diff --git a/epiphany-core/src/bin/epiphany-verse-query.rs b/epiphany-core/src/bin/epiphany-verse-query.rs index 7eda779d..63655c08 100644 --- a/epiphany-core/src/bin/epiphany-verse-query.rs +++ b/epiphany-core/src/bin/epiphany-verse-query.rs @@ -66,6 +66,7 @@ use epiphany_core::write_epiphany_cultmesh_daemon_poke_receipt; use epiphany_core::write_epiphany_cultmesh_daemon_restart_policy; use epiphany_core::write_epiphany_cultmesh_daemon_service_lifecycle_receipt; use epiphany_core::write_epiphany_cultmesh_daemon_status; +use epiphany_core::write_epiphany_cultmesh_daemon_statuses; use epiphany_core::write_epiphany_cultmesh_daemon_tool_invocation_intent; use epiphany_core::write_epiphany_cultmesh_daemon_tool_invocation_receipt; use epiphany_core::write_epiphany_cultmesh_eve_connection_intent; @@ -1400,16 +1401,24 @@ fn run_cli() -> Result<()> { ); } "smoke" => { - if args.smoke_default_store { - if let Some(parent) = args.store.parent() { - fs::remove_dir_all(parent).ok(); - } + if !args.smoke_default_store { + anyhow::bail!( + "verse-query smoke fixtures may use only the built-in .epiphany-smoke quarantine store; --store and --runtime-id overrides are forbidden" + ); + } + if let Some(parent) = args.store.parent() { + fs::remove_dir_all(parent).ok(); } seed_epiphany_local_verse_context( &args.store, args.runtime_id.clone(), "2026-06-02T00:00:00Z", )?; + write_epiphany_cultmesh_daemon_statuses( + &args.store, + args.runtime_id.clone(), + "2026-06-02T00:00:00Z", + )?; let context = query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?; let ready_liveness = load_epiphany_cultmesh_daemon_liveness(&args.store, args.runtime_id.clone())?; @@ -2376,32 +2385,15 @@ fn run_cli() -> Result<()> { || !batch_poke_tui_row.contains("epiphany-daemon-hands") || !batch_poke_tui_row.contains("privateVerse=epiphany.cluster.hands.private") || !batch_poke_tui_row.contains("surface=eve://epiphany/hands") - || !batch_poke_tui_row.contains("receipt=daemon-poke-receipt-") + || !batch_poke_tui_row.contains("receipt=unknown") + || !batch_poke_tui_row.contains("receiptStatus=unknown") + || !batch_poke_tui_row.contains("result=unknown") || !batch_poke_tui_row.contains("private=false") { anyhow::bail!( "local Verse query smoke batch daemon poke lost compact row topology/receipt/private-state fields" ); } - let degraded_receipt_directory_context = - query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?; - let degraded_receipt_directory = receipt_directory_report( - °raded_receipt_directory_context, - &load_epiphany_cultmesh_daemon_service_lifecycle_receipts( - &args.store, - args.runtime_id.clone(), - )?, - None, - ); - if !degraded_receipt_directory.rows.iter().any(|row| { - row.family == "daemon-poke" - && row.route == "epiphany-daemon-hands" - && row.status == "degraded" - }) { - anyhow::bail!( - "local Verse query smoke daemon-poke receipt row stopped reflecting current degraded liveness before heartbeat recovery" - ); - } let triage_overview = load_swarm_overview_report(&args)?; let triage_pokes = if triage_overview.liveness_status == "ready" { Vec::new() @@ -2464,25 +2456,6 @@ fn run_cli() -> Result<()> { args.runtime_id.clone(), restored_hands, )?; - let restored_receipt_directory_context = - query_epiphany_local_verse_context(&args.store, args.runtime_id.clone())?; - let restored_receipt_directory = receipt_directory_report( - &restored_receipt_directory_context, - &load_epiphany_cultmesh_daemon_service_lifecycle_receipts( - &args.store, - args.runtime_id.clone(), - )?, - None, - ); - if !restored_receipt_directory.rows.iter().any(|row| { - row.family == "daemon-poke" - && row.route == "epiphany-daemon-hands" - && row.status == "resolved" - }) { - anyhow::bail!