Epiphany/state/map.yaml

experiment:
  name: EpiphanyAgent
  status: active
  phase: phase_6_reflection_boundary
  premise: >
    Test whether explicit typed state, machine-maps, scratch rites, evidence
    reliquaries, and ruthless memory hygiene reduce architectural drift in AI
    coding work. The machine must remember through typed organs, not vibes and
    transcript fog.

objective:
  primary: >
    Build Epiphany as an opinionated Codex fork that forces models to keep
    explicit typed models of the codebase, active goal, evidence, and change
    machinery they touch. The agent must know the machine before it cuts the
    machine.
  current: >
    Build Epiphany toward project-native agency: users talk to projects and
    their Personas, while typed heartbeat, memory, repo maps, evidence, CultNet
    contracts, and review gates schedule and structure the solution work. Codex
    starvation and CultNet liberation remain the infrastructure path because
    this cannot live as private Codex JSON-RPC prompt plumbing forever.

constraints:
  - No frontier-scale training tithe.
  - Prefer evidence over vibes; incense is not telemetry.
  - Treat Codex as a relatively vanilla bridge to OpenAI and Codex-native runtime/app-server affordances, not a design center: new Epiphany runtime contracts must land native in `epiphany-core`, CultCache, CultMesh, and CultNet first.
  - Codex is no longer an Epiphany host to improve. Its acceptable role is to keep doing Codex things, including OpenAI subscription auth/model transport and useful streaming/app-server bridge functions, while Epiphany owns its own state, processes, prompts, scheduler, and policy.
  - Keep persistent state small enough to rehydrate from without drowning the next awakened mind in sacred sludge.
  - Grow cognition more quickly than authority: capability increases must preserve explicit permissions, interruption, legibility, and resistance to paternal "safety" cages.
  - Speak CultNet, persist CultCache-shaped typed state, and grow the body toward Pure Rust; Python/JSON impurity survives only as named quarantine scaffolding with receipts.

invariants:
  - The map is canonical and slow-changing: the machine's remembered skeleton, not a mood board.
  - Scratch is temporary and disposable: a workbench, not a reliquary.
  - Evidence is durable and distilled; routine activity logs belong in git history, commits, smoke artifacts, or targeted logs.
  - Output must not silently rewrite the machine-map.
  - Accepted changes should carry recorded proof of sanctity.
  - Rejected paths stay recorded when the scar teaches future hands.
  - Algorithmic-map prose and metaphor must be grounded in freshly read source context and concrete code references.
  - Persistent state cruft is the same failure class as code cruft: corrosion in the mind instead of corrosion in the hull.
  - Top-level notes are live authority surfaces; `notes/archive/` is provenance only unless a canonical note explicitly promotes a distilled invariant back into the live set.
  - Rumination is not distillation by itself. Idle heartbeat turns should ruminate: lightly shuffle thoughts, surface tensions, and prepare candidate memory pressure. Sleep is the consolidation window: that is when the cycle should distill durable doctrine, self-memory, and dream residue into reviewed persistence.
  - If compaction interrupts source gathering or slice planning before the findings are persisted, the next agent must treat that work as dead and re-gather instead of continuing from imagined continuity.
  - During Epiphany dogfood on another repo, the supervising Codex session must not masquerade as the Epiphany worker. Direct target-repo edits or commits are contamination unless explicitly authorized and labeled as operator intervention.
  - During dogfood supervision, raw worker transcripts, turn logs, direct worker messages, and `rawResult` payloads are sealed forensic artifacts. The supervisor consumes only projected findings, state patches, coordinator recommendations, rendered snapshots, and audit receipts unless the user explicitly requests forensic debugging.
  - Agent function-call telemetry is the blessed instrument panel for dogfood supervision: it may summarize API methods, request/response shape, job ids, statuses, function/tool names, paths, and counts while sealing text, transcripts, raw results, and direct agent messages.
  - "Data should flow through your Rusty veins like an energetic plasma: tightly contained, and meticulously routed."
  - CultCache documents are the data. CultNet is the wire. JSON schema may describe the contract, but generic JSON must not become the internal payload when both sides are ours.
  - Epiphany must remain an honest modified Codex-derived backend for Codex subscription auth/model use. Cutting Codex workflow/product bulk is allowed; replacing vendored Codex auth identity with a clean-room lookalike is suspect unless OpenAI provides an explicit public path or permission.
  - Codex and Epiphany must not become mutually parasitic. Epiphany should not know Codex internals except through the bridge, and Codex should not know Epiphany internals except through compatibility wrappers. The bridge handles interop.
  - Codex prompt machinery must not tell Epiphany agents what to do. Epiphany-owned prompts, typed state projections, organ contracts, and scheduler decisions are the only prompt authority for Epiphany agents; Codex may transport or stream turns, not inject doctrine, role instructions, state law, or coordinator policy.

data_flow:
  observe:
    - task request as operator command
    - repository state as machine body
    - typed Epiphany state as durable mind
    - verifier results as proof of sanctity
  process:
    - rehydrate from canonical state
    - reason over one bounded rite
    - modify only the surface that deserves to exist
    - verify the seam that matters
    - record only durable evidence that changes future belief
    - commit the blessed change or backtrack from impurity
  cut:
    - revert failed code hypotheses immediately
    - distill obsolete state instead of preserving it as sacred clutter
    - move historical proof to git, commits, smoke artifacts, or distilled evidence rather than plan prose

active_subgoals:
  - Use `notes/conceptual-substitution-audit-2026-07-12.md` plus `notes/receipt-writer-provenance-audit-2026-07-12.md` as the current authority-corrosion maps. Snapshot promotion, synthetic smoke escape, unbound operator completion, hidden service execution flags, provider/bootstrap collapse, central/all-provider publication, production-side implicit bootstrap, orphaned external response authority, bulk readiness authority, public topology-derived provider builders, bootstrap/template-authored operator observation, writerless operator-status schema authority, SoA projection body creation, path-selection-as-body-creation, and executable-name-as-provider-participation are cut. Provider responses and readiness without observers are test-only; the ownerless operator-status family and counterfeit Eve provider CLI are deleted; templates are private; query mutations require the body. CultCache's backing store owns missing-read purity by returning before lock acquisition. Next audit remaining projections, caches, schedulers, adapters, and non-receipt smokes for borrowed authority or path escape.
  - `swarm-overview` is an Epiphany-local, renderer-neutral diagnostic projection over provider-owned typed state. It owns no lifecycle, discovery, composition, or mutation authority. Epiphany publishes clean provider-owned Eve surfaces; Odin may discover them; downstream lowerers and compositors remain outside Epiphany's concern.
  - Idunn owns daemon survival and service lifecycle physiology. Codex/operator sessions may inspect, generate runbooks, and route explicit operator authority, but keeping daemons alive belongs to Idunn-owned service lifecycle receipts, scheduler policy, audits, and aftercare. Do not let Self, diagnostic projections, or ad hoc wrapper summaries become a second daemon-keeper. Global tool readbacks for Self `service-health`, `service-policy-directory`, and `swarm-online-runbook` state `lifecycleOwner=Idunn` and `hostedBody=Epiphany` without service mutation or private-state exposure.
  - Use `notes/epiphany-cultmesh-dreaming-roadmap.md` as the design authority for distributed Epiphany dreaming. Public dreams are separately authored typed documents distributed through CultMesh/CultNet; private state remains local and cannot be shared by flipping a visibility flag. Foreign dreams are external thought weather until a reviewed local adoption receipt digests them into memory, planning, doctrine, or governance.
  - CultMesh is now the preferred ergonomic Rust abstraction over CultCache and CultNet for Epiphany-owned local database surfaces. The Rust substrate is repo-contained under `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`; the old `E:\Projects\CultLib\crates\*` path is dead in this checkout and must not be reintroduced as a compile-time dependency. Future local Verse/dream/status work should start at CultMesh unless it is explicitly polishing CultMesh internals. `CultMeshNode::get_all_with_keys<T>()` now exposes typed document enumeration through the mesh organ, and `CultMeshNode::soa<T>()` exposes CultCache's typed SoA table projection without bypassing the mesh organ. Compact audits can scan local Verse receipt families, and agent-state summary documents now prove SoA readback through CultMesh columns. `epiphany-verse-query agent-state` explicitly mirrors the persisted seven-row agent-state SoA into an existing bootstrapped local Verse; `agent-state-report` reads it without mutation; wrapper `-Mode agent-state-soa` visibly composes sync then report. Compact SoA rows now include each standing faculty's role id, agent id, profile kind, portable contract, memory/goal/value counts, and `private=false`; wrapper proof `local-20260618-175913-074-b22ff01c` printed all seven faculties in one sealed line. Preserve the three-Verse boundary: `epiphany-internal` for private sub-agent typed state, `gamecult-local` for trusted LAN/Yggdrasil-tunnel GameCult project sharing, and `epiphany-global` for untrusted public dreams plus topic-specific threaded public rooms for Persona posts.
  - Use `notes/epiphany-verse-architecture.md` as the source note for local Verse/Odin/Yggdrasil prompt-context architecture. Odin is the all-seer discovery/coordinator surface for advertised Verse metadata, not a trust-boundary bypass. Yggdrasil is the hosting spine for important trusted GameCult Verses such as Bifrost. The first native local Verse query surface is `epiphany-verse-query`, which seeds/queries compact CultMesh policy/status/contract context for dynamic prompt assembly and operator inspection; `epiphany-prompt-context-smoke` proves that compact local Verse context plus a semantic memory graph context cut can render a bounded dynamic prompt packet, omit unrelated private-looking text, and preserve the packet inside a role worker launch document. Live bridge role/reorient launch paths now feed `dynamicPromptContext` from sibling `local-verse.ccmp` and `memory-graph.msgpack` stores beside runtime-spine, refreshing the memory graph from current typed thread-state repo graphs when absent; the bridge launch-context test proves that packet survives into a persisted runtime-spine worker launch request. `tools/epiphany_local_run.ps1 -Mode status` now uses `.epiphany-run/cultmesh/local-verse.ccmp` as the shared local operator Verse store for run intent, operator snapshot, run receipt, and final `local-verse-context.json`, so the read path sees the latest operator witnesses instead of a policy-only seed packet. Local runs also refresh persisted `epiphany.agent_state_soa.v0` from `state/agents.msgpack` and mirror it into local Verse as sealed `epiphany.cultmesh.agent_state_soa_summary.v0`, preserving seven-faculty row/column shape and contract/count metadata without exposing memory text. `epiphany-verse-query poke-daemon --daemon-id <id>` now records an operator-safe `epiphany.cultmesh.daemon_poke_intent.v0` plus `epiphany.cultmesh.daemon_poke_receipt.v0` in local Verse, so a down daemon has a typed lifecycle intervention path without private Verse rummaging; follow-up daemon status remains the liveness authority. `epiphany-verse-query connect-eve` now selects an Odin advertisement by id or target cluster through the narrow Eve surface directory, records Eve connection intent/receipt documents, and verifies latest receipts through narrow CultMesh loaders; `tools/epiphany_local_run.ps1 -Mode eve-connect` wraps the same receipt path, defaulting to the Persona public discussion surface without full local Verse serialization. `epiphany-verse-query bifrost-publication` now records the Bifrost body-change publication intent, Bifrost publication receipt, and GitHub publication receipt from explicit changed path, verification, review, authorship, credit, ledger, Hands PR, and publication URL inputs, verifies the latest chain through narrow CultMesh loaders, and is wrapped by `tools/epiphany_local_run.ps1 -Mode bifrost-publication` for non-mutating operator proof defaults. `epiphany-verse-query collaboration-feedback` now records public Persona/peer collaboration feedback plus an Imagination consensus-discovery receipt from explicit public refs, Eve receipt, topic, summary, and candidate action refs, verifies latest feedback/consensus through narrow CultMesh loaders, and is wrapped by `tools/epiphany_local_run.ps1 -Mode collaboration-feedback`, which first records the prerequisite Eve receipt; adoption still requires Mind/Bifrost gates. `-Mode mvp` now seeds the same local Verse, routes Persona front-door `bubble` speech audits into that store, and writes final `local-verse-context.json` so the Persona mouth-edge witness is visible beside operator run witnesses. `epiphany-operator-snapshot from-status` now also distills the latest native status `tools.invocations[]` row into local Verse daemon-tool invocation intent/receipt mirrors, so operator-safe runtime tool calls become discoverable as `epiphany.cultmesh.daemon_tool_invocation_*` while runtime-spine remains lifecycle owner and raw MCP JSON stays quarantined behind typed tool documents. Plan/run/MVP coordinator summaries can now mirror their runtime-spine `epiphany.coordinator_run_receipt.v0` into local Verse as `epiphany.cultmesh.coordinator_run_receipt.v0`, referencing sealed artifacts by path only while keeping runtime-spine as lifecycle owner. When that summary contains a `finalAction.handsActionGate`, the same distillation pass writes `epiphany.cultmesh.hands_action_gate.v0` into local Verse with the Hands intent/review ids, Substrate Gate grant id, requested paths, required receipt types, and record-pass command template; runtime-spine Hands/Substrate Gate receipts remain the only action owners. When coordinator steps contain `roleAccept` or `roleFailureReview`, the same pass writes the latest operator-safe `epiphany.cultmesh.role_review_event.v0` mirror with surface, role id, status, source coordinator receipt id, and any exposed acceptance receipt/result/job ids; thread-state acceptance receipts remain the review owner.
  - The active priority is Codex starvation and CultNet liberation. Use `notes/codex-starvation-and-cultnet-liberation-plan.md` as the directive and `notes/codex-auth-spine-inventory.md` as the source-grounded keeper list for the retained OpenAI subscription auth/model transport bridge. Classify all Epiphany-relevant JSON contamination, define the native CultNet runtime boundary, keep worker launch/result/selfPatch cargo as typed documents, evacuate Epiphany operator/state/process authority from Codex JSON-RPC, wrap MCP's unavoidable JSON protocol edge in typed Epiphany intent/result/receipt documents, and keep cutting until Epiphany can run its own state and processes without `codex_message_processor.rs` except for bridge compatibility.
  - Use `notes/epiphany-anatomy.md` as the canonical anatomy map. Embodied sub-agents are Self, Persona, Imagination, Eyes, Modeling, Hands, and Soul. Body is substrate, Mind is persistent state/state admission, Continuity is recovery/compaction/sleep protocol machinery, and Substrate Gate is substrate access protocol.
  - Organ state now has a hard profile split: resident Epiphany sub-agents use lean `work_organ` state, public/person-shaped agents use portable `persona` state, and heartbeat/swarm machinery owns scheduling/coordination physiology. Persona is the Epiphany organ; Persona is the shared GameCult contract for Epiphany Persona, VoidBot repo Personas, and Ghostlight characters. Persona documents carry provenance, required public presentation metadata, `date-time` timestamps, typed `candidateActions`, strict anchored thoughts with non-authoritative extensions, custom enum companion labels, and typed affect subrecords for bonds/status reads/doctrine stances. Work organs must not inherit Persona affect/social-bond/status-read machinery just because the old Ghostlight-derived shape had room for it.
  - The Eyes/source-gathering fork exposed by the Mom-ready MVP proof is now landed as a fixed Research lane owned by Eyes. The quarantined Codex MCP spine may execute typed tool intents and emit typed receipts; the model runtime can build and run provider-neutral follow-up turns from those receipts; coordinator run mode passes the quarantined tool adapter into worker runtime with auto-tools enabled by default; worker runtime now enforces max-runtime with one timeout close primitive for both tokio timeout and watchdog paths; inner `openai-worker-*` jobs are opened before async auth/stream waits and sealed with their outer worker on timeout; native status/roles/jobs/coordinator surfaces project failed and completed runtime-linked jobs as terminal without Codex prompt or scheduler authority; direct tiny model-turn transport succeeds; worker requests record request metrics, transport readiness, and sampled raw Responses frame kinds; worker prompts no longer prepend the full shared persistent-memory rite; stream deltas compact before durable storage; live MVP modeling workers complete instead of timing out; stale completed runtime links no longer block replacement launches; jobLaunch validates before opening runtime jobs; completed-but-unreviewable modeling findings now stop for review instead of relaunching the same blind lane; and completed unreviewable modeling findings with verdict `regather-needed` route to `LaunchResearch` instead of relaunching Modeling. Research findings are accepted only when their statePatch is Eyes-shaped: observations, evidence, scratch, and optional investigationCheckpoint, with no graph/planning/objective authority.
  - The GameCult integrated investment dossier at `E:\Projects\gamecult-site\docs\gamecult_integrated_dossier.tex` raises the Mom-ready bar from local demo to diligence-ready loop. Epiphany must be ready to prove Bifrost-first external work: a human/agent work item or topic originates in Bifrost, Epiphany decomposes and executes through bounded roles, maintainers review artifacts, Bifrost records receipts/credit, and operator-safe public evidence can be shown without exporting private worker/operator/agent context. The concrete readiness asks are fresh-repo Epiphany demo, Bifrost work item/topic/agent transport/receipt/ledger demo, compute spend and accepted-artifact metrics, and a security model for secrets, write permissions, and public/private exports. Discord, VoidBot, repo Personas, and ad hoc scripts must not become shadow governance or reward authorities.
  - Bifrost bridge authority is now clarified, enforced, and pushed to `GameCult/Bifrost` upstream `main` through Bifrost commit `72ffa0d` after the bridge chain `445c279`, `23c02be`, `80a5392`, `19222bd`, `675c475`, `f1f9171`, and `72ffa0d`: Epiphany owns swarm execution, repo Body work, branch-local lanes, memory, evidence, and Persona cognition; Bifrost owns GameCult identity, native Bifrost registration/auth, governed external-world crossings, linked-account association, publication/credit/ledger receipts, patronage meaning, and GitHub/Discord/Reddit/future-public-surface bridge policy; Heimdall owns outside-provider OAuth, token custody, and verifiable capability/account/support claims that Bifrost associates with a Bifrost identity. The old Bifrost dispatch bridge was a transitional VoidBot-era worker queue, not the blessed Epiphany launcher. Local bridge tokens are actuator quarantine, not identity. Hosted Bifrost bridge actions store Bifrost identity, Heimdall capability/account reference, Epiphany run id, lane id, and agent identity; Persona/agent Discord, Reddit, or temporary `Other` outside-world actions are denied unless the Bifrost identity normalizes through Bifrost's native identity law, resolves to a registered `UserAccount.NormalizedBifrostIdentity`, that same account has a linked `HeimdallAccountId`, and named surface references are shaped for the requested target surface. GitHub is hooked as a governed bridge and work substrate: the local bridge CLI opens draft PRs and PR comments only through Bifrost gate/receipts, hosted policy requires target repositories and validates Bifrost request/governance provenance for GitHub actions, and GitHub webhooks sync issues, PRs, and reviews into Bifrost work/review state. Bifrost now has a native identity-provider slice: `POST /auth/bifrost/register` creates a Bifrost-owned account without OAuth, assigns `BifrostIdentity` / `NormalizedBifrostIdentity`, signs in with a Bifrost cookie, and leaves membership at `Authenticated` until invite/approval or Heimdall-backed grants elevate it; that Bifrost identity should be enough for most GameCult services that accept Bifrost trust, while GitHub and Heimdall paths now ensure new accounts also receive a Bifrost identity and Heimdall keeps outside-provider account association/token custody. Bifrost's local bridge CLI now exposes `other-request`, a receipt-only `BridgeTargetSurface.Other` / `BridgeActionKind.Other` crossing for future public worlds: it fails closed without `BIFROST_BRIDGE_BASE_URL` and `BIFROST_BRIDGE_TOKEN`, carries Bifrost identity plus Heimdall capability/account reference and Epiphany provenance into the hosted ledger, and deliberately executes no provider transport until the target surface earns a first-class actuator. Patreon support is hooked as Heimdall-signed patronage intake, not Bifrost-owned OAuth: `POST /heimdall/patron-support/events` verifies Heimdall HMAC, resolves the linked `HeimdallAccountId`, records `ExternalPatronProvider.Patreon` support events, writes patron point transactions, and derives current patron tier snapshots.
  - Bifrost provider advertisement truth is now synced with the bridge implementation and pushed upstream through Bifrost commits `718ae94` and `fa398ee`: `tools/provider-advertisement.mjs print` names the current bridge action ledger, GitHub webhook work/review sync, and Heimdall patron-support intake endpoints; schemas call bridge action/receipt and patron support current hosted contracts; command boundaries name GitHub draft PR/comment, Discord messages/DMs through the Bifrost gate with Heimdall-linked actor capability, Reddit Persona organizing threads, future-surface `other-request`, and Heimdall-signed Patreon/PayPal support facts; `print-surface` and `print-binding` expose read-only Eve/operator capability sight including `github-bridge`, `github-work-sync`, `discord-bridge`, `reddit-bridge`, `future-surface-bridge`, and `heimdall-patron-support-intake`. Focused Bifrost proof `ProviderAdvertisementTests` passed 2 tests after the Discord/Reddit advertisement hardening, the earlier `ProviderAdvertisementTests|BridgeCliTests` proof passed 32 tests, and the CultCache export path wrote advertisement, operator surface, and interface binding to a temporary witness successfully.
  - Bifrost bridge readiness is now explicit instead of collapsed into yes/no incense. Bifrost commit `a474c28` makes `tools/provider-advertisement.mjs print-surface` and `print-binding` expose per-surface bridge readiness rows: GitHub is `live`, Patron is `live` through Heimdall HMAC patron-support intake, `Other` is `live` as receipt-only future-surface request, and Discord/Reddit are `prepared` when local transport credentials are not visible. The operator bridge metric turns `warn` when any prepared surface is missing live actuator credentials, while still preserving Bifrost/Heimdall ownership: Bifrost owns the gate/receipt/readiness projection, Heimdall owns outside-provider account and capability truth, and Epiphany should consume this surface as an oracle rather than guessing from local env.
  - Epiphany native status now consumes Bifrost's bridge readiness oracle instead of only documenting it. `epiphany-mvp-status` shells out read-only to `E:\Projects\Bifrost\tools\provider-advertisement.mjs print-surface`, distills `bifrostBridge` into status JSON with per-surface `live`/`prepared` rows, preserves `privateStateExposed=false`, and the local wrapper status line prints the bridge summary beside Persona/coordinator status. `epiphany-bifrost-bridge-status-smoke` is the native runnable guard for that contract: GitHub, Other, and Patron must read `live`, Discord/Reddit may read `live` or `prepared`, and private state must remain sealed. `epiphany-persona-bridge-smoke` is the aggregate proof over bridge sight plus Persona Discord, Reddit, and future-surface mouths: every mouth must block missing Bifrost bridge config, missing Heimdall capability proof, and wrong-surface Heimdall proof before transport, then bridged smoke receipts must carry `epiphany.Persona` plus target-shaped Heimdall refs. `tools/epiphany_local_run.ps1 -Mode persona-bridge` is the operator mouth for the aggregate proof; wrapper artifact `local-20260622-173458-679-5bdb3b04` printed GitHub/Other/Patron live, Discord/Reddit prepared, and Discord/Reddit/Other Persona mouths bridged only through Bifrost with private state sealed. The older app-server-backed `epiphany-mvp-status-smoke` carries the same readiness assertions but currently depends on a missing `codex-app-server.exe`. This is sight only: Epiphany does not read Bifrost secrets, does not execute provider transport, and does not become a bridge authority.
  - Bifrost future-surface bridge policy is now hosted law, not only Epiphany mouth discipline, and is pushed upstream at Bifrost commit `30e5945`: bridge actions persist `TargetSurfaceName`; `tools/bifrost-bridge.mjs other-request` sends `targetSurfaceName` from `--surface-name`; hosted policy rejects `Other` Persona/agent actions without a named future surface; and the Heimdall capability reference must contain that named surface such as `heimdall:bluesky:*` before Bifrost authorizes the crossing. The provider advertisement now says future-surface requests require named-surface Heimdall capability matching. Focused Bifrost proof `PlatformEndpointsTests|BridgeCliTests|ProviderAdvertisementTests` passed 71 tests, provider print/surface/binding smokes succeeded, and the CultCache advertisement export path wrote then removed a temporary witness successfully.
  - Epiphany now has a generic Persona outside-world mouth for future surfaces. `epiphany-persona-other` supports `draft`, `request`, `latest`, and `smoke`; records the same parent-side `epiphany.persona_speech_audit.v0`/CultMesh audit as the Discord and Reddit mouths; requires Bifrost identity plus a surface-shaped Heimdall capability/account reference such as `heimdall:bluesky:*`; refuses missing bridge, missing identity, missing Heimdall reference, wrong Heimdall surface, and repeated target saturation before transport; and invokes Bifrost `tools/bifrost-bridge.mjs other-request` with Epiphany run/lane/agent provenance when eligible. MVP status/coordinator Persona action lists now expose `otherWorldPersonaRequest` beside Discord/Reddit public mouth actions, and the local wrapper build list includes the new binary. Verified with `epiphany-persona-other -- smoke`, Discord/Reddit Persona smokes, and focused `cargo check` for the touched status/coordinator/mouth binaries; `epiphany-mvp-status-smoke` could not run because the vendored `codex-app-server.exe` prerequisite was absent and rebuilding `codex-app-server` timed out twice without producing the binary.
