Epiphany/notes/fresh-workspace-handoff.md

Fresh workspace handoff

Updated: 2026-08-23 Branch: codex/epiphany-shakedown-live Latest committed implementation cut: 63939fa2 Current worktree: canonical map/evidence sync; Ox17 remains paused

Orientation

The five-day shakedown and Model Atlas operational Gate 1 are paused. Do not touch historical c011/proof volumes, reuse partial Gate roots, release autonomous scheduling, register operational topology in gamecult-ops, race Idunn's Yggdrasil CI/CD task with local compiler work, or wake resident cognition without an explicit operator resumption.

Epiphany is a supervised engineering alpha. Exact source d2ca6630 remains the production symlink body and is inactive. Exact 5b799b12 is the current build-affecting source. Historical live proofs remain evidence; they do not authorize the next capstone or Gate 1.

Current live deployment

• Epiphany source: d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4.
• Release: sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06.
• Release witness file SHA-256: 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357.
• Full-workspace test receipt SHA-256: de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482.
• Model provider: OpenRouter stealth/ox-alpha, selected explicitly and injected through the root-owned systemd credential boundary.
• epiphany.service and epiphany-swarm.service are inactive with zero restarts after the hard epoch refusal rollback. The d2ca stores and swarm brake remain historical production state; no newer package is admitted there.
• Idunn source 8b972715c47731f2418d0c423cb0dd2076940bd7 is provenance-exact and admits Epiphany through the shared authenticated daemon-health contract.
• gamecult-ops b47f9084 removes Docker from Epiphany's future Idunn compile/package actuator. Native Rust 1.95.0 is installed under epiphany-builder; current source-change builds are native.
• Ox9 and Ox10 ran only in isolated fresh capstone roots. Neither is acceptance: Ox9 exposed coordinator-receipt resurrection; Ox10 exposed Body retry starvation after strict malformed-output refusal. No public consequence was emitted.

What just landed

Exact 03140a47 deletes the packaged epiphany-runtime-spine command and the false service authority it carried: 649 lines of operator/debug mutation CLI, callerless Hello/schema-catalog writers, a hand-maintained mutation-contract mirror, and its source-shape test. CultCache exact fdbf3bf now exposes the types actually registered in a cache. Runtime status and model preflight derive from that single registry instead of a second list. The production Mind store and its typed jobs, decisions, and receipts remain; only the duplicate mouth is gone. Cargo now has 21 executable targets and zero duplicate binary-source owners. Core checks without warnings and release construction passes 17/17.

Exact 500125d5 deletes the separately packaged epiphany-mvp-status command. Nothing in deployment or operations invoked it; the coordinator instead textually included the binary source as a module. The live status projection, operator rendering, and thought sealing now live once in epiphany-core. The CLI parser, default store, output-file writer, package role, and redundant release assertion are gone. Cargo has 20 executable targets and zero duplicate binary-source owners. Coordinator compilation, the exact operator-sealing test, and release construction 17/17 pass.

Exact 63939fa2 deletes Persona's hand-written projector-output language tribunal. Projector and Persona prose are inert private cognition; only the Interpreter's closed typed effect enum can propose a state or speech consequence. Keyword matches on STATE NOTE, SAY, JSON punctuation, or field names therefore added retries without adding authority. The cut also deletes a test-only prompt wrapper and two tests that blessed prompt phrases/forbidden words. Three-stage execution and replay, channel-escape refusal, substituted provider/model refusal, typed-effect validation, and all OpenAI-runtime targets pass.

No Epiphany-owned Rider or Unity code, target, schema, or actuator exists. Brokkr owns Unity through Eve/CultMesh. A future Rider daemon owns Rider. Epiphany may consume their typed capabilities and receipts; it does not poke either editor directly.

Exact 856648de deletes the unused semantic-memory and workspace-coverage projection subsystem: 32,866 net source lines, four binaries, the competing local daemon supervisor, Qdrant/Ollama/Postgres configuration, projector policy/lifecycle/heartbeat/recovery state, query/context packets, aggregate RepoModel revision/hash cargo, and Persona's always-empty semantic-recall plumbing.

No agent request builder or sealed reasoning projection consumed those caches. Modeling now reads the exact typed Body and keyed RepoModel projection directly; Persona reads keyed memory and typed social state directly. Future retrieval evidence must earn a typed provider receipt and an explicit reasoning consumer. Idunn remains the sole deployment and daemon-survival authority. Core 165/165, OpenAI runtime 25/25, and release construction 19/19 pass serially.

The active editor boundary is clean. Epiphany owns no Rider or Unity bridge, command schema, or editor-specific actuator. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon will own Rider. Historical architecture snapshots retain their dated record but cannot be mistaken for executable or current authority.

Four subsequent cuts narrow RepoModel to what Modeling can actually decide:

• 6ea4ff3c removes the redundant memory-profile axis, dead SHA-1 ID factory, empty profile module, seven cache/Persona-only node kinds, seven cache-only edge kinds, and seventeen impossible lifecycle states.
• 5218cf2c deletes the producerless RepoModel lifecycle-receipt document family and all of its empty projection/fixture plumbing.
• 8bb039af makes domain creation seed-only and deletes the unreachable summary operation, summary document family, validation, registry contract, and the test cargo that alone produced it. The retained atomic graph test now follows the live seeded-domain then node/edge path.
• ab1afc27 removes node salience/confidence and edge confidence because no owner read, validated, routed, or displayed them; they merely perturbed exact document identity.

Affected targets check cleanly. Core remains 165/165; focused RepoModel tests pass 5/5 and reasoning-context tests pass 8/8.

The global thread-state authority is gone.

