Epiphany/state/map.yaml

experiment:
  name: Epiphany
  body: F:\Projects\Epiphany
  purpose: Native, inspectable agent organism with typed state and explicit organ authority.

objective:
  current: Complete the source-subtraction and test-authority audit before admitting a fresh Ox17 package. Production remains braked and historical Ox roots are never resumed.

architecture:
  body: Repository, runtime, service processes, stores, interfaces, and deployment substrate.
  mind: CultCache-backed typed state admitted through Mind-owned transactions.
  self: Routes pressure and work; does not inherit another organ's authority.
  eyes: Establishes source and observation provenance before change.
  modeling: Maintains the source-grounded RepoModel and Body map.
  imagination: Proposes futures without adopting or executing them.
  hands: Changes the Body only through an admitted action route and scoped gate.
  soul: Verifies consequences and invariants at the layer where failure appears.
  persona: Owns public cognition and speech eligibility.
  continuity: Owns recovery, compaction, sleep, and restart protocol.
  model_atlas: Federates provider-owned offers and consumer-owned claims through signed publications; its projector derives edges, compatibility, cycles, and blast radius without owning dependency truth.
  substrate_gate: Owns access grants, not state admission.
  crossings:
    bifrost: Owns governed external transport and its signed receipts.
    idunn: Owns source-change CI/CD observation, compilation, testing, release construction, deployment, and daemon survival.
    cultmesh: Projects typed state without becoming its owner.
    brokkr: Owns Unity editor inspection and actuation; Epiphany consumes its typed CultMesh/Eve capabilities and receipts.
    model_provider: Owns explicit provider selection and exact provider lowering; OpenRouter/Ox is the admitted Yggdrasil provider, while Codex-derived transport remains an optional OpenAI boundary rather than Epiphany authority.
    codex: Retained only where an OpenAI provider needs its earned authentication or transport capability.

invariants:
  - Mind is the sole durable state-admission authority.
  - Modeling maps the Body; Eyes establishes provenance; Hands acts; Soul verifies; Self routes.
  - Persona speech and external consequences require explicit typed authority and signed receipts.
  - Bifrost owns external transport; Idunn owns deployment actuation; neither may impersonate Epiphany cognition.
  - CultMesh and Eve are projections, never owners of project truth.
  - Editor integration is provider-owned. Epiphany carries no Rider or Unity command organ; Brokkr owns Unity, and a future Rider daemon owns Rider.
  - Native model requests are canonical. Provider requests are derived internally through the selected typed provider dialect; credentials are injected by the deployment substrate and never become Mind authority.
  - Nobody owns a shared dependency edge; providers own offers, consumers own claims, Soul owns exact verification evidence, and the Atlas projector owns only deterministic derivation.
  - Atlas may wake local Modeling or Soul through consumer Self, but it never grants Hands authority or writes a foreign repository Mind.
  - The canonical swarm brake blocks Epiphany cognition and Epiphany-authored external consequences while preserving Epiphany read-only physiology and operator sight. It does not gate Idunn startup, Idunn self-bootstrap, or same-release daemon recovery: the persisted brake remains engaged across restart. A target brake may gate deployment mutation of that target, never Idunn itself or unrelated service lifecycle.
  - An Idunn bounded-redeploy helper only opens an exact expiring operator grant and wakes Idunn. The operator transaction owns terminal observation and explicit re-engagement; Idunn cannot possess the private identity that grants or closes its own deployment authority.
  - Corrupted Epiphany runtime state is an operator-enginseer intervention surface, not a permission boundary. Repair it proactively from authoritative evidence, preserve immutable evidence, and record exact before/after receipts; this standing repair authority does not bypass typed gates for new external consequences.
  - Evidence and git retain history; this map retains only state that changes future decisions.

