Bind autonomous proposals to organizational Mind

epiphany-core/src/admitted_model_direction_consideration.rs

@@ -211,6 +211,10 @@ pub fn validate_result(
     request: &AdmittedModelDirectionConsiderationRequest,
     result: &AdmittedModelDirectionConsiderationResult,
 ) -> Result<()> {
+    let requested_at = chrono::DateTime::parse_from_rfc3339(&request.requested_at)
+        .map_err(|_| anyhow!("model direction request timestamp must be RFC3339"))?;
+    let proposed_at = chrono::DateTime::parse_from_rfc3339(&result.proposed_at)
+        .map_err(|_| anyhow!("model direction result timestamp must be RFC3339"))?;
     if result.schema_version != RESULT_SCHEMA
         || result.contract != RESULT_CONTRACT
         || !result.proposal_only
@@ -223,7 +227,7 @@ pub fn validate_result(
         || result.model_admission_receipt_id != request.model_admission_receipt_id
         || result.result_id.trim().is_empty()
         || result.summary.trim().is_empty()
-        || chrono::DateTime::parse_from_rfc3339(&result.proposed_at).is_err()
+        || proposed_at < requested_at
     {
         bail!("model direction result substituted causal identity");
     }

epiphany-core/src/bin/epiphany-persona-feedback-causal-smoke.rs

@@ -46,11 +46,14 @@ fn main() -> Result<()> {
         bail!("fixture requires exact public, organization, and private feedback classes");
     }
 
+    bind_runtime_repository_domain(&runtime_store, "GameCult/Epiphany", "2026-07-18T00:00:00Z")?;
     let inserted = ingest_resident_self_domain_pressure(
         &resident_store,
         &runtime_store,
         &feedback_store,
         "epiphany-yggdrasil",
+        "GameCult/Epiphany",
+        runtime_store.parent().unwrap().to_str().unwrap(),
         1_752_796_800_000,
     )?;
     if inserted < admitted.len() {

epiphany-core/src/bin/epiphany-swarm.rs

@@ -5,11 +5,12 @@ use epiphany_core::{
     ProcessInstanceObservation, ResidentProviderReadiness, ResidentReadinessRequest,
     ResidentSelfOutcome, ResidentSelfPolicy, ResidentSelfPorts, ResidentSelfPressure,
     ResidentSelfState, acknowledge_resident_self_launch, authenticate_resident_self_policy,
-    cancel_resident_self_turn, capture_process_instance, complete_resident_self_turn,
-    coordinator_run_receipts, derive_resident_cognition_readiness, enqueue_resident_self_pressure,
-    import_bifrost_persona_feedback_deliveries, ingest_resident_self_domain_pressure,
-    load_epiphany_cultmesh_swarm_brake, load_resident_self_state, observe_process_instance,
-    prepare_resident_self_launch, publish_resident_provider_readiness, resident_self_child_claim,
+    bind_runtime_repository_domain, cancel_resident_self_turn, capture_process_instance,
+    complete_resident_self_turn, coordinator_run_receipts, derive_resident_cognition_readiness,
+    enqueue_resident_self_pressure, import_bifrost_persona_feedback_deliveries,
+    ingest_resident_self_domain_pressure, load_epiphany_cultmesh_swarm_brake,
+    load_resident_self_state, observe_process_instance, prepare_resident_self_launch,
+    publish_resident_provider_readiness, resident_self_child_claim,
     resident_self_local_provider_status, terminate_process_instance,
     validate_bifrost_persona_feedback_source, validate_persona_feedback_store_separation,
     validate_resident_self_store_separation,
@@ -152,11 +153,18 @@ fn cycle(
         &args.feedback_target_repository,
         &args.feedback_target_persona,
     )?;
+    bind_runtime_repository_domain(
+        &args.policy.runtime_store,
+        &args.feedback_target_repository,
+        &Utc::now().to_rfc3339(),
+    )?;
     ingest_resident_self_domain_pressure(
         &args.state_store,
         &args.policy.runtime_store,
         &args.persona_feedback_store,
         &args.policy.release_runtime_id,
+        &args.feedback_target_repository,
+        &args.policy.workspace.display().to_string(),
         now,
     )?;
     *state = load_resident_self_state(&args.state_store)?;