• 1662a012 makes coordinator policy a pure projection over keyed Mind, exact current-work families, Resident pressure, and runtime receipts.
• 07d891ba deletes persisted EpiphanyThreadStateEntry, coordinator_state_transaction, generic coordinator state/update/launch/ acceptance/interrupt services, and their aggregate writers.
• ec1431ff deletes EpiphanyThreadState itself, global launch revision cargo, generic launch/interrupt request types, aggregate prompt/freshness/graph- context surfaces, the obsolete Repo graph importer, and the historical prompt-context smoke.
• f7948795 deletes the generic MindGatewayReview and MindStateCommitReceipt v0 authority, its interpreter prompt, runtime registration/read APIs, false state-effect/thought/adoption CultNet mouths, and launch proof profiles that required phantom gateway receipts. CultMesh now projects only the sealed reasoning basis, decision context, and exact EpiphanyMindCommitReceipt, all read-only.
• 1c9aafd8 seals the exact terminal decision context before a model-backed frontier-Planning failure is written. The typed faculty failure and generic runtime job now cite the same context; transport-only failure remains physiological and cannot impersonate a Mind decision.
• e0e75a30 deletes EpiphanyRoleStatePatchDocument, its generic parser and three role-policy tribunals. Research now emits one closed EpiphanyResearchDecision; its admission owner derives keyed evidence, observation, and checkpoint writes. The old generic Imagination planning patch had no current-work owner and was deleted rather than generalized. Runtime role-result and worker output contracts advanced to v4.
• 12b1b285 makes runtime model/tool binding validation one shared owner for both execution and decision-context sealing. Exact native/provider lowering, ToolCall arguments, ToolResult bytes, terminal receipts, session/job/basis, and source-worker authority must describe one family. Hostile provider, receipt, and stored-binding substitutions refuse; reasoning bases and decision contexts remain valid after native/provider transcript deltas are deleted.
• 01602fd3 advances the Mind epoch to v2 and runtime-spine schema to v1. Opening any store that claims runtime or Mind identity now requires one exact current identity pair before registered runtime writers can see it. Old v1/v0 stores and split identities refuse byte-identically; unrelated Persona and coverage physiology stores remain outside this authority. There is no schema migrator or dual reader.
• 26b6a5bf closes the first fresh concurrency slice. Two independently planned Modeling-node writes commit simultaneously and assemble into one valid reopened graph; competing writes to one semantic identity yield one winner and one typed conflict; exact winner replay returns the original receipt. A real Verification admission also commits simultaneously with an unrelated Modeling-node write. Raw mutation primitives are crate-private, so external callers cannot manufacture generic Mind CAS plans.
• 7c2ebd81 removes the live Persona consequence path from the legacy agent-memory aggregate. Interpreter state_note decisions now become keyed EpiphanyMindPersonaMemoryDocument writes under the exact Interpreter decision context. Exact replay returns the original Mind commit. A concrete Hands commit and Persona admission run simultaneously and both commit.
• 79c0e373 seals the complete assembled Persona pass input as one typed Mind document before inference. It records the exact heartbeat, agent-memory, and admitted Body versions observed; all three Persona stages cite the sealed Mind version. Substitution refuses byte-identically, replay reuses the original input, and direct Git inspection is gone. Persona-only input and memory documents are excluded from generic role projections.
• d3300bba makes re-entry consume only an authenticated admitted Persona pass-input. The loader requires one exact Persona.pass_input Mind commit receipt, validates its content-addressed identity, and refuses a naked typed document. A restarted execution plan performs no heartbeat, agent-memory, Body, repository, or model read when that input and terminal decision already exist. Current-work reconstruction is identical and byte-for-byte read-only at Launch, Wait, completed, and post-Research boundaries.
• f8412b69 makes decision audit an operator capability rather than a test claim. reasoning_context::audit_decision_context reconstructs the sealed basis, decoded typed projection, exact terminal native/provider requests, governed tool observations, structured terminal records, and exact Mind commit receipts without consulting streams, events, or current Mind state. Worker archival now retains the complete typed role/generic result family; the digest-only archive shape is deleted. Runtime schema v2 refuses the prior writable archive epoch.
• 553f79d9 makes the OpenAI Responses schema projector one explicit dialect compiler shared by every model pass. It types literal-only schemas, removes parent-relative and unsupported conditional validation from provider cargo, preserves supported type-specific constraints, and lowers decision-bearing UUID formats to exact lexical patterns. The full native schema remains the Mind-admission contract; no provider projection can weaken native decoding. This cut was forced by three preserved packaged falsifications: untyped literal/parent refinements, rejected uniqueItems, and an invalid UUID after over-stripping provider guidance. No role-specific prompt/schema exception survives.
• a8f3c1f0 repairs the Body identity seam exposed only after the first fully typed packaged Modeling decision. Bootstrap had supplied Git source identity to the keyed RepoModel's Body-binding field. Bootstrap now uses the admitted RepositoryBodyObservationBasis, and RepoModel initialization independently refuses any seed that disagrees with the authenticated runtime Body route before writing a single envelope. The negative test proves the entire store remains byte-identical.
• Exact bb823c54 closes the model-pass failure seam exposed by the native capstone. EpiphanyModelPassFailure is one shared typed terminal record over the sealed basis/context for role, reorient, and Persona cognition. The terminal owner derives the exact transport session/job from that context, atomically closes a still-live transport job plus the exact model session, and prevents generic transport failure from impersonating decision authority. Restart reuses the terminal record instead of inferring again. Persona success closes the session only after the effect document and terminal receipt are durable.
• Reorientation failure admission now requires that same exact EpiphanyModelPassFailure. A generic failed worker result plus a plausible context can no longer manufacture a Continuity decision.
• Provider request authorship is also cut at the owner. Runtime execution and decision sealing both derive the provider request internally from the exact native request. Public model-turn ingress accepts only native requests; caller-authored provider requests refuse before opening model authority, and no public provider-request storage function survives.
• Exact bb823c54 also closes the bootstrap-only semantic work seam. Modeling projection work is derived on each pulse from the complete exact keyed RepoModel document-version set and the Mind commit receipts that own those versions. The cache work item is content-addressed and stays outside Mind mutation CAS, so unrelated graph commits remain concurrent. Older work cannot suppress a newly assembled basis. Each projector operation validates the complete current keyed namespace from its opening snapshot, and acquisition uses full-snapshot CAS so a concurrent disjoint insert cannot hide as a phantom. Modeling retention uses exact basis identity rather than synthetic aggregate generation or timestamp order.
• Exact 470d4cb5 removes historical coordinator receipts from behavioral routing. Family admission owners materialize typed obligations, and one pure current-work projection is now the scheduler input. Exact d48f69b7 repairs Body Modeling retry identity. Exact 9b9b5c85 completes the shared law: simple model passes carry one typed attempt projection, Research and two-stage Planning retain their full exact lifecycles in current-work, and proposal Modeling preserves canonical failed/cancelled attempt identity. A failure changes pressure identity once without counters or event authority.

There is no compatibility aggregate, dual reader, bootstrap thread, or migrator. Thread identifiers may survive only as immutable pass-creation provenance; they do not own identity, currentness, or conflict.

Verification at this boundary:

• cargo test --workspace --all-targets --locked -- --test-threads=1 passes natively;
• every Epiphany core target compiles;
• core library 491/491;
• OpenAI runtime library 25/25;
• OpenAI Codex spine 12/12;
• model-runtime binary 10/10;
• OpenAI-runtime binary 10/10;
• Persona service 1/1.
• tool runtime 14/14, with only the explicitly live immutable-GitHub test ignored;
• release construction 21/21.