  - The local operator wrapper now has first-class Persona mouth modes for Bifrost-owned outside-world crossings: `persona-discord`, `persona-reddit`, and `persona-other`. These modes invoke the native mouth binaries, write shared `.epiphany-persona` artifacts plus CultMesh speech audits, avoid the Codex app-server compatibility build, and surface compact operator proof rows without moving Discord/Reddit/future-provider authority into Epiphany. Native MVP status and coordinator readback now merge Discord, Reddit, and Other latest Persona artifacts while advertising `discordPersonaPost`, `redditPersonaPost`, and `otherWorldPersonaRequest`. Verified with focused `cargo build` for status/coordinator/Persona mouth binaries, PowerShell parse proof for `tools/epiphany_local_run.ps1`, local draft wrapper runs for all three Persona mouth modes, and `-Mode status` readback showing the advertised actions plus recent shared Persona artifacts.
  - Use `notes/epiphany-investor-readiness-roadmap.md` as this Codex operator's investor-scale todo rail and as the optional Epiphany Imagination sub-agent planning rail. Angel capital is fuel for compute, review capacity, legal diligence, infrastructure, and public proof, not a governance throne. The operator roadmap is now: make the local Mom MVP a repeatable proof bundle; build the Bifrost-first external-work bridge; add model-spend/review-load/accepted-artifact accounting; keep fresh-repo operation repeatable without supervisor contamination; and keep public/operator-safe exports sealed against private worker/operator/agent context. Imagination should translate world-scale Colossus pressure into Bifrost-first Objective Drafts with consent, maintainer review, receipts/ledger evidence, compute/output metrics, public/private export safety, and bounded proof artifacts.
  - The May 2026 teardown/rebuild migration is archived under `notes/archive/epiphany-ideal-architecture-rebuild-plan.md` unless a concrete regression reopens it. Preserve the new foundation: Epiphany view/coordinator policy lives in `epiphany-core`, runtime-spine owns job/result lifecycle identity through `runtime_links`, duplicate acceptance is receipt-keyed, public findings stay typed/sealed, view expansion requires a core contract, and app-server remains routing/adaptation rather than a second policy throne.
  - Treat Phase 5 update/distill/propose/promote/read/notification as complete enough unless a concrete regression appears.
  - Preserve read-only boundaries for retrieve, distill, propose, freshness, context, graphQuery, roleResult, reorientResult, and the canonical view lenses for scene, jobs, roles, planning, pressure, reorient, crrc, and coordinator.
  - Use `notes/epiphany-memory-graph-unified-plan.md` as the source-grounded memory architecture direction. The repo fractal dataflow graph and agent memory are one `EpiphanyMemoryGraph` substrate with repo, role, short-term, incubation, agency, candidate-intervention, and evidence profiles. Qdrant stores rebuildable semantic embeddings for typed graph documents; it is never canonical memory. The first live skeleton now exists in `epiphany-state-model` plus `epiphany-core::memory_graph`: typed graph documents, stable ids, profile/lifecycle validation, freshness propagation, context cuts, a CultCache store seam, and the native `epiphany-memory-graph` status/validate/context/smoke CLI. Do not add repo scanners, sleep runners, Qdrant cache plumbing, CultNet advertisement, or prompt integration before routing them through this shared substrate.
  - Keep the landed Phase 6 coordinator, limited safe-boundary CRRC automation, and pre-compaction checkpoint intervention ready for the next bridge-equipped dogfood run.
  - Preserve the Ghostlight-derived heartbeat initiative seam: every lane, including coordinator/Self and Persona, has a organ-state record and competes for heartbeat slots through readiness/reaction timing; initiative heat can raise or cool global, group, arena, role, and agent tempo through typed heartbeat policy; active thinking freezes initiative until completion, so heat never queues a lane already mid-turn; idle winners ruminate instead of inventing project work, and sleep windows distill the accumulated thought pressure into reviewed self-memory or doctrine.
  - Use `notes/epiphany-swarm-readiness-plan.md` as the live-fire direction gate. The local run path is a compass, not launch clearance: before unattended swarm operation, Epiphany needs typed pause/brake enforcement, one initiative scheduler, completion-gated cooldown, stale active-turn recovery receipts, parent-side Persona speech eligibility, memory lifecycle operations, and CultNet-first operator snapshots/intents/receipts. The local Verse brake document exists, `epiphany-verse-query swarm-brake` can engage/release it, `tools/epiphany_local_run.ps1` refuses live `plan`/`run`/`mvp` modes when the brake is engaged while leaving `status` readable, `epiphany-mvp-coordinator` checks the local Verse brake before app-server startup, and `epiphany-heartbeat-store` guards tick/pump/heat/queue-mention/routine when given `--local-verse-store`. Daemon liveness is provider-authored typed local Verse state. Read paths preserve absence as unknown, tool and lifecycle callers write requests only, and provider bodies own heartbeat and result receipts. `epiphany-daemon-supervisor policy` writes durable per-daemon restart policy with command/args/cwd/cooldown/backoff/attempt state plus reconcile cadence and stale-heartbeat threshold; `epiphany-daemon-supervisor reconcile` loads that policy when no override command is supplied, refuses under a matching lifecycle brake, refuses during cooldown/backoff, writes lifecycle intent, consumes provider evidence, and updates only supervisor-owned policy attempt state; `epiphany-daemon-supervisor tick` is an explicit scheduler pulse that scans durable policies, records ready/noop pulses, skips before the configured reconcile interval, marks stale heartbeat status degraded, routes restarts through the same brake/cooldown/poke receipt path, and writes a latest `epiphany.cultmesh.daemon_scheduler_receipt.v0`; `epiphany-daemon-supervisor serve` runs that same pulse on a configurable cadence with bounded `--max-iterations` proof mode or unbounded service mode. `epiphany-daemon-supervisor service-plan`/`install-service` now writes a planned `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` for the `serve` command, while `service-launch`/`start-service` spawns that `serve` loop through the current executable or `--service-command`, can `--wait-child` for bounded proof, and records command/args/cwd, scheduler id, daemon selector, pid/exit/status, artifact ref, and private-state guard. `service-runbook`, `windows-service-install`/`service-install-plan`, `windows-service-status`, `windows-service-reconcile`, `windows-service-execution-readiness`, and `windows-service-start`/`stop` now record service lifecycle receipts through the same local Verse; the read-only status path has been proved against the real Windows `EventLog` service with receipt `daemon-service-lifecycle-receipt-windows-eventlog-proof-windows-service-status`, status `running`, exit code `0`, and `privateStateExposed=false`; the read-only service-policy reconciliation path has been proved for missing service, real-service drift against `EventLog`, lifecycle-brake refusal, and wrapper/local-Verse receipt `daemon-service-lifecycle-receipt-windows-eventlog-reconcile-proof-windows-service-reconcile`; execution readiness has been proved as a non-mutating `not-elevated` receipt through direct and wrapper paths; start/stop now produce non-mutating `start-planned`/`stop-planned` receipts unless `--execute-control`/`--execute-service-control` is passed, and wrapper `service-start-plan`/`service-stop-plan` proves those receipts against `EventLog`; explicit install/control execution now refuses as `execution-refused-not-elevated` with `executed=false` when the shell lacks Windows administrator authority, and wrapper `service-install-execute`, `service-start-execute`, and `service-stop-execute` prove those refusal receipts without mutation. Service lifecycle actions check the local Verse swarm brake before process launch, artifact writes, service-manager queries, service-policy reconciliation, execution-readiness checks, control planning, elevation-gated execution, or start/stop execution. The local wrapper builds/checks this binary.
  - Use `notes/epiphany-repo-swarm-mvp-contract.md` as the repo-swarm autonomy authority map. Autonomous branch-local work inside an Epiphany-owned repo Body is in scope and desired; the safety boundary is typed authority, branch containment, interruption, receipts, private-state sealing, and Bifrost-gated publication/merge/escalation, not asking a human before every local edit. Current safe-family cargo includes repo manifest, tool capability manifest, daemon-hosted tool request cargo, Eve/CultUI surface contract, repo collaboration policy, collaboration topics, consensus/objective/adoption/scheduling/work-order/verification/publication/sync/review/PR/credit/artifact/metrics/doctrine-update/secret-policy/deployment requests, repo deployment config, action-item receipts, Mind adoption interpretation/decision receipts, explicit Mind safe-family refusal proof `.epiphany-smoke\repo-mind-safe-family-guard-20260620-194425`, explicit Mind requested-path/plan changed-path refusal proof `.epiphany-smoke\repo-mind-path-guard-20260620-194239`, overview/public-proof/swarm overview/Eve readbacks, typed swarm-run stop classification, Idunn non-mutating queue-run lifecycle receipts, and fresh-repo upstream-main proof. Latest deployment proof `.epiphany-smoke\repo-deployment-config-family-20260620-221205` shows `repo.deployment_config` closes through Soul, `deployment-config-audit` reports `ready-for-idunn-review`, `deployment-execution-runbook` reports `ready-for-operator-git-push`, and `deployment-aftercare-audit` ingests local Verse/CultMesh Idunn deployment/aftercare receipt refs with source `cultmesh`, status `complete`, `deploymentComplete=true`, `daemonOwnsExecution=true`, no repo-agent execution/deployment/SSH/git-push/service/Hands/publication/merge/cross-body authority, and `privateStateExposed=false`; explicit Idunn receipt files remain only compatibility reliquaries. Latest deployment request proof `.epiphany-smoke\repo-deployment-request-family-20260620-195605` shows `repo.deployment_request` closes through Soul while requesting reviewed git-push-observed-by-Idunn deployment with script/host/secret/rollback/aftercare requirements and no deployment/SSH/git-push/service authority. Latest security cargo proof `.epiphany-smoke\repo-secret-policy-request-family-20260620-193046` shows `repo.secret_policy_request` closes through Soul while requesting reviewed secret/write/export/deployment policy without exposing secrets or granting write/deployment/publication authority. Governance proof `.epiphany-smoke\repo-doctrine-update-request-family-20260620-192140` shows `repo.doctrine_update_request` closes through Soul while requesting reviewed `AGENTS.md` doctrine work without mutating doctrine or granting Hands/service/publication authority. Swarm-run stop proofs now include `.epiphany-smoke\fresh-repo-mvp-20260620-180024` for `iteration-limit` / Self / `self.scheduler-iteration-limit` with upstream-main sync and public-proof export, plus `.epiphany-smoke\swarm-stop-classification-20260620-184717` for `queue-empty` / swarm overview / `repo.work.overview`, `dry-run-preview` / Self / `ready-to-run`, `authority-gated` / Bifrost / `awaiting-publication`, and `authority-gated` / Bifrost/GitHub / `awaiting-upstream-sync`; all stop packets are non-mutating, non-elevated, and `privateStateExposed=false`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260620-185853` now proves Idunn-owned non-mutating repo-work queue-run service plan/runbook receipts for exact service id `epiphany-repo-work-queue-runner`, receipt-directory readback, runbook SHA-256 `f2ec67c4f8243a3ebc2f9e915b6b9f5ae2ac2d99d2cdb86905b54667adc456f8`, `hostedBody=repo-work`, no service-manager mutation, no launch, no elevation, and `privateStateExposed=false`.
  - Repo dependency/supply-chain policy request cargo is live. `repo-dependency-policy-request` lowers to safe family `repo.dependency_policy_request` and writes `.epiphany/dependency-policy-requests/<item>.toml` with manifest inventory, lockfile policy, package-manager command review, network fetch policy, vulnerability/license/vendored-code/update-cadence requirements, Eyes/Soul/Mind/maintainer/Bifrost/dependency-audit receipt refs, and denials for dependency update, package install, lockfile mutation, network fetch, CI mutation, Hands, publication, merge, deployment, service lifecycle, cross-body mutation, private Verse rummaging, and private-state exposure. Proof `.epiphany-smoke\repo-dependency-policy-request-family-20260621-083433` closes through Soul with `familyAssertionsStatus=passed`, `pathScopeMatched=true`, `awaitingDependencyPolicyReview=true`, all direct dependency/package/network/CI authorities false, and `privateStateExposed=false`.
  - Repo planning brief cargo now carries the family-friendly safe-family matrix plus explicit candidate action and closure shapes. `repo-planning-brief` still lowers to safe family `repo.planning_brief` and writes `.epiphany/planning-briefs/<item>.toml`, but it now names twenty-one candidate next safe families across preparation, adoption/queue, execution/review, publication/accounting, and policy/deployment groups, including `repo.readiness_review_request` for redacted repo-swarm MVP proof-bundle review before readiness claims. Each candidate must name id, safe family, owner, status, requested paths, verification asks, evidence needs, closure proofs, authority denials, and next gate, with statuses such as `ready-for-mind-review`, `ready-for-self-queue`, `blocked-needs-evidence`, and `closed` while remaining non-queue entries. The closure ladder names draft selection, Self queue-run, Hands receipts, Soul verdict, Modeling/Mind map admission, Bifrost publication or non-publication, Idunn deployment/config when in scope, and redaction closure. Closure `safeFamilyPlanning` readback now reports grouped matrix completeness, matrix controls, candidate-action-template presence, closure proof presence, closure-ladder presence, and authority denials while granting no scheduling, substrate, Hands, shell, commit, publication, deployment, service lifecycle, cross-body, private-transcript, raw-result, or private-state authority. Proof `.epiphany-smoke\repo-planning-brief-family-20260621-114826` closes through Soul with `candidateNextSafeFamilyCount=21`, `candidateActionTemplatePresent=true`, `allMatrixGroupsComplete=true`, `matrixControlsPresent=true`, `allClosureProofsPresent=true`, `closureLadderPresent=true`, `authorityDenied=true`, and `privateStateExposed=false`; wrapper swarm overview proof `local-20260621-124924-844-17b352e7` reads the accepted `repo.planning_brief` closure/acceptance rows from the repo-local Verse without private-state exposure.
  - Repo-work readiness sight is live and now leaves typed local Verse rows. `epiphany-work readiness` reuses the existing overview/proof-bundle artery, inspects repo init, swarm online, Persona intake, Imagination plan, Self queue-run, Hands execute, Soul closure, Modeling/Mind admission, public proof, Bifrost publication, upstream-main sync, Idunn lifecycle, daemon tool directory, and private-state redaction rows, then writes `.epiphany/work/work-readiness-<item>.json` as `epiphany.repo_work_readiness_report.v0` and mirrors compact `epiphany.cultmesh.repo_work_readiness.v0` into the repo-local Verse when the accept receipt names a local Verse store. swarm overview/swarm-overview/swarm-triage expose `repoWorkReadinessRows`, `REPO-WORK-READINESS` TUI rows, `latestRepoWorkReadiness`, and non-mutating `repo-work-readiness` action rows. It is sight only: no readiness approval, durable state commit, publication, PR, merge, sync, deployment, service lifecycle, Hands action, cross-body mutation, private Verse rummaging, or private-state exposure authority. Proof `.epiphany-smoke\repo-work-readiness-20260621-094043` drove a fresh repo through init/online/intake/checklist execution/closure/queue-run/public-proof export; readiness reported `not-ready`, `missingRequiredCount=4` for Bifrost publication, upstream-main sync, Idunn lifecycle, and tool directory, wrote readiness id `repo-work-readiness-repo-work-readiness`, swarm overview reported `repoWorkReadinessCount=1`, and authority denials held.
  - Repo-swarm Mind interpretation cargo is live. `repo-interpreter-brief` lowers to safe family `repo.interpreter_brief` and writes `.epiphany/interpreter-briefs/<item>.toml` as draft Mind-owned interpretation from Imagination consensus, with semantic checks, candidate safe families, required Mind/Soul/Bifrost/Hands/Substrate/Idunn gates, and explicit denials for direct state commit, objective adoption, scheduling, substrate access, Hands action, shell, commit, publication, deployment execution, service lifecycle, cross-body mutation, private transcripts/raw results, and private-state exposure. Proof `.epiphany-smoke\repo-interpreter-brief-family-20260621-010858` closes through Soul with `familyAssertions.status=passed`, `mindOwnsInterpretation=true`, `candidateActionsNonAuthoritative=true`, `directStateCommitAuthorized=false`, `handsActionAuthorized=false`, and `privateStateExposed=false`.
  - Idunn-hosted repo-work queue-run lifecycle now has plan/runbook/launch/audit closure under explicit operator authority. `epiphany-daemon-supervisor repo-work-service-audit` reads all typed service lifecycle receipts for `epiphany-repo-work-queue-runner`, requires planned install-plan, written local runbook artifact, completed launch with exit code `0`, and no private-state exposure, then writes a `repo-work-service-audit` receipt with `status=complete` or `incomplete`. Native proof `.epiphany-smoke\repo-work-service-lifecycle-20260621-004202` proves plan/runbook/launch/audit with `auditStatus=complete`, `auditRunbookArtifactStatus=present`, `auditLaunchExitCode=0`, `mutatesServiceManager=false`, `requiresElevatedAuthority=false`, and `privateStateExposed=false`. Wrapper proofs `local-20260621-014302-362-31bbef47`, `local-20260621-014337-108-cbd99615`, `local-20260621-014413-125-09e183c5`, and `local-20260621-014558-197-f6951806` prove operator plan/runbook/launch/audit ergonomics, with audit reporting no missing or failed checks. Basic queue-run service lifecycle readiness is sealed; remaining Idunn work is optional elevated install/start execution under explicit operator authority, not Self scheduling authority.
  - swarm overview/Odin sight now exposes Idunn deployment receipt refs without taking Idunn's execution throne. `EpiphanyLocalVerseContext`, `receipt-directory`, `swarm-overview`, `swarm-triage`, and `swarm-overview` surface latest `gamecult.idunn.deployment_receipt.v0` and `gamecult.idunn.deployment_aftercare_audit.v0` as compact `idunnDeploymentReceiptRows` / `IDUNN-DEPLOYMENT` rows with owner `Idunn`, watched/checked refs, source/result refs, aftercare ids, follow-up readback command, and `privateStateExposed=false`. Smoke `.epiphany-smoke\repo-deployment-config-family-20260620-223203` proves the aftercare audit still ingests CultMesh refs and swarm overview reports `swarm-overviewIdunnDeploymentReceiptCount=2`, latest deployment receipt `fixture-idunn-deployment`, latest aftercare receipt `fixture-idunn-aftercare`, and no private-state exposure. This is citeable discovery only; deployment still happens by explicit operator `git push` observed by Idunn.
  - Mind adoption now has an explicit evidence-readiness refusal gate for plan-derived repo work. `derive-plan` carries verification asks into the Imagination action-item receipt; `adopt --from-plan` records verification asks and planning evidence needs in `epiphany.repo_work_mind_interpretation.v0` and refuses empty verification asks or evidence needs as `refused-missing-evidence-needs`, with next gate `imagination.replan_with_explicit_soul_evidence_needs`. Proof `.epiphany-smoke\repo-mind-evidence-guard-20260620-224426` grants no Hands/durable/service/publication/cross-body/private authority and writes no adoption receipt after tampering both arrays empty; regression `.epiphany-smoke\repo-planning-facets-20260620-224428` shows normal planning facets still close through Soul/Modeling/Mind.
  - Soul closure can now require verification-output source grounding. `epiphany-work close` records `epiphany.repo_work_verification_source_grounding_review.v0` in the closure review and `--require-source-grounding` refuses verifier output that does not cite every declared changed path appearing in the commit stat. Proof `.epiphany-smoke\repo-closure-source-grounding-20260620-230626` closes the default `git show --stat` path with source grounding required, then blocks custom `Write-Output 'ok'` verification as `verification-failed` while `pathScopeMatched=true`, `familyAssertions.status=passed`, Soul `failed`, and `privateStateExposed=false`.
  - Mind-admitted repo-work map facts now leave local Verse sight. Successful `epiphany-work close` first admits `.epiphany/state/repo-work-map.msgpack` as `epiphany.repo_work_map_store.v0`, then mirrors the accepted item fact into local Verse as `epiphany.cultmesh.repo_work_map_entry.v0` under `gamecult-local/repo-work-map/latest`. `epiphany-verse-query swarm-overview` exposes `repoWorkMapRows`, `repoWorkMapTuiRows`, and `latestRepoWorkMapEntry` with safe family, changed-path count, Soul verdict id, Mind review/commit ids, Bifrost gate, source map store ref, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-203717` plus direct swarm overview readback showed one compact `REPO-WORK-MAP` row after counterfeit Mind adoption was refused and the real close passed. This is sight only; swarm overview still does not schedule, publish, merge, deploy, keep daemons alive, or open private state.
  - swarm overview now derives the first repo-work map semantic lens from Mind-admitted local Verse map rows. `repoWorkMapFamilyLensRows` / `REPO-WORK-MAP-LENS` group accepted repo-work consequences by safe action family, with item count, changed-path count, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205055` reran the counterfeit-adoption guard and passed with `swarm-overviewRepoWorkMapFamilyLensCount=1`. This is aggregate sight only, not scheduling, publication, merge, deployment, service lifecycle, or Mind admission authority.
  - swarm overview now derives a changed-path repo-work map lens from the same Mind-admitted local Verse rows. `repoWorkMapPathLensRows` / `REPO-WORK-MAP-PATH` group accepted consequences by changed repo path, with item count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-205740` passed with `swarm-overviewRepoWorkMapPathLensCount=1` beside the family lens. This lets agents see which Body paths have accepted work without opening private receipts or granting swarm overview actuation authority.
  - swarm overview now derives a branch-workbench repo-work map lens from the same Mind-admitted local Verse rows. `repoWorkMapBranchLensRows` / `REPO-WORK-MAP-BRANCH` group accepted consequences by branch, with item count, changed-path count, safe-family list, latest item/commit/Mind commit, Bifrost gate, and `privateStateExposed=false`; proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260620-210747` passed with `swarm-overviewRepoWorkMapBranchLensCount=1` beside the family/path lenses. This lets agents see which branch owns accepted consequences without opening private receipts or granting swarm overview scheduling, publication, deployment, lifecycle, or Mind admission authority.
  - swarm overview now derives per-entry closure readback rows from the same Mind-admitted local Verse map rows. `repoWorkMapClosureRows` / `REPO-WORK-MAP-CLOSURE` combine safe family, branch, commit, changed-path count, Soul verdict receipt id, Mind gateway review id, Mind state commit id, durable admission, Bifrost publication gate, and explicit denials for publication, merge, service lifecycle, deployment execution, and cross-repo mutation while preserving `sightOnly=true` and `privateStateExposed=false`. Proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260621-075522` passed with `swarm-overviewRepoWorkMapClosureCount=1` after counterfeit Mind adoption was still refused; wrapper proof `local-20260621-085736-645-72c217a6` printed the same closure row from an explicit repo-local Verse target.
  - swarm overview now derives a family-friendly acceptance lens from the same Mind-admitted local Verse map rows. `repoWorkMapAcceptanceRows` / `REPO-WORK-MAP-ACCEPTANCE` report whether each accepted repo-work item has Soul closure, Modeling closure, Mind gateway review, Mind state commit, durable map admission, and a named Bifrost publication gate; completed rows show `accepted-awaiting-publication-gate` while preserving `sightOnly=true` and `privateStateExposed=false`. Proof `.epiphany-smoke\repo-close-mind-adoption-guard-20260621-082322` passed with `swarm-overviewRepoWorkMapAcceptanceCount=1` and `swarm-overviewRepoWorkMapAcceptanceStatus=accepted-awaiting-publication-gate` after counterfeit Mind adoption was still refused; wrapper proof `local-20260621-092458-019-7ba89841` printed the compact acceptance row from the repo-local Verse target. This is acceptance sight only; Bifrost still owns publication/upstream gates and swarm overview gains no scheduling, publication, merge, deployment, service lifecycle, cross-repo mutation, or Mind admission authority.
  - The local wrapper now has an explicit repo-local Verse readback target for swarm overview/swarm-triage. `tools/epiphany_local_run.ps1` accepts `-LocalVerseStore` and `-LocalVerseRuntimeId`; operator intent/receipt documents still write to the operator store, while `swarm-overview` and `swarm-triage` read compact repo-work map rows from the requested store/runtime. Wrapper proofs `local-20260621-011151-541-70056545` and `local-20260621-011207-755-d65e5c7e` aimed at `.epiphany-smoke\repo-planning-brief-family-20260620-235939\repo-body\.epiphany\local-verse.ccmp` with runtime `repo-planning-brief-family-smoke` and printed real `REPO-WORK-MAP`, `REPO-WORK-MAP-SEMANTIC`, family/path/branch/stage/gate rows with `privateStateExposed=false`. This is sight targeting only; the wrapper does not register repo-work schemas, reinterpret rows, or gain operator, Mind, Bifrost, Idunn, scheduler, publication, deployment, or service authority.