current_status:
  decision_audit_cut: Exact f8412b69 adds a read-only context-ID audit projection over the sealed basis, decoded reasoning projection, exact terminal native/provider requests, governed tool observations, structured terminal records, and exact Mind commit receipts. Exact 5f66d6c9 adds deterministic read-only discovery of fully auditable terminal context IDs through the existing packaged model runtime; sealed but nonterminal contexts remain physiology and are omitted. Worker archive v1 retains the typed role and generic result family; runtime schema v2 refuses the prior digest-only writable archive shape. Yggdrasil CI then falsified five portable-test assumptions and accepted their source repairs through exact ebc0ffe4. Its sealed Linux package predates the operator-control-plane deletion and is now historical package evidence, not a deployable current release.
  provider_schema_cut: Exact 553f79d9 makes one OpenAI Responses dialect compiler own every role and Persona output schema. Provider-illegal conditional and parent-relative structure is removed, literal-only schemas receive explicit types, supported standard-model constraints remain generation guidance, and UUID formats lower to exact patterns. Full native decoding and family Mind admission remain final authority. Preserved packaged falsifications at 55fb4cf8, edd664db, and 1e01c339 prove refusal before inference, typed failure without Mind writes, successful concurrent Persona cognition, and transcript-free failure audit.
  repo_model_body_cut: Exact a8f3c1f0 makes the authenticated runtime Body route own initial keyed RepoModel binding. Bootstrap derives the digest from the admitted RepositoryBodyObservationBasis, initialization reauthenticates runtime, swarm, workspace, and Body binding before any write, and a hostile seed refuses with the whole store byte-identical. The exact 553f79d9 package exposed this root after concurrent Persona and terminal Modeling cognition; its result is not transplanted.
  semantic_cache_cut: Exact 856648de deletes the unused semantic-memory and workspace-coverage projection subsystem rather than preserving a second derived model of Mind. Four binaries, the local daemon supervisor, Qdrant/Ollama/Postgres configuration, projector policy/lifecycle/heartbeat/recovery state, semantic query/context packets, aggregate model revision/hash cargo, workspace file-cache reader, and Persona's always-empty semantic-recall fields are gone. No agent request builder or sealed reasoning projection consumed this cache. Modeling now reads the exact typed Body and keyed RepoModel projection directly; future retrieval evidence must enter through an earned typed provider receipt. Idunn remains the sole deployment and daemon-survival authority. Core 165/165, OpenAI runtime 25/25, and release construction 19/19 pass.
  repo_model_vocabulary_cut: Exact 6ea4ff3c deletes the redundant generic memory profile, dead SHA-1 ID factory, empty profile module, cache-only node/edge kinds, and impossible lifecycle variants. Exact 5218cf2c deletes the producerless RepoModel lifecycle-receipt family. Exact 8bb039af makes domains seed-owned and deletes the unreachable summary mutation/document/validation/registry path plus the test cargo that alone produced it. Exact ab1afc27 removes node salience/confidence and edge confidence because no owner read, validated, routed, or displayed those values. Modeling can author only the keyed repository operations advertised by its provider schema. Affected targets check cleanly; core remains 165/165, RepoModel 5/5, and reasoning-context 8/8.
  package_baseline: Exact d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4 remains the admitted production source and current symlink target. Its native serialized full-workspace gate passed with receipt SHA-256 de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482. Idunn sealed 26 root-owned non-writable binaries plus release-witness.ccmp as release sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06; witness-file SHA-256 is 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357. Source 9b9b5c85 also passed Idunn's native test gate under receipt SHA-256 6c6a71359f8c31297419665d2872f6982a89f84e197d71fc5b36a7fc86216093 and remains sealed as release sha256-30a910785a380224bbdbd56a7b742c8d058fa70cb72dab3562e3907903e0d191 with witness-file SHA-256 75bf52d31c56ea3b08e1a702273301c1db12a4b1ffae45e3d948ce8a29b50e1d. A foreign-target helper restarted Idunn during the Epiphany transaction; rollback restored d2ca, removed deployment.env, and left production Epiphany units inactive. OpenRouter model stealth/ox-alpha and its systemd-injected credential are readiness-proven. Idunn is active with zero restarts and its deployment brake is engaged.
  summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure plus generic job result to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
  public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
  competitive_launch_signal: The 2026-08-22 Munder Difflin launch analysis in notes/munder-difflin-launch-intelligence-2026-08-23.md is the current Eyes/Imagination owner for this category signal. It establishes strong demand to try a packaged, local, visual multi-agent control plane and supplies repeated qualitative demand for an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness; it does not establish retention, reliable autonomy, or paid product-market fit. Munder is materially ahead in installation, cross-platform reach, provider reuse, category compression, community formation, and feedback velocity. Its public failures make renderer-owned physiology, cross-Body restoration, proxy safety metrics, false consequence receipts, provider parity, and marketed-but-unavailable federation concrete falsification targets. Epiphany does not yet own a general operator UI: Persona projection into shared asynchronous chat is the concrete human surface, while CultMesh remains projection-neutral. Social Aquarium, a dense operator cockpit, TUI, and audit surfaces may use distinct Eve compositions over the same provider-owned facts. A one-hour projection experiment and managed continuity/federation remain evidence-led options rather than adopted roadmap authority; the source-subtraction and test-authority audit remains next.
