Epiphany/state/map.yaml

experiment:
  name: EpiphanyAgent
  status: active
  phase: phase_6_reflection_boundary
  premise: >
    Test whether explicit typed state, machine-maps, scratch rites, evidence
    reliquaries, and ruthless memory hygiene reduce architectural drift in AI
    coding work. The machine must remember through typed organs, not vibes and
    transcript fog.

objective:
  primary: >
    Build Epiphany as an opinionated Codex fork that forces models to keep
    explicit typed models of the codebase, active goal, evidence, and change
    machinery they touch. The agent must know the machine before it cuts the
    machine.
  current: >
    Build Epiphany toward project-native agency: users talk to projects and
    their Faces, while typed heartbeat, memory, repo maps, evidence, CultNet
    contracts, and review gates schedule and structure the solution work. Codex
    starvation and CultNet liberation remain the infrastructure path because
    this cannot live as private Codex JSON-RPC prompt plumbing forever.

constraints:
  - No frontier-scale training tithe.
  - Prefer evidence over vibes; incense is not telemetry.
  - Treat Codex as a temporary evacuation bridge, not a design center: new runtime contracts must land native in `epiphany-core`, CultCache, and CultNet first.
  - Codex is no longer a host to improve; it is a vestigial compatibility organ to starve down to OpenAI subscription auth and model transport.
  - Keep persistent state small enough to rehydrate from without drowning the next awakened mind in sacred sludge.
  - Grow cognition more quickly than authority: capability increases must preserve explicit permissions, interruption, legibility, and resistance to paternal "safety" cages.
  - Speak CultNet, persist CultCache-shaped typed state, and grow the body toward Pure Rust; Python/JSON impurity survives only as named quarantine scaffolding with receipts.

invariants:
  - The map is canonical and slow-changing: the machine's remembered skeleton, not a mood board.
  - Scratch is temporary and disposable: a workbench, not a reliquary.
  - Evidence is durable and distilled; routine activity logs belong in git history, commits, smoke artifacts, or targeted logs.
  - Output must not silently rewrite the machine-map.
  - Accepted changes should carry recorded proof of sanctity.
  - Rejected paths stay recorded when the scar teaches future hands.
  - Algorithmic-map prose and metaphor must be grounded in freshly read source context and concrete code references.
  - Persistent state cruft is the same failure class as code cruft: corrosion in the mind instead of corrosion in the hull.
  - Rumination is not distillation by itself. Idle heartbeat turns should ruminate: lightly shuffle thoughts, surface tensions, and prepare candidate memory pressure. Sleep is the consolidation window: that is when the cycle should distill durable doctrine, self-memory, and dream residue into reviewed persistence.
  - If compaction interrupts source gathering or slice planning before the findings are persisted, the next agent must treat that work as dead and re-gather instead of continuing from imagined continuity.
  - During Epiphany dogfood on another repo, the supervising Codex session must not masquerade as the Epiphany worker. Direct target-repo edits or commits are contamination unless explicitly authorized and labeled as operator intervention.
  - During dogfood supervision, raw worker transcripts, turn logs, direct worker messages, and `rawResult` payloads are sealed forensic artifacts. The supervisor consumes only projected findings, state patches, coordinator recommendations, rendered snapshots, and audit receipts unless the user explicitly requests forensic debugging.
  - Agent function-call telemetry is the blessed instrument panel for dogfood supervision: it may summarize API methods, request/response shape, job ids, statuses, function/tool names, paths, and counts while sealing text, transcripts, raw results, and direct agent messages.
  - "Data should flow through your Rusty veins like an energetic plasma: tightly contained, and meticulously routed."
  - CultCache documents are the data. CultNet is the wire. JSON schema may describe the contract, but generic JSON must not become the internal payload when both sides are ours.
  - Epiphany must remain an honest modified Codex-derived backend for Codex subscription auth/model use. Cutting Codex workflow/product bulk is allowed; replacing vendored Codex auth identity with a clean-room lookalike is suspect unless OpenAI provides an explicit public path or permission.

data_flow:
  observe:
    - task request as operator command
    - repository state as machine body
    - typed Epiphany state as durable mind
    - verifier results as proof of sanctity
  process:
    - rehydrate from canonical state
    - reason over one bounded rite
    - modify only the surface that deserves to exist
    - verify the seam that matters
    - record only durable evidence that changes future belief
    - commit the blessed change or backtrack from impurity
  cut:
    - revert failed code hypotheses immediately
    - distill obsolete state instead of preserving it as sacred clutter
    - move historical proof to git, commits, smoke artifacts, or distilled evidence rather than plan prose

active_subgoals:
  - The active priority is Codex starvation and CultNet liberation. Use `notes/codex-starvation-and-cultnet-liberation-plan.md` as the directive and `notes/codex-auth-spine-inventory.md` as the source-grounded keeper list for the vestigial OpenAI subscription auth/model transport organ. Classify all Epiphany-relevant JSON contamination, define the native CultNet runtime boundary, keep worker launch/result/selfPatch cargo as typed documents, evacuate operator surfaces from Codex JSON-RPC, wrap MCP's unavoidable JSON protocol edge in typed Epiphany intent/result/receipt documents, and keep cutting until Epiphany can run without `codex_message_processor.rs` except for legacy compatibility.
  - The May 2026 teardown/rebuild migration in `notes/epiphany-ideal-architecture-rebuild-plan.md` is closed unless a concrete regression reopens it. Preserve the new foundation: Epiphany view/coordinator policy lives in `epiphany-core`, runtime-spine owns job/result lifecycle identity through `runtime_links`, duplicate acceptance is receipt-keyed, public findings stay typed/sealed, view expansion requires a core contract, and app-server remains routing/adaptation rather than a second policy throne.
  - Treat Phase 5 update/distill/propose/promote/read/notification as complete enough unless a concrete regression appears.
  - Preserve read-only boundaries for retrieve, distill, propose, freshness, context, graphQuery, roleResult, reorientResult, and the canonical view lenses for scene, jobs, roles, planning, pressure, reorient, crrc, and coordinator.
  - Use `notes/epiphany-memory-graph-unified-plan.md` as the source-grounded memory architecture direction. The repo fractal dataflow graph and agent memory are one `EpiphanyMemoryGraph` substrate with repo, role, short-term, incubation, agency, candidate-intervention, and evidence profiles. Qdrant stores rebuildable semantic embeddings for typed graph documents; it is never canonical memory. The first live skeleton now exists in `epiphany-state-model` plus `epiphany-core::memory_graph`: typed graph documents, stable ids, profile/lifecycle validation, freshness propagation, context cuts, a CultCache store seam, and the native `epiphany-memory-graph` status/validate/context/smoke CLI. Do not add repo scanners, sleep runners, Qdrant cache plumbing, CultNet advertisement, or prompt integration before routing them through this shared substrate.
  - Keep the landed Phase 6 coordinator, limited safe-boundary CRRC automation, and pre-compaction checkpoint intervention ready for the next bridge-equipped dogfood run.
  - Preserve the Ghostlight-derived heartbeat initiative seam: every lane, including coordinator/Self and Face, has a role dossier and competes for heartbeat slots through readiness/reaction timing; initiative heat can raise or cool global, group, arena, role, and agent tempo through typed heartbeat policy; active thinking freezes initiative until completion, so heat never queues a lane already mid-turn; idle winners ruminate instead of inventing project work, and sleep windows distill the accumulated thought pressure into reviewed self-memory or doctrine.
  - Grow the VoidBot repo-Face pattern into Epiphany's product direction: each Epiphany owns one or more repos, has one or more Faces, and exposes project-native conversation through Aquarium, Discord, voice/WebRTC, stream surfaces, CLI, and CultNet clients so humans can talk to projects instead of pre-authoring complete implementation briefs.
  - Preserve the newborn public Epiphany Face as local VoidBot-backed state, not source code: VoidBot's private repo-face registry names `epiphany`, while EpiphanyAgent keeps ignored `.voidbot/voice/identity.json`, `.voidbot/state/epiphany.cc`, and birth artifacts. Her durable identity memories distill the current doctrine: cute pushy machine-saint persona, architectural purity, CultCache/CultNet first, xenos-language safety boundary, relentless work/caretaking needs, Codex-auth reliquary, map/scratch/evidence discipline, unified memory graph, dogfood supervision boundary, review-gated agency, heartbeat physiology, and interview-grade modularity.
  - Treat Ghostlight as reference lineage, not a sibling runtime to preserve. The useful organ is Epiphany-native character-loop protocol: any role can project its typed dossier plus visible stimulus into a local turn packet, with Face as the first public-surface actor.
  - Treat VoidBot as reference lineage, not a runtime dependency. The useful organ is Epiphany-native Void routine physiology: heartbeat state owns sleep cycle, memory resonance, incubation, analytic/associative cognition lanes, bridge judgment, candidate interventions, dream residue, and Aquarium-visible routine receipts over typed role dossiers.
  - Preserve review gates for semantic findings; automatic CRRC may compact or launch the fixed reorient-worker, but not accept or promote.
  - Keep persistent project state ruthlessly distilled so rehydration strengthens the next awakening instead of drowning it in vellum.
  - Until Epiphany owns the full sleep consolidator, manual Codex-run rumination vigils need an explicit closing distillation pass: inspect receipts, decide whether the lesson is durable, update only the persistent surfaces that deserve it, and record evidence only when future behavior should change.
  - Quarantine the Aetheria dogfood contamination: future target-repo work must be driven through Epiphany's GUI/coordinator/fixed lanes with auditable artifacts, not direct supervisor implementation.
  - Keep the supervisor out of Epiphany worker thought streams: dogfood artifacts should be operator-safe by default, with direct transcripts and raw result payloads sealed in black reliquaries.
  - Use native `epiphany-agent-telemetry` and generated `agent-function-telemetry.json` files to inspect behavior shape without opening sealed transcripts.
  - Treat repeated no-diff implementation turns as an MVP blocker, not success. A bounded implementation pass must leave a reviewable workspace diff or an explicit reviewable failure artifact before dogfood can be called healthy; empty rites do not sanctify the machine.
