Epiphany/notes/perfect-machine-audit-roadmap.md

Perfect Machine audit roadmap

Updated: 2026-08-10

Objective

Prove every Epiphany faculty both at its own authority boundary and in live coordination before treating the organism as deployment-ready. Tests prove only the seam they observe. Packaged Linux bodies, copied-state falsification, and actual c006 behavior are the live gates.

Current body

• Source branch: codex/epiphany-shakedown-live.
• Accepted runtime implementation: exact 16407f7e.
• Linux release: sha256-66cf1c2f4d88e7885a36870277cf4b143204de9c9b0dad0ed8f809983b3c55af.
• Witness: sha256-5f41248bb11c01f19125f16bf39f3dfcc2a802de211f3eae7e2caf292d59e4b3.
• Actual c006: Heartbeat and resident Self alive in distinct containers, cognitive brake engaged, resident revision 26, readiness active with no reasons.
• Build body: Starfire. Yggdrasil is the small public crossing and never builds this graph.

Live authority matrix

Faculty	Owner	Accepted proof	Remaining live gate
Self	resident Self state machine	single-consumption Heartbeat grants, typed fulfillment, exact recovery/requeue, cooldown and brake behavior; actual c006 completed its retained proposal-Modeling grant once	broader autonomous frontier turnover across several consecutive causal grants
Substrate Gate	substrate_gate	scoped read/mutation grants on Eyes and Hands paths	audit remaining utility and compatibility actuators for bypasses
Eyes	Eyes gateway and authenticated source tools	challenged-claim Windows circuit and governed Linux tool circuit accepted into Mind	one broader foreign/public Verse evidence adoption path
Modeling	runtime-owned typed Modeling contracts	causal Eyes-to-Modeling acceptance, direct proposal Modeling, archived fulfillment	broader Body-map coverage across a changing live repository
Imagination	typed proposal/consideration producers	proposal-only candidates, exact fulfillment, no Hands adoption leak	native multi-option autonomous turnover beyond bounded fixtures
Hands	Hands gateway	bounded patch, command, commit, push, and changed-path receipts	audit non-repo-work actuators for direct consequence paths
Soul	Soul gateway	consequence-bound verdict, causal Modeling route, retention and replay	collapse remaining verifier-specific broad projections into narrow receipt reads
Mind	canonical transactions and specialized admission	atomic RepoModel admission, launch-owned adjudication, semantic/runtime retention	audit remaining state families for legacy writers and run longer memory behavior
Persona	Persona turn, speech audit, public mouth	cross-host request/permit/receipt, signed failure and unknown no-repost behavior, conversation retention	one completed public consequence; currently blocked by absent Yggdrasil Discord credential
Continuity	runtime/resident recovery and retention	graceful shutdown, exact process-death recovery, session closure/archive, lifecycle retention, non-resurrection	latest-body long-duration plateau and later deployed restart supervision
Nervous system	Heartbeat, runtime spine, Idunn, CultMesh	detached scheduling, typed jobs, provider readiness, active/warming transitions across PID namespaces	latest-body 900-pulse plateau; continue narrowing whole-Verse reads
Body	Rust binaries, named-volume CultCache stores, model transport	deterministic 24-binary packaging, fast warm replay, named-volume interruption proof	deployment-sized endurance and remaining inspection surfaces

Accepted coordinated circuits

1. Substrate Gate -> Eyes -> Mind evidence admission.
2. Heartbeat -> Self -> coordinator -> runtime worker -> typed fulfillment -> exact resident settlement.
3. Eyes acceptance -> causal Modeling launch -> Modeling acceptance -> route consumption.
4. Imagination proposal -> Modeling -> Mind admission -> new direction pressure, without accidental Hands authority.
5. Hands consequence -> Soul verdict -> Modeling update -> Mind transaction.
6. Process death -> Continuity recovery -> canonical requeue or fulfilled settlement -> archive/retention without resurrection.
7. Persona feedback crossing -> bounded consideration -> speech audit -> signed permit/refusal/no-repost boundary.

Accepted latest-body endurance

Actual c006 completed the detached latest-body plateau from iteration 572 to 1496. Thirty samples observed a 923-pulse delta with zero authority violations, exact-zero state/workspace growth, Heartbeat RSS 28.63-28.88 MiB, resident RSS 54.11-55.50 MiB, both role owners alive, and final authenticated readiness active under the engaged brake. Receipts: .epiphany-run/c006-endurance-16407f7e.

Active rite

Narrow local Verse consumers

Lifecycle commands may read only the state family that owns their decision. Managed-task install/control, service-runbook construction, and repo-work service audit now load only the canonical swarm brake instead of the whole local Verse. Cluster reconciliation retains broader context only where it actually enumerates daemon rows. Continue classifying remaining query_epiphany_local_verse_context production callers by output ownership; do not replace a legitimate aggregate projection with a pile of ad hoc reads.

Selected next broad circuit

Run autonomous frontier turnover across Self, Eyes, Modeling, Imagination, and Mind. Map the current live frontier owner, then use copied exact 16407f7e state to prove several consecutive causal grants and typed settlements without Hands or Persona consequence. Only after copied-state acceptance may actual c006 receive an explicit bounded brake window; the brake must be re-engaged and readiness re-proven at closure. state/map.yaml owns the exact current action.

Completion standard

The shakedown is complete only when every matrix row has current authoritative evidence, every explicit remaining gate is either proven or recorded as an operator-owned external dependency, the live coordinated circuit survives endurance and restart, and no stale roadmap claim is being mistaken for state.