  latest_phase: The fresh-package Ox17 lane remains paused for source subtraction. Exact 856648de is the largest current cut: 32,866 net source lines, four binaries, one competing daemon-survival authority, and the entire unconsumed semantic/workspace projection stack are gone. Earlier cuts removed heartbeat scheduling, test-only source inspection, counterfeit CultMesh families, false topology, dead operator surfaces, prose-only organ contracts, editor bridges, and other authorities sustained only by their own tests. Native runtime, keyed Mind, Persona, direct Body-to-Modeling flow, exact provider requests, provider-owned Bifrost feedback, and Odin/Idunn deployment receipts remain. Old writable epochs refuse; there is no migrator or dual reader. No Idunn build, package, deployment, or Ox root is authorized yet. Ox16 remains sealed historical evidence and must never resume.
  supervisor_subtraction: Exact 856648de completes the supervisor deletion. Epiphany owns no local generic daemon supervisor, semantic projector service, workspace-coverage projector, Windows Task Scheduler integration, or service-policy/lifecycle/heartbeat/recovery mirror. Idunn on Yggdrasil owns source-triggered compilation, testing, packaging, deployment, signed health, and daemon survival. The canonical Epiphany brake gates Epiphany cognition and consequence authority, not Idunn startup or unrelated lifecycle.
  launch_dependency_cut: Exact 2aeab7a9 deletes the generic organ dependency matrix, generic receipt catalogue/proof profiles, persisted worker-launch cargo, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. Family admission owners derive exact dependencies from typed state. Worker-launch schema v2 and Persona projector prompt v1 refuse the old writable shape. Core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1 pass.
  operator_surface_subtraction: Exact ef92e853 deletes the callerless view-lens registry, legacy acceptance-bundle builders, test-only raw-JSON result interpreters, and six tests: 797 net lines. Exact a292979d and 77e817c1 delete the duplicate CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. Exact 3b94bf6e and 59c5e3a6 delete the nested duplicate status view, false auxiliary mode, and ignored status arguments. Exact 7c9b0cf3 deletes the fixed synthetic job table, role-board job cargo/mappers, and its test: 338 net lines. Exact 2ce91461 deletes the scene/planning Mind reconstructions, duplicate self-policy crate, unused prompt templates, four counterfeit schemas, and ten producer/source-text tests: 1,723 net lines. Exact 78836f3b deletes eight unconsumed status tableaux, the pressure calculator production only called without telemetry, its unreachable compaction action, one counterfeit schema, and six tests: 518 net lines. Exact f10f7fb3 deletes the final twelve epiphany.surface.* schemas and ten catalog entries after every one proved producerless and consumerless: 692 pure deletions. Exact ab3cacfb deletes thirty-one more producerless contracts, the false runtime-session mutation mouth, every Epiphany-owned Rider/Unity command schema, a callerless prompt-context module, its test-only specialist prompt system, and four self-affirming tests: 3,514 net lines. Exact 16d85b1b deletes six duplicate JSON-schema builder tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. Exact 06f93f70 deletes the test-only inverse OpenAI-to-native request mapper and makes two retained tests follow canonical native-to-provider derivation: sixty net lines. The local catalog now has twenty-three live or portable contracts. Brokkr owns Unity capabilities through CultMesh/Eve; a future Rider daemon owns Rider. Status retains Mind identity, exact current work, one action/reason decision, readable role lanes, and operator thought sealing. Core checks cleanly; retained provider and focused request-flow tests pass.
  immutable_runtime_identity_cut: Exact bf997ce0 removes empty legacy frontier-decision echoes and requires exact worker-result provenance. Exact e00ea70f deletes the lossy PID-only process compatibility API. Exact 87983ffc makes runtime identity immutable bootstrap state: no update time, duplicated capability catalog, temporary metadata, or launch-time reconstruction survives. Current-work launch replays the original identity and existing root-session envelopes byte-for-byte as strong reads, preventing hidden singleton timestamp conflicts while retaining substitution refusal. Exact ffcf036f advances runtime spine to v7 and derives the constant native runtime kind at CultNet publication. The current-work capstone, epoch refusal, and OpenAI-runtime all-target checks pass.