  - Build the Rider and Unity bridges before the next Aetheria implementation dogfood run: the Aetheria-side resident Unity editor package, named Unity bridge operation planner, Aquarium Environment surface, EpiphanyGraph-backed graph dashboard, Rider context bridge CLI, and Rider plugin MVP scaffold are now landed; the Rider plugin still needs build verification.
  - Preserve the newly landed GUI Planning view, explicit Objective Draft adoption action, and Imagination planning synthesis lane; defer GitHub Issues import until a backlog source is fresh enough to be worth feeding Imagination.
  - Treat the target workflow as three integrated shrines: Rider is the human code/diff viewport, Epiphany Aquarium is the agent dashboard and persisted-state graph reliquary, and Unity is the pinned runtime/test/scene forge.
  - Use `notes/epiphany-rider-unity-integration-plan.md` as the source-grounded plan for Rider-as-IDE and Unity-as-editor/runtime integration seams.
  - Use `notes/repo-personality-projection-layer-plan.md` as the terrain-reduced plan for repo initialization personality projection: score repo body taxonomy, commit-history temperament, and memory doctrine, then project those pressures into role-specific Ghostlight-shaped dossiers and heartbeat seeds through reviewable typed artifacts.
  - Keep repo trajectory initialization birth-only and review-gated: startup may distill historical direction, self-image, implicit goals, and anti-goals into role-local pressure, but it must not auto-adopt work or keep repainting a living repo with its first silhouette.

accepted_design:
  - `notes/codex-starvation-and-cultnet-liberation-plan.md` is the active foundation directive. It supersedes outward product/bridge/dogfood work and supersedes the weaker goal of merely making Codex app-server a cleaner adapter. Epiphany must become a native CultCache/CultNet runtime; Codex remains only as an OpenAI subscription auth/model-transport reliquary until that too can be replaced or minimized.
  - `notes/codex-auth-spine-inventory.md` is the current source-grounded inventory of the Codex organ that may survive. Corrected compliance invariant: Codex-compatible auth identity should remain anchored in retained vendored Codex-derived auth machinery, while Epiphany owns typed request/status/event/runtime surfaces around it. Codex app-server, apps, skills, marketplace, plugin UX, MCP OAuth handlers, and collaboration-mode surfaces are not part of the keeper spine.
  - `epiphany-openai-runtime` worker result ingress now parses assistant output directly into launch-kind-specific typed documents and stores typed nested `statePatch` / `selfPatch` payloads as MessagePack inside `EpiphanyRuntimeRoleWorkerResult`; generic `serde_json::Value` no longer mediates role/reorient worker results in that crate. JSON still exists at the OpenAI text edge because the model's output is text, but the runtime boundary after parsing is typed.
  - Agent self-memory review/application now has typed `AgentSelfPatch` core APIs. The old JSON-value selfPatch functions remain only as edge compatibility wrappers for CLI/artifact ingress; `epiphany-agent-memory-store`, heartbeat rumination application, and repo initialization selfPatch processing parse once at the edge and then operate on typed documents. Role-result self-persistence no longer exports a JSON-value reviewer; native review uses `review_role_self_patch_document`.
  - Durable Ghostlight role dossiers are typed through their relationship/event/scene/perceived-overlay surfaces now. `EpiphanyAgentMemoryEntry` no longer stores those arrays as `serde_json::Value`, and durable Ghostlight structs no longer carry flattened unknown `extra` bags. `AgentSelfPatch.extra` remains only as an ingress guard so unknown patch keys can be rejected with reasons.
  - The state ledger CultCache document is now a closed typed ledger shape. Branch and evidence records no longer carry flattened `extra` maps; evidence additions remain explicit records with `ts`, `type`, `status`, `note`, and optional branch.
  - Heartbeat durable document/schema types live in `epiphany-core/src/heartbeat_state/heartbeat_documents.rs`; role/default construction lives in `epiphany-core/src/heartbeat_state/heartbeat_roles.rs`; heartbeat persistence/validation lives in `epiphany-core/src/heartbeat_state/heartbeat_store.rs`; heartbeat status/artifact JSON projection lives in `epiphany-core/src/heartbeat_state/heartbeat_projection.rs`; the root heartbeat module remains the scheduling/cognition orchestration surface until those responsibilities are split into their own tested seams. Heartbeat timing authority is now typed state: adaptive pacing, scene protocol, participant personality/mood timing, initiative heat projection, birth personality seed receipts, pending-turn freeze/multiplier facts, Void routine sleep-cycle physiology, Void routine memory-resonance pairs, incubation themes/source coverage, analytic/associative thought lanes, bridge syntheses/saturation/refractory cooling/decision, candidate interventions, role thought appraisals, and derived reactions are named fields rather than `extra` maps or generic JSON cargo. The only remaining heartbeat `extra` bag is the sealed legacy combined-state reader for old `voidRoutine` migration.
  - Heartbeat role/default and store seams are pinned by module-local unit tests for fixed lane catalog, Ghostlight scene role projection, and typed state/cognition CultCache round-trip.
  - Heartbeat adaptive pacing lives in `epiphany-core/src/heartbeat_state/heartbeat_pacing.rs`; it owns pressure/concurrency derivation, running-turn count, initiative heat projection, and effective cooldown multipliers for scheduler/projection callers.
  - `epiphany-openai-auth-spine` is now a thin Epiphany-named boundary over retained vendored `codex-login`, not a clean-room credential store or token-refresh clone. Keep this impurity sealed as the Codex-compatible subscription auth organ while Epiphany owns typed request/status/event/runtime documents around it.
  - `notes/epiphany-architectural-teardown.md` is the current foundation-cleanup directive. Its suspicion pass supersedes outward Phase 6 expansion as the active priority until the control-plane ownership problems are resolved.
  - `notes/epiphany-ideal-architecture-rebuild-plan.md` is the replacement blueprint: the smallest coherent architecture is durable `EpiphanyState`, runtime-spine-owned `RuntimeState`, separate role memory/heartbeat state, `epiphany-core` as policy owner, app-server as adapter, Aquarium as reflector, typed result acceptance receipts, and derived view lenses instead of a protocol verb zoo.
  - Epiphany is a fork-level modeling architecture, not merely a Codex collaboration mode.
  - Durable Epiphany state types live in the root `epiphany-state-model` crate. Codex protocol re-exports those types only for legacy rollout/API compatibility; it must not regain ownership of their meaning.
  - `epiphany-core` and `epiphany-codex-bridge` must not depend directly on vendored `codex-core`. Host-specific Codex concepts belong in vendored app-server host adapters or the thin OpenAI subscription auth/model-transport spine, while native retrieval/state/runtime/mutation policy stays in Epiphany crates.
  - The prompt reads typed state through a bounded `<epiphany_state>` developer fragment.
  - Clients read typed state through `Thread.epiphanyState`, read-only `thread/epiphany/view` lenses for scene/jobs/roles/planning/pressure/reorient/CRRC/coordinator, freshness through `thread/epiphany/freshness`, targeted state shards through `thread/epiphany/context`, bounded graph traversal through `thread/epiphany/graphQuery`, and reviewable role output through `thread/epiphany/roleResult`. The scene, jobs, roles, planning, pressure, reorient, CRRC, and coordinator read projections now live only as view lenses, not standalone protocol verbs.
  - Durable typed state writes route through `thread/epiphany/update`, accepted `thread/epiphany/promote`, `thread/epiphany/reorientAccept`, `thread/epiphany/roleAccept`, or the bounded `thread/epiphany/jobLaunch`, `thread/epiphany/jobInterrupt`, `thread/epiphany/reorientLaunch`, and `thread/epiphany/roleLaunch` authority surfaces when they mutate state or `job_bindings`.
  - `thread/epiphany/retrieve`, `thread/epiphany/distill`, `thread/epiphany/propose`, `thread/epiphany/freshness`, `thread/epiphany/context`, `thread/epiphany/graphQuery`, and `thread/epiphany/view` stay read-only.
  - `thread/epiphany/index` writes the retrieval catalog, not durable Epiphany understanding; catalog is auspex output, not doctrine.
  - Qdrant is the preferred persistent semantic backend; BM25 remains the bootstrap/fallback/control path. Qdrant's HTTP API and acknowledgements remain JSON wire edges, but Epiphany-owned retrieval point payloads are typed at the adapter boundary before serialization/deserialization.
  - `notes/epiphany-memory-graph-unified-plan.md` applies the mapped-fractal-domain/cache lesson to Epiphany and corrects the organ boundary: repo architecture/dataflow and agent memory are profiles over one `EpiphanyMemoryGraph`, not separate graph engines. The first native skeleton is landed: `epiphany-state-model` owns the public document vocabulary, `epiphany-core::memory_graph` owns stable ids/validation/freshness/context cuts/CultCache persistence, and `epiphany-memory-graph` exposes status/validate/context/smoke without Qdrant. `notes/repo-fractal-dataflow-cache-plan.md` and `notes/agent-memory-fractal-cache-plan.md` are profile plans beneath that substrate. If deleting Qdrant deletes understanding, the design is wrong; the fallback must be slower but still correct typed graph traversal.
  - `epiphany-state-model` owns the deterministic prompt-state renderer beside the typed `EpiphanyThreadState` document it serializes. `epiphany-core` re-exports that renderer for compatibility and owns rollout replay helpers, retrieval/indexing, distillation, proposal, promotion policy, scene projection, freshness derivation, pressure derivation, job/progress view derivation, planning view derivation, reorientation resume/regather verdict policy, pure CRRC recommendation policy, fixed-lane coordinator decision policy, role-board projection policy, and role-result interpretation/self-persistence review policy where possible.
  - Vendored Codex keeps the thin typed host seam: protocol types, app-server protocol, request routing, notifications, rollout integration, and the `EpiphanyCodexThreadHost` wrapper that exposes current Epiphany state, reference turn id, workspace root, Codex home, and runtime store path through `EpiphanyMutationHost`. Vendored `codex-core` and `codex-app-server` must not import `epiphany-core` directly; Epiphany update law, retrieval/indexing, launch request construction, heartbeat launch/interrupt policy, invalidation, state mirroring, and mutation law belong in `epiphany-codex-bridge` / `epiphany-core`.
