Record launch dependency authority cut

notes/epiphany-current-algorithmic-map.md

@@ -1,7 +1,7 @@
 # Epiphany current algorithmic map
 
 Updated: 2026-08-23
-Latest committed implementation cut: `803e3447` on `codex/epiphany-shakedown-live`
+Latest committed implementation cut: `2aeab7a9` on `codex/epiphany-shakedown-live`
 Current worktree cut: canonical map/evidence sync; Ox17 remains paused
 
 This document describes the live machine. Historical cuts, rejected paths, and
@@ -39,6 +39,14 @@ an unused aggregate cannot become an interface merely by round-tripping. The
 unused service-execution audit and Bifrost artifact, metrics, and public-proof
 receipt families are deleted with the tests that alone called them.
 
+Worker launches carry one typed launch document, its exact output contract, and
+the sealed reasoning projection that owns model input. They do not carry a
+generic organ dependency matrix or prose receipt catalogue. Family admission
+owners derive exact dependencies from typed state; no universal "every organ
+depends on every other organ" prompt cargo can make Eyes gate Modeling or make
+a decorative list impersonate transaction authority. Persona projects exact
+social, memory, and Body inputs without that fiction.
+
 Persisted cluster topology is the sole local-Verse bootstrap witness. It carries
 the runtime-bound Body domain and declared daemon targets consumed by the
 supervisor and prompt projection. The former singleton CultMesh status row was

notes/fresh-workspace-handoff.md

@@ -702,11 +702,30 @@ command and its ad hoc JSON projection: 40 net lines. Typed lifecycle and
 heartbeat state plus Idunn's signed aggregate health remain the read paths.
 Supervisor check and 4/4 consequence tests pass.
 
-Preserve cluster topology while it owns the runtime-bound Body domain and
-bootstrap evidence. Separately split the remaining daemon supervisor's
-launch/reconcile authority before claiming sequencing coverage. Do not run a
-full-workspace compile, package, deployment, or Ox root until the subtraction
-audit closes. Never resume Ox10, Ox12, Ox13, Ox15, or Ox16.
+Exact `da8ed840` removes 484 net lines of console-shaped reconcile state.
+Semantic and workspace recovery now prove launches, termination, readiness,
+and recovery through typed receipts; the scheduler proves health through its
+signed Idunn publication. Authentication failures fail the command instead of
+printing a JSON refusal and returning success. Degraded native process sight
+still refuses actuation. The supervisor is 2,104 lines and its four remaining
+tests each cross a live brake, process-identity, or signed-health boundary.
+
+Exact `2aeab7a9` deletes the generic organ dependency/proof-profile subsystem,
+its persisted worker-launch field, Persona prompt injection, evaluator, and
+three self-certifying tests: 700 net lines. The universal dependency matrix was
+never consumed by admission and contradicted direct Body-to-Modeling work.
+Worker-launch schema v2 and Persona projector prompt v1 make the hard cut.
+Family validators, typed launch documents, sealed reasoning projections, and
+concrete invariant owners remain. Focused acceptance is core 378/378,
+OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1.
+
+Next audit the derived operator surface modules and their tests by production
+consumer. Preserve Eve/CultMesh projections that expose live typed owners; cut
+surface DTOs, status helpers, and tests whose only consumer is their own
+fixture. Preserve cluster topology while it owns the runtime-bound Body domain
+and bootstrap evidence. Do not run a full-workspace compile, package,
+deployment, or Ox root until the subtraction audit closes. Never resume Ox10,
+Ox12, Ox13, Ox15, or Ox16.
 
