539 lines
33 KiB
Markdown
539 lines
33 KiB
Markdown
# Epiphany Native Implementation Plan
|
|
|
|
This is the live campaign plan. The Codex-fork phase succeeded by starving
|
|
Codex of Epiphany authority; Epiphany is no longer implemented as a collection
|
|
of app-server routes.
|
|
|
|
## Objective
|
|
|
|
Build an inspectable native organism whose typed state, runtime, organ gates,
|
|
memory, scheduling, interfaces, and social crossings can operate without Codex
|
|
owning Epiphany cognition. Retain Codex-derived code only where it provides an
|
|
earned OpenAI-compatible authentication or model-transport capability.
|
|
|
|
## Current Mechanism
|
|
|
|
- `epiphany-state-model` owns shared typed semantic contracts; durable Mind is keyed CultCache owned by `epiphany-core`.
|
|
- `epiphany-core` owns keyed Mind admission, runtime spine, organ gates,
|
|
Resident Self physiology, Persona, and CultMesh integration. Coordinator policy,
|
|
status, and every migrated work family consume keyed Mind plus exact runtime
|
|
receipts. Persisted `EpiphanyThreadStateEntry`, the in-memory
|
|
`EpiphanyThreadState` schema, generic launch/update transactions, and global
|
|
launch revisions have been deleted with no compatibility path.
|
|
- Native binaries expose coordinator, status, state, model runtime, Persona,
|
|
repository Body observation, governed work, and Verse operations. Deployment
|
|
and daemon survival belong to Idunn; retrieval providers remain external
|
|
evidence sources until a typed reasoning consumer earns them.
|
|
- CultCache stores typed state and receipts; CultMesh/CultNet carry typed local
|
|
and federated projections.
|
|
- Vendored Codex exposes no Epiphany route, DTO, thread-state field, rollout
|
|
migration, scheduler, watcher, or bridge crate.
|
|
|
|
## Invariants
|
|
|
|
1. Mind is the only durable state-admission gateway.
|
|
2. Substrate Gate controls access; it does not admit state.
|
|
3. Eyes establishes provenance; Hands causes consequences; Soul verifies them.
|
|
4. Self coordinates but does not steal another organ's authority.
|
|
5. Heartbeat/Idunn own physiology and daemon survival, not project truth.
|
|
6. Persona speech and outside-world action preserve consent, identity,
|
|
provenance, and private-state seals.
|
|
7. CultMesh projections and Eve renderers never become owners.
|
|
8. Codex remains free of Epiphany state/process/interface authority.
|
|
|
|
## Completed Foundation
|
|
|
|
- Typed reasoning bases, terminal decision contexts, exact Mind batch CAS, and
|
|
keyed objective/RepoModel documents.
|
|
- Native coordinator facade and derived status/recommendation surfaces.
|
|
- CultCache runtime spine with worker, Mind, Eyes, Substrate Gate, Hands, Soul,
|
|
Continuity, and coordinator receipts.
|
|
- Native OpenAI auth/model/runtime spine.
|
|
- Native heartbeat, daemon supervision, and cluster liveness surfaces.
|
|
- Native Persona memory/turn/audit machinery and Bifrost-governed public mouths.
|
|
- Native repo-work planning, Hands/Soul/Mind closure, public-proof, credit, and
|
|
Bifrost accounting families.
|
|
- CultMesh local Verse, compact operator readbacks, Gjallar sight, Eve
|
|
connection receipts, and three-Verse trust boundaries. Organ contract
|
|
summaries derive directly from their CultNet owners; CultMesh persists no
|
|
parallel contract directory. Fixed Verse and public-room policy project
|
|
directly into the local context rather than occupying mutable store rows.
|
|
- Native runtime and keyed Mind receipts project without JSON-to-CultMesh
|
|
shadows. Unauthenticated pre-provider Odin/Eve/tool rows and their retirement
|
|
migrators are outside the live schema.
|
|
- Complete removal of the Epiphany Codex app-server compatibility surface and
|
|
`epiphany-codex-bridge`.
|
|
|
|
## Active Campaign
|
|
|
|
### 0. Federate Decision-Auditable Mind
|
|
|
|
Status: source-complete; exact-package capstone open. The persisted thread head,
|
|
global revision transaction, aggregate RepoModel, generic Mind gateway, and
|
|
dual readers are deleted. Concrete invariant owners submit exact-envelope
|
|
`MindMutation` plans; CultCache batch CAS merges disjoint identities and refuses
|
|
same-identity or changed-strong-read conflicts without partial writes.
