Epiphany/state/map.yaml

experiment:
  name: Epiphany
  body: F:\Projects\Epiphany
  purpose: Native, inspectable agent organism with typed state and explicit organ authority.

objective:
  current: Diagnose why the authorized gpt-5.6-luna comparison closed its authenticated Connector socket before any tool round while Ghostlight routinely completes a different no-tool Luna workload through the same daemon. No further capstone attempt is admitted. Production remains inactive and Atlas Gate 1 paused.

architecture:
  body: Repository, runtime, service processes, stores, interfaces, and deployment substrate.
  mind: CultCache-backed typed state admitted through Mind-owned transactions.
  self: Routes pressure and work; does not inherit another organ's authority.
  eyes: Establishes source and observation provenance before change.
  modeling: Maintains the source-grounded RepoModel and Body map.
  imagination: Proposes futures without adopting or executing them.
  hands: Changes the Body only through an admitted action route and scoped gate.
  soul: Verifies consequences and invariants at the layer where failure appears.
  persona: Owns public cognition and speech eligibility.
  continuity: Owns recovery, compaction, sleep, and restart protocol.
  model_atlas: Federates provider-owned offers and consumer-owned claims through signed publications; its projector derives edges, compatibility, cycles, and blast radius without owning dependency truth.
  substrate_gate: Owns access grants, not state admission.
  crossings:
    bifrost: Owns governed external transport and its signed receipts.
    idunn: Owns source-change CI/CD observation, compilation, testing, release construction, deployment, and daemon survival.
    cultmesh: Projects typed state without becoming its owner.
    brokkr: Owns Unity editor inspection and actuation; Epiphany consumes its typed CultMesh/Eve capabilities and receipts.
    model_provider: Owns explicit provider selection and exact provider lowering. Epiphany is backend-agnostic. Codex, Claude, and OpenAI-compatible APIs are reached through separate connectors, which share one standardized Epiphany-facing CultNet API that Ghostlight also consumes. Today the independent CodexConnector is the admitted non-production capstone credential and transport boundary, with a distinct caller identity. Production Epiphany remains inactive on its historical OpenRouter configuration.
    codex: One connector backend among several. Epiphany's compiled body holds no Codex implementation or transport (evicted in 7a125d78 and ed7357a2); Codex auth and transport belong to CodexConnector.

invariants:
  - Mind is the sole durable state-admission authority.
  - Modeling maps the Body; Eyes establishes provenance; Hands acts; Soul verifies; Self routes.
  - Persona speech and external consequences require explicit typed authority and signed receipts.
  - Bifrost owns external transport; Idunn owns deployment actuation; neither may impersonate Epiphany cognition.
  - CultMesh and Eve are projections, never owners of project truth.
  - Editor integration is provider-owned. Epiphany carries no Rider or Unity command organ; Brokkr owns Unity, and a future Rider daemon owns Rider.
  - Native model requests are canonical. Provider requests are derived internally through the selected typed provider dialect; credentials are injected by the deployment substrate and never become Mind authority.
  - Nobody owns a shared dependency edge; providers own offers, consumers own claims, Soul owns exact verification evidence, and the Atlas projector owns only deterministic derivation.
  - Atlas may wake local Modeling or Soul through consumer Self, but it never grants Hands authority or writes a foreign repository Mind.
  - The canonical swarm brake blocks Epiphany cognition and Epiphany-authored external consequences while preserving Epiphany read-only physiology and operator sight. It does not gate Idunn startup, Idunn self-bootstrap, or same-release daemon recovery: the persisted brake remains engaged across restart. A target brake may gate deployment mutation of that target, never Idunn itself or unrelated service lifecycle.
  - An Idunn bounded-redeploy helper only opens an exact expiring operator grant and wakes Idunn. The operator transaction owns terminal observation and explicit re-engagement; Idunn cannot possess the private identity that grants or closes its own deployment authority.
  - Corrupted Epiphany runtime state is an operator-enginseer intervention surface, not a permission boundary. Repair it proactively from authoritative evidence, preserve immutable evidence, and record exact before/after receipts; this standing repair authority does not bypass typed gates for new external consequences.
  - Evidence and git retain history; this map retains only state that changes future decisions.

current_status:
  model_session_and_verification_input_cut: >-
    Exact dbb00c2b removes six echo-only fields from the in-memory model-turn
    summary and deletes the one-field session-closure options wrapper: 38 net
    lines. The accompanying lifecycle audit retains EpiphanyRuntimeSession plus
    the private EpiphanyArchivedRuntimeSession for two distinct invariants. The
    live active/completed latch is the explicit phase boundary between tool
    rounds; the archived identity sets and deletion digest prevent retired
    session, job, model-request, and tool-intent identities from resurrecting
    after their bindings are deleted. Exact 24023265 then deletes the live
    read_hands_receipt tool, three public runtime-store readers, their exports,
    prompt mandate, tool schema/test, source-dispatch store argument, and stale
    Substrate Gate allowlist entry. Verification already receives the exact
    patch, command, and commit receipts inside its sealed typed projection, so
    reopening mutable runtime state duplicated decision input and weakened
    replayability. The receipt chain and its atomic Hands-to-Verification
    admission remain intact. Tool runtime 8/8, OpenAI runtime 21/21, the
    release-owned tool daemon, and the full keyed Persona/Hands lifecycle proof
    pass. The second cut removes 78 maintained lines net. Verification generated
    4.909 GiB across 7,687 files; cleanup restored only the exact 1,776,640-byte
    authenticated state inspector. No schema epoch changes; Atlas is untouched.
  generic_runtime_result_cut: >-
    Exact 2c3335dc deletes EpiphanyRuntimeJobResult, its completion DTO,
    snapshot wrapper, schema registration, archive cargo, audit branch, and
    every summary/next-move/result-ID projection. Typed role and reorientation
    outcomes now atomically terminalize their own job and process claim; native
    model receipts or EpiphanyModelPassFailure own model-pass terminality; the
    exact process claim owns process death. Reorientation failure admission
    binds the typed model failure directly. One shared worker-outcome rule maps
    success to Completed/TerminalResult and typed failure to
    Failed/TerminalFailure, and failed archives may retain the full typed
    failure rather than erasing it. Runtime/Mind writable epochs advance to
    v45/v11 with no compatibility reader. Core 152/152, OpenAI runtime 21/21,
    release model runtime 12/12, coordinator and Persona entrypoint checks
    pass. The cut removes 361 maintained lines net. Verification generated
    6.349 GiB across 7,376 files; cleanup restored only the exact 1,776,640-byte
    authenticated state inspector. Atlas remains intact and operationally
    unaccepted.
  worker_launch_authority_cut: >-
    Exact edb5c3a3 makes the sealed typed worker launch document the sole live
    owner of pass-family identity. Eight optional request-ID fields disappear
    from the persisted launch and heartbeat options; eight family echoes plus
    Body basis and frontier-route echoes disappear from the terminal role
    result. Live routing decodes the launch, while retained history uses the
    archived attempt's exact request kind/ID and preserved structured decision.
    Terminal success must carry the semantic payload required by its launch;
    typed failure carries one nonempty error and no success cargo. Runtime
    advances to v39 and the role-result contract to v5 with no compatibility
    reader. The cut removes 443 maintained lines net. Focused Core, OpenAI
    runtime, release-owned model binary, state-flow capstone, context audit,
    concurrent CAS, failure, and old-epoch proofs pass.
  semantic_state_package_cut: >-
    Exact 07529fb5 deletes the epiphany-state-model package after proving
    epiphany-core is its sole consumer. The ordinary Serde semantic contracts
    move unchanged into one Core-owned module; unused JsonSchema and TypeScript
    derives, schemars and ts-rs, duplicate memory-graph re-exports, three stale
    WebSocket patch pins, and 99 lockfile lines disappear. The committed
    structural delta is 201 net deletions and one fewer Cargo package. Core
    checks without warnings; the deterministic keyed-Mind and repository-path
    consequence proofs pass. Whole-Core Clippy remains blocked by 58
    pre-existing lints outside this cut. Verification generated 1.842 GB across
    2,718 files; cleanup restored only the exact 1,776,640-byte state inspector.
    No schema epoch changes because serialized contracts did not change. Atlas
    and live deployment remain untouched.
  decision_audit_cut: Exact f8412b69 adds a read-only context-ID audit projection over the sealed basis, decoded reasoning projection, exact terminal native/provider requests, governed tool observations, structured terminal records, and exact Mind commit receipts. Exact 5f66d6c9 adds deterministic read-only discovery of fully auditable terminal context IDs through the existing packaged model runtime; sealed but nonterminal contexts remain physiology and are omitted. Worker archive v1 retains the typed role and generic result family; runtime schema v2 refuses the prior digest-only writable archive shape. Yggdrasil CI then falsified five portable-test assumptions and accepted their source repairs through exact ebc0ffe4. Its sealed Linux package predates the operator-control-plane deletion and is now historical package evidence, not a deployable current release.
  provider_schema_cut: Exact 553f79d9 makes one OpenAI Responses dialect compiler own every role and Persona output schema. Provider-illegal conditional and parent-relative structure is removed, literal-only schemas receive explicit types, supported standard-model constraints remain generation guidance, and UUID formats lower to exact patterns. Full native decoding and family Mind admission remain final authority. Preserved packaged falsifications at 55fb4cf8, edd664db, and 1e01c339 prove refusal before inference, typed failure without Mind writes, successful concurrent Persona cognition, and transcript-free failure audit.
  repo_model_body_cut: Exact a8f3c1f0 makes the authenticated runtime Body route own initial keyed RepoModel binding. Bootstrap derives the digest from the admitted RepositoryBodyObservationBasis, initialization reauthenticates runtime, swarm, workspace, and Body binding before any write, and a hostile seed refuses with the whole store byte-identical. The exact 553f79d9 package exposed this root after concurrent Persona and terminal Modeling cognition; its result is not transplanted. Exact 79292fe3 makes one authenticated Repository Body snapshot load own runtime route, Body binding, historical observation, and manifest validation. Basis validation, Mind admission, Modeling projection, and manifest consumers no longer validate, reopen, and reconstruct the same head against a second store read.
  semantic_cache_cut: Exact 856648de deletes the unused semantic-memory and workspace-coverage projection subsystem rather than preserving a second derived model of Mind. Four binaries, the local daemon supervisor, Qdrant/Ollama/Postgres configuration, projector policy/lifecycle/heartbeat/recovery state, semantic query/context packets, aggregate model revision/hash cargo, workspace file-cache reader, and Persona's always-empty semantic-recall fields are gone. No agent request builder or sealed reasoning projection consumed this cache. Modeling now reads the exact typed Body and keyed RepoModel projection directly; future retrieval evidence must enter through an earned typed provider receipt. Idunn remains the sole deployment and daemon-survival authority. Core 165/165, OpenAI runtime 25/25, and release construction 19/19 pass.
