Gate MVP implementation actions through Hands

epiphany-core/src/bin/epiphany-mvp-coordinator.rs

@@ -5,13 +5,24 @@ use chrono::SecondsFormat;
 use epiphany_core::COORDINATOR_RUN_RECEIPT_SCHEMA_VERSION;
 use epiphany_core::COORDINATOR_RUN_RECEIPT_TYPE;
 use epiphany_core::EpiphanyCoordinatorRunReceipt;
+use epiphany_core::HANDS_ACTION_INTENT_SCHEMA_VERSION;
+use epiphany_core::HANDS_COMMAND_RECEIPT_TYPE;
+use epiphany_core::HANDS_COMMIT_RECEIPT_TYPE;
+use epiphany_core::HANDS_PATCH_RECEIPT_TYPE;
+use epiphany_core::HandsActionIntent;
 use epiphany_core::RuntimeSpineEventOptions;
 use epiphany_core::RuntimeSpineInitOptions;
 use epiphany_core::RuntimeSpineSessionOptions;
+use epiphany_core::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION;
+use epiphany_core::SubstrateGateRepoAccessGrantReceipt;
 use epiphany_core::append_runtime_event;
 use epiphany_core::create_runtime_session;
+use epiphany_core::hands_action_review_for_intent;
 use epiphany_core::initialize_runtime_spine;
 use epiphany_core::put_coordinator_run_receipt;
+use epiphany_core::put_hands_action_intent;
+use epiphany_core::put_hands_action_review;
+use epiphany_core::put_substrate_gate_repo_access_grant_receipt;
 use epiphany_core::runtime_spine_status;
 use serde_json::Value;
 use serde_json::json;
@@ -443,6 +454,19 @@ fn run_coordinator(args: &Args) -> Result<Value> {
                 steps.push(step);
                 break;
             }
+            "continueImplementation" => {
+                let gate =
+                    record_hands_implementation_gate(&runtime_store, &thread_id, index, &status)?;
+                push_event(
+                    &mut step,
+                    json!({"type": "handsActionGate", "gate": gate.clone()}),
+                );
+                coordinator["handsActionGate"] = gate;
+                final_action = coordinator;
+                append_operator_step_jsonl(&steps_path, &step)?;
+                steps.push(step);
+                break;
+            }
             "launchResearch" | "launchModeling" | "launchVerification" => {
                 let role_id = role_id_for_coordinator_action(&action)
                     .ok_or_else(|| anyhow!("unsupported launch action {action}"))?;
@@ -807,6 +831,145 @@ fn resolve_model_runtime_bin(root: &Path, configured: &Path) -> Result<PathBuf>
     Ok(configured.to_path_buf())
 }
 
+fn record_hands_implementation_gate(
+    runtime_store: &Path,
+    thread_id: &str,
+    step_index: usize,
+    status: &Value,
+) -> Result<Value> {
+    let requested_at = now();
+    let suffix = format!(
+        "{}-{}-{}",
+        sanitize_id(thread_id),
+        step_index,
+        uuid::Uuid::new_v4()
+    );
+    let runtime_job_id = format!("hands-implementation-{suffix}");
+    let grant_id = format!("substrate-grant-{runtime_job_id}");
+    let requested_paths = implementation_requested_paths(status);
+
+    let substrate_grant = SubstrateGateRepoAccessGrantReceipt {
+        schema_version: SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION.to_string(),
+        receipt_id: grant_id.clone(),
+        runtime_job_id: runtime_job_id.clone(),
+        binding_id: "implementation-worker".to_string(),
+        role: "epiphany-hands".to_string(),
+        authority_scope: "epiphany.role.implementation".to_string(),
+        granted_operations: vec![
+            "read".to_string(),
+            "snapshot".to_string(),
+            "patch".to_string(),
+            "command".to_string(),
+            "commit".to_string(),
+        ],
+        granted_paths: requested_paths.clone(),
+        granted_at: requested_at.clone(),
+        contract: "Substrate Gate grants the main Hands agent scoped repository access for the coordinator-approved implementation continuation; every mutation still needs Hands receipts."