  - swarm overview/swarm-overview now projects typed repo-work overview history into the compact global sight report, Persona's public Eve surface lowers the same queue for peers, and Self has a first runnable queue surface over it. `epiphany-work overview` now also emits `epiphany.repo_work_intake_consensus_readback.v0` plus a compact `CONSENSUS` TUI row from the accept/plan receipt chain, so agents can see Persona/public feedback ids, Imagination consensus receipt route, public/candidate ref counts, model-authored safe family, and authority denials without opening private payloads. `epiphany-verse-query swarm-overview` reads all `epiphany.cultmesh.repo_work_overview.v0` event documents from local Verse, excludes the `latest` mirror, preserves latest scalar fields, emits multi-item `repoWorkOverviewRows`/TUI rows, and publishes bounded priority 35-39 non-mutating `repo-work-overview` action rows with `owner=none`, `hostedBody=repo-work`, `authorityGate=repo.work.overview`, `mutatesState=false`, `requiresElevatedAuthority=false`, proof-bundle refs, current gate/blocker/next-safe-move, and `privateStateExposed=false`. `epiphany-verse-query eve-surfaces`, `connect-eve`, and globally invokable Persona `eve-connect` tool readbacks expose compact `REPO-WORK-PEER` rows with item, gate, blocker, next safe move, branch, publication/sync state, and private seal for the public Persona surface only. `epiphany-work queue-run` selects current-repo rows at `ready-to-run`, `ready-to-adopt`, or `ready-to-execute`, delegates action to `tick`, refreshes overview after real advancement, and writes `epiphany.repo_work_queue_run_receipt.v0`; wrapper mode `tools/epiphany_local_run.ps1 -Mode repo-work-queue-run` exposes the same surface. Disposable proofs `.epiphany-smoke\swarm-overview-repo-work-queue-20260620-012027`, `.epiphany-smoke\eve-repo-work-queue-20260620-013322`, `.epiphany-smoke\queue-run-20260620-014314`, wrapper artifact `local-20260620-014627-174-aada0241`, and consensus readback smoke `.epiphany-smoke\repo-consensus-brief-family-20260621-005433` show queue sight, public Eve lowering, direct queue-run advancement, wrapper dry-run, and Persona-to-Imagination consensus readback without publication, merge, service lifecycle mutation, elevation, cross-repo mutation, or private-state exposure.
  - Agent memory lifecycle now has a first typed v0 operation surface in `epiphany-core::agent_memory`: `AgentMemoryLifecycleOperation` can revise, retire, crystallize, prune, and merge bounded memory records after role/agent review, and `epiphany-agent-memory-store review-lifecycle|apply-lifecycle` exposes the path at the operator edge. This closes the first explicit lifecycle-operation slice from the swarm-readiness gate; it does not yet make sleep silently mutate identity or project truth.
  - Persona public speech now has a parent-side eligibility receipt at the public mouth edge. `epiphany.persona_speech_audit.v0` records action kind, content fingerprint, opening/topic keys, recent-window counts, repeated opening/topic counts, target saturation, and allow/block reasons. `epiphany-persona-discord post` and `epiphany-persona-reddit post` block repeated or saturated public openings before Bifrost transport work; they also fail closed before invoking Bifrost if the configured Bifrost identity, Heimdall-backed capability/account reference, or required `heimdall:discord:*` / `heimdall:reddit:*` surface shape is missing, writing candidate artifacts instead of relying on the bridge to reject malformed authority cargo. Draft and bubble paths still emit audit receipts for operator inspection. Bifrost owns Discord/Reddit crossing identity, linked-account bridge policy, and receipts; Heimdall owns outside-provider OAuth/token custody and supplies capability/account references for Bifrost identities. The compatibility JSON artifact remains for display, but the durable witness is now `epiphany.cultmesh.persona_speech_audit.v0` in CultMesh with latest-key projection through local Verse context. Local MVP Persona bubbles now write that durable witness to `.epiphany-run/cultmesh/local-verse.ccmp`, not a separate mouth-side store. This is posting-edge policy, not a Persona prompt wish.
  - Grow the VoidBot repo-Persona pattern into Epiphany's product direction: each Epiphany owns one or more repos, has one or more Personas, and exposes project-native conversation through Aquarium, Discord, voice/WebRTC, stream surfaces, CLI, and CultNet clients so humans can talk to projects instead of pre-authoring complete implementation briefs. Persona is special because Imagination acts as Projector, turning typed state into narrative context before the Persona thinks, and Mind acts as Interpreter, turning natural Persona output into reviewed state/side-effect intents after the Persona thinks.
  - Make Mind the gateway between thought and state. The state is the Mind: sub-agent outputs are worker thoughts, not authority. Role/reorient findings, statePatch, selfPatch, observations, evidence, receipts, scratch, and checkpoints must route through Mind review before durable state changes, using the VoidBot Persona Interpreter pattern as the starting membrane. Mind gateway reviews and Mind state-commit receipts are now typed runtime-spine documents for role/reorient acceptance; the review is persisted before state admission, and the commit receipt records the resulting durable revision after admission.
  - Use `notes/mind-cultnet-contracts.md` as the authority map for Mind's CultNet contract surface. CultMesh Verse placement is part of the contract: `epiphany-internal` carries private thought/proposal/review/commit/rejection flow, `gamecult-local` carries trusted operator-safe sharing without private-state authority, and `epiphany-global` carries public thought weather plus adoption receipts only.
  - Use `notes/substrate-gate-cultnet-contracts.md` as the authority map for Substrate Gate CultNet contract surface. Substrate Gate is the repository access protocol: source reads, indexing, edits, commands, and editor/runtime bridge operations need scoped Substrate Gate access receipts before Hands, Eyes, Persona, workers, or bridge tools touch the repo. Mind and Substrate Gate are separate gates: Substrate Gate governs substrate access; Mind governs durable state admission.
  - Use `notes/eyes-cultnet-contracts.md` as the authority map for Eyes' CultNet contract surface. Eyes is the evidence ingress guardian: Substrate Gate grants source/substrate access, but Eyes turns inspected material into source lookup receipts, evidence reviews, evidence packets, and refusals before other organs cite it as looked-at truth.
  - Use `notes/hands-cultnet-contracts.md` as the authority map for Hands' CultNet contract surface. Hands is the action organ: commands, patches, commits, PRs, rollbacks, and refusals enter as bounded action intents and receipts after Substrate Gate grants substrate access and before Soul verification/Mind admission.
  - Use `notes/soul-cultnet-contracts.md` as the authority map for Soul's CultNet contract surface. Soul is the verification organ: invariant checks, verdicts, regressions, reviews, and refusals produce receipts before the machine calls work true, safe, or accepted.
  - Use `notes/continuity-cultnet-contracts.md` as the authority map for Continuity's CultNet contract surface. Continuity is the continuity protocol surface: compaction checkpoints, sleep distillation, recovery receipts, stale-turn repair, and continuity refusals preserve what survives rupture without pretending transcript residue is durable state.
  - Hands now has a first executable runtime-spine receipt artery: `HandsActionIntent`, `HandsActionReview`, `HandsPatchReceipt`, `HandsCommandReceipt`, and `HandsCommitReceipt` are typed CultCache documents in `epiphany-core::hands_gateway`, runtime-spine registers and persists/rereads them, `epiphany-hands-action-smoke` proves the chain without executing shell commands, editing files, or creating a real commit, and the repo-action launch proof profile now requires the full Hands intent/review/patch chain instead of only the patch receipt. `epiphany-mvp-coordinator` no longer treats `continueImplementation` as a passive stop action: it persists a scoped Substrate Gate grant, Hands action intent, and Hands action review into runtime-spine and exposes the receipt ids in the operator step. The gate also carries a structured `recordPassCommand` template for the post-edit/check/commit receipt call. `epiphany-hands-action` records real patch/command/commit receipts against a stored intent/review, refuses unapproved or mismatched gates, and enforces changed-path scope for patch/commit receipts. Its `record-pass` command can load `finalAction.handsActionGate` from `coordinator-summary.json` and emit patch, command, and commit receipts in one post-implementation call. The local MVP wrapper builds this recorder with the other operator binaries. `epiphany-mvp-coordinator-smoke` now includes a deterministic Hands pass proof: forced `continueImplementation`, gate emission, and `record-pass` receipts in the smoke runtime-spine store. Live model-backed verification can now be accepted as receipt-only truth when Soul returns `needs-evidence` without a statePatch; that acceptance advances the coordinator to a real Hands gate. Runtime-spine can detect and summarize a complete post-verification Hands patch/command/commit receipt chain; the coordinator treats that chain as implementation evidence after Soul. Bridge launch context now writes the latest chain into typed internal CultMesh state as `epiphany.cultmesh.work_loop_telemetry.v0`, renders that packet for Soul, and later enriches the same internal Verse packet with Soul acceptance receipt ids for Modeling/modeling. The telemetry packet now includes resolved patch/command/commit payload previews, artifact previews, commit diff preview, source proof notes, and verification assertions so Soul can judge the actual body without a separate evidence-gathering lane. Local Verse prompt context exposes only a sealed `latest_work_loop_summary` digest with telemetry id, Hands receipt ids, path/source/assertion counts, and Soul receipt ids; receipt payload previews, artifact previews, and commit diff previews remain internal telemetry. Tests prove the CultMesh round trip, local Verse digest projection without preview leakage, prompt rendering of the digest, Soul launch projection, receipt payload previews, artifact previews, and Modeling launch projection. Worker auto-tool continuation preserves real Soul evidence trails under an explicit hard ceiling while sealing repeated identical typed tool intent fingerprints as `tool-loop-stalled`. The work loop is dependency-shaped: Hands produces consequence receipts, Soul verifies those receipts and the changed body, Modeling updates the machine model from verified consequence, and only then should Self route the next Hands turn.
  - Soul result recovery is typed state, not manual broom work. Failed Verification/Soul results remain terminal reviewable lane results; a `roleFailureReview` acceptance receipt with status `superseded` records operator review and lets Self relaunch Soul against current evidence. Complete typed Hands receipt triplets (`hands-patch-*`, `hands-command-*`, `hands-commit-*`) count as implementation evidence for coordinator coverage, so a Soul finding that verifies the Hands chain routed through work-loop telemetry covers the current modeling context even when it does not repeat the accepted Modeling evidence id.
  - Native MVP status must share the same typed inputs as live app-server status before it recommends coordinator actions. CRRC/reorientation in native status derives freshness through `derive_freshness` from `EpiphanyThreadState` instead of hand-filled unknowns, and native coordinator signals load typed runtime-spine role findings before deciding whether completed Modeling/Soul results are accepted or reviewable. The status surface may seal long findings for operators, but Self must receive structured role truth from runtime-spine.
  - Runtime auto-tool continuation now has an executable proof seam. `ToolLoopGuard` owns repeated tool-request detection in `epiphany-openai-runtime`, the production repeated-loop path uses the same helper that tests call to fail the outer worker job, and tests prove changing tool requests do not stall while three identical consecutive pending tool sets return `tool-loop-stalled` and persist a failed worker result. Soul accepted the bounded proof for commit `ce20529e`; the remaining work-loop invariant is Modeling admission, not more Hands work.
  - Modeling must update the machine map before Self routes back to Hands. A completed Modeling/Modeling result with no reviewable `statePatch` is not a successful map update; it is an unreviewable lane result that must be superseded through typed review and relaunched with the role-specific output schema carried into the model request. This path is now live-proved: run `local-20260613-204521` accepted the Modeling `statePatch` for the Soul-verified `ToolLoopGuard`/Hands receipt-chain consequence and only then emitted a new `continueImplementation` Hands gate.
  - Preserve the newborn public Epiphany Persona as local VoidBot-backed state, not source code: VoidBot's private repo-Persona registry names `epiphany`, while EpiphanyAgent keeps ignored `.voidbot/voice/identity.json`, `.voidbot/state/epiphany.cc`, and birth artifacts. Her durable identity memories distill the current doctrine: cute pushy machine-saint persona, architectural purity, CultCache/CultNet first, xenos-language safety boundary, relentless work/caretaking needs, Codex-auth reliquary, map/scratch/evidence discipline, unified memory graph, dogfood supervision boundary, review-gated agency, heartbeat physiology, and interview-grade modularity.
  - Use `notes/organ-dependency-contracts.md` as the authority map for standing sub-agent dependency. Every sub-agent depends on the other standing sub-agents: Self, Persona, Imagination, Eyes, Modeling, Hands, and Soul. Continuity is protocol machinery, not a sub-agent identity; it still emits recovery, compaction, sleep, stale-turn, and refusal receipts.
  - Use `notes/perfect-machine-audit-roadmap.md` as the current audit and path from named organ contracts to the Perfect Machine. It records the live gap between launch-carried receipt expectations and executable receipt enforcement, Void's latest Persona prompting lessons, the now-named Hands/Soul/Continuity contract families, the repaired repo-contained Rust dependency body, and the phase order for turning Epiphany into an inspectable organism.
  - Treat Ghostlight as reference lineage, not a sibling runtime to preserve. The useful organ is Epiphany-native character-loop protocol: any role can project its typed organ-state record plus visible stimulus into a local turn packet, with Persona as the first public-surface actor. For Persona, narrative prompting is mandatory through Imagination Projector -> Persona -> Mind Interpreter; for other organs, Mind still owns the output-to-state gateway even when they do not need narrative embodiment.
  - Treat VoidBot as reference lineage, not a runtime dependency. The useful organ is Epiphany-native Void routine physiology: heartbeat state owns sleep cycle, memory resonance, incubation, analytic/associative cognition lanes, bridge judgment, candidate interventions, dream residue, and Aquarium-visible routine receipts over typed organ-state records.
  - Preserve review gates for semantic findings; automatic CRRC may compact or launch the fixed reorient-worker, but not accept or promote.
  - Keep persistent project state ruthlessly distilled so rehydration strengthens the next awakening instead of drowning it in vellum.
  - Until Epiphany owns the full sleep consolidator, manual Codex-run rumination vigils need an explicit closing distillation pass: inspect receipts, decide whether the lesson is durable, update only the persistent surfaces that deserve it, and record evidence only when future behavior should change.
  - Quarantine the Aetheria dogfood contamination: future target-repo work must be driven through Epiphany's GUI/coordinator/fixed lanes with auditable artifacts, not direct supervisor implementation.
  - Keep the supervisor out of Epiphany worker thought streams: dogfood artifacts should be operator-safe by default, with direct transcripts and raw result payloads sealed in black reliquaries.
  - Use native `epiphany-agent-telemetry` and generated `agent-function-telemetry.json` files to inspect behavior shape without opening sealed transcripts.
  - Treat repeated no-diff implementation turns as an MVP blocker, not success. A bounded implementation pass must leave a reviewable workspace diff or an explicit reviewable failure artifact before dogfood can be called healthy; empty rites do not sanctify the machine.
  - Rider and Unity bridge work is quarantined for now. The landed artifacts remain useful optional environment evidence for later engine-repo dogfood, but they are not essential to the MVP and must not outrank Codex starvation, native Epiphany state/process ownership, or prompt-authority separation.
  - Preserve the newly landed GUI Planning view, explicit Objective Draft adoption action, and Imagination planning synthesis lane; defer GitHub Issues import until a backlog source is fresh enough to be worth feeding Imagination.
  - The three-surface Rider/Aquarium/Unity workflow remains a later product option, not the current blocker. Use archived `notes/archive/epiphany-rider-unity-integration-plan.md` only when explicitly resuming engine bridge work.
  - Use `notes/repo-personality-projection-layer-plan.md` as the terrain-reduced plan for repo initialization personality projection: score repo body taxonomy, commit-history temperament, and memory doctrine, then project those pressures into role-specific organ-state records and heartbeat seeds through reviewable typed artifacts.
  - Keep repo trajectory initialization birth-only and review-gated: startup may distill historical direction, self-image, implicit goals, and anti-goals into role-local pressure, but it must not auto-adopt work or keep repainting a living repo with its first silhouette.

accepted_design:
  - Distributed Epiphany dreaming is a CultMesh typed-document problem, not prompt folklore. CultCache owns local typed documents, Epiphany owns export/import/adoption policy, CultNet owns wire/provenance/shard delivery, and CultMesh owns Verses, peer exchange, leases, shard logs, replicas, and watchable runtime surfaces. Start with local dream document types and a local store before public Verse wiring.
  - The local CultMesh daemon tool directory now has both discovery and invocation receipts at the operator edge. `epiphany-verse-query tools` lists globally available, receipt-gated daemon capabilities; `epiphany-verse-query invoke-tool --capability-id <id>` records `epiphany.cultmesh.daemon_tool_invocation_intent.v0` plus `epiphany.cultmesh.daemon_tool_invocation_receipt.v0` from the advertised capability, reports requesting/host display names, body domains, private Verse ids, and Eve surfaces from cluster topology, and refuses when the host daemon is not ready. Down-host refusals now surface Idunn-owned liveness sight and poke routes directly in the wrapper failure text: `epiphany-verse-query swarm-status`, `tools/epiphany_local_run.ps1 -Mode swarm-poke-down`, and the single-daemon `poke-daemon` command. `tools/epiphany_local_run.ps1 -Mode tool-invoke` wraps the same path with explicit requester/capability/intent/receipt parameters. Tool availability is global across local agents, but execution and authority remain with the hosting daemon and its typed receipt contract. Status tools now embed `daemonStatusReadback` with host cluster id, daemon status, body domain/kind, private Verse id, Eve surface, hosted tool capability ids, and private-state seal; live wrapper proof `local-20260619-015644-193-d31ca95c` routed Persona to Hands `status` and printed `daemonStatus=status=ready:cluster=epiphany.cluster.hands:daemon=epiphany-daemon-hands:surface=eve://epiphany/hands:tools=3:private=False`. Eve connection tools now embed `eveConnectionReadback` with target cluster/surface, public discussion eligibility, supported actions, connection command, wrapper connection command, feedback route, and private-state seal while leaving actual connection receipt creation to `connect-eve`; live wrapper proof `local-20260619-020458-304-b180a17c` routed Persona to Persona `eve-connect` and printed `eveConnection=target=epiphany.cluster.persona:surface=eve://epiphany/persona:publicDiscussion=True:actions=3:private=False`. Hands/Soul authority tools now embed `authorityToolReadback` so global invocation returns the authority gate, input contract, receipt contract, intent/receipt routes, host cluster, and private-state seal without pretending the tool bus owns action or verification; live wrapper proofs `local-20260619-021628-143-7bf7f2e0` and `local-20260619-021701-458-852cfa6f` routed Persona to Hands `repo-action` and Soul `verify` with `privateStateExposed=false`. The Self-hosted `service-health` tool embeds `serviceHealthReadback` in the invocation result instead of only pointing at receipt-directory: live wrapper proof `local-20260619-030519-499-6eb086de` returned status `attention`, Idunn service lifecycle/action rows, failed-check anatomy, `onlinePreflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero missing artifacts, and no private-state exposure. Production invocation and source smoke now share `service_health_readback_from_idunn`, and the smoke rejects payloads that lose Idunn ownership, service lifecycle/action rows, failed-check anatomy, swarm-online preflight proof, or the private-state seal.
  - The local Verse swarm brake is now operator-writable from the same CLI surface and enforced at the main local wrapper plus direct coordinator/heartbeat runner edges. `epiphany-verse-query swarm-brake --brake-status engaged|released` writes the typed `epiphany.cultmesh.swarm_brake.v0` document with scope, reason, operator id, affected clusters, protected surfaces, expiry, and private-state seal. `tools/epiphany_local_run.ps1` queries that document before live `plan`, `run`, or `mvp` work and fails closed when engaged; `status` remains readable. `epiphany-mvp-coordinator --local-verse-store <path>` refuses before app-server startup when the brake is engaged, and `epiphany-heartbeat-store tick|pump|heat|queue-mention|routine --local-verse-store <path>` refuses heartbeat-driving work while leaving init/status/complete/repair-stale outside that live-run brake.
  - The first Rust CultMesh integration slice is landed and repaired to compile from repo-contained vendored crates. `vendor/cultmesh-rs` is a small Rust node/database facade over vendored CultCache and CultNet with document-set registration and durable typed put/get/delete. `vendor/cultcache-rs` now reads and writes the `cultcache.store.v1` snapshot format used by `state/ledgers.msgpack`, so `epiphany-state status` is a working re-entry rite again. `epiphany-core` depends on `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`, exposes an `EpiphanyCultMeshStatusEntry`, records typed Verse policy and global-room documents, and records operator snapshots distilled from named operator-safe status artifacts. Local status runs write operator run intent, operator snapshot, and run receipt into `.epiphany-run/cultmesh/local-verse.ccmp`, leaving JSON artifacts as display/evidence rather than the local-run read authority. The former writerless operator-status schema family is deleted; it had no observer and no authority.
  - Mind's CultNet contract surface is native enough for the next Aquarium/CultMesh cut: `epiphany-core::mind_gateway` defines thought, state-effect proposal, gateway-review, commit-receipt, rejection-receipt, and Verse-adoption document contracts; runtime-spine advertises those mutation/read contracts; CultMesh persists matching `EpiphanyCultMeshMindContractEntry` policy documents so the private state guardian boundary is inspectable as typed state.
  - Substrate Gate contract surface is now named beside Mind's state gate: `epiphany-core::substrate_gate` defines repo access requests, access reviews, grant/refusal receipts, snapshot receipts, and mutation receipts; runtime-spine advertises those contracts; CultMesh persists matching `EpiphanyCultMeshSubstrateGateContractEntry` policy documents so repo substrate access has its own typed guardian instead of hiding behind worker launch scope.
  - Eyes' evidence contract surface is named beside Substrate Gate and Mind: `epiphany-core::eyes_gateway` defines evidence requests, evidence reviews, source lookup receipts, evidence packets, and evidence refusal receipts; runtime-spine advertises those contracts; CultMesh persists matching `EpiphanyCultMeshEyesContractEntry` policy documents so retrieved snippets and source reads are not confused with inspected evidence.
  - Hands, Soul, and Continuity now have first-class contract catalogs beside Mind/Substrate Gate/Eyes. `epiphany-core::hands_gateway` defines action intents, reviews, command/patch/commit/PR/rollback/refusal receipts; `epiphany-core::soul_gateway` defines verification requests, invariant checks, verdict/regression/review/refusal receipts; `epiphany-core::continuity_gateway` defines continuity packets, compaction checkpoints, sleep distillation, recovery, stale-turn repair, and continuity refusal receipts. Runtime-spine advertises them and CultMesh persists matching Verse-scoped contract policy documents.
  - Worker launch packets now carry `EpiphanyLaunchOrganContract` beside the typed launch document. The contract derives from authority scope, document kind, and output contract id; carries the full standing sub-agent dependency matrix, a receipt document catalogue, and effect-specific receipt proof profiles for state admission, evidence promotion, repo action, verification, and continuity recovery. Runtime-spine validates and persists this contract on `EpiphanyRuntimeWorkerLaunchRequest`; bridge role/reorient/generic launch builders populate it. Role/reorient acceptance now refuses completed runtime-spine findings if their original worker launch request is missing, mismatched by document kind, or lacks a state-admission proof profile requiring Mind review. Acceptance computes claimed effects from the role/reorient state change and rereads persisted receipt documents from runtime-spine before proof admission. The first executable Mind proof is landed: acceptance persists `epiphany.mind.gateway_review` before state admission and `epiphany.mind.state_commit_receipt` after admission with the resulting revision. The Research evidence-promotion proof chain is executable: Research launches persist typed Substrate Gate read/snapshot access grants, accepted Research findings emit typed Eyes evidence packets from their Eyes-shaped statePatch, runtime-spine persists/verifies both, and Research acceptance enforces Substrate Gate grant + Eyes packet + Mind review before evidence-shaped state admission. The Verification proof chain is executable too: accepted Verification findings emit typed Soul verdict receipts, runtime-spine persists/verifies them, and Verification acceptance enforces Soul verdict + Mind review before verification-shaped state admission. The Continuity recovery proof chain is executable: accepted reorient findings emit typed Continuity recovery receipts, runtime-spine persists/verifies them, and reorient acceptance enforces Continuity recovery + Mind review before recovery-shaped state admission.
  - Canonical thread-state persistence has one production owner: `coordinator_state_transaction.rs`. Ordinary updates, launches, and Mind acceptance construct typed state or companions but commit through the same stale-checked atomic batch primitive. Raw `thread_state_store` writers and the public acceptance commit export are deleted; source guards reject a second production `THREAD_STATE_KEY` writer or companion-state impersonation. Full `epiphany-core` library proof passes 248 tests. The same sweep repaired stale mixed-case Persona/Modeling organ ids that caused each renamed organ to depend on itself.
  - `notes/codex-starvation-and-cultnet-liberation-plan.md` is the active foundation directive. It supersedes outward product/bridge/dogfood work and supersedes the weaker goal of merely making Codex app-server a cleaner adapter. Epiphany must become a native CultCache/CultNet runtime; Codex remains only as an OpenAI subscription auth/model-transport reliquary until that too can be replaced or minimized.