( - "local Verse query smoke daemon-poke receipt row did not resolve after current liveness returned ready" - ); - } let bifrost_intent = epiphany_cultmesh_bifrost_body_change_publication_intent( "bifrost-publication-intent-smoke", "epiphany.cluster.hands", @@ -10650,7 +10623,7 @@ impl Args { } } - let smoke_default_store = command == "smoke" && !store_overridden; + let smoke_default_store = command == "smoke" && !store_overridden && !runtime_id_overridden; if smoke_default_store { store = PathBuf::from(".epiphany-smoke/verse-query-default/local-verse.ccmp"); if !runtime_id_overridden { diff --git a/notes/epiphany-current-algorithmic-map.md b/notes/epiphany-current-algorithmic-map.md index c6950427..9258f7f6 100644 --- a/notes/epiphany-current-algorithmic-map.md +++ b/notes/epiphany-current-algorithmic-map.md @@ -78,6 +78,14 @@ - Output explicitly returns null tool intent/receipt fields and `toolInvocationAuthority=runtime-spine-only`. - Negative proof: forged accepted tool JSON produced a snapshot but no canonical intent or receipt. +## Fixture store quarantine (2026-07-12) + +- `epiphany-verse-query smoke` owns synthetic contract fixtures only. +- Its only writable body is `.epiphany-smoke/verse-query-default/local-verse.ccmp` with runtime `verse-query-default-smoke`. +- Store/runtime overrides fail before fixture seeding or receipt construction. +- Negative proof: targeting `state/local-verse.ccmp` was rejected and its SHA-256 did not change. +- Positive proof: the built-in quarantined smoke completes successfully and reports its quarantine coordinates. + This is the source-grounded map of the live machine. Historical route and bridge anatomy belongs in git history and evidence ledgers, not here. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index ca633bf1..2a4c31c4 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -36,6 +36,10 @@ Single poke, batch poke, and swarm triage now write only `epiphany.cultmesh.daem The first call-site audit found a new canonical-promotion substitution in `epiphany-operator-snapshot from-status`: arbitrary edge JSON under `/tools/invocations` could be converted into canonical daemon-tool intent and receipt documents. That promotion is removed. The adapter writes only `operator_snapshot`, returns null tool intent/receipt fields, and states `runtime-spine-only` authority; the conversion helper is compiled only for tests. Forgery proof imported an `accepted` fake receipt and confirmed both canonical latest tool intent and receipt remained absent. See `notes/receipt-writer-provenance-audit-2026-07-12.md`. Next quarantine smoke writers, then inspect operator-run and daemon-supervisor evidence binding. +## 2026-07-12 verse-query smoke quarantine + +The monolithic `epiphany-verse-query smoke` fixture writer can no longer accept `--store` or `--runtime-id`; it is hard-bound to `.epiphany-smoke/verse-query-default/local-verse.ccmp` and `verse-query-default-smoke`. A direct canonical-store attempt was rejected before mutation and `state/local-verse.ccmp` retained the same SHA-256. The quarantined smoke now explicitly seeds fixture daemon statuses, expects intent-only batch poke rows, and completes `status=ok` within quarantine. Next inspect operator-run/supervisor provenance and quarantine standalone smoke binaries that accept arbitrary roots. + This is the re-entry rite for `E:\Projects\EpiphanyAgent`: the waking chant for the local machine-spirit before it touches the forge. diff --git a/notes/receipt-writer-provenance-audit-2026-07-12.md b/notes/receipt-writer-provenance-audit-2026-07-12.md index 07dcc931..2c25bd7f 100644 --- a/notes/receipt-writer-provenance-audit-2026-07-12.md +++ b/notes/receipt-writer-provenance-audit-2026-07-12.md @@ -19,7 +19,11 @@ A forged operator-status artifact containing `intentId=forged-intent`, `receiptI ## Remaining scrutiny -1. Quarantine smoke writers so they cannot target canonical stores. -2. Inspect `epiphany-operator-run` receipt construction against actual subprocess/runtime evidence rather than command arguments. -3. Inspect daemon-supervisor plan/rehearsal receipts separately from execution receipts so planning cannot masquerade as service mutation. +1. Inspect `epiphany-operator-run` receipt construction against actual subprocess/runtime evidence rather than command arguments. +2. Inspect daemon-supervisor plan/rehearsal receipts separately from execution receipts so planning cannot masquerade as service mutation. +3. Extend the same store quarantine invariant to standalone smoke binaries that accept output paths. 