  build_target_ownership_cut: Exact a319146b deletes the public non-atomic worker-launch path used only by test fixtures; exact 76fd259b deletes two source-layout tests while retaining real CLI refusal behavior. Exact b95a3266 deletes the superseded unpackaged OpenAI debug executable and the tests/helper that animated it. Exact 6f93134d makes epiphany-release-bundle the sole package owner for production entrypoints, disables automatic leaf binaries, reduces Cargo executable targets from 26 to 22, and deletes a hardcoded release target map plus two self-affirming tests that did not drive the build. Exact c04c3aff deletes the five-reexport auth wrapper crate; the transport imports its narrow Codex auth surface directly. Cargo metadata reports no binary source with multiple package owners; release construction passes 17/17.
  runtime_registry_authority_cut: Exact 03140a47 deletes the 649-line epiphany-runtime-spine operator/debug CLI, its packaged release role, its callerless Hello/schema-catalog service facsimile, the 600-line hand-maintained mutation-contract mirror, and the source-shape test that guarded that mirror. CultCache exact fdbf3bf exposes its registered type identities, so runtime status and model preflight derive accepted documents from the same registration used to open the Mind store. Executable targets fall from 22 to 21 with zero duplicate source owners. Core checks without warnings and release construction passes 17/17. Editor actuation remains entirely provider-owned: Brokkr owns Unity through CultMesh/Eve and a future Rider daemon owns Rider.
  coordinator_status_cut: Exact 500125d5 deletes the unconsumed packaged epiphany-mvp-status executable. Its live projection and operator-sanitization functions move from a binary source textually included by the coordinator into one epiphany-core module. The dead CLI parser, default store, result-file writer, release role, and redundant release assertion are gone. Cargo has 20 executable targets and zero duplicate binary-source owners; the release-owned coordinator checks, the operator thought-sealing test passes, and release construction remains 17/17.
  persona_language_tribunal_cut: Exact 63939fa2 deletes Persona's keyword-based projector-output tribunal, its test-only no-transcript prompt wrapper, and two tests that blessed prompt phrases and forbidden words rather than a consequence. Projector and Persona outputs remain inert private cognition sealed into exact stage contexts. Only the Interpreter's closed typed effect enum can propose state or speech; its channel, cardinality, size, schema, and exact-context validation remain. The three-stage execution/replay, channel-escape refusal, substituted provider/model refusal, retained typed-effect validation, and OpenAI-runtime all-target checks pass.
  bifrost_authority_cut: Exact 203bcc41 deletes Epiphany's producerless Bifrost body-change/GitHub publication family: four document types, three singleton latest heads, constructors, validators, writers, local-Verse advertisement/projection, public exports, and five tests that manufactured both ends. Bifrost owns the real Persona feedback/delivery stores and signed crossing receipts; Epiphany does not publish an alternate Bifrost protocol. Core and release-bundle checks pass; the remaining CultMesh suite passes 13/13.
  hands_pr_authority_cut: Exact 11d99de1 deletes the producerless HandsPrReceipt type, registration, dead test-only writer, read path, exports, relinquishment branch, and two contract advertisements. Hands owns local patch, command, and commit consequences; exact remote publication evidence belongs to the provider/Bifrost crossing. Core and release-bundle checks pass, and the rebuilt 43-entry schema catalog contains no deleted PR family.
  local_verse_contract_cut: Exact a4af4734 deletes six organ-specific contract DTO/factories, the callerless LocalVerseContext query/seed bundle, fixed Verse/room policy prose, the mind-contract self-test, and persisted cluster topology. The topology writer had no caller; supervision accepted any nonempty fixed-key subset without authenticating Body domain, completeness, or runtime binding. That false bootstrap gate, loader, exports, and its diagnostic test are gone. Exact 03140a47 later deletes the remaining standalone runtime contract mirror; live providers own their CultMesh/CultNet catalogs. Exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health remain supervisor prerequisites. The cut removes 1,005 net source lines; core/release checks, CultMesh 12/12, and supervisor 4/4 pass.
  tool_capability_cut: Exact beb9fd32 deletes the producerless EpiphanyToolCapability DTO/constructor, runtime registration and mutation-contract row, standalone schema/index entry, and MCP smoke-banner claim. No writer, reader, constructor call, admission path, or test existed. Exact model-request tool definitions, RuntimeToolExecutionBinding, invocation intents, and governed receipts remain owners. The canonical catalog drops from 43 to 42 schemas; four affected packages compile and the tool runtime passes 14/14 active tests with one live-source test ignored.