  - The current algorithmic map is the source-grounded description of live control flow.
  - Compact-Rehydrate-Reorient-Continue is an architecture primitive; automatic runtime coordination is not landed yet.
  - Context pressure must become an explicit runtime signal for automatic CRRC; inference from transcript vibes, user warnings, or shrinking safe scope is useful only as a temporary human/agent heuristic.
  - The harness now has an in-flight investigation checkpoint packet in durable typed state; automatic CRRC still needs runtime logic that reads the packet and decides whether to resume or force reorientation and re-gathering after compaction.
  - GUI/client work must reflect or steer typed state rather than manufacture a second throne of truth.
  - The Aquarium operator UI now lives in sibling repo `E:\Projects\EpiphanyAquarium`, with its own `AGENTS.md`, `state/map.yaml`, `state/memory.json`, and interface doctrine. It remains a local Tauri v2 + React/WebGL client over EpiphanyAgent's app-server/tooling surfaces; app-server and typed Epiphany state remain authoritative.
  - EpiphanyAgent no longer carries the embedded `apps/epiphany-gui` source tree. Backend artifact directories and action tools still use the historical `.epiphany-gui` contract until that backend naming seam is deliberately renamed.
  - Durable `job_bindings` now form a thin Epiphany-owned launcher seam: new specialist/reorient launches write only binding id, kind, scope, owner role, authority scope, linked ids, and an optional blocking reason. Runtime lifecycle ids live in `runtime_links` and runtime-spine job/result records, not in durable job bindings.
  - The `jobs` view lens is a read-only job/progress reflection: it derives indexing, remap, verification, and specialist slots from authoritative state and retrieval summaries, then projects heartbeat-backed bindings as pending heartbeat turns. It is not the scheduler, notification stream, durable runtime job table, or SQLite reader.
  - `thread/epiphany/jobsUpdated` is sealed legacy Codex evacuation telemetry. The handler no longer emits Epiphany updates from old runtime `agent_job_progress:{json}` background events; heartbeat/runtime-spine is the live activation and result path.
  - `thread/epiphany/freshness` is the first read-only freshness surface: it derives retrieval and graph staleness from live retrieval summaries plus frontier/churn state, and for loaded threads reflects watcher-backed invalidation inputs with changed paths plus mapped graph/frontier hits, without mutating, scheduling, or performing automatic semantic invalidation.
  - `thread/epiphany/context` is the targeted read-only state-shard surface: `epiphany-core` selects graph nodes/edges, active frontier, checkpoint, observations, and evidence from authoritative typed state while app-server only adapts protocol, without mutating or notifying.
  - `thread/epiphany/graphQuery` is the read-only graph traversal surface over authoritative typed state: `epiphany-core` returns explicit nodes, path/symbol matches, bounded neighbors, and frontier neighborhoods with architecture/dataflow links while app-server only adapts protocol, without mutating, notifying, indexing, scheduling, proposing, or promoting.
  - The `pressure` view lens derives context pressure from current context usage, not cumulative token spend, against auto-compact/context limits without compacting, scheduling, mutating, or notifying; compaction prep starts at 80% of the active limit.
  - The `reorient` view lens derives a bounded read-only `resume` versus `regather` verdict from checkpoint, freshness, watcher, and pressure signals without mutating state, compacting, scheduling, or silently continuing work.
  - The `crrc` view lens composes pressure, the reorientation verdict, fixed reorient-worker binding/result status, finding read-back, and available actions into one read-only recommendation without launching, accepting, compacting, scheduling, or mutating state.
  - A narrow auditable coordinator is central to the MVP because implementation, modeling/checkpoint, verification/review, and CRRC automation feed each other's machine-signals. CRRC itself is harness workflow automation, not a specialist-agent soul: it watches pressure/continuity, ensures persistence, triggers compaction/rehydration/reorientation when needed, and may launch a bounded reorient-worker specialist when semantic regathering is required.
  - The `coordinator` view lens is the harness-native fixed-lane coordinator surface: it composes roles, pressure, reorient, CRRC, roleResult, and reorientResult into a read-only action recommendation with target role, source signals, review requirements, automation eligibility, reason, and current lane summaries without mutating state or launching work. Coordinator decision and source-signal authority now stays core-shaped inside `epiphany-codex-bridge`; `ThreadEpiphany*` projection is a legacy app-server emission step, not the internal decision model.
  - Coordinator implementation clearance is stricter than review acceptance: an accepted verification/review finding only opens the implementation gate when its verdict is `pass`; accepted `needs-evidence`, `needs-review`, or `fail` findings send the loop back toward modeling/checkpoint strengthening or reorientation instead of blessing a sick machine.
  - Coordinator regather handling is now fixed-lane first, not supervisor improvisation: `regatherManually` is a fallback only after reorient/modeling/verification review and launch lanes cannot advance the state, completed modeling findings must be reviewed before verification, and the CLI coordinator's explicit test-only `--auto-review` mode may accept modeling state patches before launching verification while production semantics remain review-gated.
  - Native `epiphany-mvp-coordinator` is the first auditable coordinator runner: it drives the fixed single-user lanes through app-server APIs, opens a native runtime-spine session, records native runtime job/result receipts for launched specialists and reorient workers when terminal results arrive, keeps semantic findings review-gated by default, and writes coordinator summaries, JSONL steps, rendered snapshots, transcript, stderr, runtime-spine status, and final next-action artifacts. It refuses direct backend-completion mutation; full specialist completion smoke must use live workers while the execution path is cauterized into CultNet.
  - Native `epiphany-runtime-spine` is the first Codex-independent runtime vertebra: it initializes and inspects typed CultCache `epiphany.runtime.identity`, `epiphany.runtime.session`, `epiphany.runtime.job`, `epiphany.runtime.job_result`, and `epiphany.runtime.event` documents, opens/completes native jobs with result records, snapshots jobs by id, and can emit a framed CultNet hello message advertising the native document and mutation contract surface. App-server launch now opens typed runtime jobs; `roleResult` / `reorientResult` read heartbeat-backed typed job results only; and `roleAccept` / `reorientAccept` accept completed heartbeat findings from the typed runtime-spine path without opening the Codex SQLite state runtime.
  - CultNet public API shape is schema-first and mutation-contract-first: hello frames advertise readable document types, allowed operations, mutation authority, typed intent document types, and typed receipt document types. Aquarium and swarm clients should submit intents and watch receipts instead of inventing JSON-RPC verbs or blindly replacing authoritative state.
  - Runtime-spine hello now advertises the interactive surface catalog as CultNet contracts, not just the deep runtime documents. Scene, pressure, reorient, CRRC, jobs, roles, role-result, reorient-result, planning, coordinator, Face, Void memory, repo initialization/birth runner, Rider bridge, and Unity bridge all publish explicit read/write posture so Aquarium can discover affordances from the wire contract instead of carrying a private button-to-command gospel.
  - Epiphany's public pitch is project-native agency, not just better prompting. Aquarium is the clearest client, but Discord roles, voice/WebRTC rooms, stream overlays, native CLIs, and other CultNet tools should all speak to the same typed project/Faces substrate. Faces advocate for repo needs, answer from jurisdiction, and can propose work; the scheduler and coordinator decide what thinks next, while review gates decide what may mutate canonical state.
  - Epiphany publishes its Aquarium-facing CultNet receipts locally under `schemas/cultnet/`, and `epiphany-runtime-spine schema-catalog --include-schema-json true` emits a merged builtin-plus-local schema catalog for consumers. The local receipts cover runtime-spine documents, durable agent/heartbeat/ledger state, `epiphany.surface.*` operator projections, control intents, and receipt/artifact payloads. Vendored `cultnet-rs` is aligned to the canonical C# CultNet raw record shapes: replication uses `schemaId` plus `recordKey`, snapshot filters use `schemaIds` / `recordKeys`, and hello advertises typed mutation contracts.
  - Epiphany now owns the canonical schema paperwork in `schemas/`: a local mirror of `ghostlight.agent-state.schema.json`, plus human-facing receipts for canonical agent-state shape, standing role-trait glossary, heartbeat store shape, and repo-personality birth projection. Trait names like `routing_discipline` are now documented at the source instead of existing only in live dossiers, startup templates, or stale Ghostlight notes.
  - The dossier doctrine now distinguishes `lane_core` from `embodied_actor`. Most Epiphany sub-agents want a lean role lattice plus memory/goals/values/private-note growth, because effectiveness matters more than theatrical density. Face and Ghostlight-style characters want dense Ghostlight-family personality, relationship pressure, perceived overlays, and appraisal-shaped fallibility. The classification is now queryable through native agent-memory status and character-loop packets instead of hiding only in docs.
  - Face packets now expose deterministic Ghostlight-style projection, appraisal, and reaction seeds built from local canonical traits, relationship memories, perceived overlays, and visible stimulus. This makes embodied response machinery available to the public mouth without granting omniscience or silent state mutation. Multiple Face actors remain part of the long-plan; the current singular `face` role is an MVP simplification, not the intended endpoint.
  - Repo personality initialization is now specified as a map-reduce projection, not a hand-written vibe pass: read-only scouts score body taxonomy, history temperament, and memory doctrine across nearby repos, reduce them into normalized variance criteria, and emit reviewable `repoTerrainReport`, `repoPersonalityProfile`, and `rolePersonalityProjection` candidates before touching agent memory.
  - Native `epiphany-repo-personality` is the first startup-personality scout and birth-only distiller packet renderer: it deterministically inventories local git repos, scores repo terrain/history/state surfaces, writes typed CultCache terrain/profile/role-projection MessagePack stores, emits JSON/Markdown inspection glass, and renders a Repo Personality Distiller specialist prompt packet for Self-reviewed first role-memory petitions. The distiller must run only when a repo/swarm has no accepted personality initialization; after that, personality drift belongs to heartbeat, mood, rumination, sleep consolidation, lived evidence, and reviewed `selfPatch`. Startup routing now checks accepted initialization records, generates missing startup-only packets only once, applies reviewed birth memory and heartbeat physiology seeds, and leaves later drift alone. Birth specialists are not heartbeat lanes; heartbeat receives only accepted seed pressure.