  repo_model_vocabulary_cut: Exact 6ea4ff3c deletes the redundant generic memory profile, dead SHA-1 ID factory, empty profile module, cache-only node/edge kinds, and impossible lifecycle variants. Exact 5218cf2c deletes the producerless RepoModel lifecycle-receipt family. Exact 8bb039af makes domains seed-owned and deletes the unreachable summary mutation/document/validation/registry path plus the test cargo that alone produced it. Exact ab1afc27 removes node salience/confidence and edge confidence because no owner read, validated, routed, or displayed those values. Modeling can author only the keyed repository operations advertised by its provider schema. Affected targets check cleanly; core remains 165/165, RepoModel 5/5, and reasoning-context 8/8.
  package_baseline: Production remains exact d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4, inactive, and braked. Non-production image sha256:af748394b5098f85a4d4571243e0f0937f3e9126f9ab5bec33ae0c89983981c0 is built from exact Epiphany 377be331b9b86d7404a441f0d9a9f62081b86126. Idunn exact 7e31921c4b53563d7a7f10e756d0dd1458fe7688 owns its isolated lifecycle. Deployed gamecult-ops policy exact 36892263864351b9bcf946e67f0edddc2d9e4ec0 admits caller `epiphany-model-runtime` to gpt-5.6-luna. Connector client and deployed daemon are exact be1776ab455fd79bd74b393518ab07211dc9c1f0. The root-owned credential is group-readable and mounted read-only. Direct container-gateway transport is bounded by UFW; the obsolete guest proxy is deleted. Container 920c23d1a63159c2a2b293c4ff58476b283f2cc34eef1b38f0559e8bcfa9b400 is exited after the failed Luna comparison; bridge and UFW aperture are stopped. Its failed roots grant no continuation authority.
  ox17_capstone_attempt: Historical container c50a1a83118d on immutable image sha256:12bc9a30ad455db2709c0b0749bde84e1c763c5cd36d1ea158112fdaa1deed9c launched direct Body Modeling from exact Epiphany 27e1dca1. Three corrected provider attempts produced three connector connection failures because host UFW blocked the container-to-host route; a secondary typed model-pass failure identity collision followed. No accepted model result, Mind consequence, Hands mutation, or public speech exists. Its state and work volumes, Docker inspections, logs, hashes, and exact revision receipt are sealed read-only under attempt `20260825-c50a1a83118d-f4697376-caff-4b38-a331-24e31f334d8b`; readback checks pass. The container and both volumes are deleted. Ox17 is historical evidence, not an active deployment identity.
  capstone_17_transport_attempts: Three independent fresh gpt-5.4 roots completed 6, 6, and 4 coherent authenticated provider/tool cycles before terminating respectively with provider SSE timeout, Connector I/O failure, and provider SSE timeout. Each admitted exactly one typed terminal failure and no Mind commit, Hands mutation, or public speech. The failure-identity collision is repaired and did not recur. Credential access and direct bounded gateway transport are proven. The third failed body is sealed under `/srv/epiphany/capstones/failures/20260825T123821Z-manual:redeploy:yggdrasil-epiphany-capstone-17:manual:redeploy:yggdrasil-epiphany-capstone-17:2026-08-25T12:27:14.826Z-877e506f-eacf-42c2-a066-03e0ffaaf6c9`. This proves sustained transport and typed failure terminality, not capstone acceptance.
  capstone_17_luna_comparison: One authorized fresh Mind root at `/var/lib/gamecult/epiphany/luna/runtime/runtime.cc` used exact image sha256:af748394b5098f85a4d4571243e0f0937f3e9126f9ab5bec33ae0c89983981c0, Epiphany 377be331b9b86d7404a441f0d9a9f62081b86126, Connector client and daemon be1776ab455fd79bd74b393518ab07211dc9c1f0, caller `epiphany-model-runtime`, and gpt-5.6-luna. Job `body-modeling-0122c8f7ad5240535f427b8b25e5cfb5aa02ad931d5e39c491fad2a7c3984a36-attempt-0` failed before any tool round with `connector client connection failed: failed to fill whole buffer`. The daemon, direct bridge, and UFW aperture remained active during the request; no CAPSTONE-17.md, Hands mutation, or public speech exists. Exactly one typed failure was admitted. Evidence is checksum-sealed under `/srv/epiphany/capstones/failures/20260825T131038Z-capstone-17-luna-comparison-da62aa1d-a4bc-4e9f-985e-7c6541bcb826`. Ghostlight is comparative evidence only: it uses the same daemon and Luna with low/medium reasoning, no tools, routine completions, and occasional timeout or provider-failed results. The request shapes are not equivalent.
  summary: The keyed RepoModel hard cut, decision-context foundation, Model Atlas code slice, complete Body, Proposal, frontier-verdict Modeling, frontier Research, frontier Verification, frontier Planning/PlanMind, Reorientation, and Persona decision-context lifecycles are landed on codex/epiphany-shakedown-live. Keyed Mind plus exact runtime receipts own coordinator presence, work discovery, deterministic launch, job-bound continuation, review, typed failure, semantic admission, and retained decision reachability. Exact 07d891ba and ec1431ff delete the persisted/global thread aggregate and its generic coordinator/prompt/revision surfaces. Exact f7948795 deletes MindGatewayReview, MindStateCommitReceipt v0, the generic interpreter prompt, runtime registration/read APIs, false thought/state-effect/adoption CultNet mouths, and stale launch proof profiles. CultMesh now projects only reasoning basis, decision context, and exact Mind commit receipt, read-only. Exact 1c9aafd8 seals the terminal decision context before model-backed frontier-Planning failure and binds the typed failure to it. Exact e0e75a30 deletes the residual aggregate role patch/parser/policy surface, gives Research one closed typed decision, and deletes the unowned generic Imagination planning patch. Exact 12b1b285 makes runtime model/tool binding validation the shared owner for execution and decision sealing; hostile provider, receipt, and stored-binding substitutions refuse, while retained basis/context audit survives transcript-delta deletion. Exact 01602fd3 advances Mind/runtime to v2/v1 and refuses historical or split writable identity pairs before registered writers see them. Exact 26b6a5bf proves simultaneous disjoint Modeling writes, simultaneous Verification+Modeling admission, same-identity conflict, exact replay, and reopened graph assembly; raw mutation primitives are crate-private. Exact 7c2ebd81 moves Persona state-note admission from the legacy agent-memory aggregate into keyed Mind documents and proves a concrete Hands consequence can commit simultaneously. Exact 79c0e373 seals the assembled Persona input and observed source versions in Mind before inference. Exact d3300bba authenticates that input through its one exact Mind commit, refuses naked typed documents, re-enters without external observation or model inference, and proves current-work reconstruction is identical and read-only across Launch, Wait, completed, and post-Research boundaries. Exact edb5c3a3 deletes the launch, heartbeat, and terminal-result family identity mirrors: the sealed typed launch owns live pass identity and the archived attempt owns historical request identity. Exact cabdd6c3 separates immutable coordinator incarnation basis/terminality from minimal model-session admission and removes the remaining session prose, clocks, dead states, redundant options, and whole-store coordinator snapshot. Exact a46725a1 reduces runtime jobs to Queued/Completed/Failed admission latches and removes timestamp selection from Research. Exact 10a70afc derives job role/session ownership from sealed launches and model bindings, leaving the generic job as identity plus status. Exact 53e869c0 removes generic job-result evidence/artifact mirrors; exact 8eaa96c5 stops persisting generic result documents for structured worker decisions; exact 2c3335dc deletes the generic result family entirely and makes typed decisions, model receipts/failures, job status, and process claims own their respective terminal facts. Exact dbb00c2b retains the minimal live/archive session pair for explicit phase closure and retired-identity refusal while deleting display echoes and a wrapper. Exact 24023265 makes the sealed Verification projection the sole Hands receipt input and deletes the duplicate live reread path. Exact a01c6842 deletes the coordinator's same-function always-approved Hands review, derives consequence authority through route/intent/grant identities, and refuses ambiguous receipt sets instead of selecting by timestamp. No compatibility reader, bootstrap aggregate, schema migrator, or dual reader survives. The source-level Decision-Auditable Concurrent Mind migration is accepted; the fresh exact-package capstone remains open. The machine remains a supervised engineering alpha; Model Atlas operational Gate 1 stays paused.
  public_positioning: docs/positioning.md is the current public claim owner. Epiphany is the organizational layer above frontier AI workers; global coherence collapse is the primary failure; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance. GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Model Atlas carries typed offers, claims, evidence, and derived technical relationships; Bifrost is the intended external work, membership, governance, attribution, and identity-linked receipt rail. Public Persona relationships and visitor surfaces are intended social infrastructure, while private Mind and consequence authority remain local. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain gated alpha targets.
  competitive_launch_signal: The 2026-08-22 Munder Difflin launch analysis in notes/munder-difflin-launch-intelligence-2026-08-23.md is the current Eyes/Imagination owner for this category signal. It establishes strong demand to try a packaged, local, visual multi-agent control plane and supplies repeated qualitative demand for an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness; it does not establish retention, reliable autonomy, or paid product-market fit. Munder is materially ahead in installation, cross-platform reach, provider reuse, category compression, community formation, and feedback velocity. Its public failures make renderer-owned physiology, cross-Body restoration, proxy safety metrics, false consequence receipts, provider parity, and marketed-but-unavailable federation concrete falsification targets. Epiphany does not yet own a general operator UI: Persona projection into shared asynchronous chat is the concrete human surface, while CultMesh remains projection-neutral. Social Aquarium, a dense operator cockpit, TUI, and audit surfaces may use distinct Eve compositions over the same provider-owned facts. A one-hour projection experiment and managed continuity/federation remain evidence-led options rather than adopted roadmap authority; the source-subtraction and test-authority audit remains next.
  latest_phase: The controlled Luna comparison failed before meaningful tool progress with an early socket close, unlike the prior gpt-5.4 attempts that completed 6, 6, and 4 tool cycles before terminal failure. Generic Connector nonfunction remains falsified by Ghostlight, but model choice alone did not buy Epiphany completion. The exact early termination now belongs to Connector operator-safe diagnosis; no further capstone budget is admitted. Production promotion, public speech, Hands mutation, and Atlas remain paused.
  execution_binding_authority_cut: Exact ce6bff12 reduces model and tool execution bindings to the only facts they own. A model binding maps one native request to its runtime session and job; a tool binding maps one typed intent to its runtime session and job. Provider identity, source worker, reasoning basis, and model-request ancestry are no longer copied into bindings or compared through timestamp-shaped API arguments. Validation, retention, public-source lookup, worker terminality, decision sealing, and tool continuation reload the exact native request or tool intent. Runtime writable state advances to v37. Core, epoch refusal, transcript-free decision audit, OpenAI tool continuation, and the release-owned tool runtime pass. The cut removes 67 net source lines and leaves runtime_spine.rs at 9,300 physical lines with 50 public functions and 25 public structs. Verification generated 12.713 GiB across 19,134 files; Cargo cleanup restored the single 1.78 MiB state inspector. Atlas is untouched; no live inter-swarm collaboration has run.