Canonical machine now

The runtime Mind .cc is the sole decision-bearing store. Keyed Mind and RepoModel documents assemble deterministic views; their projection digests are audit/display identities, not mutable authority revisions.

reasoning_context::commit_mind_mutation is the crate-private canonical commit primitive. Concrete invariant owners supply exact strong reads and complete typed writes. Disjoint identities merge, same-identity divergence conflicts, changed strong reads refuse without mutation, and exact replay returns the original receipt. Model output is never silently rebased.

current_work.rs derives work from unresolved typed state obligations and exact runtime receipts:

• Modeling consumes Body/RepoModel obligations directly.
• Eyes launches only for an explicit outside-evidence obligation.
• Verification consumes exact Hands consequences and invariant obligations.
• Persona consumes typed unread social/relationship state.
• Hands consumes an adopted plan/route and exact capability receipts.

Events, timestamps, role lanes, latest-result slots, and accepted-at ordering are projections only.

Decision-audit foundation

The intended retained chain is:

1. exact typed Mind document versions;
2. sealed EpiphanyReasoningBasis with a closed typed projection;
3. exact final native model request;
4. internally derived provider request;
5. exact ordered governed tool intents/receipts supplied to the pass;
6. sealed EpiphanyDecisionContext;
7. structured terminal decision or typed pass failure;
8. invariant-owned MindMutation and EpiphanyMindCommitReceipt.

Transcripts, SSE frames, reasoning deltas, and intermediate prose are optional and non-authoritative. A retained decision must remain auditable after deleting them.

Model opening requires the sealed basis for worker passes and derives the provider request internally from the native request; callers cannot supply a second provider-shaped truth. Structured role/reorient results, the three Persona stages, and retained worker/session/Persona authority already bind and preserve exact decision contexts. Concrete Body, Proposal, frontier-verdict Modeling, Research, Verification, Planning/PlanMind, and Reorientation admissions use keyed mutations. Research is driven only by explicit external-evidence obligations; Eyes does not gate Body Modeling.

Accepted migration boundary

The source-level Decision-Auditable Concurrent Mind migration is accepted.

Context validation is now exact and DRY: execution and sealing share the same model/tool binding owners, native/provider lowering is exact, final ToolCall/ ToolResult bytes are closed, and request-owned public-source observations stay distinct from model-continuation observations.

Retention must preserve direct reachability: worker attempt or Persona terminal to decision context to reasoning basis. No raw stream event, request family, or transcript may be required for that query after archival.

The packaged epiphany-model-runtime audit-decision command exposes that read-only projection by exact context ID. Its JSON is an operator/xenos rendering only; it never writes Mind or reconstructs prompts from live state. Exact source 5f66d6c9 adds list-decisions to the same runtime. It deterministically lists only contexts with a complete validated terminal audit chain; sealed nonterminal contexts remain physiology and are omitted. This surface and its portable-test repairs through exact ebc0ffe4 have now passed Idunn's full Yggdrasil workspace gate and are sealed in the exact Linux package described below.

The cross-repository operator-plane cut is complete: Epiphany 39adf3a4, Bifrost 8b9ab65, VoidBot 78763ea, and gamecult-ops ca09ba8/c44fb05/448e368. Eve/CultMesh projections, local typed enginseer tools, Persona transport, and governed consequence receipts remain. The standalone Discord command daemon, bridge admission worker, operator Mind writers, deployment gate, unit, and readiness claims do not.

Exact ab321b34 introduces one explicit, decision-auditable model-provider boundary. The native request remains canonical; provider selection lowers it internally into the exact OpenAI or OpenRouter request recorded in the decision context. Exact 547404fa projects public provider identity without exposing credentials. Exact c1a6034f preserves supervisor, heartbeat, and Resident Self read-only physiology while the swarm brake is engaged. Exact 6b44b4d3 publishes the shared Idunn signed-health wire schema.

Idunn compiled, tested, packaged, deployed, and health-admitted exact current source d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4 natively on upgraded Yggdrasil. The full workspace gate passed under test receipt SHA-256 de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482. Idunn sealed 26 immutable root-owned binaries plus release-witness.ccmp as release sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06; the witness file SHA-256 is 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357. The successful request is manual:redeploy:yggdrasil-epiphany:manual:redeploy:yggdrasil-epiphany:2026-08-22T16:35:41.670Z. epiphany-operator-command remains absent.

The provider boundary exposed two deployment ownership defects rather than earning provider-specific compensators. Idunn's validator now consumes its canonical authenticated daemon-health record; the root actuator supplies the exact trust store. Runtime credential readiness is inspected inside Resident Self's systemd mount namespace, where LoadCredential actually exists. These cuts are live at Idunn 8b972715 and gamecult-ops through b47f9084. No transient Epiphany container, named volume, package root, or per-run test root remains.

The bounded redeploy request helper opens an exact, expiring brake grant and immediately returns after waking Idunn; it does not own terminal observation or brake closure. During the 470d4cb5 transaction the operator poll reached a successful terminal receipt before re-engaging the brake. Exact release binding refused contemporaneous stale Odin/Ghostlight requests, so no unrelated target mutated, but the released record briefly survived transaction closure. Future operator transactions must treat terminal observation plus explicit deployment-brake-engage as their final step. Idunn cannot possess the private operator identity used to close its own mutation authority.

Fresh source tests prove the retained chain, concurrent keyed commits, old-epoch refusal, deterministic current-work re-entry, and Persona replay without input reformulation or inference. This is source acceptance, not yet a package/live claim.

Exact clean packages at 55fb4cf8, edd664db, and 1e01c339 preserved the three provider-boundary falsifications above. Exact clean 553f79d9 then packaged 27 Linux binaries as release sha256-e6c19d2b231a73023772f1162b15dac63bd4c7957a7a1cea82a86c8d75f35ac9 with witness sha256-fbee2857c558bde47f4b422b59fe675362fd1955388b084b3d44a188f8a6c82a. Its fresh capstone completed concurrent three-stage Persona cognition and a terminal Body-Modeling decision after five governed source-tool rounds. Review then refused before Mind mutation because the seeded RepoModel carried Git source identity instead of the authenticated Body binding. That failed root is preserved and is not replay input.

Exact clean a8f3c1f0 now packages natively on Windows as 27 binaries, release sha256-19d40048f46355486e66c2abc766abb277122c552cb121a9161e6e95a471be46, witness sha256-ee8bf0574b5e7d489adc47f6dca491fe5224c8b3e61b3d2fd8c2e67c36d5f903, with privateStateExposed=false. Its fresh store projected launchModeling directly from the Body obligation and launched Persona plus Modeling concurrently. Both provider calls then failed because this task token cannot reach chatgpt.com; no positive decision was fabricated.