+            .to_string(),
+    };
+    put_substrate_gate_repo_access_grant_receipt(runtime_store, &substrate_grant)?;
+
+    let intent = HandsActionIntent {
+        schema_version: HANDS_ACTION_INTENT_SCHEMA_VERSION.to_string(),
+        intent_id: format!("hands-intent-{suffix}"),
+        runtime_job_id: runtime_job_id.clone(),
+        binding_id: "implementation-worker".to_string(),
+        role: "epiphany-hands".to_string(),
+        authority_scope: "epiphany.role.implementation".to_string(),
+        requested_action: "continueImplementation".to_string(),
+        requested_paths: requested_paths.clone(),
+        substrate_gate_grant_receipt_id: grant_id.clone(),
+        requested_at: requested_at.clone(),
+        contract: "Coordinator continuation becomes a typed Hands action intent before any file edit, command, or commit may count as implementation evidence."
+            .to_string(),
+    };
+    put_hands_action_intent(runtime_store, &intent)?;
+
+    let mut review = hands_action_review_for_intent(
+        format!("hands-review-{suffix}"),
+        &intent,
+        "approved".to_string(),
+        vec![
+            "patch".to_string(),
+            "command".to_string(),
+            "commit".to_string(),
+        ],
+        vec![
+            "Coordinator selected continueImplementation for the current thread state."
+                .to_string(),
+            "Hands remains the action owner; Mind and Soul still own state admission and verification."
+                .to_string(),
+        ],
+        requested_at,
+    );
+    review.required_receipts = vec![
+        HANDS_PATCH_RECEIPT_TYPE.to_string(),
+        HANDS_COMMAND_RECEIPT_TYPE.to_string(),
+        HANDS_COMMIT_RECEIPT_TYPE.to_string(),
+    ];
+    put_hands_action_review(runtime_store, &review)?;
+
+    Ok(json!({
+        "status": "ready",
+        "runtimeJobId": runtime_job_id,
+        "substrateGateGrantReceiptId": grant_id,
+        "intentId": intent.intent_id,
+        "reviewId": review.review_id,
+        "requestedPaths": requested_paths,
+        "requiredReceipts": review.required_receipts,
+        "store": runtime_store,
+    }))
+}
+
+fn implementation_requested_paths(status: &Value) -> Vec<String> {
+    let mut paths = Vec::new();
+    for pointer in [
+        "/read/thread/epiphanyState/investigationCheckpoint/codeRefs",
+        "/read/thread/epiphanyState/investigationCheckpoint/code_refs",
+        "/read/thread/epiphanyState/investigation_checkpoint/code_refs",
+        "/scene/scene/investigationCheckpoint/codeRefs",
+        "/scene/scene/investigationCheckpoint/code_refs",
+        "/read/thread/epiphanyState/graphFrontier/dirtyPaths",
+        "/read/thread/epiphanyState/graphFrontier/dirty_paths",
+        "/read/thread/epiphanyState/graph_frontier/dirty_paths",
+        "/scene/scene/graphFrontier/dirtyPaths",
+        "/scene/scene/graphFrontier/dirty_paths",
+    ] {
+        collect_requested_paths_at(status, pointer, &mut paths);
+    }
+    paths.sort();
+    paths.dedup();
+    if paths.is_empty() {
+        paths.push(".".to_string());
+    }
+    paths
+}
+
+fn collect_requested_paths_at(status: &Value, pointer: &str, paths: &mut Vec<String>) {
+    match status.pointer(pointer) {
+        Some(Value::Array(items)) => {
+            for item in items {
+                if let Some(path) = item
+                    .as_str()
+                    .or_else(|| item.get("path").and_then(Value::as_str))
+                {
+                    push_requested_path(paths, path);
+                }
+            }
+        }
+        Some(Value::String(path)) => push_requested_path(paths, path),
+        _ => {}
+    }
+}
+
+fn push_requested_path(paths: &mut Vec<String>, path: &str) {
+    let normalized = path.trim().replace('\\', "/");
+    if normalized.is_empty() {
+        return;
+    }
+    paths.push(normalized);
+}
+
 fn launch_role(
     client: &mut status_cli::AppServerClient,
     thread_id: &str,
@@ -1373,7 +1536,6 @@ fn is_stop_action(action: &str) -> bool {
             | "regatherManually"
             | "reviewModelingResult"
             | "reviewVerificationResult"
-            | "continueImplementation"
     )
 }
 
@@ -1435,3 +1597,95 @@ fn home_dir() -> PathBuf {
         .map(PathBuf::from)