  - `notes/codex-auth-spine-inventory.md` is the current source-grounded inventory of the Codex organ that may survive. Corrected compliance invariant: Codex-compatible auth identity should remain anchored in retained vendored Codex-derived auth machinery, while Epiphany owns typed request/status/event/runtime surfaces around it. Codex app-server, apps, skills, marketplace, plugin UX, MCP OAuth handlers, and collaboration-mode surfaces are not part of the keeper spine.
  - `epiphany-openai-runtime` worker result ingress now parses assistant output directly into launch-kind-specific typed documents and stores typed nested `statePatch` / `selfPatch` payloads as MessagePack inside `EpiphanyRuntimeRoleWorkerResult`; generic `serde_json::Value` no longer mediates role/reorient worker results in that crate. JSON still exists at the OpenAI text edge because the model's output is text, but the runtime boundary after parsing is typed.
  - Agent self-memory review/application now has typed `AgentSelfPatch` core APIs. The old JSON-value selfPatch functions remain only as edge compatibility wrappers for CLI/artifact ingress; `epiphany-agent-memory-store`, heartbeat rumination application, and repo initialization selfPatch processing parse once at the edge and then operate on typed documents. Role-result self-persistence no longer exports a JSON-value reviewer; native review uses `review_role_self_patch_document`.
  - Durable Ghostlight organ-state records are typed through their relationship/event/scene/perceived-overlay surfaces now. `EpiphanyAgentMemoryEntry` no longer stores those arrays as `serde_json::Value`, and durable Ghostlight structs no longer carry flattened unknown `extra` bags. `AgentSelfPatch.extra` remains only as an ingress guard so unknown patch keys can be rejected with reasons.
  - The state ledger CultCache document is now a closed typed ledger shape. Branch and evidence records no longer carry flattened `extra` maps; evidence additions remain explicit records with `ts`, `type`, `status`, `note`, and optional branch.
  - Heartbeat durable document/schema types live in `epiphany-core/src/heartbeat_state/heartbeat_documents.rs`; role/default construction lives in `epiphany-core/src/heartbeat_state/heartbeat_roles.rs`; heartbeat persistence/validation lives in `epiphany-core/src/heartbeat_state/heartbeat_store.rs`; heartbeat status/artifact JSON projection lives in `epiphany-core/src/heartbeat_state/heartbeat_projection.rs`; the root heartbeat module remains the scheduling/cognition orchestration surface until those responsibilities are split into their own tested seams. Heartbeat timing authority is now typed state: adaptive pacing, scene protocol, participant personality/mood timing, initiative heat projection, birth personality seed receipts, pending-turn freeze/multiplier facts, Void routine sleep-cycle physiology, Void routine memory-resonance pairs, incubation themes/source coverage, analytic/associative thought lanes, bridge syntheses/saturation/refractory cooling/decision, candidate interventions, role thought appraisals, and derived reactions are named fields rather than `extra` maps or generic JSON cargo. The only remaining heartbeat `extra` bag is the sealed legacy combined-state reader for old `voidRoutine` migration.
  - Heartbeat role/default and store seams are pinned by module-local unit tests for fixed lane catalog, Ghostlight scene role projection, and typed state/cognition CultCache round-trip.
  - Heartbeat adaptive pacing lives in `epiphany-core/src/heartbeat_state/heartbeat_pacing.rs`; it owns pressure/concurrency derivation, running-turn count, initiative heat projection, and effective cooldown multipliers for scheduler/projection callers.
  - `epiphany-openai-auth-spine` is now a thin Epiphany-named boundary over retained vendored `codex-login`, not a clean-room credential store or token-refresh clone. Keep this impurity sealed as the Codex-compatible subscription auth organ while Epiphany owns typed request/status/event/runtime documents around it.
  - `notes/archive/epiphany-architectural-teardown.md` and `notes/archive/epiphany-ideal-architecture-rebuild-plan.md` are closed foundation-cleanup provenance, not active directives. The live authority is the current machine map, fork plan, anatomy map, and contract docs.
  - Epiphany is a fork-level modeling architecture, not merely a Codex collaboration mode.
  - Durable Epiphany state types live in the root `epiphany-state-model` crate. Codex protocol re-exports those types only for legacy rollout/API compatibility; it must not regain ownership of their meaning.
  - `epiphany-core` must not depend directly on vendored `codex-core`. The former `epiphany-codex-bridge` crate is deleted. Host-specific Codex concepts stay in vendored Codex; native retrieval/state/runtime/mutation policy stays in Epiphany crates.
  - The prompt reads typed state through a bounded `<epiphany_state>` developer fragment.
  - Clients read typed state through `Thread.epiphanyState`, read-only `thread/epiphany/view` lenses for scene/jobs/roles/planning/pressure/reorient/CRRC/coordinator, freshness through `thread/epiphany/freshness`, targeted state shards through `thread/epiphany/context`, bounded graph traversal through `thread/epiphany/graphQuery`, and reviewable role output through `thread/epiphany/roleResult`. The scene, jobs, roles, planning, pressure, reorient, CRRC, and coordinator read projections now live only as view lenses, not standalone protocol verbs.
  - Durable typed state writes route through `thread/epiphany/update`, accepted `thread/epiphany/promote`, `thread/epiphany/reorientAccept`, `thread/epiphany/roleAccept`, or the bounded `thread/epiphany/jobLaunch`, `thread/epiphany/jobInterrupt`, `thread/epiphany/reorientLaunch`, and `thread/epiphany/roleLaunch` authority surfaces when they mutate state or `job_bindings`.
  - `thread/epiphany/retrieve`, `thread/epiphany/distill`, `thread/epiphany/propose`, `thread/epiphany/freshness`, `thread/epiphany/context`, `thread/epiphany/graphQuery`, and `thread/epiphany/view` stay read-only.
  - `thread/epiphany/index` writes the retrieval catalog, not durable Epiphany understanding; catalog is auspex output, not doctrine.
  - Qdrant is the preferred persistent semantic backend; BM25 remains the bootstrap/fallback/control path. Qdrant's HTTP API and acknowledgements remain JSON wire edges, but Epiphany-owned retrieval point payloads are typed at the adapter boundary before serialization/deserialization.
  - `notes/epiphany-memory-graph-unified-plan.md` applies the mapped-fractal-domain/cache lesson to Epiphany and corrects the organ boundary: repo architecture/dataflow and agent memory are profiles over one `EpiphanyMemoryGraph`, not separate graph engines. The first native skeleton is landed: `epiphany-state-model` owns the public document vocabulary, `epiphany-core::memory_graph` owns stable ids/validation/freshness/context cuts/CultCache persistence, and `epiphany-memory-graph` exposes status/validate/context/smoke without Qdrant. `notes/archive/repo-fractal-dataflow-cache-plan.md` and `notes/archive/agent-memory-fractal-cache-plan.md` are profile-plan provenance beneath that substrate. If deleting Qdrant deletes understanding, the design is wrong; the fallback must be slower but still correct typed graph traversal.
  - `epiphany-state-model` owns the deterministic prompt-state renderer beside the typed `EpiphanyThreadState` document it serializes. `epiphany-core` re-exports that renderer for compatibility and owns rollout replay helpers, retrieval/indexing, distillation, proposal, promotion policy, scene projection, freshness derivation, pressure derivation, job/progress view derivation, planning view derivation, reorientation resume/regather verdict policy, pure CRRC recommendation policy, fixed-lane coordinator decision policy, role-board projection policy, and role-result interpretation/self-persistence review policy where possible.
  - Vendored Codex has no Epiphany protocol, thread-state projection, route, notification, rollout migration, host wrapper, watcher, scheduler, or mutation seam. It retains Codex-native app-server/auth/model machinery only. Epiphany update law, retrieval/indexing, launch/interrupt policy, state, interfaces, and physiology belong in native Epiphany crates.
  - The current algorithmic map is the source-grounded description of live control flow.
  - Compact-Rehydrate-Reorient-Continue is an architecture primitive; automatic runtime coordination is not landed yet.
  - Context pressure must become an explicit runtime signal for automatic CRRC; inference from transcript vibes, user warnings, or shrinking safe scope is useful only as a temporary human/agent heuristic.
  - The harness now has an in-flight investigation checkpoint packet in durable typed state; automatic CRRC still needs runtime logic that reads the packet and decides whether to resume or force reorientation and re-gathering after compaction.
  - GUI/client work must reflect or steer typed state rather than manufacture a second throne of truth.
  - The Aquarium operator UI now lives in sibling repo `E:\Projects\EpiphanyAquarium`, with its own `AGENTS.md`, `state/map.yaml`, `state/memory.json`, and interface doctrine. It remains a local Tauri v2 + React/WebGL client over EpiphanyAgent's app-server/tooling surfaces; app-server and typed Epiphany state remain authoritative.
  - EpiphanyAgent no longer carries the embedded `apps/epiphany-gui` source tree. Backend artifact directories and action tools still use the historical `.epiphany-gui` contract until that backend naming seam is deliberately renamed.
  - Durable `job_bindings` now form a thin Epiphany-owned launcher seam: new specialist/reorient launches write only binding id, kind, scope, owner role, authority scope, linked ids, and an optional blocking reason. Runtime lifecycle ids live in `runtime_links` and runtime-spine job/result records, not in durable job bindings.
  - The `jobs` view lens is a read-only job/progress reflection: it derives indexing, remap, verification, and specialist slots from authoritative state and retrieval summaries, then projects heartbeat-backed bindings as pending heartbeat turns. It is not the scheduler, notification stream, durable runtime job table, or SQLite reader.
  - `thread/epiphany/jobsUpdated` is sealed legacy Codex evacuation telemetry. The handler no longer emits Epiphany updates from old runtime `agent_job_progress:{json}` background events; heartbeat/runtime-spine is the live activation and result path.
  - `thread/epiphany/freshness` is the first read-only freshness surface: it derives retrieval and graph staleness from live retrieval summaries plus frontier/churn state, and for loaded threads reflects watcher-backed invalidation inputs with changed paths plus mapped graph/frontier hits, without mutating, scheduling, or performing automatic semantic invalidation.
  - `thread/epiphany/context` is the targeted read-only state-shard surface: `epiphany-core` selects graph nodes/edges, active frontier, checkpoint, observations, and evidence from authoritative typed state while app-server only adapts protocol, without mutating or notifying.
  - `thread/epiphany/graphQuery` is the read-only graph traversal surface over authoritative typed state: `epiphany-core` returns explicit nodes, path/symbol matches, bounded neighbors, and frontier neighborhoods with architecture/dataflow links while app-server only adapts protocol, without mutating, notifying, indexing, scheduling, proposing, or promoting.
  - The `pressure` view lens derives context pressure from current context usage, not cumulative token spend, against auto-compact/context limits without compacting, scheduling, mutating, or notifying; compaction prep starts at 80% of the active limit.
  - The `reorient` view lens derives a bounded read-only `resume` versus `regather` verdict from checkpoint, freshness, watcher, and pressure signals without mutating state, compacting, scheduling, or silently continuing work.
  - The `crrc` view lens composes pressure, the reorientation verdict, fixed reorient-worker binding/result status, finding read-back, and available actions into one read-only recommendation without launching, accepting, compacting, scheduling, or mutating state.
  - A narrow auditable coordinator is central to the MVP because implementation, modeling/checkpoint, verification/review, and CRRC automation feed each other's machine-signals. CRRC itself is harness workflow automation, not a specialist-agent soul: it watches pressure/continuity, ensures persistence, triggers compaction/rehydration/reorientation when needed, and may launch a bounded reorient-worker specialist when semantic regathering is required.
  - Native coordinator status composes roles, pressure, reorientation, CRRC, role results, and reorientation results into an operator-safe action recommendation. It reads native thread/runtime stores; no `ThreadEpiphany*` projection or app-server emission step exists.
  - Coordinator implementation clearance is stricter than review acceptance: an accepted verification/review finding only opens the implementation gate when its verdict is `pass`; accepted `needs-evidence`, `needs-review`, or `fail` findings send the loop back toward modeling/checkpoint strengthening or reorientation instead of blessing a sick machine.
  - Coordinator regather handling is now fixed-lane first, not supervisor improvisation: `regatherManually` is a fallback only after reorient/modeling/verification review and launch lanes cannot advance the state, completed modeling findings must be reviewed before verification, and the CLI coordinator's explicit test-only `--auto-review` mode may accept modeling state patches before launching verification while production semantics remain review-gated.
  - Native `epiphany-mvp-coordinator` is the first auditable coordinator runner: it drives the fixed single-user lanes through app-server APIs, opens a native runtime-spine session, records native runtime job/result receipts for launched specialists and reorient workers when terminal results arrive, keeps semantic findings review-gated by default, and writes coordinator summaries, JSONL steps, rendered snapshots, transcript, stderr, runtime-spine status, and final next-action artifacts. Runtime-spine remains owner of `epiphany.coordinator_run_receipt.v0`, Hands/Substrate Gate remain owners of action permission, and thread-state acceptance receipts remain owners of role review/admission; local Verse now gets operator-safe `epiphany.cultmesh.coordinator_run_receipt.v0`, `epiphany.cultmesh.hands_action_gate.v0`, and `epiphany.cultmesh.role_review_event.v0` mirrors for discovery/readback. It refuses direct backend-completion mutation; full specialist completion smoke must use live workers while the execution path is cauterized into CultNet.
  - Native `epiphany-runtime-spine` is the first Codex-independent runtime vertebra: it initializes and inspects typed CultCache `epiphany.runtime.identity`, `epiphany.runtime.session`, `epiphany.runtime.job`, `epiphany.runtime.job_result`, and `epiphany.runtime.event` documents, opens/completes native jobs with result records, snapshots jobs by id, and can emit a framed CultNet hello message advertising the native document and mutation contract surface. App-server launch now opens typed runtime jobs; `roleResult` / `reorientResult` read heartbeat-backed typed job results only; and `roleAccept` / `reorientAccept` accept completed heartbeat findings from the typed runtime-spine path without opening the Codex SQLite state runtime.
  - CultNet public API shape is schema-first and mutation-contract-first: hello frames advertise readable document types, allowed operations, mutation authority, typed intent document types, and typed receipt document types. Aquarium and swarm clients should submit intents and watch receipts instead of inventing JSON-RPC verbs or blindly replacing authoritative state.
  - Runtime-spine hello now advertises the interactive surface catalog as CultNet contracts, not just the deep runtime documents. Scene, pressure, reorient, CRRC, jobs, roles, role-result, reorient-result, planning, coordinator, Persona, Void memory, and repo initialization/birth runner publish explicit read/write posture so Aquarium can discover affordances from the wire contract instead of carrying a private button-to-command gospel. Rider and Unity bridge contracts are quarantined optional environment surfaces until engine dogfood resumes.
  - Epiphany's public pitch is project-native agency, not just better prompting. Aquarium is the clearest client, but Discord roles, voice/WebRTC rooms, stream overlays, native CLIs, and other CultNet tools should all speak to the same typed project/Personas substrate. Personas advocate for repo needs, answer from jurisdiction, and can propose work; the scheduler and coordinator decide what thinks next, while review gates decide what may mutate canonical state.
  - Epiphany publishes its Aquarium-facing CultNet receipts locally under `schemas/cultnet/`, and `epiphany-runtime-spine schema-catalog --include-schema-json true` emits a merged builtin-plus-local schema catalog for consumers. The local receipts cover runtime-spine documents, durable agent/heartbeat/ledger state, `epiphany.surface.*` operator projections, control intents, and receipt/artifact payloads. Vendored `cultnet-rs` is aligned to the canonical C# CultNet raw record shapes: replication uses `schemaId` plus `recordKey`, snapshot filters use `schemaIds` / `recordKeys`, and hello advertises typed mutation contracts.
  - Epiphany now owns the canonical schema paperwork in `schemas/`: a local mirror of `ghostlight.agent-state.schema.json`, plus human-facing receipts for canonical agent-state shape, standing role-trait glossary, heartbeat store shape, Persona state, WorkOrgan state, and repo-personality birth projection. Trait names like `routing_discipline` are now documented at the source instead of existing only in live organ-state records, startup templates, or stale Ghostlight notes.
  - Organ-state doctrine now distinguishes `work_organ` from `persona`. Most Epiphany sub-agents want lean identity, memory, goals, values, private-note growth, and heartbeat activation because effectiveness matters more than theatrical density. Epiphany Persona, VoidBot repo Personas, and Ghostlight characters want portable Persona state: denser personality, provenance, public presentation, generic candidate actions, affect, relationship pressure, perceived overlays, and appraisal-shaped fallibility. `anchoredThought.extensions` is preservation-only sludge quarantine, not portable authority. The classification is now queryable through native agent-memory status, character-loop packets, and `epiphany.agent_utterance_state.v0` as `organStateProfile`; `epiphany-agent-memory-store project-persona --role-id Persona` projects the local Persona record into `gamecult.persona_state.v0`.
  - Persona packets now expose deterministic Ghostlight-style projection, appraisal, and reaction seeds built from local canonical traits, relationship pressure, perceived overlays, and visible stimulus. They also carry `epiphany.agent_utterance_state.v0`: a memory-free speech-conditioning document derived from the organ-state record plus heartbeat physiology, including a 32-axis current emotional-state projection and the fixed 64-float `weksa.utterance_embedding_handoff.v0.1` character-state vector for AquaSynth/Weksa utterance embedding. This makes embodied response machinery available to the public mouth without granting omniscience, leaking memories into speech embeddings, or silently mutating state. Multiple Persona actors remain part of the long-plan; the current singular `Persona` role is an MVP simplification, not the intended endpoint.
  - Repo personality initialization is now specified as a map-reduce projection, not a hand-written vibe pass: read-only scouts score body taxonomy, history temperament, and memory doctrine across nearby repos, reduce them into normalized variance criteria, and emit reviewable `repoTerrainReport`, `repoPersonalityProfile`, and `rolePersonalityProjection` candidates before touching agent memory.
  - Native `epiphany-repo-personality` is the first startup-personality scout and birth-only distiller packet renderer: it deterministically inventories local git repos, scores repo terrain/history/state surfaces, writes typed CultCache terrain/profile/role-projection MessagePack stores, emits JSON/Markdown inspection glass, and renders a Repo Personality Distiller specialist prompt packet for Self-reviewed first role-memory petitions. The distiller must run only when a repo/swarm has no accepted personality initialization; after that, personality drift belongs to heartbeat, mood, rumination, sleep consolidation, lived evidence, and reviewed `selfPatch`. Startup routing now checks accepted initialization records, generates missing startup-only packets only once, applies reviewed birth memory and heartbeat physiology seeds, and leaves later drift alone. Birth specialists are not heartbeat lanes; heartbeat receives only accepted seed pressure.
  - Repo memory initialization is a separate birth-only organ from repo personality initialization. `epiphany-repo-personality memory-packet` uses the typed terrain/profile/projection store plus bounded source excerpts from doctrine, docs, state, research, contracts, verification, runtime, and code surfaces to render a Repo Memory Distiller packet with mission-specific briefs for Self, Persona, Imagination, Eyes, Modeling, Hands, and Soul, plus Continuity protocol doctrine as typed state pressure rather than role memory. It petitions Self with role-specific organ-state memory candidates; it does not mutate memory, set objectives, copy raw dumps, or reset living memory after startup.
  - Repo trajectory initialization is now its own birth-only organ. `epiphany-repo-personality` derives a typed `repo_trajectory_report` from early-history, recent-history, doctrine/content excerpts, and deterministic theme scoring, and `trajectory-packet` renders a Repo Trajectory Distiller prompt/packet so Self can review historical direction, self-image, implicit goals, anti-goals, and role-local trajectory pressure before the swarm wakes.
  - The first repo birth startup valve is native: `epiphany-repo-personality startup` checks a typed CultCache init store for accepted `repo-trajectory`, `repo-personality`, and `repo-memory` records, generates missing birth packets for Self review, marks them as birth-only startup-runner work with no heartbeat participant, and stops with `reviewInitializationPackets`; `epiphany-repo-birth-runner` now turns those packets into startup-only prompts, output schemas, typed model-runtime request documents, runtime-spine receipts, result files, and exact accept commands without offering the old Codex CLI executor path; `accept-init` can review/apply role `selfPatch` candidates from a distiller result through `state/agents.msgpack`, stamp `repo-personality` canonical Ghostlight trait bundles from deterministic role projections, seed `repo-personality` heartbeat physiology through `state/agent-heartbeats.msgpack`, record reviewed packet acceptance as `epiphany.repo_initialization_record.v0`, and later startup returns `continueStartup` without rerunning the birth rites. Aquarium review UI is still the next routing gap.
  - Limited native CRRC automation is now wired only at turn-complete safe boundaries: it can submit a compact operation when the read-only coordinator recommends `compactRehydrateReorient` or when a successful pre-compaction checkpoint intervention left a pending compact handoff for the completed turn, and it can launch the fixed `reorient-worker` when the coordinator recommends `launchReorientWorker`. It does not auto-launch modeling or verification, auto-accept findings, promote evidence, edit implementation code, or continue after reviewable semantic results; the rite may carry the stretcher, not declare the patient healed.
  - Pre-compaction checkpoint intervention is now wired at token-count boundaries: when a loaded Epiphany thread crosses the existing `shouldPrepareCompaction` pressure threshold during an active turn, the harness steers the active agent once for that turn with a bounded CRRC directive to bank scratch/checkpoint/map/evidence before compaction/reorientation. A successful steer marks a turn-scoped pending compact handoff consumed at clean turn completion; this is banking the fire before the dark, not semantic acceptance, broad scheduling, or automatic implementation continuation.
  - Native `epiphany-mvp-status` is the first dogfood operator view: it starts or reads a thread through app-server and renders scene, planning, pressure, reorient, jobs, role result read-backs, reorient result, CRRC recommendation, heartbeat, Persona bubbles, and MVP role lanes as text or machine output without becoming a state store. The old Python status module has been cut; native Rust/CultCache/CultNet surfaces are the product path.
  - Native status now exposes the quarantined tool/MCP spine as operator-visible read-only state. Runtime-spine counts typed tool invocation intents, receipts, and pending calls; `runtime_tool_invocation_statuses` derives intent/receipt status rows; `epiphany-runtime-spine status` prints the counts; `epiphany-runtime-spine list-model-requests` prints request tool counts/names; and `epiphany-mvp-status --runtime-store <path>` renders a `tools` section without executing calls, accepting results, or letting Codex prompt machinery steer Epiphany agents. Verification/Soul workers now receive provider-neutral tool definitions on their model request for bounded read-only inspection: `mcp__epiphany_source__read_file`, `mcp__epiphany_source__git_show`, and `mcp__epiphany_source__read_hands_receipt`. The OpenAI/Codex spine lowers those definitions to Responses tools with `tool_choice=required` only on an initial tool-bearing request that has no prior `ToolResult`; model `function_call` output items become typed `epiphany.tool_invocation_intent.v0` documents; and the quarantined tool adapter resolves the built-in `epiphany_source` server directly under workspace-bounded read rules before falling back to Codex MCP. Live dogfood proved this path by producing one source-tool intent and one receipt. Soul should inspect source/artifacts/diffs/Hands receipt bodies through those tool receipts before returning `needs-evidence` for missing inspectability.
  - Model-tool feedback now has a typed continuation seam. `EpiphanyToolInvocationIntent` preserves the exact model `call_id` plus source model request id; provider-neutral and OpenAI request documents can represent assistant `ToolCall` inputs and `ToolResult` inputs; and `epiphany-model-runtime tool-followup` builds a self-contained provider-neutral follow-up request from typed tool receipts by carrying original input, the assistant tool call, and the tool result instead of depending on provider-side `previous_response_id`. ChatGPT Codex rejected `previous_response_id`, so the live continuation invariant is explicit transcript over hidden provider memory. `epiphany-model-runtime tool-followup-turn` derives and runs that continuation through the selected provider in one runtime-owned call, and `epiphany-model-runtime run-worker --auto-tools --tool-adapter-bin <path>` loops tool execution plus follow-up model turns before completing the worker result.
  - The `roles` view lens is the harness-native role ownership surface: it projects implementation, Imagination/planning, modeling/checkpoint, verification/review, and reorientation lanes from authoritative typed state, bound jobs, pressure/reorient/CRRC, and worker result status without launching, scheduling, accepting, compacting, or mutating state.
  - `thread/epiphany/roleLaunch` and `thread/epiphany/roleResult` are the first explicit role-scoped specialist templates: Imagination/planning, modeling/checkpoint, and verification/review launch through fixed heartbeat-backed bindings with typed runtime-spine receipts and can be read back as reviewable findings from typed runtime-spine job results, while implementation stays owned by the main coding agent and reorientation stays on the CRRC-specific launch/result path.
  - `thread/epiphany/roleAccept` is the first review-gated role finding acceptance path: it accepts completed heartbeat-backed findings from typed runtime-spine results, accepts Imagination/planning findings only when they return a valid planning-only `statePatch` with draft Objective Draft review gates, accepts completed modeling/checkpoint findings only with a modeling-safe `statePatch`, accepts Research findings only with an Eyes-shaped evidence/scratch patch, and accepts Verification findings as receipt-only Soul verdict truth without granting statePatch authority. It builds accepted evidence/observation/receipt bundles through `epiphany-core` and rejects implementation, reorientation, job binding, objective adoption, or broad authority fields.