That failure found a real architecture gap. Modeling already sealed a typed, transcript-free failure context, but Persona left its session active. The Exact bb823c54 repairs the shared owner. A native negative replay produced basis reasoning-basis-sha256:d31179fe..., context decision-context-sha256:a89ba921..., and model-pass failure dd058f3f...; the Persona session is Completed, transcriptRequired=false, and restart left runtime SHA-256 C7723AD7... plus heartbeat SHA-256 2996AAA8... byte-identical. Its 2.09 MB temporary replay root is .epiphany-run/native-model-failure-20260818-a; evidence is distilled and the temporary root owns no continuing proof.

The admitted d2ca6630 release was compiled and packaged natively on Yggdrasil with Rust 1.95.0 under epiphany-builder. The live Idunn actuator contains no Docker path. A build container or cloned source volume owns no durable proof.

Ox9 proved typed Persona and Modeling decisions, then exposed that historical coordinator receipts could resurrect stale direction. Exact 470d4cb5 cut that authority and made Resident Self consume only current unresolved typed state. Ox10 proved the replacement route: Body launched Modeling directly with no Eyes result, while Persona ran concurrently. Modeling sealed its exact basis/context and failed closed because Ox emitted duplicate tension cargo; no Mind commit occurred. Three Persona projector attempts independently timed out opening the provider stream and each terminalized as typed failure.

Ox10 then exposed one remaining asymmetry. Body Modeling projected its semantic work and continuation action in separate fields and omitted the failed job from the current-work digest. The unresolved obligation remained launchable, but Resident Self correctly refused to mint the same pressure identity twice. Exact d48f69b7 deletes that Body split shape. Exact d2ca6630 adds restart-safe resident objectives and durable recovery for a dead runtime worker, and is the current admitted Yggdrasil body.

Private Ox12 proved the repaired Body path in package reality: Body Modeling launched directly without Eyes, completed, and admitted; admitted-direction Imagination also completed. Under exact 9b9b5c85, OpenRouter then completed proposal Modeling attempt 1 with a structured result. The result put RepoModel node/claim identities in dependency_item_ids, whose contract is frontier identity. The mutation planner correctly refused the absent frontier dependency and changed no graph state.

That correct semantic refusal exposed a generalized lifecycle gap: model transport success remained terminal while its failed Mind admission was not a durable routing input. Exact e046a4d1 adds one typed EpiphanyAgentPassAdmissionRefusal Mind document for Body, proposal, and frontier-verdict Modeling plus frontier Verification. The refusal binds exact request, job, result, decision context, invariant owner, refusal kind, reason, and commit. Current-work derives a fresh attempt from it; proposal retry carries the ordered prior refusals. A successful model result remains truthful and is not rewritten as a failed worker job. Output contracts now distinguish claim targets from frontier dependencies. Mind/runtime/proposal context cut to epochs v3/v4/v2; old writable stores are refused. Ox12 is therefore historical evidence and must not resume. Local core 491/491, coordinator 12/12, status 2/2, swarm 10/10, and all core targets pass.

Exact 85061129 then passed Idunn's full Yggdrasil workspace gate and sealed release sha256-238a7911650c406c67b710b19642451c1b1e7bdbe66e9dc7605e46e098a780dd. Private fresh-store Ox13 proved the new refusal lifecycle in package reality: Body Modeling launched without Eyes and admitted, Imagination completed, and a structurally valid proposal result wrote a typed admission-refusal commit before attempt 1 completed with corrected semantics. Transcript-free exact audit is retained under the Ox13 root. Persona concurrently exposed an independent deadline-owner defect: its provider transport hardcoded 90 seconds while worker passes used one outer 600-second budget. A stop race let systemd begin four typed projector failures rather than the live-observed three; none committed Mind or public speech. Ox13 is sealed, inactive, and must never resume.

Exact 3b958a83 gives Persona one explicit outer --turn-timeout-seconds budget, defaults it to 600 seconds, removes the inner provider request timer, and makes the shared error provider-neutral. The focused provider/runtime suites pass: provider spine 17/17, runtime library 26/26, model-runtime binaries 13/13 each, and Persona service 1/1.

Ox15 is sealed historical fresh-store evidence. It proved Persona no longer dies at the old inner transport timeout, then exposed a separate proposal currentness fault. Exact 8812945e keeps proposal semantics inside the family admission owner, and exact 749d977e makes a completed historical direction decision valid evidence for its proposal across later disjoint RepoModel changes without turning an aggregate model revision back into authority.

Exact 749d977e passed Idunn's Yggdrasil gate under test receipt SHA-256 39229d8a526a7af7e7b29cec28d27b07f89ba5f5792658947e3d1d039b9449c4 and sealed package sha256-5d9bc25612dd46511620671ccd5113f3b5e0e3c060c85e97dcdc199f9126a230. Private fresh-store Ox16 launched direct Body Modeling without Eyes while all three Persona stages ran concurrently. Body and proposal admission survived later disjoint RepoModel changes. No public delivery succeeded. Planning then remained unavailable because the active Imagination frontier used inspected evidence paths as its supposed future write scope, omitted OX-CAPSTONE.md, and was unordered. Dependent proposal pressure began to form, so Ox16 was braked and sealed before the forest grew. No Hands consequence or capstone marker exists; Ox16 must never resume.

Exact 5b799b12 is the hard architectural cut from that evidence. It deletes source_scope/sourceScope, makes repository_scope the canonical sorted repository-relative ceiling for future Planning/Hands consequences, and names the adopted route narrowing authorized_paths. Generic RepoModel validation owns the intrinsic path law and refuses an invalid routed frontier atomically before any graph document is written. Inspected files and evidence remain in their existing typed audit cargo. Mind/runtime/RepoModel epochs advance to v4/v5/v2. Local acceptance is core 494/494, OpenAI runtime 26/26, coordinator 12/12, swarm 10/10, and model-runtime 13/13.

Immediate next action

The Ox17 deployment lane is paused. Continue the source/test-authority audit from exact 856648de; do not compile or deploy through Idunn yet. Inspect the remaining production modules and tests by owner, consumer, invariant, and failure mode. Delete an abstraction with the tests that merely animate it when it has no decision-bearing consumer. Preserve the keyed Mind, sealed reasoning, direct Body-to-Modeling flow, family admission owners, Persona social state, provider boundaries, and consequence-verifying receipts.

Yggdrasil previously exposed 96 GiB of dead native Cargo targets after interrupted full-workspace builds; exact cleanup returned the builder target root to 4 KiB. Exact 1d5a1f17 landed the first causal cut:

• 21 duplicate core/release binary declarations are gone; each production entrypoint has one Cargo owner;
• 19 generic repo-request smoke executables are gone because Cargo compiled them but their main() assertions were not tests;
• the runtime-store migrator CLI and the unshipped repo-personality birth subsystem, parallel agents.msgpack initialization, schemas, prompts, and stale contract plans are gone;
• the non-vendor diff removes 19,252 net lines and reduces epiphany-core from 75 to 30 binary targets;
• core library tests remain 494/494 and Hands remains 5/5 under the sole release package owner.

