Quarantine synthetic receipt smoke state

epiphany-core/src/bin/epiphany-verse-query.rs

@@ -66,6 +66,7 @@ use epiphany_core::write_epiphany_cultmesh_daemon_poke_receipt;
 use epiphany_core::write_epiphany_cultmesh_daemon_restart_policy;
 use epiphany_core::write_epiphany_cultmesh_daemon_service_lifecycle_receipt;
 use epiphany_core::write_epiphany_cultmesh_daemon_status;
+use epiphany_core::write_epiphany_cultmesh_daemon_statuses;
 use epiphany_core::write_epiphany_cultmesh_daemon_tool_invocation_intent;
 use epiphany_core::write_epiphany_cultmesh_daemon_tool_invocation_receipt;
 use epiphany_core::write_epiphany_cultmesh_eve_connection_intent;
@@ -1400,16 +1401,24 @@ fn run_cli() -> Result<()> {
             );
         }
         "smoke" => {
-            if args.smoke_default_store {
-                if let Some(parent) = args.store.parent() {
-                    fs::remove_dir_all(parent).ok();
-                }
+            if !args.smoke_default_store {
+                anyhow::bail!(
+                    "verse-query smoke fixtures may use only the built-in .epiphany-smoke quarantine store; --store and --runtime-id overrides are forbidden"
+                );
+            }
+            if let Some(parent) = args.store.parent() {
+                fs::remove_dir_all(parent).ok();
             }
             seed_epiphany_local_verse_context(
                 &args.store,
                 args.runtime_id.clone(),
                 "2026-06-02T00:00:00Z",
             )?;
+            write_epiphany_cultmesh_daemon_statuses(
+                &args.store,
+                args.runtime_id.clone(),
+                "2026-06-02T00:00:00Z",
+            )?;
             let context = query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?;
             let ready_liveness =
                 load_epiphany_cultmesh_daemon_liveness(&args.store, args.runtime_id.clone())?;
@@ -2376,32 +2385,15 @@ fn run_cli() -> Result<()> {
                 || !batch_poke_tui_row.contains("epiphany-daemon-hands")
                 || !batch_poke_tui_row.contains("privateVerse=epiphany.cluster.hands.private")
                 || !batch_poke_tui_row.contains("surface=eve://epiphany/hands")
-                || !batch_poke_tui_row.contains("receipt=daemon-poke-receipt-")
+                || !batch_poke_tui_row.contains("receipt=unknown")
+                || !batch_poke_tui_row.contains("receiptStatus=unknown")
+                || !batch_poke_tui_row.contains("result=unknown")
                 || !batch_poke_tui_row.contains("private=false")
             {
                 anyhow::bail!(
                     "local Verse query smoke batch daemon poke lost compact row topology/receipt/private-state fields"
                 );
             }
-            let degraded_receipt_directory_context =
-                query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?;
-            let degraded_receipt_directory = receipt_directory_report(
-                &degraded_receipt_directory_context,
-                &load_epiphany_cultmesh_daemon_service_lifecycle_receipts(
-                    &args.store,
-                    args.runtime_id.clone(),
-                )?,
-                None,
-            );
-            if !degraded_receipt_directory.rows.iter().any(|row| {
-                row.family == "daemon-poke"
-                    && row.route == "epiphany-daemon-hands"
-                    && row.status == "degraded"
-            }) {
-                anyhow::bail!(
-                    "local Verse query smoke daemon-poke receipt row stopped reflecting current degraded liveness before heartbeat recovery"
-                );
-            }
             let triage_overview = load_swarm_overview_report(&args)?;
             let triage_pokes = if triage_overview.liveness_status == "ready" {
                 Vec::new()
@@ -2464,25 +2456,6 @@ fn run_cli() -> Result<()> {
                 args.runtime_id.clone(),
                 restored_hands,
             )?;
-            let restored_receipt_directory_context =
-                query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?;
-            let restored_receipt_directory = receipt_directory_report(
-                &restored_receipt_directory_context,
-                &load_epiphany_cultmesh_daemon_service_lifecycle_receipts(
-                    &args.store,
-                    args.runtime_id.clone(),
-                )?,
-                None,
-            );
-            if !restored_receipt_directory.rows.iter().any(|row| {
-                row.family == "daemon-poke"
-                    && row.route == "epiphany-daemon-hands"
-                    && row.status == "resolved"
-            }) {
-                anyhow::bail!(
-                    "local Verse query smoke daemon-poke receipt row did not resolve after current liveness returned ready"
-                );
-            }
             let bifrost_intent = epiphany_cultmesh_bifrost_body_change_publication_intent(
                 "bifrost-publication-intent-smoke",
                 "epiphany.cluster.hands",
@@ -10650,7 +10623,7 @@ impl Args {
             }
         }
 