  continuity_contract_cut: Exact ca2d2cf2 deletes four prose-only Continuity mutation contracts and their constants: packet, compaction checkpoint, stale-turn repair, and refusal. None had a typed document, schema, store, writer, reader, or test. ContinuityRecoveryReceipt remains constructed and persisted by accepted reorientation. Core/release checks and decision-auditable reorientation 1/1 pass.
  soul_contract_cut: Exact f8974d52 deletes five prose-only Soul mutation contracts/constants: generic verification request, invariant check, regression receipt, review receipt, and verification refusal. None had a typed document, schema, store, writer, reader, or test. The keyed RepoFrontierVerificationRequest and persisted SoulVerdictReceipt remain the actual request/result path. Core/release checks and focused verification 3/3 pass.
  eyes_contract_cut: Exact 201fa192 deletes three prose-only Eyes mutation contracts/constants/exports: generic evidence request, evidence review, and evidence refusal. None had a typed document, schema, store, writer, reader, or test. Authenticated EyesSourceLookupReceipt rows and the exact research decision's persisted EyesEvidencePacket remain real. Core/release checks and focused Research 2/2 pass.
  persona_social_cut: Pending mentions, immutable requests, terminal receipts, quarantine records, retention heads, and retention plans are separate keyed CultCache documents. Persona derives its own deterministic work identity, reserves and terminalizes through exact batch CAS, cites the exact request envelope as pass-input provenance, and retries failed mentions without a timestamp or global revision. No scheduler can launch, block, retain, or provide pass provenance for Persona work.
  operational_state:
    local_worktree: source_subtraction_commits_landed_ox17_and_deployment_paused
    docker_engine_access: starfire_compiler_retired_all_yggdrasil_epiphany_transient_containers_volumes_package_roots_and_per_run_test_target_removed_future_idunn_epiphany_builds_native_rust_1_95_0_via_gamecult_ops_89f0d78
    operator_wireguard: restored
    starfire_persona_permit_firewall: persistent_exact_gamecult_ops_6ee08a4
    yggdrasil: upgraded_16_vcpu_62_gib_2_tib_intended_swarm_and_cicd_host
    yggdrasil_idunn_epiphany_cicd: exact_8b972715c47731f2418d0c423cb0dd2076940bd7_provenance_live_nrestarts_0_native_epiphany_builder_and_generic_signed_health_validator_live
    yggdrasil_epiphany_package: source_d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4_release_sha256_46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06_witness_file_sha256_348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357_26_binaries_plus_witness_root_owned_nonwritable
    yggdrasil_epiphany_test_receipt: sha256_de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482_native_serial_workspace_passed
    yggdrasil_epiphany_deployment: request_2026_08_22T16_35_41_670Z_succeeded_exact_d2ca6630_native_test_package_signed_authenticated_health_active_openrouter_ox_credential_ready_swarm_and_deployment_brakes_engaged
    ox10_failed_capstone: sealed_braked_inactive_exact_470d4cb5_direct_body_modeling_without_eyes_exact_failure_context_no_mind_commit_no_public_consequence_retry_projection_falsified
    ox12_frozen_capstone: root_ox12_84a7dec1_private_inactive_historical_epoch_direct_body_modeling_without_eyes_openrouter_proposal_attempt_1_structured_result_repo_model_mutation_refused_absent_frontier_dependency_no_public_consequence_never_resume
    ox16_frozen_capstone: root_ox16_749d977e_private_inactive_historical_epoch_direct_body_modeling_without_eyes_concurrent_persona_historical_direction_proof_survived_disjoint_model_changes_planning_blocked_by_evidence_paths_impersonating_repository_authority_no_hands_no_public_consequence_never_resume
    yggdrasil_epiphany_749d_package: source_749d977e_release_sha256_5d9bc25612dd46511620671ccd5113f3b5e0e3c060c85e97dcdc199f9126a230_test_receipt_sha256_39229d8a526a7af7e7b29cec28d27b07f89ba5f5792658947e3d1d039b9449c4_historical_exact_package
    starfire: operator_workstation_and_source_checkout_not_cicd_build_body
    starfire_runtime_identity: epiphany-starfire
    starfire_swarm_brake: original_c011_quiescent_exited_255_f90_copied_proof_body_braked_and_stopped_exit_zero
    starfire_release: exact_465af24d_sha256_089e0005_historical_c011_not_running
    starfire_repository_body: bound_and_observed
    starfire_verse_topology: bound_to_current_repository_body
    starfire_native_status: canonical_docs_corrected_original_c011_containers_exited_255_named_volumes_quiescent