Exact 387afe49 is the second verified cut. It deletes the runtime_store_migration module/test, all 29 remaining unshipped core executables, the shipped epiphany-verse-query parallel control plane, the local PowerShell launcher, and its orphan Rider bridge. epiphany-core now owns only epiphany-prepare-compaction; the release bundle owns 25 runtime executables. Focused core, supervisor, and release-construction tests pass 493/493, 32/32, and 21/21.

Exact bf516f99 deletes the agent-memory migration, repair, lifecycle, trait-seed, and SoA authorities with the tests that preserved them. It also deletes the second CultMesh SoA mirror, its timestamp-selected latest head, and its prompt injection. Persona now reads learned memory only from keyed EpiphanyMindPersonaMemoryDocument rows in the assembled Mind view; those documents participate in the exact projection digest and source set. Dead test-only alternate Resident Self and direct Continuity writers are also gone. The final core library passes 483/483 and Persona service re-entry passes 1/1.

Exact 360073a3 was an intermediate reduction of semantic projection. Exact 856648de later proved the remaining cache had no reasoning consumer and deleted the subsystem wholesale. Modeling now seals the live typed Body and keyed RepoModel basis directly; no vector readiness or workspace-coverage gate stands between Body and Modeling.

Exact d1685df8 deletes heartbeat aggregate cognition: personality/mood timing, appraisal, rumination, dreaming, the void routine, and its memory graph. Exact 39dd9fdb deletes the remaining agent-memory identity/generation store, the 64-float utterance vector, generic selfPatch decoding/admission, the phantom sleep-distillation contract, stale aggregate/thread schemas, and nine more constructor/static-vector tests. Native role ingress now refuses unknown model cargo instead of accepting forbidden identity and silently ignoring it. Core passes 455/455 and the provider runtime passes 27/27. The obsolete repository- local Cargo target was 2.5 GiB and was removed; compilation remains in the shared target.

Exact 2164bd0a first collapsed heartbeat to Resident Self and Persona scheduling. It deletes Ghostlight scene scheduling, manual tick/pump/heat/complete and queue-mention controls, adaptive pacing/initiative heat, five fake organ lanes, five dead schemas, and eight self-referential tests: 2,145 deletions against 118 additions. The strict heartbeat state is now v1; the owning binary checks cleanly and the surviving core suite passes 448/448.

The keyed Persona cut completes the separation. Pending Persona mentions, immutable requests, terminal receipts, quarantine records, and retention state are keyed CultCache documents. Persona derives and reserves its own work; the heartbeat daemon has no Persona path. The exact social request envelope is the pass-input provenance. Failed turns produce a new deterministic retry identity, and retention excludes its immutable retired frontier instead of deleting decision history. The old heartbeat bridge/terminal names and writable types have no compatibility reader.

Exact 4d0db2c7 deletes the final singleton heartbeat scheduler: module, binary, schema, store, service, deployment lifecycle, artifact tree, stale repair, pacing/history state, and acknowledgement consumer. Resident Self now owns pressure-to-grant CAS, launch exclusion, leases, terminal receipts, retry, and retention directly. The same cut deletes twenty-one tests that guarded source spelling, constructor copies, or one-line helpers instead of behavior.

Exact 67a3a57b deletes every remaining Rust test that parses its own source: nineteen daemon-supervisor/workspace-coverage string and ordering assertions, plus two exact argument-vector mirrors. This removes 591 lines. The focused native supervisor suite now passes 10/10 and the workspace-coverage behavioral slice passes 74/74. The retained tests exercise validation, owned-store exclusion, process observation, CAS conflict, signed authority, recovery, and re-entry. The deleted tests named several legitimate sequencing invariants but proved none of them. The 4.7-kiloline daemon supervisor is therefore an exposed launch/reconcile authority knot; split it before restoring transition-level proof rather than adding a mock shell around the monolith.

Exact bbe5fcf1 deletes four CultMesh tableau tests and replaces their production-absent seven-cluster Odin/Eve/daemon world with the minimum retired provider rows needed by the surviving authority tests. The real tests still prove that legacy rows cannot become live discovery state, explicit retirement touches only those rows, private-state tool requests refuse, and typed intent/receipt persistence round-trips. The cut removes 396 net lines; CultMesh integration passes 57/57 and the non-test core check is clean.

Exact f236e1cd deletes the six parallel Mind, Substrate Gate, Eyes, Hands, Soul, and Continuity CultMesh contract families. Their DTOs, type/schema constants, registry bindings, field-copy mappers, writers, seed calls, mirror tests, and public reexports are gone. The local Verse now derives summaries directly from each organ's owning CultNet contract factory. This removes 607 net lines; CultMesh integration passes 51/51 and non-test core remains clean. A store containing the deleted derived envelopes refuses under the new registry; there is no migrator or dual reader.

Exact fe591b33 deletes the persisted Verse-policy and global-room-policy families. Their registry rows, schema/type constants, seed-time writers, public writer APIs, and two literal-copy tests are gone; EpiphanyLocalVerseContext projects the fixed policy tables directly. This removes 130 net lines and the focused CultMesh suite remains clean at 49/49.

Exact 4ed3a6e0 deletes nine dead CultMesh document families: the JSON-derived operator snapshot, coordinator receipt, Hands gate, and role-review event; unauthenticated Odin advertisement, Eve surface, daemon capability, daemon-tool intent, and daemon-tool receipt. Their DTOs, registries, parsers, validators, writers, latest slots, prompt branches, exports, fixtures, and ten tests are gone. The provider-row retirement path and the daemon supervisor's retired operator-status migration command are also gone. The hard cut removes 2,398 net lines. Non-test core check, CultMesh 39/39, prompt projection 1/1, and daemon supervisor 10/10 pass.

Next audit the remaining round-trip tests for duplicated CultCache derive coverage: retain tests only when they prove Epiphany validation, monotonicity, authentication, conflict behavior, projection, or an authority boundary.

Exact e8bc0382 deletes the unused CultMesh Persona-speech-audit and Weksa-lowering-receipt shadows plus all four tests that alone animated them. The real Persona and Weksa typed owners remain intact. This removes 432 lines; non-test core check and CultMesh 35/35 pass.

Exact db6a7131 deletes the unused CultMesh operator-run intent/receipt and generic work-loop telemetry shadows. Their runtime-spine declarations, prompt branch, test-only prompt seed, and two tests are gone; native runtime and keyed Mind receipts remain the owners. This is 829 pure deletions. Non-test core, CultMesh 33/33, and prompt projection 1/1 pass.