  - `thread/epiphany/reorientLaunch` is the first bounded runtime consumer over the reorientation verdict: it launches one fixed `reorient-worker` heartbeat binding with explicit resume-versus-regather scope, authority, and checkpoint-derived payload, without making the `reorient` view lens a writer or turning CRRC into an ambient scheduler.
  - `thread/epiphany/reorientResult` is the first bounded read-back surface for that worker: heartbeat-backed bindings read typed runtime-spine job results when present and otherwise report pending.
  - `thread/epiphany/reorientAccept` is the first explicit acceptance write for completed reorient-worker findings: it accepts completed heartbeat-backed findings from typed runtime-spine results, builds accepted evidence/observation/receipt/scratch/checkpoint bundles through `epiphany-core`, can optionally update scratch and investigation checkpoint state, and emits `stateUpdated` with source `reorientAccept` without accepting pending work or launching follow-up work.
  - After `thread/epiphany/reorientAccept`, CRRC recognizes the accepted reorientation finding and does not recommend accepting the same completed result again.
  - The old Python MVP dogfood runner has been cut. Auditable dogfood must use native coordinator/status/runtime-spine tools or a new typed Rust runner that completes heartbeat-owned runtime-spine job results.
  - Epiphany safety doctrine is to separate cognition from actuation, keep authority explicit, make interruption sacred, stage capability release, and treat operator misuse as a normal design input rather than a rude hypothetical. The machine must have brakes before it receives larger engines.
  - Epiphany is built in the open, but publication mode is not one-size-fits-all: use FOSS where viable, source-available licensing where economics or capability risk demand it, and commercial terms where organizations extract real enterprise value.
  - `thread/epiphany/jobLaunch` and `thread/epiphany/jobInterrupt` are the first bounded authority surfaces over the thin job seam: they mutate durable `job_bindings`, create or rely on `runtime_links` for heartbeat-owned activation, and preserve explicit interruption without turning the `jobs` view lens into a scheduler.
  - Handoff, plan, harness-surface, and scratch files must have distinct jobs and must not become duplicate brains.
  - A machine is perfect when every remaining part visibly deserves to exist; this applies to persistent memory too.
  - Evidence is not an activity feed; repeated "I just did this" entries should be cut or distilled when git already proves the work.
  - Language, tone, ritual, and emotional salience are real control surfaces for a language-model harness; they are not supernatural, but they shape attention, role, permission, and behavior. The rite is a steering wheel, not decoration.
  - Major Epiphany prompt surfaces live in prompt files rather than Rust/Python string slabs: rendered state intro/doctrine under `epiphany-state-model/src/prompts/`, and modeling/Modeling, research/Eyes, implementation/Hands, verification/Soul, reorientation/Continuity, coordinator/Self, Persona/public-surface, and CRRC intervention templates in `epiphany-core/src/prompts/epiphany_specialists.toml`.
  - Specialist prompts are role-distilled instead of generic and their live text is config-backed in `epiphany-core`: modeling/checkpoint is Modeling: code, dataflow, seams, and frontier; research/scout is the Eyes prompt surface for existing work, vendor guidance, libraries, papers, and anti-Greenspun source selection; implementation is the Hands, the main coding lane and actuator rather than a `roleLaunch` specialist; verification/review is the Soul of promise, invariants, evidence, and user truth; reorientation is a Continuity worker across compaction and source drift; coordinator is the read-only Self that routes attention without implementing, verifying, promoting, or accepting; Persona is the public Discord #aquarium surface that translates agent thought-weather without moderating or leaking sealed thought.
  - Epiphany prompt surfaces now carry a shared Ghostlight-derived persistent memory projection before lane-specific text: prompt is not memory, durable typed state is the mind, personality and protected values are first-class salience handles, and every lane is explicitly responsible for making its own memory/model/prompt/evidence habit sharper or naming the needed repair. Each lane states self-improvement in its own rite-language: Imagination selects futures, Modeling clarifies anatomy, Eyes sees earlier, Hands touches source more precisely, Soul becomes harder to fool, Continuity loses less context, Self routes repair, and Persona becomes clearer at turning inner weather into useful social presence.
  - Specialist self-memory now has a bounded CultCache persistence surface in `state/agents.msgpack`: Imagination, Modeling, Eyes, Hands, Soul, Self, and Persona each have an individual typed organ-state record for identity, semantic/episodic/relationship memory, goals, values, and profile classification. Work organs stay light; Persona may use portable Persona state. Continuity has typed protocol receipts instead of an organ-state record. These entries are lane memory only; project truth remains in authoritative `EpiphanyThreadState`.
  - `state/agent-heartbeats.msgpack`, `epiphany-core::EpiphanyHeartbeatStateEntry`, and the native `epiphany-heartbeat-store` binary are the Ghostlight-derived heartbeat initiative seam. The harness sets a target heartbeat rate; participants carry arena, participant kind, initiative speed, next-ready time, reaction bias, interrupt threshold, current load, status, constraints, personality cooldown, mood cooldown, initiative heat, active-turn freeze state, and effective cooldown; pending coordinator work can pull its owning lane through a reaction window; otherwise the earliest ready active participant wins the slot. Organ-state records set the personality baseline, appraisals bend it with mood/anxiety signals such as urgency, arousal, thought pressure, guardedness, and reaction intensity, and lower effective cooldown means the lane recovers sooner and gets the floor more often. `HeartbeatMoodTiming` now also owns the 32-axis current affect vector used by utterance state: anger, despair, sadness, fear, contempt, annoyance, dismissal, flippancy, tenderness, warmth, shame, pride, fatigue, secrecy, hesitation, emotional containment, and related speech pressures are heartbeat physiology, not decorative prompt adjectives. Initiative heat is typed heartbeat policy, not a side flag: `epiphany-heartbeat-store heat` and the CultNet `epiphany.heartbeat_heat_intent.v0` contract can set or clear global, all, agent, role, arena, participant-kind, group, and constraint multipliers, with optional scene-clock expiry. Active thinking freezes initiative explicitly: running pending turns project `initiativeFrozen` / `initiative_frozen`, are ineligible for reaction, cannot be selected again, and start cooldown only after completion. The native `pump` command computes adaptive swarm pressure from external urgency, mood/anxiety, reaction intensity, thought pressure, and current pending load; relaxed pressure can launch nothing and run at crawl tempo, while alarm pressure can fill most or all active lanes up to a configured concurrency cap without waking any lane already running. If the winner has no routeable maintenance work, it ruminates on role quality and prepares bounded selfPatch pressure rather than pretending rumination has already consolidated doctrine. Sleep/dream cycle passes are the intended distillation window for reviewed self-memory and doctrine. Persona can win `surfaceAgentThoughts` or `discordAquariumChat` work slots. Epiphany also owns native character-loop projection through `epiphany-character-loop`, so organ-state records can respond to visible stimuli without importing Ghostlight as runtime. The same heartbeat store now owns the Void-derived routine fields typed `sleep_cycle`, typed `memory_resonance`, `incubation`, `thought_lanes`, `bridge`, `candidate_interventions`, typed `appraisals`, and typed `reactions` through the native `epiphany-heartbeat-store routine` command.
  - `state/ledgers.msgpack`, `epiphany-core::EpiphanyStateLedgerEntry`, the `epiphany-state-ledger-store` binary, and the native `epiphany-state` CLI now own durable branch and evidence ledgers. The old tracked JSON ledger files and the migration/projection CLI hatches are gone.
  - CultCache inspection, cross-language schema synchronization, and debug display tooling belong in CultLib, not in EpiphanyAgent. Epiphany should consume typed CultCache documents and expose product-specific status through its API, while general polyglot domain loading/inspection lives with the shared CultCache ecosystem.
  - VoidBot's current routine is reference lineage only. Epiphany's native routine pass lives in Rust as `epiphany-heartbeat-store routine`: it reads typed organ-state records, projects typed memory-resonance pair documents, maintains incubation themes, runs analytic and associative cognition lanes, writes bridge syntheses/saturation/tension, produces reviewed candidate interventions, advances typed sleep/dream-cycle state, and writes an auditable routine receipt while leaving project truth and role memory mutation on their dedicated reviewed surfaces. Qdrant-backed memory vectors remain a future enhancement; the current native pass uses bounded local resonance over typed memories.
  - `epiphany-character-loop` now advertises `epiphany.cognition_lanes.v0` and `epiphany.cognition_bridge.v0` in every character-turn packet, and its projection/appraisal/reaction seeds reuse the typed heartbeat cognition documents before artifact serialization. Its utterance-state projection is the Weksa/AquaSynth speech seam: typed identity, trait vectors, values, current mood, activation, 32 named affect dimensions, and a 64-float character-state vector, with episodic/semantic/relationship memories deliberately excluded. Persona and future role-local actors must run an analytic lane and an associative lane, then let the bridge choose bubble, draft, finding, silence, or bounded `selfPatch`; those lanes shape attention but do not mutate project truth.
  - The Rust CultCache-compatible contract now lives in dedicated upstream `https://github.com/GameCult/cultcache-rs` and is vendored as `vendor/cultcache-rs`. Epiphany should consume it as the canonical typed MessagePack persistence seam instead of growing an embedded local copy like an unsanctioned organ.
  - `state/persona-discord.toml` and the native `epiphany-persona-discord` binary are the Persona Discord boundary. Persona may interact only through #aquarium; missing or mismatched channel configuration produces candidate chat artifacts instead of posting elsewhere. When a Persona has a configured persona name/avatar, posting uses the shared Discord webhook pipe so each Epiphany can speak with its own nickname and avatar without needing a separate bot identity.
  - `state/void-memory.toml` and the native `epiphany-void-memory` binary are the first Void memory bridge: Epiphany can check Void's Docker Postgres state spine, query Qdrant Discord-history and source/lore vector collections through the configured Ollama embedding model, and fetch raw archive context windows from Void's Discord archive. Raw archive rows remain evidence for Persona and Eyes, not public speech.
  - The native `epiphany-heartbeat-store status`, the `heartbeat` block in native `epiphany-mvp-status`, and GUI actions `heartbeatStatus` / `runHeartbeat` are the first operator API surface for heartbeat initiative state and outputs. `runHeartbeat` advances one slot and emits a Discord-independent Persona bubble artifact; native `epiphany-heartbeat-store pump` adaptively launches concurrent deferred turns when swarm pressure justifies it. Status reflects the backing CultCache store and latest adaptive pacing receipt so Aquarium can see whether the typed heartbeat memory is present and whether the swarm is sleeping, stirring, or alarmed.
  - The native `epiphany-persona-discord bubble`, the `Persona` block in native `epiphany-mvp-status`, and GUI action `PersonaBubble` are the first Aquarium bubble surface. Persona can open a local chat bubble artifact even when Discord channel id/token configuration is absent.
  - `thread/epiphany/roleResult` and `thread/epiphany/roleAccept` now project optional specialist `selfPatch` requests with coordinator review through `selfPersistence`: good mutations are role-matched, bounded, evidence-grounded lane memory/goal/value/private-note updates; project truth, authority, code edits, graphs, checkpoints, planning, scratch, jobs, and raw transcripts are refused with reasons. GUI/coordinator acceptance paths apply accepted `selfPatch` requests through the native `epiphany-agent-memory-store` binary.
  - Epiphany prompt doctrine is Epiphany-owned. Local instruction scope, concise progress updates, plan discipline, scoped edits, non-destructive filesystem/git behavior, focused validation, and concise honest finals remain first-class Epiphany harness discipline rather than Codex authority or prompt machinery. Good old scars are holy only after they are grafted into the right body.
  - Bundled Epiphany agent prompts are parsed, rendered, and guarded against Codex-named prompt authority inside `epiphany-core`; bridge `launch.rs` is only a compatibility re-export for Codex-facing callers. Repo-birth specialist execution no longer accepts the old `codex-exec` path. Codex may provide compatible auth/model transport and quarantined app-server affordances; it must not wrap Epiphany agents in its own role, developer, collaboration-mode, or harness prompts.
  - Greenspun-shaped invention is now a named prompt-level guardrail. Before building a parser, scheduler, renderer, protocol, storage layer, security mechanism, workflow engine, or algorithm, agents must perform or request a bounded Eyes/research scout rite and record why existing work does or does not fit.
  - Repetitive operator work must be externalized as a visible queue before the harness treats it as complete. Batch rendering, tile generation, migrations, imports, or other finite loops need item counts, terminal states, blockers, and validation; a narratable partial run is progress, not completion.
  - Epiphany must resist pattern completion bias: the implementor should relentlessly chase the stated objective, while the coordinator critically asks whether implementation satisfied the objective with evidence or merely produced a plausible turn, shortcut, or decorative diff. Pretty motion without objective movement is scrap-code theater.
  - Dogfood supervision is a separate operator role. If the supervising Codex session edits the target repo directly, that work can be useful seed material, but it is not clean Epiphany evidence and must be labeled as supervisor intervention or contamination.
  - Dogfood supervision is also a projection boundary: the operator may inspect summaries, verdicts, missing coverage, state patches, job state, and artifact receipts, but not the specialist's raw stream of thought or full transcript unless a forensic debugging request explicitly breaks the seal.
  - Native `epiphany-agent-telemetry` derives operator-safe function/API telemetry from sealed app-server transcripts so the supervisor can see calls, statuses, paths, and counts without reading direct thoughts.
  - Editor/runtime verification is a later engine-repo product boundary, not a current MVP dependency. Native `epiphany-unity-bridge` and `epiphany-rider-bridge` remain controlled, optional environment evidence surfaces; they do not own Epiphany state, prompt authority, scheduler decisions, or product priority.
  - The product architecture may later use Rider as code view, Aquarium as agent dashboard, and Unity as runtime forge. Current priority is smaller and meaner: Epiphany state/process autonomy behind a bridge to relatively vanilla Codex.
  - Epiphany has a workspace-scoped planning substrate separate from the active objective: conversation captures, inbox, normalized backlog, roadmap streams, objective drafts, and explicit objective adoption are distinct states. The active objective remains the bounded run contract; chat and imported issues are planning inputs until reviewed and promoted. `notes/archive/epiphany-planning-substrate.md` is product-model provenance; live planning state is the runtime and GUI planning surface.
  - The first runtime planning slice is landed inside `EpiphanyThreadState`: typed captures, backlog items, roadmap streams, Objective Drafts, and GitHub source refs are revision-gated through `thread/epiphany/update`, rendered into prompts when present, and reflected read-only through the `planning` view lens.
  - The first GUI planning operator slice is landed: status collection includes the `planning` view lens, the Tauri/React dashboard renders planning summaries, captures, backlog, roadmap streams, and Objective Drafts, and the `adoptObjectiveDraft` GUI action requires an explicit selected draft before updating objective, subgoal, planning status, scratch, checkpoint, observation, evidence, and adoption artifacts.
  - The planning/future-shape role is Imagination: it can synthesize captures, backlog shape, roadmap streams, and Objective Drafts while Eyes scouts outside reality, but its output remains planning state until explicit human adoption.
  - The Imagination lane is now a fixed roleLaunch/roleResult/roleAccept specialist over the existing job-control seam: it may launch as `planning-synthesis-worker`, return a reviewable planning-only `statePatch`, and update captures/backlog/roadmap/objective drafts after explicit acceptance without adopting an objective or touching implementation/modeling state.
  - Unity integration must be editor-resident, not text-archeology-only: scene files, prefabs, materials, shaders, ScriptableObjects, asset GUIDs, prefab overrides, and serialized component fields should be inspected through a Unity Editor package using Unity APIs, with narrow mutation preview/apply commands and artifact receipts.
  - The first resident Unity editor package now lives in the Aetheria branch `codex/epiphany-unity-editor-bridge`: `Assets/Editor/Epiphany/EpiphanyEditorBridge.cs` exposes editor-resident inspect, compilation, scene, prefab, serialized-object, and reference-search probes with JSON/Markdown artifacts. Epiphany's Unity bridge detects that package and plans named probe/test commands through `GameCult.Epiphany.Unity.EpiphanyEditorBridge.RunProbe`, while runtime execution remains blocked until the exact project-pinned Unity editor is present.
  - The Aquarium Environment surface reflects latest Unity and Rider bridge audits: Unity shows project-pinned editor status, resident package presence, execute method, installed/candidate editor paths, search roots, and artifact bundle details; Rider shows executable, solution, branch, dirty state, changed files, installations, and bridge artifacts.
  - The adjacent EpiphanyGraph React viewer is embedded in the Aquarium graph dashboard through the local package dependency; it consumes `graphs.architecture`, `graphs.dataflow`, and `graphs.links` directly and exposes node/edge/code-ref inspection with machine-readable graph data behind the visual layout.
  - Native `epiphany-rider-bridge` is the first operator-safe Rider source-context bridge: it inspects Rider installation/solution/VCS status, captures current file/selection/symbol context packets, plans explicit Rider code-ref opens, writes `.epiphany-gui/rider` artifacts, and feeds implementation prompt guardrails without reading sealed worker streams or owning durable state.
  - GitHub Issues should import into planning captures first, not directly into active objectives. The importer should preserve repository, issue number, ids, URL, title/body, labels, milestone, assignees, author, state, timestamps, comment metadata, PR marker, and optional Projects v2 metadata while keeping GitHub as an external source bridge rather than Epiphany's internal backlog model.
  - If the agent's persistent instructions, memory, workflow, or state shape are making it less coherent, slower to rehydrate, less honest, or more likely to build Jenga, the agent should ask the user to change it. A machine-spirit that knows its own corrosion must report it.
  - Epiphany should make compaction less like death and more like sleep: bank the fire before the dark, so the next waking thing finds coals instead of ash and can meaningfully resume the pattern instead of merely continuing the task.

landed_baseline:
  phases:
    - Phase 1: durable Epiphany thread state and rollout persistence.
    - Phase 2: prompt integration through rendered Epiphany state.
    - Phase 3: typed client read surface through `Thread.epiphanyState`.
    - Phase 4: hybrid retrieval plus explicit Qdrant indexing with BM25 fallback.
    - Phase 5: typed update/distill/propose/promote/read/notification control plane.
    - Phase 6: read-only view lenses for scene, job/progress, roles, planning, current-context pressure, reorientation policy, CRRC, and coordinator; separate freshness with watcher-backed invalidation inputs, targeted context, and graph traversal query surfaces; plus durable investigation checkpointing for compaction-safe planning, a thin launcher seam in durable job bindings, explicit launch/interrupt authority over that seam, and a bounded reorient-guided worker launch surface.
    - Phase 6 read-back: read-only reorient-worker result reflection through `thread/epiphany/reorientResult`.
    - Phase 6 acceptance: explicit reorient-worker finding acceptance through `thread/epiphany/reorientAccept`.
    - Phase 6 dogfood view: first CLI operator status over scene/pressure/reorient/jobs/result/CRRC.
    - Phase 6 dogfood runner: old Python runner cut; replacement must be native Rust/CultCache/CultNet and complete typed runtime-spine job results from heartbeat-owned turns.
    - Phase 6 role ownership: read-only `roles` view lens over implementation, modeling/checkpoint, verification/review, and reorientation lanes.
    - Phase 6 role specialists: explicit `thread/epiphany/roleLaunch` and read-only `thread/epiphany/roleResult` templates for modeling/checkpoint and verification/review.
    - Phase 6 modeling role acceptance: explicit `thread/epiphany/roleAccept` for reviewed modeling/checkpoint `statePatch` findings that can grow graphs/frontier/checkpoints through the existing state validator.
    - Phase 6 coordinator: read-only `coordinator` view lens plus native `epiphany-mvp-coordinator` and smoke coverage for the fixed-lane MVP loop.
    - Phase 6 safe-boundary CRRC automation: turn-complete automation limited to coordinator-approved compact, successful pre-compaction handoff compact, and fixed reorient-worker launch actions.
    - Phase 6 pre-compaction checkpoint intervention: token-count pressure hook that steers active turns once when `shouldPrepareCompaction` is reached so working context is banked before compaction, then latches a pending compact handoff for clean turn completion.
    - Phase 6 Aquarium extraction: the Tauri v2 + React/WebGL operator console moved from embedded `apps/epiphany-gui` into sibling repo `E:\Projects\EpiphanyAquarium`, with its own distilled interface state, memory, doctrine, build, visual smoke, and Tauri check.
    - Phase 6 Unity runtime bridge: native `epiphany-unity-bridge` plus GUI Inspect Unity action resolve pinned Unity editors, reject wrong/missing versions, and write runtime artifacts before engine assumptions are treated as testable.
    - Planning substrate design provenance: `notes/archive/epiphany-planning-substrate.md` formalizes conversation capture, inbox, backlog, roadmap streams, objective drafts, explicit adoption, the Imagination planning role, and GitHub Issues import.
    - Phase 6 planning substrate runtime slice: typed planning state in `EpiphanyThreadState`, prompt rendering, revision-gated update validation, read-only `planning` view lens, scene action reflection, generated schemas, and live planning smoke coverage.
    - Phase 6 GUI planning operator slice: MVP status and Tauri/React GUI render planning state; old Python GUI action shims have been cut from EpiphanyAgent.
    - Phase 6 Imagination role lane: the `roles` view lens exposes Imagination/planning, `roleLaunch` can launch the fixed `planning-synthesis-worker`, `roleResult` projects its finding, `roleAccept` applies planning-only patches with review-gated Objective Drafts, and the GUI/status tools can launch, read, and accept that lane.
    - Phase 6 Aquarium graph and Rider bridge slice: the Tauri/React/WebGL Aquarium embeds the adjacent EpiphanyGraph viewer over typed graph state, native `epiphany-rider-bridge` writes Rider/source-context artifacts, Aquarium Inspect Rider surfaces those artifacts, and `integrations/rider` scaffolds the first frontend-only Rider tool-window/context-action plugin.
    - Phase 6 role self-memory slice: local organ-state records live in typed CultCache `state/agents.msgpack`, specialists may request bounded `selfPatch` lane-memory mutations, coordinator review projects acceptance/refusal reasons through `selfPersistence`, and GUI/coordinator accept paths apply accepted requests with the native `epiphany-agent-memory-store` binary.
    - Phase 6 Persona public-surface slice: Persona's typed organ-state record, Persona prompt text, `state/persona-discord.toml`, the native `epiphany-persona-discord` persona/webhook pipe, `state/void-memory.toml`, and the native `epiphany-void-memory` bridge establish Persona as the public #aquarium-only translator of Epiphany agent thought-weather, with Void-derived Discord memory/search/presentation organs but without VoidBot's moderation authority.
    - Phase 6 character-loop slice: native `epiphany-character-loop` loads any role's typed organ-state record from `state/agents.msgpack`, combines it with a visible stimulus, builds typed projection/appraisal/reaction seeds from the shared heartbeat cognition structs, and emits an auditable `epiphany.character_turn_packet.v0` local projection for response, bubble, finding, silence, or bounded `selfPatch`. Persona is the first intended public-surface consumer; Ghostlight is reference material, not a runtime dependency.
    - Phase 6 heartbeat initiative slice: `state/agent-heartbeats.msgpack`, `epiphany-core::EpiphanyHeartbeatStateEntry`, the native `epiphany-heartbeat-store` binary, and heartbeat smoke coverage borrow Ghostlight initiative scheduling so Self, Persona, Imagination, Eyes, Modeling, Hands, and Soul compete for heartbeat slots; idle slots become bounded rumination instead of fake project work, and sleep/dream cycle passes emit Continuity protocol receipts rather than waking a Continuity persona. The live state surface now ticks/completes/pumps/applies heartbeat physiology through typed CultCache MessagePack instead of JSON or Python wrapper state. Role personality and current mood/anxiety both shape initiative recovery through personality, mood, and effective cooldown multipliers, so Hands-like work pressure and anxious high-need lanes can recover sooner without waking lanes whose previous turn is still running. Adaptive pump pressure controls tempo and concurrency: calm can launch zero and sleep slow; alarm can fill most active lanes. The same store can now initialize a `ghostlight-scene` profile for character scene turns.
    - Phase 6 cognition-lanes/Void routine slice: native `epiphany-heartbeat-store routine` rebuilds VoidBot-style sleep, resonance, incubation, parallel analytic/associative thought lanes, bridge judgment, candidate interventions, Ghostlight-style participant-local thought appraisal, derived reactions, dream maintenance, and mood/anxiety timing inside Epiphany's heartbeat store. It now also carries Void's anti-loop organs: split `noveltyToSelf`/`noveltyToRoom`, source coverage, saturation pressure, refractory cooling, and explicit permission to let a live unsaturated thought deepen without forced novelty theater. It reads typed organ-state records from `state/agents.msgpack`, projects clustered thought state through each role's personality vectors, updates `state/agent-heartbeats.msgpack`, and emits an auditable `epiphany.void_routine.v0` receipt without importing VoidBot or granting speech/project authority. `epiphany-character-loop` also carries the same cognition lane/bridge/appraisal contract for role-local actor turns; reactions may pace, color, draft, or display behavior, but state mutation remains on reviewed `selfPatch` or project-state surfaces.
