Record launch and build ownership cuts

notes/epiphany-current-algorithmic-map.md

@@ -195,7 +195,7 @@ interface authority.
 |---|---|---|---|
 | keyed Mind documents | typed semantic documents keyed by logical identity | deterministic `EpiphanyMindView` | There is no persisted aggregate Mind head or global revision. |
 | `reasoning_context.rs` Mind commit owner | invariant-owned strong reads and complete typed writes | atomic batch CAS plus `EpiphanyMindCommitReceipt` | Disjoint identities merge; same-identity or changed-strong-read conflicts refuse without partial mutation. |
-| runtime bootstrap | immutable runtime identity envelope | exact identity strong read plus keyed session/job/launch writes | Worker launch replays the original identity and existing session envelopes byte-for-byte; it cannot refresh a singleton timestamp or capability mirror and thereby serialize unrelated work. |
+| runtime bootstrap | immutable runtime identity envelope | exact identity strong read plus keyed session/job/launch writes | Worker launch replays the original identity and existing session envelopes byte-for-byte; it cannot refresh a singleton timestamp or capability mirror and thereby serialize unrelated work. Native runtime kind and supported document types are derived for CultNet publication. |
 | concrete family admission owners | sealed decision context, exact family request/result chain, affected semantic documents | one family-specific `MindMutation` | The model cannot choose which stale state is safe to ignore. |
 | `current_work.rs` | keyed Mind view and exact runtime request/job/result/decision families | pure family scheduling and continuation projections | Events, timestamps, role lanes, and thread provenance cannot create or suppress work. |
 | coordinator policy/status | keyed Mind presence, exact current work, and the accepted continuity decision | one action/reason pair plus operator-readable role lanes | Coordinator presence is derived; no mutable coordinator head, pressure tableau, or duplicate policy wrapper exists. |
@@ -559,7 +559,7 @@ Accepted through the local `5b799b12` source boundary:
   and remains a sealed immutable package. A foreign-target helper interrupted
   candidate deployment; exact rollback restored d2ca and prevented false
   admission. Production units are inactive and deployment.env is absent;
-- Mind epoch v4, runtime spine v6, and RepoModel epoch v2 refuse prior writable
+- Mind epoch v4, runtime spine v7, and RepoModel epoch v2 refuse prior writable
   stores without mutation or a dual-read path.
 - Persona production source has one outer turn deadline, no hidden provider
   request deadline, and focused provider/runtime suites pass.

notes/epiphany-fork-implementation-plan.md

@@ -500,12 +500,19 @@ Cut in this order:
    inspected evidence does not. Mind/runtime/RepoModel epochs advance to
    v4/v5/v2 with no compatibility reader. Ox16 is historical; Ox17 starts from
    a fresh store and exact package.
-36. **Runtime identity is immutable at `87983ffc`:** the v6 hard cut removes
+36. **Runtime identity is immutable at `87983ffc`/`ffcf036f`:** the v7 hard cut removes
    update time, derived document-type cargo, and temporary metadata from the
    runtime identity. Current-work launch preserves the exact identity and
    existing root-session envelopes as strong reads instead of reconstructing
    them with fresh storage timestamps. Unrelated job launches therefore share
    bootstrap identity without turning it into a global mutation head.
+37. **Production binary ownership is singular at `6f93134d`:** the root release
+   bundle alone owns model runtime, Persona service, and tool MCP runtime
+   entrypoints. Leaf crates are libraries, Cargo metadata has no duplicate
+   binary-source owner, and release construction no longer maintains a
+   hardcoded package map that does not drive the build. Exact `b95a3266`
+   separately deletes the superseded OpenAI debug executable; exact `c04c3aff`
+   deletes the auth re-export crate.
 
 Do not preserve the aggregate for compatibility, manufacture a bootstrap
 thread, release autonomous scheduling, register topology in `gamecult-ops`,

notes/fresh-workspace-handoff.md

@@ -843,7 +843,7 @@ or tests. Authenticated source lookup receipts and the exact research decision's
 persisted evidence packet remain the real Eyes path. Core/release checks and
 focused Research 2/2 pass.
 
-Next continue the test-authority audit after exact `87983ffc`, beginning with remaining direct schema,
+Next continue the test-authority audit after exact `ffcf036f`, beginning with remaining direct schema,
 prompt-rendering, CLI-parser, and CultMesh projection tests. Audit every claimed
 cross-service contract against its real producer before preserving it. Retain a test only
 when it reaches Epiphany validation, ownership, authentication, monotonicity,
@@ -863,7 +863,7 @@ its unused path helper; exact process-incarnation identity remains the only
 liveness and termination authority.
 