  provider_transport_boundary_cut: Exact ed7357a2 removes Codex transport from Epiphany's compiled body. The complete epiphany-openai-codex-spine package, codex-login/codex-client graph, CODEX_HOME/auth.json readiness, direct Codex HTTP/SSE, and Codex credential creation/argv are gone. Model and Persona entrypoints use the lean typed client from exact CodexConnector 54d8bc2525b7e7fa1b9dd26b95871247ff4c7566 over authenticated loopback MessagePack; Connector owns Codex auth, transport, replay, and exact native/provider digest receipts. Epiphany retains sealed native/provider requests, strict schema/call-ID projection, tool continuation, decision admission, and typed receipt evidence. OpenRouter remains one direct ureq/Rustls boundary with its own credential and terminal-tool dialect. Model receipts advance to v1 and runtime to v38; caller identity, both request digests, and cached-token usage survive transcript deletion. The maintained non-lock source shrinks by 857 lines and Cargo.lock drops 4,830 lines. Core 150/150, runtime 21/21, adapter 5/5, model edge 12/12, Persona 1/1, exact launch checks, and focused no-deps Clippy pass. Two focused build roots totaling 10.8 GiB were removed; only the exact 1,776,640-byte state inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E remains. Atlas is untouched and no collaboration acceptance is claimed.
  provider_request_authority_cut: Exact c37cae8b replaces the durable generic OpenAI-shaped request with a closed provider-request document. The consumer adapter now lowers the canonical native request directly to either the exact final `CodexProviderRequest` or the exact OpenRouter request before inference and decision-context sealing. The release edge no longer performs Codex schema, tool, call-ID, or output-format lowering; it supplies the already sealed Codex request to the authenticated Connector invocation. Runtime and decision-context writable schemas advance to v47/v3 with no compatibility reader. Exact 87ea81db pins current Connector source 6dc80f6d266db4d82566d2434adcc55a48e8ecad and deletes Epiphany's obsolete 106-line public schema for the dead generic request, leaving two earned portable CultNet contracts. Connector separates contract-only, client, and daemon compile surfaces; Epiphany uses the contract-only surface in the adapter and the client surface only at the release edge. The Epiphany source cuts remove 125 net maintained lines; Core 152/152, runtime 21/21, adapter 5/5, model edge 12/12, Persona 1/1, and Connector contract/client/daemon 8/8, 10/10, 29/29 pass. Atlas is untouched and no live collaboration acceptance is claimed.
  runtime_session_authority_cut: Exact cabdd6c3 removes coordinator process incarnations from the generic model-session aggregate. EpiphanyRuntimeSession now contains only grouping identity plus active/completed admission state. Immutable EpiphanyCoordinatorRunBasis records exact thread, resident launch, objective, and start provenance. Exact completion/failure receipts and process-death recovery compete through one deterministic EpiphanyCoordinatorRunTerminality identity, so one full typed authority wins while unrelated document inserts merge. Objective prose, clocks, coordinator notes, four unused status variants, the one-field session-options wrapper, and the dead whole-snapshot append helper are deleted. Runtime advances to v40 with no compatibility reader. The focused Core, model-failure audit, Persona, coordinator terminality/conflict, release coordinator, and release model-runtime checks pass. The code cut removes 62 maintained lines net. Verification created 6.3 GiB across 7,017 Cargo files; cleanup restored exactly the 1,776,640-byte state inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E. Atlas remains untouched and no live inter-swarm collaboration is claimed.
  runtime_job_authority_cut: Exact a46725a1 removes timestamp causality and dead transition theater from EpiphanyRuntimeJob. The job is now the minimal mutable admission latch from Queued to Completed or Failed; Running, WaitingForReview, Cancelled, created_at, and updated_at are gone. Research no longer chooses a latest attempt by creation time: it derives the exact attempt set, refuses multiple live or multiple successful authorities, requires terminal evidence for failures, and otherwise projects launch, wait, or review deterministically. Runtime advances to v41 with no compatibility reader. Core, old-epoch refusal, model-failure audit, Persona replay, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 67 maintained lines net. Verification created 3.2 GiB across 4,498 Cargo files; cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven.
  runtime_job_binding_cut: Exact 10a70afc makes EpiphanyRuntimeJob a two-field identity/status latch. The sealed worker launch owns outer-worker role; EpiphanyRuntimeModelExecutionBinding owns model-session membership; outer workers belong to the root session by definition. Role and session disappear from jobs and generic job results, the result's always-empty metadata map is deleted, and heartbeat launch options lose constant root-session plus unused objective/note cargo. Session closure and retention derive their exact job set from model bindings; tool ownership derives from either the sealed launch or one exact model binding; duplicate terminal results refuse instead of sorting by completion time. Runtime advances to v42 without a compatibility reader. Keyed lifecycle, model-failure audit, transcript-free binding, tool continuation, Persona replay, coordinator terminality, epoch refusal, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 73 maintained lines net. Verification created 3.7 GiB across 4,764 Cargo files; cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven.
  runtime_job_result_cargo_cut: Exact 53e869c0 deletes evidence and artifact mirrors from EpiphanyRuntimeJobResult and its completion API. Structured role/reorientation outcomes remain the sole evidence/artifact owners; the generic result retains only lifecycle verdict, terse summary/next-move account, completion time, and optional decision-context binding for transport and process-death physiology. Reorientation failure display no longer invents generic evidence. Runtime advances to v43 with no compatibility reader. Keyed lifecycle, auditable model failure, epoch refusal, reorientation, typed worker admission, Persona replay, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 51 maintained lines net. Verification created 3.654 GiB across 4,759 Cargo files; Cargo cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven.
  structured_worker_result_cut: Exact 8eaa96c5 makes typed role/reorientation outcomes the sole durable structured worker decisions. Runtime completion strong-reads and byte-identically replays the exact structured envelope while atomically terminalizing job/process physiology; it persists a generic result only when no structured outcome exists. Fulfilled worker archives retain decision context plus the full typed role result, not a generic companion. Coordinator reorientation success derives from job status and requires the typed reorientation result. Runtime advances to v44 and archived worker attempts to v3 with no compatibility reader. Keyed lifecycle, decision audit, model-failure audit, reorientation, role admission, Persona replay, runtime-error/tool-loop failures, release coordinator, and release model-runtime checks pass. The source cut adds 7 maintained lines because the exact CAS dependency fence replaces a larger durable duplication. Verification created 5.632 GiB across 6,826 Cargo files; Cargo cleanup restored exactly the authenticated 1,776,640-byte state inspector. Atlas remains untouched and live inter-swarm collaboration remains unproven.
  standalone_codex_transport_target: Independent GameCult/CodexConnector client and deployed daemon exact be1776ab455fd79bd74b393518ab07211dc9c1f0 own authenticated transport; deployed ops exact 36892263864351b9bcf946e67f0edddc2d9e4ec0 admits Epiphany and Ghostlight separately to gpt-5.6-luna. The direct UFW-bounded container-gateway route replaces the deleted guest proxy. Ghostlight routinely completes no-tool Luna stages through the same daemon. Epiphany's one Luna comparison closed before any tool round, while earlier gpt-5.4 requests sustained multiple rounds. This falsifies generic daemon nonfunction but does not isolate model, request-shape, or per-request server handling.
  fixed_routing_and_retention_cargo_cut: Exact ffd91c20 deletes EyesEvidencePacket.source_role_id, PersonaSocialMention.target_agent_id, and ResidentSelfRetentionHead.retained_at_millis. Each producer supplied one fixed or non-causal value and no consumer read it; the request/context, Persona queue plus turn request, and retention chain remain the real owners. Eyes packet v2, Persona mention v2, Resident Self state v3/retention head v1, and runtime v27 form a hard cut. Core and the three consuming release entrypoints compile; consequential Persona, Research, and epoch-refusal proofs pass. The maintained source delta is 6 net deletions. Atlas is untouched; no live inter-swarm collaboration has run.
  provider_stream_authority_cut: Exact fe118e13 makes OpenAI/OpenRouter events and receipts transient transport values. The runtime immediately normalizes them into the single persisted native model event/receipt family used by tool continuation, assistant reconstruction, terminal validation, and bounded retention. Duplicate provider writes, registrations, archive requirements, schema IDs, two public schemas/index rows, and the include-only model-runtime shell are gone; the exact provider request remains durable. Runtime advances to v28 and the catalog drops to 18 schemas. The cut removes 270 net maintained lines. Adapter 1/1, provider spine 14/14, reasoning context 8/8, runtime 23/23, model entrypoint 11/11, swarm 4/4, epoch refusal 1/1, and release construction 15/15 pass. Atlas is untouched; live inter-swarm collaboration remains unproven.
  cultnet_catalog_authority_cut: Exact dbed11b3 and 8bb0719b delete the hand-maintained JSON shadow registry. The nonexistent runtime-event contract and obsolete public archived-session tombstone schema disappear first. Runtime-local identity, session, job, binding, coordinator, native model/tool, and state-ledger schemas then disappear because no live CultNet provider carries them and several contradicted their Rust owners. Typed CultCache registration and owner-projected CultMesh state remain authoritative. The catalog has exactly three earned boundaries: the exact OpenAI-compatible provider request, gamecult.persona_state.v0, and epiphany.work_organ_state.v0. Parse/path/unindexed/forbidden-contract checks pass at 3/3/0/0/0. The cuts remove 850 net maintained lines. Atlas is untouched; live inter-swarm collaboration remains unproven.
  release_dependency_ownership_cut: Exact 695af6c6 deletes thirteen unowned Cargo dependency declarations, the last tracked marker for the extinct epiphany-openai-auth-spine crate, and one production-only unused import. The root release package no longer claims nine libraries absent from every executable source; affected leaf/dev manifests drop four more dead edges. The lock graph contracts from 757 to 732 packages and the source/manifest/lock delta is 284 net deletions. All nine production entrypoints, both affected libraries, and both affected library test targets compile individually. Package-scoped cleanup removes 56,581 disposable files and 124.2 GiB from the five compiled package caches; the shared target is 108.42 GiB and the prebuilt state tool remains healthy. Atlas is untouched; live inter-swarm collaboration remains unproven.
  hands_receipt_authority_cut: Exact 65bf044f removes fixed schema-version strings and unread contract prose from Hands patch, command, and commit receipts. Their CultCache envelope owns type/schema identity; at that cut the exact intent, review, Substrate Gate grant, runtime job, consequence, and immutable receipt envelope remained the admission proof; exact a01c6842 subsequently removed the review and copied causal cargo. Fourteen definition-only shadow type constants and one callerless reorient display enum are also gone. Runtime advances to v29 and old writable state refuses. The existing keyed lifecycle proof passes exact Hands through concurrent Persona admission into Verification, and package cleanup removes its 678.6 MiB compiler footprint. The cut removes 67 net maintained lines. Atlas is untouched; no live inter-swarm collaboration has run.