epiphany-core/src/coordinator_launch.rs

@@ -965,6 +965,9 @@ fn validate_proposal_modeling_launch(
         .get::<RepoFrontierWorkProposal>(&selection.proposal_id)?
         .ok_or_else(|| anyhow!("proposal Modeling selection references a missing proposal"))?;
     crate::runtime_spine::validate_repo_frontier_work_proposal(&proposal)?;
+    if proposal.source_kind == crate::RepoFrontierProposalSourceKind::Imagination {
+        crate::runtime_spine::validate_autonomous_proposal_binding(cache, &proposal)?;
+    }
     if cache
         .get_all::<RepoFrontierProposalModelingLaunchBinding>()?
         .iter()

epiphany-core/src/lib.rs

@@ -937,6 +937,7 @@ pub use runtime_spine::RuntimeSpineJobOptions;
 pub use runtime_spine::RuntimeSpineJobResultOptions;
 pub use runtime_spine::RuntimeSpineSessionOptions;
 pub use runtime_spine::append_runtime_event;
+pub use runtime_spine::bind_runtime_repository_domain;
 pub use runtime_spine::bind_runtime_to_agent_memory_swarm;
 pub use runtime_spine::canonical_repo_frontier_plan_candidate_id;
 pub use runtime_spine::clear_epiphany_job_binding_backend;
@@ -959,6 +960,7 @@ pub use runtime_spine::migrate_legacy_repo_model_projection_obligation;
 pub use runtime_spine::open_runtime_spine_heartbeat_job;
 pub use runtime_spine::plan_runtime_spine_heartbeat_launch;
 pub use runtime_spine::prepare_runtime_spine_heartbeat_job;
+pub use runtime_spine::promote_autonomous_direction_options_for_modeling;
 pub use runtime_spine::put_continuity_recovery_receipt;
 pub use runtime_spine::put_coordinator_run_receipt;
 pub use runtime_spine::put_eyes_evidence_packet;

epiphany-core/src/repo_model_gateway.rs

@@ -39,6 +39,14 @@ pub const REPO_FRONTIER_PLAN_DECISION_CONTRACT: &str = "epiphany.repo_frontier_p
 pub const REPO_FRONTIER_PLANNING_CONTRACT: &str = "epiphany.repo_frontier_planning.v1";
 pub const REPO_FRONTIER_WORK_PROPOSAL_CONTRACT: &str =
     "epiphany.repo_frontier_work_proposal.inert.v0";
+pub const REPO_FRONTIER_AUTONOMOUS_PROPOSAL_BINDING_SCHEMA_VERSION: &str =
+    "epiphany.self.repo_frontier_autonomous_proposal_binding.v0";
+pub const REPO_FRONTIER_AUTONOMOUS_PROPOSAL_BINDING_CONTRACT: &str =
+    "epiphany.repo_frontier_autonomous_proposal_binding.v0";
+pub const RUNTIME_REPOSITORY_DOMAIN_BINDING_KEY: &str = "runtime-repository-domain-binding";
+pub const RUNTIME_REPOSITORY_DOMAIN_BINDING_SCHEMA_VERSION: &str =
+    "epiphany.runtime.repository_domain_binding.v0";
+pub const RUNTIME_REPOSITORY_DOMAIN_BINDING_CONTRACT: &str = "deployment configuration binds one organizational repository name to one exact authenticated repository Body; Self may consume but not relabel it";
 pub const REPO_FRONTIER_PROPOSAL_MODELING_REQUEST_SCHEMA_VERSION: &str =
     "epiphany.coordinator.repo_frontier_proposal_modeling_request.v0";
 pub const REPO_FRONTIER_PROPOSAL_MODELING_REQUEST_CONTRACT: &str =
@@ -213,6 +221,7 @@ pub enum RepoFrontierProposalSourceKind {
     User,
     Persona,
     Bifrost,
+    Imagination,
 }
 
