Type metrics request closure semantics

epiphany-core/src/bin/epiphany-work.rs

@@ -8279,114 +8279,82 @@ fn closure_family_assertions(
             );
         }
         "repo.metrics_request" => {
+            let request = parse_repo_metrics_request(&content).ok();
             push_assertion(
                 &mut assertions,
                 "metrics-request-schema-present",
-                content.contains("schema_version = \"epiphany.repo_metrics_request.v0\""),
+                request
+                    .as_ref()
+                    .is_some_and(RepoMetricsRequest::has_canonical_identity),
                 "Committed metrics request carries the schema version.".to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "metrics-request-family-present",
-                content.contains("safe_action_family = \"repo.metrics_request\""),
+                request
+                    .as_ref()
+                    .is_some_and(RepoMetricsRequest::has_canonical_identity),
                 "Committed metrics request carries the safe action family.".to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "metrics-request-summary-present",
-                content.contains(&compact_summary),
+                request
+                    .as_ref()
+                    .is_some_and(|request| request.summary == compact_summary),
                 "Committed metrics request contains the accepted pressure summary.".to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "metrics-request-awaits-review",
-                content.contains("[request]")
-                    && content.contains("status = \"awaiting-metrics-review\"")
-                    && content.contains("requested_owner = \"Bifrost/Maintainer\"")
-                    && content.contains(
-                        "requested_effect = \"record-compute-review-and-artifact-accounting\"",
-                    )
-                    && content.contains("publication_request_ref = ")
-                    && content.contains("credit_request_ref = ")
-                    && content.contains("artifact_acceptance_request_ref = "),
+                request
+                    .as_ref()
+                    .is_some_and(RepoMetricsRequest::awaits_owned_review),
                 "Committed metrics request waits for Bifrost/maintainer review before consequence."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "metrics-request-antecedents-present",
-                content.contains("[antecedents]")
-                    && content.contains("closure_review_required = true")
-                    && content.contains("soul_verdict_required = true")
-                    && content.contains("mind_commit_required = true")
-                    && content.contains("public_proof_required = true")
-                    && content.contains("accepted_artifact_required = true")
-                    && content.contains("credit_request_required = true"),
+                request
+                    .as_ref()
+                    .is_some_and(RepoMetricsRequest::has_antecedent_contract),
                 "Committed metrics request requires closure, Soul, Mind, proof, accepted artifact, and credit request antecedents."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "metrics-request-receipt-contract",
-                content.contains("[required_receipts]")
-                    && content.contains(
-                        "closure_review = \"epiphany.repo_work_closure_review.v0\"",
-                    )
-                    && content.contains(
-                        "soul_verdict = \"epiphany.soul.verification_verdict\"",
-                    )
-                    && content.contains("mind_commit = \"epiphany.mind.state_commit_receipt\"")
-                    && content.contains(
-                        "public_proof = \"epiphany.repo_work_public_proof_bundle.v0\"",
-                    )
-                    && content.contains(
-                        "accepted_artifact = \"gamecult.artifact.acceptance_receipt.v0\"",
-                    )
-                    && content.contains("model_spend = \"gamecult.metrics.model_spend_receipt.v0\"")
-                    && content.contains("review_load = \"gamecult.metrics.review_load_receipt.v0\"")
-                    && content.contains(
-                        "credit_readback = \"gamecult.bifrost.credit_readback_receipt.v0\"",
-                    ),
+                request
+                    .as_ref()
+                    .is_some_and(RepoMetricsRequest::has_receipt_contract),
                 "Committed metrics request names closure, proof, artifact, spend, review-load, and credit readback receipts."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "metrics-request-packet-contract",
-                content.contains("[metrics_packet]")
-                    && content.contains("requires_model_call_count = true")
-                    && content.contains("requires_token_or_cost_summary = true")
-                    && content.contains("requires_review_minutes_or_count = true")
-                    && content.contains("requires_accepted_artifact_ref = true")
-                    && content.contains("requires_public_proof_ref = true")
-                    && content.contains("requires_credit_readback_ref = true")
-                    && content.contains("requires_private_state_redaction_check = true"),
+                request
+                    .as_ref()
+                    .is_some_and(RepoMetricsRequest::has_metrics_packet),
                 "Committed metrics request names model-call, cost, review-load, artifact, proof, credit, and redaction requirements."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "metrics-request-authority-seals",
-                content.contains("[authority]")
-                    && content.contains("metrics_ledger_authorized = false")
-                    && content.contains("spend_authorized = false")
-                    && content.contains("review_load_authorized = false")
-                    && content.contains("credit_ledger_authorized = false")
-                    && content.contains("github_pr_authorized = false")
-                    && content.contains("merge_authorized = false")
-                    && content.contains("publication_authorized = false")
-                    && content.contains("upstream_sync_authorized = false")
-                    && content.contains("hands_action_authorized = false")
-                    && content.contains("cross_body_mutation_authorized = false")
-                    && content
-                        .contains("bifrost_or_maintainer_metrics_authority_required = true"),
+                request
+                    .as_ref()
+                    .is_some_and(RepoMetricsRequest::has_authority_seals),
                 "Committed metrics request denies metrics/spend/review/credit/PR/merge/publication/sync/action/cross-body authority."
                     .to_string(),
             );
             push_assertion(
                 &mut assertions,
                 "metrics-request-private-seal",
-                content.contains("private_state_exposed = false"),
+                request
+                    .as_ref()
+                    .is_some_and(|request| !request.private_state_exposed),
                 "Committed metrics request preserves the private-state seal.".to_string(),
             );
         }

