diff --git a/epiphany-core/src/bin/epiphany-repo-planning-brief-family-smoke.rs b/epiphany-core/src/bin/epiphany-repo-planning-brief-family-smoke.rs index a25d9cd9..a4d8e9b6 100644 --- a/epiphany-core/src/bin/epiphany-repo-planning-brief-family-smoke.rs +++ b/epiphany-core/src/bin/epiphany-repo-planning-brief-family-smoke.rs @@ -1,9 +1,9 @@ -use anyhow::anyhow; use anyhow::Context; use anyhow::Result; +use anyhow::anyhow; use chrono::Utc; -use serde_json::json; use serde_json::Value; +use serde_json::json; use std::env; use std::fs; use std::path::Path; @@ -282,7 +282,37 @@ fn run_smoke(args: Args) -> Result { "safeFamilyPlanning", "candidateNextSafeFamilyCount", ], - 6, + 20, + )?; + require_bool( + &close, + &[ + "closureReview", + "familyAssertions", + "safeFamilyPlanning", + "allMatrixGroupsComplete", + ], + true, + )?; + require_bool( + &close, + &[ + "closureReview", + "familyAssertions", + "safeFamilyPlanning", + "matrixControlsPresent", + ], + true, + )?; + require_bool( + &close, + &[ + "closureReview", + "familyAssertions", + "safeFamilyPlanning", + "allClosureProofsPresent", + ], + true, )?; require_bool(&close, &["privateStateExposed"], false)?; require_text( @@ -298,11 +328,25 @@ fn run_smoke(args: Args) -> Result { require_text(&brief_text, "requires_soul_evidence_needs = true")?; require_text(&brief_text, "[decomposition]")?; require_text(&brief_text, "\"repo.consensus_brief\"")?; + require_text(&brief_text, "\"repo.interpreter_brief\"")?; require_text(&brief_text, "\"repo.objective_draft\"")?; + require_text(&brief_text, "\"repo.adoption_request\"")?; + require_text(&brief_text, "\"repo.scheduling_request\"")?; require_text(&brief_text, "\"repo.task_card\"")?; require_text(&brief_text, "\"repo.work_order\"")?; require_text(&brief_text, "\"repo.verification_request\"")?; + require_text(&brief_text, "\"repo.maintainer_review_request\"")?; + require_text(&brief_text, "\"repo.artifact_acceptance_request\"")?; require_text(&brief_text, "\"repo.publication_request\"")?; + require_text(&brief_text, "\"repo.sync_request\"")?; + require_text(&brief_text, "\"repo.pr_request\"")?; + require_text(&brief_text, "\"repo.credit_request\"")?; + require_text(&brief_text, "\"repo.metrics_request\"")?; + require_text(&brief_text, "\"repo.doctrine_update_request\"")?; + require_text(&brief_text, "\"repo.secret_policy_request\"")?; + require_text(&brief_text, "\"repo.dependency_policy_request\"")?; + require_text(&brief_text, "\"repo.deployment_config\"")?; + require_text(&brief_text, "\"repo.deployment_request\"")?; require_text( &brief_text, "candidate_items_must_name_requested_paths = true", @@ -315,6 +359,44 @@ fn run_smoke(args: Args) -> Result { &brief_text, "candidate_items_must_name_evidence_needs = true", )?; + require_text(&brief_text, "candidate_items_must_name_owner = true")?; + require_text( + &brief_text, + "candidate_items_must_name_authority_denials = true", + )?; + require_text( + &brief_text, + "candidate_items_must_name_closure_proofs = true", + )?; + require_text(&brief_text, "[safe_family_matrix]")?; + require_text(&brief_text, "preparation = [")?; + require_text(&brief_text, "adoption_and_queue = [")?; + require_text(&brief_text, "execution_and_review = [")?; + require_text(&brief_text, "publication_and_accounting = [")?; + require_text(&brief_text, "policy_and_deployment = [")?; + require_text(&brief_text, "matrix_is_planning_only = true")?; + require_text(&brief_text, "families_may_not_inherit_authority = true")?; + require_text( + &brief_text, + "family_choice_requires_mind_or_self_review = true", + )?; + require_text(&brief_text, "[closure_proofs]")?; + require_text(&brief_text, "soul_family_assertions_required = true")?; + require_text( + &brief_text, + "modeling_map_update_required_after_verified_consequence = true", + )?; + require_text(&brief_text, "mind_gateway_review_required = true")?; + require_text(&brief_text, "mind_state_commit_required = true")?; + require_text( + &brief_text, + "bifrost_publication_gate_required_for_upstream = true", + )?; + require_text( + &brief_text, + "upstream_main_sync_required_after_publication = true", + )?; + require_text(&brief_text, "private_state_redaction_required = true")?; require_text(&brief_text, "[gates]")?; require_text(&brief_text, "mind_interpreter_required = true")?; require_text(&brief_text, "self_queue_selection_required = true")?; @@ -358,6 +440,9 @@ fn run_smoke(args: Args) -> Result { "safeFamilyPlanningSchema": close["closureReview"]["familyAssertions"]["safeFamilyPlanning"]["schemaVersion"], "candidateNextSafeFamilyCount": close["closureReview"]["familyAssertions"]["safeFamilyPlanning"]["candidateNextSafeFamilyCount"], "allExpectedCandidateFamiliesPresent": close["closureReview"]["familyAssertions"]["safeFamilyPlanning"]["allExpectedCandidateFamiliesPresent"], + "allMatrixGroupsComplete": close["closureReview"]["familyAssertions"]["safeFamilyPlanning"]["allMatrixGroupsComplete"], + "matrixControlsPresent": close["closureReview"]["familyAssertions"]["safeFamilyPlanning"]["matrixControlsPresent"], + "allClosureProofsPresent": close["closureReview"]["familyAssertions"]["safeFamilyPlanning"]["allClosureProofsPresent"], "allRequiredGatesPresent": close["closureReview"]["familyAssertions"]["safeFamilyPlanning"]["allRequiredGatesPresent"], "authorityDenied": close["closureReview"]["familyAssertions"]["safeFamilyPlanning"]["authorityDenied"], "briefIsDraft": true, diff --git a/epiphany-core/src/bin/epiphany-work.rs b/epiphany-core/src/bin/epiphany-work.rs index 200e5f42..f63dc912 100644 --- a/epiphany-core/src/bin/epiphany-work.rs +++ b/epiphany-core/src/bin/epiphany-work.rs @@ -1,8 +1,30 @@ -use anyhow::anyhow; use anyhow::Context; use anyhow::Result; +use anyhow::anyhow; use chrono::DateTime; use chrono::Utc; +use epiphany_core::EPIPHANY_CULTMESH_LOCAL_AREA_VERSE_ID; +use epiphany_core::EPIPHANY_CULTMESH_REPO_WORK_MAP_ENTRY_LATEST_KEY; +use epiphany_core::EPIPHANY_CULTMESH_REPO_WORK_MAP_ENTRY_SCHEMA_VERSION; +use epiphany_core::EPIPHANY_CULTMESH_REPO_WORK_OVERVIEW_SCHEMA_VERSION; +use epiphany_core::EPIPHANY_CULTMESH_REPO_WORK_PUBLIC_PROOF_SCHEMA_VERSION; +use epiphany_core::EpiphanyCultMeshRepoWorkMapEntry; +use epiphany_core::EpiphanyCultMeshRepoWorkOverviewEntry; +use epiphany_core::EpiphanyCultMeshRepoWorkPublicProofEntry; +use epiphany_core::HANDS_ACTION_INTENT_SCHEMA_VERSION; +use epiphany_core::HANDS_COMMAND_RECEIPT_TYPE; +use epiphany_core::HANDS_COMMIT_RECEIPT_TYPE; +use epiphany_core::HANDS_PATCH_RECEIPT_TYPE; +use epiphany_core::HANDS_PR_RECEIPT_TYPE; +use epiphany_core::HandsActionIntent; +use epiphany_core::MIND_GATEWAY_REVIEW_SCHEMA_VERSION; +use epiphany_core::MindGatewayDecision; +use epiphany_core::MindGatewayReview; +use epiphany_core::RuntimeSpineInitOptions; +use epiphany_core::SOUL_VERDICT_RECEIPT_SCHEMA_VERSION; +use epiphany_core::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION; +use epiphany_core::SoulVerdictReceipt; +use epiphany_core::SubstrateGateRepoAccessGrantReceipt; use epiphany_core::hands_action_review_for_intent; use epiphany_core::hands_command_receipt_for_review; use epiphany_core::hands_commit_receipt_for_review; @@ -34,32 +56,10 @@ use epiphany_core::runtime_latest_hands_receipt_chain_after; use epiphany_core::write_epiphany_cultmesh_repo_work_map_entry; use epiphany_core::write_epiphany_cultmesh_repo_work_overview; use epiphany_core::write_epiphany_cultmesh_repo_work_public_proof; -use epiphany_core::EpiphanyCultMeshRepoWorkMapEntry; -use epiphany_core::EpiphanyCultMeshRepoWorkOverviewEntry; -use epiphany_core::EpiphanyCultMeshRepoWorkPublicProofEntry; -use epiphany_core::HandsActionIntent; -use epiphany_core::MindGatewayDecision; -use epiphany_core::MindGatewayReview; -use epiphany_core::RuntimeSpineInitOptions; -use epiphany_core::SoulVerdictReceipt; -use epiphany_core::SubstrateGateRepoAccessGrantReceipt; -use epiphany_core::EPIPHANY_CULTMESH_LOCAL_AREA_VERSE_ID; -use epiphany_core::EPIPHANY_CULTMESH_REPO_WORK_MAP_ENTRY_LATEST_KEY; -use