    bifrost: exact_cb3239aa_f67f5122_native_runtime_active_on_yggdrasil
    bifrost_persona_feedback: ready_on_yggdrasil
    bifrost_feedback_binding: gamecult_aquarium_to_epiphany_starfire
    bifrost_feedback_crossing: authenticated_transport_only
    bifrost_persona_mouth: active_on_yggdrasil_10_77_0_1_17876
    starfire_persona_permit: authenticated_prior_release_pid_19024_10_77_0_2_17877
    persona_first_live_consequence: signed_failed_expired_without_repost
    persona_second_live_consequence: signed_unknown_unreceipted_bridge_refusal_without_repost
    persona_permit_probe: unique_node_rust_node_request_completed
    persona_fresh_consequence: blocked_by_absent_yggdrasil_discord_credential
    yggdrasil_epiphany_services: production_units_inactive_after_exact_rollback_current_symlink_d2ca6630_deployment_env_absent_idunn_active_nrestarts_0_deployment_brake_engaged_stale_failed_transient_ox_units_reset
    yggdrasil_previous_capacity_2026_08_08: historical_2_vcpu_1_9_gib_measurement_obsolete_after_host_upgrade
    yggdrasil_linux_physiology_smoke: exact_b5140288_runtime_spine_sha256_14143382_passed_and_removed
    starfire_linux_model_cognition: exact_a0d56f94_model_runtime_sha256_c72f33ed_two_turns_passed_20_mib_peak_rss
    starfire_linux_resident_coordination: exact_c0055772_heartbeat_self_plan_coordinator_passed
    starfire_linux_resident_peak: 62590976_bytes_self_plus_coordinator_plus_model_worker
    starfire_linux_role_cognition: eyes_and_modeling_tools_results_and_acceptance_proven_zero_consequence
    starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
    yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
    resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
  unresolved_authority: Generic command, legacy lineage, caller-authored identity, behaviorless policy fields, global lifecycle latest state, timestamp election, Windows Task Scheduler authority, and their false proofs are gone. Semantic and workspace launch owners are separate over shared process mechanics. The remaining daemon supervisor still combines the service loop, aggregate signed-health publication, semantic reconciliation, and the large workspace recovery state machine. Continue decomposing only where ownership becomes smaller; do not create family frameworks or adapters. The false persisted cluster-topology bootstrap sentinel is gone; supervisor admission remains bound to exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health. The current gamecult-ops Epiphany unit has retired agent-store and daemon-id argv that its owning lane must fix before deployment. Fresh exact-package Ox17 and Model Atlas Gate 1 remain paused until subtraction closes. Bifrost remains Persona and governed external-consequence transport. Historical c011 and partial Gate roots stay untouched/read-only.
  next_action: Continue the source/test-authority audit after exact 63939fa2. Retain only code and tests that reach decision admission, validation, authentication, keyed CAS conflict/replay, exact projection, provider lowering, or an externally visible consequence. Delete test-only APIs and fixtures with the tests they animate. Preserve sealed decision audit, direct typed Body-to-Modeling flow, provider-owned CultMesh/Eve documents, keyed Persona state, exact current work, immutable runtime identity, single-package binary ownership, family admission owners, and typed Persona effect validation. Epiphany owns no local daemon supervisor, standalone schema service, status CLI, editor bridge, or keyword tribunal over natural language. Do not run a local full-workspace compile, package, deployment, or Ox root.

  runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.

active_subgoals:
  - Complete the fresh exact-package Decision-Auditable Concurrent Mind capstone before any further operational Gate run.
  - Prove the ordered Model Atlas Gate 1 with real isolated stores: establish signed sight before engaging all brakes, then prove frozen read-only state and no local Modeling or Soul wakes.
  - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
  - Prove a live coordinated path from source gathering through the Hands gate and post-action verification.
  - Bound artifact retention and prove supervised restart, crash recovery, session closure, and long-duration resource behavior.
  - Keep source editing on F:. Idunn on upgraded Yggdrasil owns source-triggered compilation, testing, packaging, deployment, and daemon survival; do not duplicate that work on Starfire.