  hands_review_authority_cut: Exact a01c6842 deletes the same-function always-approved HandsActionReview and its public writer, review ID copies, and sealed Verification copy. The adopted route owns the write ceiling; the Substrate Gate grant owns permitted operations and paths; the minimal intent binds the runtime job to the grant; RepoFrontierHandsAuthority binds route, intent, and grant. Consequence receipts cite the intent and derive other causal identity through that chain. Commit admission requires exactly one patch and one successful command receipt and refuses ambiguity rather than selecting by timestamp. Runtime advances to v46 and the sealed Verification context to v2 with no legacy reader. The cut removes 381 maintained lines net; core 152/152, coordinator 4/4, and OpenAI runtime 21/21 pass. Verification generated 5.8 GiB across 6,583 target files; cleanup restored the single 1,776,640-byte inspector.
  autonomous_proposal_origin_authority_cut: Exact d9a196a0 makes RepoFrontierProposalModelingRequest the sole durable owner of autonomous proposal origin. It carries the exact direction result, option ordinal, and worker job identities. The separate binding type, schema constant, registry entry, third CAS envelope, replay collision branch, and worker-result/launch hash echoes are gone. The referenced launch and result remain immutable typed documents and promotion strongly reads them atomically with the proposal/request pair. Runtime advances to v30. The full keyed lifecycle passes promotion, concurrent launch, retry ancestry, Modeling admission, concurrent Persona/Hands, and Verification; package cleanup removes 677.6 MiB. The cut removes 53 net maintained lines. Atlas is untouched; live inter-swarm collaboration remains unproven.
  repository_domain_binding_cut: Exact 6f5d6600 keeps the immutable typed repository-domain receipt but reduces it to its two causal facts, the canonical organizational repository name and exact authenticated Body hash. CultCache owns envelope type, key, and schema; the authenticated Body route owns runtime, swarm, and workspace; binding time and fixed prose own no decision. Binding still validates the live Body and atomically strong-reads runtime identity plus Body route, while promotion and fulfillment refuse repository or Body-hash substitution. Runtime advances to v31. The full keyed lifecycle and old-store refusal pass; package cleanup removes 677.2 MiB. The cut removes 50 net maintained lines. Atlas remains protected until a real inter-swarm collaboration trial exercises the complete crossing.
  operator_objective_intake_cut: Exact 952dcd9f preserves the typed human assertion and atomic singleton Mind-objective commit while deleting four persisted echoes: fixed schema prose, key identity, objective digest, and contract text. The public outcome now returns only the Mind projection digest, exact commit receipt, and whether the commit changed state; it no longer carries a full intake or over-broad Mind view. The coordinator-binary test that merely replayed the library seed/idempotency/refusal proof is gone; the library proof is strengthened to require byte-identical replay and the wrapper-specific resident-grant provenance proof remains. Runtime advances to v32. All three focused proofs pass. The maintained cut removes 54 net lines. Package cleanup removed 18.5 GiB, then the 1.7 MiB state tool was preserved across cleanup of 961.1 MiB regenerated artifacts. Atlas is untouched.
  frontier_document_envelope_cut: Exact 718ce9c1 removes fixed schema-version fields and contract slogans from thirteen durable repository-frontier documents spanning Proposal, Proposal-Modeling, Planning, Research, plan candidate, PlanMind, plan decision, route, Hands authority, Verification, Soul verdict, and post-verdict Modeling. CultCache envelopes plus runtime epoch v33 own internal shape identity; semantic IDs, exact source-document versions, strong-read chains, decision contexts, dispositions, evidence, and consequences remain. Sealed worker-context schema and contract fields remain because they define exact model input. The full keyed lifecycle, old-store refusal, provider candidate mapping, core library, and release-owned coordinator target pass. The cut removes 177 net maintained lines. Verification generated 9.61 GB across 12,514 files; cleanup restored the shared target to the single 1.78 MB state inspector. Atlas is untouched and remains protected until a real inter-swarm collaboration run exercises its complete crossing.
  runtime_child_epoch_echo_cut: Exact a4356d1f makes runtime identity plus swarm binding the explicit writable-root epoch owners and removes repeated schema-version fields from thirteen child physiology documents: sessions, jobs, model/tool execution bindings, archived sessions, worker launches, process claims, worker archives, role/reorientation/job results, coordinator receipts, and coordinator death recovery. Their exact lifecycle identity, causal bindings, terminal outcomes, decision contexts, and retention chains remain. Runtime advances to v34 and old writable stores still refuse byte-identically. Core, keyed lifecycle, reorientation audit, model-failure audit, transcript-free binding audit, provider candidate mapping, coordinator, swarm, and model-runtime checks pass. The cut removes 122 net maintained lines and leaves runtime_spine.rs at 9,440 lines. Verification generated 10.92 GB across 16,251 files; cleanup restored the single 1.78 MB state inspector. Atlas and external crossings are untouched.
  model_runtime_preflight_certificate_cut: Exact e60b924f deletes the callerless model-runtime preflight command, its JSON self-certificate, executable and schema-list hashes, fresh-cache required-type comparison, and the public runtime_registered_document_types accessor. Actual Mind/runtime epoch admission owns writable-store compatibility; Idunn's frozen-package witness owns executable provenance. The cut removes 64 net maintained lines without changing schemas or Atlas.
  model_runtime_diagnostic_wrapper_cut: Exact 3b991e40 makes admitted run-worker the sole provider execution path and retains list-decisions plus audit-decision for transcript-free inspection. The uncalled standalone model-turn, tool-followup, and tool-followup-turn commands, their CLI DTOs/parsers, duplicate JSON ingress family, and three tests that animated only that dead ingress are gone. OpenAI/OpenRouter selection, activation capability, automatic tool continuation, bounded typed failure, decision-context sealing, and worker terminality remain. The packaged binary suite passes 8/8 and its exact check passes. The cut removes 468 net maintained lines and leaves the model-runtime binary source at 1,493 lines. Verification generated 9.36 GB across 13,992 files; Cargo removed 8.7 GiB and restored the shared target to the single 1.78 MB state inspector. Atlas and inter-swarm contracts are untouched.
  atlas_authoring_cut: Exact ce306e23 preserves the complete inter-swarm Atlas vertical slice while deleting its duplicate local offer/claim authoring authority. Ordinary Modeling through RepoModel operations is the sole owner of provider offers and consumer claims; Atlas retains signed publication, trust, transport, deterministic projection, Soul verification, Self impact admission, Resident Self wake, brakes, and Eve lowering. Two direct write-intent types, their runtime commit APIs and registry entries, 518 planner lines, and two tests that animated only that duplicate path are gone. The runtime proof now creates offers/claims through RepoModel before proving exact verification admission and Body-drift refusal. The cut removes 593 net source lines; the three-repository direct/transitive Modeling proof passes. These are component proofs only: no live inter-swarm collaboration has yet run, so the Atlas vertical slice remains protected until Gate 1 exercises it end to end. Runtime writable epoch is v14.
  autonomous_proposal_binding_cut: Exact 5d507bfd reduces Self's autonomous Imagination-to-Modeling origin binding from a 22-field duplicate archive to six causal join fields: schema, exact direction-result identity, selected option ordinal, worker job identity, and exact worker-result/launch digests. Proposal identity and payload, direction request, runtime/thread, typed model projection, Body/domain binding, selected option content, and canonical Modeling-request identity are checked directly from their owning immutable documents. The atomic proposal plus binding plus Modeling-request commit and its broad keyed-lifecycle proof remain; 60 net source lines are gone. Runtime writable epoch is v15.
  hands_verification_derivation_cut: Exact 6ccc7dd2 deletes the 20-field transient Hands receipt-chain summary. The Hands commit owner now derives the exact Verification request directly from the persisted patch, command, and commit receipts plus the frontier authority; no copied schema, job, grant, command-output, Git, path, summary, or timestamp fields mediate that handoff. Atomic Hands-to-Verification admission and the concurrent Persona/Hands lifecycle proof remain. The cut removes 43 net source lines without adding state, schema, or tests.
  proposal_modeling_launch_authority_cut: Exact b0a4978d deletes the Proposal-Modeling launch-binding document family after exact 6831eb69 exposed that even its four-field form owned nothing. The immutable worker launch already carries the exact request reference, role, binding, job identity, and sealed typed document. Current-work, retry counting, fulfillment, archival, and coordinator actuation now consume that owner directly; the registry entry and operator JSON echo are gone. The keyed lifecycle, coordinator target, OpenAI runtime, and old-epoch refusal pass; 70 net source lines are gone. Runtime writable epoch is v17.
  planning_launch_authority_cut: Exact b55e96ea deletes both persisted Planning and PlanMind launch-binding families. Their twenty-four fields copied the immutable worker launch, typed requests, runtime job, timestamp, canonical attempt identity, or typed failure review without owning a consequence. Self now derives contiguous attempts and current jobs from family-referenced worker launches. A retry launch strongly reads every prior launch plus the exact failed result and review, so stale retry authority conflicts instead of being summarized into decorative cargo. The complete keyed Planning-to-PlanMind lifecycle, v17 refusal, packaged coordinator, and model-runtime checks pass; 44 net source lines are gone. Runtime writable epoch is v18.
  remaining_launch_authority_cut: Exact 8dbfcf63 deletes the persisted Body Modeling, Imagination consideration, and Reorientation launch-binding families. Their attempt, request, role/binding, timestamp, Body/projection, and launch-digest fields were derivable from the immutable worker launch, typed family request/projection, runtime job/result, admission refusal, or typed pass failure. Canonical job identities own contiguous attempt order. Body retry CAS strongly reads prior launches, latest job, exact result, and matching refusal; Reorientation retry CAS strongly reads prior launches, latest job, typed failure, and exact terminal result; Imagination retry CAS strongly reads prior launches. Family semantic requests, sealed projections, result validation, substrate grants, typed failures, and Mind admission remain. Focused Body/Imagination lifecycle, Reorientation success/failure/retry, old-epoch refusal, coordinator, and OpenAI runtime checks pass; 24 net source lines are gone. Runtime writable epoch is v19. Model Atlas and its unrun inter-swarm path are untouched.
  frontier_modeling_writer_cut: Exact 3ed1d564 deletes the public commit_repo_frontier_modeling_request API and export. Production had no caller because accepted Verification already atomically commits its audit, Soul verdict, and canonical frontier-Modeling request through one Mind transaction. The second writer reopened the store and survived only to feed one OpenAI test. That test now launches ordinary Body Modeling and still proves sealed reasoning input, structured completion, typed job/result persistence, provider failure, and output-contract failure; 164 lines of fabricated frontier, route, Verification, and Soul authority are gone. The atomic Verification-to-Modeling lifecycle, core library, OpenAI test, and release-owned model runtime pass. The cut removes 205 net source lines; runtime_spine.rs is 9,819 lines with 54 public functions. Model Atlas is untouched.