epiphany_core::EPIPHANY_CULTMESH_REPO_WORK_MAP_ENTRY_SCHEMA_VERSION; -use epiphany_core::EPIPHANY_CULTMESH_REPO_WORK_OVERVIEW_SCHEMA_VERSION; -use epiphany_core::EPIPHANY_CULTMESH_REPO_WORK_PUBLIC_PROOF_SCHEMA_VERSION; -use epiphany_core::HANDS_ACTION_INTENT_SCHEMA_VERSION; -use epiphany_core::HANDS_COMMAND_RECEIPT_TYPE; -use epiphany_core::HANDS_COMMIT_RECEIPT_TYPE; -use epiphany_core::HANDS_PATCH_RECEIPT_TYPE; -use epiphany_core::HANDS_PR_RECEIPT_TYPE; -use epiphany_core::MIND_GATEWAY_REVIEW_SCHEMA_VERSION; -use epiphany_core::SOUL_VERDICT_RECEIPT_SCHEMA_VERSION; -use epiphany_core::SUBSTRATE_GATE_REPO_ACCESS_GRANT_RECEIPT_SCHEMA_VERSION; use serde::Deserialize; use serde::Serialize; -use serde_json::json; use serde_json::Value; +use serde_json::json; use sha2::Digest; use sha2::Sha256; use std::env; @@ -1467,9 +1467,9 @@ fn run_accept(args: AcceptArgs) -> Result { .join("swarm-online") .join("repo-swarm-online-receipt.json") }); - let online_receipt = read_json(&online_receipt_path).with_context(|| { - "repo swarm online receipt is required; run epiphany-swarm online first" - })?; + let online_receipt = read_json(&online_receipt_path).with_context( + || "repo swarm online receipt is required; run epiphany-swarm online first", + )?; let local_verse_store = args.local_verse_store.unwrap_or_else(|| { path_from_json(&online_receipt, &["localVerseStore"]) .unwrap_or_else(|| workspace.join(".epiphany").join("local-verse.ccmp")) @@ -1630,9 +1630,9 @@ fn run_persona_intake(args: PersonaIntakeArgs) -> Result { .join("swarm-online") .join("repo-swarm-online-receipt.json") }); - let online_receipt = read_json(&online_receipt_path).with_context(|| { - "repo swarm online receipt is required; run epiphany-swarm online first" - })?; + let online_receipt = read_json(&online_receipt_path).with_context( + || "repo swarm online receipt is required; run epiphany-swarm online first", + )?; let local_verse_store = args.local_verse_store.clone().unwrap_or_else(|| { path_from_json(&online_receipt, &["localVerseStore"]) .unwrap_or_else(|| workspace.join(".epiphany").join("local-verse.ccmp")) @@ -3444,11 +3444,25 @@ fn derive_repo_planning_brief_plan( let brief_id = format!("repo-planning-brief:{item_slug}"); let recommended_families = vec![ "repo.consensus_brief".to_string(), + "repo.interpreter_brief".to_string(), "repo.objective_draft".to_string(), + "repo.adoption_request".to_string(), + "repo.scheduling_request".to_string(), "repo.task_card".to_string(), "repo.work_order".to_string(), "repo.verification_request".to_string(), + "repo.maintainer_review_request".to_string(), + "repo.artifact_acceptance_request".to_string(), "repo.publication_request".to_string(), + "repo.sync_request".to_string(), + "repo.pr_request".to_string(), + "repo.credit_request".to_string(), + "repo.metrics_request".to_string(), + "repo.doctrine_update_request".to_string(), + "repo.secret_policy_request".to_string(), + "repo.dependency_policy_request".to_string(), + "repo.deployment_config".to_string(), + "repo.deployment_request".to_string(), ]; let lines = vec![ "# Epiphany repo planning brief.".to_string(), @@ -3499,10 +3513,15 @@ fn derive_repo_planning_brief_plan( "[decomposition]".to_string(), "sequence = [".to_string(), " \"repo.consensus_brief\",".to_string(), + " \"repo.interpreter_brief\",".to_string(), " \"repo.objective_draft\",".to_string(), + " \"repo.adoption_request\",".to_string(), + " \"repo.scheduling_request\",".to_string(), " \"repo.task_card\",".to_string(), " \"repo.work_order\",".to_string(), " \"repo.verification_request\",".to_string(), + " \"repo.maintainer_review_request\",".to_string(), + " \"repo.artifact_acceptance_request\",".to_string(), " \"repo.publication_request\"".to_string(), "]".to_string(), "max_candidate_work_items = 6".to_string(), @@ -3510,8 +3529,30 @@ fn derive_repo_planning_brief_plan( "candidate_items_must_name_requested_paths = true".to_string(), "candidate_items_must_name_verification_asks = true".to_string(), "candidate_items_must_name_evidence_needs = true".to_string(), + "candidate_items_must_name_owner = true".to_string(), + "candidate_items_must_name_authority_denials = true".to_string(), + "candidate_items_must_name_closure_proofs = true".to_string(), "shell_commands_must_be_deterministic_lowerings = true".to_string(), String::new(), + "[safe_family_matrix]".to_string(), + "preparation = [\"repo.consensus_brief\", \"repo.interpreter_brief\", \"repo.objective_draft\", \"repo.task_card\"]".to_string(), + "adoption_and_queue = [\"repo.adoption_request\", \"repo.scheduling_request\"]".to_string(), + "execution_and_review = [\"repo.work_order\", \"repo.verification_request\", \"repo.maintainer_review_request\", \"repo.artifact_acceptance_request\"]".to_string(), + "publication_and_accounting = [\"repo.publication_request\", \"repo.sync_request\", \"repo.pr_request\", \"repo.credit_request\", \"repo.metrics_request\"]".to_string(), + "policy_and_deployment = [\"repo.doctrine_update_request\", \"repo.secret_policy_request\", \"repo.dependency_policy_request\", \"repo.deployment_config\", \"repo.deployment_request\"]".to_string(), + "matrix_is_planning_only = true".to_string(), + "families_may_not_inherit_authority = true".to_string(), + "family_choice_requires_mind_or_self_review = true".to_string(), + String::new(), + "[closure_proofs]".to_string(), + "soul_family_assertions_required = true".to_string(), + "modeling_map_update_required_after_verified_consequence = true".to_string(), + "mind_gateway_review_required = true".to_string(), + "mind_state_commit_required = true".to_string(), + "bifrost_publication_gate_required_for_upstream = true".to_string(), + "upstream_main_sync_required_after_publication = true".to_string(), + "private_state_redaction_required = true".to_string(), + String::new(), "[gates]".to_string(), "mind_interpreter_required = true".to_string(), "mind_adoption_required = true".to_string(), @@ -3549,7 +3590,7 @@ fn derive_repo_planning_brief_plan( "[verification]".to_string(), "asks = [".to_string(), " \"Soul verifies the planning brief path changed and contains the accepted pressure summary.\",".to_string(), - " \"Soul verifies the brief names candidate safe families, requested-path/evidence requirements, and gate order without granting action authority.\",".to_string(), + " \"Soul verifies the brief names the safe-family matrix, requested-path/evidence/closure requirements, and gate order without granting action authority.\",".to_string(), " \"Soul verifies the brief preserves private-state seals and forbids deployment execution authority.\",".to_string(), " \"Soul verifies no paths outside the declared planning brief changed.\"".to_string(), "]".to_string(), @@ -3570,7 +3611,7 @@ fn derive_repo_planning_brief_plan( commit_message: format!