|
|
|
|
- Preserve the sealed reasoning basis, exact final native/provider request,
|
|
governed tool observations, structured terminal decision/failure, and Mind
|
|
commit receipt.
|
|
- Keep family requests and admission owners concrete; share only pure identity,
|
|
continuation, binding-validation, and CAS invariants.
|
|
- Derive work from unresolved typed obligations. Events, lanes, timestamps,
|
|
thread provenance, and aggregate view digests remain projections only.
|
|
- Assemble RepoModel and semantic work from complete keyed document sets.
|
|
Fence namespace phantoms at the operation snapshot; do not invent a global
|
|
head to make set membership convenient.
|
|
|
|
Exit evidence:
|
|
|
|
- concurrent Persona, Hands, Modeling, and Verification writes to disjoint
|
|
identities all commit;
|
|
- same-key conflict, changed strong reads, and exact replay follow the declared
|
|
merge law;
|
|
- every model-backed success or failure can be audited to its exact sealed
|
|
projection without transcript retention;
|
|
- source guards reject persisted thread state, aggregate RepoModel authority,
|
|
caller-authored provider storage, and generic Mind mutation mouths.
|
|
|
|
### 1. Repair Modeling
|
|
|
|
- Keep `notes/epiphany-current-algorithmic-map.md` aligned with source.
|
|
- Distinguish historical evidence from current mechanism in long handoffs.
|
|
- Remove live-looking references to deleted bridge/routes from current docs,
|
|
prompts, wrapper help, and operator output.
|
|
- Add source guards where a removed authority could plausibly regrow.
|
|
|
|
Exit evidence:
|
|
|
|
- current canonical docs contain no false live paths;
|
|
- every mapped owner/file exists;
|
|
- source scans show no Epiphany Codex protocol authority.
|
|
|
|
### 2. Normalize Native Operator Contracts
|
|
|
|
Status: complete for the canonical coordinator/status boundary. The two-path
|
|
service constructor and status flags are deleted, native JSON emits `state`,
|
|
and the wrapper supplies the live unified store. Source guards reject the old
|
|
field and flags.
|
|
|
|
- Audit native JSON artifacts for compatibility-shaped field names and nested
|
|
Codex response assumptions.
|
|
- Rename only when no external contract depends on the old shape; otherwise
|
|
publish a typed migration and explicit expiry.
|
|
- Prefer CultCache/CultMesh documents as load-bearing state; keep JSON at CLI,
|
|
schema, MCP, OpenAI, and other xenos boundaries.
|
|
|
|
Exit evidence:
|
|
|
|
- native coordinator/status consumers read native fields directly;
|
|
- wrapper summaries are projections, not reconstructed policy;
|
|
- no load-bearing JSON sidecar decides behavior.
|
|
|
|
### 3. Close The Organ Loop
|
|
|
|
Status: active. The scheduler can no longer impersonate Modeling/Mind after
|
|
Hands execution, and closure refuses deterministic fallback or a passing
|
|
verdict without an explicit model-authored finding. That finding now persists
|
|
as a typed runtime document backed by a passing Soul receipt; Mind rereads it,
|
|
and repo-map/CultMesh admission carries its receipt ID. Repo-map admission is
|
|
now atomic: the typed canonical map entry and both Mind witnesses publish in one
|
|
CultCache batch, while CultMesh lowers the committed entry. The custom map
|
|
MessagePack owner is deleted. Stable phase IDs are immutable: identical retries
|
|
reread existing Soul, Modeling, and Mind/map documents, while conflicting retry
|
|
cargo fails without changing admitted state.
|
|
|
|
- Prove Hands → Soul → Modeling → Mind → Self on a fresh repository without
|
|
supervisor implementation or direct worker-thought inspection.
|
|
- Ensure every consequence has Substrate Gate scope, Hands receipts, Soul
|
|
verdict, Modeling map update, and Mind admission before the next Hands turn.
|
|
- Treat no-diff, unreviewable, timeout, and regather outcomes as explicit typed
|
|
states rather than success-shaped silence.
|
|
|
|
Exit evidence:
|
|
|
|
- fresh-repo live-fire closes one nontrivial work item;
|
|
- negative tests prove workers/Hands/Soul cannot bypass Mind;
|
|
- operator-safe artifacts explain owner, inputs, outputs, and verdicts.