 ## Operational state that matters
 

state/map.yaml

@@ -49,7 +49,8 @@ current_status:
   summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure plus generic job result to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
   public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
   latest_phase: The fresh-package Ox17 lane remains paused for source subtraction. Exact 4d0db2c7 deletes the final heartbeat scheduler and twenty-one low-value tests. Exact 67a3a57b deletes all nineteen remaining Rust self-source inspection tests plus two argument-vector mirrors. Exact bbe5fcf1 deletes four CultMesh tableaux and their production-absent seven-cluster fixture world. Exact f236e1cd makes each organ's CultNet factory the sole contract author by deleting six parallel CultMesh families. Exact fe591b33 removes persisted fixed Verse/room policy and two literal-copy tests. Exact 4ed3a6e0 deletes four JSON-derived CultMesh mirrors, five unauthenticated legacy provider/tool families, prompt branches, retirement paths, one supervisor migration command, and ten tests: 2,398 net lines. Exact e8bc0382 deletes unused Persona-speech-audit and Weksa-lowering CultMesh shadows plus four tests: 432 lines. Exact db6a7131 deletes unused CultMesh operator-run intent/receipt and generic work-loop telemetry shadows, runtime declarations, prompt branch, and two tests: 829 pure deletions. Exact 75ead942 deletes the abandoned RepoWork aggregates, service-audit helper, Bifrost artifact/metrics/public-proof families, and tests that alone animated them: 1,410 net lines. Exact 753707ff deletes the duplicate CultMesh status bootstrap sentinel so persisted runtime-bound cluster topology alone owns bootstrap: 99 net lines. Exact 967743cc deletes seven test-only daemon-poke/Bifrost loader APIs in favor of the runtime-consumed LocalVerseContext: 85 net lines. Exact 1ab0859b deletes two obsolete tableau tests: 78 lines. Exact ab5b16ec deletes the test-only generic managed-service writer that recreated a forbidden path: 28 lines. Exact c977d149 deletes two counterfeit Idunn receipt families after external audit proved no live producer or consumer: 151 lines. Native runtime, keyed Mind, Persona, Weksa, live Bifrost body-change receipts, topology, specialized policy writers, and Odin/Idunn's actual deployment manifest/signed health remain owners. Non-test core, CultMesh 27/27, prompt 1/1, affected readiness/Persona tests, and supervisor 10/10 are clean. Old stores containing deleted envelopes refuse; there is no migrator or dual reader. No Idunn build, package, deployment, or Ox root is authorized yet. Ox16 remains sealed historical evidence and must never resume.
-  supervisor_subtraction: Exact 30c66080, 008bd493, 7e16e758, and 3312880e delete generic commands, legacy lifecycle lineage, fallback/finite launch, and caller-authored supervisor identity for 596 net lines. Exact afb223da deletes two implementation-mirror tests, their recovery wrapper, and five behaviorless policy fields; managed-service policy v1 refuses historical writable rows. Exact ffe707ff deletes the global lifecycle latest mirror, receipt-history scan, timestamp election, local-Verse slot, and two more false proofs. Each service now owns one exact current receipt head. Exact 47454e61 splits semantic/workspace launch ownership and deletes Epiphany's Windows Task Scheduler deployment/continuity authority and its argv test: another 463 net lines. Exact 803e3447 deletes the unused semantic status JSON mirror: 40 net lines. The supervisor is 2,653 lines; focused CultMesh 18/18, workspace process 11/11, and supervisor 4/4 pass.
+  supervisor_subtraction: Exact 30c66080, 008bd493, 7e16e758, and 3312880e delete generic commands, legacy lifecycle lineage, fallback/finite launch, and caller-authored supervisor identity for 596 net lines. Exact afb223da deletes two implementation-mirror tests, their recovery wrapper, and five behaviorless policy fields; managed-service policy v1 refuses historical writable rows. Exact ffe707ff deletes the global lifecycle latest mirror, receipt-history scan, timestamp election, local-Verse slot, and two more false proofs. Each service now owns one exact current receipt head. Exact 47454e61 splits semantic/workspace launch ownership and deletes Epiphany's Windows Task Scheduler deployment/continuity authority and its argv test: another 463 net lines. Exact 803e3447 deletes the unused semantic status JSON mirror. Exact da8ed840 deletes console-shaped scheduler/reconcile state machines and makes authentication refusal fail the command: 484 net lines. The supervisor is 2,104 lines; its four remaining tests cross live brake, process-identity, or signed-health boundaries.
+  launch_dependency_cut: Exact 2aeab7a9 deletes the generic organ dependency matrix, generic receipt catalogue/proof profiles, persisted worker-launch cargo, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. Family admission owners derive exact dependencies from typed state. Worker-launch schema v2 and Persona projector prompt v1 refuse the old writable shape. Core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1 pass.
   persona_social_cut: Pending mentions, immutable requests, terminal receipts, quarantine records, retention heads, and retention plans are separate keyed CultCache documents. Persona derives its own deterministic work identity, reserves and terminalizes through exact batch CAS, cites the exact request envelope as pass-input provenance, and retries failed mentions without a timestamp or global revision. No scheduler can launch, block, retain, or provide pass provenance for Persona work.
   operational_state:
     local_worktree: source_subtraction_commits_landed_ox17_and_deployment_paused
@@ -93,7 +94,7 @@ current_status:
     yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
     resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
   unresolved_authority: Generic command, legacy lineage, caller-authored identity, behaviorless policy fields, global lifecycle latest state, timestamp election, Windows Task Scheduler authority, and their false proofs are gone. Semantic and workspace launch owners are separate over shared process mechanics. The remaining daemon supervisor still combines the service loop, aggregate signed-health publication, semantic reconciliation, and the large workspace recovery state machine. Continue decomposing only where ownership becomes smaller; do not create family frameworks or adapters. Cluster topology remains persisted because its Body domain and bootstrap evidence are runtime-bound and consumed by supervision. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until subtraction closes. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only.
-  next_action: Audit the remaining workspace recovery state machine and aggregate health publisher for duplicated state, timestamp authority, or display-shaped branches. Keep the four supervisor tests only while their live consequence owners survive. Preserve topology while it owns runtime-bound Body/bootstrap evidence. Do not run a local full-workspace compile, package, deployment, or Ox root.
+  next_action: Audit derived operator surface modules and tests by production consumer. Preserve Eve/CultMesh projections over live typed owners; delete status DTOs, helpers, and tests whose only consumer is their own fixture. Preserve cluster topology and the four consequence-bearing supervisor tests. Do not run a local full-workspace compile, package, deployment, or Ox root.
 
 active_subgoals:
   - Complete the fresh exact-package Decision-Auditable Concurrent Mind capstone before any further operational Gate run.