From fdb81b6609c39d017387d61e4043b8dca15fa33d Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Mon, 13 Jul 2026 02:15:41 +0100 Subject: [PATCH] Type metrics request closure semantics --- epiphany-core/src/bin/epiphany-work.rs | 88 +++----- .../bin/epiphany_work/closure_contracts.rs | 204 ++++++++++++++++++ ...onceptual-substitution-audit-2026-07-12.md | 9 + notes/fresh-workspace-handoff.md | 5 +- state/ledgers.msgpack | Bin 460302 -> 460624 bytes state/map.yaml | 2 +- 6 files changed, 245 insertions(+), 63 deletions(-) diff --git a/epiphany-core/src/bin/epiphany-work.rs b/epiphany-core/src/bin/epiphany-work.rs index acc84337..52c543e4 100644 --- a/epiphany-core/src/bin/epiphany-work.rs +++ b/epiphany-core/src/bin/epiphany-work.rs @@ -8279,114 +8279,82 @@ fn closure_family_assertions( ); } "repo.metrics_request" => { + let request = parse_repo_metrics_request(&content).ok(); push_assertion( &mut assertions, "metrics-request-schema-present", - content.contains("schema_version = \"epiphany.repo_metrics_request.v0\""), + request + .as_ref() + .is_some_and(RepoMetricsRequest::has_canonical_identity), "Committed metrics request carries the schema version.".to_string(), ); push_assertion( &mut assertions, "metrics-request-family-present", - content.contains("safe_action_family = \"repo.metrics_request\""), + request + .as_ref() + .is_some_and(RepoMetricsRequest::has_canonical_identity), "Committed metrics request carries the safe action family.".to_string(), ); push_assertion( &mut assertions, "metrics-request-summary-present", - content.contains(&compact_summary), + request + .as_ref() + .is_some_and(|request| request.summary == compact_summary), "Committed metrics request contains the accepted pressure summary.".to_string(), ); push_assertion( &mut assertions, "metrics-request-awaits-review", - content.contains("[request]") - && content.contains("status = \"awaiting-metrics-review\"") - && content.contains("requested_owner = \"Bifrost/Maintainer\"") - && content.contains( - "requested_effect = \"record-compute-review-and-artifact-accounting\"", - ) - && content.contains("publication_request_ref = ") - && content.contains("credit_request_ref = ") - && content.contains("artifact_acceptance_request_ref = "), + request + .as_ref() + .is_some_and(RepoMetricsRequest::awaits_owned_review), "Committed metrics request waits for Bifrost/maintainer review before consequence." .to_string(), ); push_assertion( &mut assertions, "metrics-request-antecedents-present", - content.contains("[antecedents]") - && content.contains("closure_review_required = true") - && content.contains("soul_verdict_required = true") - && content.contains("mind_commit_required = true") - && content.contains("public_proof_required = true") - && content.contains("accepted_artifact_required = true") - && content.contains("credit_request_required = true"), + request + .as_ref() + .is_some_and(RepoMetricsRequest::has_antecedent_contract), "Committed metrics request requires closure, Soul, Mind, proof, accepted artifact, and credit request antecedents." .to_string(), ); push_assertion( &mut assertions, "metrics-request-receipt-contract", - content.contains("[required_receipts]") - && content.contains( - "closure_review = \"epiphany.repo_work_closure_review.v0\"", - ) - && content.contains( - "soul_verdict = \"epiphany.soul.verification_verdict\"", - ) - && content.contains("mind_commit = \"epiphany.mind.state_commit_receipt\"") - && content.contains( - "public_proof = \"epiphany.repo_work_public_proof_bundle.v0\"", - ) - && content.contains( - "accepted_artifact = \"gamecult.artifact.acceptance_receipt.v0\"", - ) - && content.contains("model_spend = \"gamecult.metrics.model_spend_receipt.v0\"") - && content.contains("review_load = \"gamecult.metrics.review_load_receipt.v0\"") - && content.contains( - "credit_readback = \"gamecult.bifrost.credit_readback_receipt.v0\"", - ), + request + .as_ref() + .is_some_and(RepoMetricsRequest::has_receipt_contract), "Committed metrics