From fb494313b99546db140b642cf6ca955c21687bbc Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Mon, 10 Aug 2026 06:56:17 +0100 Subject: [PATCH] Map coordinator runtime session ownership --- notes/epiphany-current-algorithmic-map.md | 54 ++++++++++++++++++++++ notes/fresh-workspace-handoff.md | 23 +++++++++ state/ledgers.msgpack | Bin 598116 -> 598858 bytes state/map.yaml | 6 +-- 4 files changed, 80 insertions(+), 3 deletions(-) diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index 342bfac7..4175a9c4 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -2711,6 +2711,60 @@ Live receipts are under `.epiphany-run/firewall-bffbaa45`. A non-elevated reconciliation attempt was denied before mutation and left identical snapshots; it is recorded as a negative authority check, not misreported as idempotence. +### Coordinator runtime-session closure and retention gap + +The broad runtime-history remainder is not an unclassified pile. Exact +model-adapter generations are already bounded by +`archive_completed_model_session`: it validates terminal jobs, native/provider +request streams and receipts, tool bindings/intents/receipts, and runtime events, +then replaces that exact family with `EpiphanyArchivedRuntimeSession` under one +full-snapshot fence. Outer-worker and coordinator authority is deliberately +refused. + +The live missing family is native coordinator sessions. The coordinator creates +`coordinator-{thread_id}` plus a `coordinator.started` event and eventually +writes `EpiphanyCoordinatorRunReceipt`, but it never calls +`close_runtime_session`. These sessions therefore remain falsely `Active` +after process-terminal evidence exists. Receipt retention can later remove the +receipt, but completed-session retention cannot select the session because it +requires a nonempty model-adapter job family. This is both unbounded growth and +a false liveness projection. + +Authority map for the cut: + +- Owner: runtime spine owns one atomic coordinator-run terminalization + transaction. Neither resident Self nor the artifact writer closes the runtime + session. +- Inputs: exact active coordinator session envelope; exact terminal coordinator + receipt bound to its session and thread; the absence of session jobs; existing + coordinator-started events; one terminal timestamp. +- Outputs: in one full-snapshot-fenced replacement, persist the immutable run + receipt, mark the session `Completed`, and publish exactly one deterministic + `session.completed` event. +- Derived state: coordinator JSON/text artifacts and runtime status projections + describe the committed terminal transaction; they do not terminalize it. +- Forbidden writers: `put_coordinator_run_receipt` followed by a separate close, + receipt retention, resident acknowledgement, process exit, and artifact + existence may not independently decide session death. +- Shared paths: every successful native coordinator exit mode uses the same + finalizer. Legacy active coordinator sessions may be repaired only from one + exact matching terminal receipt, no jobs, and the authenticated coordinator + event shape. +- Retention owner: completed coordinator-session archival owns the whole exact + session family, including its coordinator receipt and runtime events. Generic + coordinator-receipt retention must preserve receipts still named by a live or + completed runtime session; it owns only receipts outside a session family. +- Cut line: remove the coordinator binary's standalone receipt write. Do not + teach model-session archival to ignore coordinator receipts or infer closure + from age. Do not leave two independent deleters able to retire the same + receipt. +- Verification: atomic stale-snapshot refusal; exact replay idempotence; legacy + repair refusal for zero/multiple/mismatched receipts or any job; active and + newest-session preservation; exact old family replacement; unrelated runtime + byte identity; tombstone refusal of session/job recreation; and copied exact + package proof that terminal coordinator sessions plateau without changing + resident authority. + ### Semantic logical lifecycle implementation `retain_memory_semantic_projection_lifecycles` now realizes the safe unattempted diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index ddb89d90..43e10902 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -1925,3 +1925,26 @@ under `.epiphany-run/firewall-bffbaa45`. Active c005 was untouched. Next: map bounded runtime model event/session/tool history and its non-resurrection boundary before editing. Yggdrasil never builds. + +## Coordinator runtime-session retention gap mapped — 2026-08-10 + +Existing `archive_completed_model_session` already owns the exact closed +model-adapter family, including native/provider streams and tool evidence. It +correctly refuses outer-worker and coordinator authority. The actual remaining +growth fault is upstream: `epiphany-mvp-coordinator` creates a +`coordinator-{thread_id}` runtime session and start event, then writes a +terminal coordinator receipt without ever closing the session. The store keeps +false `Active` sessions indefinitely; generic receipt retention may later +remove their only terminal evidence. + +The next cut is an atomic runtime-spine finalizer for receipt + completed +session + deterministic completion event. Completed coordinator-session +archival then owns that exact family, including its receipt. Generic receipt +retention must preserve every receipt still named by a live/completed session +and own only orphans; two deleters may not race for the same authority. Legacy +repair is permitted only from one exact matching terminal receipt, no jobs, and +the authenticated coordinator event shape. Do not weaken model-session +refusals or infer terminality from age. + +Next: implement the owner cut with hostile CAS/replay/legacy tests, then package +and prove copied-state plateau. Preserve active c005. Yggdrasil never builds. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index e4fc25c501ed8242b54b507675f4d7934b605d82..3975872acaad9eb14bcbfa58e5bae751c9b9184f 100644 GIT binary patch delta 767 zcmYjPy>1gh5avt>ggOmKNF#_u5uam6N)(w2QPEIDh=L}X+|Bt`+1ovK_v~0GazVih zV7a2m8z502Bnqk&G`s{4!ngP?q!``a?zi*(%>Mbg^XqEo%Y)?p;dnH9dv$B;@zbwQ zl6OgR@nPBfxa=jU_`QwVK;1!YqVA&ZeOvanem~m&^nHK0f0z!B($Vns@L+s^UaQN` zo7;=tkK@J!RSA{K2kYi!XGR=VT#rf4ISZ88s@4)DCtHhQl~y(vopR1~0J7jpX(gW6 z39)v<`5f!4R8w4OOb!fF(P*7|!?iDMph8S01A4_90jSmG%jDr3FWxI_)_sf(V-Q=H zE5neLz7J*Wd_lEt{LPbr5A32ig>68v?1K-=DqPj8i&vrJ%W>Ve#^$1u)!vd)) z(5>g$lJ5QM;`ds7pJt`fLKDIGLDxxh5P=5**4l{|H^rpeGfxnvHJw^anS%YF1mhp? u$dfg&YsaoG*?44Pi6=tJ6yo9&Ad5K&pMet>8rV%|)}0}7Cq?5~5B>rgt{6uE delta 68 zcmX?gOy$V|l?{@NT!vPr7E#9-IOQETD>D`{GS)OtWon