|
|
|
|
### 4. Make Physiology Durable
|
|
|
|
- Finish Idunn-owned service installation/audit aftercare without moving
|
|
elevation authority into Self or wrappers.
|
|
- Prove cooldown-after-completion, no overlapping lane heartbeat, idle sleep,
|
|
explicit-pressure-only wakeup, and recovery across restart.
|
|
- Ensure scheduler and liveness receipts remain separate from project state.
|
|
|
|
Exit evidence:
|
|
|
|
- seven organ daemons survive restart under typed policies;
|
|
- complete lifecycle audits close the current elevated-service warning;
|
|
- no duplicate daemon keeper exists.
|
|
|
|
### 5. Publish Eve/CultUI Interfaces
|
|
|
|
- Emit typed Eve composition/state graphs for coordinator, organ status,
|
|
receipts, repo work, Persona, and daemon physiology through CultMesh.
|
|
- Lower those graphs in Aquarium/browser/TUI without renderer-owned truth.
|
|
- Keep private/internal, trusted-local, and public Verse surfaces distinct.
|
|
|
|
Exit evidence:
|
|
|
|
- one composition graph renders in at least GUI and compact TUI targets;
|
|
- commands route back through typed owner intents;
|
|
- UI timeline probes observe transition-time invariants.
|
|
|
|
### 6. Prove Federated Work And Social Citizenship
|
|
|
|
- Demonstrate a Bifrost-originated work item flowing through Epiphany lanes,
|
|
maintainer review, credit/ledger receipts, and operator-safe public proof.
|
|
- Demonstrate Persona discussion with keyed typed memory, consent, disagreement,
|
|
and governed external crossing.
|
|
- Treat foreign dreams as thought weather until a reviewed adoption receipt.
|
|
|
|
Exit evidence:
|
|
|
|
- public proof contains no private worker/operator context;
|
|
- Bifrost and Heimdall ownership remains explicit;
|
|
- local agency, refusal, exit, and provenance survive federation.
|
|
|
|
## Verification Strategy
|
|
|
|
- Unit tests prove local authority and validation.
|
|
- Adjacent-organ smokes prove typed handoff.
|
|
- Native end-to-end runs prove operator/product contracts.
|
|
- Negative source and runtime checks prove old owners cannot regain authority.
|
|
- Timeline checks cover load, user/programmatic transition, mid-transition,
|
|
settled state, and restart/re-entry where timing matters.
|
|
- Served/runtime versions and schema versions are exposed when deployment or
|
|
cache uncertainty could impersonate logic failure.
|
|
|
|
## Cut Line
|
|
|
|
Delete or demote:
|
|
|
|
- stale current-looking bridge/route prose;
|
|
- compatibility-shaped native code with no external consumer;
|
|
- wrapper policy duplicated from Rust owners;
|
|
- whole-context serialization where a narrow typed query exists;
|
|
- tests whose only purpose is keeping extinct compatibility anatomy alive;
|
|
- any cache, registry, adapter, mode, or metadata field without a named
|
|
invariant and owner.
|
|
|
|
## Immediate Next Action
|
|
|
|
Keep the five-day shakedown, Ox17 deployment, and Model Atlas operational Gate
|
|
1 paused. Continue the source-subtraction and test-authority audit from exact
|
|
`63939fa2`. The current sequence has deleted the semantic-memory/workspace-coverage
|
|
projection system, its local daemon supervisor, and the surviving generic
|
|
RepoModel profile, impossible lifecycle, producerless receipt/summary, and
|
|
decorative scoring axes. Modeling consumes typed Body and keyed RepoModel state
|
|
directly. Domains are seed-owned; model passes mutate only live keyed operations.
|
|
Persona consumes keyed memory and social state directly. No
|
|
Epiphany-owned Rider or Unity bridge exists: Brokkr owns Unity through typed
|
|
Eve/CultMesh capabilities, and a future Rider daemon will own Rider. Do not
|
|
admit a fresh package until the remaining production surfaces and tests have
|
|
earned their authority under the same audit.
|
|
|
|
Exact `f8412b69` closes the last known retention wound before that capstone:
|
|
the packaged model runtime can reconstruct a decision by context ID from its
|
|
sealed basis, exact terminal requests, tool observations, structured terminal
|
|
records, and Mind commit receipts. Worker attempt archival retains the typed
|
|
result family instead of reducing it to IDs and a digest. Runtime schema v2
|
|
refuses the superseded writable archive shape; there is no reader or migrator.