 #[derive(Debug, Clone)]
@@ -280,6 +289,84 @@ pub struct RepoFrontierWorkProposal {
     pub contract: String,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "epiphany.self.repo_frontier_autonomous_proposal_binding",
+    schema = "RepoFrontierAutonomousProposalBinding"
+)]
+pub struct RepoFrontierAutonomousProposalBinding {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub binding_id: String,
+    #[cultcache(key = 2)]
+    pub proposal_id: String,
+    #[cultcache(key = 3)]
+    pub proposal_payload_sha256: String,
+    #[cultcache(key = 4)]
+    pub direction_request_id: String,
+    #[cultcache(key = 5)]
+    pub direction_result_id: String,
+    #[cultcache(key = 6)]
+    pub direction_result_sha256: String,
+    #[cultcache(key = 7)]
+    pub model_revision: u64,
+    #[cultcache(key = 8)]
+    pub model_hash: String,
+    #[cultcache(key = 9)]
+    pub model_admission_receipt_id: String,
+    #[cultcache(key = 10)]
+    pub option_ordinal: u32,
+    #[cultcache(key = 11)]
+    pub option_sha256: String,
+    #[cultcache(key = 12)]
+    pub runtime_id: String,
+    #[cultcache(key = 13)]
+    pub thread_id: String,
+    #[cultcache(key = 14)]
+    pub workspace_id: String,
+    #[cultcache(key = 15)]
+    pub body_binding_sha256: String,
+    #[cultcache(key = 16)]
+    pub created_at: String,
+    #[cultcache(key = 17)]
+    pub contract: String,
+    #[cultcache(key = 18)]
+    pub direction_worker_job_id: String,
+    #[cultcache(key = 19)]
+    pub direction_worker_result_id: String,
+    #[cultcache(key = 20)]
+    pub direction_worker_result_sha256: String,
+    #[cultcache(key = 21)]
+    pub direction_worker_launch_sha256: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, DatabaseEntry)]
+#[cultcache(
+    type = "epiphany.runtime.repository_domain_binding",
+    schema = "RuntimeRepositoryDomainBinding"
+)]
+pub struct RuntimeRepositoryDomainBinding {
+    #[cultcache(key = 0)]
+    pub schema_version: String,
+    #[cultcache(key = 1)]
+    pub binding_id: String,
+    #[cultcache(key = 2)]
+    pub repository_full_name: String,
+    #[cultcache(key = 3)]
+    pub runtime_id: String,
+    #[cultcache(key = 4)]
+    pub swarm_id: String,
+    #[cultcache(key = 5)]
+    pub workspace_id: String,
+    #[cultcache(key = 6)]
+    pub body_binding_sha256: String,
+    #[cultcache(key = 7)]
+    pub bound_at: String,
+    #[cultcache(key = 8)]
+    pub contract: String,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, DatabaseEntry)]
 #[cultcache(
     type = "epiphany.coordinator.repo_frontier_proposal_modeling_request",

epiphany-core/src/repository_body_observer.rs

@@ -1329,7 +1329,7 @@ fn validate_runtime_body_store_binding(
     }
     Ok(())
 }
-fn body_binding_sha256(binding: &RepositoryBodyBinding) -> Result<String> {
+pub(crate) fn body_binding_sha256(binding: &RepositoryBodyBinding) -> Result<String> {
     Ok(format!(
         "{:x}",
         Sha256::digest(rmp_serde::to_vec_named(binding)?)