Exact 75ead942 deletes the four RepoWork aggregate families, their latest heads/loaders, the unused service-execution audit helper, unused Bifrost artifact/metrics/public-proof receipt families, and every test that alone animated those surfaces. The apparent public-proof crossing had no production consumer: its context field was assembled and then ignored. This removes 1,410 net lines. Non-test core, CultMesh 30/30, and prompt projection 1/1 pass.

Exact 753707ff makes persisted runtime-bound cluster topology the sole local-Verse bootstrap witness. The duplicate singleton status document, writer, loader, supervisor precondition, exports, and round-trip test are gone. Two foreign-row preservation tests now use an honest test-local foreign type and a real swarm-brake row instead of borrowing the dead status schema as scenery. This removes another 99 net lines. Non-test core, CultMesh 29/29, the affected readiness and Persona tests, and daemon supervisor 10/10 pass.

Exact 967743cc deletes seven daemon-poke and Bifrost latest/exact loader APIs that only tests called. The remaining tests consume EpiphanyLocalVerseContext, the same view as runtime prompt/supervision paths, and are named for immutable identity, monotonic latest selection, and governed receipt correlation rather than serialization. This removes 85 net lines; non-test core and CultMesh 29/29 pass.

Exact 1ab0859b deletes two more CultMesh tableau tests: one copied static topology strings already exercised at prompt/liveness boundaries, and one still claimed to reject provider-owned bootstrap state after those provider fields had been deleted. This is 78 pure test-line deletions; CultMesh passes 27/27.

Exact ab5b16ec deleted a #[cfg(test)] generic managed-service-policy writer and the two assertions that summoned it. The specialized projector writers and tests that survived that intermediate cut were later deleted with the entire unconsumed subsystem at 856648de.

Exact c977d149 deletes Epiphany's unused v0 Idunn deployment-receipt and aftercare-audit families. VoidBot, gamecult-ops, and the local Odin/Idunn body show that live authority is gamecult.idunn.deployment_manifest.v3 plus signed daemon-health admission; nothing produces the Epiphany-local envelopes. They had no writer, test, or consumer beyond unused context slots and loaders. The cut removes 151 lines; non-test core, CultMesh 27/27, and prompt projection 1/1 pass.

An intermediate producer audit found no production writer for EpiphanyCultMeshDaemonStatusEntry; only CultMesh tests call its public writer. The daemon supervisor and local-Verse context read this manually conjured aggregate, while the real semantic/workspace projectors already publish their own heartbeat/readiness receipts. Do not add a status publisher. In the supervisor split, consume family-owned health directly and delete the generic status/poke mirror once its command paths have moved.

Exact c553868d completes that deletion. It removes the generic daemon status, poke intent/receipt, restart-policy, and scheduler-receipt document families; their registry entries, loaders, writers, local-Verse fields, reconciliation loop, CLI flags, and nine fixture-driven tests; and one helper kept alive only by those tests. The cut is 1,808 net lines. Non-test release-bundle supervisor check passes, CultMesh passes 20/20, and the remaining supervisor tests pass 8/8. No source reference to the deleted schemas or reconciliation path remains. That left an intermediate specialized managed-service path. Exact 856648de later deleted it because neither projector fed a reasoning basis.

Exact f9eeb460 then removes the remaining self-referential supervisor display test and its helper. The test asserted only that a non-authoritative label matched the helper's own branches; correlation and provider status were already projected separately. The workspace recovery test was reduced to its real invariant: the recovery write runs for ExactAlive and not for Missing. Supervisor check and the resulting consequence-bearing suite pass 7/7; the cut removes another 47 net lines.

Exact 30c66080, 008bd493, 7e16e758, and 3312880e remove the generic command entrances, legacy lifecycle lineage, fallback/finite launch modes, and caller-authored service identity/configuration. They subtract 596 net lines. Exact afb223da removes two more tests that guarded formatting and a five-line match, collapses the latter wrapper into its only call site, and advances the managed-service policy schema to v1. Fixed owner, restart mode, unused backoff, decorative update time, and prose notes are gone; old policy rows refuse at the load boundary. The cut subtracts 84 net lines.

Exact ffe707ff removes the global lifecycle latest mirror, local-Verse slot, receipt-history scan, timestamp election, and two tests that preserved those surfaces. Each service now owns one exact current receipt head; its atomic CAS conflicts on concurrent same-service replacement while disjoint services remain independent. The cut subtracts 209 net lines. Focused native checks pass: CultMesh 18/18, workspace process authority 11/11, and supervisor 5/5.

Exact 47454e61 was the last intermediate supervisor split and correctly deleted Epiphany's Windows Task Scheduler control plane. Exact 856648de deletes the remaining native spawn mechanic and both cache-process launch owners. Idunn on Yggdrasil is the sole deployment and daemon-survival authority. The obsolete semantic-projector runbook is deleted rather than preserved as current deployment guidance.

Exact 803e3447 deletes the unconsumed semantic-projector-service-status command and its ad hoc JSON projection: 40 net lines. Typed lifecycle and heartbeat state plus Idunn's signed aggregate health remain the read paths. Supervisor check and 4/4 consequence tests pass.

Exact da8ed840 removed 484 net lines of console-shaped reconcile state. Its remaining supervisor and cache recovery authorities were subsequently deleted at 856648de; signed Idunn health is the operational truth.

Exact 2aeab7a9 deletes the generic organ dependency/proof-profile subsystem, its persisted worker-launch field, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. The universal dependency matrix was never consumed by admission and contradicted direct Body-to-Modeling work. Worker-launch schema v2 and Persona projector prompt v1 make the hard cut. Family validators, typed launch documents, sealed reasoning projections, and concrete invariant owners remain. Focused acceptance is core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1.

Exact ef92e853 deletes the callerless view-lens registry, legacy role and reorientation acceptance-bundle builders, two #[cfg(test)] raw-JSON result parsers, and the six tests that animated them: 797 net lines. The typed runtime result interpreter remains in use by current work and reorientation. Core is 372/372.

Exact a292979d plus formatting receipt 77e817c1 delete the second CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. The keyed status composer remains the sole recommendation projection. Core check and the remaining surface slice 12/12 pass.

Exact 3b94bf6e deletes the duplicate nested status view and the false --coordinator-only/auxiliary label: 25 net lines. Exact 59c5e3a6 deletes the ignored cwd and historical no-op presentation arguments: 12 lines. Exact 7c9b0cf3 deletes the fixed synthetic job table, its role-board cargo and mapping helpers, and its one test: 338 net lines. Role lanes and coordinator routing now derive directly from exact current work. Focused coordinator/status checks pass; the operator thought-sealing test remains 1/1.

