author a second request truth or admit Mind state. |
|
||||
| model-provider boundary | sealed native model request plus explicit provider configuration and injected credential | exact internally derived provider request and transport result | The pure runtime owns request/event admission; only release entrypoints own auth/network transport. Provider selection cannot author a second request truth or admit Mind state. |
|
||||
| OpenAI Responses schema projector | full native typed output schema | one provider-legal strict generation schema | Provider formatting preserves useful supported constraints but never replaces native decoding or Mind admission. |
|
||||
| model-pass terminal owner | sealed reasoning basis/context and typed failure class | exact transport closure plus `EpiphanyModelPassFailure` and terminal session/job result in one batch CAS | The caller cannot nominate a job/session; the context-derived binding closes role, reorient, and Persona failures without granting generic transport results decision authority. |
|
||||
| Substrate Gate | exact worker/job authority and requested operation | scoped grant or refusal | Access permission does not admit Mind state. |
|
||||
|
|
|
|||
|
|
@ -224,7 +224,7 @@ Delete or demote:
|
|||
|
||||
Keep the five-day shakedown, Ox17 deployment, and Model Atlas operational Gate
|
||||
1 paused. Continue the source-subtraction and test-authority audit from exact
|
||||
`ce6bff12`. The current sequence has deleted the semantic-memory/workspace-coverage
|
||||
`a6cf9383`. The current sequence has deleted the semantic-memory/workspace-coverage
|
||||
projection system, its local daemon supervisor, and the surviving generic
|
||||
RepoModel profile, impossible lifecycle, producerless receipt/summary, and
|
||||
decorative scoring axes. Modeling consumes typed Body and keyed RepoModel state
|
||||
|
|
@ -235,6 +235,14 @@ Eve/CultMesh capabilities, and a future Rider daemon will own Rider. Do not
|
|||
admit a fresh package until the remaining production surfaces and tests have
|
||||
earned their authority under the same audit.
|
||||
|
||||
The immediate comparison is now explicit. The release-edge `codex-login`
|
||||
dependency still imports configuration, app-server protocol, telemetry,
|
||||
Starlark, image, and clipboard anatomy; a pure runtime consequence test still
|
||||
costs 1.869 GiB because `epiphany-core` remains broad. Audit those as owned
|
||||
behavior, not as cleanup chores. A narrower OpenAI auth/refresh boundary must
|
||||
preserve exact provider capability and refresh-token authority; a core split
|
||||
must expose an existing semantic owner rather than invent a package taxonomy.
|
||||
|
||||
Model Atlas has component proofs but no live inter-swarm collaboration run.
|
||||
Preserve its publication, trust, transport, projection, Soul verification, Self
|
||||
admission, wake, brake, and Eve path until Gate 1 exercises the complete crossing.
|
||||
|
|
@ -451,6 +459,18 @@ Cut in this order:
|
|||
net source lines. One focused OpenAI test generated 12.713 GiB across 19,134
|
||||
files, so its provider/runtime dependency boundary is the next source-shape
|
||||
audit. Atlas remains protected for its first live inter-swarm run.
|
||||
Exact `a6cf9383` resolves that boundary: concrete Codex/OpenRouter auth,
|
||||
credential reading, and transport move to one release-entrypoint source
|
||||
module, while `epiphany-openai-runtime` retains pure exact-request opening,
|
||||
event admission, tool intent emission, and durable audit with no Codex
|
||||
dependency. Persona's concrete runner moves to the Persona service. The
|
||||
duplicate no-tools worker route, DTOs, CLI mode, and coordinator switch are
|
||||
deleted; one governed tool-capable path remains. Provider strict-shape tests
|
||||
move to the release owner. The cut removes 176 net source lines with no new
|
||||
target, process, schema, or epoch. The same runtime consequence proof now
|
||||
uses 1.869 GiB/2,942 files instead of 12.713 GiB/19,134. The release edge
|
||||
still reaches 10.473 GiB/16,483 files through `codex-login`, which is the
|
||||
next provider-edge liability. Atlas remains untouched and unaccepted.
|
||||
3. **Baseline transaction landed at `9f7b164f`; operator routing at `587c56d2`; Resident continuation and keyed acceptance at `478fb923`:** baseline Body Modeling is now thread-free from unresolved Body obligation through Launch/Wait/Review and exact Mind admission. Resident and operator callers consume the same family projection and acceptance owner. Thread ID remains immutable pass provenance only.