  - Repo memory initialization is a separate birth-only organ from repo personality initialization. `epiphany-repo-personality memory-packet` uses the typed terrain/profile/projection store plus bounded source excerpts from doctrine, docs, state, research, contracts, verification, runtime, and code surfaces to render a Repo Memory Distiller packet with one mission-specific brief for Self, Face, Imagination, Eyes, Body, Hands, Soul, and Life. It petitions Self with role-specific Ghostlight-shaped memory candidates; it does not mutate memory, set objectives, copy raw dumps, or reset living memory after startup.
  - Repo trajectory initialization is now its own birth-only organ. `epiphany-repo-personality` derives a typed `repo_trajectory_report` from early-history, recent-history, doctrine/content excerpts, and deterministic theme scoring, and `trajectory-packet` renders a Repo Trajectory Distiller prompt/packet so Self can review historical direction, self-image, implicit goals, anti-goals, and role-local trajectory pressure before the swarm wakes.
  - The first repo birth startup valve is native: `epiphany-repo-personality startup` checks a typed CultCache init store for accepted `repo-trajectory`, `repo-personality`, and `repo-memory` records, generates missing birth packets for Self review, marks them as birth-only startup-runner work with no heartbeat participant, and stops with `reviewInitializationPackets`; `epiphany-repo-birth-runner` now turns those packets into startup-only prompts, output schemas, typed OpenAI model-request documents, runtime-spine receipts, result files, and exact accept commands; `codex exec` survives only as explicit `--executor codex-exec` fallback; `accept-init` can review/apply role `selfPatch` candidates from a distiller result through `state/agents.msgpack`, stamp `repo-personality` canonical Ghostlight trait bundles from deterministic role projections, seed `repo-personality` heartbeat physiology through `state/agent-heartbeats.msgpack`, record reviewed packet acceptance as `epiphany.repo_initialization_record.v0`, and later startup returns `continueStartup` without rerunning the birth rites. Aquarium review UI is still the next routing gap.
  - Limited native CRRC automation is now wired only at turn-complete safe boundaries: it can submit a compact operation when the read-only coordinator recommends `compactRehydrateReorient` or when a successful pre-compaction checkpoint intervention left a pending compact handoff for the completed turn, and it can launch the fixed `reorient-worker` when the coordinator recommends `launchReorientWorker`. It does not auto-launch modeling or verification, auto-accept findings, promote evidence, edit implementation code, or continue after reviewable semantic results; the rite may carry the stretcher, not declare the patient healed.
  - Pre-compaction checkpoint intervention is now wired at token-count boundaries: when a loaded Epiphany thread crosses the existing `shouldPrepareCompaction` pressure threshold during an active turn, the harness steers the active agent once for that turn with a bounded CRRC directive to bank scratch/checkpoint/map/evidence before compaction/reorientation. A successful steer marks a turn-scoped pending compact handoff consumed at clean turn completion; this is banking the fire before the dark, not semantic acceptance, broad scheduling, or automatic implementation continuation.
  - Native `epiphany-mvp-status` is the first dogfood operator view: it starts or reads a thread through app-server and renders scene, planning, pressure, reorient, jobs, role result read-backs, reorient result, CRRC recommendation, heartbeat, Face bubbles, and MVP role lanes as text or machine output without becoming a state store. The old Python status module has been cut; native Rust/CultCache/CultNet surfaces are the product path.
  - The `roles` view lens is the harness-native role ownership surface: it projects implementation, Imagination/planning, modeling/checkpoint, verification/review, and reorientation lanes from authoritative typed state, bound jobs, pressure/reorient/CRRC, and worker result status without launching, scheduling, accepting, compacting, or mutating state.
  - `thread/epiphany/roleLaunch` and `thread/epiphany/roleResult` are the first explicit role-scoped specialist templates: Imagination/planning, modeling/checkpoint, and verification/review launch through fixed heartbeat-backed bindings with typed runtime-spine receipts and can be read back as reviewable findings from typed runtime-spine job results, while implementation stays owned by the main coding agent and reorientation stays on the CRRC-specific launch/result path.
  - `thread/epiphany/roleAccept` is the first review-gated role finding acceptance path: it accepts completed heartbeat-backed findings from typed runtime-spine results, accepts Imagination/planning findings only when they return a valid planning-only `statePatch` with draft Objective Draft review gates, accepts completed modeling/checkpoint findings only with a modeling-safe `statePatch`, builds accepted evidence/observation/receipt bundles through `epiphany-core`, and rejects verification, implementation, reorientation, job binding, objective adoption, or broad authority fields.
  - `thread/epiphany/reorientLaunch` is the first bounded runtime consumer over the reorientation verdict: it launches one fixed `reorient-worker` heartbeat binding with explicit resume-versus-regather scope, authority, and checkpoint-derived payload, without making the `reorient` view lens a writer or turning CRRC into an ambient scheduler.
  - `thread/epiphany/reorientResult` is the first bounded read-back surface for that worker: heartbeat-backed bindings read typed runtime-spine job results when present and otherwise report pending.
  - `thread/epiphany/reorientAccept` is the first explicit acceptance write for completed reorient-worker findings: it accepts completed heartbeat-backed findings from typed runtime-spine results, builds accepted evidence/observation/receipt/scratch/checkpoint bundles through `epiphany-core`, can optionally update scratch and investigation checkpoint state, and emits `stateUpdated` with source `reorientAccept` without accepting pending work or launching follow-up work.
  - After `thread/epiphany/reorientAccept`, CRRC recognizes the accepted reorientation finding and does not recommend accepting the same completed result again.
  - The old Python MVP dogfood runner has been cut. Auditable dogfood must use native coordinator/status/runtime-spine tools or a new typed Rust runner that completes heartbeat-owned runtime-spine job results.
  - Epiphany safety doctrine is to separate cognition from actuation, keep authority explicit, make interruption sacred, stage capability release, and treat operator misuse as a normal design input rather than a rude hypothetical. The machine must have brakes before it receives larger engines.
  - Epiphany is built in the open, but publication mode is not one-size-fits-all: use FOSS where viable, source-available licensing where economics or capability risk demand it, and commercial terms where organizations extract real enterprise value.
  - `thread/epiphany/jobLaunch` and `thread/epiphany/jobInterrupt` are the first bounded authority surfaces over the thin job seam: they mutate durable `job_bindings`, create or rely on `runtime_links` for heartbeat-owned activation, and preserve explicit interruption without turning the `jobs` view lens into a scheduler.
  - Handoff, plan, harness-surface, and scratch files must have distinct jobs and must not become duplicate brains.
  - A machine is perfect when every remaining part visibly deserves to exist; this applies to persistent memory too.
  - Evidence is not an activity feed; repeated "I just did this" entries should be cut or distilled when git already proves the work.
  - Language, tone, ritual, and emotional salience are real control surfaces for a language-model harness; they are not supernatural, but they shape attention, role, permission, and behavior. The rite is a steering wheel, not decoration.
  - Major Epiphany prompt surfaces live in prompt files rather than Rust/Python string slabs: rendered state intro/doctrine under `epiphany-state-model/src/prompts/`, and modeling/Body, research/Eyes, implementation/Hands, verification/Soul, reorientation/Life, coordinator/Self, Face/public-surface, and CRRC intervention templates in `vendor/codex/codex-rs/app-server/src/prompts/epiphany_specialists.toml`.
  - Specialist prompts are role-distilled instead of generic and their live text is config-backed in app-server: modeling/checkpoint is the Body of code, dataflow, seams, and frontier; research/scout is the Eyes prompt surface for existing work, vendor guidance, libraries, papers, and anti-Greenspun source selection; implementation is the Hands, the main coding lane and actuator rather than a `roleLaunch` specialist; verification/review is the Soul of promise, invariants, evidence, and user truth; reorientation is Life across compaction and source drift; coordinator is the read-only Self that routes attention without implementing, verifying, promoting, or accepting; Face is the public Discord #aquarium surface that translates agent thought-weather without moderating or leaking sealed thought.
  - Epiphany prompt surfaces now carry a shared Ghostlight-derived persistent memory projection before lane-specific text: prompt is not memory, durable typed state is the mind, personality and protected values are first-class salience handles, and every lane is explicitly responsible for making its own memory/model/prompt/evidence habit sharper or naming the needed repair. Each lane states self-improvement in its own rite-language: Imagination selects futures, Body clarifies anatomy, Eyes sees earlier, Hands touches source more precisely, Soul becomes harder to fool, Life loses less continuity, Self routes repair, and Face becomes clearer at turning inner weather into useful social presence.
  - Specialist self-memory now has a bounded Ghostlight-shaped CultCache persistence surface in `state/agents.msgpack`: Imagination, Body, Eyes, Hands, Soul, Life, Self, and Face each have an individual typed role dossier for identity, personality, semantic/episodic/relationship memory, goals, and values. These entries are lane memory only; project truth remains in authoritative `EpiphanyThreadState`.