("Add planning brief for work item {}", input.item), verification_asks: vec![ "Soul verifies the repo planning brief path changed and contains the accepted pressure summary.".to_string(), - "Soul verifies the brief names allowed next safe families, path/evidence requirements, and Mind/Self/Substrate/Hands/Soul/Bifrost/Idunn gates without authorizing action.".to_string(), + "Soul verifies the brief names allowed next safe-family groups, path/evidence/closure requirements, and Mind/Self/Substrate/Hands/Soul/Bifrost/Idunn gates without authorizing action.".to_string(), "Soul verifies no paths outside the declared planning brief changed.".to_string(), ], rollback_hints: vec![ @@ -6709,17 +6750,63 @@ fn closure_family_assertions( "planning-brief-decomposition-contract", content.contains("[decomposition]") && content.contains("\"repo.consensus_brief\"") + && content.contains("\"repo.interpreter_brief\"") && content.contains("\"repo.objective_draft\"") + && content.contains("\"repo.adoption_request\"") + && content.contains("\"repo.scheduling_request\"") && content.contains("\"repo.task_card\"") && content.contains("\"repo.work_order\"") && content.contains("\"repo.verification_request\"") + && content.contains("\"repo.maintainer_review_request\"") + && content.contains("\"repo.artifact_acceptance_request\"") && content.contains("\"repo.publication_request\"") && content.contains("candidate_items_must_name_requested_paths = true") && content.contains("candidate_items_must_name_verification_asks = true") - && content.contains("candidate_items_must_name_evidence_needs = true"), + && content.contains("candidate_items_must_name_evidence_needs = true") + && content.contains("candidate_items_must_name_owner = true") + && content.contains("candidate_items_must_name_authority_denials = true") + && content.contains("candidate_items_must_name_closure_proofs = true"), "Committed planning brief names the safe-family decomposition contract." .to_string(), ); + push_assertion( + &mut assertions, + "planning-brief-family-matrix", + content.contains("[safe_family_matrix]") + && content.contains("preparation = [") + && content.contains("adoption_and_queue = [") + && content.contains("execution_and_review = [") + && content.contains("publication_and_accounting = [") + && content.contains("policy_and_deployment = [") + && content.contains("\"repo.sync_request\"") + && content.contains("\"repo.pr_request\"") + && content.contains("\"repo.credit_request\"") + && content.contains("\"repo.metrics_request\"") + && content.contains("\"repo.doctrine_update_request\"") + && content.contains("\"repo.secret_policy_request\"") + && content.contains("\"repo.dependency_policy_request\"") + && content.contains("\"repo.deployment_config\"") + && content.contains("\"repo.deployment_request\"") + && content.contains("matrix_is_planning_only = true") + && content.contains("families_may_not_inherit_authority = true") + && content.contains("family_choice_requires_mind_or_self_review = true"), + "Committed planning brief carries the safe-family matrix without authority inheritance." + .to_string(), + ); + push_assertion( + &mut assertions, + "planning-brief-closure-proof-contract", + content.contains("[closure_proofs]") + && content.contains("soul_family_assertions_required = true") + && content.contains("modeling_map_update_required_after_verified_consequence = true") + && content.contains("mind_gateway_review_required = true") + && content.contains("mind_state_commit_required = true") + && content.contains("bifrost_publication_gate_required_for_upstream = true") + && content.contains("upstream_main_sync_required_after_publication = true") + && content.contains("private_state_redaction_required = true"), + "Committed planning brief names Soul, Modeling, Mind, Bifrost, upstream-main, and redaction closure proofs." + .to_string(), + ); push_assertion( &mut assertions, "planning-brief-gates-present", @@ -8226,17 +8313,14 @@ fn closure_family_assertions( push_assertion( &mut assertions, "dependency-policy-request-schema-present", - content.contains( - "schema_version = \"epiphany.repo_dependency_policy_request.v0\"", - ), + content.contains("schema_version = \"epiphany.repo_dependency_policy_request.v0\""), "Committed dependency policy request carries the schema version.".to_string(), ); push_assertion( &mut assertions, "dependency-policy-request-family-present", content.contains("safe_action_family = \"repo.dependency_policy_request\""), - "Committed dependency policy request carries the safe action family." - .to_string(), + "Committed dependency policy request carries the safe action family.".to_string(), ); push_assertion( &mut assertions, @@ -8340,8 +8424,7 @@ fn closure_family_assertions( &mut assertions, "dependency-policy-request-private-seal", content.contains("private_state_exposed = false"), - "Committed dependency policy request preserves the private-state seal." - .to_string(), + "Committed dependency policy request preserves the private-state seal.".to_string(), ); } "repo.deployment_request" => { @@ -8596,11 +8679,69 @@ fn closure_family_assertions( fn planning_brief_safe_family_readback(content: &str) -> Value { let candidate_families = [ "repo.consensus_brief", + "repo.interpreter_brief", "repo.objective_draft", + "repo.adoption_request", + "repo.scheduling_request", "repo.task_card", "repo.work_order", "repo.verification_request", + "repo.maintainer_review_request", + "repo.artifact_acceptance_request", "repo.publication_request", + "repo.sync_request", + "repo.pr_request", + "repo.credit_request", + "repo.metrics_request", + "repo.doctrine_update_request", + "repo.secret_policy_request", + "repo.dependency_policy_request", + "repo.deployment_config", + "repo.deployment_request", + ]; + let matrix_groups: Vec<(&str, Vec<&str>)> = vec![ + ( + "preparation", + vec![ + "repo.consensus_brief", + "repo.interpreter_brief", + "repo.objective_draft", + "repo.task_card", + ], + ), + ( + "adoption_and_queue", + vec!["repo.adoption_request", "repo.scheduling_request"], + ), + ( + "execution_and_review", + vec![ + "repo.work_order", + "repo.verification_request", + "repo.maintainer_review_request", + "repo.artifact_acceptance_request", + ], + ), + ( + "publication_and_accounting", + vec![ + "repo.publication_request", + "repo.sync_request", + "repo.pr_request", + "repo.credit_request", + "repo.metrics_request", + ], + ), + ( + "policy_and_deployment", + vec![ + "repo.doctrine_update_request", + "repo.secret_policy_request", + "repo.dependency_policy_request", + "repo.deployment_config", + "repo.deployment_request", + ], + ), ]; let candidate_rows: Vec = candidate_families .iter() @@ -8611,6 +8752,25 @@ fn planning_brief_safe_family_readback(content: &str) -> Value { }) }) .collect(); + let matrix_rows: Vec = matrix_groups + .iter() + .map(|(group, families)| { + let families_present = families + .iter() + .filter(|family| content.contains(&format!("\"{family}\""))) + .count(); + json!({ + "group": group, + "familyCount": families.len(), + "presentCount": families_present, + "complete": families_present == families.len(), + "families": families.iter().map(|family| json!({ + "safeActionFamily": family, + "present": content.contains(&format!("\"{family}\"")), + })).collect::>(), + }) + }) + .collect(); let gates = json!({ "mindInterpreterRequired": content.contains("mind_interpreter_required = true"), "mindAdoptionRequired": content.contains("mind_adoption_required = true"), @@ -8626,8 +8786,25 @@ fn planning_brief_safe_family_readback(content: &str) -> Value { "requestedPathsRequired": content.contains("candidate_items_must_name_requested_paths = true"), "verificationAsksRequired": content.contains("candidate_items_must_name_verification_asks = true"), "evidenceNeedsRequired": content.contains("candidate_items_must_name_evidence_needs = true"), + "ownerRequired": content.contains("candidate_items_must_name_owner = true"), + "authorityDenialsRequired": content.contains("candidate_items_must_name_authority_denials = true"), + "closureProofsRequired": content.contains("candidate_items_must_name_closure_proofs = true"), "deterministicLoweringRequired": content.contains("shell_commands_must_be_deterministic_lowerings = true"), }); + let matrix_controls = json!({ + "matrixIsPlanningOnly": content.contains("matrix_is_planning_only = true"), + "familiesMayNotInheritAuthority": content.contains("families_may_not_inherit_authority = true"), + "familyChoiceRequiresMindOrSelfReview": content.contains("family_choice_requires_mind_or_self_review = true"), + }); + let closure_proofs = json!({ + "soulFamilyAssertionsRequired": content.contains("soul_family_assertions_required = true"), + "modelingMapUpdateRequiredAfterVerifiedConsequence": content.contains("modeling_map_update_required_after_verified_consequence = true"), + "mindGatewayReviewRequired": content.contains("mind_gateway_review_required = true"), + "mindStateCommitRequired": content.contains("mind_state_commit_required = true"), + "bifrostPublicationGateRequiredForUpstream": content.contains("bifrost_publication_gate_required_for_upstream = true"), + "upstreamMainSyncRequiredAfterPublication": content.contains("upstream_main_sync_required_after_publication = true"), + "privateStateRedactionRequired": content.contains("private_state_redaction_required = true"), + }); let authority_denials = json!