epiphany-core/src/bin/epiphany_work/closure_contracts.rs

@@ -93,6 +93,151 @@ pub(super) fn parse_repo_tool_request(text: &str) -> Result<RepoToolRequest> {
     toml::from_str(text).context("tool request is not valid typed TOML")
 }
 
+#[derive(Debug, Deserialize)]
+pub(super) struct RepoMetricsRequest {
+    pub(super) schema_version: String,
+    pub(super) safe_action_family: String,
+    pub(super) summary: String,
+    pub(super) private_state_exposed: bool,
+    request: RepoMetricsRequestBody,
+    antecedents: RepoMetricsAntecedents,
+    required_receipts: RepoMetricsReceipts,
+    metrics_packet: RepoMetricsPacket,
+    authority: RepoMetricsAuthority,
+}
+
+impl RepoMetricsRequest {
+    pub(super) fn has_canonical_identity(&self) -> bool {
+        self.schema_version == "epiphany.repo_metrics_request.v0"
+            && self.safe_action_family == "repo.metrics_request"
+    }
+
+    pub(super) fn awaits_owned_review(&self) -> bool {
+        self.request.status == "awaiting-metrics-review"
+            && self.request.requested_owner == "Bifrost/Maintainer"
+            && self.request.requested_effect == "record-compute-review-and-artifact-accounting"
+            && !self.request.publication_request_ref.is_empty()
+            && !self.request.credit_request_ref.is_empty()
+            && !self.request.artifact_acceptance_request_ref.is_empty()
+    }
+
+    pub(super) fn has_antecedent_contract(&self) -> bool {
+        let a = &self.antecedents;
+        a.closure_review_required
+            && a.soul_verdict_required
+            && a.mind_commit_required
+            && a.public_proof_required
+            && a.accepted_artifact_required
+            && a.credit_request_required
+    }
+
+    pub(super) fn has_receipt_contract(&self) -> bool {
+        let r = &self.required_receipts;
+        r.closure_review == "epiphany.repo_work_closure_review.v0"
+            && r.soul_verdict == "epiphany.soul.verification_verdict"
+            && r.mind_commit == "epiphany.mind.state_commit_receipt"
+            && r.public_proof == "epiphany.repo_work_public_proof_bundle.v0"
+            && r.accepted_artifact == "gamecult.artifact.acceptance_receipt.v0"
+            && r.model_spend == "gamecult.metrics.model_spend_receipt.v0"
+            && r.review_load == "gamecult.metrics.review_load_receipt.v0"
+            && r.credit_readback == "gamecult.bifrost.credit_readback_receipt.v0"
+    }
+
+    pub(super) fn has_metrics_packet(&self) -> bool {
+        let p = &self.metrics_packet;
+        p.requires_model_call_count
+            && p.requires_token_or_cost_summary
+            && p.requires_review_minutes_or_count
+            && p.requires_accepted_artifact_ref
+            && p.requires_public_proof_ref
+            && p.requires_credit_readback_ref
+            && p.requires_private_state_redaction_check
+    }
+
+    pub(super) fn has_authority_seals(&self) -> bool {
+        let a = &self.authority;
+        a.branch_local_only
+            && !a.metrics_ledger_authorized
+            && !a.spend_authorized
+            && !a.review_load_authorized
+            && !a.credit_ledger_authorized
+            && !a.github_pr_authorized
+            && !a.merge_authorized
+            && !a.publication_authorized
+            && !a.upstream_sync_authorized
+            && !a.hands_action_authorized
+            && !a.service_lifecycle_authority
+            && !a.cross_body_mutation_authorized
+            && !a.private_verse_rummaging
+            && a.bifrost_or_maintainer_metrics_authority_required
+    }
+}
+
+#[derive(Debug, Deserialize)]
+struct RepoMetricsRequestBody {
+    status: String,
+    requested_owner: String,
+    requested_effect: String,
+    publication_request_ref: String,
+    credit_request_ref: String,
+    artifact_acceptance_request_ref: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct RepoMetricsAntecedents {
+    closure_review_required: bool,