|
|
|
|
Exact `553f79d9` closes the provider-schema ownership wound exposed by the
|
|
packaged capstone. One shared Responses dialect compiler now serves role and
|
|
Persona passes: it removes provider-illegal conditional structure, preserves
|
|
supported standard-model constraints, compiles UUID formats into enforced
|
|
patterns, and leaves the full native schema as the only admission contract.
|
|
The failed package roots remain immutable evidence; no role-specific output
|
|
exception was added.
|
|
|
|
Exact `a8f3c1f0` closes the next packaged falsification at the RepoModel seed
|
|
owner. Repository bootstrap had passed immutable Git source identity where the
|
|
keyed model contract required the authenticated runtime Body binding. The
|
|
bootstrap now derives that value from the admitted Body observation, while the
|
|
RepoModel initializer independently validates the complete route before any
|
|
envelope is written. A hostile seed refuses byte-identically; no migration or
|
|
fallback identity exists.
|
|
|
|
Exact `bb823c54` closed the two wounds found by that native replay. One shared
|
|
model-pass terminal owner atomically binds a typed failure to its sealed
|
|
decision context and closes the exact Persona session. Its derived semantic
|
|
cache design was later proven unconsumed and deleted wholesale at `856648de`;
|
|
the sealed typed Body/RepoModel basis remains the current Modeling input.
|
|
|
|
Cut in this order:
|
|
|
|
1. **Landed at `79346523`:** replace the aggregate-shaped role reasoning input with one sealed typed
|
|
projection assembled from exact keyed Mind document versions. The final
|
|
model request must render that projection; citing keyed sources while
|
|
rendering the old thread snapshot is explicitly forbidden.
|
|
2. **Body admission landed at `2eb95df6`; current-work projection landed at `e42788c9`:** one pure typed projection now derives Body Modeling, Eyes continuation, proposal Modeling, frontier planning, and Hands readiness from keyed Mind/runtime receipts.
|
|
Modeling must derive from the current Body/RepoModel obligation; Eyes only
|
|
from explicit external-evidence obligations. Body-generation Modeling
|
|
identity, typed Body-to-Mind admission, sealed reasoning, and atomic decision
|
|
admission are landed. Current-work no longer reads the external Body store;
|
|
status consumes the shared projection.
|
|
3. **Baseline transaction landed at `9f7b164f`; operator routing at `587c56d2`; Resident continuation and keyed acceptance at `478fb923`:** baseline Body Modeling is now thread-free from unresolved Body obligation through Launch/Wait/Review and exact Mind admission. Resident and operator callers consume the same family projection and acceptance owner. Thread ID remains immutable pass provenance only.
|
|
4. **Proposal Modeling landed at `d1b031cb`:** its immutable request, exact launch binding, runtime attempt/result, and `Modeling.proposal_frontier` commit now own Launch/Wait/Review and admission. The aggregate launcher refuses proposal cargo; the old selector, validator, context builder, and generic-launch hint are deleted. Body and Proposal share only the exact-envelope launch CAS invariant, not a mutable family registry.
|
|
5. **Continuation vocabulary landed at `e404c105` and was named truthfully at `fc5d1a4a`:** concrete pass families share one pure `EpiphanyAgentPassContinuationAction`; their semantic requests, projections, validators, and admission owners remain separate.
|
|
6. **Dormant claim-repair authority deleted at `20dd66c8`:** no request/binding/context schema, runtime carrier, coordinator branch, result cargo, export, or model lowering survives. The independent Eyes challenge fact remains. The same pass fixed two-snapshot Body/Proposal launch derivation and stress-proved single Proposal launch 20/20.
|
|
7. **Frontier-verdict Modeling landed at `d367e525`:** one exact Soul verdict
|
|
atomically creates its deterministic request; the sealed role projection,
|
|
deterministic attempt, shared Launch/Wait/Review state, and
|
|
`Modeling.frontier_verdict` commit own the complete lifecycle. Admission
|
|
accepts disjoint keyed changes but refuses a changed strong frontier without
|
|
mutation. Accepted Eyes timestamps, latest-result slots, aggregate prompt
|
|
construction, and generic role lanes cannot create or suppress this work.