({ "objectiveAdoptionAuthorized": content.contains("objective_adoption_authorized = true"), "selfSchedulingAuthorized": content.contains("self_scheduling_authorized = true"), @@ -8655,6 +8832,17 @@ fn planning_brief_safe_family_readback(content: &str) -> Value { .as_object() .map(|fields| fields.values().all(|value| value.as_bool() == Some(true))) .unwrap_or(false); + let all_matrix_groups_complete = matrix_rows + .iter() + .all(|row| row.get("complete").and_then(Value::as_bool) == Some(true)); + let matrix_controls_present = matrix_controls + .as_object() + .map(|fields| fields.values().all(|value| value.as_bool() == Some(true))) + .unwrap_or(false); + let all_closure_proofs_present = closure_proofs + .as_object() + .map(|fields| fields.values().all(|value| value.as_bool() == Some(true))) + .unwrap_or(false); let authority_denied = authority_denials .as_object() .map(|fields| fields.values().all(|value| value.as_bool() == Some(false))) @@ -8666,9 +8854,15 @@ fn planning_brief_safe_family_readback(content: &str) -> Value { "candidateNextSafeFamilies": candidate_rows, "candidateNextSafeFamilyCount": present_count, "allExpectedCandidateFamiliesPresent": present_count == candidate_families.len(), + "safeFamilyMatrix": matrix_rows, + "allMatrixGroupsComplete": all_matrix_groups_complete, "requirements": requirements, "gates": gates, "allRequiredGatesPresent": all_required_gates_present, + "matrixControls": matrix_controls, + "matrixControlsPresent": matrix_controls_present, + "closureProofs": closure_proofs, + "allClosureProofsPresent": all_closure_proofs_present, "authorityDenials": authority_denials, "authorityDenied": authority_denied, "allPlanningRequirementsPresent": all_requirements_present, @@ -11223,13 +11417,27 @@ fn run_overview(args: OverviewArgs) -> Result { format!("next {next_safe_move}"), format!( "CONSENSUS | feedback={} | receipt={} | route={} | publicRefs={} | candidates={} | planFamily={} | modelAuthored={} | private=false", - intake_consensus_readback["feedbackId"].as_str().unwrap_or("missing"), - intake_consensus_readback["consensusReceiptId"].as_str().unwrap_or("missing"), - intake_consensus_readback["requestedConsensusRoute"].as_str().unwrap_or("missing"), - intake_consensus_readback["publicDiscussionRefCount"].as_u64().unwrap_or(0), - intake_consensus_readback["candidateActionRefCount"].as_u64().unwrap_or(0), - intake_consensus_readback["planSafeActionFamily"].as_str().unwrap_or("missing"), - intake_consensus_readback["planModelAuthored"].as_bool().unwrap_or(false), + intake_consensus_readback["feedbackId"] + .as_str() + .unwrap_or("missing"), + intake_consensus_readback["consensusReceiptId"] + .as_str() + .unwrap_or("missing"), + intake_consensus_readback["requestedConsensusRoute"] + .as_str() + .unwrap_or("missing"), + intake_consensus_readback["publicDiscussionRefCount"] + .as_u64() + .unwrap_or(0), + intake_consensus_readback["candidateActionRefCount"] + .as_u64() + .unwrap_or(0), + intake_consensus_readback["planSafeActionFamily"] + .as_str() + .unwrap_or("missing"), + intake_consensus_readback["planModelAuthored"] + .as_bool() + .unwrap_or(false), ), format!("closure {closure_status} soul {soul_verdict}"), format!("publication {publication_status} sync {sync_status}"), @@ -13897,11 +14105,7 @@ fn string_array_field(value: &Value, field: &str) -> Vec { } fn default_if_empty(values: Vec, defaults: Vec) -> Vec { - if values.is_empty() { - defaults - } else { - values - } + if values.is_empty() { defaults } else { values } } fn adopted_action_item_from_plan(plan: &Value) -> Value { diff --git a/notes/epiphany-repo-swarm-mvp-contract.md b/notes/epiphany-repo-swarm-mvp-contract.md index 5536d6c2..ba2286e2 100644 --- a/notes/epiphany-repo-swarm-mvp-contract.md +++ b/notes/epiphany-repo-swarm-mvp-contract.md @@ -539,10 +539,10 @@ route `imagination.consensus_discovery`, two candidate action refs, model-author safe family `repo.consensus_brief`, no Hands/durable-state/publication authority, and `privateStateExposed=false`. -The next family-friendly Imagination planning smoke proved safe-family -decomposition cargo, and its closure readback now exposes the planning family -instead of only a generic pass bit: -`.epiphany-smoke\repo-planning-brief-family-20260620-235939` ran init -> +The richer family-friendly Imagination planning smoke now proves the full +safe-family matrix and closure expectations instead of only the original +six-family chain: +`.epiphany-smoke\repo-planning-brief-family-20260621-084546` ran init -> online -> accept -> `derive-plan --action-family repo-planning-brief --model-ref repo-planning-brief-family-smoke-imagination-v1 --model-authored` -> tick through run/adopt/execute/close on a fresh repo. The plan carried @@ -551,17 +551,20 @@ online -> accept -> `derive-plan --action-family repo-planning-brief `pathScopeMatched=true` and `familyAssertions.status=passed`; the closure packet carried `safeFamilyPlanning.schemaVersion=epiphany.repo_work_safe_family_planning_readback.v0`, -`candidateNextSafeFamilyCount=6`, +`candidateNextSafeFamilyCount=20`, `allExpectedCandidateFamiliesPresent=true`, -`allPlanningRequirementsPresent=true`, `allRequiredGatesPresent=true`, -`authorityDenied=true`, and `privateStateExposed=false`. The committed brief -still carries `schema_version = "epiphany.repo_planning_brief.v0"`, draft -Imagination decomposition state, candidate next safe families, requested-path / -verification-ask / evidence-need requirements, Mind/Self/Substrate/Hands/Soul / -Bifrost/Idunn gate ordering, denied objective adoption, scheduling, substrate -access, Hands action, shell, commit, publication, deployment execution, -cross-body mutation, private transcript/raw-result access, and -`privateStateExposed=false`. +`allMatrixGroupsComplete=true`, `matrixControlsPresent=true`, +`allClosureProofsPresent=true`, `allPlanningRequirementsPresent=true`, +`allRequiredGatesPresent=true`, `authorityDenied=true`, and +`privateStateExposed=false`. The committed brief still carries +`schema_version = "epiphany.repo_planning_brief.v0"`, draft Imagination +decomposition state, safe-family matrix groups for preparation, adoption/queue, +execution/review, publication/accounting, and policy/deployment, requested-path +/ verification-ask / evidence-need / owner / authority-denial / closure-proof +requirements, Mind/Self/Substrate/Hands/Soul/Bifrost/Idunn gate ordering, +denied objective adoption, scheduling, substrate access, Hands action, shell, +commit, publication, deployment execution, cross-body mutation, private +transcript/raw-result access, and `privateStateExposed=false`. The next Mind-owned interpreter smoke proved public-pressure-to-action-semantics cargo between Imagination consensus and any downstream action family: @@ -1823,7 +1826,7 @@ temptation wearing clean robes. | Repo Body birth | `epiphany-repo init` exists and writes repo-local stores plus branch workbench intent. | Keep birth startup-only, review-gated, and branch-oriented. | | Local Verse online | `epiphany-swarm online` seeds repo-local CultMesh, standing-faculty SoA, topology, liveness, Eve, and tool sight. | Keep private Verse sealed while exposing operator-safe repo status. | | Persona/Bifrost intake | `epiphany-work accept` records pressure and candidate action refs without Hands authority. `epiphany-work persona-intake` now invokes the Persona bubble speech-audit path, records public discussion and candidate-action refs, then delegates to `accept`; wrapper mode `repo-persona-intake` exposes the operator mouth. | Deepen the intake-to-Imagination interpreter so richer model-authored action items can be proposed without granting Hands, publication, or durable-state authority at the mouth