+    soul_verdict_required: bool,
+    mind_commit_required: bool,
+    public_proof_required: bool,
+    accepted_artifact_required: bool,
+    credit_request_required: bool,
+}
+
+#[derive(Debug, Deserialize)]
+struct RepoMetricsReceipts {
+    closure_review: String,
+    soul_verdict: String,
+    mind_commit: String,
+    public_proof: String,
+    accepted_artifact: String,
+    model_spend: String,
+    review_load: String,
+    credit_readback: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct RepoMetricsPacket {
+    requires_model_call_count: bool,
+    requires_token_or_cost_summary: bool,
+    requires_review_minutes_or_count: bool,
+    requires_accepted_artifact_ref: bool,
+    requires_public_proof_ref: bool,
+    requires_credit_readback_ref: bool,
+    requires_private_state_redaction_check: bool,
+}
+
+#[derive(Debug, Deserialize)]
+struct RepoMetricsAuthority {
+    branch_local_only: bool,
+    metrics_ledger_authorized: bool,
+    spend_authorized: bool,
+    review_load_authorized: bool,
+    credit_ledger_authorized: bool,
+    github_pr_authorized: bool,
+    merge_authorized: bool,
+    publication_authorized: bool,
+    upstream_sync_authorized: bool,
+    hands_action_authorized: bool,
+    service_lifecycle_authority: bool,
+    cross_body_mutation_authorized: bool,
+    private_verse_rummaging: bool,
+    bifrost_or_maintainer_metrics_authority_required: bool,
+}
+
+pub(super) fn parse_repo_metrics_request(text: &str) -> Result<RepoMetricsRequest> {
+    toml::from_str(text).context("metrics request is not valid typed TOML")
+}
+
 #[cfg(test)]
 mod tool_request_tests {
     use super::*;
@@ -134,6 +279,65 @@ private_verse_rummaging = false
         assert!(request.authority.direct_tool_execution);
         assert!(!request.has_authority_seals());
     }
+
+    #[test]
+    fn metrics_comment_cannot_counterfeit_spend_seal() {
+        let text = r#"
+schema_version = "epiphany.repo_metrics_request.v0"
+safe_action_family = "repo.metrics_request"
+summary = "summary"
+private_state_exposed = false
+[request]
+status = "awaiting-metrics-review"
+requested_owner = "Bifrost/Maintainer"
+requested_effect = "record-compute-review-and-artifact-accounting"
+publication_request_ref = "publication"
+credit_request_ref = "credit"
+artifact_acceptance_request_ref = "artifact"
+[antecedents]
+closure_review_required = true
+soul_verdict_required = true
+mind_commit_required = true
+public_proof_required = true
+accepted_artifact_required = true
+credit_request_required = true
+[required_receipts]
+closure_review = "epiphany.repo_work_closure_review.v0"
+soul_verdict = "epiphany.soul.verification_verdict"
+mind_commit = "epiphany.mind.state_commit_receipt"
+public_proof = "epiphany.repo_work_public_proof_bundle.v0"
+accepted_artifact = "gamecult.artifact.acceptance_receipt.v0"
+model_spend = "gamecult.metrics.model_spend_receipt.v0"
+review_load = "gamecult.metrics.review_load_receipt.v0"
+credit_readback = "gamecult.bifrost.credit_readback_receipt.v0"
+[metrics_packet]
+requires_model_call_count = true
+requires_token_or_cost_summary = true
+requires_review_minutes_or_count = true
+requires_accepted_artifact_ref = true
+requires_public_proof_ref = true
+requires_credit_readback_ref = true
+requires_private_state_redaction_check = true
+[authority]
+branch_local_only = true
+metrics_ledger_authorized = false
+# spend_authorized = false
+spend_authorized = true
+review_load_authorized = false
+credit_ledger_authorized = false
+github_pr_authorized = false
+merge_authorized = false
+publication_authorized = false
+upstream_sync_authorized = false
+hands_action_authorized = false
+service_lifecycle_authority = false
+cross_body_mutation_authorized = false
+private_verse_rummaging = false
+bifrost_or_maintainer_metrics_authority_required = true
+"#;
+        let request = parse_repo_metrics_request(text).expect("fixture is typed TOML");
+        assert!(!request.has_authority_seals());
+    }
 }
 