Exact 2ce91461 deletes the duplicate scene/planning Mind reconstructions, epiphany-self-policy, unused prompt templates, four counterfeit surface schemas, and ten tests that guarded producers or source text rather than a consequence: 1,723 net lines. Exact 78836f3b deletes eight more unconsumed status tableaux, the pressure calculator production only invoked without telemetry, its unreachable compaction route, one counterfeit schema, and six tests: another 518 net lines. Status now contains Mind identity, exact current work, one action/reason decision, and readable role lanes. Core 356/356, status 1/1, coordinator 8/8, and release construction 19/19 pass.

Exact f10f7fb3 completes that audit: all twelve remaining surface schemas and their ten catalog entries had zero producer and zero consumer. The 692-line pure deletion includes global-revision status shapes, old Rider/Unity/Void bridges, and the artifact-list Persona surface; gamecult.persona_state.v0 remains the portable Persona contract. The publication index contains zero epiphany.surface.* documents.

Exact ab3cacfb deletes thirty-one more producerless contracts: abandoned RepoWork aggregates, CultMesh operator-run shadows, generic launch/accept intents, swarm receipts, Persona artifacts, and every Epiphany-owned Rider and Unity command schema. Runtime sessions now advertise read-only lifecycle state instead of a nonexistent coordinator intent path. Brokkr owns Unity editor capabilities through CultMesh/Eve; a future Rider daemon owns Rider. The same cut found a 415-line prompt-context module and the specialist TOML prompt system were consumed only by their own four tests. Module, exports, configuration, dependency, and tests are deleted. Native core, OpenAI runtime, and release bundle checks pass; the behavioral core suite passes 352/352; the published catalog contains 23 local schemas and none of the deleted families.

Exact 16d85b1b deletes all six remaining direct agent_launch schema tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. The schema tests duplicated stronger provider-lowering and typed-ingress/admission proofs; the source searches proved only that forbidden function names were not spelled in one file. Core checks cleanly and the retained OpenAI runtime suite passes 25/25.

Exact 06f93f70 deletes the test-only OpenAI-to-native request mapper. Two retained runtime tests now construct the canonical native request first and derive the provider request through the production adapter. This removes sixty net lines and makes test ancestry obey the same one-way ownership rule as live inference; focused typed-storage and tool-followup tests pass.

Exact 203bcc41 deletes Epiphany's fabricated Bifrost body-change and GitHub publication family: four CultMesh document types, three singleton latest heads, their constructors, validators, writers, local-Verse advertisement and projection, public exports, and five tests that manufactured both ends of the crossing. A cross-repository producer audit found no live Bifrost or gamecult-ops owner for any of these types. The real Bifrost Persona feedback/delivery stores and signed crossing receipts remain owned by Bifrost. Core checks, release-bundle checks, and the remaining CultMesh suite pass 13/13.

Exact 11d99de1 deletes the producerless HandsPrReceipt family: the CultCache type and registration, dead test-only writer, read API, public exports, relinquishment branch, and two Hands contract advertisements. No production or test caller could create the receipt. Hands now owns local patch, command, and commit consequences; exact remote publication evidence belongs to the remote provider/Bifrost crossing. Core and release-bundle checks pass, and the rebuilt 43-entry schema catalog contains no deleted PR family.

Exact a4af4734 deletes the second CultNet contract author and the false bootstrap witness: six organ-specific contract DTO/factories, the callerless EpiphanyLocalVerseContext query/seed bundle, fixed Verse/room policy prose, the mind_contracts module and its self-affirming test, persisted seven-cluster topology, its dead writer/loader, the supervisor's nonempty-row bootstrap check, and the diagnostic test that kept the loader alive. Exact 03140a47 later deletes the remaining standalone contract mirror; live providers own their CultMesh/CultNet catalogs. Supervisor readiness continues to depend on exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health. Core and release-bundle checks, CultMesh 12/12, and supervisor 4/4 pass. The cut removes 1,005 net source lines.

Exact beb9fd32 deletes the producerless EpiphanyToolCapability family from the tool adapter, runtime registration/mutation table, standalone JSON schema, schema index, and MCP smoke banner. No writer, reader, constructor call, admission path, or test existed. Exact model-request tool definitions, RuntimeToolExecutionBinding, invocation intents, and governed receipts remain the tool authority. The canonical catalog drops from 43 to 42 schemas and keeps tool intent/receipt. Four affected packages compile; the tool runtime passes 14/14 active tests with one explicit live-source test still ignored.

Exact ca2d2cf2 deletes four prose-only Continuity contract families: packet, compaction checkpoint, stale-turn repair, and refusal. They had constants and runtime mutation-table rows but no typed documents, schemas, stores, writers, readers, or tests. ContinuityRecoveryReceipt remains real: accepted reorientation constructs, persists, and exposes it. Core/release checks pass and the decision-auditable reorientation test passes 1/1.

Exact f8974d52 deletes five prose-only Soul families: generic verification request, invariant check, regression receipt, review receipt, and verification refusal. They had constants and mutation-table prose but no typed documents, schemas, stores, writers, readers, or tests. The keyed repo-frontier verification request and persisted SoulVerdictReceipt remain the real request/result path. Core/release checks pass; focused verification tests pass 3/3.

Exact 201fa192 deletes three prose-only Eyes families: generic evidence request, evidence review, and evidence refusal. They had constants, exports, and mutation-table prose but no typed documents, schemas, stores, writers, readers, or tests. Authenticated source lookup receipts and the exact research decision's persisted evidence packet remain the real Eyes path. Core/release checks and focused Research 2/2 pass.

Next continue the test-authority audit after exact ffcf036f, beginning with remaining direct schema, prompt-rendering, CLI-parser, and CultMesh projection tests. Audit every claimed cross-service contract against its real producer before preserving it. Retain a test only when it reaches Epiphany validation, ownership, authentication, monotonicity, CAS conflict, replay, projection, or an externally visible consequence; delete test-only APIs and fixtures with the tests they animate. Preserve exact current work and the four consequence-bearing supervisor tests. Do not run a full-workspace compile, package, deployment, or Ox root until subtraction closes. Never resume Ox10, Ox12, Ox13, Ox15, or Ox16.

Latest authority cuts

Exact bf997ce0 hard-cuts frontier plan-decision receipts to v2. The two permanently empty legacy worker echoes are gone, decision provenance is required, and unused public type aliases no longer pretend to be contracts. Exact e00ea70f deletes the PID-only process-observation compatibility API and its unused path helper; exact process-incarnation identity remains the only liveness and termination authority.