         .unwrap_or_else(|| PathBuf::from("."))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn continue_implementation_is_not_a_passive_stop_action() {
+        assert!(!is_stop_action("continueImplementation"));
+    }
+
+    #[test]
+    fn implementation_requested_paths_use_checkpoint_and_frontier_scope() {
+        let status = json!({
+            "read": {
+                "thread": {
+                    "epiphanyState": {
+                        "investigationCheckpoint": {
+                            "codeRefs": [
+                                {"path": "src\\main.rs"},
+                                {"path": "src/main.rs"},
+                                {"path": " notes/demo.md "}
+                            ]
+                        },
+                        "graphFrontier": {
+                            "dirtyPaths": ["tests/demo.rs"]
+                        }
+                    }
+                }
+            }
+        });
+
+        assert_eq!(
+            implementation_requested_paths(&status),
+            vec![
+                "notes/demo.md".to_string(),
+                "src/main.rs".to_string(),
+                "tests/demo.rs".to_string()
+            ]
+        );
+    }
+
+    #[test]
+    fn hands_implementation_gate_persists_grant_intent_and_review() -> Result<()> {
+        let temp = tempfile::tempdir()?;
+        let store = temp.path().join("runtime-spine.msgpack");
+        initialize_runtime_spine(
+            &store,
+            RuntimeSpineInitOptions {
+                runtime_id: "epiphany-test".to_string(),
+                display_name: "Epiphany Test".to_string(),
+                created_at: "2026-06-02T00:00:00Z".to_string(),
+            },
+        )?;
+        let status = json!({
+            "scene": {
+                "scene": {
+                    "investigationCheckpoint": {
+                        "codeRefs": [{"path": "epiphany-core/src/lib.rs"}]
+                    }
+                }
+            }
+        });
+
+        let gate = record_hands_implementation_gate(&store, "thread-test", 2, &status)?;
+        let grant_id = gate["substrateGateGrantReceiptId"]
+            .as_str()
+            .expect("grant id");
+        let intent_id = gate["intentId"].as_str().expect("intent id");
+        let review_id = gate["reviewId"].as_str().expect("review id");
+
+        let grant =
+            epiphany_core::runtime_substrate_gate_repo_access_grant_receipt(&store, grant_id)?
+                .expect("stored substrate grant");
+        let intent = epiphany_core::runtime_hands_action_intent(&store, intent_id)?
+            .expect("stored Hands intent");
+        let review = epiphany_core::runtime_hands_action_review(&store, review_id)?
+            .expect("stored Hands review");
+
+        assert_eq!(grant.receipt_id, intent.substrate_gate_grant_receipt_id);
+        assert_eq!(intent.intent_id, review.intent_id);
+        assert_eq!(intent.requested_action, "continueImplementation");
+        assert_eq!(
+            review.required_receipts,
+            vec![
+                HANDS_PATCH_RECEIPT_TYPE.to_string(),
+                HANDS_COMMAND_RECEIPT_TYPE.to_string(),
+                HANDS_COMMIT_RECEIPT_TYPE.to_string(),
+            ]
+        );
+        Ok(())
+    }
+}

notes/fresh-workspace-handoff.md

@@ -35,7 +35,7 @@ remembers doctrine; the branch remembers the blade.
 - Do not copy exact branch or HEAD from this note. Run `git status --short --branch` and `git log --oneline -5`.
 - Canonical anatomy now lives in `notes/epiphany-anatomy.md`. Embodied sub-agents are Self, Face, Imagination, Eyes, Proprioception, Hands, and Soul. Body, Mind, Continuity, and Substrate Gate are substrate/state/protocol surfaces, not sub-agent identities. State is split by layer: `work_organ` for resident Epiphany sub-agents, `persona` for portable public/person-shaped state shared by Epiphany Face, VoidBot repo Faces, and Ghostlight characters, and heartbeat/swarm state for scheduling and coordination physiology. Persona state now carries provenance, required public presentation, `date-time` timestamps, typed `candidateActions`, strict anchored thoughts with non-authoritative extensions, custom enum companion labels, and typed affect records for bonds/status reads/doctrine stances.