|
|
8. **Frontier Research landed at `c7412998`:** the v3 request seals the exact
|
|
frontier/dependency document closure, while the full RepoModel projection is
|
|
audit cargo only. One deterministic attempt, terminal decision context,
|
|
request-bound Eyes packet, and `Eyes.frontier_research` Mind mutation own
|
|
Launch/Wait/Review/admission. Stale terminal decisions remain durable, exact
|
|
strong-state changes refuse admission byte-identically, and disjoint keyed
|
|
writes merge. Accepted Eyes, role lanes, timestamps, generic regather, and
|
|
Modeling hints cannot launch Eyes or gate Modeling. CultCache `ba6a487`
|
|
supplies the shared named nested-document encoding boundary used by Mind.
|
|
9. **Frontier Verification landed at `fc5d1a4a`:** one exact Hands commit and
|
|
its deterministic Verification request publish atomically. The sealed
|
|
request/launch/result/context lifecycle owns Launch/Wait/Review; admission
|
|
writes the keyed audit, Soul verdict, frontier-Modeling request, and Mind
|
|
commit receipt atomically. Disjoint keyed writes merge, exact-frontier drift
|
|
refuses byte-identically, and replay is stable. Generic launch/acceptance,
|
|
accepted-at/latest-result selection, dynamic telemetry prompts, and
|
|
model-authored causal IDs no longer own this family.
|
|
10. **Frontier Planning and PlanMind landed at `c9329ed6`:** the Planning
|
|
request seals exact frontier/dependency versions plus per-claim obligation
|
|
guards. Current-work owns deterministic Imagination and Mind attempts;
|
|
Imagination authors a typed candidate, while Mind alone adopts it through a
|
|
sealed PlanMind request and family-owned frontier mutation. Claim challenge
|
|
admission atomically updates the target claim-obligation document, so stale
|
|
planning conflicts without turning unrelated graph writes into a global
|
|
head. Thread provenance, generic coordinator validators/constructors,
|
|
aggregate role lanes, and accepted-at/latest-result behavior no longer own
|
|
this family.
|
|
11. **Reorientation landed at `d5df53ae`:** one keyed request seals the exact
|
|
continuity projection and source document versions; deterministic attempts
|
|
bind an exact reasoning basis and terminal decision context. The family
|
|
owner alone admits resume/regather plus its continuity receipt. Model-backed
|
|
failure retains a typed Mind failure document before retry. Status and
|
|
coordinator routing use the same current-work projection. Aggregate
|
|
launch/acceptance, checkpoint/freshness recommendation, latest binding,
|
|
global revision acceptance, and accepted-at comparison no longer own this
|
|
family.
|
|
12. **Landed at `1662a012`, `07d891ba`, and `ec1431ff`:** coordinator policy now
|
|
projects keyed current work; persisted `EpiphanyThreadStateEntry`,
|
|
`coordinator_state_transaction`, generic coordinator services, the
|
|
`EpiphanyThreadState` schema/prompt renderer, aggregate freshness/context
|
|
views, generic launch/interrupt requests, and global launch revisions are
|
|
deleted. No dual reader, bootstrap aggregate, or migrator survives.
|
|
13. **Generic Mind gateway deleted at `f7948795`:**
|
|
`MindGatewayReview`, `MindStateCommitReceipt` v0, their generic interpreter
|
|
prompt, runtime registration/read APIs, phantom thought/state-effect/public-
|
|
adoption CultNet mouths, and stale launch receipt profiles are gone.
|
|
CultMesh exposes reasoning basis, decision context, and exact Mind commit
|
|
receipt as read-only audit projections; no runtime schema-catalog mirror
|
|
survives.
|
|
14. **Model-backed Planning failure repaired at `1c9aafd8`; generic role patch
|
|
deleted at `e0e75a30`:** the runtime seals
|
|
one exact terminal decision context before writing a typed frontier-Planning
|
|
failure, and the typed failure plus generic job result cite that same
|
|
context. Transport-only failure remains physiological. Research emits one
|
|
closed typed decision and its owner derives keyed Mind writes. The unowned
|
|
generic Imagination planning lane, generic patch parser, and policy
|
|
tribunals are gone.
|
|
15. **Decision-context binding unified at `12b1b285`:** runtime execution and
|
|
context sealing consume the same exact model/tool binding validators.
|
|
Provider, tool-call, tool-result, receipt, session, job, basis, and worker
|
|
substitution refuse, and transcript delta deletion leaves the retained
|
|
basis/context usable.
|
|
16. **Writable epoch cut landed at `01602fd3`:** Mind epoch v2 and runtime-spine
|
|
schema v1 are admitted only through one exact identity pair. Historical or
|
|
split runtime stores refuse before registered writers see them; foreign
|
|
physiology stores remain outside Mind ownership. No schema migrator or dual
|
|
reader exists.
