Epiphany/notes/repo-frontier-planning-authority-map.md

Repo Frontier Planning Authority Map

Current authority

• Generic RepoModel validation owns the intrinsic frontier shape. A non-empty repository_scope is a strict lexicographically sorted set of canonical repository-relative paths. Every unresolved frontier routed to Eyes, Imagination, or Hands must carry one. Invalid scope refuses the entire keyed RepoModel mutation before any document is written.
• repository_scope is future consequence authority: the ceiling Planning may narrow and Hands may eventually change. Files inspected, evidence sources, immutable Body basis, and tool receipts remain separate reasoning and provenance cargo. They cannot impersonate write authority.
• Self selects one dependency-ready, unchallenged, active Imagination frontier from the current keyed RepoModel view. It writes one immutable RepoFrontierPlanningRequest binding the exact frontier authority document versions, frontier bytes and hash, repository scope, and runtime identity.
• Coordinator commit replays that request, injects the exact typed Imagination projection, and atomically writes a request-keyed launch binding whose hash covers the stored worker launch document.
• Imagination writes one immutable runtime result with an exclusive planning request echo and one embedded canonical RepoFrontierPlanCandidate. safe_paths may only narrow repository_scope. Imagination cannot route Hands or mutate RepoModel.
• The runtime derives one RepoFrontierPlanMindRequest from the immutable Imagination result and candidate hash. Coordinator commit launches one bounded admission-review pass serving Mind with the exact request, candidate, and keyed model-source documents.
• The admission reviewer writes one immutable typed Adopt, Refuse, or Hold judgment. Result persistence replays the request, both worker results, launch bindings, stored launch bytes, candidate identity, and current keyed frontier authority while rejecting foreign organ cargo.
• commit_repo_frontier_plan_decision consumes only that immutable review result. Refuse and Hold write one inert terminal receipt. Adopt atomically writes the changed keyed frontier document, specialized Mind review/admission, and terminal decision receipt through exact-envelope CAS.
• The dedicated Adopt transition installs the exact candidate cargo and provenance on RepoFrontierItem.adopted_plan and alone changes Imagination to Hands. Generic frontier writers cannot author or rewrite it.
• Self derives the Hands route from the admitted keyed model. The route exposes authorized_paths, equal to the adopted plan's safe_paths; Hands intent and Substrate Gate receipts bind that exact set. Verification receives the exact admitted command, checks, stop conditions, rollback steps, and consequence receipts.
• Modeling may incorporate Soul's verdict by changing lifecycle, gap, and evidence fields while preserving the adopted execution anatomy byte-for-byte.

Derived state

• Planning readiness derives from current keyed frontier documents, current challenges and dependencies, and absence of a terminal decision receipt.
• repository_scope_valid is diagnostic projection from the shared graph validator. It does not own admission.
• Candidate visibility is a projection of the immutable Imagination result.
• Hands readiness and execution cargo derive only from the post-Adopt keyed RepoModel, never from a candidate, event, role lane, or decision shadow store.
• Completion remains Soul verdict followed by Modeling verdict incorporation; adoption is not completion.

Forbidden writers and substitutions

• No aggregate model revision/hash, global thread revision, event order, timestamp freshness, or generic role slot owns planning or Hands readiness.
• No standalone candidate or adoption store exists in the production path.
• No caller supplies Mind's decision, rationale, timestamp, provider request, or strong-read set.
• No prompted reviewer may emit state, Self, RepoModel, Verification, Modeling, or implementation authority cargo.
• filesInspected, evidence references, prompt prose, namespaces, metadata, or “the current request” cannot substitute for repository_scope or exact typed launch bindings.
• Generic Upsert/Revise cannot create an adopted plan or perform Imagination-to-Hands. Verdict incorporation cannot rewrite execution anatomy.
• Same-path Hands work cannot substitute a different action, candidate, or command while retaining route authority.
• Mind is not a chatty embodied lane. The bounded admission-review pass serves Mind and has no heartbeat, lane memory, roleAccept, or selfPatch.

Verification layer

• Hostile proofs cover stale/swapped source documents, frontier, request, result, job, launch binding, projection, candidate hash, escaped or unordered paths, failed worker output, foreign cargo, duplicate/racing launches, competing terminal writes, generic adoption bypass, post-adoption anatomy mutation, and same-path command substitution.
• Scope-specific negative proofs reject parent traversal, Windows separators and drive roots, duplicate or unordered paths, and unresolved routed frontier items with no repository ceiling. The mutation remains atomic and leaves no partial frontier document.
• Exact retry authenticates immutable terminal decision plus its historical review/admission chain without requiring later disjoint RepoModel documents to remain frozen.