edge. | -| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, planning facets (assumptions, constraints, non-goals, open questions, decision points, and evidence needs), and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-planning-brief` / `repo.planning_brief`, `repo-interpreter-brief` / `repo.interpreter_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo-doctrine-update-request` / `repo.doctrine_update_request`, `repo-secret-policy-request` / `repo.secret_policy_request`, `repo-deployment-config` / `repo.deployment_config`, and `repo-deployment-request` / `repo.deployment_request`. `repo.planning_brief` is the rough-pressure decomposition family: it names candidate next safe families, requested-path / verification-ask / evidence-need requirements, and Mind/Self/Substrate/Hands/Soul/Bifrost/Idunn gates while granting no action authority; Soul closure now emits `epiphany.repo_work_safe_family_planning_readback.v0` for that family with candidate-family counts, gate/readiness flags, authority denials, and private-state seal. `repo.interpreter_brief` is the Mind-owned semantic interpretation family: it turns public Persona/Imagination pressure into draft action semantics with consensus, path, verification, evidence, rollback, non-goal, open-question, and gate checks while granting no adoption, scheduling, substrate, Hands, shell, commit, publication, deployment, cross-body, or private-state authority. `adopt` writes `epiphany.repo_work_mind_adoption_decision.v0` before the main adoption receipt cites the decision and grants branch-local Hands authority, and refuses plan-derived items that lack explicit verification asks or planning evidence needs. `plan` remains manual quarantine scaffolding. | Deepen closure/map readback and Bifrost-first external-work accounting without turning model text into arbitrary shell authority. | +| Imagination planning | `derive-plan` now writes a typed `epiphany.repo_work_imagination_action_items_receipt.v0` before the executable plan receipt. The action-item receipt can carry model provenance, allowed safe family, requested paths, verification asks, stop conditions, escalation reasons, planning facets (assumptions, constraints, non-goals, open questions, decision points, and evidence needs), and private-state seals; command text remains deterministic safe-family lowering for `append-worklog`, `planning-note`, `checklist-note`, `section-note` / `repo.markdown_managed_section`, `repo-status-section` / `repo.status_section`, `task-card` / `repo.task_card`, `repo-manifest` / `repo.body_manifest`, `repo-tool-capabilities` / `repo.tool_capabilities`, `repo-tool-request` / `repo.tool_request`, `repo-eve-surface` / `repo.eve_surface`, `repo-collaboration-policy` / `repo.collaboration_policy`, `repo-collaboration-topic` / `repo.collaboration_topic`, `repo-consensus-brief` / `repo.consensus_brief`, `repo-planning-brief` / `repo.planning_brief`, `repo-interpreter-brief` / `repo.interpreter_brief`, `repo-objective-draft` / `repo.objective_draft`, `repo-adoption-request` / `repo.adoption_request`, `repo-scheduling-request` / `repo.scheduling_request`, `repo-work-order` / `repo.work_order`, `repo-verification-request` / `repo.verification_request`, `repo-publication-request` / `repo.publication_request`, `repo-sync-request` / `repo.sync_request`, `repo-maintainer-review-request` / `repo.maintainer_review_request`, `repo-pr-request` / `repo.pr_request`, `repo-credit-request` / `repo.credit_request`, `repo-artifact-acceptance-request` / `repo.artifact_acceptance_request`, `repo-metrics-request` / `repo.metrics_request`, `repo-doctrine-update-request` / `repo.doctrine_update_request`, `repo-secret-policy-request` / `repo.secret_policy_request`, `repo-dependency-policy-request` / `repo.dependency_policy_request`, `repo-deployment-config` / `repo.deployment_config`, and `repo-deployment-request` / `repo.deployment_request`. `repo.planning_brief` is the rough-pressure decomposition family: it now names twenty candidate next safe families grouped as preparation, adoption/queue, execution/review, publication/accounting, and policy/deployment; requires requested paths, verification asks, evidence needs, owner, authority denials, and closure proofs; and names Mind/Self/Substrate/Hands/Soul/Bifrost/Idunn gates while granting no action authority. Soul closure emits `epiphany.repo_work_safe_family_planning_readback.v0` for that family with candidate-family counts, grouped matrix completeness, matrix controls, closure proof flags, gate/readiness flags, authority denials, and private-state seal. `repo.interpreter_brief` is the Mind-owned semantic interpretation family: it turns public Persona/Imagination pressure into draft action semantics with consensus, path, verification, evidence, rollback, non-goal, open-question, and gate checks while granting no adoption, scheduling, substrate, Hands, shell, commit, publication, deployment, cross-body, or private-state authority. `adopt` writes `epiphany.repo_work_mind_adoption_decision.v0` before the main adoption receipt cites the decision and grants branch-local Hands authority, and refuses plan-derived items that lack explicit verification asks or planning evidence needs. `plan` remains manual quarantine scaffolding. | Deepen closure/map readback and Bifrost-first external-work accounting without turning model text into arbitrary shell authority. | | Self scheduling | `tick` and `serve` prove one-step branch-local advancement, brake refusal, active-turn refusal, cooldown, and stale-turn recovery; `tick` now routes executed branch-local work through the existing Soul/Modeling/Mind `close` gate; `queue-run` selects tick-actionable rows from the typed repo-work queue and delegates to `tick`; `epiphany-swarm run` is the bounded operator mouth over that queue/tick physiology; `repo-work-service-plan`, `repo-work-service-runbook`, `repo-work-service-launch`, and `repo-work-service-audit` write Idunn lifecycle receipts/artifacts for the same queue-run command and prove non-mutating launch/readiness closure. | Keep any future queue-run service install/start mutation behind Idunn and explicit elevated operator authority. | | Branch-local Hands work | `adopt` and `execute` create approved Hands gates, run planned commands, stage declared paths, commit on `epiphany/*`, and write receipts. | Keep mutation branch-contained and receipt-backed; broaden only through typed plan families, not ad hoc shell freedom. | | Soul/Modeling/Mind closure | `close` verifies the Hands commit, writes `epiphany.repo_work_closure_review.v0`, refuses path-scope mismatches, refuses missing/tampered/non-affirmative Mind adoption proof, runs known safe-family content assertions, optionally gates on model-authored closure verdicts, can require verification output to cite declared changed paths with `--require-source-grounding`, writes Soul/Modeling/Mind receipts, admits a compact typed repo map entry into `.epiphany/state/repo-work-map.msgpack`, and mirrors that admitted fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0`. | Keep extending closure toward source-grounded semantic review and richer semantic map lenses, while preserving deterministic local closure for simple mechanical work. | diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index a156655a..036337c5 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -157,7 +157,7 @@ remembers doctrine; the branch remembers the blade. - 2026-06-20: `repo-deployment-request` is now live as Idunn-facing deployment request cargo. `epiphany-work derive-plan --action-family repo-deployment-request` writes `.epiphany/deployment-requests/.toml` with safe family `repo.deployment_request`, status `awaiting-idunn-review`, git-push-observed-by-Idunn trigger, Idunn/Maintainer ownership, target environment, git ref/branch, deployment script ref, script hash or review ref, host access policy, secret policy, rollback plan, aftercare checks, Eyes/Mind/Soul/maintainer/secret-policy/Bifrost/Idunn