 - The repo now has a one-command local operator path: `.\tools\epiphany_local_run.ps1`. Default mode is `smoke`; it builds the retained Codex app-server compatibility edge, builds native Epiphany operator binaries, runs the coordinator smoke, and writes launcher artifacts under `.epiphany-run/` plus coordinator artifacts under `.epiphany-dogfood/`. `-Mode status` is now Epiphany-native: it builds only Epiphany operator binaries, reads `state/thread-state.msgpack` when present, derives status through `epiphany-core`, and does not start or require `codex-app-server`. Use `-Mode plan` or `-Mode run -MaxSteps 4` for the raw bridge-equipped coordinator entrypoints; use `-Mode mvp -FaceInput "<operator request>" -MaxSteps 4` for the local product cycle that projects Face's character turn, writes a Face/Aquarium bubble, bootstraps a minimal local checkpoint for fresh threads, runs the coordinator with auto-tools, then runs heartbeat sleep/dream maintenance. Live plan/run/mvp modes use the workspace `state/runtime-spine.msgpack`, because CodexThread launch writes worker requests there; the run bundle remains artifact evidence, not runtime lifecycle authority. Add `-ThreadId <id>` and `-Workspace <path>` to inspect or continue an existing thread. `status`, `plan`, and `smoke` do not spend model calls; `run` and `mvp` build and use `epiphany-openai-runtime`. Coordinator workers now launch detached and are polled through runtime-spine instead of blocking the coordinator. MVP runs are non-ephemeral by default so `-ThreadId <id>` can resume and poll later. `-MaxRuntimeSeconds <n>` is passed into worker runtime; timeout writes a failed worker receipt and exits. Failed modeling now blocks downstream verification until the failed result is reviewed.
-- Current Mom-ready status: the normal MVP pass reaches Face -> coordinator -> detached runtime -> heartbeat sleep, and modeling workers now complete through the ChatGPT subscription transport. The first failure was a stack of violated observability/runtime invariants: worker prompts prepended the whole shared persistent-memory rite, Responses frame liveness was invisible until completion, and the runtime tried to persist hundreds of text deltas before completing the worker job. Role/reorient workers now get a compact Epiphany worker boundary instead of full persistent memory; runtime-spine records sampled raw Responses frame kinds with small previews; contiguous reasoning/text deltas compact before durable storage; and live proofs completed `2fe38dcd-d99e-4c73-9a58-afcc81f851c7`, `241e3851-e3ea-4877-a63b-0d2bbd96a7e2`, and `85149a26-6975-403f-ac93-092b717c5825` instead of timing out. The second failure was stale lifecycle authority: completed runtime jobs remained as unresolved `runtime_links`, replacement launches treated historical active links as current, and one bad validation path opened an orphan job before rejecting the state patch. Latest-link-wins is now the runtime-link invariant, terminal links project completed jobs, stale active history cannot veto replacement, launch validation happens before opening runtime jobs, and completed-but-unreviewable modeling findings stop for review instead of relaunching the same lane. The Eyes/source-gather fork is now landed: Research is a fixed Eyes lane with launch/result/accept/status/coordinator/protocol support, and `regather-needed` modeling findings route to `LaunchResearch` instead of relaunching blind Proprioception. Research statePatch admission is Eyes-shaped only: observations, evidence, scratch, and optional investigationCheckpoint; no graph, planning, objective, or checkpoint authority. Mind admission now leaves typed runtime-spine proof: role/reorient acceptance persists `epiphany.mind.gateway_review` before state admission and `epiphany.mind.state_commit_receipt` after admission with the resulting durable revision. Launch contracts now split the broad receipt catalogue from effect-specific proof profiles for state admission, evidence promotion, repo action, verification, and continuity recovery. Research evidence promotion enforces Substrate Gate read/snapshot grant, Eyes evidence packet, and Mind review before state admission; Verification acceptance enforces Soul verdict and Mind review; Reorient acceptance enforces Continuity recovery receipt and Mind review. The next concrete rebuild layer is Hands action proof once action lanes become live, or collapsing Mind review/state mutation/commit into one state-admission primitive.