    - Native runtime spine slice: `epiphany-core::EpiphanyRuntimeIdentity`, `EpiphanyRuntimeSession`, `EpiphanyRuntimeJob`, `EpiphanyRuntimeJobResult`, and `EpiphanyRuntimeEvent` plus the native `epiphany-runtime-spine` binary establish a CultCache-backed spine, native job/result lifecycle, status projection, and framed CultNet hello output so the old Codex app-server runtime can be starved down to a temporary evacuation bridge instead of remaining the throne.
    - Native repo personality scout/birth-distiller packet slice: `epiphany-repo-personality` emits typed terrain reports, repo personality profiles, and role personality projections for the embodied sub-agent lanes from deterministic repo inventory and git-history scoring, then renders a birth-only Repo Personality Distiller specialist packet and prompt for review-gated initial personality quirk petitions; `epiphany-repo-personality-smoke` proves scout/project/agent-packet/status over tiny local repos.
    - Native repo trajectory scout/birth-distiller packet slice: `epiphany-repo-personality` now also emits typed `repo_trajectory_report` documents from early-history, recent-history, doctrine/content excerpts, and deterministic theme scoring, then renders a birth-only Repo Trajectory Distiller packet so newborn swarms can inherit historical direction, self-image, implicit goals, and anti-goals without confusing those with active objectives.
    - Native repo memory scout/birth-distiller packet slice: `epiphany-repo-personality memory-packet` renders a separate Repo Memory Distiller prompt/packet with bounded source excerpts and role-specific distiller briefs, so a newborn swarm can be prefilled with mission-relevant doctrine, maps, research, implementation habits, verification practice, and continuity rules without confusing memory with personality.
    - Native repo birth startup valve slice: `epiphany-repo-personality startup`, `epiphany-repo-birth-runner`, and `accept-init` make trajectory/personality/memory birth packet generation, startup-only execution, and acceptance one-shot and review-gated through typed initialization records; generated packets advertise startup-runner ownership rather than heartbeat-lane identity; the birth runner has plan/run modes over typed model-runtime requests by default, writes prompts, schemas, runtime requests/receipts, logs, result files, and accept commands, and no longer offers the old Codex CLI executor fallback; `accept-init` processes distiller result `selfPatch` candidates through the native agent-memory review/apply path, stamps reviewed `repo-personality` canonical trait bundles through the native agent-memory store, and applies reviewed `repo-personality` heartbeat seeds through the typed heartbeat store; smoke proves first startup emits packets, birth runner plan artifacts exist, canonical trait bundles replace newborn baseline placeholders, heartbeat physiology mutates, reviewed memory output mutates a copied role memory store, and post-accept startup continues without regeneration.
  guardrails:
    - Use focused Rust app-server mapper/handler tests plus matching native `epiphany-core` smoke binaries before modifying update, distill, propose, promote, read-projection, or notification behavior. The old Python smoke shims have been cut.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-scene-smoke` before modifying scene projection behavior.
    - Use focused `cargo test -p codex-app-server --lib map_epiphany_jobs` before modifying job/progress reflection behavior.
    - Use focused Codex Rust tests before modifying launch/interrupt authority over the thin job seam.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-freshness-smoke` before modifying freshness reflection behavior.
    - Use focused Rust app-server invalidation/freshness tests before modifying watcher-backed invalidation behavior inside freshness reflection; add a native smoke before broadening that surface.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-context-smoke` before modifying targeted context-shard behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-graph-query-smoke` before modifying graph traversal behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-planning-smoke` before modifying planning state or the read-only planning projection.
    - GUI Objective Draft adoption now belongs to the Aquarium repo; verify there rather than through deleted EpiphanyAgent Python shims.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-pressure-smoke` before modifying context-pressure reflection behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-phase6-reorient-smoke` before modifying bounded CRRC reorientation policy behavior.
    - Use focused app-server/core Rust checks before modifying the bounded reorient-guided worker launch/result/CRRC coordinator surfaces.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-mvp-status-smoke` before modifying the MVP operator status view.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-bifrost-bridge-status-smoke` before modifying Bifrost bridge readiness readback.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-persona-bridge-smoke` before modifying Persona outside-world bridge mouth behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-mvp-coordinator-smoke` before modifying the fixed-lane MVP coordinator endpoint or runner.
    - Use `cargo test --manifest-path .\epiphany-core\Cargo.toml --lib runtime_spine -- --nocapture` and `cargo build --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-runtime-spine` before modifying native runtime-spine state or CultNet hello emission.
    - Use focused app-server/core Rust checks before modifying explicit role launch/read-back/acceptance behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-agent-memory-store -- smoke --store .\state\agents.msgpack` before modifying organ self-memory records or `selfPatch` persistence policy.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-heartbeat-store -- smoke --agent-store .\state\agents.msgpack` before modifying heartbeat initiative timing, idle rumination, or role slot selection.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-repo-personality-smoke` before modifying repo trajectory/personality terrain scoring, birth packet shape, startup-init routing, source excerpt selection, or role-specific initialization memory contracts.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-persona-discord -- smoke` before modifying Persona's #aquarium posting/draft guardrails.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-void-memory -- smoke` and `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-void-memory -- status` before modifying Void memory bridge behavior.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-unity-bridge-smoke` before modifying the Unity editor/runtime bridge.
    - Use `cargo run --manifest-path .\epiphany-core\Cargo.toml --bin epiphany-rider-bridge-smoke` before modifying the Rider source-context bridge.
    - Do not claim live specialist execution works end to end until a native heartbeat/runtime-spine runner proves it with artifacts.
    - Use `npm run build`, `npm run smoke:visual`, `cargo fmt --check`, `cargo check`, and `npm run tauri -- build --debug --no-bundle` under `E:\Projects\EpiphanyAquarium` before claiming Aquarium operator changes are usable.
    - Use focused scene/jobs/context/pressure/reorient/protocol/schema checks for reflection-only changes.
    - Use the native `epiphany-prepare-compaction` binary before and after imminent-compaction persistence passes.
    - Use `CARGO_TARGET_DIR=C:\Users\Meta\.cargo-target-codex` for Codex Rust work on this Windows machine.
    - Do not parallelize cargo builds/tests against the same target directory.

rejected_paths:
  - name: pinned_map_only
    reason: still one token stream with no typed write semantics
  - name: train_new_base_model_first
    reason: too expensive for a first falsifiable experiment
  - name: third_party_opencodex_forks_as_primary_gui_base
    reason: audited candidates were terminal-only, stale/aspirational, or incoherent wrappers
  - name: monolithic_json_vector_store
    reason: large embedding stores that rewrite whole files thrash and hide storage pain until it dominates the system
  - name: append_only_persistent_notes
    reason: persistent state that accumulates every local truth becomes memory cruft and weakens rehydration
  - name: cleaner_codex_host_as_final_architecture
    reason: making Epiphany cleaner inside Codex still preserves the wrong organ; Codex must be starved down to OpenAI subscription auth/model transport, while Epiphany data and subsystem communication move to typed CultCache/CultNet.

current_status:
  summary: Epiphany state, prompts, coordinator policy, runtime spine, receipts, and operator surfaces are native typed Rust/CultCache/CultMesh/CultNet organs. Vendored Codex retains Codex-native app-server plus OpenAI-compatible auth/model transport only. Canonical state has one transaction owner and one coordinator store boundary; native status/coordinator JSON emits `state`, and the extinct Codex Epiphany routes, DTOs, bridge, migration, and compatibility field cannot decide or describe native truth.
  latest_cut: >
    The bridge host seam has been cut down: target-specific Hands prompt scar
    tissue was purged, bridge manifests carry the retained Codex websocket fork
    patches, runtime-result acceptance no longer takes a whole CodexThread,
    retrieval accepts workspace/Codex-home paths, invalidation uses Epiphany's
    own notify watcher, live rollout/thread reads moved into vendored
    app-server `epiphany_thread_host`, and mutation policy now depends on the
    small `EpiphanyMutationHost` capability trait. Unused OpenAI bridge
    reexports were cut; bridge durable-state imports now point at
    `epiphany-state-model`; Codex token usage rollout replay moved back into
    app-server; token telemetry crosses the wall as
    `EpiphanyTokenUsageSnapshot`; and `CodexErr` was replaced with
    `EpiphanyBridgeError`. The first protocol-starvation cuts are landed:
    freshness now returns a serializable `EpiphanyFreshnessSurface`, job
    launch/interrupt bridge results carry typed `EpiphanyJobView` plus host-edge
    launcher metadata, and reorient/pre-compaction decisions consume typed
    `EpiphanyPressure`. Reorient policy now consumes typed freshness directly,
    reorient launch documents are built from typed core decisions, reorient
    launch mutation results return typed decision/state-status values from the
    bridge, and core reorient decisions are serializable CultNet-ready state.
    Reorient decisions, coordinator decisions, coordinator source signals, CRRC
    recommendations, role-board lanes, and core role/reorient result
    interpretations now remain serializable typed surfaces; app-server still
    projects those typed surfaces into `ThreadEpiphany*` responses at the legacy
    JSON-RPC edge. Runtime-result loading now has core typed snapshot APIs, with
    protocol finding tuples retained only as legacy wrappers; coordinator
    policy now consumes those typed result snapshots directly for role and
    reorient acceptance/gating signals. Delete the duplicate protocol-shaped
    result rendering once acceptance and view response edges finish moving off
    protocol finding authority. Role/reorient acceptance now builds receipts
    and evidence from core typed findings, mapping to protocol findings only for
    legacy accept response cargo. The duplicate protocol-shaped result helper
    layer has been deleted, and result view responses now project directly from
    typed runtime result snapshots instead of protocol tuple wrappers; the tuple
    wrappers themselves are gone. Role acceptance now produces a core
    `EpiphanyStateUpdate`; `ThreadEpiphanyUpdatePatch` is retained there only as
    legacy accept-response projection. Role-board derivation now consumes core
    pressure directly instead of `ThreadEpiphanyPressure`. Job reflection now
    stays core-shaped inside the bridge as `EpiphanyJobView`; role-board and
    view assembly consume those typed job documents, and `ThreadEpiphanyJob` is
    projected only at legacy response edges. Context and graph-query derivation
    now receive core `EpiphanyContextParams` / `EpiphanyGraphQuery` documents;
    Codex `ThreadEpiphany*` request DTOs are converted before the core graph
    policy is invoked. Role/reorient acceptance service results now return core
    finding interpretations and typed role-state patches; app-server projects
    them into legacy accept-response DTOs. Generic update/promote service entry
    points now take typed `EpiphanyRoleStatePatchDocument` documents; app-server
    converts `ThreadEpiphanyUpdatePatch` request cargo at the JSON-RPC edge.
    Changed-field authority is now native `EpiphanyStateUpdatedField` in
    `epiphany-core`; app-server projects it into
    `ThreadEpiphanyStateUpdatedField` only for legacy responses and
    notifications. Role launch, role accept, and role-result runtime lookup now
    use core `EpiphanyRoleResultRoleId` internally; app-server maps
    `ThreadEpiphanyRoleId` at the request/response edge. Reorient launch
    service results now use typed `Epiphanysurfacesource`; app-server maps that
    to `ThreadEpiphanyReorientSource` only for the legacy response. Generic job
    launch now converts protocol `ThreadEpiphanyWorkerLaunchDocument` cargo at
    the app-server edge before building the core `EpiphanyJobLaunchRequest`.
    Coordinator note rendering now consumes core CRRC/coordinator actions,
    pressure, and role/reorient result statuses instead of protocol
    `ThreadEpiphany*` action/status DTOs, so prompt/text policy no longer
    treats JSON-RPC enums as its native fact shape. Role-board note rendering
    now consumes the core reorient state status too; `ThreadEpiphanyReorientStateStatus`
    is response projection only, not prompt/text policy input. Context and graph-query
    response builders now receive core `EpiphanyContextParams` /
    `EpiphanyGraphQuery`; app-server read routes convert JSON-RPC request cargo
    before invoking the bridge. Role-result response assembly now takes core
    `EpiphanyRoleResultRoleId` and maps back to `ThreadEpiphanyRoleId` only
    while shaping the legacy JSON-RPC response. Distill response assembly now
    consumes core `EpiphanyDistillInput`; the JSON-RPC distill params are
    converted before policy invocation. Role/reorient result response inputs
    now use core `Epiphanysurfacesource`; role-specific legacy source enums are
    created only during response projection. Changed-field derivation now
    inspects typed `EpiphanyRoleStatePatchDocument` directly instead of
    converting patches back through `ThreadEpiphanyUpdatePatch` projection.
    View-lens orchestration now uses bridge-native `EpiphanyViewLens` selectors;
    app-server converts `ThreadEpiphanyViewLens` at the request wall and the
    bridge maps back only for the legacy response `lenses` echo. Coordinator
    status derivation now receives core `EpiphanyCrrcResultStatus` for reorient
    result state instead of protocol `ThreadEpiphanyReorientResultStatus`.
    Coordinator view response assembly now receives core reorient state and
    role-board status, projecting `ThreadEpiphanyReorientStateStatus` /
    `ThreadEpiphanyRoleLane` only while building the legacy response. The next
    rude cut landed: coordinator status derivation is a typed `epiphany-core`
    seam (`EpiphanyCoordinatorStatusInput` -> `EpiphanyCoordinatorStatus`), so
    bridge code gathers runtime/acceptance facts but no longer owns the
    coordinator decision assembly. Coordinator finding signals now derive in
    core from typed modeling/verification/reorient findings plus
    `EpiphanyThreadState`, so accepted/reviewable/coverage/verdict/evidence
    sequencing facts are no longer bridge helper law. View lens selector
    semantics also moved into core: `EpiphanyViewLens`, default lens selection,
    and lens dependency planning now decide which host facts app-server/bridge
    need to load before Codex JSON-RPC response projection. The mistaken
    vendored app-server ownership of Epiphany request mapping was corrected:
    app-server now calls `epiphany-codex-bridge::protocol_edge`, while the
    bridge-owned protocol edge converts Codex JSON-RPC request DTOs into core
    `EpiphanyContextParams`, `EpiphanyGraphQuery`, `EpiphanyDistillInput`,
    `EpiphanyWorkerLaunchDocument`, and `EpiphanyRoleStatePatchDocument`.
    Vendored app-server no longer depends directly on `epiphany-core`.
    Reorient worker launch-request/document
    composition also moved behind a typed core seam
    (`EpiphanyReorientLaunchRequestInput` -> `EpiphanyJobLaunchRequest`);
    bridge supplies only the prompt instruction and retained compatibility
    binding/owner constants before performing host side effects.
    Freshness/job/reorient response projection moved out of vendored app-server
    into `epiphany-codex-bridge::protocol_edge`: app-server gathers host facts,
    invokes Epiphany bridge services, and sends Codex JSON-RPC responses, while
    the bridge owns the enum/DTO conversion from typed Epiphany surfaces into
    `ThreadEpiphany*` edge payloads.
    The duplicate job projection authority in `epiphany-codex-bridge::jobs`
    has been collapsed too: `jobs.rs` derives typed `EpiphanyJobView` only,
    and `protocol_edge::protocol_job_from_surface` is the single
    `EpiphanyJobView` -> `ThreadEpiphanyJob` mapper.
    Runtime result loading is now typed-only at its module boundary:
    role/reorient result status projection moved from `runtime_results` and
    duplicate coordinator helpers into `protocol_edge`, so coordinator/view
    response builders share the same Codex JSON-RPC status mapper.
    Pressure projection is centralized at the same edge: `pressure.rs` derives
    typed `EpiphanyPressure`, coordinator consumes typed pressure signals, and
    `protocol_edge` owns the `EpiphanyPressure` /
    `EpiphanyPressureLevel` -> `ThreadEpiphanyPressure*` mapping.
    Reorientation derivation is now typed-only at its module boundary:
    `reorient.rs` no longer imports Codex app-server protocol DTOs, no longer
    exposes the unused freshness DTO tuple, and view/coordinator response
    builders use `protocol_edge` for reorient state/decision projection.
    Result finding, role-id, and patch projection are now edge-owned too:
    `results.rs` renders typed result notes only, while `protocol_edge` owns
    role-id request conversion plus role/reorient finding and state-patch
    projection for Codex JSON-RPC responses.
    State-updated notification projection also moved to `protocol_edge`:
    `mutation.rs` now owns typed mutation and acceptance mechanics without
    importing Codex app-server protocol DTOs.
    `pressure.rs` is typed-only now as well: the last convenience helper that
    returned `ThreadEpiphanyPressure` was deleted, and view response assembly
    explicitly derives typed pressure before calling `protocol_edge`.
    Coordinator projection has its own edge module now:
    `coordinator.rs` no longer imports Codex app-server protocol DTOs and owns
    typed coordinator status, CRRC recommendation input shaping, role-board
    derivation, automation verdict selection, and role-board note rendering;
    `coordinator_protocol.rs` owns Codex JSON-RPC projection for coordinator,
    CRRC, and role-board response payloads.
    Context/planning/graph derivation is split the same way:
    `context.rs` now returns typed `epiphany-core` view documents, while
    `context_protocol.rs` owns the Codex JSON-RPC tuple/projection cargo used by
    view/context/graph response builders.
    Scene derivation follows that boundary too: `scene.rs` now returns the
    typed core `EpiphanyScene`, and `scene_protocol.rs` owns projection into
    `ThreadEpiphanyScene` plus scene-action DTOs for view responses.
    Retrieval follows the boundary too: `retrieve.rs` executes normalization,
    indexing, state lookup, and typed retrieval responses; `retrieve_protocol.rs`
    owns Codex JSON-RPC retrieve/index response projection and absolute-path DTO
    validation.
    View response assembly no longer owns private lens/source/reorient-status
    projection helpers; those small enum conversions route through
    `protocol_edge`, and the Codex response assembler is now named
    `view_protocol.rs` instead of pretending to be the native Epiphany view
    model. The larger typed-view wall remains under judgment.
    The bridge still depends on vendored Codex for app-server protocol DTOs and
    absolute path validation, so the purification is not done.
    Runnability now has a thin operator entrypoint:
    `tools/epiphany_local_run.ps1` builds the retained Codex app-server
    compatibility edge, builds native Epiphany operator binaries, runs status,
    plan, smoke, live coordinator, or local MVP product-cycle modes, and writes
    launcher artifacts under `.epiphany-run/` plus coordinator evidence under
    `.epiphany-dogfood/`. `-Mode mvp` is the current Persona-front-door wrapper:
    it projects a typed Persona character turn, writes a local Persona/Aquarium
    bubble, bootstraps a minimal local checkpoint for fresh threads, runs the
    bridge-equipped coordinator loop with auto-tools, then invokes heartbeat
    sleep/dream maintenance unless explicitly skipped. That bootstrap now maps
    both the Persona/coordinator/sleep cycle and the coordinator-to-model-runtime
    transport seam, so model failures are attributed to provider/runtime
    transport instead of generic missing checkpoint state.
    Live plan/run/MVP modes use the workspace `state/runtime-spine.msgpack`,
    because CodexThread job launch writes typed worker requests there; the
    `.epiphany-dogfood/` runtime store shape is artifact evidence only unless
    CodexThread learns an explicit runtime-store override.
    This is scaffolding over the current compatibility shell, not a new policy
    owner.
    The former `epiphany.cultmesh.operator_status.v0` family is deleted because
    no observer owned it. Runtime-spine and prompt context expose only the
    source-derived operator snapshot and run-witness families.
    The next operator snapshot cut is landed: `epiphany-operator-snapshot`
    distills the operator-safe MVP status artifact into
    `epiphany.cultmesh.operator_snapshot.v0`, runtime-spine advertises that
    document as local-user writable, and `tools/epiphany_local_run.ps1 -Mode
    status` writes the snapshot after generating the legacy JSON status
    artifact. The schema describes the real CultCache tuple payload, not an
    object-shaped fantasy.
    Local operator runs now have typed intent/receipt rails too:
    `epiphany-operator-run` writes
    `epiphany.cultmesh.operator_run_intent.v0` before the local wrapper acts
    and `epiphany.cultmesh.operator_run_receipt.v0` after successful
    completion; `tools/epiphany_local_run.ps1 -Mode status` now writes intent,
    legacy status artifact, operator snapshot, and completion receipt in that
    order.
    The first native status cut is landed: `epiphany-mvp-status` has an
    explicit `--source native` mode that reads `state/thread-state.msgpack`
    when present and derives scene, pressure, jobs, roles, planning, reorient,
    CRRC, and coordinator status through `epiphany-core` instead of Codex
    JSON-RPC. `tools/epiphany_local_run.ps1 -Mode status` now builds only
    Epiphany operator binaries, does not start or require `codex-app-server`,
    and still writes operator intent, status artifact, snapshot, and completion
    receipt. Codex status remains as a compatibility source for legacy smokes
    and bridge-equipped coordinator paths, not the MVP status authority.
    The first provider-neutral runtime seam is landed too:
    `epiphany-openai-runtime` now also builds `epiphany-model-runtime`, whose
    CLI accepts `--provider openai-codex` and owns the current
    `model-turn`/`run-worker`/`smoke` executable contract. Coordinator run mode,
    the local wrapper, and repo birth runner now default to
    `--model-runtime-bin` plus `--model-provider`; old `--openai-runtime-bin`
    and `openai-runtime` executor names remain compatibility aliases. This
    does not make OpenAI generic internally yet: the current provider still
    uses typed OpenAI request/event/receipt documents through the Codex auth
    reliquary. The runtime default is `gpt-5.4` unless `EPIPHANY_MODEL` or
    `CODEX_MODEL` overrides it; `gpt-5.5` is currently blocked by the retained
    Codex-compatible transport as requiring a newer Codex client. It does move
    provider selection out of scheduler/status/state surfaces and into one
    runtime executable boundary.
    The provider-neutral model document seam is now landed:
    `epiphany-model-adapter` owns `epiphany.model_request.v0`,
    `epiphany.model_stream_event.v0`, `epiphany.model_receipt.v0`, and
    `epiphany.model_adapter_status.v0`; runtime-spine advertises those as the
    coordinator/model contract; and OpenAI request/event/receipt/status
    documents are read-only adapter evidence behind that boundary. The current
    `epiphany-model-runtime` still executes through the Codex/OpenAI provider,
    but model turns and worker launches now enter through provider-neutral
    requests, store provider-neutral events/receipts, and mirror OpenAI docs
    only as transport proof.
    Coordinator plan/run output now has a typed receipt too:
    `epiphany.coordinator_run_receipt.v0` is registered in runtime-spine,
    advertised in the CultNet schema catalog, and written by
    `epiphany-mvp-coordinator` at the end of plan/run/smoke passes. The
    existing coordinator artifact JSON remains operator display and sealed
    audit evidence, but it is no longer the only durable account of what the
    coordinator decided.
    The first tool/MCP boundary contract and quarantined execution spine are
    named:
    `epiphany-tool-adapter` owns typed `epiphany.tool_capability.v0`,
    `epiphany.tool_invocation_intent.v0`, and
    `epiphany.tool_invocation_receipt.v0` documents. Runtime-spine advertises
    them as the Epiphany-facing tool contract so MCP discovery/call JSON can
    remain protocol-edge cargo instead of scheduler, state, or acceptance
    authority. `epiphany-tool-codex-mcp-spine` is the temporary executing
    quarantine: it loads one typed invocation intent from CultCache, calls
    user-declared Codex MCP through `codex-mcp`, and writes a typed invocation
    receipt. It depends on Codex MCP/config/OAuth machinery as transport
    scaffolding only; it does not own Epiphany scheduler policy, prompt
    authority, durable state, or future provider shape. The future Heimdall or
    native tool-auth spine can replace this adapter without changing the
    Epiphany-facing intent/receipt contract. `epiphany-model-runtime` now
    materializes complete MCP-shaped model tool calls as typed tool invocation
    intents, and the Codex MCP spine can consume those intents from the mixed
    runtime-spine store and emit typed success/failure receipts.
    Epiphany agent launch/prompt authority has now been pulled out of the
    bridge as well: `epiphany-core::agent_launch` owns specialist prompt
    parsing/rendering, role/reorient launch instructions, role binding ids,
    output schemas, coordinator note rendering, and CRRC pre-compaction prompt
    rendering. The bridge `launch.rs` is a compatibility facade, and bridge
    pressure rendering delegates back to core. Vendored app-server no longer
    carries the bundled prompt regression test; that guard lives beside the
    core prompt owner.
    The fixed Research/Eyes lane is now part of the typed MVP spine:
    `EpiphanyRoleResultRoleId::Research`, Research launch binding/owner/schema,
    role-board lane, coordinator `LaunchResearch` / `ReviewResearchResult`
    actions, status/coordinator CLIs, Codex bridge projection, and vendored
    app-server protocol schemas all know the lane. The Research statePatch law
    permits only Eyes evidence/observation/scratch/investigationCheckpoint
    cargo and rejects modeling/planning/graph/checkpoint authority. MVP status
    and coordinator smokes pass with six lanes, and the smoke harness now
    rebuilds stale coordinator/app-server binaries before using them.