 Exact `87983ffc` makes runtime identity immutable bootstrap state and advances
-runtime spine to v6. Launches no longer rewrite a shared singleton merely to
+runtime spine toward its current v7 shape. Launches no longer rewrite a shared singleton merely to
 refresh `stored_at`, an update timestamp, a derived capability list, or
 temporary evacuation metadata. Existing identity and root-session envelopes
 are replayed byte-for-byte as strong reads, so disjoint keyed jobs can merge
@@ -871,6 +871,24 @@ without losing identity substitution protection. The existing current-work
 capstone now proves the identity envelope survives all launch families
 unchanged; focused core and OpenAI-runtime native checks pass.
 
+Exact `a319146b` deletes the public non-atomic worker-launch path that only test
+fixtures called; executor fixtures now seed through the canonical preparation
+path. Exact `76fd259b` deletes two source-layout tests while retaining actual
+CLI refusal behavior. Exact `b95a3266` removes the superseded, unpackaged
+`epiphany-openai-spine` debug binary and two tests that animated its private
+status helper.
+
+Exact `6f93134d` makes the release bundle the sole package owner of every
+production entrypoint. Leaf libraries disable automatic binaries, Cargo
+metadata reports no multiply owned binary source, and the release builder's
+hardcoded shadow target map plus two self-affirming tests are gone. The
+packaged body now has 22 executable targets rather than 26. Exact `c04c3aff`
+collapses the five-reexport auth wrapper crate into the transport's narrow
+direct `codex-login` imports. Exact `ffcf036f` advances runtime spine to v7 and
+derives the constant native runtime kind instead of persisting it. Focused
+release construction passes 17/17; the three release-owned daemon targets and
+current runtime epoch checks compile and pass.
+
 Exact `8c20f896` reduces Substrate Gate from six advertised contract families to
 its one real immutable repo-access grant. Request, review, refusal, snapshot,
 and mutation were prose-only constants with no typed body, writer, reader, or