|
||||
4. **Proposal Modeling landed at `d1b031cb`:** its immutable request, worker launch, runtime attempt/result, and `Modeling.proposal_frontier` commit now own Launch/Wait/Review and admission. The aggregate launcher refuses proposal cargo; the old selector, validator, context builder, and generic-launch hint are deleted. Body and Proposal share only the exact-envelope launch CAS invariant, not a mutable family registry. Exact `b0a4978d` deletes the later duplicate launch-binding document entirely; the worker launch is the sole launch owner.
|
||||
5. **Continuation vocabulary landed at `e404c105` and was named truthfully at `fc5d1a4a`:** concrete pass families share one pure `EpiphanyAgentPassContinuationAction`; their semantic requests, projections, validators, and admission owners remain separate.
|
||||
|
|
|
|||
|
|
@ -2,9 +2,9 @@
|
|||
|
||||
Updated: 2026-08-24
|
||||
Branch: `codex/epiphany-shakedown-live`
|
||||
Latest committed implementation cut: `ce6bff12`
|
||||
Current pass: execution bindings reduced to identity edges; Ox17 and Atlas Gate
|
||||
1 remain paused
|
||||
Latest committed implementation cut: `a6cf9383`
|
||||
Current pass: Codex transport quarantined at release entrypoints; Ox17 and
|
||||
Atlas Gate 1 remain paused
|
||||
|
||||
## Orientation
|
||||
|
||||
|
|
@ -15,7 +15,7 @@ Idunn's Yggdrasil CI/CD task with local compiler work, or wake resident
|
|||
cognition without an explicit operator resumption.
|
||||
|
||||
Epiphany is a supervised engineering alpha. Exact source `d2ca6630` remains the
|
||||
production symlink body and is inactive. Exact `ce6bff12` is the current
|
||||
production symlink body and is inactive. Exact `a6cf9383` is the current
|
||||
build-affecting source. Historical live proofs remain evidence; they do not
|
||||
authorize the next capstone or Gate 1.
|
||||
|
||||
|
|
@ -45,6 +45,25 @@ authorize the next capstone or Gate 1.
|
|||
|
||||
## What just landed
|
||||
|
||||
Exact `a6cf9383` quarantines concrete Codex/OpenRouter authentication,
|
||||
credential reading, and network transport at the two release entrypoints that
|
||||
perform inference. `epiphany-openai-runtime` now owns only exact native-request
|
||||
lowering, model-execution opening, typed provider-event admission, tool intent
|
||||
emission, terminal physiology, and durable audit. Its normal dependency graph
|
||||
contains no Codex crate. Persona retains its three-stage/replay owner while the
|
||||
concrete runner moves into the Persona service. The worker runtime has one
|
||||
governed tool-capable route; the duplicate no-tools route, DTOs, CLI mode, and
|
||||
coordinator switch are gone. Provider strict-shape proofs now live with the
|
||||
release-owned lowering edge. The cut removes 176 net source lines without a
|
||||
new crate, executable, process, schema, or epoch. Focused runtime, model,
|
||||
Persona, and coordinator checks pass. The pure runtime consequence-test root
|
||||
falls from 12.713 GiB/19,134 files to 1.869 GiB/2,942 files. The release-edge
|
||||
test still reaches 10.473 GiB/16,483 files because `codex-login` imports config,
|
||||
app-server protocol, telemetry, Starlark, image, and clipboard anatomy; that is
|
||||
the next named provider-edge liability. Cleanup removed 10.5 GiB and restored
|
||||
the exact 1,776,640-byte state inspector. Atlas is untouched; no live
|
||||
inter-swarm collaboration has run.