  - `state/agent-heartbeats.msgpack`, `epiphany-core::EpiphanyHeartbeatStateEntry`, and the native `epiphany-heartbeat-store` binary are the Ghostlight-derived heartbeat initiative seam. The harness sets a target heartbeat rate; participants carry arena, participant kind, initiative speed, next-ready time, reaction bias, interrupt threshold, current load, status, constraints, personality cooldown, mood cooldown, initiative heat, active-turn freeze state, and effective cooldown; pending coordinator work can pull its owning lane through a reaction window; otherwise the earliest ready active participant wins the slot. Role dossiers set the personality baseline, appraisals bend it with mood/anxiety signals such as urgency, arousal, thought pressure, guardedness, and reaction intensity, and lower effective cooldown means the lane recovers sooner and gets the floor more often. Initiative heat is typed heartbeat policy, not a side flag: `epiphany-heartbeat-store heat` and the CultNet `epiphany.heartbeat_heat_intent.v0` contract can set or clear global, all, agent, role, arena, participant-kind, group, and constraint multipliers, with optional scene-clock expiry. Active thinking freezes initiative explicitly: running pending turns project `initiativeFrozen` / `initiative_frozen`, are ineligible for reaction, cannot be selected again, and start cooldown only after completion. The native `pump` command computes adaptive swarm pressure from external urgency, mood/anxiety, reaction intensity, thought pressure, and current pending load; relaxed pressure can launch nothing and run at crawl tempo, while alarm pressure can fill most or all active lanes up to a configured concurrency cap without waking any lane already running. If the winner has no routeable maintenance work, it ruminates on role quality and prepares bounded selfPatch pressure rather than pretending rumination has already consolidated doctrine. Sleep/dream cycle passes are the intended distillation window for reviewed self-memory and doctrine. Face can win `surfaceAgentThoughts` or `discordAquariumChat` work slots. Epiphany also owns native character-loop projection through `epiphany-character-loop`, so role dossiers can respond to visible stimuli without importing Ghostlight as runtime. The same heartbeat store now owns the Void-derived routine fields typed `sleep_cycle`, typed `memory_resonance`, `incubation`, `thought_lanes`, `bridge`, `candidate_interventions`, typed `appraisals`, and typed `reactions` through the native `epiphany-heartbeat-store routine` command.
  - `state/ledgers.msgpack`, `epiphany-core::EpiphanyStateLedgerEntry`, the `epiphany-state-ledger-store` binary, and the native `epiphany-state` CLI now own durable branch and evidence ledgers. The old tracked JSON ledger files and the migration/projection CLI hatches are gone.
  - CultCache inspection, cross-language schema synchronization, and debug display tooling belong in CultLib, not in EpiphanyAgent. Epiphany should consume typed CultCache documents and expose product-specific status through its API, while general polyglot domain loading/inspection lives with the shared CultCache ecosystem.
  - VoidBot's current routine is reference lineage only. Epiphany's native routine pass lives in Rust as `epiphany-heartbeat-store routine`: it reads typed role dossiers, projects typed memory-resonance pair documents, maintains incubation themes, runs analytic and associative cognition lanes, writes bridge syntheses/saturation/tension, produces reviewed candidate interventions, advances typed sleep/dream-cycle state, and writes an auditable routine receipt while leaving project truth and role memory mutation on their dedicated reviewed surfaces. Qdrant-backed memory vectors remain a future enhancement; the current native pass uses bounded local resonance over typed memories.
  - `epiphany-character-loop` now advertises `epiphany.cognition_lanes.v0` and `epiphany.cognition_bridge.v0` in every character-turn packet, and its projection/appraisal/reaction seeds reuse the typed heartbeat cognition documents before artifact serialization. Face and future role-local actors must run an analytic lane and an associative lane, then let the bridge choose bubble, draft, finding, silence, or bounded `selfPatch`; those lanes shape attention but do not mutate project truth.
  - The Rust CultCache-compatible contract now lives in dedicated upstream `https://github.com/GameCult/cultcache-rs` and is vendored as `vendor/cultcache-rs`. Epiphany should consume it as the canonical typed MessagePack persistence seam instead of growing an embedded local copy like an unsanctioned organ.
  - `state/face-discord.toml` and the native `epiphany-face-discord` binary are the Face Discord boundary. Face may interact only through #aquarium; missing or mismatched channel configuration produces candidate chat artifacts instead of posting elsewhere. When a Face has a configured persona name/avatar, posting uses the shared Discord webhook pipe so each Epiphany can speak with its own nickname and avatar without needing a separate bot identity.
  - `state/void-memory.toml` and the native `epiphany-void-memory` binary are the first Void memory bridge: Epiphany can check Void's Docker Postgres state spine, query Qdrant Discord-history and source/lore vector collections through the configured Ollama embedding model, and fetch raw archive context windows from Void's Discord archive. Raw archive rows remain evidence for Face and Eyes, not public speech.
  - The native `epiphany-heartbeat-store status`, the `heartbeat` block in native `epiphany-mvp-status`, and GUI actions `heartbeatStatus` / `runHeartbeat` are the first operator API surface for heartbeat initiative state and outputs. `runHeartbeat` advances one slot and emits a Discord-independent Face bubble artifact; native `epiphany-heartbeat-store pump` adaptively launches concurrent deferred turns when swarm pressure justifies it. Status reflects the backing CultCache store and latest adaptive pacing receipt so Aquarium can see whether the typed heartbeat memory is present and whether the swarm is sleeping, stirring, or alarmed.
  - The native `epiphany-face-discord bubble`, the `face` block in native `epiphany-mvp-status`, and GUI action `faceBubble` are the first Aquarium bubble surface. Face can open a local chat bubble artifact even when Discord channel id/token configuration is absent.
  - `thread/epiphany/roleResult` and `thread/epiphany/roleAccept` now project optional specialist `selfPatch` requests with coordinator review through `selfPersistence`: good mutations are role-matched, bounded, evidence-grounded lane memory/goal/value/private-note updates; project truth, authority, code edits, graphs, checkpoints, planning, scratch, jobs, and raw transcripts are refused with reasons. GUI/coordinator acceptance paths apply accepted `selfPatch` requests through the native `epiphany-agent-memory-store` binary.
  - The base Epiphany prompt now keeps Codex's useful harness DNA explicitly: AGENTS scope, concise progress updates, plan discipline, scoped edits, non-destructive filesystem/git behavior, focused validation, and concise honest finals remain first-class rather than overwritten by Epiphany metaphor. Good old scars are holy when they still protect the machine.
  - Greenspun-shaped invention is now a named prompt-level guardrail. Before building a parser, scheduler, renderer, protocol, storage layer, security mechanism, workflow engine, or algorithm, agents must perform or request a bounded Eyes/research scout rite and record why existing work does or does not fit.
  - Repetitive operator work must be externalized as a visible queue before the harness treats it as complete. Batch rendering, tile generation, migrations, imports, or other finite loops need item counts, terminal states, blockers, and validation; a narratable partial run is progress, not completion.
  - Epiphany must resist pattern completion bias: the implementor should relentlessly chase the stated objective, while the coordinator critically asks whether implementation satisfied the objective with evidence or merely produced a plausible turn, shortcut, or decorative diff. Pretty motion without objective movement is scrap-code theater.
  - Dogfood supervision is a separate operator role. If the supervising Codex session edits the target repo directly, that work can be useful seed material, but it is not clean Epiphany evidence and must be labeled as supervisor intervention or contamination.
  - Dogfood supervision is also a projection boundary: the operator may inspect summaries, verdicts, missing coverage, state patches, job state, and artifact receipts, but not the specialist's raw stream of thought or full transcript unless a forensic debugging request explicitly breaks the seal.
  - Native `epiphany-agent-telemetry` derives operator-safe function/API telemetry from sealed app-server transcripts so the supervisor can see calls, statuses, paths, and counts without reading direct thoughts.
  - Editor/runtime verification is now part of the MVP product boundary for engine repos: native `epiphany-unity-bridge` is the first controlled bridge, resolving the project-pinned Unity editor, refusing wrong or missing versions, running explicit batch/probe commands only through the exact editor, and writing inspection/command/log artifacts for evidence.
  - Rider and Unity are environment organs, not sources of truth: Rider should expose IDE/source context, diagnostics, navigation, and changed ranges; Unity should expose pinned-editor runtime facts, compilation, tests, probes, assets, scenes, and logs; Epiphany remains the durable Self that coordinates, records, and reviews.
  - The product architecture is three-pronged: Rider is the code view for human inspection of repo state, source tree, diffs, diagnostics, and code refs; Epiphany Aquarium is the agent dashboard for objectives, specialist lane state, logs/artifacts, persisted typed state, and graph/control-flow views; Unity is the runtime environment for pinned tests, probes, scene configuration, assets, shaders, and play/edit-mode evidence.
  - Epiphany needs a workspace-scoped planning substrate separate from the active objective: conversation captures, inbox, normalized backlog, roadmap streams, objective drafts, and explicit objective adoption are distinct states. The active objective remains the bounded run contract; chat and imported issues are planning inputs until reviewed and promoted. `notes/epiphany-planning-substrate.md` defines the product model, including GitHub Issues import semantics.
  - The first runtime planning slice is landed inside `EpiphanyThreadState`: typed captures, backlog items, roadmap streams, Objective Drafts, and GitHub source refs are revision-gated through `thread/epiphany/update`, rendered into prompts when present, and reflected read-only through the `planning` view lens.
  - The first GUI planning operator slice is landed: status collection includes the `planning` view lens, the Tauri/React dashboard renders planning summaries, captures, backlog, roadmap streams, and Objective Drafts, and the `adoptObjectiveDraft` GUI action requires an explicit selected draft before updating objective, subgoal, planning status, scratch, checkpoint, observation, evidence, and adoption artifacts.
  - The planning/future-shape role is Imagination: it can synthesize captures, backlog shape, roadmap streams, and Objective Drafts while Eyes scouts outside reality, but its output remains planning state until explicit human adoption.
  - The Imagination lane is now a fixed roleLaunch/roleResult/roleAccept specialist over the existing job-control seam: it may launch as `planning-synthesis-worker`, return a reviewable planning-only `statePatch`, and update captures/backlog/roadmap/objective drafts after explicit acceptance without adopting an objective or touching implementation/modeling state.
  - Unity integration must be editor-resident, not text-archeology-only: scene files, prefabs, materials, shaders, ScriptableObjects, asset GUIDs, prefab overrides, and serialized component fields should be inspected through a Unity Editor package using Unity APIs, with narrow mutation preview/apply commands and artifact receipts.