4. Distill or remove dead public receipt constructors once every named provider executable exists. + +## Smoke quarantine update + +`epiphany-verse-query smoke` is now hard-bound to `.epiphany-smoke/verse-query-default/local-verse.ccmp` and runtime `verse-query-default-smoke`. Store or runtime overrides are rejected before the fixture body runs. A direct attempt against `state/local-verse.ccmp` was refused and its SHA-256 remained unchanged. The quarantined smoke was repaired to seed fixture liveness explicitly and to expect requester-only poke output; it completes successfully inside the quarantine. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index c080202e..5c07026d 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 6316c3db..4d1ba431 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -70,7 +70,7 @@ data_flow: - move historical proof to git, commits, smoke artifacts, or distilled evidence rather than plan prose active_subgoals: - - Use `notes/conceptual-substitution-audit-2026-07-12.md` plus `notes/receipt-writer-provenance-audit-2026-07-12.md` as the current authority-corrosion maps. The fresh call-site audit found and cut operator-snapshot canonical promotion: arbitrary edge status JSON can no longer become canonical daemon-tool intents/receipts. Snapshot output names `runtime-spine-only` authority; the old converter is test-only. Next quarantine smoke receipt writers from canonical stores, then audit operator-run and daemon-supervisor evidence provenance. + - Use `notes/conceptual-substitution-audit-2026-07-12.md` plus `notes/receipt-writer-provenance-audit-2026-07-12.md` as the current authority-corrosion maps. Operator-snapshot cannot promote edge JSON into canonical tool receipts. `epiphany-verse-query smoke` is now hard-bound to its `.epiphany-smoke` store/runtime; overrides are refused before fixture writes, and canonical-store hash proof passed. Next audit operator-run and daemon-supervisor evidence provenance, then extend quarantine to standalone smoke binaries with configurable paths. - `swarm-overview` is an Epiphany-local, renderer-neutral diagnostic projection over provider-owned typed state. It owns no lifecycle, discovery, composition, or mutation authority. Epiphany publishes clean provider-owned Eve surfaces; Odin may discover them; downstream lowerers and compositors remain outside Epiphany's concern. - Idunn owns daemon survival and service lifecycle physiology. Codex/operator sessions may inspect, generate runbooks, and route explicit operator authority, but keeping daemons alive belongs to Idunn-owned service lifecycle receipts, scheduler policy, audits, and aftercare. Do not let Self, diagnostic projections, or ad hoc wrapper summaries become a second daemon-keeper. Global tool readbacks for Self `service-health`, `service-policy-directory`, and `swarm-online-runbook` state `lifecycleOwner=Idunn` and `hostedBody=Epiphany` without service mutation or private-state exposure. - Use `notes/epiphany-cultmesh-dreaming-roadmap.md` as the design authority for distributed Epiphany dreaming. Public dreams are separately authored typed documents distributed through CultMesh/CultNet; private state remains local and cannot be shared by flipping a visibility flag. Foreign dreams are external thought weather until a reviewed local adoption receipt digests them into memory, planning, doctrine, or governance.