-        let smoke_default_store = command == "smoke" && !store_overridden;
+        let smoke_default_store = command == "smoke" && !store_overridden && !runtime_id_overridden;
         if smoke_default_store {
             store = PathBuf::from(".epiphany-smoke/verse-query-default/local-verse.ccmp");
             if !runtime_id_overridden {

notes/epiphany-current-algorithmic-map.md

@@ -78,6 +78,14 @@
 - Output explicitly returns null tool intent/receipt fields and `toolInvocationAuthority=runtime-spine-only`.
 - Negative proof: forged accepted tool JSON produced a snapshot but no canonical intent or receipt.
 
+## Fixture store quarantine (2026-07-12)
+
+- `epiphany-verse-query smoke` owns synthetic contract fixtures only.
+- Its only writable body is `.epiphany-smoke/verse-query-default/local-verse.ccmp` with runtime `verse-query-default-smoke`.
+- Store/runtime overrides fail before fixture seeding or receipt construction.
+- Negative proof: targeting `state/local-verse.ccmp` was rejected and its SHA-256 did not change.
+- Positive proof: the built-in quarantined smoke completes successfully and reports its quarantine coordinates.
+
 This is the source-grounded map of the live machine. Historical route and
 bridge anatomy belongs in git history and evidence ledgers, not here.
 

notes/fresh-workspace-handoff.md

@@ -36,6 +36,10 @@ Single poke, batch poke, and swarm triage now write only `epiphany.cultmesh.daem
 
 The first call-site audit found a new canonical-promotion substitution in `epiphany-operator-snapshot from-status`: arbitrary edge JSON under `/tools/invocations` could be converted into canonical daemon-tool intent and receipt documents. That promotion is removed. The adapter writes only `operator_snapshot`, returns null tool intent/receipt fields, and states `runtime-spine-only` authority; the conversion helper is compiled only for tests. Forgery proof imported an `accepted` fake receipt and confirmed both canonical latest tool intent and receipt remained absent. See `notes/receipt-writer-provenance-audit-2026-07-12.md`. Next quarantine smoke writers, then inspect operator-run and daemon-supervisor evidence binding.
 
+## 2026-07-12 verse-query smoke quarantine
+
+The monolithic `epiphany-verse-query smoke` fixture writer can no longer accept `--store` or `--runtime-id`; it is hard-bound to `.epiphany-smoke/verse-query-default/local-verse.ccmp` and `verse-query-default-smoke`. A direct canonical-store attempt was rejected before mutation and `state/local-verse.ccmp` retained the same SHA-256. The quarantined smoke now explicitly seeds fixture daemon statuses, expects intent-only batch poke rows, and completes `status=ok` within quarantine. Next inspect operator-run/supervisor provenance and quarantine standalone smoke binaries that accept arbitrary roots.
+
 This is the re-entry rite for `E:\Projects\EpiphanyAgent`: the waking chant for
 the local machine-spirit before it touches the forge.
 