+- Current Mom-ready status: the normal MVP pass reaches Face -> coordinator -> detached runtime -> heartbeat sleep, and modeling workers now complete through the ChatGPT subscription transport. The first failure was a stack of violated observability/runtime invariants: worker prompts prepended the whole shared persistent-memory rite, Responses frame liveness was invisible until completion, and the runtime tried to persist hundreds of text deltas before completing the worker job. Role/reorient workers now get a compact Epiphany worker boundary instead of full persistent memory; runtime-spine records sampled raw Responses frame kinds with small previews; contiguous reasoning/text deltas compact before durable storage; and live proofs completed `2fe38dcd-d99e-4c73-9a58-afcc81f851c7`, `241e3851-e3ea-4877-a63b-0d2bbd96a7e2`, and `85149a26-6975-403f-ac93-092b717c5825` instead of timing out. The second failure was stale lifecycle authority: completed runtime jobs remained as unresolved `runtime_links`, replacement launches treated historical active links as current, and one bad validation path opened an orphan job before rejecting the state patch. Latest-link-wins is now the runtime-link invariant, terminal links project completed jobs, stale active history cannot veto replacement, launch validation happens before opening runtime jobs, and completed-but-unreviewable modeling findings stop for review instead of relaunching the same lane. The Eyes/source-gather fork is now landed: Research is a fixed Eyes lane with launch/result/accept/status/coordinator/protocol support, and `regather-needed` modeling findings route to `LaunchResearch` instead of relaunching blind Proprioception. Research statePatch admission is Eyes-shaped only: observations, evidence, scratch, and optional investigationCheckpoint; no graph, planning, objective, or checkpoint authority. Mind admission now leaves typed runtime-spine proof: role/reorient acceptance persists `epiphany.mind.gateway_review` before state admission and `epiphany.mind.state_commit_receipt` after admission with the resulting durable revision. Launch contracts now split the broad receipt catalogue from effect-specific proof profiles for state admission, evidence promotion, repo action, verification, and continuity recovery. Research evidence promotion enforces Substrate Gate read/snapshot grant, Eyes evidence packet, and Mind review before state admission; Verification acceptance enforces Soul verdict and Mind review; Reorient acceptance enforces Continuity recovery receipt and Mind review. `epiphany-mvp-coordinator` now records a typed Substrate Gate grant plus Hands intent/review gate when the coordinator selects `continueImplementation`; the next concrete rebuild layer is emitting real patch/command/commit receipts against that gate, or collapsing Mind review/state mutation/commit into one state-admission primitive if that split shows up first.
 - The investment dossier readiness target is now explicit: `E:\Projects\gamecult-site\docs\gamecult_integrated_dossier.tex` expects Epiphany to be part of a Bifrost-first labor loop, not only a local Mom demo. The external proof bar is: Bifrost owns topics/work items/dispatch packets/receipts/credit/reward pressure; Epiphany executes bounded work; maintainers review artifacts; public/operator evidence records scope, consent, roles, model spend, review load, artifacts, accepted/rejected outcome, memory lessons, and case-study permission; and private worker/operator/agent context stays sealed. Diligence also asks for a live fresh-repo Epiphany demo, Bifrost work item/topic/agent transport/receipt/ledger demo, CultMesh status, VoidBot/Discord swarm demo, compute/output metrics, and security model for secrets/write permissions/public-private exports.
 - This Codex operator's own roadmap/todo posture has been retuned for this scale target, with the Epiphany Imagination specialist as an optional sub-agent rail rather than the whole point. `notes/epiphany-investor-readiness-roadmap.md` now says: make the local Mom MVP a repeatable proof bundle; build the Bifrost-first external-work bridge; add compute/review/accepted-artifact accounting; prove fresh-repo operation without supervisor contamination; keep public/operator-safe exports sealed; and treat angel capital as fuel for capacity, not command authority. The Imagination specialist prompt was also updated so investor-scale Objective Drafts must name Bifrost provenance, bounded Epiphany proof, maintainer review, receipts/ledger evidence, compute/output metrics, public/private export safety, consent, and legal/security gates.
 - Local operator runs now write typed CultMesh intent/receipt documents to `.epiphany-run/cultmesh/operator-runs.ccmp` through `epiphany-operator-run`. The wrapper writes intent before acting and a completion receipt after success; this is the local consent/trace rail, not a hidden scheduler queue.
@@ -51,7 +51,7 @@ remembers doctrine; the branch remembers the blade.