|
||||
|
||||
Exact `ce6bff12` makes execution bindings identity edges instead of miniature
|
||||
copies of their owners. A model binding carries only request, session, and job
|
||||
identity; provider, source worker, and reasoning basis are loaded from the
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -52,8 +52,9 @@ current_status:
|
|||
summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure plus generic job result to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
|
||||
public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
|
||||
competitive_launch_signal: The 2026-08-22 Munder Difflin launch analysis in notes/munder-difflin-launch-intelligence-2026-08-23.md is the current Eyes/Imagination owner for this category signal. It establishes strong demand to try a packaged, local, visual multi-agent control plane and supplies repeated qualitative demand for an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness; it does not establish retention, reliable autonomy, or paid product-market fit. Munder is materially ahead in installation, cross-platform reach, provider reuse, category compression, community formation, and feedback velocity. Its public failures make renderer-owned physiology, cross-Body restoration, proxy safety metrics, false consequence receipts, provider parity, and marketed-but-unavailable federation concrete falsification targets. Epiphany does not yet own a general operator UI: Persona projection into shared asynchronous chat is the concrete human surface, while CultMesh remains projection-neutral. Social Aquarium, a dense operator cockpit, TUI, and audit surfaces may use distinct Eve compositions over the same provider-owned facts. A one-hour projection experiment and managed continuity/federation remain evidence-led options rather than adopted roadmap authority; the source-subtraction and test-authority audit remains next.
|
||||
latest_phase: Fresh-package Ox17 remains paused while source subtraction continues. The live source owns keyed Mind, sealed reasoning projections and exact provider requests, direct Body-to-Modeling work, typed frontier planning, Persona, provider-owned Bifrost feedback, and Odin/Idunn deployment receipts. Provider events and receipts are transient transport values normalized into one native persisted model stream/receipt family. Runtime model bindings are request-to-session/job edges; provider, worker ancestry, and reasoning basis remain on the native model request. Runtime tool bindings are intent-to-session/job edges; model ancestry remains on the exact tool intent. Runtime child documents, Hands consequence receipts, and repository-frontier documents carry only causal identity, lifecycle, strong dependencies, semantic payload, and consequence; CultCache plus the runtime root epoch own internal type/schema identity. Runtime identity and swarm binding retain their explicit epoch fields. Sealed worker contexts retain explicit schema and contract because they are exact model input. Autonomous proposal origin belongs to the Proposal-Modeling request; there is no companion binding document or stored hash echo. The immutable repository-domain receipt carries only the canonical repository name and exact authenticated Body hash; runtime, swarm, workspace, envelope identity/schema, prose, and time remain derived. Operator objective intake carries only thread provenance, the asserted objective, source actor/reference, and submission time; CultCache owns envelope identity/schema and the Mind objective owns active state. Persona-memory v2 owns exact Interpreter effect/context provenance; Persona social mention v2 relies on its queue and turn request for routing; tool-receipt v1 owns exact result JSON or error. Research authenticates the real Substrate Gate grant and tool receipts in place, then writes keyed evidence/observations under one exact `Eyes.frontier_research` Mind commit; no source-lookup document or evidence packet survives. Resident Self state v3 and retention head v1 retain lifecycle counts and the exact deletion chain without a causal clock. Mind/runtime writable epochs are v10/v37. The public CultNet catalog contains only three earned portable boundaries: exact OpenAI-compatible provider request, Persona state, and work-organ state. Old writable stores refuse with no migrator or dual reader. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon owns Rider. No Idunn build, package, deployment, Ox root, or Model Atlas Gate run is authorized. Ox16 remains sealed historical evidence.