  coordinator_terminal_receipt_cut: Exact 63d2991e advances EpiphanyCoordinatorRunReceipt to v1 and deletes seven unread cargo families: step count, model-provider echo, runtime-store path, artifact and sealed-artifact lists, arbitrary metadata, and final runtime-job echo. The receipt retains terminal status/action/reason, timestamp, session/thread identity, plan-or-execute mode, and exact resident grant/launch/policy/argv/objective/release/manifest/executable provenance. Operator artifacts remain only in the non-authoritative summary; model requests and runtime jobs retain their own provider and job truth. The published JSON schema now matches the live typed receipt instead of rejecting its omitted resident fields. Runtime writable epoch is v20. Core check, old-epoch refusal, coordinator 5/5, and swarm 4/4 pass; 59 maintained lines are gone. Model Atlas is untouched.
  runtime_lifecycle_document_cut: Exact 196222d9 makes runtime sessions and jobs lifecycle documents rather than second result records. Session metadata and job metadata had no reader; every producer wrote an empty map. Job summary and artifact refs had no reader; every launch supplied empty artifacts, while the terminal EpiphanyRuntimeJobResult already owns the consequential summary and artifact references. Those four fields, the launch-option echoes, completion merges, and caller literals are gone. The session retains objective/coordinator note; the job retains exact session/role/status/time identity. Runtime writable epoch is v21 and the closed session/job catalog schemas are v1. Core and OpenAI libraries compile; old-epoch refusal, model-failure audit, model-produced completion, coordinator 5/5, and native tool-runtime 4/4 pass. The cut removes 95 net maintained lines, leaves runtime_spine.rs at 9,766 lines with the same 54 public functions and 25 public structs, and does not touch Model Atlas or claim collaboration acceptance.
  strict_session_writer_cut: Exact cd2177e8 deletes ensure_runtime_session, a duplicate public session writer used only by two model-runtime test fixtures. On an active ID collision it returned the existing session without comparing objective, creation time, or coordinator note, allowing stale fixture context to masquerade as exact replay. Exact fdefb889 later deletes the remaining generic session/job writers after proving they too had only fixture callers. Real family launch, model execution, and coordinator owners create runtime physiology. No compatibility path or replacement abstraction exists. Runtime remains v35 and Model Atlas is untouched.
  current_work_projection_cut: Exact 0a97eef8 makes project_current_work the sole assembler of the current typed work slice. The callerless current_body_modeling_work and unresolved_body_modeling_work paths independently reopened Body, RepoModel, and runtime state to reconstruct subsets already derived by the aggregate projection. Three callerless per-job continuation-action wrappers likewise rebuilt the entire projection while the live coordinator consumes the retained family review-job selectors. All five duplicate mouths are gone. The keyed Modeling/Research lifecycle still proves thread-free routing and zero live Body rescans; coordinator 5/5 passes. The cut removes 49 net maintained lines from current_work.rs without changing schema, tests, targets, or Atlas.
  callerless_helper_cut: Exact 5a047944 deletes ninety lines of public helper shelf with no consumer: JSON-shaped state-ledger status projection and its now-dead type label; generic role binding/owner lookups; unique-string wrapper and implementation; and a successful-coordinator receipt wrapper. The live state CLI reads typed ledger owners, role-family launch code uses exact constants and typed schemas, and Resident Self plus swarm retain the exact coordinator binding validator they actually call. Core and the native state binary compile warning-free; swarm remains 4/4. No durable contract, schema, target, test, or Atlas path changed.
  unowned_projection_and_grant_cut: Exact 6ccaf937 deletes three public surfaces with no live consumer. The repository Body helper merely unwrapped assemble_mind_view and its proof now reads the typed Mind view directly. The Persona blocked-pressure helper reconstructed a sorted list already owned by keyed quarantine documents. The generic repo-work planning grant could mint read/snapshot Hands authority but no admission or actuator consumed it; exact coordinator and worker grant constructors remain. Core checks, the read-only Body-basis proof, the fixed governed-tool operation proof, and coordinator 5/5 pass. The cut removes 41 net maintained lines without changing a schema, target, or Atlas path. Live inter-swarm collaboration remains unproven.
  unconsumed_read_helper_cut: Exact f6a2ad7f deletes two exported readers with no workspace consumer. Packaged-release publication retains its atomically written current-head document and authentication retains exact release-by-ID reads; only the unused standalone head reader is gone. Idunn provider-health admission retains typed supplied trust-anchor validation plus continuity and substitution proofs; only the unused trust-anchor file reader is gone. Core checks and Idunn provider-health 6/6 pass. The cut removes 25 net maintained lines without changing a schema, target, or Atlas path.
  imagination_review_contract_cut: Exact be611f24 deletes the producerless Imagination consideration-review request as one authority cut: its writer, durable document, schema constant, public export, and runtime registration are all gone. It had no caller, reader, test, or Modeling admission path. Imagination requests and candidates retain quoted-evidence, substitution, chronology, disposition, and route validation; adopted proposal Modeling remains owned by its actual lifecycle. Runtime writable epoch advances to v22 so v21 stores cannot carry the retired contract into current authority. Core checks, Imagination 8/8, old-epoch refusal, and coordinator 5/5 pass. The cut removes 71 net maintained lines without touching Atlas.
  resident_self_runtime_receipt_cut: Exact 3140d305 deletes ResidentSelfRuntimeReceipt, a durable type that was registered, accepted, and decoded but had no producer or reader. Its schema constant and every state-cache branch are gone. The definition-plus-export-only EpiphanyCoordinatorRoleResultStatus is also gone; the live role board retains EpiphanyCoordinatorRoleStatus. Resident Self writable state advances to v2, and a consequential negative proof confirms a v1 store refuses byte-identically. Resident Self 7/7 and swarm physiology 4/4 pass. The cut is net 32 maintained lines removed without touching Atlas.
  adapter_status_authority_cut: Exact 0091e0e1 deletes the generic model-adapter and OpenAI-adapter status families. Every model pass wrote both mutable documents, but no query, router, admission owner, audit path, or display consumed either. Their types, per-pass writers, status/auth-mode constructors, adapter-ID constants, one self-affirming OpenRouter status test, runtime registrations, two published schemas, and catalog entries are gone. Native/provider requests retain provider and model identity; live transport construction retains credential and attachment proof. Runtime writable epoch advances to v23. Adapter libraries compile; provider spine 14/14, old-epoch refusal, and model runtime 23/23 pass. The cut removes 267 net maintained lines without touching Atlas. The local published catalog contains twenty live or portable contracts.
  generic_planning_mirror_cut: Exact 2e3489c4 deletes the empty generic planning mirror. Four registered Mind document families—planning captures, backlog items, roadmap streams, and objective drafts—had no constructor, writer, admission owner, or consumer, yet were read and injected empty into every reasoning projection. Their document types, registry/validation/projection branches, reasoning field, and 256-line issue-tracker-shaped state-model vocabulary are gone. Real planning remains in frontier planning requests, candidates, Mind review, adopted decisions, checkpoints, Hands receipts, and exact admission paths. Mind/runtime writable epochs advance to v9/v24. State model and core compile; sealed reasoning 8/8, old-epoch refusal, model runtime 23/23, and coordinator 5/5 pass. The cut removes 350 net maintained lines without touching Atlas.
  persona_quarantine_mirror_cut: Exact a6f73fc4 deletes the write-only Persona quarantine mirror. A blocked turn already atomically writes one terminal receipt containing exact crossing status/reason and mention digest, then marks each mention quarantined and binds it to that receipt. The duplicate blocked-pressure payload, wrapper document, construction branch, type constant, registry entry, and decoder are gone; nothing read them after the earlier duplicate projection was deleted. Core compiles, Persona consequence/retention 5/5 pass, and the feature-gated Persona service compiles. The cut is 63 pure deletions without touching Atlas.
  continuity_recovery_mirror_cut: Exact fed4b857 deletes the final duplicate Continuity recovery record. Accepted reorientation already persists its exact runtime result, sealed reasoning basis/context, typed Mind decision, strong-read admission, and Mind commit receipt. ContinuityRecoveryReceipt copied the same job/result, mode, checkpoint validity, summary, next move, files, and timestamp, and no reader consumed it. The entire continuity-gateway module, runtime registration, and derived-companion write are gone; success and failure use the ordinary exact Mind commit primitive. Runtime writable epoch advances to v25. Core compiles; decision-auditable reorientation 1/1, old-epoch refusal, and coordinator 5/5 pass. The cut removes 80 net maintained lines without touching Atlas.
  dormant_state_vocabulary_cut: Exact a602fbdc deletes fifteen public state-model DTO types with no external consumer, two callerless OpenAI-runtime mouths, and eight definition-only type constants. Acceptance receipts and runtime links are derived from exact runtime/Mind receipts; RepoModel owns its keyed graph; retrieval and scratch belong to sealed passes; runtime jobs own their own typed identity. The old aggregate graph/frontier/checkpoint, retrieval, scratch, generic job-binding, and churn vocabulary has no remaining source reference. State-model is 398 lines. Focused state-model, core, OpenAI-runtime, and release-owned model-runtime checks pass. The cut removes 291 maintained lines, does not alter a writable schema, and leaves the complete unrun Atlas vertical slice untouched.
  provider_frame_observer_cut: Exact 9abadfe7 deletes the provider-frame observation DTO and callback APIs from both Codex Responses and OpenRouter transports. Every live caller supplied a no-op observer; typed model stream events and receipts remain the sole provider consequences. The same cut removes a provider-specific transcript reader used only by one empty-text assertion, a callerless RepoModel-to-reorientation checkpoint constructor, a definition-only MCP client label, and a historical health-identity constant-spelling test. Provider spine 14/14, OpenAI runtime 23/23, tool MCP 8/8, Idunn runtime health 5/5, state-model, and the release-owned model-runtime check pass. The cut removes 140 net maintained lines; state-model is 366 lines. Atlas remains untouched and live inter-swarm collaboration remains unproven.
  singular_persona_tool_provenance_cut: Exact 2a435eb5 deletes duplicate or uninhabited provenance cargo from two durable contracts. Persona-memory v2 retains exact Interpreter effect-document and decision-context IDs; the one-element linked-event vector repeated the same effect ID and the relationship field was always None. Tool-receipt v1 retains exact result JSON or error; the sealed-raw-result reference was always None and had no producer or reader. Mind/runtime writable epochs advance to v10/v26 with no migrator or compatibility reader. Tool adapter compiles; tool MCP 8/8, Persona conversation/retention 5/5, old-epoch refusal 1/1, OpenAI runtime 23/23, and the release-owned model-runtime check pass. The cut removes 10 net maintained lines without touching Atlas.
  supervisor_subtraction: Exact 856648de completes the supervisor deletion. Epiphany owns no local generic daemon supervisor, semantic projector service, workspace-coverage projector, Windows Task Scheduler integration, or service-policy/lifecycle/heartbeat/recovery mirror. Idunn on Yggdrasil owns source-triggered compilation, testing, packaging, deployment, signed health, and daemon survival. The canonical Epiphany brake gates Epiphany cognition and consequence authority, not Idunn startup or unrelated lifecycle.