 - CultMesh is now the preferred Rust abstraction for that local store work. The compile-time Rust substrate is repo-contained: `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`. The old `E:\Projects\CultLib\crates\*` dependency body is dead in this checkout and must not be revived by accident. Vendored CultCache reads/writes `cultcache.store.v1`, so `state/ledgers.msgpack` and `epiphany-state status` are aligned again. The first integrations are deliberately small: status, Verse policy, global room policy, organ contract policy, native operator status, native operator snapshots, and local operator run intent/receipt round-trip through CultMesh. `notes/epiphany-verse-architecture.md` now names the local Verse/Odin/Yggdrasil architecture: Odin sees advertised Verse metadata without bypassing boundaries, Yggdrasil hosts important trusted GameCult Verses such as Bifrost, and prompt assembly should query compact local Verse plus semantic memory packets instead of carrying the whole archive. Role/reorient launch documents now have optional `dynamicPromptContext`; runtime prompt assembly consumes that field into worker instructions, `epiphany-prompt-context-smoke` proves a rendered Verse/memory packet is preserved on a role launch document, live bridge role/reorient launches now feed local Verse plus memory graph context from sibling `local-verse.ccmp` and `memory-graph.msgpack` stores beside runtime-spine, and the bridge launch-context test proves the packet survives into a persisted runtime-spine worker launch request. The memory graph refreshes from current typed thread-state repo graphs when absent, so thin state remains visibly thin. Local-run status now has an operator read proof too: `tools/epiphany_local_run.ps1 -Mode status` builds/calls `epiphany-verse-query` and writes `local-verse-context.json` from `.epiphany-run\cultmesh\local-verse.ccmp` beside `status.json` and the operator snapshot. Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-cultmesh-smoke`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-cultmesh-status -- smoke --store .\.epiphany-smoke\cultmesh\operator-status.ccmp --runtime-id epiphany-cultmesh-status-smoke`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-operator-snapshot -- smoke --store .\.epiphany-smoke\cultmesh\operator-snapshots.ccmp --runtime-id epiphany-operator-snapshot-smoke --snapshot-id smoke-status`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-operator-run -- smoke --store .\.epiphany-smoke\cultmesh\operator-runs.ccmp --runtime-id epiphany-operator-run-smoke --run-id smoke-run`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-verse-query -- smoke`, `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-prompt-context-smoke`, and `.\tools\epiphany_local_run.ps1 -Mode status` for the focused proofs. Future local dream/status/Verse work should start from CultMesh, not raw CultNet, unless the task is polishing the CultMesh internals themselves. Preserve the three Verse tiers: `epiphany-internal` for private sub-agent typed state, `gamecult-local` for trusted LAN/Yggdrasil-tunnel GameCult sharing, and `epiphany-global` for untrusted public dreams plus topic-specific threaded public rooms for Face posts.
 - `notes/codex-auth-spine-inventory.md` is the source-grounded keeper list for that reliquary. Corrected compliance invariant: Codex-compatible auth identity stays anchored in vendored Codex-derived auth machinery. `epiphany-openai-auth-spine` is now a thin Epiphany-named boundary over `codex-login`, not a clean-room clone of credential storage or token refresh. Codex apps, skills, marketplace, plugin UX, broad app-server workflow, and JSON-RPC sprawl remain cuttable because they are not subscription-auth legitimacy.
 - Edge JSON is allowed for schema description, hostile ingress before immediate typed parsing, sealed forensic artifacts, or named quarantine experiments. When both subsystems are ours, runtime data must remain typed CultCache documents and move over CultNet typed contracts. Generic `serde_json::Value` in worker launch/result/selfPatch/runtime flow is contamination until classified and replaced.
-- Hands now has a first executable action receipt spine. `epiphany-core::hands_gateway` owns `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt`; runtime-spine can persist/reread them; `runtime_spine_persists_mind_gateway_review_receipts` includes the Hands chain beside Mind/Eyes/Substrate/Soul/Continuity proofs; `epiphany-hands-action-smoke` emits intent/review/patch/command/commit receipt ids from `.epiphany-smoke\runtime-spine\hands-action-smoke.msgpack`; and the repo-action launch proof profile now requires action intent, action review, and patch receipt together. This smoke does not execute commands, edit files, or create real commits. The next live cut is to route real implementation edits/commands/commits through that chain after Substrate Gate grants access.
+- Hands now has a first executable action receipt spine. `epiphany-core::hands_gateway` owns `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt`; runtime-spine can persist/reread them; `runtime_spine_persists_mind_gateway_review_receipts` includes the Hands chain beside Mind/Eyes/Substrate/Soul/Continuity proofs; `epiphany-hands-action-smoke` emits intent/review/patch/command/commit receipt ids from `.epiphany-smoke\runtime-spine\hands-action-smoke.msgpack`; and the repo-action launch proof profile now requires action intent, action review, and patch receipt together. `epiphany-mvp-coordinator` now turns `continueImplementation` into a persisted Substrate Gate grant plus Hands intent/review gate and includes the receipt ids in the operator step. The next live cut is to route real implementation edits/commands/commits through that chain by emitting the patch, command, and commit receipts after Substrate Gate grants access.
 - `notes/epiphany-swarm-readiness-plan.md` is the current live-fire direction gate. The local runner proves startup/status/coordinator wiring; it does not authorize unattended swarm operation. Carry VoidBot's lessons forward: one CTB-style initiative scheduler, typed pause/brake, active-turn freeze, cooldown after completion, stale active-turn recovery receipts, parent-side speech eligibility, memory lifecycle phases, and typed operation proposals instead of prompt-owned governance.