|
||||
latest_phase: Fresh-package Ox17 remains paused while source subtraction continues. The live source owns keyed Mind, sealed reasoning projections and exact provider requests, direct Body-to-Modeling work, typed frontier planning, Persona, provider-owned Bifrost feedback, and Odin/Idunn deployment receipts. Provider events and receipts are transient transport values normalized into one native persisted model stream/receipt family. The pure OpenAI runtime library opens exact model execution and admits typed provider events; concrete Codex/OpenRouter auth and network transport exist only in release-entrypoint source. Runtime model bindings are request-to-session/job edges; provider, worker ancestry, and reasoning basis remain on the native model request. Runtime tool bindings are intent-to-session/job edges; model ancestry remains on the exact tool intent. Workers use one governed tool-capable route; no parallel no-tools mode survives. Runtime child documents, Hands consequence receipts, and repository-frontier documents carry only causal identity, lifecycle, strong dependencies, semantic payload, and consequence; CultCache plus the runtime root epoch own internal type/schema identity. Runtime identity and swarm binding retain their explicit epoch fields. Sealed worker contexts retain explicit schema and contract because they are exact model input. Autonomous proposal origin belongs to the Proposal-Modeling request; there is no companion binding document or stored hash echo. The immutable repository-domain receipt carries only the canonical repository name and exact authenticated Body hash; runtime, swarm, workspace, envelope identity/schema, prose, and time remain derived. Operator objective intake carries only thread provenance, the asserted objective, source actor/reference, and submission time; CultCache owns envelope identity/schema and the Mind objective owns active state. Persona-memory v2 owns exact Interpreter effect/context provenance; Persona social mention v2 relies on its queue and turn request for routing; tool-receipt v1 owns exact result JSON or error. Research authenticates the real Substrate Gate grant and tool receipts in place, then writes keyed evidence/observations under one exact `Eyes.frontier_research` Mind commit; no source-lookup document or evidence packet survives. Resident Self state v3 and retention head v1 retain lifecycle counts and the exact deletion chain without a causal clock. Mind/runtime writable epochs are v10/v37. The public CultNet catalog contains only three earned portable boundaries: exact OpenAI-compatible provider request, Persona state, and work-organ state. Old writable stores refuse with no migrator or dual reader. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon owns Rider. No Idunn build, package, deployment, Ox root, or Model Atlas Gate run is authorized. Ox16 remains sealed historical evidence.
|
||||
execution_binding_authority_cut: Exact ce6bff12 reduces model and tool execution bindings to the only facts they own. A model binding maps one native request to its runtime session and job; a tool binding maps one typed intent to its runtime session and job. Provider identity, source worker, reasoning basis, and model-request ancestry are no longer copied into bindings or compared through timestamp-shaped API arguments. Validation, retention, public-source lookup, worker terminality, decision sealing, and tool continuation reload the exact native request or tool intent. Runtime writable state advances to v37. Core, epoch refusal, transcript-free decision audit, OpenAI tool continuation, and the release-owned tool runtime pass. The cut removes 67 net source lines and leaves runtime_spine.rs at 9,300 physical lines with 50 public functions and 25 public structs. Verification generated 12.713 GiB across 19,134 files; Cargo cleanup restored the single 1.78 MiB state inspector. Atlas is untouched; no live inter-swarm collaboration has run.
|
||||
provider_transport_boundary_cut: Exact a6cf9383 moves concrete Codex/OpenRouter authentication, credential reading, and network transport out of epiphany-openai-runtime and into one source module included only by the two release entrypoints that perform inference. The pure runtime library retains exact native-request lowering, model-execution opening, typed event admission, tool intent emission, terminal physiology, and audit persistence without depending on any Codex crate. Provider strict-shape proofs move to the release-owned model binary. Persona keeps its family-owned three-stage executor while its concrete runner moves to the Persona service. The duplicate worker route without governed tools plus its CLI mode, DTOs, and coordinator switch are deleted; all workers use one tool-capable route. The cut removes 176 net source lines and adds no crate, executable, process, schema, or epoch. The runtime-library consequence test falls from 12.713 GiB/19,134 files to 1.869 GiB/2,942 files; the release-edge test still reaches 10.473 GiB/16,483 files through codex-login. All focused checks pass, then cleanup restores the exact 1,776,640-byte state inspector. Atlas is untouched and no collaboration acceptance is claimed.
|
||||
fixed_routing_and_retention_cargo_cut: Exact ffd91c20 deletes EyesEvidencePacket.source_role_id, PersonaSocialMention.target_agent_id, and ResidentSelfRetentionHead.retained_at_millis. Each producer supplied one fixed or non-causal value and no consumer read it; the request/context, Persona queue plus turn request, and retention chain remain the real owners. Eyes packet v2, Persona mention v2, Resident Self state v3/retention head v1, and runtime v27 form a hard cut. Core and the three consuming release entrypoints compile; consequential Persona, Research, and epoch-refusal proofs pass. The maintained source delta is 6 net deletions. Atlas is untouched; no live inter-swarm collaboration has run.