epiphany-core/src/resident_self.rs

@@ -52,6 +52,7 @@ impl ResidentSelfPressure {
                     | "persona-feedback"
                     | "imagination-consideration"
                     | "imagination-proposal"
+                    | "repo-frontier-proposal-modeling"
             )
             || self.pressure_id.trim().is_empty()
             || self.provenance_ref.trim().is_empty()
@@ -811,6 +812,8 @@ pub fn ingest_resident_self_domain_pressure(
     runtime_store: &Path,
     persona_feedback_store: &Path,
     runtime_id: &str,
+    repository: &str,
+    workspace: &str,
     now_millis: u64,
 ) -> Result<usize> {
     let mut inserted = 0;
@@ -829,6 +832,30 @@ pub fn ingest_resident_self_domain_pressure(
             created_at_millis: now_millis, status: "pending".into(), consumed_by_grant_id: None, private_state_exposed: false,
         })?);
     }
+    for selection in crate::promote_autonomous_direction_options_for_modeling(
+        runtime_store,
+        repository,
+        workspace,
+        &requested_at,
+    )? {
+        inserted += usize::from(enqueue_resident_self_pressure_idempotent(
+            resident_store,
+            &ResidentSelfPressure {
+                schema_version: RESIDENT_SELF_PRESSURE_SCHEMA_VERSION.into(),
+                pressure_id: format!("repo-frontier-proposal-modeling-{}", selection.request_id),
+                kind: "repo-frontier-proposal-modeling".into(),
+                provenance_ref: format!(
+                    "cultcache://repo-frontier-proposal-modeling/{}",
+                    selection.request_id
+                ),
+                objective: "Launch the exact autonomous proposal Modeling review; do not admit, adopt, act, release, or deploy.".into(),
+                created_at_millis: now_millis,
+                status: "pending".into(),
+                consumed_by_grant_id: None,
+                private_state_exposed: false,
+            },
+        )?);
+    }
     for feedback in crate::admitted_persona_feedback(persona_feedback_store, runtime_id)? {
         if feedback.target_runtime_id != runtime_id {
             return Err(anyhow!(
@@ -1009,18 +1036,23 @@ pub fn prepare_resident_self_launch(
     let mut argv = coordinator_argv(policy, &turn_id, &wake);
     if matches!(
         grant.pressure_kind.as_str(),
-        "imagination-consideration" | "admitted-model-direction-consideration"
+        "imagination-consideration"
+            | "admitted-model-direction-consideration"
+            | "repo-frontier-proposal-modeling"
     ) {
-        let (prefix, request_flag) = if grant.pressure_kind == "imagination-consideration" {
-            (
+        let (prefix, request_flag) = match grant.pressure_kind.as_str() {
+            "imagination-consideration" => (
                 "cultcache://imagination-consideration/",
                 "--imagination-consideration-request-id",
-            )
-        } else {
-            (
+            ),
+            "admitted-model-direction-consideration" => (
                 "cultcache://admitted-model-direction-consideration/",
                 "--admitted-model-direction-consideration-request-id",
-            )
+            ),
+            _ => (
+                "cultcache://repo-frontier-proposal-modeling/",
+                "--proposal-modeling-request-id",
+            ),
         };
         let request_id = grant
             .provenance_ref
@@ -1751,6 +1783,43 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn autonomous_frontier_pressure_launches_exact_modeling_selection_without_objective()
+    -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = temp.path().join("resident-autonomous.cc");
+        let coordinator = temp.path().join("epiphany-mvp-coordinator");
+        std::fs::write(&coordinator, b"witnessed executable")?;
+        let mut policy = policy();
+        policy.coordinator_bin = coordinator;
+        enqueue_resident_self_pressure(
+            &store,
+            &ResidentSelfPressure {
+                schema_version: RESIDENT_SELF_PRESSURE_SCHEMA_VERSION.into(),
+                pressure_id: "pressure-autonomous-modeling-1".into(),
+                kind: "repo-frontier-proposal-modeling".into(),
+                provenance_ref: "cultcache://repo-frontier-proposal-modeling/selection-1".into(),
+                objective: "Launch exact autonomous proposal Modeling review.".into(),
+                created_at_millis: 1,
+                status: "pending".into(),
+                consumed_by_grant_id: None,
+                private_state_exposed: false,
+            },
+        )?;
+        heartbeat_issue_resident_self_grant(&store, "heartbeat-autonomous", "action-1", 2)?
+            .expect("autonomous grant");
+        let prepared = prepare_resident_self_launch(&store, &policy, 3)?
+            .expect("autonomous Modeling preparation");
+        assert!(!prepared.argv.iter().any(|arg| arg == "--objective"));
+        assert!(
+            prepared
+                .argv
+                .windows(2)
+                .any(|pair| { pair == ["--proposal-modeling-request-id", "selection-1"] })
+        );
+        Ok(())
+    }
+
     #[test]
     fn standard_heartbeat_owns_self_grant_selection() -> Result<()> {
         let temp = tempfile::tempdir()?;