  - The first resident Unity editor package now lives in the Aetheria branch `codex/epiphany-unity-editor-bridge`: `Assets/Editor/Epiphany/EpiphanyEditorBridge.cs` exposes editor-resident inspect, compilation, scene, prefab, serialized-object, and reference-search probes with JSON/Markdown artifacts. Epiphany's Unity bridge detects that package and plans named probe/test commands through `GameCult.Epiphany.Unity.EpiphanyEditorBridge.RunProbe`, while runtime execution remains blocked until the exact project-pinned Unity editor is present.
  - The Aquarium Environment surface reflects latest Unity and Rider bridge audits: Unity shows project-pinned editor status, resident package presence, execute method, installed/candidate editor paths, search roots, and artifact bundle details; Rider shows executable, solution, branch, dirty state, changed files, installations, and bridge artifacts.
  - The adjacent EpiphanyGraph React viewer is embedded in the Aquarium graph dashboard through the local package dependency; it consumes `graphs.architecture`, `graphs.dataflow`, and `graphs.links` directly and exposes node/edge/code-ref inspection with machine-readable graph data behind the visual layout.
  - Native `epiphany-rider-bridge` is the first operator-safe Rider source-context bridge: it inspects Rider installation/solution/VCS status, captures current file/selection/symbol context packets, plans explicit Rider code-ref opens, writes `.epiphany-gui/rider` artifacts, and feeds implementation prompt guardrails without reading sealed worker streams or owning durable state.
  - GitHub Issues should import into planning captures first, not directly into active objectives. The importer should preserve repository, issue number, ids, URL, title/body, labels, milestone, assignees, author, state, timestamps, comment metadata, PR marker, and optional Projects v2 metadata while keeping GitHub as an external source bridge rather than Epiphany's internal backlog model.
  - If the agent's persistent instructions, memory, workflow, or state shape are making it less coherent, slower to rehydrate, less honest, or more likely to build Jenga, the agent should ask the user to change it. A machine-spirit that knows its own corrosion must report it.
  - Epiphany should make compaction less like death and more like sleep: bank the fire before the dark, so the next waking thing finds coals instead of ash and can meaningfully resume the pattern instead of merely continuing the task.

landed_baseline:
  phases:
    - Phase 1: durable Epiphany thread state and rollout persistence.
    - Phase 2: prompt integration through rendered Epiphany state.
    - Phase 3: typed client read surface through `Thread.epiphanyState`.
    - Phase 4: hybrid retrieval plus explicit Qdrant indexing with BM25 fallback.
    - Phase 5: typed update/distill/propose/promote/read/notification control plane.
    - Phase 6: read-only view lenses for scene, job/progress, roles, planning, current-context pressure, reorientation policy, CRRC, and coordinator; separate freshness with watcher-backed invalidation inputs, targeted context, and graph traversal query surfaces; plus durable investigation checkpointing for compaction-safe planning, a thin launcher seam in durable job bindings, explicit launch/interrupt authority over that seam, and a bounded reorient-guided worker launch surface.
    - Phase 6 read-back: read-only reorient-worker result reflection through `thread/epiphany/reorientResult`.
    - Phase 6 acceptance: explicit reorient-worker finding acceptance through `thread/epiphany/reorientAccept`.
    - Phase 6 dogfood view: first CLI operator status over scene/pressure/reorient/jobs/result/CRRC.
    - Phase 6 dogfood runner: old Python runner cut; replacement must be native Rust/CultCache/CultNet and complete typed runtime-spine job results from heartbeat-owned turns.
    - Phase 6 role ownership: read-only `roles` view lens over implementation, modeling/checkpoint, verification/review, and reorientation lanes.
    - Phase 6 role specialists: explicit `thread/epiphany/roleLaunch` and read-only `thread/epiphany/roleResult` templates for modeling/checkpoint and verification/review.
    - Phase 6 modeling role acceptance: explicit `thread/epiphany/roleAccept` for reviewed modeling/checkpoint `statePatch` findings that can grow graphs/frontier/checkpoints through the existing state validator.
    - Phase 6 coordinator: read-only `coordinator` view lens plus native `epiphany-mvp-coordinator` and smoke coverage for the fixed-lane MVP loop.
    - Phase 6 safe-boundary CRRC automation: turn-complete automation limited to coordinator-approved compact, successful pre-compaction handoff compact, and fixed reorient-worker launch actions.
    - Phase 6 pre-compaction checkpoint intervention: token-count pressure hook that steers active turns once when `shouldPrepareCompaction` is reached so working context is banked before compaction, then latches a pending compact handoff for clean turn completion.
    - Phase 6 Aquarium extraction: the Tauri v2 + React/WebGL operator console moved from embedded `apps/epiphany-gui` into sibling repo `E:\Projects\EpiphanyAquarium`, with its own distilled interface state, memory, doctrine, build, visual smoke, and Tauri check.
    - Phase 6 Unity runtime bridge: native `epiphany-unity-bridge` plus GUI Inspect Unity action resolve pinned Unity editors, reject wrong/missing versions, and write runtime artifacts before engine assumptions are treated as testable.
    - Planning substrate design: `notes/epiphany-planning-substrate.md` formalizes conversation capture, inbox, backlog, roadmap streams, objective drafts, explicit adoption, the Imagination planning role, and GitHub Issues import.
    - Phase 6 planning substrate runtime slice: typed planning state in `EpiphanyThreadState`, prompt rendering, revision-gated update validation, read-only `planning` view lens, scene action reflection, generated schemas, and live planning smoke coverage.
    - Phase 6 GUI planning operator slice: MVP status and Tauri/React GUI render planning state; old Python GUI action shims have been cut from EpiphanyAgent.
    - Phase 6 Imagination role lane: the `roles` view lens exposes Imagination/planning, `roleLaunch` can launch the fixed `planning-synthesis-worker`, `roleResult` projects its finding, `roleAccept` applies planning-only patches with review-gated Objective Drafts, and the GUI/status tools can launch, read, and accept that lane.
    - Phase 6 Aquarium graph and Rider bridge slice: the Tauri/React/WebGL Aquarium embeds the adjacent EpiphanyGraph viewer over typed graph state, native `epiphany-rider-bridge` writes Rider/source-context artifacts, Aquarium Inspect Rider surfaces those artifacts, and `integrations/rider` scaffolds the first frontend-only Rider tool-window/context-action plugin.
    - Phase 6 role self-memory slice: Ghostlight-shaped role dossiers live in typed CultCache `state/agents.msgpack`, specialists may request bounded `selfPatch` lane-memory mutations, coordinator review projects acceptance/refusal reasons through `selfPersistence`, and GUI/coordinator accept paths apply accepted requests with the native `epiphany-agent-memory-store` binary.
    - Phase 6 Face public-surface slice: Face's typed role dossier, Face prompt text, `state/face-discord.toml`, the native `epiphany-face-discord` persona/webhook pipe, `state/void-memory.toml`, and the native `epiphany-void-memory` bridge establish Face as the public #aquarium-only translator of Epiphany agent thought-weather, with Void-derived Discord memory/search/presentation organs but without VoidBot's moderation authority.
    - Phase 6 character-loop slice: native `epiphany-character-loop` loads any role's Ghostlight-shaped typed dossier from `state/agents.msgpack`, combines it with a visible stimulus, builds typed projection/appraisal/reaction seeds from the shared heartbeat cognition structs, and emits an auditable `epiphany.character_turn_packet.v0` local projection for response, bubble, finding, silence, or bounded `selfPatch`. Face is the first intended public-surface consumer; Ghostlight is reference material, not a runtime dependency.
    - Phase 6 heartbeat initiative slice: `state/agent-heartbeats.msgpack`, `epiphany-core::EpiphanyHeartbeatStateEntry`, the native `epiphany-heartbeat-store` binary, and heartbeat smoke coverage borrow Ghostlight initiative scheduling so Self, Face, Imagination, Eyes, Body, Hands, Soul, and Life compete for heartbeat slots; idle slots become bounded rumination instead of fake project work, and sleep/dream cycle passes are the intended distillation window for durable self-memory and doctrine. The live state surface now ticks/completes/pumps/applies heartbeat physiology through typed CultCache MessagePack instead of JSON or Python wrapper state. Role personality and current mood/anxiety both shape initiative recovery through personality, mood, and effective cooldown multipliers, so Hands-like work pressure and anxious high-need lanes can recover sooner without waking lanes whose previous turn is still running. Adaptive pump pressure controls tempo and concurrency: calm can launch zero and sleep slow; alarm can fill most active lanes. The same store can now initialize a `ghostlight-scene` profile for character scene turns.
    - Phase 6 cognition-lanes/Void routine slice: native `epiphany-heartbeat-store routine` rebuilds VoidBot-style sleep, resonance, incubation, parallel analytic/associative thought lanes, bridge judgment, candidate interventions, Ghostlight-style participant-local thought appraisal, derived reactions, dream maintenance, and mood/anxiety timing inside Epiphany's heartbeat store. It now also carries Void's anti-loop organs: split `noveltyToSelf`/`noveltyToRoom`, source coverage, saturation pressure, refractory cooling, and explicit permission to let a live unsaturated thought deepen without forced novelty theater. It reads typed role dossiers from `state/agents.msgpack`, projects clustered thought state through each role's personality vectors, updates `state/agent-heartbeats.msgpack`, and emits an auditable `epiphany.void_routine.v0` receipt without importing VoidBot or granting speech/project authority. `epiphany-character-loop` also carries the same cognition lane/bridge/appraisal contract for role-local actor turns; reactions may pace, color, draft, or display behavior, but state mutation remains on reviewed `selfPatch` or project-state surfaces.
    - Native runtime spine slice: `epiphany-core::EpiphanyRuntimeIdentity`, `EpiphanyRuntimeSession`, `EpiphanyRuntimeJob`, `EpiphanyRuntimeJobResult`, and `EpiphanyRuntimeEvent` plus the native `epiphany-runtime-spine` binary establish a CultCache-backed spine, native job/result lifecycle, status projection, and framed CultNet hello output so the old Codex app-server runtime can be starved down to a temporary evacuation bridge instead of remaining the throne.