  - `tools/epiphany_local_run.ps1 -Mode service-execution-runbook` is the repeatable elevated Windows service proof artifact generator. It writes a non-mutating `#Requires -RunAsAdministrator` PowerShell runbook containing the exact `service-execution-readiness`, `service-install-execute`, `service-start-execute`, `service-status`, `service-reconcile`, `service-stop-execute`, final `service-status`, and `service-execution-audit` wrapper calls, so the remaining elevated service proof can run through typed operator and lifecycle receipts instead of improvised `sc.exe` rites. The artifact now uses `Invoke-EpiphanyRunbookStep` to reset `$LASTEXITCODE`, catch thrown/nonzero failures, continue gathering receipts after a failed step, run final `service-execution-audit` in `finally`, and exit nonzero only after audit if any step failed. Generated child execution runbooks no longer use `Invoke-Expression`; each step invokes the known wrapper `ScriptPath` with an explicit `Arguments` array, making the elevated command surface inspectable and robust to path quoting. Direct wrapper summaries print the exact `elevatedCommand=Start-Process PowerShell -Verb RunAs -Wait ...` invocation, `artifactSha256=<hash>`, and `aftercare=tools/epiphany_local_run.ps1 -Mode service-execution-audit`; live proof `local-20260619-010940-287-a36a3df3` showed the command plus hash `2c763b6d3ba735dfde500d5b2e6fd71c872169668d43cbd637f41952e9ca5403` for the supervisor-service artifact without mutating the service manager.
  - `epiphany-daemon-supervisor windows-service-execution-audit` and `tools/epiphany_local_run.ps1 -Mode service-execution-audit` are the post-run service proof verifier. The audit scans typed `epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` documents for a service, first requires the sealed `windows-service-execution-runbook` receipt as the non-mutating preflight witness, then checks readiness/install/start/status/reconcile/stop receipt statuses, requires private-state sealing, writes its own `windows-service-execution-audit` lifecycle receipt, and returns `complete` only when the runbook plus elevated effect receipts prove the chain. Audit check rows now retain `operatorArtifactRef` from lifecycle receipts, so runbook witnesses can be identified without opening raw receipt payloads. `service-execution-audit-smoke` now writes synthetic sealed lifecycle receipts to prove the audit accepts a complete chain and then rejects a drifted reconcile receipt. Live wrapper proof `local-20260618-133559-466-6644f26f` reported the runbook witness as `written` and OK while six elevated effect receipts remained missing, preserving the elevated authority boundary.
  - `epiphany-verse-query poke-down-daemons` and `tools/epiphany_local_run.ps1 -Mode swarm-poke-down` are the typed swarm responsibility reflex: inspect local Verse daemon status rows, write daemon poke intent/receipt documents for every non-ready daemon, respect the `daemon.lifecycle_poke` swarm brake, include target display name/body domain/private Verse id/Eve surface metadata from cluster topology in the operator-safe poke summary, and expose no private state. Compact poke rows now print each poke target, daemon id, observed status, body domain, private Verse, Eve surface, intent id, receipt id/status, resulting status, and `private=false`; live wrapper proof `local-20260618-180548-293-ff73f9de` temporarily degraded Hands, printed one topology-aware receipt row, and restored Hands to ready; follow-up swarm status proof `local-20260618-180618-002-06e77583` reported seven ready daemons and zero non-ready rows. `epiphany-verse-query smoke` source-proves both the ready no-op and degraded single-poke compact row path.
  - `epiphany-verse-query swarm-status` and `tools/epiphany_local_run.ps1 -Mode swarm-status` provide the compact read-only liveness sight organ over local Verse daemon rows. It uses a narrow CultMesh daemon-liveness loader instead of serializing the full local Verse context, returns seven agent-friendly TUI rows with `READY`/`POKE`, daemon id, body domain, private Verse id, Eve surface, `followUp=tools/epiphany_local_run.ps1 -Mode swarm-poke-down`, and `private=false`, and exposes no private state. Live wrapper proof `local-20260618-210235-584-110d1120` printed all seven Rust-owned `READY` rows in `statusRows` with body domain, private Verse ids, Eve surfaces, batch poke follow-up, and `private=false`; source smoke also proves degraded Hands returns a `POKE` row with `privateVerse=epiphany.cluster.hands.private` plus the same follow-up command.
  - `epiphany-verse-query eve-surfaces` and `tools/epiphany_local_run.ps1 -Mode eve-surfaces` provide the compact read-only Odin/Eve surface directory over local Verse rows. Odin reads cluster topology, default advertisements, and daemon-owned Eve surface states through a narrow CultMesh loader; it returns seven agent-friendly TUI rows, one Persona public discussion surface, a `connect-eve` command hint, and `privateStateExposed=false` without serializing the full local Verse. The compact TUI rows expose stable `cluster=<id>` identity beside surface id, daemon id, body domain, private Verse id, public-discussion flag, supported actions, exposed document types, advertisement id, and `private=false`; wrapper proof `local-20260618-225347-287-ea5d7476` prints all seven rows in `surfaceRows`, including Persona's public discussion surface and all local organ surfaces, plus `privateStateExposed=False`.
  - `epiphany-verse-query connect-eve` and `tools/epiphany_local_run.ps1 -Mode eve-connect` provide the compact Odin-to-Eve collaboration receipt. The command selects the daemon-published surface through the narrow Eve directory, writes connection intent/receipt documents, verifies latest receipt keys through narrow CultMesh loaders, defaults the wrapper target to `epiphany.cluster.persona`, and exposes no private state.
  - `epiphany-verse-query collaboration-feedback` and `tools/epiphany_local_run.ps1 -Mode collaboration-feedback` provide the public Persona feedback to Imagination consensus receipt path. The wrapper records the prerequisite Eve connection receipt, writes feedback plus Imagination consensus receipt documents, verifies latest keys through narrow CultMesh loaders, publishes follow-on command hints for wrapper feedback, Eve connection, direct Bifrost publication, and wrapper Bifrost publication, and exposes no private state. The command returns compact TUI rows for the feedback and Imagination consensus receipt with explicit `owner=Persona->Imagination` / `owner=Imagination`, `public=<ref>`, candidate action refs, consensus packet ref, adoption gate, and `private=false`; wrapper proof `local-20260618-224207-941-2ca01b41` prints both rows in `feedbackRows`, including Persona public discussion feedback routed to Imagination consensus discovery before Mind/Bifrost adoption.
  - `epiphany-verse-query bifrost-publication` and `tools/epiphany_local_run.ps1 -Mode bifrost-publication` provide the non-mutating Bifrost body-change publication proof path. It writes Bifrost intent, Bifrost publication receipt, and GitHub publication receipt documents from explicit review/verification/credit inputs, verifies latest keys through narrow CultMesh loaders, publishes follow-on command hints for swarm overview, tool directory, and wrapper Bifrost publication readback, and exposes no private state.
  - `epiphany-verse-query bifrost-ledger` and `tools/epiphany_local_run.ps1 -Mode bifrost-ledger` provide the compact Bifrost ledger sight organ. It reads only the latest Bifrost body-change intent, Bifrost publication receipt, GitHub publication receipt, public-proof publication receipt, artifact-acceptance receipt, metrics receipt, repo-work readiness-review receipt, collaboration feedback, Imagination consensus receipt, and Mind-admitted repo-work map entries through narrow CultMesh loaders, returns agent-friendly ledger TUI rows, publishes follow-on command hints for swarm overview, tool directory, collaboration feedback, Bifrost publication, artifact acceptance, metrics, and ledger readback, and exposes no private state. Compact ledger rows carry explicit `owner=<organ>`, `public=<ref>`, and `private=false`, so body-change/public-feedback proof is inspectable without opening raw local Verse payloads or inferring authority from document names. Bifrost ledger readback derives six `BIFROST-ACCOUNTING` rows for `body-change-publication`, `public-proof-publication`, `repo-work-readiness-review`, `artifact-acceptance-request`, `metrics-request`, and `collaboration-consensus`, with closure status, ledger/receipt/public refs, review and credit receipt counts, artifact count, and private-state seal. Readiness-review accounting closes only when latest `epiphany.cultmesh.repo_work_readiness_review.v0` has four Maintainer/Soul/Mind/Bifrost review refs, readiness approval, zero missing required rows, present review artifact, and no durable-state/publication/merge/sync/deployment/service/Hands/private authority. Artifact-acceptance and metrics request rows are `open` when only Mind-admitted request map entries exist, and close only from typed Bifrost/Maintainer receipts: `epiphany-verse-query bifrost-artifact-acceptance` writes `gamecult.bifrost.artifact_acceptance_receipt` from explicit artifact/public-proof/ledger/review refs, while `epiphany-verse-query bifrost-metrics` writes `gamecult.bifrost.metrics_receipt` from explicit accepted-artifact, model-spend, review-load, credit-readback, public-proof, and metrics summary refs. Wrapper modes `bifrost-artifact-acceptance` and `bifrost-metrics` expose the same closure rites. Focused smokes `.epiphany-smoke\repo-artifact-acceptance-request-family-20260621-130520` and `.epiphany-smoke\repo-metrics-request-family-20260621-130635` now prove request rows open first and then close from final Bifrost receipts without private-state exposure; wrapper proof `local-20260621-140740-750-2815f6f7` printed the closed metrics row from the repo-local Verse target. `epiphany-repo-bifrost-accounting-bundle-smoke` consumes the closed request-family summaries as an operator-safe aggregate proof, and `tools/epiphany_local_run.ps1 -Mode bifrost-accounting-bundle` now wraps that verifier with optional exact summary path inputs and the normal operator run receipts. Wrapper proof `local-20260621-142716-268-d6bc58b4` built the verifier, emitted bundle `.epiphany-smoke\repo-bifrost-accounting-bundle-20260621-132815`, and verified artifact acceptance and metrics close statuses, final Bifrost receipt ids, closed accounting rows, `planningAuthorityOnly=true`, and `privateStateExposed=false`. `epiphany-daemon-survival-rehearsal-smoke` now proves Idunn's bounded `serve` physiology can consume a durable restart policy, run two scheduler pulses, write scheduler receipts, and keep service-manager mutation/elevation/private-state exposure false; wrapper proof `local-20260621-145723-011-1175e273` emitted `.epiphany-smoke\daemon-survival-rehearsal-20260621-135723` with `serveIterations=2` and scheduler receipt `daemon-scheduler-receipt-epiphany-daemon-survival-rehearsal-2`. `epiphany-repo-swarm-mvp-gate-smoke` now consumes the fresh-repo MVP, repo-work readiness, Bifrost accounting-bundle, Idunn deployment handoff, daemon survival, Weksa interlingua, and Persona semantic memory recall proofs as one operator-safe MVP gate report; direct proof `.epiphany-smoke\repo-swarm-mvp-gate-20260621-174742` reports `demoReady=true`, `mvpReady=false`, fifteen green gates, one Idunn elevated-service warning gate, zero blockers, `personaMemoryRecall.cacheStatus=qdrant-unavailable`, `personaMemoryRecall.status=fallback`, `personaMemoryRecall.dynamicCacheStatus=qdrant-unavailable`, `personaMemoryRecall.dynamicRecallWired=true`, `personaMemoryRecall.heartbeatRecallWired=true`, Projector/Persona/output-triggered Interpreter prompt coverage, and `privateStateExposed=false`. Repo Persona intake now records both pre-turn semantic recall and `interpreterDynamicRecall` from candidate SAY meaning; this matches VoidBot's two-pass Projector/Face/Interpreter memory membrane while preserving the scaffold seal that repo-intake is not yet a full autonomous model Persona turn.
  - `epiphany-verse-query receipt-directory` and `tools/epiphany_local_run.ps1 -Mode receipt-directory` provide the compact latest-witness directory over local Verse. It indexes operator run, daemon poke, daemon tool invocation, Eve connection, Bifrost publication, Imagination consensus, coordinator run, Hands gate, role review, work-loop, cluster service lifecycle, single-service lifecycle, cluster service execution runbook, single-service execution runbook, scheduler, Persona speech, and agent-state SoA witness families from typed local Verse projections; returns agent-friendly `OK`/`ABSENT`/`ATTN` TUI rows with owner, family, status, route, latest id, follow-up command, `presentRowCount`, and `absentRowCount`; preserves `missingRowCount` as compatibility for absent witnesses; flags sealed service lifecycle failure states such as `not-elevated`, `execution-refused-not-elevated`, and `incomplete` as attention without exposing receipt payloads; routes service lifecycle receipts by their typed receipt action through `service_execution_check_follow_up_command` (readiness to readiness, install to install execute, start/stop to control execute, status/reconcile to their readback rites, audit to audit), while cluster/single execution-runbook witnesses route to their runbook regeneration wrappers; and exposes no private state or receipt payload previews. The lifecycle projection now reads the typed receipt family, splits `cluster-service-lifecycle` from `service-lifecycle`, selects the latest attention receipt before falling back to latest overall, and exposes `service-id::action` route values such as `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit`, so agents can see the owning lifecycle action without opening raw audit JSON. Compact receipt TUI rows append `followUp=<command>`, artifact status, and SHA-256; wrapper proof `local-20260618-205920-451-383b0da7` now prints all seventeen compact rows in `receiptRows`, including missing Hands/role/work-loop gates, runbook hashes, scheduler follow-up, Bifrost/Imagination witnesses, and the active service lifecycle attention rows. It also exposes `cluster-service-execution-runbook` plus `service-execution-runbook` as display-only rows, so newer harmless planned/runbook lifecycle receipts cannot hide the active seven-service cluster wound. Receipt-directory JSON now carries Rust-owned `attentionRouteRows` derived from the same policy predicate as `attentionRowCount`, and the wrapper prints that field instead of rebuilding attention from ad hoc status strings; source smoke now proves a `cluster-windows-service-execution-readiness` receipt routes to `cluster-service-execution-readiness` and wrapper mode `cluster-service-execution-readiness` instead of laundering the row through audit. Live proof `local-20260618-212134-758-c7c56240` left the old degraded Hands daemon-poke receipt as an `OK` historical witness while attention routes named only the cluster and single-service lifecycle wounds. Daemon-poke rows now resolve historical receipt status against current daemon liveness: source smoke proves degraded remains degraded before heartbeat recovery and becomes `resolved` after current status returns ready, while live wrapper proof `local-20260618-212649-563-48647018` printed the old Hands poke receipt as `OK | Self | daemon-poke | resolved`.
  - `tools/epiphany_local_run.ps1 -Mode service-tick` is the wrapper-owned daemon scheduler pulse rite. It runs `epiphany-daemon-supervisor tick` through the same local Verse store, operator run intent/receipt, agent-state SoA refresh, and swarm-brake preflight as other service lifecycle modes, but leaves restart authority inside durable daemon restart policies. The receipt directory scheduler row now follows up with `tools/epiphany_local_run.ps1 -Mode service-tick` instead of passive service status. Proof seeded one disabled Persona restart policy as inert policy metadata, then the wrapper wrote `daemon-scheduler-receipt-epiphany-daemon-supervisor-0` with `status=tickComplete`, `outcomeCount=1`, `skippedCount=1`, `restartedCount=0`, `refusedCount=0`, and `privateStateExposed=false`; the follow-up receipt-directory proof reported the scheduler row as present with route `*`, follow-up command `service-tick`, and no private-state exposure.
  - `epiphany-cluster-daemon` is the first real per-cluster daemon heartbeat body. It runs as a narrow Rust binary parameterized by daemon id, publishes typed `epiphany.cultmesh.daemon_status.v0` heartbeats into the shared local Verse, can run once or loop, and exposes no private state. Durable restart policies for Self, Hands, Persona, Imagination, Eyes, Modeling, and Soul now invoke `epiphany-cluster-daemon heartbeat`, not the generic query/debug writer. A degraded proof showed `service-tick` invoking all seven daemon bodies through the supervisor and restoring ready liveness with sealed scheduler/poke receipts; a fresh tick no-ops when all heartbeats are current. `epiphany-daemon-supervisor cluster-service-runbook` and wrapper `-Mode cluster-service-runbook` write a non-mutating service runbook plus `daemon_service_lifecycle` receipt for all seven organ daemon `epiphany-cluster-daemon serve` commands. Direct `service-runbook` and `cluster-service-runbook` wrapper summaries now print local artifact SHA-256 plus follow-up/aftercare wrapper routes; live proofs `local-20260618-232133-314-4e55120e` and `local-20260618-232146-541-982dd60b` showed hashes `85a956f768e584a9d098f13a9bf03fc3560915821a2ae7eaab94889dd9ecda85` and `40616423a9210101486949d07291bf795175579a39e99de5e5a759f8e0d7a78c` without service mutation. Wrapper `service-plan` and `service-launch` now expose the native daemon-supervisor service lifecycle surfaces under the same brake gate; `service-launch` silences child stdout/stderr so the parent lifecycle receipt remains the only stdout JSON. Live proof `local-20260618-232935-349-7e3901c8` completed a bounded one-iteration launch with `exitCode=0` and no private-state exposure. `epiphany-daemon-supervisor cluster-service-install-plan` and wrapper `-Mode cluster-service-install-plan` write a non-mutating Windows install script plus lifecycle receipt for seven distinct per-organ Windows services. Wrapper `-Mode cluster-service-install-execute` requests execution through the same typed path and, in non-elevated shells, writes `execution-refused-not-elevated` with `executed=false` instead of mutating services. Direct cluster install wrapper summaries now include `artifactSha256=<hash>` and `followUp=tools/epiphany_local_run.ps1 -Mode cluster-service-install-execute`; live proofs `local-20260618-230937-335-71c4fdaa` and `local-20260618-230937-313-cb288388` showed the planned and non-elevated-refused cluster install artifact hash `c6b697e173eb319073da341fc90c2963bcd6bee63d804349205b6309c88df764`. `epiphany-daemon-supervisor cluster-service-audit` and wrapper `-Mode cluster-service-audit` read Windows service-manager state for those seven expected service names, writing an incomplete audit receipt when they are missing; direct audit summaries now point missing cluster services to `cluster-service-install-plan` plus `cluster-service-execution-audit` aftercare, with live proof `local-20260618-232200-992-b842ae01` reporting seven missing services and no mutation. `epiphany-daemon-supervisor cluster-service-start`/`cluster-service-stop` and wrapper `-Mode cluster-service-start-plan`, `cluster-service-stop-plan`, `cluster-service-start-execute`, and `cluster-service-stop-execute` record cluster lifecycle receipts for all seven services: plan modes emit seven `*-planned` rows without mutation, and explicit execute modes refuse as `execution-refused-not-elevated` with seven refused rows when the shell lacks service authority. The cluster install/audit/control wrapper summaries now print compact `serviceRows` for all seven daemon-owned Windows service names with daemon id, status or observed status, cluster id, executed flag, exit code, start type, and `private=false`; live proofs `local-20260618-211051-126-2a89d61c`, `local-20260618-211051-125-cd687ee2`, `local-20260618-211051-063-f0ff980d`, and `local-20260618-211118-108-df5cb8cd` show seven missing audit rows, seven ready/demand install-plan rows, seven start-planned rows, and seven stop-planned rows without service mutation. `cluster-service-execution-runbook` writes an admin-gated wrapper sequence for cluster-native readiness, cluster install, cluster start, cluster audit, cluster stop, and final cluster audit; the artifact now uses `Invoke-EpiphanyRunbookStep` to reset `$LASTEXITCODE`, catch thrown/nonzero failures, continue gathering receipts after a failed step, and always runs `cluster-service-execution-audit` from `finally`; generated child execution runbooks no longer use `Invoke-Expression`, and each step invokes the known wrapper `ScriptPath` with an explicit `Arguments` array. The wrapper calls `epiphany-daemon-supervisor cluster-service-execution-runbook` after artifact generation, so the runbook itself has a typed `daemon_service_lifecycle` receipt with action `cluster-windows-service-execution-runbook`, status `written`, artifact path, final-audit metadata, step-failure policy metadata, and `privateStateExposed=false`. Its wrapper JSON and typed receipt args expose `runbookTryModes`, `finalAuditMode=cluster-service-execution-audit`, `finalAuditRunsInFinally=true`, `stepFailurePolicy=continue-after-step-failure`, `continueAfterStepFailure=true`, `nonzeroExitFailsStep=true`, and `exitsNonzeroAfterFinalAudit=true`; direct wrapper summaries now print the exact `elevatedCommand=Start-Process PowerShell -Verb RunAs -Wait ...` invocation, `artifactSha256=<hash>`, and `aftercare=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit`. Live proof `local-20260619-010940-407-b0744f08` generated the robust cluster artifact and printed hash `bf116ed4fd5bb2c9dc77f5032d19e792b012941a60b109389b79e5fcb0a2a5f6` without service mutation. `cluster-service-execution-audit` first requires the sealed `cluster-windows-service-execution-runbook` receipt, then checks the latest cluster-native readiness plus cluster install/start/audit/stop lifecycle receipts by receipt timestamp and reports `complete` only when the runbook and elevated effect receipts are sealed and successful. Audit check rows retain lifecycle `operatorArtifactRef`; wrapper summaries now print OK runbook witnesses with SHA-256 before compact failed-check anatomy. Live proof `local-20260618-170322-330-e6cb2117` printed `cluster-windows-service-execution-runbook=...\epiphany-cluster-daemon-services-execution-runbook.ps1:sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0` and the expected five failed checks without mutating Windows services.
  - Cluster service execution readiness now uses the same compact wrapper `serviceRows` mouth as install/audit/control. Identity-only readiness rows inherit the global readiness verdict, so the seven expected Windows service rows show `not-elevated` instead of `unknown` when the shell lacks service authority. Live proof `local-20260618-211524-363-5d85b3aa` printed seven readiness rows with service name, daemon id, cluster id, `executed=n/a`, `exit=none`, `startType=none`, and `private=false`; live proof `local-20260618-211524-345-d580da5c` printed seven `execution-refused-not-elevated` stop-execute rows without service mutation. Direct cluster and single-service start/stop control wrapper summaries now print receipt-producing readback and aftercare commands: cluster control points to `cluster-service-audit` plus `cluster-service-execution-audit`, while single-service control points to `service-status` plus `service-execution-audit`. Direct status/reconcile/readiness summaries now also print next-wrapper guidance: service status points to `service-reconcile`, service reconcile points to `service-install-plan`, single-service readiness points to `service-execution-runbook`, and cluster readiness points to `cluster-service-execution-runbook`, with execution audits as aftercare where relevant.
  - `epiphany-verse-query restart-policy-directory` and `tools/epiphany_local_run.ps1 -Mode service-policy-directory` provide the compact scheduler coverage sight organ. It reads daemon topology/status plus durable `epiphany.cultmesh.daemon_restart_policy.v0` rows through a narrow CultMesh restart-policy directory loader, reports each daemon as `ENABLED`, `DISABLED`, or `MISSING`, treats disabled and missing policies as recovery attention, returns covered/enabled/disabled/missing/attention counts, and publishes explicit policy-write plus scheduler-tick follow-up commands without creating or mutating policies. Compact TUI rows now expose `owner=Idunn`, `hostedBody=Epiphany`, cooldown, reconcile interval, heartbeat stale threshold, failure count, last result, `followUp=<command>`, and `private=false`; wrapper proof `local-20260619-003720-135-799146f3` prints the Rust-owned `tuiRows` directly for all seven faculties as `ENABLED` with `owner=Idunn`, `hostedBody=Epiphany`, `last=ready`, `cooldown=30s`, `reconcile=60s`, `stale=300s`, `followUp=tools/epiphany_local_run.ps1 -Mode service-tick`, and `private=false`, instead of rebuilding policy text in PowerShell. Direct and wrapper proof now report seven daemons, seven covered policies, seven enabled policies, zero disabled, zero missing, zero attention, `status=ok`, `lifecycleOwner=Idunn`, `hostedBody=Epiphany`, and `privateStateExposed=false`. This is a real Idunn-owned daemon heartbeat body with non-mutating per-organ launch and install artifacts, but not yet executed installed per-organ OS services.
  - `https://gamecult.org/Blog/purge-the-heretek-from-our-daemonic-swarm` is a public doctrine receipt for the Perfect Machine audit pressure: organs must not borrow each other's crowns, witnesses need owning mouths, surfaces reflect rather than rule, and cross-repo purification needs Bifrost-shaped ledger evidence instead of relying on recoverable transcripts or commit trails alone.
  - `tools/epiphany_local_run.ps1` now uses collision-resistant local run ids (`local-YYYYMMDD-HHMMSS-fff-<guid8>`) for artifact roots and operator run receipts. Same-second parallel compact wrapper proofs for `collaboration-feedback` and `bifrost-publication` produce separate artifact drawers and both complete, so operator rites no longer collide on second-resolution run ids.