notes/epiphany-current-algorithmic-map.md

@@ -1128,5 +1128,27 @@ Idunn separately own release and deployment. Operator silence permits bounded
 observation, map maintenance, rumination, and proposals. It grants none of the
 later consequences.
 
+The autonomous proposal crossing is source-grounded in
+`runtime_spine.rs`, `admitted_model_direction_consideration.rs`,
+`coordinator_launch.rs`, and `repo_model_gateway.rs`. A deployment-configured
+`RuntimeRepositoryDomainBinding` immutably joins the runtime/swarm/workspace to
+the exact repository Body binding. It names organizational jurisdiction only;
+it is not proof of a Git remote. Self promotion reloads the exact direction
+request/result, worker result and launch, admitted model receipt, domain
+binding, and Body-owned canonical Git root, then one preserved-authority CAS
+creates an inert frontier proposal and its Modeling selection. The generic
+proposal mouth rejects Imagination provenance so it cannot substitute for this
+causal crossing.
+
+Proposal Modeling is structurally bounded: its sole frontier upsert must
+recommend `Imagination` and carry no adopted plan. Ordinary Evolution cannot
+mutate frontier state, and proposal Evolution is insert-only. Therefore map
+direction can become an inspectable proposal and planning request, but not a
+Hands route. The full-chain hostile test supplies an exact proposal-citing
+Modeling result that recommends direct Hands; Mind admission rejects it before
+mutation, the store remains byte-identical, and Hands authority remains absent.
+Only the existing explicit Mind adoption transition may create the route that
+Hands consumes.
+
 This map must change when ownership changes. Historical scars belong in git,
 evidence, or an explicitly archived note—not in the machine's Modeling state.

notes/fresh-workspace-handoff.md

@@ -3146,15 +3146,32 @@ manual and automatic paths share it, and stale automatic work is dropped while
 the actuator is occupied. Durable request-head/result CAS remains unchanged.
 All 49 Idunn tests pass. No Ygg deployment has yet used this binary.
 
-The autonomous option-to-frontier bridge is concurrently implemented but is
-not release-ready. Exact worker launch/result provenance, Body-workspace
-binding, preserved-authority CAS, true Self selection time, idempotent replay,
-counterfeit companion refusal, and alien-workspace refusal pass the full
-Epiphany library (578 passed, one ignored). Remaining blockers are typed
-canonical repository-name authority and a direct negative proof that no Hands
-authority appears without explicit Mind adoption.
+The autonomous option-to-frontier bridge is now locally release-ready. A typed,
+immutable deployment-configured repository-domain binding joins runtime,
+swarm, workspace, and the exact Body binding. It is an organizational label,
+not authenticated Git-remote identity. Promotion reloads the exact direction
+request/result, worker result and launch, admitted model and receipt, canonical
+Body Git root, and domain binding before one CAS creates an inert proposal and
+Self selection for Modeling. Generic Imagination intake cannot forge this path.
+Proposal Modeling may recommend only Imagination and may not carry an adopted
+plan; ordinary Evolution cannot mutate frontier state. The hostile full-chain
+test attempts a proposal-citing direct Hands route, is rejected with a
+byte-identical store, and leaves Hands empty. Full core proof is 578 passed,
+zero failed, one ignored; all binaries compile; Soul found no release blocker.
 