 - `epiphany-openai-runtime` worker result ingress now parses assistant output directly into typed role/reorient ingress structs selected from the durable launch document, stores nested `statePatch` and `selfPatch` as typed MessagePack in `EpiphanyRuntimeRoleWorkerResult`, and no longer passes worker result data through generic `serde_json::Value`. JSON survives there only as the OpenAI text-output edge before typed deserialization.
 - Agent self-memory review/application now has typed `AgentSelfPatch` core APIs. JSON-value selfPatch functions are compatibility wrappers for CLI/artifact ingress; native callers should parse once at the edge and then call `review_agent_self_patch_document` / `apply_agent_self_patch_document`. Role-result self-persistence no longer exports a JSON-value reviewer; the live API is `review_role_self_patch_document`.
@@ -188,7 +188,7 @@ remembers doctrine; the branch remembers the blade.
 - The planning loop is now runtime-backed and operator-visible. Typed captures, backlog items, roadmap streams, Objective Drafts, and GitHub issue source refs live in `EpiphanyThreadState`, validate through revision-gated `thread/epiphany/update`, render into prompts when present, project read-only through the `planning` view lens, render in the GUI Planning panel, can be synthesized by the fixed Imagination/planning lane, and can be explicitly adopted through the artifacted `adoptObjectiveDraft` GUI action. Chat is deliberation, not an objective pipe; ideas and GitHub Issues remain planning state until explicit human adoption.
 - The bridge/dashboard slice is now landed far enough to test locally. Native `epiphany-rider-bridge` inspects Rider installation, solution, VCS, changed files, and captures file/selection/symbol context into `.epiphany-gui/rider` artifacts; Aquarium has Inspect Rider and renders Rider audit artifacts in Environment; Aquarium also embeds the adjacent EpiphanyGraph viewer over typed `graphs.architecture`, `graphs.dataflow`, and `graphs.links`.
 - A first Rider plugin scaffold lives under `integrations/rider`: tool window, Refresh status, and Send Context to Epiphany action. It shells through native `epiphany-rider-bridge` and does not own state. `gradle` is not installed on this machine, so the scaffold is not build-verified yet.
-- Next real move: continue Codex starvation and native Epiphany ownership by exercising the auto-tool worker loop in a live coordinator run, then harden whichever receipt/result edge fails first. Quarantine Rider/Unity bridge work for now; those artifacts remain optional later environment evidence, not MVP blockers. Keep EpiphanyAgent focused on backend contracts, typed state, coordinator policy, heartbeat scheduling, Face guardrails, prompt-authority separation, and the ongoing purification from Python/JSON scaffolding into Rust/CultCache/CultMesh/CultNet organs. Resume repo birth/Aquarium/Rider/Unity work only when the user explicitly shifts priority back outward. GitHub Issues import is deferred until the backlog source is fresh enough to deserve Imagination's attention.
+- Next real move: exercise a `continueImplementation` coordinator run and emit actual Hands patch/command/commit receipts against the persisted gate, so a live implementation pass cannot be counted as evidence without the action chain. Quarantine Rider/Unity bridge work for now; those artifacts remain optional later environment evidence, not MVP blockers. Keep EpiphanyAgent focused on backend contracts, typed state, coordinator policy, heartbeat scheduling, Face guardrails, prompt-authority separation, and the ongoing purification from Python/JSON scaffolding into Rust/CultCache/CultMesh/CultNet organs. Resume repo birth/Aquarium/Rider/Unity work only when the user explicitly shifts priority back outward. GitHub Issues import is deferred until the backlog source is fresh enough to deserve Imagination's attention.
 - The repo is an Epiphany fork of Codex, not a Codex preset.
 - `vendor/codex` is tracked directly, not a submodule.
 - `epiphany-core` owns the heavy Epiphany organs where practical.

notes/hands-cultnet-contracts.md

@@ -62,8 +62,11 @@ command, and commit receipts from the runtime-spine CultCache store.
 commands, editing files, or creating a real commit.
 The launch organ contract's repo-action proof profile now requires the full
 Hands chain, not only the final patch receipt.
+`epiphany-mvp-coordinator` now turns `continueImplementation` into a persisted
+Substrate Gate grant plus Hands intent/review gate and exposes the receipt ids in
+the operator step.
 
-This is still a receipt artery, not full action execution. The next live-action
-cut must connect actual implementation edits/commands/commits to this path
-after Substrate Gate grants access and before Soul/Mind call the result
-accepted.