deployment/aftercare receipt requirements, and denials for direct deployment, SSH, git push, service lifecycle, Hands, publication, merge, cross-body mutation, private Verse rummaging, and private-state exposure. Soul closure assertions inspect schema, family, summary, request state, antecedents, receipt contract, deployment packet, authority gates, and private-state seal. Focused smoke `.epiphany-smoke\repo-deployment-request-family-20260620-195605` ran init -> online -> accept -> repo-deployment-request derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/deployment-requests/repo-deployment-request-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `awaitingIdunnReview=true`, `deploymentTrigger=git-push-observed-by-idunn`, `deploymentAuthority=false`, `sshAuthority=false`, `gitPushAuthority=false`, `serviceLifecycleAuthority=false`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics, further reviewed config/action request families, richer closure depth, and explicit Idunn deployment execution/audit under operator authority. - 2026-06-20: `repo-deployment-config` is now live as repo-owned Idunn deployment configuration cargo. `epiphany-work derive-plan --action-family repo-deployment-config` writes `.epiphany/deployment.toml` with safe family `repo.deployment_config`, `enabled=false`, owner `Idunn`, trigger `git-push-observed-by-idunn`, watched ref `refs/heads/main`, deployment script ref, script hash/review requirement, host policy, secret policy, rollback, aftercare checks, Idunn CultMesh intent/receipt/aftercare contracts, daemon-owned execution, and denials for direct deployment, SSH, git push, service lifecycle, Hands, publication, merge, cross-body mutation, private Verse rummaging, and private-state exposure. Focused smoke `.epiphany-smoke\repo-deployment-config-family-20260620-211809` ran init -> online -> accept -> repo-deployment-config derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/deployment.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `deploymentConfigEnabled=false`, `daemonOwnsExecution=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics, richer closure depth, and explicit Idunn deployment execution/audit under operator authority. - 2026-06-20: `derive-plan` action-item receipts now carry richer model-authored planning facets without widening command authority, and `adopt --from-plan` now preserves the chosen Imagination action item in the Mind adoption receipt. New CLI fields `--assumption`, `--constraint`, `--non-goal`, `--open-question`, `--decision-point`, and `--evidence-need` are recorded under `planningFacets` in `epiphany.repo_work_imagination_action_items_receipt.v0`, mirrored into the plan derivation's `actionItemReceipt`, then copied into `epiphany.repo_work_adoption_receipt.v0` as `adoptedActionItem`; deterministic defaults are emitted when a model does not supply them. Focused smoke `.epiphany-smoke\repo-planning-facets-20260620-164958` ran init -> online -> accept -> model-authored `derive-plan --action-family planning-note` with all facet fields -> tick run/adopt/execute/close; the action-item receipt preserved assumptions, constraints, non-goals, open questions, decision points, and evidence needs while `handsAuthorityGranted=false`, `durableStateAdmitted=false`, `handsCommandAuthority=false`, `durableStateAuthority=false`, and `privateStateExposed=false`; the adoption receipt preserved `adoptedActionItem.safeActionFamily=repo.markdown_planning_note`, planning facets, `adoptedActionItem.handsCommandAuthority=false`, `adoptedActionItem.durableStateAuthority=false`, `adoptedActionItem.publicationAuthorized=false`, `authority.handsAuthorityGranted=true`, `authority.durableStateAdmitted=false`, and `privateStateExposed=false`; Soul closure passed with family assertions and path scope matched. Current remaining repo-swarm MVP organs are deeper interpreter/adoption semantics, more useful repo-owned configuration/action families, and Idunn-owned queue-run service lifecycle under explicit operator authority. -- 2026-06-20: `repo-planning-brief` is live as the family-friendly Imagination decomposition cargo, and Soul closure now emits a typed safe-family planning readback for it. `epiphany-work derive-plan --action-family repo-planning-brief` writes `.epiphany/planning-briefs/.toml` with safe family `repo.planning_brief`, status `draft`, candidate next safe families, requested-path / verification-ask / evidence-need requirements, and Mind/Self/Substrate/Hands/Soul/Bifrost/Idunn gate ordering while denying objective adoption, scheduling, substrate access, Hands action, shell, commit, publication, deployment execution, service lifecycle, cross-body mutation, private transcripts, raw-result payloads, and private-state exposure. Closure `familyAssertions.safeFamilyPlanning` now carries `epiphany.repo_work_safe_family_planning_readback.v0` with candidate-family rows/count, planning requirement flags, gate flags, authority-denial flags, and the private-state seal. Focused smoke `.epiphany-smoke\repo-planning-brief-family-20260620-235939` ran init -> online -> accept -> repo-planning-brief derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/planning-briefs/repo-planning-brief-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `candidateNextSafeFamilyCount=6`, `allExpectedCandidateFamiliesPresent=true`, `allRequiredGatesPresent=true`, `authorityDenied=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics, richer closure/map readback, and Idunn-owned queue-run service lifecycle under explicit operator authority. +- 2026-06-21: `repo-planning-brief` is live as richer family-friendly Imagination decomposition cargo, and Soul closure now emits a typed safe-family planning readback for its full matrix. `epiphany-work derive-plan --action-family repo-planning-brief` writes `.epiphany/planning-briefs/.toml` with safe family `repo.planning_brief`, status `draft`, twenty candidate next safe families grouped as preparation, adoption/queue, execution/review, publication/accounting, and policy/deployment, requested-path / verification-ask / evidence-need / owner / authority-denial / closure-proof requirements, and Mind/Self/Substrate/Hands/Soul/Bifrost/Idunn gate ordering while denying objective adoption, scheduling, substrate access, Hands action, shell, commit, publication, deployment execution, service lifecycle, cross-body mutation, private transcripts, raw-result payloads, and private-state exposure. Closure `familyAssertions.safeFamilyPlanning` now carries `epiphany.repo_work_safe_family_planning_readback.v0` with candidate-family rows/count, grouped matrix rows, matrix control flags, closure proof flags, planning requirement flags, gate flags, authority-denial flags, and the private-state seal. Focused smoke `.epiphany-smoke\repo-planning-brief-family-20260621-084546` ran init -> online -> accept -> repo-planning-brief derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/planning-briefs/repo-planning-brief-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `candidateNextSafeFamilyCount=20`, `allMatrixGroupsComplete=true`, `matrixControlsPresent=true`, `allClosureProofsPresent=true`, `allRequiredGatesPresent=true`, `authorityDenied=true`, and `privateStateExposed=false`. Current remaining repo-swarm MVP organs are deeper interpreter semantics, richer closure/map readback, another useful repo-owned safe family if needed, or Idunn-owned queue-run service lifecycle under explicit operator authority. - 2026-06-21: `repo-interpreter-brief` is live as Mind-owned interpretation cargo between Imagination consensus and downstream action-family adoption. `epiphany-work derive-plan --action-family repo-interpreter-brief` writes `.epiphany/interpreter-briefs/.toml` with safe family `repo.interpreter_brief`, status `draft`, owner `Mind`, source `Imagination`, consensus/safe-family/path/verification/evidence requirements, semantic checks for