state/map.yaml

@@ -56,7 +56,8 @@ current_status:
   supervisor_subtraction: Exact 856648de completes the supervisor deletion. Epiphany owns no local generic daemon supervisor, semantic projector service, workspace-coverage projector, Windows Task Scheduler integration, or service-policy/lifecycle/heartbeat/recovery mirror. Idunn on Yggdrasil owns source-triggered compilation, testing, packaging, deployment, signed health, and daemon survival. The canonical Epiphany brake gates Epiphany cognition and consequence authority, not Idunn startup or unrelated lifecycle.
   launch_dependency_cut: Exact 2aeab7a9 deletes the generic organ dependency matrix, generic receipt catalogue/proof profiles, persisted worker-launch cargo, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. Family admission owners derive exact dependencies from typed state. Worker-launch schema v2 and Persona projector prompt v1 refuse the old writable shape. Core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1 pass.
   operator_surface_subtraction: Exact ef92e853 deletes the callerless view-lens registry, legacy acceptance-bundle builders, test-only raw-JSON result interpreters, and six tests: 797 net lines. Exact a292979d and 77e817c1 delete the duplicate CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. Exact 3b94bf6e and 59c5e3a6 delete the nested duplicate status view, false auxiliary mode, and ignored status arguments. Exact 7c9b0cf3 deletes the fixed synthetic job table, role-board job cargo/mappers, and its test: 338 net lines. Exact 2ce91461 deletes the scene/planning Mind reconstructions, duplicate self-policy crate, unused prompt templates, four counterfeit schemas, and ten producer/source-text tests: 1,723 net lines. Exact 78836f3b deletes eight unconsumed status tableaux, the pressure calculator production only called without telemetry, its unreachable compaction action, one counterfeit schema, and six tests: 518 net lines. Exact f10f7fb3 deletes the final twelve epiphany.surface.* schemas and ten catalog entries after every one proved producerless and consumerless: 692 pure deletions. Exact ab3cacfb deletes thirty-one more producerless contracts, the false runtime-session mutation mouth, every Epiphany-owned Rider/Unity command schema, a callerless prompt-context module, its test-only specialist prompt system, and four self-affirming tests: 3,514 net lines. Exact 16d85b1b deletes six duplicate JSON-schema builder tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. Exact 06f93f70 deletes the test-only inverse OpenAI-to-native request mapper and makes two retained tests follow canonical native-to-provider derivation: sixty net lines. The local catalog now has twenty-three live or portable contracts. Brokkr owns Unity capabilities through CultMesh/Eve; a future Rider daemon owns Rider. Status retains Mind identity, exact current work, one action/reason decision, readable role lanes, and operator thought sealing. Core checks cleanly; retained provider and focused request-flow tests pass.
-  immutable_runtime_identity_cut: Exact bf997ce0 removes empty legacy frontier-decision echoes and requires exact worker-result provenance. Exact e00ea70f deletes the lossy PID-only process compatibility API. Exact 87983ffc advances runtime spine to v6 and makes runtime identity immutable bootstrap state: no update time, duplicated capability catalog, temporary metadata, or launch-time reconstruction survives. Current-work launch replays the original identity and existing root-session envelopes byte-for-byte as strong reads, preventing hidden singleton timestamp conflicts while retaining substitution refusal. The current-work capstone and OpenAI-runtime all-target check pass.
+  immutable_runtime_identity_cut: Exact bf997ce0 removes empty legacy frontier-decision echoes and requires exact worker-result provenance. Exact e00ea70f deletes the lossy PID-only process compatibility API. Exact 87983ffc makes runtime identity immutable bootstrap state: no update time, duplicated capability catalog, temporary metadata, or launch-time reconstruction survives. Current-work launch replays the original identity and existing root-session envelopes byte-for-byte as strong reads, preventing hidden singleton timestamp conflicts while retaining substitution refusal. Exact ffcf036f advances runtime spine to v7 and derives the constant native runtime kind at CultNet publication. The current-work capstone, epoch refusal, and OpenAI-runtime all-target checks pass.
+  build_target_ownership_cut: Exact a319146b deletes the public non-atomic worker-launch path used only by test fixtures; exact 76fd259b deletes two source-layout tests while retaining real CLI refusal behavior. Exact b95a3266 deletes the superseded unpackaged OpenAI debug executable and the tests/helper that animated it. Exact 6f93134d makes epiphany-release-bundle the sole package owner for production entrypoints, disables automatic leaf binaries, reduces Cargo executable targets from 26 to 22, and deletes a hardcoded release target map plus two self-affirming tests that did not drive the build. Exact c04c3aff deletes the five-reexport auth wrapper crate; the transport imports its narrow Codex auth surface directly. Cargo metadata reports no binary source with multiple package owners; release construction passes 17/17.
   bifrost_authority_cut: Exact 203bcc41 deletes Epiphany's producerless Bifrost body-change/GitHub publication family: four document types, three singleton latest heads, constructors, validators, writers, local-Verse advertisement/projection, public exports, and five tests that manufactured both ends. Bifrost owns the real Persona feedback/delivery stores and signed crossing receipts; Epiphany does not publish an alternate Bifrost protocol. Core and release-bundle checks pass; the remaining CultMesh suite passes 13/13.
   hands_pr_authority_cut: Exact 11d99de1 deletes the producerless HandsPrReceipt type, registration, dead test-only writer, read path, exports, relinquishment branch, and two contract advertisements. Hands owns local patch, command, and commit consequences; exact remote publication evidence belongs to the provider/Bifrost crossing. Core and release-bundle checks pass, and the rebuilt 43-entry schema catalog contains no deleted PR family.
   local_verse_contract_cut: Exact a4af4734 makes runtime spine the sole live CultNet mutation-contract publisher by deleting six organ-specific contract DTO/factories, the callerless LocalVerseContext query/seed bundle, fixed Verse/room policy prose, the mind-contract self-test, and persisted cluster topology. The topology writer had no caller; supervision accepted any nonempty fixed-key subset without authenticating Body domain, completeness, or runtime binding. That false bootstrap gate, loader, exports, and its diagnostic test are gone. Exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health remain supervisor prerequisites. The cut removes 1,005 net source lines; core/release checks, CultMesh 12/12, and supervisor 4/4 pass.
@@ -107,7 +108,7 @@ current_status:
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
   unresolved_authority: Generic command, legacy lineage, caller-authored identity, behaviorless policy fields, global lifecycle latest state, timestamp election, Windows Task Scheduler authority, and their false proofs are gone. Semantic and workspace launch owners are separate over shared process mechanics. The remaining daemon supervisor still combines the service loop, aggregate signed-health publication, semantic reconciliation, and the large workspace recovery state machine. Continue decomposing only where ownership becomes smaller; do not create family frameworks or adapters. The false persisted cluster-topology bootstrap sentinel is gone; supervisor admission remains bound to exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until subtraction closes. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Continue the source/test-authority audit after exact 87983ffc. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Delete test-only APIs and fixtures with the tests they animate. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, immutable runtime identity, and family admission owners. Epiphany owns no local daemon supervisor or editor bridge. Do not run a local full-workspace compile, package, deployment, or Ox root.
+  next_action: Continue the source/test-authority audit after exact ffcf036f. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Delete test-only APIs and fixtures with the tests they animate. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, immutable runtime identity, single-package binary ownership, and family admission owners. Epiphany owns no local daemon supervisor or editor bridge. Do not run a local full-workspace compile, package, deployment, or Ox root.
 
   runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.