|
|
17. **Keyed concurrency landed at `26b6a5bf`:** simultaneous disjoint
|
|
Modeling-node writes merge; simultaneous Verification admission and an
|
|
unrelated Modeling-node write merge; same-identity competitors yield one
|
|
winner and one typed conflict; exact replay returns the original receipt;
|
|
and reopening assembles one valid graph.
|
|
18. **Persona consequence ownership landed at `7c2ebd81`:** Interpreter
|
|
`state_note` output commits keyed Persona-memory documents through its exact
|
|
decision context; the legacy agent-memory aggregate is no longer a writer on
|
|
this path. A real Hands consequence and Persona Mind admission commit
|
|
simultaneously.
|
|
19. **Persona ingress landed at `79c0e373`:** one typed Mind pass-input
|
|
document seals the exact assembled projector input and observed source
|
|
versions before inference; every Persona stage cites it, replay reuses it,
|
|
substitution refuses, and generic role projections exclude Persona-private
|
|
documents.
|
|
20. **Restart/re-entry landed at `d3300bba`:** one exact validated Mind commit
|
|
receipt authenticates the admitted Persona input. Plan construction is
|
|
sealed behind that loader; naked typed input refuses; terminal replay makes
|
|
no external observation or model call. Current-work projection reopens
|
|
identically and without mutation across Launch, Wait, completed, and
|
|
post-Research boundaries. Build the exact clean-source package and run the
|
|
fresh-store capstone. Only then restart Model Atlas Gate 1 from a new
|
|
external root.
|
|
21. **Provider schema ownership landed at `553f79d9`:** one shared Responses
|
|
dialect compiler serves role and Persona passes. Unsupported conditional
|
|
fragments and `uniqueItems` leave provider cargo; supported standard-model
|
|
constraints remain; literal-only variants receive explicit types; UUID
|
|
formats lower to lexical patterns. Full native decoding remains the only
|
|
terminal-decision admission boundary. Three failed packaged roots are
|
|
retained as falsification evidence rather than hidden by a family prompt
|
|
patch.
|
|
22. **RepoModel seed ownership landed at `a8f3c1f0`:** the authenticated
|
|
runtime Body route, not Git source identity or caller convention, owns the
|
|
keyed model's Body binding. Bootstrap derives it from the admitted
|
|
observation and initialization reauthenticates it before writing. The exact
|
|
`553f79d9` package proved concurrent Persona plus terminal Modeling cognition,
|
|
then correctly exposed the bad seed during admission. Rebuild and replay the
|
|
capstone from exact `a8f3c1f0`; do not transplant the prior decision.
|
|
23. **Terminality and provider-authorship landed at `bb823c54`; its cache projection was superseded by `856648de`:**
|
|
a provider or contract failure seals one `EpiphanyModelPassFailure`; its
|
|
sealed context, not caller arguments, identifies and atomically closes the
|
|
exact model transport job/session. Role, reorient, and Persona failures share
|
|
this owner, while generic transport results carry no decision authority.
|
|
Provider requests are derived internally from native requests at execution
|
|
opening, event recording, and context sealing; the public caller-authored
|
|
provider store is deleted. Reorientation failure admission requires the
|
|
same canonical model-pass failure rather than a generic failed worker result
|
|
plus context. Restart cannot silently infer again. Modeling seals exact keyed
|
|
document versions and their owning Mind commit receipts directly into its
|
|
reasoning basis. The later cache/projector layer that duplicated this source
|
|
set had no reasoning consumer and is gone. Concurrency is protected by keyed
|
|
Mind CAS and exact basis identity rather than aggregate revision or timestamp
|
|
order.
|
|
24. **Build/run retention is bounded:** Idunn on upgraded Yggdrasil owns the
|
|
source-triggered compile/test/package/deploy path. Starfire does not run a
|
|
parallel release build. Any containerized run must use exact run labels and remove disposable
|
|
containers, copied-source volumes, and writable roots at terminal
|
|
settlement. Accepted proof stores remain only when this plan or the handoff
|
|
names the invariant they preserve. Exact source
|
|
`470d4cb5b46f94a5490a479dba19604828e1b5d1` passed Idunn's native serialized
|
|
Yggdrasil workspace gate, then sealed 26 binaries plus witness as release
|
|
`sha256-ce4a287ebb915ff9410dd04e022285d82998e0bf4c9acb3b04a44db661aea90c`.