Exact 87983ffc makes runtime identity immutable bootstrap state and advances runtime spine toward its current v7 shape. Launches no longer rewrite a shared singleton merely to refresh stored_at, an update timestamp, a derived capability list, or temporary evacuation metadata. Existing identity and root-session envelopes are replayed byte-for-byte as strong reads, so disjoint keyed jobs can merge without losing identity substitution protection. The existing current-work capstone now proves the identity envelope survives all launch families unchanged; focused core and OpenAI-runtime native checks pass.

Exact a319146b deletes the public non-atomic worker-launch path that only test fixtures called; executor fixtures now seed through the canonical preparation path. Exact 76fd259b deletes two source-layout tests while retaining actual CLI refusal behavior. Exact b95a3266 removes the superseded, unpackaged epiphany-openai-spine debug binary and two tests that animated its private status helper.

Exact 6f93134d makes the release bundle the sole package owner of every production entrypoint. Leaf libraries disable automatic binaries, Cargo metadata reports no multiply owned binary source, and the release builder's hardcoded shadow target map plus two self-affirming tests are gone. The packaged body reached 22 executable targets rather than 26. Exact c04c3aff collapses the five-reexport auth wrapper crate into the transport's narrow direct codex-login imports. Exact ffcf036f advances runtime spine to v7 and derives the constant native runtime kind instead of persisting it. Focused release construction passes 17/17; the three release-owned daemon targets and current runtime epoch checks compile and pass.

Exact 03140a47 then deletes the packaged runtime-spine CLI and its duplicate Hello/catalog contract mirror, leaving 21 executable targets. Live providers own their CultMesh/CultNet catalogs; model preflight derives accepted document types from the real CultCache registration.

Exact 8c20f896 reduces Substrate Gate from six advertised contract families to its one real immutable repo-access grant. Request, review, refusal, snapshot, and mutation were prose-only constants with no typed body, writer, reader, or consequence. Two constructor-literal tests went with them; the governed-tool allowlist denial test remains.

Exact bb6f2ef6 deletes the fictional Hands rollback receipt and the alternate JSON gate-authority path. The coordinator now passes the exact persisted Hands intent/review IDs directly to the recorder. coordinator-summary.json remains operator display and cannot decide action authority.

Exact d66baa27, 058751fb, 573ddc8b, and 27fe11ae delete the generic runtime-event organ completely. Provider frames and typed model stream events are no longer copied into a second event family; arbitrary CLI callers cannot author event claims; session/job/failure commits no longer create duplicate terminal witnesses; and coordinator start/completion/death, retention, archival, status, CLI, registry, CultNet, and legacy-repair paths no longer read or write event shadows. Session/job state and exact typed terminal documents are the sole lifecycle owners. Core 337/337, model runtime 25/25, coordinator 8/8, swarm 4/4, coordinator-core 4/4, and affected native checks pass.

Competitive Eyes/Imagination pass

notes/munder-difflin-launch-intelligence-2026-08-23.md distills the 2026-08-22 Munder Difflin launch, its growth trail, product/source architecture, HN criticism, public failure ledger, pricing and trust boundaries, and implications for Epiphany, Aquarium, CultMesh, Bifrost, Idunn, and Model Atlas.

The durable signal is not an architectural victory claim. Munder has real category heat and is materially ahead at packaging, provider reuse, cross-platform reach, visual comprehension, distribution, community feedback, and commercial experimentation. Users appear to want an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness. Retention, reliable autonomy, and paid conversion remain unproven. The note proposes falsifiable golden-path, Aquarium, orchestration-overhead, memory, Body-binding, provider, federation, and willingness-to-pay experiments; none is adopted roadmap authority. The test-authority audit and Ox17 brake remain unchanged.

Interface correction: Epiphany does not currently expose its internal faculty and ecosystem vocabulary through a general operator UI. Beyond engineering tools, the concrete human-facing surface is Persona projection into shared asynchronous chat. CultMesh remains the projection-neutral state API. A social Aquarium, dense operator cockpit, TUI, and audit surface may use distinct Eve compositions and interaction models over the same provider-owned facts; no one projection should fossilize its layout into shared truth.

Operational state that matters

• Original c011 resident and Heartbeat containers are not running; both exited 255 on 2026-08-11. Their named volumes are quiescent historical evidence.
• Historical accepted live release: source 465af24d, c011 package SHA-256 089e0005; it is not the current source body.
• The old Yggdrasil capacity measurement is obsolete. The upgraded host is the intended swarm body and CI/CD machine. Idunn owns source-change compilation, testing, release construction, deployment, and daemon survival there; its current deployment truth belongs to Idunn's typed deployment receipts.
• Idunn is active, provenance-exact, and independent at installed source 8b972715c47731f2418d0c423cb0dd2076940bd7. Exact Epiphany source d2ca6630 remains the current symlink target; Starfire remains outside the compilation path. Production Epiphany units are inactive after exact rollback and deployment.env is absent. Idunn has zero restarts.
• Exact 9b9b5c85 passed Idunn's native gate under receipt SHA-256 6c6a71359f8c31297419665d2872f6982a89f84e197d71fc5b36a7fc86216093 and remains sealed as release sha256-30a910785a380224bbdbd56a7b742c8d058fa70cb72dab3562e3907903e0d191. A foreign-target helper restarted Idunn during its candidate transaction; exact rollback prevented false admission but exposed the missing cross-target transaction mutex.
• OpenRouter stealth/ox-alpha credential readiness is proven inside Resident Self's mount namespace. The production organism remains braked. Ox decisions exist only in isolated failed capstone roots and do not authorize production state.
• Bifrost public crossing remains active on Yggdrasil and publishes typed readiness. Its current Idunn observation is diagnostic-only rather than a lifecycle-authenticated admission. Frozen private Ox12 must prove Persona effects and exact context without emitting public speech.
• Model Atlas code and isolated proofs remain accepted. Signed Gate 1 sight, brake freeze, autonomous cascade, partition exercise, and endurance remain open.
• GitHub's August 2026 service incidents were external provider downtime. They do not count as Epiphany source-identity or grant failures; successful lookup and denial-before-network remain separately required evidence.

Git/worktree caution

The shared worktree contains unrelated pre-existing modifications, including vendored Codex/CultMesh files and a dirty vendor/cultnet-rs submodule. Preserve them. Stage only intentional migration/documentation paths. Do not use reset or checkout to clean the tree.

Re-entry

Read, in order:

1. state/map.yaml
2. this handoff
3. notes/epiphany-current-algorithmic-map.md
4. notes/epiphany-fork-implementation-plan.md

Then run the shared-target epiphany-state.exe status. Persisted next action is orientation, not automatic authority to resume a live Gate.