organ_readiness:
  model_atlas: code-complete and locally verified; ordinary Modeling uses runtime-authored proposal v2, authenticated Body-manifest evidence, derived opaque IDs, and exact CAS. Publishers revalidate Body evidence; signed transport, deterministic enriched projection, one Eve tree, local impact admission, Resident Self lane pressure, brakes, partition staleness, cycle policy, and no-Hands boundary pass. Real ordered Starfire Gate 1 and sustained dogfood remain open.
  persona: partial; the live Projector -> Persona -> Interpreter loop now consumes Ghostlight's exact-revision generalized projection membrane, and the Persona receives only one lived narrative stream rather than parallel raw transcript, memory, mention, activity, or typed-state authorities. Epiphany retains stage receipts, effect validation, Mind admission, brakes, Bifrost consequence gates, and terminal commit. Cross-host request/receipt/permit organs, distinct identities, exact release admission, unique permit completion, signed failure/unknown receipts, and no-repost behavior are live. Exact Bifrost cb3239aa fixes positional permit bodies and binds the Discord bridge command receipt to the signed request. A completed public consequence remains unproven because Yggdrasil has no Discord bot credential.
  self: partial; proposal recovery, Mind admission, current-model Hands routing, Soul lifecycle precedence, verdict incorporation, proposal preemption, explicit-obligation Eyes routing, in-process status ownership, causal Soul-to-Modeling routing, and grant-owned lifecycle projection are live. Exact c7412998 removes accepted Eyes, generic regather, role lanes, and Modeling hints from Research launch authority; the exact Research lifecycle alone drives Launch/Wait/Review, and accepted Eyes alone cannot manufacture Modeling. Exact d4907ee8 proves first-attempt proposal Modeling fulfillment, exact grant terminalization, and one terminal downstream review whose receipt carries the post-transaction awaitFrontierProposal action without replay.
  eyes: local and copied Linux source-gathering circuits are proven. Immutable GitHub identity, execution revalidation without a grant, frontier-owned continuation, request-owned exact public-source coverage, sealed decision context, and keyed evidence/observation admission share typed owners. Exact c7412998 makes one Research lifecycle own launch, terminal decision durability, review, and Eyes.frontier_research admission; full RepoModel state is audit cargo while the exact frontier closure owns conflicts. Exact 3d13b1ea rejects zero, partial, or unrequested public lookup sets. Exact c40aa286 shares terminal receipt validation across provider and Mind. Exact packaged f90f1186 completed two immutable public lookup and Mind-acceptance cycles, advanced authenticated tool receipts from 53 to 61, produced no Hands consequence, survived process turnover, and stopped braked with both daemons exiting zero. GitHub's August 2026 service incidents are classified as external provider downtime; they do not falsify Epiphany's source identity or gate ownership. Denial-before-network and successful immutable lookup remain separate proofs.
  modeling: proven for the current bounded Windows circuit, the causal Linux resident Eyes-to-Modeling route, governed live directory observation, typed resident grant sight, first-attempt proposal-frontier publication, and single-consumption coordinator review. Exact d367e525 proves the full frontier-verdict lifecycle from atomic Soul request through deterministic launch, sealed decision, disjoint keyed merge, same-frontier refusal, and Modeling.frontier_verdict admission. Exact d4907ee8 proves one outer proposal job, one terminal review, post-transaction awaitFrontierProposal publication, and no replay. Broader Body-map coverage remains open.
  imagination: proven for three bounded live circuits, exact packaged receipt-free settlement, and genuine packaged model-produced option generation. Exact acd91e6e accepted signed public feedback into one proposal-only request, derived all causal identity and quoted-evidence references from authenticated runtime context, atomically published worker result plus candidate companion, settled Self once without retry, and neither adopted the proposal nor granted Hands. The rejected b661ec4b copied run remains evidence that model-authored evidence identifiers were an illicit provenance mouth; its three failed attempts were braked and sealed.
  hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind reviewed path ceilings to exact changed-path subsets.
  soul: proven for the current bounded route-chain consequence; exact d367e525 makes Verification acceptance atomically own the Soul verdict and deterministic frontier-Modeling request rather than relying on later accepted-at selection. Exact d3bfbda0 launched Verification through typed plan-decision provenance, result f23fe2b6 was accepted at revision 57, and Self then derived Modeling before any repeated Hands authority.