 #[derive(Debug, Deserialize)]

notes/conceptual-substitution-audit-2026-07-12.md

@@ -799,6 +799,15 @@ parses through `closure_contracts.rs` and checks exact request, CultMesh, Odin,
 and authority semantics. A regression fixture proves commented denial text
 cannot conceal `direct_tool_execution = true`.
 
+## Metrics-request prose substituted for accounting contracts
+
+`repo.metrics_request` closure inferred request identity, prerequisite receipt
+contracts, packet requirements, and denied accounting authority from arbitrary
+substrings. The typed metrics contract now owns those meanings. Closure checks
+exact fields and accepted-summary equality; a comment claiming
+`spend_authorized = false` cannot conceal an actual spend grant. Bifrost or the
+Maintainer remains the required accounting authority.
+
 ## Unresolved: provider receipts without chronology
 
 Bifrost body-change/GitHub publication receipts are externally owned and their

notes/fresh-workspace-handoff.md

@@ -234,8 +234,9 @@ Historical implementation detail belongs in git history, smoke artifacts, and th
 
 ## Next real move
 
-Continue the modeling pass beyond receipt writers. Tool-request closure now uses
-the typed family contract and cannot accept comment-counterfeit execution seals.
+Continue the modeling pass beyond receipt writers. Tool-request and
+metrics-request closure now use typed family contracts and cannot accept
+comment-counterfeit execution or spend seals.
 Inventory remaining substring closure families and production paths where a
 projection, cache, adapter, scheduler, coordinator, or compatibility surface
 asserts a fact owned elsewhere. For each candidate, name the owner, allowed

state/map.yaml

@@ -660,4 +660,4 @@ current_status:
   - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
   - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
   last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
-  next_action: Continue the conceptual-substitution pass. Typed deployment config/request, secret-policy, dependency-policy, and tool-request contracts now live in parent-private epiphany_work/closure_contracts.rs; tool-request comments cannot counterfeit execution-denial seals. Add future family validators there only when they protect named invariants, never as generic policy mush. Operational/evidence/self-state and operator mirrors follow owned clocks; identity chains are typed; scheduling/runbook selection do not parse prose; verse-query smoke deletion is canonically confined; writerless readiness-review is deleted. Bifrost provider receipts still need provider chronology and artifact/metrics request identity. Continue auditing remaining substring closure families, destructive path consumers, evidence/security mirrors, and adapters for borrowed authority.
+  next_action: Continue the conceptual-substitution pass. Typed deployment config/request, secret-policy, dependency-policy, tool-request, and metrics-request contracts now live in parent-private epiphany_work/closure_contracts.rs; comments cannot counterfeit execution or spend-denial seals. Add future family validators there only when they protect named invariants, never as generic policy mush. Operational/evidence/self-state and operator mirrors follow owned clocks; identity chains are typed; scheduling/runbook selection do not parse prose; verse-query smoke deletion is canonically confined; writerless readiness-review is deleted. Bifrost provider receipts still need provider chronology and artifact-request identity. Continue auditing remaining substring closure families, destructive path consumers, evidence/security mirrors, and adapters for borrowed authority.