  launch_dependency_cut: Exact 2aeab7a9 deletes the generic organ dependency matrix, generic receipt catalogue/proof profiles, persisted worker-launch cargo, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. Family admission owners derive exact dependencies from typed state. Worker-launch schema v2 and Persona projector prompt v1 refuse the old writable shape. Core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1 pass.
  operator_surface_subtraction: Exact ef92e853 deletes the callerless view-lens registry, legacy acceptance-bundle builders, test-only raw-JSON result interpreters, and six tests: 797 net lines. Exact a292979d and 77e817c1 delete the duplicate CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. Exact 3b94bf6e and 59c5e3a6 delete the nested duplicate status view, false auxiliary mode, and ignored status arguments. Exact 7c9b0cf3 deletes the fixed synthetic job table, role-board job cargo/mappers, and its test: 338 net lines. Exact 2ce91461 deletes the scene/planning Mind reconstructions, duplicate self-policy crate, unused prompt templates, four counterfeit schemas, and ten producer/source-text tests: 1,723 net lines. Exact 78836f3b deletes eight unconsumed status tableaux, the pressure calculator production only called without telemetry, its unreachable compaction action, one counterfeit schema, and six tests: 518 net lines. Exact f10f7fb3 deletes the final twelve epiphany.surface.* schemas and ten catalog entries after every one proved producerless and consumerless: 692 pure deletions. Exact ab3cacfb deletes thirty-one more producerless contracts, the false runtime-session mutation mouth, every Epiphany-owned Rider/Unity command schema, a callerless prompt-context module, its test-only specialist prompt system, and four self-affirming tests: 3,514 net lines. Exact 16d85b1b deletes six duplicate JSON-schema builder tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. Exact 06f93f70 deletes the test-only inverse OpenAI-to-native request mapper and makes two retained tests follow canonical native-to-provider derivation: sixty net lines. Exact 0091e0e1 later removes two unread adapter-status schemas and catalog entries; the local catalog now has twenty live or portable contracts. Brokkr owns Unity capabilities through CultMesh/Eve; a future Rider daemon owns Rider. Status retains Mind identity, exact current work, one action/reason decision, readable role lanes, and operator thought sealing. Core checks cleanly; retained provider and focused request-flow tests pass.
  immutable_runtime_identity_cut: Exact bf997ce0 removes empty legacy frontier-decision echoes and requires exact worker-result provenance. Exact e00ea70f deletes the lossy PID-only process compatibility API. Exact 87983ffc makes runtime identity immutable bootstrap state: no update time, duplicated capability catalog, temporary metadata, or launch-time reconstruction survives. Current-work launch replays the original identity and existing root-session envelopes byte-for-byte as strong reads, preventing hidden singleton timestamp conflicts while retaining substitution refusal. Exact ffcf036f advances runtime spine to v7 and derives the constant native runtime kind at CultNet publication. The current-work capstone, epoch refusal, and OpenAI-runtime all-target checks pass.
  build_target_ownership_cut: Exact a319146b deletes the public non-atomic worker-launch path used only by test fixtures; exact 76fd259b deletes two source-layout tests while retaining real CLI refusal behavior. Exact b95a3266 deletes the superseded unpackaged OpenAI debug executable and the tests/helper that animated it. Exact 6f93134d makes epiphany-release-bundle the sole package owner for production entrypoints, disables automatic leaf binaries, reduces Cargo executable targets from 26 to 22, and deletes a hardcoded release target map plus two self-affirming tests that did not drive the build. Exact c04c3aff deletes the five-reexport auth wrapper crate; the transport imports its narrow Codex auth surface directly. Exact ad2292ee deletes two callerless Persona identity setup executables, their forced release roles, and 96 lines of enrollment/anchor-export wrappers. Exact 3dda58a5 deletes the duplicate Persona feedback ingress executable and release role after Resident Self proved to be the live authenticated Bifrost import owner. Exact 56267201 deletes three unadmitted Model Atlas daemon shells and release roles while preserving the typed library owners; authority separation alone does not justify production processes. Exact 900c5232 deletes the callerless frontier-proposal executable and release role; typed Self/runtime proposal intake and selection remain. Exact 94098223 deletes the host-identity executable/release role and 555 net lines of unowned private identity custody; Bifrost owns its signer while Epiphany retains only public-anchor verification. Exact b78ffb25 deletes the callerless Hands consequence recorder, release role, unconsumed command-description handshake, and main-only tests after proving that it executed no patch, command, or commit. The coordinator now reports awaitingHandsExecutor; exact typed receipt-chain admission remains. Exact a78c1802 deletes the 366-line standalone pre-compaction checker and its Cargo target. It merely re-rendered the existing state status, Git status/log, and phrase checks over canonical documents; agents now inspect those owners directly. Exact d2aee1ce deletes the 97-line callerless epiphany-package CLI because epiphany-release already owns its package/inspect operations plus publish. Cargo metadata reports 9 executable targets and no binary source with multiple package owners; focused state-binary, core-library, release-construction-library, and release-binary checks pass.
  runtime_registry_authority_cut: Exact 03140a47 deletes the 649-line epiphany-runtime-spine operator/debug CLI, its packaged release role, its callerless Hello/schema-catalog service facsimile, the 600-line hand-maintained mutation-contract mirror, and the source-shape test that guarded that mirror. CultCache exact fdbf3bf exposes its registered type identities, so runtime status and model preflight derive accepted documents from the same registration used to open the Mind store. Executable targets fall from 22 to 21 with zero duplicate source owners. Core checks without warnings and release construction passes 17/17. Editor actuation remains entirely provider-owned: Brokkr owns Unity through CultMesh/Eve and a future Rider daemon owns Rider.
  coordinator_status_cut: Exact 500125d5 deletes the unconsumed packaged epiphany-mvp-status executable. Its live projection and operator-sanitization functions move from a binary source textually included by the coordinator into one epiphany-core module. The dead CLI parser, default store, result-file writer, release role, and redundant release assertion are gone. Cargo has 20 executable targets and zero duplicate binary-source owners; the release-owned coordinator checks, the operator thought-sealing test passes, and release construction remains 17/17.
  persona_language_tribunal_cut: Exact 63939fa2 deletes Persona's keyword-based projector-output tribunal, its test-only no-transcript prompt wrapper, and two tests that blessed prompt phrases and forbidden words rather than a consequence. Projector and Persona outputs remain inert private cognition sealed into exact stage contexts. Only the Interpreter's closed typed effect enum can propose state or speech; its channel, cardinality, size, schema, and exact-context validation remain. The three-stage execution/replay, channel-escape refusal, substituted provider/model refusal, retained typed-effect validation, and OpenAI-runtime all-target checks pass.
  test_authority_cut: Exact bf2f39eb deletes a causal-ID test that compared identical calls and mislabeled the equality provenance independence, plus a duplicate unknown-field test for an already deleted generic patch field. Exact 104bf390 deletes the tool runtime's duplicate immutable-GitHub identity test and a permanently ignored live-network probe pinned to historical README prose. Exact f3360248 deletes a redundant release-cache prefix/determinism assertion, a Git submodule argument-vector mirror plus its single-use helper, and a raw repeated-round predicate test. Exact keyed request identities remain exercised through family lifecycle and admission tests; strict ingress unknown-field refusal remains exercised by runtime-owned Body identity substitution; immutable GitHub parsing remains tested once in epiphany-core; source-cache recovery, cache separation, tool-loop transition, and terminal failed-worker receipts remain proven. Focused owning-package tests pass for each cut. Exact ede5c669 deletes a single-use coordinator runtime-options factory plus the test that merely asserted its field assignments, a literal-membership stop-policy test that never exercised coordinator continuation, a private Unix mode predicate test duplicated by file-level credential permission proof, and a same-call source-cache equality assertion. Release construction remains 15/15, coordinator 5/5, and core checks cleanly. Exact 79292fe3 also deletes the private scanner-session spelling test and fixture-wide route assertions already covered by public observation and dedicated immutable-route proofs; Repository Body remains 22/22.
  tool_runtime_status_cut: Exact 777dd1a5 deletes the callerless epiphany-tool-mcp-runtime smoke command, its fixed JSON self-description, parser branch, and self-affirming branding test. Exact 0bb6a883 removes the run summary's fixed adapter/schema catalogue and caller-supplied store echo; stdout now carries only intent ID, receipt ID, and terminal status. Signed daemon health owns liveness; typed invocation intents and exact receipts own tool execution. With one live command remaining, the one-variant CLI enum collapses into a direct run parser. The four retained release-owned tests pass and exercise typed execution, receipt persistence, Resident-state binding, and unbound refusal.
  repository_body_smoke_cut: Exact 013c3bf1 deletes the callerless epiphany-repository-body smoke command and its temporary-store self-test path. The shipped Body binary retains bootstrap, bind, observe, and status. Authenticated Body binding, exact projection, generation, Git worktree semantics, no repository mutation, and tamper refusal remain proven by 23 focused owner tests.
  model_runtime_smoke_cut: Exact ce90f911 deletes the callerless epiphany-model-runtime smoke route. It opened no provider transport; it wrote a synthetic model request, tool call, completed receipt, and smoke_no_network marker into a writable runtime store, then reported not-opened. Real model-turn, worker, follow-up, decision discovery, and decision audit commands remain. The release-owned model-runtime suite passes 12/12.
  bifrost_authority_cut: Exact 203bcc41 deletes Epiphany's producerless Bifrost body-change/GitHub publication family: four document types, three singleton latest heads, constructors, validators, writers, local-Verse advertisement/projection, public exports, and five tests that manufactured both ends. Bifrost owns the real Persona feedback/delivery stores and signed crossing receipts; Epiphany does not publish an alternate Bifrost protocol. Exact a276d0f4 collapses the residual generic host-identity module into its sole Bifrost feedback-admission consumer: CultNet owns the shared public anchor/signature shapes, exact legacy wire bytes and cryptographic domains remain compatible, and generic verifier/aliases/setup fixtures plus callerless public signing helpers are gone. Epiphany owns no Bifrost private key. Core and swarm checks pass; all seven focused feedback admission tests pass.
  hands_pr_authority_cut: Exact 11d99de1 deletes the producerless HandsPrReceipt type, registration, dead test-only writer, read path, exports, relinquishment branch, and two contract advertisements. Hands owns local patch, command, and commit consequences; exact remote publication evidence belongs to the provider/Bifrost crossing. Core and release-bundle checks pass, and the rebuilt 43-entry schema catalog contains no deleted PR family.