  mind: proven for launch-owned resident frontier adjudication; two historical attempts failed closed, exact bd96305e derived immutable identity from authenticated launch, authorized retry 2d2a3e8b completed, and Self atomically committed terminal adopt decision e7d7f3c7. Broader memory retention and long-duration behavior remain open.
  continuity: partial; authenticated 55660d78 terminalized the copied v28 dead worker once and refused duplicate restart, while sealed v28 remained unchanged. Exact 100d8854 closes only all-terminal sessions, emits one deterministic event, and refuses post-close jobs. Exact 42bc665a proves bounded retention and restart sequence recovery. A digest-pinned Linux runtime-spine at b5140288 repeated closure invariants on Yggdrasil. Authenticated c005 proves typed resident state survives hard exit, executable-body replacement, runtime-topology correction, and restart while preserving awaitFrontierProposal. Exact b8138a6b proves active-child and idle SIGTERM closure with exit zero and final braked state. Exact c930f505 proves cross-container resident ownership refusal without state mutation while Heartbeat retains its distinct typed lock. Exact ed15f83a packages resident lifecycle retention. Exact 16c4b19f packages coordinator receipt retention without resurrection. Exact 75b84180 packaged Linux proves worker start gating, claimed/active orphan death recovery, canonical resident requeue, and one distinct same-request retry without dual live authority. Exact 7637b1cf packages and proves atomic generic job/result/event plus terminal-failure process closure, canonical resident settlement, and a distinct same-request retry with no dual live authority. Exact 2e66433f packaged Self proves admitted-model-direction valid-result-before-receipt closes once without retry. Exact 52ee6b53 packages the corrected full-backing resident retention fence. Exact 53678374 packages authenticated failed and fulfilled outer-worker archival: window one retires only the older exact seven-envelope family, retained authority stays live, archived failure cannot resurrect, and archived fulfillment remains queryable. Direct packaged proposal Modeling and deployed journald ownership are accepted. Exact a4756857 packages CultCache 0ba8745 and proves named-volume publication across forty SIGKILL writers plus ten million concurrent lockless reads. Exact f04abd6b restarts a sealed braked resident with startup maintenance, stable revision/hashes, no grant resurrection, 0.36% sampled CPU, and a second clean SIGTERM exit zero.
  nervous_system: partial; detached scheduling, runtime jobs, typed feedback, ordinary Windows coverage-store identity, and operator projection work. Exact c0055772 proves Linux heartbeat acknowledgement/regrant, Self single-consumption launch, authenticated plan coordinator completion, and a persistent resident body. The accepted Linux Eyes-to-Modeling circuit proves detached role workers, native read-only tool loops, typed admission, and causal next-organ routing. Exact 16407f7e adds cross-container readiness ownership and an actual c006 923-pulse braked plateau. Exact c9a2a979 adds two consecutive causal grants with clean terminal settlement, then completed 36,700 total Heartbeat iterations across a 10h23m braked endurance run with bounded artifacts, stable authority hashes, and clean dual exit zero. Exact 3f37503e makes the brake a true cognition-ingress boundary and proves 0.29-0.33% copied resident CPU at one-second cadence. Exact f04abd6b decouples maintenance from polling and proves released sleeping CPU about 3.0% at five-second cadence with stable authority, no grant, restored brake, and clean shutdown. Exact ec54666c closes the local-Verse reader classification. Exact acd91e6e proves signed Bifrost ingress through Heartbeat, Self, coordinator, OpenAI Imagination, runtime-owned candidate admission, terminal acknowledgement, and braked restart with one grant and no resurrection. Historical container runs used bounded local logs. The prior migration suite was compiled natively before the Idunn boundary correction; all subsequent source-change compilation, testing, packaging, and deployment belongs to Idunn on upgraded Yggdrasil. Deployment admission remains outside this source pass.

forbidden_actions:
  - Do not issue a speculative deployment grant.
  - Do not mutate or restart Yggdrasil from this source task while the deployment task owns its preparation.
  - Do not reuse pre-upgrade Yggdrasil capacity measurements or service topology as current deployment truth.
  - Do not treat stored status, process liveness, or an old receipt as current authority.

memory_policy:
  canonical_map: state/map.yaml
  live_handoff: notes/fresh-workspace-handoff.md
  durable_evidence: state/ledgers.msgpack
  historical_provenance: Git history and archived notes
  rule: If a fact does not constrain a current decision or explain a live invariant, it does not belong in the active Mind.