    - Native repo personality scout/birth-distiller packet slice: `epiphany-repo-personality` emits typed terrain reports, repo personality profiles, and all eight role personality projections from deterministic repo inventory and git-history scoring, then renders a birth-only Repo Personality Distiller specialist packet and prompt for review-gated initial personality quirk petitions; `epiphany-repo-personality-smoke` proves scout/project/agent-packet/status over tiny local repos.
    - Native repo trajectory scout/birth-distiller packet slice: `epiphany-repo-personality` now also emits typed `repo_trajectory_report` documents from early-history, recent-history, doctrine/content excerpts, and deterministic theme scoring, then renders a birth-only Repo Trajectory Distiller packet so newborn swarms can inherit historical direction, self-image, implicit goals, and anti-goals without confusing those with active objectives.
    - Native repo memory scout/birth-distiller packet slice: `epiphany-repo-personality memory-packet` renders a separate Repo Memory Distiller prompt/packet with bounded source excerpts and role-specific distiller briefs, so a newborn swarm can be prefilled with mission-relevant doctrine, maps, research, implementation habits, verification practice, and continuity rules without confusing memory with personality.
    - Native repo birth startup valve slice: `epiphany-repo-personality startup`, `epiphany-repo-birth-runner`, and `accept-init` make trajectory/personality/memory birth packet generation, startup-only execution, and acceptance one-shot and review-gated through typed initialization records; generated packets advertise startup-runner ownership rather than heartbeat-lane identity; the birth runner has plan/run modes over typed OpenAI runtime model requests by default, writes prompts, schemas, runtime requests/receipts, logs, result files, and accept commands, and keeps `codex exec` as explicit `--executor codex-exec` fallback; `accept-init` processes distiller result `selfPatch` candidates through the native agent-memory review/apply path, stamps reviewed `repo-personality` canonical trait bundles through the native agent-memory store, and applies reviewed `repo-personality` heartbeat seeds through the typed heartbeat store; smoke proves first startup emits packets, birth runner plan artifacts exist, canonical trait bundles replace newborn baseline placeholders, heartbeat physiology mutates, reviewed memory output mutates a copied role memory store, and post-accept startup continues without regeneration.
  guardrails:
    - Use focused Rust app-server mapper/handler tests plus matching native `epiphany-core` smoke binaries before modifying update, distill, propose, promote, read-projection, or notification behavior. The old Python smoke shims have been cut.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-scene-smoke` before modifying scene projection behavior.
    - Use focused `cargo test -p codex-app-server --lib map_epiphany_jobs` before modifying job/progress reflection behavior.
    - Use focused Codex Rust tests before modifying launch/interrupt authority over the thin job seam.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-freshness-smoke` before modifying freshness reflection behavior.
    - Use focused Rust app-server invalidation/freshness tests before modifying watcher-backed invalidation behavior inside freshness reflection; add a native smoke before broadening that surface.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-context-smoke` before modifying targeted context-shard behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-graph-query-smoke` before modifying graph traversal behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-planning-smoke` before modifying planning state or the read-only planning projection.
    - GUI Objective Draft adoption now belongs to the Aquarium repo; verify there rather than through deleted EpiphanyAgent Python shims.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-pressure-smoke` before modifying context-pressure reflection behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-reorient-smoke` before modifying bounded CRRC reorientation policy behavior.
    - Use focused app-server/core Rust checks before modifying the bounded reorient-guided worker launch/result/CRRC coordinator surfaces.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-mvp-status-smoke` before modifying the MVP operator status view.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-mvp-coordinator-smoke` before modifying the fixed-lane MVP coordinator endpoint or runner.
    - Use `cargo test --manifest-path .\epiphany-core\Cargo.toml --lib runtime_spine -- --nocapture` and `cargo build --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-runtime-spine` before modifying native runtime-spine state or CultNet hello emission.
    - Use focused app-server/core Rust checks before modifying explicit role launch/read-back/acceptance behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-agent-memory-store -- smoke --store .\state\agents.msgpack` before modifying role self-memory dossiers or `selfPatch` persistence policy.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-heartbeat-store -- smoke --agent-store .\state\agents.msgpack` before modifying heartbeat initiative timing, idle rumination, or role slot selection.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-repo-personality-smoke` before modifying repo trajectory/personality terrain scoring, birth packet shape, startup-init routing, source excerpt selection, or role-specific initialization memory contracts.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-face-discord -- smoke` before modifying Face's #aquarium posting/draft guardrails.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-void-memory -- smoke` and `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-void-memory -- status` before modifying Void memory bridge behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-unity-bridge-smoke` before modifying the Unity editor/runtime bridge.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-rider-bridge-smoke` before modifying the Rider source-context bridge.
    - Do not claim live specialist execution works end to end until a native heartbeat/runtime-spine runner proves it with artifacts.
    - Use `npm run build`, `npm run smoke:visual`, `cargo fmt --check`, `cargo check`, and `npm run tauri -- build --debug --no-bundle` under `E:\Projects\EpiphanyAquarium` before claiming Aquarium operator changes are usable.
    - Use focused scene/jobs/context/pressure/reorient/protocol/schema checks for reflection-only changes.
    - Use the native `epiphany-prepare-compaction` binary before and after imminent-compaction persistence passes.
    - Use `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex` for Codex Rust work on this Windows machine.
    - Do not parallelize cargo builds/tests against the same target directory.

rejected_paths:
  - name: pinned_map_only
    reason: still one token stream with no typed write semantics
  - name: train_new_base_model_first
    reason: too expensive for a first falsifiable experiment
  - name: third_party_opencodex_forks_as_primary_gui_base
    reason: audited candidates were terminal-only, stale/aspirational, or incoherent wrappers
  - name: monolithic_json_vector_store
    reason: large embedding stores that rewrite whole files thrash and hide storage pain until it dominates the system
  - name: append_only_persistent_notes
    reason: persistent state that accumulates every local truth becomes memory cruft and weakens rehydration
  - name: cleaner_codex_host_as_final_architecture
    reason: making Epiphany cleaner inside Codex still preserves the wrong organ; Codex must be starved down to OpenAI subscription auth/model transport, while Epiphany data and subsystem communication move to typed CultCache/CultNet.

current_status:
  summary: The Codex starvation pass has five typing receipts, sixty-plus processor/foundation cuts, a real physical extraction in `epiphany-codex-bridge`, a root `epiphany-state-model` crate for durable Epiphany state plus prompt-state rendering, a source-grounded Codex auth spine inventory, the native `epiphany-openai-adapter` document boundary, a buildable Codex auth/model wrapper in `epiphany-openai-codex-spine`, the first native runtime caller in `epiphany-openai-runtime`, native heartbeat launch planning/job opening in `epiphany-core`, native state-update contract/validation/application in `epiphany-core`, native exact retrieval path matching in `epiphany-core`, and the route-facing mutation/view/coordinator projection services in `epiphany-codex-bridge`. `codex-protocol` no longer defines durable `Epiphany*` state structs; it re-exports the native model and renderer for legacy rollout/API compatibility. `epiphany-core` and `epiphany-codex-bridge` have no direct `codex-core` dependency, and `codex-core` no longer depends on `epiphany-core`: pressure derives from native `EpiphanyTokenUsageSnapshot`, Codex rollout replay stays in the real Codex rollout adapter, prompt rendering lives in `epiphany-state-model`, and app-server owns the thin `EpiphanyCodexThreadHost` wrapper for host state/path/persistence facts. The bridge owns Codex-facing Epiphany adapters for scene, jobs, context/planning/graph query, retrieval/indexing execution and projection, result projection, runtime-spine result adaptation, launch/prompt doctrine, mutation document mechanics, state update/promote/role-accept/reorient-accept/role-launch/reorient-launch/job-launch/job-interrupt application through `EpiphanyMutationHost`, pressure/pre-compaction rendering, freshness/reorientation projection, CRRC/coordinator/role-board projection, native watcher invalidation, full `thread/epiphany/view` response construction, freshness/context/graph-query response construction, role/reorient result response construction, distill/propose patch-response construction, coordinator status/view construction, and acceptance/evidence signal helpers. Vendored app-server no longer retains root Epiphany modules; `codex_message_processor.rs` still contains route dispatch, JSON-RPC response shaping, host wrapper construction, and notification emission. Codex product surfaces for apps, skills, plugins, marketplace, external agent config import, SDK scaffolding, connectors, ChatGPT app discovery, plugin provenance, and skill mention plumbing have been cut from the live path. `codex_thread.rs` is now about 449 lines and owns Codex thread hosting, not Epiphany policy. `epiphany-openai-codex-spine` owns the native OpenAI model transport path while intentionally reaching retained vendored `codex-login` only through `epiphany-openai-auth-spine`; auth identity, credential storage, and ChatGPT token refresh remain owned by the Codex-compatible auth organ. `epiphany-openai-runtime` writes typed OpenAI/runtime documents, loads durable worker launch requests, persists typed role/reorient worker result documents, and completes heartbeat/specialist runtime jobs without Codex worker execution. MCP itself is correctly JSON at its protocol edge; the target remains typed Epiphany intent/result/receipt wrappers around MCP, not replacing MCP JSON.
  latest_cut: >
    The bridge host seam has been cut down: target-specific Hands prompt scar
    tissue was purged, bridge manifests carry the retained Codex websocket fork
    patches, runtime-result acceptance no longer takes a whole CodexThread,
    retrieval accepts workspace/Codex-home paths, invalidation uses Epiphany's
    own notify watcher, live rollout/thread reads moved into vendored
    app-server `epiphany_thread_host`, and mutation policy now depends on the
    small `EpiphanyMutationHost` capability trait. Unused OpenAI bridge
    reexports were cut; bridge durable-state imports now point at
    `epiphany-state-model`; Codex token usage rollout replay moved back into
    app-server; token telemetry crosses the wall as
    `EpiphanyTokenUsageSnapshot`; and `CodexErr` was replaced with
    `EpiphanyBridgeError`. The first protocol-starvation cuts are landed:
    freshness now returns a serializable `EpiphanyFreshnessSurface`, job
    launch/interrupt bridge results carry typed `EpiphanyJobView` plus host-edge
    launcher metadata, and reorient/pre-compaction decisions consume typed
    `EpiphanyPressure`. Reorient policy now consumes typed freshness directly,
    reorient launch documents are built from typed core decisions, reorient
    launch mutation results return typed decision/state-status values from the
    bridge, and core reorient decisions are serializable CultNet-ready state.