  local_verse_contract_cut: Exact a4af4734 deletes six organ-specific contract DTO/factories, the callerless LocalVerseContext query/seed bundle, fixed Verse/room policy prose, the mind-contract self-test, and persisted cluster topology. The topology writer had no caller; supervision accepted any nonempty fixed-key subset without authenticating Body domain, completeness, or runtime binding. That false bootstrap gate, loader, exports, and its diagnostic test are gone. Exact 03140a47 later deletes the remaining standalone runtime contract mirror; live providers own their CultMesh/CultNet catalogs. Exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health remain supervisor prerequisites. The cut removes 1,005 net source lines; core/release checks, CultMesh 12/12, and supervisor 4/4 pass.
  tool_capability_cut: Exact beb9fd32 deletes the producerless EpiphanyToolCapability DTO/constructor, runtime registration and mutation-contract row, standalone schema/index entry, and MCP smoke-banner claim. No writer, reader, constructor call, admission path, or test existed. Exact model-request tool definitions, RuntimeToolExecutionBinding, invocation intents, and governed receipts remain owners. The canonical catalog drops from 43 to 42 schemas; four affected packages compile and the tool runtime passes 14/14 active tests with one live-source test ignored.
  continuity_contract_cut: Exact ca2d2cf2 deletes four prose-only Continuity mutation contracts and their constants: packet, compaction checkpoint, stale-turn repair, and refusal. None had a typed document, schema, store, writer, reader, or test. Exact fed4b857 later deletes the final unread ContinuityRecoveryReceipt copy; typed reorientation Mind decisions/failures and commit receipts own recovery audit. Core/release checks and decision-auditable reorientation 1/1 pass.
  soul_contract_cut: Exact f8974d52 deletes five prose-only Soul mutation contracts/constants: generic verification request, invariant check, regression receipt, review receipt, and verification refusal. None had a typed document, schema, store, writer, reader, or test. The keyed RepoFrontierVerificationRequest and persisted SoulVerdictReceipt remain the actual request/result path. Core/release checks and focused verification 3/3 pass.
  eyes_contract_cut: Exact 201fa192 deletes three prose-only Eyes mutation contracts/constants/exports: generic evidence request, evidence review, and evidence refusal. Exact 83611f9b completes the cut by deleting the never-persisted EyesSourceLookupReceipt DTO and the duplicate EyesEvidencePacket. The real grant/tool chain is authenticated in place; the structured Research decision becomes keyed Mind evidence/observation writes under one validated atomic commit. Core check, full keyed Research lifecycle, replay, conflict, re-entry, and old-epoch refusal pass. Runtime advances to v35; the cut removes 205 net maintained lines. Atlas is untouched and remains operationally unaccepted.
  test_only_runtime_writer_cut: Exact fdefb889 deletes public create_runtime_session and create_runtime_job plus their exports. Every caller was a fixture; production session/job creation already belongs to family launch CAS, open_runtime_model_execution, and open_coordinator_run. OpenAI launch fixtures now use the real family preparation owner. Native-tool tests seed only their prerequisite documents locally rather than purchasing arbitrary production writers. Tool runtime 4/4, model runtime 8/8, OpenAI verification-request 1/1, and all affected production checks pass. The cut removes 96 net maintained lines; runtime_spine.rs is 9,347 physical lines with 50 public functions and 25 public structs. Verification generated 11.56 GiB across 17,633 files; cleanup restored the single 1.78 MB state inspector. No schema or Atlas path changed.
  persona_delivery_evidence_cut: Exact b3e9b229 makes the Persona social terminal the sole local owner of delivered-speech consequence identity. It folds the already-verified signed Bifrost receipt into message ID, crossing receipt ID, and exact receipt digest. The standalone PersonaDiscordDeliveryEvidence document, runtime registration/write/read path, and conversation receipt evidence-ID vector are gone. Retention reloads and cryptographically verifies the durable provider-owned request/receipt pair, then matches that exact consequence against the social terminal. Runtime advances to v36; social terminal and conversation execution advance to v2 with no compatibility reader. Core compiles, Persona consequence/retention passes 5/5, and the release-owned Persona service compiles. The cut removes 66 net maintained lines; verification generated 3.1 GiB across 7,791 files and cleanup restored the single 1.78 MB state inspector. Atlas is untouched; no live inter-swarm collaboration has run.
  persona_social_cut: Pending mentions, immutable requests, terminal receipts, quarantine records, retention heads, and retention plans are separate keyed CultCache documents. Persona derives its own deterministic work identity, reserves and terminalizes through exact batch CAS, cites the exact request envelope as pass-input provenance, and retries failed mentions without a timestamp or global revision. No scheduler can launch, block, retain, or provide pass provenance for Persona work. Exact 3dda58a5 makes Resident Self the sole authenticated Bifrost-feedback polling/import owner and deletes the standalone ingress CLI, its static projections, its old Starfire snapshot replacement seam, and two command-only tests: 426 net deletions. Seven retained tests prove signed admission, target/provider substitution refusal, disclosure gating, recovery, and read-only provider-store import.
  operational_state:
    local_worktree: source_subtraction_commits_landed_ox17_and_deployment_paused
    docker_engine_access: starfire_compiler_retired_all_yggdrasil_epiphany_transient_containers_volumes_package_roots_and_per_run_test_target_removed_future_idunn_epiphany_builds_native_rust_1_95_0_via_gamecult_ops_89f0d78
    operator_wireguard: restored
    starfire_persona_permit_firewall: persistent_exact_gamecult_ops_6ee08a4
    yggdrasil: upgraded_16_vcpu_62_gib_2_tib_intended_swarm_and_cicd_host
    yggdrasil_idunn_epiphany_cicd: exact_8b972715c47731f2418d0c423cb0dd2076940bd7_provenance_live_nrestarts_0_native_epiphany_builder_and_generic_signed_health_validator_live
    yggdrasil_epiphany_package: source_d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4_release_sha256_46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06_witness_file_sha256_348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357_26_binaries_plus_witness_root_owned_nonwritable
    yggdrasil_epiphany_test_receipt: sha256_de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482_native_serial_workspace_passed
    yggdrasil_epiphany_deployment: request_2026_08_22T16_35_41_670Z_succeeded_exact_d2ca6630_native_test_package_signed_authenticated_health_active_openrouter_ox_credential_ready_swarm_and_deployment_brakes_engaged
    ox10_failed_capstone: sealed_braked_inactive_exact_470d4cb5_direct_body_modeling_without_eyes_exact_failure_context_no_mind_commit_no_public_consequence_retry_projection_falsified
    ox12_frozen_capstone: root_ox12_84a7dec1_private_inactive_historical_epoch_direct_body_modeling_without_eyes_openrouter_proposal_attempt_1_structured_result_repo_model_mutation_refused_absent_frontier_dependency_no_public_consequence_never_resume
    ox16_frozen_capstone: root_ox16_749d977e_private_inactive_historical_epoch_direct_body_modeling_without_eyes_concurrent_persona_historical_direction_proof_survived_disjoint_model_changes_planning_blocked_by_evidence_paths_impersonating_repository_authority_no_hands_no_public_consequence_never_resume
    yggdrasil_epiphany_749d_package: source_749d977e_release_sha256_5d9bc25612dd46511620671ccd5113f3b5e0e3c060c85e97dcdc199f9126a230_test_receipt_sha256_39229d8a526a7af7e7b29cec28d27b07f89ba5f5792658947e3d1d039b9449c4_historical_exact_package
    starfire: operator_workstation_and_source_checkout_not_cicd_build_body
    starfire_runtime_identity: epiphany-starfire
    starfire_swarm_brake: original_c011_quiescent_exited_255_f90_copied_proof_body_braked_and_stopped_exit_zero
    starfire_release: exact_465af24d_sha256_089e0005_historical_c011_not_running
    starfire_repository_body: bound_and_observed
    starfire_verse_topology: bound_to_current_repository_body
    starfire_native_status: canonical_docs_corrected_original_c011_containers_exited_255_named_volumes_quiescent
    bifrost: exact_cb3239aa_f67f5122_native_runtime_active_on_yggdrasil
    bifrost_persona_feedback: ready_on_yggdrasil
    bifrost_feedback_binding: gamecult_aquarium_to_epiphany_starfire
    bifrost_feedback_crossing: authenticated_transport_only
    bifrost_persona_mouth: active_on_yggdrasil_10_77_0_1_17876
    starfire_persona_permit: authenticated_prior_release_pid_19024_10_77_0_2_17877
    persona_first_live_consequence: signed_failed_expired_without_repost
    persona_second_live_consequence: signed_unknown_unreceipted_bridge_refusal_without_repost
    persona_permit_probe: unique_node_rust_node_request_completed
    persona_fresh_consequence: blocked_by_absent_yggdrasil_discord_credential
    yggdrasil_epiphany_services: production_units_inactive_after_exact_rollback_current_symlink_d2ca6630_deployment_env_absent_idunn_active_nrestarts_0_deployment_brake_engaged_stale_failed_transient_ox_units_reset
    yggdrasil_previous_capacity_2026_08_08: historical_2_vcpu_1_9_gib_measurement_obsolete_after_host_upgrade
    yggdrasil_linux_physiology_smoke: exact_b5140288_runtime_spine_sha256_14143382_passed_and_removed
    starfire_linux_model_cognition: exact_a0d56f94_model_runtime_sha256_c72f33ed_two_turns_passed_20_mib_peak_rss
    starfire_linux_resident_coordination: exact_c0055772_heartbeat_self_plan_coordinator_passed
    starfire_linux_resident_peak: 62590976_bytes_self_plus_coordinator_plus_model_worker
    starfire_linux_role_cognition: eyes_and_modeling_tools_results_and_acceptance_proven_zero_consequence
    starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
    yggdrasil_epiphany_service_contract: idunn_source_change_owner_eve_and_local_typed_operator_surfaces_no_discord_control_plane
    resident_physiology: historical_c011_exact_465af24d_zero_zombie_proof_accepted_current_containers_exited_255
  vendored_codex_eviction: Exact 7a125d78 deletes all 3,592 tracked vendored Codex files and 851,099 lines after Cargo metadata and manifest/source guards prove no build consumer. The seven dirty files contained only rustfmt and blank-line churn, so no semantic work was discarded or preserved as a counterfeit artifact. The root workspace exclusion, obsolete AGENTS search recipes, vendor-specific license clauses, and two superseded live migration notes are gone. The independent Connector contract remains the sole Codex-facing compile dependency. Gamecult-ops exact cb63e77 corrects the Yggdrasil inventory from the extinct Epiphany-branded/Ghostlight-owned daemon to the independent `yggdrasil-codex-connector` Idunn target. Historical archive notes and the explicitly dated June Body whitepaper remain inert history. No compilation or deployment mutation was required.