-Next action: install `a17b0b6` on Ygg, commit/push only this state boundary as a
-new Epiphany successor, authorize that exact commit through Bifrost, and require
-signed health admission plus `deployment.env` under the all-scope brake. Do not
-include the uncommitted autonomous bridge in that deployment release.
+Live certification of state-only Epiphany commit `36f687e` exposed a separate
+Idunn verifier wound. Epiphany sent a 2,260-byte signed active health document
+with the exact request, release, witness, commit, signer, and Body terminal
+receipt. Idunn received it but tried to create
+`/etc/gamecult/idunn/epiphany-health-identity.ccmp.lock` while reading the
+root-owned trust anchor, so no signed admission or deployment witness was
+published. Making the config directory daemon-writable is forbidden because it
+would let the verifier alter its own trust root. Odin commit `64bb679` uses an
+atomic read-only CultCache snapshot for this one pinned-anchor read, proves no
+sibling lock in a read-only directory, and passes 50/50 Idunn tests.
+
+Next action: install exact Idunn `64bb679` on Ygg, allow the incomplete
+transaction to roll back cleanly, then retry the exact Bifrost-authorized 36f
+release under the all-scope brake. Require signed active admission and final
+`deployment.env`. Then commit/push the autonomous bridge and certify its exact
+successor separately. No host reboot is authorized.