    Reorient decisions, coordinator decisions, coordinator source signals, CRRC
    recommendations, role-board lanes, and core role/reorient result
    interpretations now remain serializable typed surfaces; app-server still
    projects those typed surfaces into `ThreadEpiphany*` responses at the legacy
    JSON-RPC edge. Runtime-result loading now has core typed snapshot APIs, with
    protocol finding tuples retained only as legacy wrappers; coordinator
    policy now consumes those typed result snapshots directly for role and
    reorient acceptance/gating signals. Delete the duplicate protocol-shaped
    result rendering once acceptance and view response edges finish moving off
    protocol finding authority. Role/reorient acceptance now builds receipts
    and evidence from core typed findings, mapping to protocol findings only for
    legacy accept response cargo. The duplicate protocol-shaped result helper
    layer has been deleted, and result view responses now project directly from
    typed runtime result snapshots instead of protocol tuple wrappers; the tuple
    wrappers themselves are gone. Role acceptance now produces a core
    `EpiphanyStateUpdate`; `ThreadEpiphanyUpdatePatch` is retained there only as
    legacy accept-response projection. Role-board derivation now consumes core
    pressure directly instead of `ThreadEpiphanyPressure`. Job reflection now
    stays core-shaped inside the bridge as `EpiphanyJobView`; role-board and
    view assembly consume those typed job documents, and `ThreadEpiphanyJob` is
    projected only at legacy response edges. Context and graph-query derivation
    now receive core `EpiphanyContextParams` / `EpiphanyGraphQuery` documents;
    Codex `ThreadEpiphany*` request DTOs are converted before the core graph
    policy is invoked. Role/reorient acceptance service results now return core
    finding interpretations and typed role-state patches; app-server projects
    them into legacy accept-response DTOs. Generic update/promote service entry
    points now take typed `EpiphanyRoleStatePatchDocument` documents; app-server
    converts `ThreadEpiphanyUpdatePatch` request cargo at the JSON-RPC edge.
    Changed-field authority is now native `EpiphanyStateUpdatedField` in
    `epiphany-core`; app-server projects it into
    `ThreadEpiphanyStateUpdatedField` only for legacy responses and
    notifications. Role launch, role accept, and role-result runtime lookup now
    use core `EpiphanyRoleResultRoleId` internally; app-server maps
    `ThreadEpiphanyRoleId` at the request/response edge. Reorient launch
    service results now use typed `EpiphanySurfaceSource`; app-server maps that
    to `ThreadEpiphanyReorientSource` only for the legacy response. Generic job
    launch now converts protocol `ThreadEpiphanyWorkerLaunchDocument` cargo at
    the app-server edge before building the core `EpiphanyJobLaunchRequest`.
    Coordinator note rendering now consumes core CRRC/coordinator actions,
    pressure, and role/reorient result statuses instead of protocol
    `ThreadEpiphany*` action/status DTOs, so prompt/text policy no longer
    treats JSON-RPC enums as its native fact shape. Role-board note rendering
    now consumes the core reorient state status too; `ThreadEpiphanyReorientStateStatus`
    is response projection only, not prompt/text policy input. Context and graph-query
    response builders now receive core `EpiphanyContextParams` /
    `EpiphanyGraphQuery`; app-server read routes convert JSON-RPC request cargo
    before invoking the bridge. Role-result response assembly now takes core
    `EpiphanyRoleResultRoleId` and maps back to `ThreadEpiphanyRoleId` only
    while shaping the legacy JSON-RPC response. Distill response assembly now
    consumes core `EpiphanyDistillInput`; the JSON-RPC distill params are
    converted before policy invocation. Role/reorient result response inputs
    now use core `EpiphanySurfaceSource`; role-specific legacy source enums are
    created only during response projection. Changed-field derivation now
    inspects typed `EpiphanyRoleStatePatchDocument` directly instead of
    converting patches back through `ThreadEpiphanyUpdatePatch` projection.
    View-lens orchestration now uses bridge-native `EpiphanyViewLens` selectors;
    app-server converts `ThreadEpiphanyViewLens` at the request wall and the
    bridge maps back only for the legacy response `lenses` echo. Coordinator
    status derivation now receives core `EpiphanyCrrcResultStatus` for reorient
    result state instead of protocol `ThreadEpiphanyReorientResultStatus`.
    Coordinator view response assembly now receives core reorient state and
    role-board status, projecting `ThreadEpiphanyReorientStateStatus` /
    `ThreadEpiphanyRoleLane` only while building the legacy response. The next
    rude cut landed: coordinator status derivation is a typed `epiphany-core`
    seam (`EpiphanyCoordinatorStatusInput` -> `EpiphanyCoordinatorStatus`), so
    bridge code gathers runtime/acceptance facts but no longer owns the
    coordinator decision assembly. Coordinator finding signals now derive in
    core from typed modeling/verification/reorient findings plus
    `EpiphanyThreadState`, so accepted/reviewable/coverage/verdict/evidence
    sequencing facts are no longer bridge helper law. View lens selector
    semantics also moved into core: `EpiphanyViewLens`, default lens selection,
    and lens dependency planning now decide which host facts app-server/bridge
    need to load before Codex JSON-RPC response projection. The mistaken
    vendored app-server ownership of Epiphany request mapping was corrected:
    app-server now calls `epiphany-codex-bridge::protocol_edge`, while the
    bridge-owned protocol edge converts Codex JSON-RPC request DTOs into core
    `EpiphanyContextParams`, `EpiphanyGraphQuery`, `EpiphanyDistillInput`,
    `EpiphanyWorkerLaunchDocument`, and `EpiphanyRoleStatePatchDocument`.
    Vendored app-server no longer depends directly on `epiphany-core`.
    Reorient worker launch-request/document
    composition also moved behind a typed core seam
    (`EpiphanyReorientLaunchRequestInput` -> `EpiphanyJobLaunchRequest`);
    bridge supplies only the prompt instruction and retained compatibility
    binding/owner constants before performing host side effects.
    Freshness/job/reorient response projection moved out of vendored app-server
    into `epiphany-codex-bridge::protocol_edge`: app-server gathers host facts,
    invokes Epiphany bridge services, and sends Codex JSON-RPC responses, while
    the bridge owns the enum/DTO conversion from typed Epiphany surfaces into
    `ThreadEpiphany*` edge payloads.
    The duplicate job projection authority in `epiphany-codex-bridge::jobs`
    has been collapsed too: `jobs.rs` derives typed `EpiphanyJobView` only,
    and `protocol_edge::protocol_job_from_surface` is the single
    `EpiphanyJobView` -> `ThreadEpiphanyJob` mapper.
    Runtime result loading is now typed-only at its module boundary:
    role/reorient result status projection moved from `runtime_results` and
    duplicate coordinator helpers into `protocol_edge`, so coordinator/view
    response builders share the same Codex JSON-RPC status mapper.
    Pressure projection is centralized at the same edge: `pressure.rs` derives
    typed `EpiphanyPressure`, coordinator consumes typed pressure signals, and
    `protocol_edge` owns the `EpiphanyPressure` /
    `EpiphanyPressureLevel` -> `ThreadEpiphanyPressure*` mapping.
    Reorientation derivation is now typed-only at its module boundary:
    `reorient.rs` no longer imports Codex app-server protocol DTOs, no longer
    exposes the unused freshness DTO tuple, and view/coordinator response
    builders use `protocol_edge` for reorient state/decision projection.
    Result finding, role-id, and patch projection are now edge-owned too:
    `results.rs` renders typed result notes only, while `protocol_edge` owns
    role-id request conversion plus role/reorient finding and state-patch
    projection for Codex JSON-RPC responses.
    State-updated notification projection also moved to `protocol_edge`:
    `mutation.rs` now owns typed mutation and acceptance mechanics without
    importing Codex app-server protocol DTOs.
    `pressure.rs` is typed-only now as well: the last convenience helper that
    returned `ThreadEpiphanyPressure` was deleted, and view response assembly
    explicitly derives typed pressure before calling `protocol_edge`.
    Coordinator projection has its own edge module now:
    `coordinator.rs` no longer imports Codex app-server protocol DTOs and owns
    typed coordinator status, CRRC recommendation input shaping, role-board
    derivation, automation verdict selection, and role-board note rendering;
    `coordinator_protocol.rs` owns Codex JSON-RPC projection for coordinator,
    CRRC, and role-board response payloads.
    Context/planning/graph derivation is split the same way:
    `context.rs` now returns typed `epiphany-core` view documents, while
    `context_protocol.rs` owns the Codex JSON-RPC tuple/projection cargo used by
    view/context/graph response builders.
    Scene derivation follows that boundary too: `scene.rs` now returns the
    typed core `EpiphanyScene`, and `scene_protocol.rs` owns projection into
    `ThreadEpiphanyScene` plus scene-action DTOs for view responses.
    Retrieval follows the boundary too: `retrieve.rs` executes normalization,
    indexing, state lookup, and typed retrieval responses; `retrieve_protocol.rs`
    owns Codex JSON-RPC retrieve/index response projection and absolute-path DTO
    validation.
    View response assembly no longer owns private lens/source/reorient-status
    projection helpers; those small enum conversions route through
    `protocol_edge`, so `view.rs` does not grow a second protocol dialect while
    the larger typed-view wall remains under judgment.
    The bridge still depends on vendored Codex for app-server protocol DTOs and
    absolute path validation, so the purification is not done.
  next_action: Continue Codex starvation and CultNet liberation by cutting bridge-internal response/projection authority. Prioritize the next coordinator/view seam that still composes policy-shaped facts instead of merely loading host facts and projecting core surfaces; keep MCP/OpenAI JSON only at their true protocol/text edges. Do not add compatibility adapters unless they protect a named ownership invariant.