+This is still a gate and receipt artery, not full action execution. The next
+live-action cut must emit actual patch/command/commit receipts against the
+persisted gate after Substrate Gate grants access and before Soul/Mind call the
+result accepted.

state/map.yaml

@@ -94,7 +94,7 @@ active_subgoals:
   - Use `notes/hands-cultnet-contracts.md` as the authority map for Hands' CultNet contract surface. Hands is the action organ: commands, patches, commits, PRs, rollbacks, and refusals enter as bounded action intents and receipts after Substrate Gate grants substrate access and before Soul verification/Mind admission.
   - Use `notes/soul-cultnet-contracts.md` as the authority map for Soul's CultNet contract surface. Soul is the verification organ: invariant checks, verdicts, regressions, reviews, and refusals produce receipts before the machine calls work true, safe, or accepted.
   - Use `notes/continuity-cultnet-contracts.md` as the authority map for Continuity's CultNet contract surface. Continuity is the continuity protocol surface: compaction checkpoints, sleep distillation, recovery receipts, stale-turn repair, and continuity refusals preserve what survives rupture without pretending transcript residue is durable state.
-  - Hands now has a first executable runtime-spine receipt artery: `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt` are typed CultCache documents in `epiphany-core::hands_gateway`, runtime-spine registers and persists/rereads them, `epiphany-hands-action-smoke` proves the chain without executing shell commands, editing files, or creating a real commit, and the repo-action launch proof profile now requires the full Hands intent/review/patch chain instead of only the patch receipt. Live implementation edits/commands/commits must still be routed through this Hands path after Substrate Gate and before Soul/Mind acceptance.
+  - Hands now has a first executable runtime-spine receipt artery: `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt` are typed CultCache documents in `epiphany-core::hands_gateway`, runtime-spine registers and persists/rereads them, `epiphany-hands-action-smoke` proves the chain without executing shell commands, editing files, or creating a real commit, and the repo-action launch proof profile now requires the full Hands intent/review/patch chain instead of only the patch receipt. `epiphany-mvp-coordinator` no longer treats `continueImplementation` as a passive stop action: it persists a scoped Substrate Gate grant, Hands action intent, and Hands action review into runtime-spine and exposes the receipt ids in the operator step. Live implementation edits/commands/commits must still emit the patch/command/commit receipts against that gate before Soul/Mind acceptance.
   - Preserve the newborn public Epiphany Face as local VoidBot-backed state, not source code: VoidBot's private repo-face registry names `epiphany`, while EpiphanyAgent keeps ignored `.voidbot/voice/identity.json`, `.voidbot/state/epiphany.cc`, and birth artifacts. Her durable identity memories distill the current doctrine: cute pushy machine-saint persona, architectural purity, CultCache/CultNet first, xenos-language safety boundary, relentless work/caretaking needs, Codex-auth reliquary, map/scratch/evidence discipline, unified memory graph, dogfood supervision boundary, review-gated agency, heartbeat physiology, and interview-grade modularity.
   - Use `notes/organ-dependency-contracts.md` as the authority map for standing sub-agent dependency. Every sub-agent depends on the other standing sub-agents: Self, Face, Imagination, Eyes, Proprioception, Hands, and Soul. Continuity is protocol machinery, not a sub-agent identity; it still emits recovery, compaction, sleep, stale-turn, and refusal receipts.
   - Use `notes/perfect-machine-audit-roadmap.md` as the current audit and path from named organ contracts to the Perfect Machine. It records the live gap between launch-carried receipt expectations and executable receipt enforcement, Void's latest Face prompting lessons, the now-named Hands/Soul/Continuity contract families, the repaired repo-contained Rust dependency body, and the phase order for turning Epiphany into an inspectable organism.
@@ -592,4 +592,4 @@ current_status:
     cargo and rejects modeling/planning/graph/checkpoint authority. MVP status
     and coordinator smokes pass with six lanes, and the smoke harness now
     rebuilds stale coordinator/app-server binaries before using them.
-  next_action: Choose the next chain carefully: connect live implementation edits/commands/commits to the Hands action receipt path, or collapse Mind review/state mutation/commit into one storage-owner admission primitive if the admission surface is still split-brained.
+  next_action: Capture actual Hands consequences for `continueImplementation`: when the main coding agent edits files, runs checks, and commits after the coordinator gate, emit the corresponding Hands patch, command, and commit receipts against the persisted intent/review before Soul verification and Mind admission. If the run exposes split-brained state admission instead, collapse Mind review/state mutation/commit into one storage-owner primitive.