state/map.yaml

@@ -9,8 +9,8 @@ experiment:
   coordinator_grounding_loop: "Cold start is owned by one typed UserObjectiveIntake that atomically seeds thread state and refuses objective replacement; a missing checkpoint routes to Modeling rather than a fictional prepareCheckpoint actuator. Explicit local-Verse path authority flows into launch context without sibling-path inference. Eyes and Modeling receive bounded source tools. Accepted CRRC regather findings hand source gathering to Eyes instead of recursively relaunching the continuity judge. Runtime/display/coordinator reads share the canonical typed role and reorient result readers. Failed or completed-unreviewable role outputs may be explicitly superseded by a typed review receipt; JSON null is not a state patch. Provider output schema is formatting guidance only, while canonical typed ingress and Mind remain admission authority. Modeling's provider schema now describes tagged patch operations, closed node/edge/profile vocabularies, canonical node/edge fields, anchors, code refs, observations, evidence, frontier items, and Body-basis echo. Live dogfood has accepted one code-grounded Eyes result, but no current Body-grounded Modeling admission yet: the latest Modeling run used eleven source-tool rounds then failed at the provider request boundary before publishing typed output."
   modeling_admission_dogfood: "Source-grounded Modeling now completes with typed Body-basis ingress and substantial RepoModel node/edge proposals, proving the source/tool/output path. Mind first refused an ordinary Evolution patch that attempted unrequested frontier mutation, then refused a nodes/edges-only patch whose invented workspace-derived domain and Active lifecycle violated the canonical aggregate. Both were superseded through typed admission-rejection review. Modeling launch context now carries the current model revision/hash and exact existing domain ids plus legal repo lifecycles; Evolution mutates nodes/edges only and frontier mutation remains request-bound. A fresh run against the post-fix Body is still required before repository readiness can join."
   resident_direction_pressure: "Resident Self no longer invents Body drift from a current RepoModel hash. In epiphany-core/src/resident_self.rs, admitted-model-direction-consideration is emitted only for the exact current admitted model revision/hash and unique admission receipt when no terminal direction consideration exists. The request is typed and Imagination remains proposal-only. Attributed organizational feedback may add separate pressure but is not required for the resident swarm to inspect its admitted map and suggest direction."
-  autonomous_frontier_bridge: "Work in progress, not release authority. The current cut atomically persists an Imagination direction result with its worker result, binds promoted options to the exact worker launch/result, current admitted model receipt, runtime/thread, and authenticated repository Body workspace, then lets Self create an inert proposal and Modeling-selection request under preserved-authority CAS. Counterfeit standalone results, alien workspaces, causal time reversal, and timestamp-rewriting replay are refused without writes. Release remains withheld until canonical repository-name authority is typed rather than caller/configuration-shaped and a negative proof shows no Hands authority without explicit Mind adoption."
-  idunn_observation_actuation_split: "Odin commit a17b0b6 makes continuous target observation/evaluation/publication the target loop's sole authority and runs deploy/restart consequences separately under one per-target actuation reservation. Manual and automatic consequences share the reservation; automatic work is dropped rather than queued stale while occupied; durable current-request/result CAS is unchanged. This replaces the failed 75bd5f2 cut, which moved the mutex but left observation awaiting the long automatic deployment command. Idunn tests pass 49/49. Ygg installation/certification is pending."
+  autonomous_frontier_bridge: "Accepted normal product path. An immutable deployment-configured repository-domain binding joins the runtime/swarm/workspace and exact Body binding; it labels organizational jurisdiction but does not impersonate authenticated Git-remote identity. Epiphany atomically persists an Imagination direction result with its exact worker result, binds promotion to the exact worker launch/result, current admitted model receipt, runtime/thread, repository domain, and canonical Body Git root, then lets Self create one inert proposal and Modeling-selection request under preserved-authority CAS. Counterfeit companions, generic Imagination intake, alien workspaces/domains, causal time reversal, and replay substitution are refused without writes. Proposal Modeling may recommend only Imagination and carries no adopted plan; ordinary Evolution cannot mutate frontier state. The hostile full-chain proof rejects a proposal-citing Modeling result that attempts direct Hands routing, leaves the store byte-identical, and grants no Hands authority. Explicit Mind adoption remains the only route from proposal/planning into Hands. Full core proof: 578 passed, zero failed, one ignored; all binaries compile."
+  idunn_observation_actuation_split: "Odin commit a17b0b6 makes continuous target observation/evaluation/publication the target loop's sole authority and runs deploy/restart consequences separately under one per-target actuation reservation. Manual and automatic consequences share the reservation; automatic work is dropped rather than queued stale while occupied; durable current-request/result CAS is unchanged. Live deployment then exposed that signed Epiphany health admission read the root-owned pinned trust anchor through a writer-locking store path. Odin commit 64bb679 replaces only that trust-anchor read with an atomic read-only snapshot and proves a read-only directory creates no sibling lock; 50/50 Idunn tests pass. Ygg certification awaits installation of that exact verifier and a clean braked retry."
   release_publication_ownership: "epiphany-core/src/packaged_release.rs constructs and verifies immutable package bytes and witnesses. Application-owned store publication is distinct from Bifrost release approval and Idunn deployment: packaging proves what artifact exists; downstream applications own their typed publication, while Bifrost and Idunn own crossing and deployment consequences."
   verifier_read_purity: "Verifier/status reads do not acquire writer authority merely to inspect provider state. epiphany-core/src/persona_feedback_admission.rs reads a provider-owned snapshot through pull_all_read_only_snapshot without taking the provider lock. Status derives from immutable/provider snapshots; mutation locks belong only to the owning writer transaction."