|
|
It is deployed, authenticated-health admitted, and deliberately braked.
|
|
Transient Epiphany containers, volumes, package roots, and the per-run test
|
|
target are absent. The unused Discord/Bifrost/VoidBot operator bridge is
|
|
deleted across source and deployment; Starfire is not a fallback.
|
|
25. **Decision discovery is read-only:** exact source `5f66d6c9` adds
|
|
`list-decisions` beside `audit-decision` in the existing packaged model
|
|
runtime. It lists only fully validated terminal decision contexts, persists
|
|
nothing, and omits nonterminal pass physiology. That surface is now inside
|
|
the admitted Idunn-built `470d4cb5` package.
|
|
26. **Explicit OpenRouter/Ox transport is live at `6b44b4d3`:** exact
|
|
`ab321b34` makes provider selection typed and keeps the native request
|
|
canonical; the provider request is internally derived and retained in the
|
|
decision context. Exact `c1a6034f` preserves read-only physiology while the
|
|
swarm brake is engaged. Exact `6b44b4d3` publishes Idunn's shared signed
|
|
daemon-health schema. Idunn exact `8ddf8140` validates the canonical generic
|
|
health record; gamecult-ops `a9e9f79`/`0c0dbd1` bind validation to the root
|
|
trust store and inspect systemd credentials in the target mount namespace.
|
|
Ox decisions produced in isolated capstone roots are durable audit evidence,
|
|
not production authority or capstone acceptance.
|
|
27. **Future Epiphany builds are native at gamecult-ops `89f0d78`:** the
|
|
earlier disposable Yggdrasil builders and their volumes were removed. The
|
|
admitted `470d4cb5` release was built natively. The installed Idunn actuator invokes
|
|
fixed Rust `1.95.0` directly as `epiphany-builder`; Docker, image, and CID
|
|
authority are absent. This does not manufacture a reason to rebuild the
|
|
already admitted body while cognition is paused.
|
|
28. **Current typed state owns routing at `470d4cb5`:** coordinator receipts,
|
|
historical terminal slots, timestamps, and role-lane state are audit/display
|
|
cargo only. Concrete family owners materialize unresolved obligations, one
|
|
pure current-work projection schedules them, and Resident Self pressure is
|
|
content-addressed to that projection plus its recommended action. Ox9 is the
|
|
preserved falsification that forced the deletion.
|
|
29. **Body retry identity is normalized at `d48f69b7`:** Body Modeling no
|
|
longer splits launch-only semantic work from a sibling action field. One
|
|
family projection owns the exact work, continuation action, and latest job
|
|
identity through Launch/Wait/Review. Failure therefore changes state and
|
|
produces one fresh deterministic grant; unchanged failure replay remains
|
|
idempotent. Ox10 is sealed failed evidence, not resumable state.
|
|
30. **Attempt identity is generalized at `9b9b5c85`:** Body, proposal and
|
|
frontier-verdict Modeling, Verification, consideration,
|
|
admitted-direction consideration, and Reorientation carry one shared typed
|
|
attempt projection. Research and two-stage Planning retain their full exact
|
|
lifecycle projections in current-work instead of lossy action/stage fields.
|
|
Proposal attempt ordinals are canonical and contiguous; older nonterminal
|
|
attempts refuse. The Ox12-shaped test proves one failed attempt changes
|
|
Resident pressure exactly once and the next launch becomes attempt 1. Exact
|
|
`d2ca6630` remains the admitted production source.
|
|
31. **Agent admission refusal is replayable at `e046a4d1`:** Body, proposal,
|
|
and frontier-verdict Modeling plus frontier Verification write one exact
|
|
typed refusal and commit receipt when semantic mutation or a strong-read CAS
|
|
refuses a structured terminal result. The result remains truthful model
|
|
transport evidence; current-work excludes it from fulfillment and launches
|
|
a fresh attempt carrying the prior refusal. RepoModel claim targets and
|
|
frontier dependencies are distinct in the output contract. Mind/runtime and
|
|
proposal-context epochs cut to v3/v4/v2, so Ox12 is historical evidence and
|
|
a new fresh-store capstone is mandatory.
|
|
32. **Persona owns one outer turn deadline at `3b958a83`:** packaged Ox13
|
|
proved the admission-refusal lifecycle, then four exact Persona projector
|
|
failures exposed a separate 90-second timeout hidden inside the shared
|
|
provider transport. Persona service now accepts one explicit
|
|
`--turn-timeout-seconds` budget, defaults it to 600 seconds, wraps the whole
|
|
native pass once, and lowers provider transport with no independent request
|
|
timer. The shared transport error no longer impersonates an OpenAI-direct
|
|
path when OpenRouter owns the request. Ox13 is historical; later fresh roots
|
|
use a non-restarting Persona unit so provider failure counts remain exact.