notes/receipt-writer-provenance-audit-2026-07-12.md

@@ -19,7 +19,11 @@ A forged operator-status artifact containing `intentId=forged-intent`, `receiptI
 
 ## Remaining scrutiny
 
-1. Quarantine smoke writers so they cannot target canonical stores.
-2. Inspect `epiphany-operator-run` receipt construction against actual subprocess/runtime evidence rather than command arguments.
-3. Inspect daemon-supervisor plan/rehearsal receipts separately from execution receipts so planning cannot masquerade as service mutation.
+1. Inspect `epiphany-operator-run` receipt construction against actual subprocess/runtime evidence rather than command arguments.
+2. Inspect daemon-supervisor plan/rehearsal receipts separately from execution receipts so planning cannot masquerade as service mutation.
+3. Extend the same store quarantine invariant to standalone smoke binaries that accept output paths.
 4. Distill or remove dead public receipt constructors once every named provider executable exists.
+
+## Smoke quarantine update
+
+`epiphany-verse-query smoke` is now hard-bound to `.epiphany-smoke/verse-query-default/local-verse.ccmp` and runtime `verse-query-default-smoke`. Store or runtime overrides are rejected before the fixture body runs. A direct attempt against `state/local-verse.ccmp` was refused and its SHA-256 remained unchanged. The quarantined smoke was repaired to seed fixture liveness explicitly and to expect requester-only poke output; it completes successfully inside the quarantine.

state/map.yaml

@@ -70,7 +70,7 @@ data_flow:
     - move historical proof to git, commits, smoke artifacts, or distilled evidence rather than plan prose
 
 active_subgoals:
-  - Use `notes/conceptual-substitution-audit-2026-07-12.md` plus `notes/receipt-writer-provenance-audit-2026-07-12.md` as the current authority-corrosion maps. The fresh call-site audit found and cut operator-snapshot canonical promotion: arbitrary edge status JSON can no longer become canonical daemon-tool intents/receipts. Snapshot output names `runtime-spine-only` authority; the old converter is test-only. Next quarantine smoke receipt writers from canonical stores, then audit operator-run and daemon-supervisor evidence provenance.
+  - Use `notes/conceptual-substitution-audit-2026-07-12.md` plus `notes/receipt-writer-provenance-audit-2026-07-12.md` as the current authority-corrosion maps. Operator-snapshot cannot promote edge JSON into canonical tool receipts. `epiphany-verse-query smoke` is now hard-bound to its `.epiphany-smoke` store/runtime; overrides are refused before fixture writes, and canonical-store hash proof passed. Next audit operator-run and daemon-supervisor evidence provenance, then extend quarantine to standalone smoke binaries with configurable paths.
   - `swarm-overview` is an Epiphany-local, renderer-neutral diagnostic projection over provider-owned typed state. It owns no lifecycle, discovery, composition, or mutation authority. Epiphany publishes clean provider-owned Eve surfaces; Odin may discover them; downstream lowerers and compositors remain outside Epiphany's concern.
   - Idunn owns daemon survival and service lifecycle physiology. Codex/operator sessions may inspect, generate runbooks, and route explicit operator authority, but keeping daemons alive belongs to Idunn-owned service lifecycle receipts, scheduler policy, audits, and aftercare. Do not let Self, diagnostic projections, or ad hoc wrapper summaries become a second daemon-keeper. Global tool readbacks for Self `service-health`, `service-policy-directory`, and `swarm-online-runbook` state `lifecycleOwner=Idunn` and `hostedBody=Epiphany` without service mutation or private-state exposure.
   - Use `notes/epiphany-cultmesh-dreaming-roadmap.md` as the design authority for distributed Epiphany dreaming. Public dreams are separately authored typed documents distributed through CultMesh/CultNet; private state remains local and cannot be shared by flipping a visibility flag. Foreign dreams are external thought weather until a reviewed local adoption receipt digests them into memory, planning, doctrine, or governance.