|
||||
provider_stream_authority_cut: Exact fe118e13 makes OpenAI/OpenRouter events and receipts transient transport values. The runtime immediately normalizes them into the single persisted native model event/receipt family used by tool continuation, assistant reconstruction, terminal validation, and bounded retention. Duplicate provider writes, registrations, archive requirements, schema IDs, two public schemas/index rows, and the include-only model-runtime shell are gone; the exact provider request remains durable. Runtime advances to v28 and the catalog drops to 18 schemas. The cut removes 270 net maintained lines. Adapter 1/1, provider spine 14/14, reasoning context 8/8, runtime 23/23, model entrypoint 11/11, swarm 4/4, epoch refusal 1/1, and release construction 15/15 pass. Atlas is untouched; live inter-swarm collaboration remains unproven.
|
||||
cultnet_catalog_authority_cut: Exact dbed11b3 and 8bb0719b delete the hand-maintained JSON shadow registry. The nonexistent runtime-event contract and obsolete public archived-session tombstone schema disappear first. Runtime-local identity, session, job, binding, coordinator, native model/tool, and state-ledger schemas then disappear because no live CultNet provider carries them and several contradicted their Rust owners. Typed CultCache registration and owner-projected CultMesh state remain authoritative. The catalog has exactly three earned boundaries: the exact OpenAI-compatible provider request, gamecult.persona_state.v0, and epiphany.work_organ_state.v0. Parse/path/unindexed/forbidden-contract checks pass at 3/3/0/0/0. The cuts remove 850 net maintained lines. Atlas is untouched; live inter-swarm collaboration remains unproven.
|
||||
|
|
@ -152,10 +153,10 @@ current_status:
|
|||
starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
|
||||
yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
|
||||
resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
|
||||
unresolved_authority: `runtime_spine.rs` remains the largest central liability at 9,346 physical lines, 50 public functions, and 25 public structs; it still mixes immutable identity, sessions/jobs, process claims, model/tool execution binding, family request admission, consequence receipts, retention, and narrow identity/schema reads. Sessions and jobs carry only lifecycle identity/status; terminal result documents own summaries and artifacts. Generic session/job creation is gone; real family launch, model execution, and coordinator owners create runtime physiology. All persisted family launch-binding documents, the standalone verdict-driven Modeling writer, coordinator artifact/status cargo, uninhabited aggregate state-model DTO families, public registered-type catalog, duplicate Eyes acceptance documents, test-only arbitrary runtime writers, and duplicate Persona delivery evidence are gone; immutable worker launches plus typed family requests and atomic admission receipts own launch ancestry and downstream work creation. Continue splitting only by deleting callerless or duplicate authority and auditing tests against consequential behavior; do not create family frameworks or adapters. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Bifrost's Discord delivery path is a real consumer of Epiphany's short-lived request-bound permit signature, so the distinct permit identity/process remains an earned privilege boundary; current Ygg deployment doctrine still points that crossing at the old Starfire endpoint and installs no issuer unit, which the Idunn lane must repair before Persona consequence readiness. Historical c011 and partial Gate roots stay untouched/read-only.
|
||||
next_action: Continue the source-shape and test-liability audit after exact ce6bff12. First trace why one epiphany-openai-runtime consequence test activates the complete Codex provider graph and generated 12.713 GiB; subtract or move authority only if the same behavior can be proven across a narrower owner boundary. Preserve exact identity, decision audit, conflict/replay, retry ancestry, retention fences, terminal Self provenance, typed frontier planning, Persona consequences, exact native/provider requests, governed tool receipts, and the complete unrun Model Atlas vertical slice. Component tests are not collaboration acceptance. Do not run a local full-workspace compile, package, deployment, Ox root, or Model Atlas Gate run.