intent/scope/paths/verification/evidence/rollback/non-goals/questions/consensus, candidate next safe families, and Mind/Soul/Bifrost/Hands/Substrate/Idunn gates while denying direct state commit, objective adoption, scheduling, substrate access, Hands action, shell, commit, publication, deployment execution, service lifecycle, cross-body mutation, private transcripts, raw-result payloads, and private-state exposure. Focused smoke `.epiphany-smoke\repo-interpreter-brief-family-20260621-010858` ran init -> online -> accept -> repo-interpreter-brief derive-plan -> tick run/adopt/execute/close; Hands committed only `.epiphany/interpreter-briefs/repo-interpreter-brief-family.toml`, Soul passed with `pathScopeMatched=true`, `familyAssertions.status=passed`, `mindOwnsInterpretation=true`, `candidateActionsNonAuthoritative=true`, `directStateCommitAuthorized=false`, `handsActionAuthorized=false`, and `privateStateExposed=false`. - 2026-06-20: Gjallar repo-work map sight now includes semantic stage lenses. `epiphany-verse-query gjallar`, swarm overview, and swarm triage expose `repoWorkMapStageLensRows` plus `REPO-WORK-MAP-STAGE` rows derived from Mind-admitted local Verse map entries, grouping safe families into stages and owning organs such as `imagination-planning` / `Imagination`, `hands-execution-request` / `Hands`, `soul-verification-request` / `Soul`, `bifrost-publication-accounting` / `Bifrost`, and `idunn-deployment` / `Idunn`. Focused smoke `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-232414` proves the stage lens for accepted `repo.markdown_planning_note` work reports `stage=imagination-planning`, `owner=Imagination`, latest item/commit/Mind commit receipt, Bifrost gate, and `privateStateExposed=false`. This is sight only; Gjallar still does not schedule, publish, merge, deploy, keep daemons alive, or admit Mind state. - 2026-06-20: Gjallar repo-work map sight now includes next-publication-gate lenses. `epiphany-verse-query gjallar`, swarm overview, and swarm triage expose `repoWorkMapGateLensRows` plus `REPO-WORK-MAP-GATE` rows derived from the same Mind-admitted local Verse map entries, grouping accepted consequences by publication gate and naming the owning gate organ. Focused smoke `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-233353` proves accepted `repo.markdown_planning_note` work reports `gate=Bifrost`, `owner=Bifrost`, latest item/commit/Mind commit receipt, `sightOnly=true`, `publicationAuthorized=false`, and `privateStateExposed=false`. This is sight only; Bifrost still owns publication/credit/upstream review and Gjallar does not schedule, publish, merge, deploy, keep daemons alive, or admit Mind state. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 52cd7a57..9636089d 100644 Binary files a/state/ledgers.msgpack and b/state/ledgers.msgpack differ diff --git a/state/map.yaml b/state/map.yaml index 788dc5ae..f14680f9 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -90,6 +90,7 @@ active_subgoals: - Use `notes/epiphany-swarm-readiness-plan.md` as the live-fire direction gate. The local run path is a compass, not launch clearance: before unattended swarm operation, Epiphany needs typed pause/brake enforcement, one initiative scheduler, completion-gated cooldown, stale active-turn recovery receipts, parent-side Persona speech eligibility, memory lifecycle operations, and CultNet-first operator snapshots/intents/receipts. The local Verse brake document exists, `epiphany-verse-query swarm-brake` can engage/release it, `tools/epiphany_local_run.ps1` refuses live `plan`/`run`/`mvp` modes when the brake is engaged while leaving `status` readable, `epiphany-mvp-coordinator` checks the local Verse brake before app-server startup, and `epiphany-heartbeat-store` guards tick/pump/heat/queue-mention/routine when given `--local-verse-store`. Daemon liveness is now a typed local Verse authority: `epiphany-verse-query daemon-status` writes one daemon status without repainting the table, local Verse seeding preserves existing daemon statuses and swarm brakes, `invoke-tool` refuses when the host daemon is not ready or lacks `submitTypedToolIntent`, and both daemon tool invocation and lifecycle poke fail closed under an engaged matching brake. `epiphany-daemon-supervisor policy` writes durable per-daemon restart policy with command/args/cwd/cooldown/backoff/attempt state plus reconcile cadence and stale-heartbeat threshold; `epiphany-daemon-supervisor reconcile` loads that policy when no override command is supplied, refuses under a matching lifecycle brake, refuses during cooldown/backoff, writes daemon poke intent/receipt, updates daemon status, and updates policy attempt state; `epiphany-daemon-supervisor tick` is an explicit scheduler pulse that scans durable policies, records ready/noop pulses, skips before the configured reconcile interval, marks stale heartbeat status degraded, routes restarts through the same brake/cooldown/poke receipt path, and writes a latest `epiphany.cultmesh.daemon_scheduler_receipt.v0`; `epiphany-daemon-supervisor serve` runs that same pulse on a configurable cadence with bounded `--max-iterations` proof mode or unbounded service mode. `epiphany-daemon-supervisor service-plan`/`install-service` now writes a planned `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` for the `serve` command, while `service-launch`/`start-service` spawns that `serve` loop through the current executable or `--service-command`, can `--wait-child` for bounded proof, and records command/args/cwd, scheduler id, daemon selector, pid/exit/status, artifact ref, and private-state guard. `service-runbook`, `windows-service-install`/`service-install-plan`, `windows-service-status`, `windows-service-reconcile`, `windows-service-execution-readiness`, and `windows-service-start`/`stop` now record service lifecycle receipts through the same local Verse; the read-only status path has been proved against the real Windows `EventLog` service with receipt `daemon-service-lifecycle-receipt-windows-eventlog-proof-windows-service-status`, status `running`, exit code `0`, and `privateStateExposed=false`; the read-only service-policy reconciliation path has been proved for missing service, real-service drift against `EventLog`, lifecycle-brake refusal, and wrapper/local-Verse receipt `daemon-service-lifecycle-receipt-windows-eventlog-reconcile-proof-windows-service-reconcile`; execution readiness has been proved as a non-mutating `not-elevated` receipt through direct and wrapper paths; start/stop now produce non-mutating `start-planned`/`stop-planned` receipts unless `--execute-control`/`--execute-service-control` is passed, and wrapper `service-start-plan`/`service-stop-plan` proves those receipts against `EventLog`; explicit install/control execution now refuses as `execution-refused-not-elevated` with `executed=false` when the shell lacks Windows administrator authority, and wrapper `service-install-execute`, `service-start-execute`, and `service-stop-execute` prove those refusal receipts without mutation. Service lifecycle actions check the local Verse swarm brake before process launch, artifact writes, service-manager queries, service-policy reconciliation, execution-readiness checks, control planning, elevation-gated execution, or start/stop execution. The local wrapper builds/checks this binary. - Use `notes/epiphany-repo-swarm-mvp-contract.md` as the repo-swarm autonomy authority map. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruption, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Current safe-family cargo includes repo manifest, tool capability manifest, daemon-hosted tool request cargo, Eve/CultUI surface contract, repo collaboration policy, collaboration topics, consensus/objective/adoption/scheduling/work-order/verification/publication/sync/review/PR/credit/artifact/metrics/doctrine-update/secret-policy/deployment requests, repo deployment config, action-item receipts, Mind adoption interpretation/decision receipts, explicit Mind safe-family refusal proof `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, explicit Mind requested-path/plan changed-path refusal proof `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, overview/public-proof/Gjallar/Eve readbacks, typed swarm-run stop classification, Idunn non-mutating queue-run lifecycle receipts, and fresh-repo upstream-main proof. Latest deployment proof `.epiphany-smoke\repo-deployment-config-family-20260620-221205` shows `repo.deployment_config` closes through Soul, `deployment-config-audit` reports `ready-for-idunn-review`, `deployment-execution-runbook` reports `ready-for-operator-git-push`, and `deployment-aftercare-audit` ingests local Verse/CultMesh Idunn deployment/aftercare receipt refs with source `cultmesh`, status `complete`, `deploymentComplete=true`, `daemonOwnsExecution=true`, no repo-agent execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority, and `privateStateExposed=false`; explicit Idunn receipt files remain only compatibility reliquaries. Latest deployment request proof `.epiphany-smoke\repo-deployment-request-family-20260620-195605` shows `repo.deployment_request` closes through Soul while requesting reviewed git-push-observed-by-Idunn deployment with script/host/secret/rollback/aftercare requirements and no deployment/SSH/git-push/service authority. Latest security cargo proof `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` shows `repo.secret_policy_request` closes through Soul while requesting reviewed secret/write/export/deployment policy without exposing secrets or granting write/deployment/publication authority. Governance proof `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` shows `repo.doctrine_update_request` closes through Soul while requesting reviewed `AGENTS.md` doctrine work without mutating doctrine or granting Hands/service/publication authority. Swarm-run stop proofs now include `.epiphany-smoke\fresh-repo-mvp-20260620-180024` for `iteration-limit` / Self / `self.scheduler-iteration-limit` with upstream-main sync and public-proof export, plus `.epiphany-smoke\swarm-stop-classification-20260620-184717` for `queue-empty` / Gjallar / `repo.work.overview`, `dry-run-preview` / Self / `ready-to-run`, `authority-gated` / Bifrost / `awaiting-publication`, and `authority-gated` / Bifrost/GitHub / `awaiting-upstream-sync`; all stop packets are non-mutating, non-elevated, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853` now proves Idunn-owned non-mutating repo-work queue-run service plan/runbook receipts for exact service id `epiphany-repo-work-queue-runner`, receipt-directory readback, runbook SHA-256 `f2ec67c4f8243a3ebc2f9e915b6b9f5ae2ac2d99d2cdb86905b54667adc456f8`, `hostedBody=repo-work`, no service-manager mutation, no launch, no elevation, and `privateStateExposed=false`. - Repo dependency/supply-chain policy request cargo is live. `repo-dependency-policy-request` lowers to safe family `repo.dependency_policy_request` and writes `.epiphany/dependency-policy-requests/.toml` with manifest inventory, lockfile policy, package-manager command review, network fetch policy, vulnerability/license/vendored-code/update-cadence requirements, Eyes/Soul/Mind/maintainer/Bifrost/dependency-audit receipt refs, and denials for dependency update, package install, lockfile mutation, network fetch, CI mutation, Hands, publication, merge, deployment, service lifecycle, cross-body mutation, private Verse rummaging, and private-state exposure. Proof `.epiphany-smoke\repo-dependency-policy-request-family-20260621-083433` closes through Soul with `familyAssertionsStatus=passed`, `pathScopeMatched=true`, `awaitingDependencyPolicyReview=true`, all direct dependency/package/network/CI authorities false, and `privateStateExposed=false`. + - Repo planning brief cargo now carries the family-friendly safe-family matrix. `repo-planning-brief` still lowers to safe family `repo.planning_brief` and writes `.epiphany/planning-briefs/.toml`, but it now names twenty candidate next safe families across preparation, adoption/queue, execution/review, publication/accounting, and policy/deployment groups, requires each candidate to name owner, requested paths, verification asks, evidence needs, authority denials, and closure proofs, and adds Soul/Modeling/Mind/Bifrost/upstream-main/redaction closure proof expectations. Closure `safeFamilyPlanning` readback now reports grouped matrix completeness, matrix controls, and closure proof presence while granting no scheduling, substrate, Hands, shell, commit, publication, deployment, service lifecycle, cross-body, private-transcript, raw-result, or private-state authority. Proof `.epiphany-smoke\repo-planning-brief-family-20260621-084546` closes through Soul with `candidateNextSafeFamilyCount=20`, `allMatrixGroupsComplete=true`, `matrixControlsPresent=true`, `allClosureProofsPresent=true`, `authorityDenied=true`, and `privateStateExposed=false`. - Repo-swarm Mind interpretation cargo is live. `repo-interpreter-brief` lowers to safe family `repo.interpreter_brief` and writes `.epiphany/interpreter-briefs/.toml` as draft Mind-owned interpretation from Imagination consensus, with semantic checks, candidate safe families, required Mind/Soul/Bifrost/Hands/Substrate/Idunn gates, and explicit denials for direct state commit, objective adoption, scheduling, substrate access, Hands action, shell, commit, publication, deployment execution, service lifecycle, cross-body mutation, private transcripts/raw results, and private-state exposure. Proof `.epiphany-smoke\repo-interpreter-brief-family-20260621-010858` closes through Soul with `familyAssertions.status=passed`, `mindOwnsInterpretation=true`, `candidateActionsNonAuthoritative=true`, `directStateCommitAuthorized=false`, `handsActionAuthorized=false`, and `privateStateExposed=false`. - Idunn-hosted repo-work queue-run lifecycle now has plan/runbook/launch/audit closure under explicit operator authority. `epiphany-daemon-supervisor repo-work-service-audit` reads all typed service lifecycle receipts for `epiphany-repo-work-queue-runner`, requires planned install-plan, written local runbook artifact, completed launch with exit code `0`, and no private-state exposure, then writes a `repo-work-service-audit` receipt with `status=complete` or `incomplete`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260621-004202` proves plan/runbook/launch/audit with `auditStatus=complete`, `auditRunbookArtifactStatus=present`, `auditLaunchExitCode=0`, `mutatesServiceManager=false`, `requiresElevatedAuthority=false`, and `privateStateExposed=false`. Wrapper proofs `local-20260621-014302-362-31bbef47`, `local-20260621-014337-108-cbd99615`, `local-20260621-014413-125-09e183c5`, and `local-20260621-014558-197-f6951806` prove operator plan/runbook/launch/audit ergonomics, with audit reporting no missing or failed checks. Basic queue-run service lifecycle readiness is sealed; remaining Idunn work is optional elevated install/start execution under explicit operator authority, not Self scheduling authority. - Gjallar/Odin sight now exposes Idunn deployment receipt refs without taking Idunn's execution throne. `EpiphanyLocalVerseContext`, `receipt-directory`, `swarm-overview`, `swarm-triage`, and `gjallar` surface latest `gamecult.idunn.deployment_receipt.v0` and `gamecult.idunn.deployment_aftercare_audit.v0` as compact `idunnDeploymentReceiptRows` / `IDUNN-DEPLOYMENT` rows with owner `Idunn`, watched/checked refs, source/result refs, aftercare ids, follow-up readback command, and `privateStateExposed=false`. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-223203` proves the aftercare audit still ingests CultMesh refs and Gjallar reports `gjallarIdunnDeploymentReceiptCount=2`, latest deployment receipt `fixture-idunn-deployment`, latest aftercare receipt `fixture-idunn-aftercare`, and no private-state exposure. This is citeable discovery only; deployment still happens by explicit operator `git push` observed by Idunn.