|
|
33. **Proposal semantics stay inside admission at `8812945e`:** proposal
|
|
current-work does not grow a second rules tribunal for model-authored graph
|
|
operations. The existing family mutation planner and generic RepoModel
|
|
validator remain the semantic owners; refusal is durable typed state and a
|
|
fresh pass receives the exact prior refusal.
|
|
34. **Historical direction proof is not current-work authority at `749d977e`:**
|
|
a completed admitted-direction decision remains valid evidence for the
|
|
proposal it created even when later disjoint RepoModel documents change.
|
|
Current work is still projected from unresolved typed obligations, not from
|
|
an aggregate model freshness comparison. Ox16 proved this cut in package
|
|
reality before exposing the separate path-scope fault.
|
|
35. **Repository consequence authority is explicit at `5b799b12`:** the old
|
|
`source_scope` name conflated evidence provenance with future write
|
|
authority. The hard cut replaces it with `repository_scope`, names the
|
|
adopted Hands narrowing `authorized_paths`, and makes generic RepoModel
|
|
validation own canonical sorted repository-relative paths. Unresolved Eyes,
|
|
Imagination, or Hands frontiers without a valid ceiling refuse atomically.
|
|
Prompt schemas state that not-yet-created outputs belong in the ceiling and
|
|
inspected evidence does not. Mind/runtime/RepoModel epochs advance to
|
|
v4/v5/v2 with no compatibility reader. Ox16 is historical; Ox17 starts from
|
|
a fresh store and exact package.
|
|
36. **Runtime identity is immutable at `87983ffc`/`ffcf036f`:** the v7 hard cut removes
|
|
update time, derived document-type cargo, and temporary metadata from the
|
|
runtime identity. Current-work launch preserves the exact identity and
|
|
existing root-session envelopes as strong reads instead of reconstructing
|
|
them with fresh storage timestamps. Unrelated job launches therefore share
|
|
bootstrap identity without turning it into a global mutation head.
|
|
37. **Production binary ownership is singular at `6f93134d`:** the root release
|
|
bundle alone owns model runtime, Persona service, and tool MCP runtime
|
|
entrypoints. Leaf crates are libraries, Cargo metadata has no duplicate
|
|
binary-source owner, and release construction no longer maintains a
|
|
hardcoded package map that does not drive the build. Exact `b95a3266`
|
|
separately deletes the superseded OpenAI debug executable; exact `c04c3aff`
|
|
deletes the auth re-export crate.
|
|
38. **Runtime document registration has one owner at `03140a47`:** the packaged
|
|
runtime-spine CLI, callerless Hello/schema-catalog writers, and hand-written
|
|
mutation-contract mirror are deleted. CultCache exact `fdbf3bf` exposes its
|
|
actual registered type identities; runtime status and model preflight read
|
|
that registry directly. Cargo has 21 executable targets and no duplicate
|
|
binary-source owner. Brokkr owns Unity editor capability through Eve/CultMesh;
|
|
a future Rider daemon owns Rider. Epiphany owns neither editor bridge.
|
|
39. **Coordinator status is a projection, not a program, at `500125d5`:** the
|
|
unconsumed packaged status executable is deleted. Its live current-work
|
|
projection, rendering, and operator-thought sealing live once in
|
|
`epiphany-core`; the coordinator imports that module directly. Cargo falls to
|
|
20 executable targets without losing the operator-sealing check.
|
|
40. **Persona consequence safety is typed at `63939fa2`:** projector and Persona
|
|
prose are inert stage outputs, so a hand-written forbidden-word tribunal
|
|
cannot add authority. Only the Interpreter's closed effect enum can propose
|
|
consequence. The tribunal, test-only prompt wrapper, prompt-substring test,
|
|
and forbidden-word test are deleted; exact stage/context and typed-effect
|
|
refusal tests remain.
|
|
|
|
Do not preserve the aggregate for compatibility, manufacture a bootstrap
|
|
thread, release autonomous scheduling, register topology in `gamecult-ops`,
|
|
race the separate Yggdrasil deployment task, reuse historical/partial Gate
|
|
roots, or treat semantic readiness as coordinator acceptance.
|