|
||||
unresolved_authority: `runtime_spine.rs` remains the largest central liability at 9,300 physical lines, 50 public functions, and 25 public structs; it still mixes immutable identity, sessions/jobs, process claims, model/tool execution binding, family request admission, consequence receipts, retention, and narrow identity/schema reads. Sessions and jobs carry only lifecycle identity/status; terminal result documents own summaries and artifacts. Generic session/job creation is gone; real family launch, model execution, and coordinator owners create runtime physiology. All persisted family launch-binding documents, the standalone verdict-driven Modeling writer, coordinator artifact/status cargo, uninhabited aggregate state-model DTO families, public registered-type catalog, duplicate Eyes acceptance documents, test-only arbitrary runtime writers, and duplicate Persona delivery evidence are gone; immutable worker launches plus typed family requests and atomic admission receipts own launch ancestry and downstream work creation. The release-edge Codex provider still pulls a broad codex-login graph that includes configuration, app-server protocol, telemetry, Starlark, image codecs, and clipboard support; the pure runtime no longer pays that cost. Continue splitting only by deleting callerless or duplicate authority and auditing tests against consequential behavior; do not create family frameworks or adapters. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Bifrost's Discord delivery path is a real consumer of Epiphany's short-lived request-bound permit signature, so the distinct permit identity/process remains an earned privilege boundary; current Ygg deployment doctrine still points that crossing at the old Starfire endpoint and installs no issuer unit, which the Idunn lane must repair before Persona consequence readiness. Historical c011 and partial Gate roots stay untouched/read-only.
|
||||
next_action: Continue the source-shape and test-liability audit after exact a6cf9383. First compare two remaining liabilities by owned behavior: the release-edge codex-login dependency fan-out and epiphany-core's 1.869 GiB cost under one pure runtime consequence test. Narrow or replace the Codex authentication/refresh boundary only if exact provider capability and refresh-token authority remain sound; split core only where a smaller semantic owner already exists. Preserve exact identity, decision audit, conflict/replay, retry ancestry, retention fences, terminal Self provenance, typed frontier planning, Persona consequences, exact native/provider requests, governed tool receipts, and the complete unrun Model Atlas vertical slice. Component tests are not collaboration acceptance. Do not run a local full-workspace compile, package, deployment, Ox root, or Model Atlas Gate run.
|
||||
|
||||
runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, exact sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. Provider requests remain exact durable audit input; provider events/receipts normalize into one native persisted stream/receipt family. Session/job documents carry lifecycle identity and status; terminal job results carry summaries, evidence, artifacts, and decision-context identity. Completed model-session retention writes one private resurrection tombstone; archived worker retention keeps exact request/terminal identity, deletion digest, decision context, structured result, and terminal job records. Mind/runtime writable epochs are v10/v36. Runtime identity and swarm binding retain explicit epoch fields; their child physiology, Hands consequence, and repository-frontier documents rely on CultCache type/schema identity rather than carrying fixed duplicate metadata. Sealed worker contexts keep exact model-input schema and contract. Autonomous proposal promotion commits one proposal/request pair; the request owns its exact origin identities. Research coverage derives from the exact structured result and `Eyes.frontier_research` commit receipt, not a companion packet. Persona delivery consequence identity belongs to the social terminal while Bifrost retains the signed crossing request/receipt. Family launch CAS, model execution, and coordinator opening are the only session/job creation owners. The spine is 9,346 physical lines with 50 public functions and 25 public structs. Continue subtraction by tracing each public surface and verifier to a live consumer and consequential invariant; do not recreate deleted authority through registries, adapters, compatibility readers, or summary DTOs.
|
||||
runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, exact sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. Provider requests remain exact durable audit input; provider events/receipts normalize into one native persisted stream/receipt family. Session/job documents carry lifecycle identity and status; terminal job results carry summaries, evidence, artifacts, and decision-context identity. Completed model-session retention writes one private resurrection tombstone; archived worker retention keeps exact request/terminal identity, deletion digest, decision context, structured result, and terminal job records. Mind/runtime writable epochs are v10/v37. Runtime identity and swarm binding retain explicit epoch fields; their child physiology, Hands consequence, and repository-frontier documents rely on CultCache type/schema identity rather than carrying fixed duplicate metadata. Sealed worker contexts keep exact model-input schema and contract. Autonomous proposal promotion commits one proposal/request pair; the request owns its exact origin identities. Research coverage derives from the exact structured result and `Eyes.frontier_research` commit receipt, not a companion packet. Persona delivery consequence identity belongs to the social terminal while Bifrost retains the signed crossing request/receipt. Family launch CAS, model execution, and coordinator opening are the only session/job creation owners. The spine is 9,300 physical lines with 50 public functions and 25 public structs. Continue subtraction by tracing each public surface and verifier to a live consumer and consequential invariant; do not recreate deleted authority through registries, adapters, compatibility readers, or summary DTOs.
|
||||
|
||||
runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.
|
||||
|
||||
|
|
|
|||
Reference in a new issue