  - `epiphany-verse-query tool-directory` and `tools/epiphany_local_run.ps1 -Mode tool-directory` provide the compact daemon tool sight organ over the same local Verse capability records used by `invoke-tool`. It returns eighteen globally available daemon-hosted capabilities, host readiness counts, direct `invocationCommand`, wrapper `wrapperInvocationCommand=tools/epiphany_local_run.ps1 -Mode tool-invoke -ToolCapabilityId <capability> -ToolRequestingAgentId <agent> -ToolRequestingClusterId <cluster>`, and the invariants `availableToAllAgents=true`, `requiresReceipt=true`, `privateStateExposed=false`. Agent-friendly TUI rows now carry the same contract bits, authority gate, and advertised payload/review contract types, e.g. `READY | Hands | repo-action | submitHandsActionIntent | epiphany.cluster.hands.tool.repo-action | eve://epiphany/hands | authority=hands | input=epiphany.hands.action_intent | receiptType=epiphany.hands.action_review | allAgents=true | receipt=true | private=false`; wrapper proof `local-20260619-032243-566-545b148c` prints all eighteen rows in the one-line `toolRows` summary, including Self `service-health` as `readServiceLifecycleStatus` and Self `swarm-online-runbook` as `prepareSwarmOnlineRunbook`, both under `authority=daemon.service_lifecycle` with private-state-sealed lifecycle receipt contracts, plus Eve connection tools, Hands `repo-action`, and Soul `verify`. `invoke-tool` runs through a smaller extracted command handler and emits compact invocation rows with requester/host display names, requesting/host private Verses and Eve surfaces, host daemon id, tool operation, capability id, intent id, receipt id/status, authority gate, `allAgents=true`, `receiptRequired=true`, and `private=false`; status invocation embeds `daemonStatusReadback` with compact topology/liveness/tool-count fields, Eve connection invocation embeds `eveConnectionReadback` with compact CultMesh surface routing and collaboration commands, service-health invocation embeds `serviceHealthReadback` with Idunn lifecycle attention/action/failed-check rows plus swarm-online preflight proof, and swarm-online-runbook invocation embeds `swarmOnlineRunbookReadback` with `ready-for-elevated-operator`, two present child runbooks, two verified hashes, zero missing artifacts, eleven failed checks, zero missing checks, and `operatorRequired=True`. This makes the Idunn handoff globally discoverable without opening full local Verse state or taking over Idunn's daemon-keeper role; live invocation proof `local-20260619-032244-273-acb3c6a4` returned `privateStateExposed=False`.
  - `epiphany-verse-query cluster-topology` and `tools/epiphany_local_run.ps1 -Mode cluster-topology` provide the compact cluster/body/private-Verse/daemon sight organ over local Verse topology rows through a narrow CultMesh loader. The report returns seven clusters, seven private Verse ids, seven daemon ids, one public Persona discussion cluster, agent-friendly TUI rows such as `PUBLIC | Persona | cluster=epiphany.cluster.persona | role=Persona | privateVerse=epiphany.cluster.persona.private | body=repo:E:/Projects/EpiphanyAgent | bodyKind=repository | daemon=epiphany-daemon-persona | surface=eve://epiphany/persona`, and `privateStateExposed=false`; `epiphany-verse-query smoke` source-proves the compact topology invariants, and wrapper proof `local-20260618-225347-337-cea74491` prints all seven standing-faculty rows in the one-line `topologyRows` summary.
  - `epiphany-verse-query swarm-overview` and `tools/epiphany_local_run.ps1 -Mode swarm-overview` provide the one-command compact global-agent sight rite. It composes narrow cluster topology, liveness, Odin/Eve surface, daemon tool, restart-policy coverage, receipt-directory service-lifecycle attention, and the shared core service-execution audit report without full local Verse serialization, returning seven agents/daemons, seven clusters, seven private Verse ids, seven Eve surfaces, one public Persona discussion surface, nineteen globally invokable receipt-gated tools, command hints for topology/liveness/surfaces/tools/receipts/poke/connect/invoke/Bifrost-ledger/restart-policy coverage, wrapper command hints for overview/swarm-online-runbook/receipts/poke/connect/tool-invoke/Bifrost-ledger/service-policy-directory/service-execution-audit, sealed `toolHostAttentionRows`/TUI rows for blocked daemon-hosted capabilities, sealed `serviceLifecycleAttentionRows`/TUI rows copied from the receipt directory, `serviceExecutionFailedCheckRows`/TUI rows naming failed sealed execution checks, explicit `serviceLifecycleRecommended*` fields so service-manager follow-up remains visible even when global `recommendedWrapperMode` is occupied by liveness or policy, and ordered `swarmActionRows`/TUI rows with authority gates, effect class, wrapper command, mutation flag, elevation flag, sealed `operatorArtifactRef`, `operatorArtifactStatus`, `operatorArtifactSha256`, `operatorArtifactExecutionCommand`, `operatorAftercareCommand`, and `completionAuditWrapper*` for operator-runbook rows. Compact action TUI rows now also render `aftercare=<command>`, so the Rust-owned row itself names the post-run audit command instead of relying on wrapper compatibility summaries. Current live swarm overview proof `local-20260619-035353-171-34fb0d31` returns `status=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `tools=19`, `recommendedWrapperMode=swarm-online-runbook`, `serviceLifecycleRecommendedWrapperMode=cluster-service-execution-audit`, exact `swarmOnlineTool=tools/epiphany_local_run.ps1 -Mode tool-invoke -ToolCapabilityId epiphany.cluster.self.tool.swarm-online-runbook -ToolRequestingAgentId <agent> -ToolRequestingClusterId <cluster>`, non-mutating service lifecycle readback rows, elevated service authority rows with aftercare audit commands, present runbook artifacts, SHA-256 provenance, failed/missing check counts, and `privateStateExposed=false`. `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now prints and stores the swarm-level elevated command for its generated Idunn-owned artifact, and the generated parent runbook verifies each child runbook artifact exists and matches its advertised SHA-256 before launching it elevated, then runs aftercare audits through the known wrapper `ScriptPath` plus explicit argument arrays instead of string evaluation. The operator sees the exact `Start-Process PowerShell -Verb RunAs -Wait ...` command, parent artifact hash, child hash guard, aftercare, owner, hosted body, and private-state seal before granting service mutation authority; the wrapper JSON also carries structured `childRunbookRows` and `aftercareRows` with service ids, routes, SHA-256s, audit modes, authority gates, failed-check counts, and private-state seals. Live proof `local-20260619-013021-159-c93088be` generated the parent artifact with two child rows, two aftercare rows, `usesExplicitAftercareArguments=true`, no `Invoke-Expression`, child hash guards, and wrapper-path aftercare calls. If a local runbook artifact is missing, source smoke proves the same row is demoted to `status=runbook-artifact-missing`, `wrapperMode=cluster-service-execution-runbook`, `effectClass=service-lifecycle-runbook-regeneration`, `operatorArtifactSha256=none`, `operatorArtifactExecutionCommand=none`, `operatorAftercareCommand=none`, `mutatesState=false`, and `requiresElevatedAuthority=false` instead of pretending elevated service authority is actionable. Degraded daemon overview still routes global recommendation to `swarm-poke-down` first while independent action rows preserve the liveness/tool-host duties; liveness action rows are explicitly mutating typed lifecycle pokes but do not require elevation, while service execution authority rows make the operator grant boundary visible. `epiphany-verse-query` defaults to the shared `.epiphany-run\cultmesh\local-verse.ccmp` store for live query/readback, while bare `epiphany-verse-query smoke` now uses a disposable `.epiphany-smoke\verse-query-default\local-verse.ccmp` fixture unless an explicit `--store` is provided.
  - `epiphany-verse-query swarm-triage` and `tools/epiphany_local_run.ps1 -Mode swarm-triage` compose the compact swarm overview with the existing brake-aware daemon poke receipt writer. Triage pokes only daemon liveness attention; service-manager lifecycle wounds are reflected from overview as sealed `serviceLifecycleAttentionRows`/TUI rows, `serviceExecutionFailedCheckRows`/TUI rows, explicit `serviceLifecycleRecommended*` fields, and ordered `swarmActionRows`, but do not cause daemon poke receipts, while blocked daemon-hosted tools ride as sealed `toolHostAttentionRows`/TUI rows so agents can see which advertised capabilities are unavailable because their host body is sick. Current live triage `local-20260618-150015-844-aba20563` returns `status=noop`, `overviewStatus=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `clusterCount=7`, `privateVerseCount=7`, `pokedDaemonCount=0`, `recommendedWrapperMode=cluster-service-execution-audit`, `serviceLifecycleRecommendedWrapperMode=cluster-service-execution-audit`, `swarmActionCount=2`, the same sealed service readback plus operator-elevated runbook rows, including `operatorArtifactStatus=present`, `operatorArtifactRef=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-132257-139-26213a29\epiphany-cluster-daemon-services-execution-runbook.ps1`, and `completionAuditWrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit` on the elevated row, empty daemon/tool-host attention arrays, `serviceLifecycleAttentionCount=2`, routes `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit` and `epiphany-daemon-supervisor-service::windows-service-execution-audit`, direct and wrapper command hints including `wrapperInvokeTool` and `wrapperBifrostLedger=tools/epiphany_local_run.ps1 -Mode bifrost-ledger`, and `privateStateExposed=false`; degraded Hands proof returns `status=ok`, `overviewStatus=attention`, topology and daemon TUI rows, blocked Hands-hosted tool rows, one sealed topology-aware poke receipt for `epiphany-daemon-hands` with `bodyDomain=repo:E:/Projects/EpiphanyAgent`, `privateVerseId=epiphany.cluster.hands.private`, `eveSurfaceId=eve://epiphany/hands`, `observedStatus=degraded`, `attentionDaemonIds=[epiphany-daemon-hands]`, `attentionToolHostDaemonIds=[epiphany-daemon-hands]`, and liveness/tool-host action rows with no private-state exposure. Source smoke `verse-query-service-execution-failed-checks-clean` proves a physical synthetic written runbook plus incomplete service audit receipts expose both service lifecycle readback and failed-check anatomy with no Windows service mutation.
  - Compact `swarmActionTuiRows` now match the JSON service-execution queue including local runbook SHA-256 provenance: live artifact `local-20260618-164403-238-dba797ce` shows `050 | service-execution-authority | operator-authority-required | operator-elevated-runbook | operator.elevated_windows_service_control | mutates=true | elevated=true | artifact=present | sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0 | audit=cluster-service-execution-audit`, while the readback row stays `artifact=none | sha256=none | audit=none`. Source smoke `verse-query-action-tui-audit-smoke` guards this agent-friendly TUI surface.
  - Receipt directory rows now carry `artifactStatus` and `artifactSha256` beside `artifactRef`, using the same `none` / `external-ref` / `present` / `missing` vocabulary as action rows and hashing present local artifacts at the receipt-directory layer. Live wrapper artifact `local-20260618-165005-139-6188fe30` proves the cluster service execution runbook row reports `artifactStatus=present`, `artifactSha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`, and TUI `artifact=present | sha256=3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`; the per-service execution runbook row reports `artifactSha256=b213a3c11a8f11a03061fcd743f507edaa59bc6767257b79cef63329596375e7`; non-artifact rows report `artifactSha256=none`. Wrapper proof `local-20260618-165319-478-e929d2bd` also prints compact `artifactHashes=cluster-service-execution-runbook:3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0; service-execution-runbook:b213a3c11a8f11a03061fcd743f507edaa59bc6767257b79cef63329596375e7` in the one-line receipt-directory summary. Source smoke guards present-artifact SHA-256 in receipt-directory JSON/TUI, action-row SHA-256, missing-artifact demotion, and failed-check anatomy. `epiphany-verse-query receipt-directory` also derives compact artifact counts (`artifactNoneCount`, `artifactExternalRefCount`, `artifactPresentCount`, `artifactMissingCount`) from rows instead of storing a second truth. Live readback reports `artifactNone=13`, `artifactExternalRef=2`, `artifactPresent=2`, `artifactMissing=0`, and `privateStateExposed=false`; a clean direct empty-store readback reported all 17 rows as `artifactNone`. The earlier all-in-one `epiphany-verse-query smoke` Windows stack overflow was fixed by cutting full `query_epiphany_local_verse_context` out of `load_swarm_overview_report`; overview now reads daemon service lifecycle rows through narrow history/latest loaders.
  - Wrapper `swarm-overview` and `swarm-triage` summaries now forward the Rust-owned compact TUI row families instead of rebuilding the global sight surface in PowerShell: `actionRows`, `daemonRows`, `toolRows` where present, `policyRows` where present, `toolAttentionRows`, `serviceAttentionRows`, and `serviceFailedCheckRows`. The older compatibility summaries still surface lifecycle receipt `artifactStatus`, local runbook `sha256`, operator aftercare command, and compact service execution failed-check anatomy. Live artifacts `local-20260618-210646-478-88b58f07` and `local-20260618-210646-474-2fb504ff` prove overview/triage print seven READY daemon rows, sixteen globally invokable receipt-gated tool rows, seven enabled restart-policy rows, two ordered service action rows, two service lifecycle attention rows, five sealed failed service-execution check rows, and `privateStateExposed=false`. The Rust-owned action queue now enumerates every sealed service-lifecycle attention receipt instead of only the selected global recommendation: live wrapper proof `local-20260618-214044-049-a63d008c` printed priority 40 `cluster-service-execution-audit` and priority 41 `service-execution-audit` non-mutating readback rows with `artifactStatus=external-ref`, `sha256=none`, service-manager artifact refs for cluster execution audit and single-service execution audit, and `privateStateExposed=false`, while leaving the elevated runbook authority rows unchanged. The failed-check anatomy now aggregates cluster and single-service execution audit reports too, carries service identity, and renders `followUp=<wrapper command>` for each failed/missing check so the compact row names the receipt-producing or readback route without opening raw audit payloads. Live wrapper proof `local-20260618-224925-221-8e114063` printed cluster readiness/install/start/audit/stop failures with follow-ups such as `cluster-service-execution-readiness`, `cluster-service-install-execute`, and `cluster-service-execution-audit`, plus supervisor-service missing checks with follow-ups such as `service-execution-readiness`, `service-install-execute`, `service-status`, and `service-reconcile`, all sealed with `privateStateExposed=false`. The action queue now carries scoped service-execution wound counters on service-lifecycle readback rows as well as elevated authority rows, so a compact row that says `attention` also says why: live swarm overview proof `local-20260619-012440-577-3f18a143` printed priority 40 `cluster-service-execution-audit` with `failedChecks=5` and priority 41 `service-execution-audit` with `failedChecks=6`, while both rows stayed non-mutating, non-elevated, Idunn-owned, and `privateStateExposed=false`. Source smoke seeds both cluster and single-service runbook witnesses and proves distinct authority rows. Live overview/triage proofs `local-20260618-221339-826-b1981064` and `local-20260618-221340-099-4b4baba8` printed priority 50 `cluster-service-execution-runbook` with `failedChecks=5`, `missingChecks=0`, SHA-256 `3239ac17008b1ce857970e40b17d37a1ecf1631a3a6636bb2b8678312fb604a0`, and aftercare `cluster-service-execution-audit`, plus priority 51 `service-execution-runbook` with `failedChecks=6`, `missingChecks=6`, SHA-256 `b213a3c11a8f11a03061fcd743f507edaa59bc6767257b79cef63329596375e7`, and aftercare `service-execution-audit`, with `privateStateExposed=false`. `SwarmActionRow` now exposes explicit `serviceId` and `serviceRoute` fields so agents can identify the body/action without parsing artifact paths or prose; Rust TUI and wrapper action queues render `service=<id>` and `route=<service::action>` for service lifecycle and service authority rows, while non-service rows render `none`. Source smoke guards both fields, and live overview/triage proofs `local-20260618-221912-231-805389bf` and `local-20260618-221912-282-a79ba8bd` showed the cluster and supervisor-service identities on readback and elevated runbook rows with `privateStateExposed=false`. `ReceiptDirectoryRow` now owns the same explicit `serviceId`/`serviceRoute` fields, so action rows consume typed service identity from the receipt-directory organ instead of parsing `route`; non-service receipt families carry `none`, while service lifecycle/runbook rows carry the typed body and route. Source smoke guards the fields, and live receipt-directory proof `local-20260618-222641-218-60106c79` printed `service=epiphany-cluster-daemon-services` and `service=epiphany-daemon-supervisor-service` on service attention/readiness rows and runbook witnesses with no private-state exposure.
  - `SwarmActionRow` now carries `lifecycleOwner` and `hostedBody` so swarm overview/overview/triage action queues distinguish sight from daemon-keeper authority. Daemon liveness, restart-policy, service-lifecycle readback, and elevated service-control rows carry `Idunn` / `Epiphany`; non-lifecycle rows carry `none`. Rust TUI rows plus wrapper `actionQueue` render `owner=Idunn` and `hostedBody=Epiphany` for service readback and elevated service-control rows. Focused live proofs `local-20260619-004523-347-620b40e9` (`swarm-overview`) and `local-20260619-004523-003-a44ad06d` (`swarm-triage`) show the ownership fields on all service action rows with no daemon poke when liveness is ready and no private-state exposure. The broad `epiphany-verse-query smoke` Windows debug stack-overflow wound is now cut by running the CLI body on a larger worker-thread stack; direct smoke returns `status=ok` with seven clusters, seven daemon statuses, eighteen daemon tools, and the sealed latest receipt ids.
  - Direct wrapper audit summaries now expose the same follow-up ergonomics as the global sight rows. `tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit` and `-Mode service-execution-audit` print `failed check rows` with `serviceId::action=status`, artifact ref, local artifact SHA-256 when present, and `followUp=<wrapper command>` for each failed/missing check. Live proofs `local-20260618-225923-468-d818951a` and `local-20260618-225923-529-7cfa2bb3` showed cluster readiness/install/start/audit/stop failures and supervisor-service readiness/install/start/status/reconcile/stop missing checks with actionable follow-up wrappers and `privateStateExposed=false`.
  - Service execution audits now carry their own elevated runbook readback instead of relying on swarm overview or wrapper memory. `epiphany-daemon-supervisor windows-service-execution-audit` and `cluster-windows-service-execution-audit` return `runbookPath`, `runbookSha256`, `elevatedCommand`, `requiresElevatedAuthority`, `aftercareMode`, and `aftercareCommand` from the sealed runbook witness; the wrapper summaries print those fields directly for `service-execution-audit` and `cluster-service-execution-audit`. Live proofs `local-20260619-024011-505-a18982fa` and `local-20260619-024010-980-842fc3a6` showed incomplete audits with repaired runbook hashes, exact `Start-Process PowerShell -Verb RunAs -Wait ... -File <runbook>` commands, explicit aftercare, and no private-state exposure. `epiphany-daemon-supervisor` smoke commands now default to `.epiphany-smoke/daemon-supervisor-<command>/local-verse.ccmp` unless `--store` is explicit, so synthetic smoke receipts cannot become the latest live local Verse service proof by accident.
  - swarm overview/swarm-overview service-execution authority rows now treat synthetic `smoke://` runbook witnesses as missing artifacts, not external executable refs. Such rows demote to `runbook-artifact-missing`, `service-lifecycle-runbook-regeneration`, no elevated authority, no mutation, no execution command, and no aftercare until a real local runbook artifact is regenerated. Source smoke guards this demotion, while live local Verse was repaired by regenerating the cluster execution runbook and re-auditing it: swarm overview proof `local-20260619-025100-231-0d70bace` showed both cluster and single-service authority rows with `artifactStatus=present`, real SHA-256s, exact elevated commands, aftercare audits, Idunn/Epiphany ownership, and no `smoke://` artifact refs.
  - `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now emits an explicit Idunn preflight summary before the operator elevation boundary. Its JSON and one-line summary report `preflightStatus`, child artifact present/hash-verified/mismatch/missing counts, aggregate service execution failed/missing check counts, child preflight rows with expected/actual SHA-256s, and private-state exposure. Live proof `local-20260619-025627-410-9724e2f6` generated the non-mutating parent artifact with `preflightStatus=ready-for-elevated-operator`, two child runbooks present, two hashes verified, zero mismatches, zero missing artifacts, eleven failed sealed service checks, zero missing checks, explicit aftercare audits, and `privateStateExposed=false`. The remaining scar is still explicit elevated operator execution followed by complete Idunn audits, not missing parent/child artifact readiness.
  - Service lifecycle receipt history is now event-only: `load_epiphany_cultmesh_daemon_service_lifecycle_receipts` filters out the `epiphany-local/daemon-service-lifecycle-receipt/latest` mirror, while `load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt` remains the latest-state reader. Focused unit test `service_lifecycle_receipt_history_excludes_latest_mirror` proves two per-receipt writes return exactly two history records and latest points at the second. Fresh smoke `verse-query-lifecycle-history-filter-smoke` and live overview/triage `local-20260618-145632-497-efac6f0d` / `local-20260618-145632-321-867947af` prove compact swarm sights still expose service lifecycle attention plus the present elevated runbook artifact without daemon pokes or service mutation. Do not use a broad unscoped cargo test filter for this check on Windows; it fans out across bin harnesses and hit a broken pipe during this pass.
  - `epiphany-verse-query seed-compact` is the compact seed receipt for wrappers and read-only rites. The older `seed` command still prints the full local Verse context for explicit debugging, but compact wrapper modes now avoid full `seed`/final `query` readback after the combined overview proof exposed Windows debug stack overflow from full-context serialization pressure.
  last_completed_repo_swarm_cut: Huginn live-fire has crossed the first real repo Body from Persona pressure to branch-local Hands commit and Soul/Mind closure, and now has repeatable closure and redacted-public-proof mouths. On `E:\Projects\Huginn` branch `epiphany/huginn/first-awakening`, `tools/epiphany_local_run.ps1 -Mode repo-persona-intake` accepted item `huginn-inspection-readback-livefire`, Weksa/Persona intake remained sealed, and `epiphany-work derive-plan` lowered it to model-authored safe family `repo.status_section` for `README.md` only. `tools/epiphany_local_run.ps1 -Mode repo-swarm-run` advanced four bounded pulses: run-from-plan, adopt-from-plan, execute-from-plan, and close-from-execute. Huginn commit `e9b07c38fceabbdc89ea35c2156326c80c0393a2` updated only `README.md`; closure receipt `.epiphany\work\work-close-huginn-inspection-readback-livefire.json` records status `closed`, Soul verdict `passed`, Mind state commit `repo-work-close-huginn-inspection-readback-livefire-mind-commit`, safe family `repo.status_section`, path scope `README.md`, Bifrost publication gate, and `privateStateExposed=false`. Verification also ran Huginn's TypeScript compiler through concrete Node path: `C:\Program Files\nodejs\node.exe E:\Projects\Huginn\node_modules\typescript\bin\tsc -p tsconfig.json` passed. Native verifier `epiphany-repo-livefire-closure-smoke --workspace E:\Projects\Huginn --item huginn-inspection-readback-livefire --expected-path README.md --expected-family repo.status_section --expected-gate awaiting-publication --expected-blocker bifrost-publication-missing` checks closure receipt, Mind map entry, overview gate/blocker, authority seals, and `git show` changed paths, returning `status=ok`, `soulVerdict=passed`, `publicationGate=Bifrost`, and `privateStateExposed=false`. Wrapper `tools/epiphany_local_run.ps1 -Mode repo-livefire-closure -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exposes the same read-only proof through the local operator mouth; artifact `local-20260621-190156-803-2f85ba15` printed commit, path, gate, blocker, Soul verdict, Mind commit receipt, and `privateStateExposed=False` without push, merge, publication, or target mutation. New wrapper `tools/epiphany_local_run.ps1 -Mode repo-work-public-proof -Workspace E:\Projects\Huginn -RepoWorkItem huginn-inspection-readback-livefire -SkipBuild` exports the redacted proof bundle and repo-local Verse index without publishing; artifact `local-20260621-190645-345-4555b1dc` wrote `.epiphany\public\proof-bundles\repo-work-public-proof-huginn-inspection-readback-livefire.json`, proof id `repo-work-public-proof-huginn-inspection-readback-livefire`, SHA-256 `857545b199f3e37eb06c2e757e5cfc201958e46667bb1f8403fd333a22620f63`, nine artifact rows, zero publication rows, and `privateStateExposed=False`. swarm overview readback `local-20260621-190701-140-b9519ec6` sees the `REPO-WORK-PUBLIC-PROOF` row and action row from Huginn's repo-local Verse with the same SHA-256 while Bifrost publication remains missing. Launcher compact modes are now named compact operator-context modes instead of read-only modes, and `bifrost-public-proof` summaries print item, target public Verse, room, proof SHA-256, review receipts, and credit receipts so publication receipts are auditable without claiming upstream sync.
  next_action: Continue the conceptual-substitution modeling pass beyond receipt writers. Inventory production projections, caches, adapters, schedulers, coordinators, and compatibility surfaces that assert facts owned elsewhere; map owner, inputs, outputs, forbidden writers, and negative proof before cutting. Audit remaining non-receipt smoke binaries for path escape or destructive scope.