Stop edge snapshots promoting tool receipts

notes/epiphany-current-algorithmic-map.md

@@ -70,6 +70,14 @@
 - Forbidden metrics writers: caller cannot provide accepted artifact, model spend, review load, credit, proof, summary, receipt, or status results.
 - Negative proof: missing requests fail without receipt mutation and response-shaped arguments fail before lookup or write.
 
+## Operator snapshot authority boundary (2026-07-12)
+
+- Owner: operator snapshot adapter owns only a bounded summary of an edge status artifact.
+- Runtime spine owns daemon-tool execution intent and receipt truth.
+- Forbidden projection: `/tools/invocations` JSON cannot be promoted into canonical daemon-tool schemas by snapshot import.
+- Output explicitly returns null tool intent/receipt fields and `toolInvocationAuthority=runtime-spine-only`.
+- Negative proof: forged accepted tool JSON produced a snapshot but no canonical intent or receipt.
+
 This is the source-grounded map of the live machine. Historical route and
 bridge anatomy belongs in git history and evidence ledgers, not here.
 

notes/fresh-workspace-handoff.md

@@ -32,6 +32,10 @@ Single poke, batch poke, and swarm triage now write only `epiphany.cultmesh.daem
 
 `bifrost-artifact-acceptance` and `bifrost-metrics`, plus their wrappers, now inspect the latest Mind-admitted `repo.artifact_acceptance_request` / `repo.metrics_request` map entry and report `pending-maintainer-bifrost` / `pending-bifrost-maintainer`. They write no provider receipts. Artifact/proof/review/ledger/accepted-by/status fields and accepted-artifact/spend/review-load/credit/proof/summary/status fields are rejected respectively. The canonical local Verse currently contains neither request family, so negative proof showed clean missing-request failure, no receipt mutation, and rejection of counterfeit result fields. The original conceptual-substitution audit now records all confirmed substitutions as structurally cut; next audit every remaining production receipt-writer call site for provider provenance.
 
+## 2026-07-12 receipt-writer provenance audit
+
+The first call-site audit found a new canonical-promotion substitution in `epiphany-operator-snapshot from-status`: arbitrary edge JSON under `/tools/invocations` could be converted into canonical daemon-tool intent and receipt documents. That promotion is removed. The adapter writes only `operator_snapshot`, returns null tool intent/receipt fields, and states `runtime-spine-only` authority; the conversion helper is compiled only for tests. Forgery proof imported an `accepted` fake receipt and confirmed both canonical latest tool intent and receipt remained absent. See `notes/receipt-writer-provenance-audit-2026-07-12.md`. Next quarantine smoke writers, then inspect operator-run and daemon-supervisor evidence binding.
+
 This is the re-entry rite for `E:\Projects\EpiphanyAgent`: the waking chant for
 the local machine-spirit before it touches the forge.
 

notes/receipt-writer-provenance-audit-2026-07-12.md

@@ -0,0 +1,25 @@
+# Receipt Writer Provenance Audit — 2026-07-12
+
+## Method
+
+Inventory every production call to `write_*receipt`, then ask whether the executable is the named owner, a bounded ingest/projection boundary, a test-only fixture, or a caller able to assert the result it records.
+
+## Classification
+
+- `epiphany-daemon-supervisor`: owner-aligned for scheduler, lifecycle, and daemon-poke receipts. It performs or observes the lifecycle operation it records.
+- `epiphany-eve-provider`: owner-aligned narrow provider receipt writer; verifies the pending intent targets its provider cluster.
+- `epiphany-operator-run`: owner-aligned for operator-run receipts and coordinator receipts derived from the run it executes.
+- smoke binaries and the `epiphany-verse-query smoke` arm: fixtures, not runtime evidence. They remain a quarantine risk if permitted to target canonical stores.
+- `epiphany-work` Weksa lowering: a lowering projection receipt, explicitly non-publication authority; no substitution confirmed in this pass.
+- `epiphany-operator-snapshot from-status`: **confirmed substitution and cut**. Arbitrary edge JSON under `/tools/invocations` could previously be converted into canonical daemon-tool intent and receipt documents. The snapshot adapter now writes the operator snapshot only; tool invocation fields return null and authority remains `runtime-spine-only`. The conversion helper is test-only.
+
+## Negative proof
+
+A forged operator-status artifact containing `intentId=forged-intent`, `receiptId=forged-receipt`, and `status=accepted` was imported. The operator snapshot was written, while canonical latest daemon-tool intent and receipt both remained absent.
+
+## Remaining scrutiny
+
+1. Quarantine smoke writers so they cannot target canonical stores.
+2. Inspect `epiphany-operator-run` receipt construction against actual subprocess/runtime evidence rather than command arguments.
+3. Inspect daemon-supervisor plan/rehearsal receipts separately from execution receipts so planning cannot masquerade as service mutation.
+4. Distill or remove dead public receipt constructors once every named provider executable exists.