request names closure, proof, artifact, spend, review-load, and credit readback receipts." .to_string(), ); push_assertion( &mut assertions, "metrics-request-packet-contract", - content.contains("[metrics_packet]") - && content.contains("requires_model_call_count = true") - && content.contains("requires_token_or_cost_summary = true") - && content.contains("requires_review_minutes_or_count = true") - && content.contains("requires_accepted_artifact_ref = true") - && content.contains("requires_public_proof_ref = true") - && content.contains("requires_credit_readback_ref = true") - && content.contains("requires_private_state_redaction_check = true"), + request + .as_ref() + .is_some_and(RepoMetricsRequest::has_metrics_packet), "Committed metrics request names model-call, cost, review-load, artifact, proof, credit, and redaction requirements." .to_string(), ); push_assertion( &mut assertions, "metrics-request-authority-seals", - content.contains("[authority]") - && content.contains("metrics_ledger_authorized = false") - && content.contains("spend_authorized = false") - && content.contains("review_load_authorized = false") - && content.contains("credit_ledger_authorized = false") - && content.contains("github_pr_authorized = false") - && content.contains("merge_authorized = false") - && content.contains("publication_authorized = false") - && content.contains("upstream_sync_authorized = false") - && content.contains("hands_action_authorized = false") - && content.contains("cross_body_mutation_authorized = false") - && content - .contains("bifrost_or_maintainer_metrics_authority_required = true"), + request + .as_ref() + .is_some_and(RepoMetricsRequest::has_authority_seals), "Committed metrics request denies metrics/spend/review/credit/PR/merge/publication/sync/action/cross-body authority." .to_string(), ); push_assertion( &mut assertions, "metrics-request-private-seal", - content.contains("private_state_exposed = false"), + request + .as_ref() + .is_some_and(|request| !request.private_state_exposed), "Committed metrics request preserves the private-state seal.".to_string(), ); } diff --git a/epiphany-core/src/bin/epiphany_work/closure_contracts.rs b/epiphany-core/src/bin/epiphany_work/closure_contracts.rs index 90377a79..db455bfd 100644 --- a/epiphany-core/src/bin/epiphany_work/closure_contracts.rs +++ b/epiphany-core/src/bin/epiphany_work/closure_contracts.rs @@ -93,6 +93,151 @@ pub(super) fn parse_repo_tool_request(text: &str) -> Result { toml::from_str(text).context("tool request is not valid typed TOML") } +#[derive(Debug, Deserialize)] +pub(super) struct RepoMetricsRequest { + pub(super) schema_version: String, + pub(super) safe_action_family: String, + pub(super) summary: String, + pub(super) private_state_exposed: bool, + request: RepoMetricsRequestBody, + antecedents: RepoMetricsAntecedents, + required_receipts: RepoMetricsReceipts, + metrics_packet: RepoMetricsPacket, + authority: RepoMetricsAuthority, +} + +impl RepoMetricsRequest { + pub(super) fn has_canonical_identity(&self) -> bool { + self.schema_version == "epiphany.repo_metrics_request.v0" + && self.safe_action_family == "repo.metrics_request" + } + + pub(super) fn awaits_owned_review(&self) -> bool { + self.request.status == "awaiting-metrics-review" + && self.request.requested_owner == "Bifrost/Maintainer" + && self.request.requested_effect == "record-compute-review-and-artifact-accounting" + && !self.request.publication_request_ref.is_empty() + && !self.request.credit_request_ref.is_empty() + && !self.request.artifact_acceptance_request_ref.is_empty() + } + + pub(super) fn has_antecedent_contract(&self) -> bool { + let a = &self.antecedents; + a.closure_review_required + && a.soul_verdict_required + && a.mind_commit_required + && a.public_proof_required + && a.accepted_artifact_required + && a.credit_request_required + } + + pub(super) fn has_receipt_contract(&self) -> bool { + let r = &self.required_receipts; + r.closure_review == "epiphany.repo_work_closure_review.v0" + && r.soul_verdict == "epiphany.soul.verification_verdict" + && r.mind_commit == "epiphany.mind.state_commit_receipt" + && r.public_proof == "epiphany.repo_work_public_proof_bundle.v0" + && r.accepted_artifact == "gamecult.artifact.acceptance_receipt.v0" + && r.model_spend == "gamecult.metrics.model_spend_receipt.v0" + && r.review_load == "gamecult.metrics.review_load_receipt.v0" + && r.credit_readback == "gamecult.bifrost.credit_readback_receipt.v0" + } + + pub(super) fn has_metrics_packet(&self) -> bool { + let p = &self.metrics_packet; + p.requires_model_call_count + && p.requires_token_or_cost_summary + && p.requires_review_minutes_or_count + && p.requires_accepted_artifact_ref + && p.requires_public_proof_ref + && p.requires_credit_readback_ref + && p.requires_private_state_redaction_check + } + + pub(super) fn has_authority_seals(&self) -> bool { + let a = &self.authority; + a.branch_local_only + && !a.metrics_ledger_authorized + && !a.spend_authorized + && !a.review_load_authorized + && !a.credit_ledger_authorized + && !a.github_pr_authorized + && !a.merge_authorized + && !a.publication_authorized + && !a.upstream_sync_authorized + && !a.hands_action_authorized + && !a.service_lifecycle_authority + && !a.cross_body_mutation_authorized + && !a.private_verse_rummaging + && a.bifrost_or_maintainer_metrics_authority_required + } +} + +#[derive(Debug, Deserialize)] +struct RepoMetricsRequestBody { + status: String, + requested_owner: String, + requested_effect: String, + publication_request_ref: String, + credit_request_ref: String, + artifact_acceptance_request_ref: String, +} + +#[derive(Debug, Deserialize)] +struct RepoMetricsAntecedents { + closure_review_required: bool, + soul_verdict_required: bool, + mind_commit_required: bool, + public_proof_required: bool, + accepted_artifact_required: bool, + credit_request_required: bool, +} + +#[derive(Debug, Deserialize)] +struct RepoMetricsReceipts { + closure_review: String, + soul_verdict: String, + mind_commit: String, + public_proof: String, + accepted_artifact: String, + model_spend: String, + review_load: String, + credit_readback: String, +} + +#[derive(Debug, Deserialize)] +struct RepoMetricsPacket { + requires_model_call_count: bool, + requires_token_or_cost_summary: bool, + requires_review_minutes_or_count: bool, + requires_accepted_artifact_ref: bool, + requires_public_proof_ref: bool, + requires_credit_readback_ref: bool, + requires_private_state_redaction_check: bool, +} + +#[derive(Debug, Deserialize)] +struct RepoMetricsAuthority { + branch_local_only: bool, + metrics_ledger_authorized: bool, + spend_authorized: bool, + review_load_authorized: bool, + credit_ledger_authorized: bool, + github_pr_authorized: bool, + merge_authorized: bool, + publication_authorized: bool, + upstream_sync_authorized: bool, + hands_action_authorized: bool, + service_lifecycle_authority: bool, + cross_body_mutation_authorized: bool, + private_verse_rummaging: bool, + bifrost_or_maintainer_metrics_authority_required: bool, +} + +pub(super) fn parse_repo_metrics_request(text: &str) -> Result { + toml::from_str(text).context("metrics request is not valid typed TOML") +} + #[cfg(test)] mod tool_request_tests { use super::*; @@ -134,6 +279,65 @@ private_verse_rummaging = false assert!(request.authority.direct_tool_execution); assert!(!request.has_authority_seals()); } + + #[test] + fn metrics_comment_cannot_counterfeit_spend_seal() { + let text = r#" +schema_version = "epiphany.repo_metrics_request.v0" +safe_action_family = "repo.metrics_request" +summary = "summary" +private_state_exposed = false +[request] +status = "awaiting-metrics-review" +requested_owner = "Bifrost/Maintainer" +requested_effect = "record-compute-review-and-artifact-accounting" +publication_request_ref = "publication" +credit_request_ref = "credit" +artifact_acceptance_request_ref = "artifact" +[antecedents] +closure_review_required = true +soul_verdict_required = true +mind_commit_required = true +public_proof_required = true +accepted_artifact_required = true +credit_request_required = true +[required_receipts] +closure_review = "epiphany.repo_work_closure_review.v0" +soul_verdict = "epiphany.soul.verification_verdict" +mind_commit = "epiphany.mind.state_commit_receipt" +public_proof = "epiphany.repo_work_public_proof_bundle.v0" +accepted_artifact = "gamecult.artifact.acceptance_receipt.v0" +model_spend = "gamecult.metrics.model_spend_receipt.v0" +review_load = "gamecult.metrics.review_load_receipt.v0" +credit_readback = "gamecult.bifrost.credit_readback_receipt.v0" +[metrics_packet] +requires_model_call_count = true +requires_token_or_cost_summary = true +requires_review_minutes_or_count = true +requires_accepted_artifact_ref = true +requires_public_proof_ref = true +requires_credit_readback_ref = true +requires_private_state_redaction_check = true +[authority] +branch_local_only = true +metrics_ledger_authorized = false +# spend_authorized = false +spend_authorized = true +review_load_authorized = false +credit_ledger_authorized = false +github_pr_authorized = false +merge_authorized = false +publication_authorized = false +upstream_sync_authorized = false +hands_action_authorized = false +service_lifecycle_authority = false +cross_body_mutation_authorized = false +private_verse_rummaging = false +bifrost_or_maintainer_metrics_authority_required = true +"#; + let request = parse_repo_metrics_request(text).expect("fixture is typed TOML"); + assert!(!request.has_authority_seals()); + } } #[derive(Debug, Deserialize)] diff --git a/notes/conceptual-substitution-audit-2026-07-12.md b/notes/conceptual-substitution-audit-2026-07-12.md index 83754104..158e01ad 100644 --- a/notes/conceptual-substitution-audit-2026-07-12.md +++ b/notes/conceptual-substitution-audit-2026-07-12.md @@ -799,6 +799,15 @@ parses through `closure_contracts.rs` and checks exact request, CultMesh, Odin, and authority semantics. A regression fixture proves commented denial text cannot conceal `direct_tool_execution = true`. +## Metrics-request prose substituted for accounting contracts + +`repo.metrics_request` closure inferred request identity, prerequisite receipt +contracts, packet requirements, and denied accounting authority from arbitrary +substrings. The typed metrics contract now owns those meanings. Closure checks +exact fields and accepted-summary equality; a comment claiming +`spend_authorized = false` cannot conceal an actual spend grant. Bifrost or the +Maintainer remains the required accounting authority. + ## Unresolved: provider receipts without chronology Bifrost body-change/GitHub publication receipts are externally owned and their diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 100ae0ae..cbd13c07 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -234,8 +234,9 @@ Historical implementation detail belongs in git history, smoke artifacts, and th ## Next real move -Continue the modeling pass beyond receipt writers. Tool-request closure now uses -the typed family contract and cannot accept comment-counterfeit execution seals. +Continue the modeling pass beyond receipt writers. Tool-request and +metrics-request closure now use typed family contracts and cannot accept +comment-counterfeit execution or spend seals. Inventory remaining substring closure families and production paths where a projection, cache, adapter, scheduler, coordinator, or compatibility surface asserts a fact owned elsewhere. For each candidate, name the owner, allowed diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index ce01a916ecbe560d8fa8d6d3048ded607f23728d..0147368cd6514c8c68e1f80e0503a1ca4d80b812 100644 GIT binary patch delta 192 zcmeC{k-5+(vq6%P%hbxmAnF(cJDcuiWyV5AM(^gSOzl&d7=ai>GXpUT5VHa?+xDqU z?3K*ZEkoG2*^NUC46O`Jr(Y~*mE{#GN-fCO%S|mQ%1kbvuF1-7DwbN2m|UWenUb1U zl37xzqfnGumYG^U)sbC+Lm@doucRn3d1?Z??DUEkEd0~^SlPvtiVITnQWSt1G81zY k(h@UsiuDxS@{>!8Q&SX5Qj1H9b*2k`W|N=(kCj~j0MIQw#sB~S delta 60 zcmcc6C)3v>vq6%P%gD;uBI+0eJIm|M%8Z4Kj9$%CncAl^F#<7&W(HywAZ7((w(V1y H*ejU