   resident_readiness_ownership: "Resident cognition readiness is a join, not one store pretending to own the organism. epiphany-core/src/resident_readiness.rs derives readiness from separately owned provider readiness, packaged release identity/witness, runtime/Verse observations, Mind state, and brake state. Each source remains authoritative for its own fact; the readiness projection is read-derived and grants no cognition or action authority."
@@ -804,4 +804,4 @@ current_status:
   - Candidate `b8517d9d7905eb62314db675cc2f0688510aa5bd` proved stale launch terminalization and current-policy replacement launch: supervisor PID `1147968` launched replacement workspace projector PID `1148157`, whose authenticated ready heartbeat advanced while the engaged brake held. Recovery still stalled because the old Body claim could be read only through current-claim authentication, which correctly rejected its historical policy before the mismatch recovery branch. The candidate was rolled back and revoked; no deployment witness exists. Claim sight now has two explicit authorities: current authentication is required for provider projection work and rejects stale launches; recovery authentication proves the old signed claim/body/route lineage only. Supervisor recovery and directive writing use the recovery reader, while old launch authentication inside the atomic lease-transfer transaction is historical and the replacement launch/heartbeat remain current-policy evidence. The full causal test performs an actual policy rotation and proves current refusal, historical recovery, directive fencing, lease transfer, successor current sight, and replay/tamper boundaries. Full core passes 573/573 with one ignored; all binaries compile.
   - Candidate `351355d3baee2d475f84168136380d2f50197ef8` authenticated the historical claim and started all three owners under the brake, but recovery refused because the claim named an older launch than the current replacement's direct parent. Repeated failed candidate deployments had formed a valid signed replacement chain, while recovery still assumed one direct old-to-new edge. The exact Idunn process group was terminated, all services stopped, active pointer and witness removed, and Bifrost authority revoked. No deployment witness exists. Recovery now authenticates the complete immutable chain from the claim's historical launch to the live current-policy descendant: every intermediate launch is host-signed, every parent termination id and envelope digest is exact, chronology is ordered, cycles and broken edges refuse, and the selected endpoint must be current. Directive writing, receipt verification, atomic lease transfer, and supervisor resume share this proof. Typed refusal now exposes the exact lineage fault instead of swallowing it. The causal recovery test contains a real intermediate generation and still proves the full fenced transaction. Full library passes 573/573 with one ignored; supervisor authority tests pass 24/24.
   - Candidate `a70fe275195740ecefc2984b32ebd8ae93658c18` proved the full signed multi-generation chain and emitted recovery directive `06165fb6-97bd-4c27-97e3-38af03dec72d` from historical claim `c6df4335-7080-4d5f-80fc-4fa18a9d16ce` to current launch `9414c32f-f53c-450c-bc19-a69f5ba04a29`. The replacement projector nevertheless kept refusing stale-policy claim sight because its pulse authenticated the not-yet-created current successor claim before looking for the recovery directive. Supervisor replayed the same directive without mutating Body, exposing a circular ordering fault. The exact Idunn process group was terminated, services stopped, pointer and witness removed, and Bifrost authority revoked; no deployment witness exists. Projector recovery directive consumption now precedes all ordinary projection work and invokes the already idempotent atomic transfer directly. Current claim sight is an output of recovery, never a prerequisite for it. Full library now passes 574/574 with one ignored; supervisor authority tests pass 24/24.
-  next_action: "The runtime-to-repository Body binding cut is committed and pushed at 67f0fe0: supervisor terminal sight now authenticates the runtime store against the separately bound Body store, and 25/25 supervisor tests pass. Its live candidate reached terminal-observer-alive, three stable braked services, and a healthy pre-witness check, but final admission was correctly withheld after Idunn's automatic worker superseded the manual deployment request head. Exact authority was revoked and rollback removed all candidate runtime pointers and witnesses. Odin successor eefd47f makes local manual/automatic actuation per-target serialized and makes the persistent request/result CAS chain the durable cross-process authority: a live head cannot be superseded without its exact terminal result; 48/48 Idunn tests and independent Soul audit pass. That Idunn binary is live on Ygg at SHA-256 49e09d1989342737f6c996be267894555e8c23886f090a5ae5d334e4aa29ff8d with rollback binary preserved. Bifrost permanently refuses reauthorization of revoked 67f0fe0, so commit this state successor and certify that new exact Epiphany commit through Bifrost and Idunn under the all-scope brake. Require one stable request head, terminal-observer-alive, three stable services, signed aggregate health, and deployment witness. Then build the ordinary organizational product bridge: autonomous admitted-model option -> immutable frontier proposal -> automatic Self selection for Modeling review -> existing Imagination planning -> explicit Mind adoption -> Hands. Organization feedback through Persona remains additional attributed pressure; conversation/proposal alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."
+  next_action: "Install exact Idunn read-only trust-anchor verifier commit 64bb679 on Ygg without making /etc writable, let the incomplete 36f deployment roll back cleanly, and retry the exact Bifrost-authorized release under the all-scope brake. Require one stable request head, terminal-observer-alive, three stable services, exact signed active health admission, and final deployment.env witness. The autonomous organizational bridge is accepted locally: Modeling map -> exact direction result -> Imagination proposal -> Self selection -> proposal-bounded Modeling -> Imagination planning -> explicit Mind adoption -> Hands. Commit and push that code plus its map/evidence after the deployment boundary is stable. Organization feedback through Persona remains additional attributed pressure; conversation/proposal alone grants no Mind, Hands, Persona-speech, release, or deployment authority. No host reboot is authorized."