  unresolved_authority: `runtime_spine.rs` remains the largest central liability; it still mixes immutable identity, minimal model sessions/jobs, process claims, model/tool execution binding, family admission, consequence receipts, retention, and resurrection fences. Exact a01c6842 removes the counterfeit Hands review; route, Substrate Gate grant, minimal intent, frontier authority, and exact consequences now own that chain. No production actuator authors those receipts, so the coordinator truthfully stops at `awaitingHandsExecutor`. Exact c37cae8b closes the two-stage Codex request seam, exact 7a125d78 removes the excluded implementation corpse, exact 7374be5e removes split-snapshot current-work projection, exact 5f1bea39 removes the second fulfillment/replay store snapshot, and exact 2bcbf268 makes current work the sole coordinator scheduling projection. Ghostlight exact 8e7d980 pins the same Connector source contract. Historical c011 and partial Gate roots stay untouched/read-only.
  next_action: Do not restart container 920c23d1a63159c2a2b293c4ff58476b283f2cc34eef1b38f0559e8bcfa9b400 or grant another attempt. Inspect Connector-owned operator-safe request handling for the exact Luna request `worker-body-modeling-0122c8f7ad5240535f427b8b25e5cfb5aa02ad931d5e39c491fad2a7c3984a36-attempt-0-1787663438545`: determine why the server closed without a typed result while remaining healthy. Compare it with a successful Ghostlight Luna receipt without treating the no-tool workload as equivalent. Admit another capstone budget only after one owner-level cause or verifier gap is established. Keep production, public speech, Hands mutation, and Atlas paused.
  capstone_package_authority_gap_closed: Idunn/Odin exact 446657a1 and gamecult-ops exact 1eeea5f provide an immutable image artifact witness route, isolated one-shot container target, preserve-before-delete private volumes, and bounded Connector route without mutating production. Historical Ox17 is sealed evidence, not an active alias.
  source_subtraction_audit_complete: Exact ed4ca58c deletes the final adopted-plan action/command forwarding wrappers and makes the operator projection plus Hands consequence validation read the owning public fields directly. The bounded closing audit found no further unearned public function in runtime_spine, state_model, current_work, resident_readiness, or resident_self: every survivor has a production consumer, and the sole low-fanout candidate authenticates the resident coordinator objective against its prepared grant or active lease. Further helper shaving has crossed into diminishing returns. The campaign stops with 2,111 net code/manifest/test lines removed across the evaluated thirty-commit downsizing sequence, two Cargo package boundaries retired, and no replacement authority, schema, process, or target added. The exact staged diff passed `git diff --cached --check`; no mixed-worktree compilation was claimed.
  single_snapshot_current_work_cut: Exact 7374be5e makes one pulled CultCache snapshot the sole input to Mind assembly, keyed RepoModel assembly, current-work Research and Planning lifecycles, Hands readiness, Modeling launches, reasoning-basis assembly, and Reorientation request projection. Three path-based wrappers and numerous repeated open/pull sequences are gone; Research and Verification admission also reuse their already authenticated cache for review and public-source consequence checks. The public Codex Connector client remains the earned ABI stub: deleting it would duplicate authenticated encryption and framing in every consumer, while no daemon/auth/HTTP/SSE implementation compiles into Epiphany. The cut is one net maintained line smaller, adds no schema, dependency, target, or process, and passes Core check, current-work 3/3, reasoning-context 8/8, Reorientation 1/1, Mind determinism 1/1, and RepoModel determinism 1/1. The focused run produced 2.0 GiB across 2,867 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
  single_snapshot_fulfillment_cut: Exact 5f1bea39 makes typed fulfillment replay consume the caller's already pulled runtime Mind snapshot. Research, Verification, Proposal Modeling, PlanMind continuation, fulfilled-worker archival, and Resident Self completion no longer reopen the same `.cc` file while validating one immutable result. The generic path-based fulfillment wrapper is deleted. The public provider-runtime role-result function remains the sole path-based CAS writer; cache-local fulfillment can only replay the exact result already present in its supplied snapshot. The cut adds 17 maintained lines net to remove repeated physical reads while adding no schema, dependency, target, process, or decision authority. Core check, current-work 3/3, reasoning-context 8/8, structured-failure refusal, and the release-owned swarm entrypoint pass. Verification produced 2.2 GiB across 3,189 files; cleanup restored the exact authenticated state inspector.
  single_projection_coordinator_cut: Exact 2bcbf268 makes the current-work projection the sole scheduling input for operator status and Resident Self. An accepted reorientation decision's real manual-regather obligation is projected once with Body, Research, Planning, Modeling, Verification, Imagination, and Hands work. Status no longer opens and assembles Mind separately, and Resident Self no longer hard-codes a contradictory Continue value. `EpiphanyCrrcAction`, its five impossible transition variants, the parallel coordinator-input field, and the second Mind read are gone. The existing reorientation lifecycle now proves the durable regather decision reaches the user-visible coordinator action. The cut removes 12 maintained lines net, adds no persisted schema, dependency, target, or process, and passes Core check, current-work 3/3, Reorientation 1/1, operator-sanitization 1/1, and the release-owned coordinator compile. Verification produced 1.6 GiB across 2,924 files; cleanup restored the exact authenticated state inspector.
  reorientation_result_projection_cut: Exact 125d77a2 collapses operator reorientation-result review onto one pulled runtime cache. Job and typed result cannot come from different store moments. The caller's never-used missing-store option, six impossible CRRC statuses, error-to-state translation, and the residual `surfaces/crrc.rs` module are deleted. The live typed result status is only Pending, Completed, or Failed; store failures propagate as errors, and a completed job without its exact typed result is rejected as corruption rather than displayed as backend unavailability. The existing Reorientation lifecycle now exercises the public result projection before Mind admission. The cut removes 64 maintained lines net, adds no schema, dependency, target, or process, and passes Core check, Reorientation 1/1, and the release-owned coordinator compile. Verification produced 1.6 GiB across 2,924 files; cleanup restored the exact authenticated state inspector.
  reorientation_terminal_projection_cut: Exact dfe3757b makes the one current-work projection retain whether terminal Reorientation review represents a typed model failure. The coordinator no longer reopens the runtime job merely to select success or failure admission; each admission owner still performs its exact strong validation. Production code shrinks by three lines, while two consequential assertions distinguish successful and failed review. Core check, Reorientation 1/1, and the release-owned coordinator compile pass. Verification produced 1.6 GiB across 2,924 files; cleanup restored the exact authenticated state inspector.
  native_model_event_cut: Exact b83c0416 deletes the transient OpenAI/provider request-input, tool, stream-event, payload, and receipt mirrors. CodexConnector and OpenRouter now terminate directly into the one native `EpiphanyModelStreamEvent` and `EpiphanyModelReceipt` family already persisted and admitted by Mind. The native receipt already carries provider response identity, usage, transport, caller identity, exact native/provider digests, and cached-token usage, so no evidence was lost. The cut removes 147 maintained lines with no schema epoch change. Adapter 5/5, runtime 21/21, release model edge 12/12, and focused checks pass; both verification roots were removed.
  model_adapter_package_cut: Exact a721b763 deletes the one-file `epiphany-openai-adapter` Cargo package. Its pure provider request lowering and OpenRouter response projection now live beside the canonical native model contracts in `epiphany-model-adapter`; transport remains in the release edge or independent Connector daemon. One manifest, workspace target, dependency edge, and 27 maintained lines disappear without changing serialized identities or field order. Model adapter 5/5, decision context 8/8, runtime 21/21, release model edge 12/12, and focused checks pass. Verification produced 4.7 GiB across 6,524 files; cleanup restored the exact authenticated state inspector.
  model_runtime_package_audit: Keep `epiphany-openai-runtime` as an earned optional library boundary. Its single library target contains about 190 KiB of model and Persona orchestration with thirteen direct dependencies. The root release package owns nine production binaries and pulls this library only behind `openai-runtime` for the model and Persona entrypoints. Folding it into a root library would make state, Body, swarm, coordinator, release, permit, and tool binaries compile or feature-mask model-runtime anatomy they do not consume. No source change is justified; deleting a manifest while increasing compile fan-out would violate the subtraction objective.
  release_construction_package_cut: Exact 8086d66f deletes the single-consumer `epiphany-release-construction` Cargo package. Its pure 1,222-line constructor moves byte-for-byte beneath Core's existing packaged-release owner; `fs2` moves with it. The workspace member, manifest, dependency edge, and seventeen obsolete lockfile lines disappear. The Model Atlas focused test command now names Core. The cut removes 39 maintained lines and one library target without changing a serialized contract or verifier. Core check, packaged-release 15/15, resident-readiness 11/11, and the release entrypoint pass. Verification produced 1.60 GiB across 2,728 files; cleanup restored the exact authenticated inspector.
  hands_constructor_cut: Exact 1e66e770 deletes the three public Hands receipt convenience constructors and their `too_many_arguments` exemption. Their only caller was the current-work lifecycle test, which now uses explicit typed receipt literals. The three receipt writers remain because they are the real consequence-admission owner: they validate route, intent, Substrate Gate grant, patch, successful command, commit, and exact Verification obligation under CAS. The cut removes 59 maintained lines with no schema or behavior change. The complete keyed Modeling/Research/Hands/Verification lifecycle and concurrent Persona/Hands proof passes. Verification produced 1.25 GiB across 1,888 files; cleanup restored the exact authenticated inspector.
  dead_idunn_runtime_health_cut: Exact fab6a59a deletes the 505-line `idunn_runtime_health` module and seven Core export lines. Its signer, aggregate calculator, RUDP publisher, two public shapes, and five self-tests had zero production caller. Idunn's deployed signed-health authority is external; Epiphany resident startup uses `resident_readiness`, and the separate provider-health admission module remained untouched in this cut. The deletion removes 512 maintained lines. Provider-health admission 6/6 and resident-readiness 11/11 pass. Verification produced 1.25 GiB across 1,888 files; cleanup restored the exact authenticated inspector.
  dead_idunn_provider_health_cut: Exact 200732e9 deletes the 1,030-line `idunn_provider_health` module and eight Core export lines. Its query, candidate verification, monotonic admission store, typed admission family, and six self-tests had no production consumer. The release-owned swarm compiles without it and the actual `resident_readiness` owner still passes 11/11. Idunn's external deployment-health authority is unchanged. The cut removes 1,038 maintained lines. Verification produced 1.45 GiB across 2,554 files; cleanup restored the exact authenticated inspector.
  packaged_release_api_cut: Exact 1e4fa533 inlines the one-caller packaged-release loader into authentication, makes required-binary enumeration and witness read/write private to construction, and demotes validation/file verification/digest validation to the parent packaged-release owner. Five unconsumed root exports disappear. The release package, publish, inspect, authentication, exact witness digest, and all typed contracts remain public. The cut removes seven maintained lines and narrows six false API promises. Packaged-release 15/15 and the release entrypoint pass. Verification produced 1.45 GiB across 2,554 files; cleanup restored the exact authenticated inspector.
  canonical_brake_surface_cut: Exact e905dcd9 inlines the sole canonical protected-surface list into `default_epiphany_cultmesh_swarm_brake` and removes its root export. The actual brake document and engage/release/read/write owners remain unchanged, including the paused Model Atlas surfaces. The cut removes four maintained lines and one false public API. Both brake lifecycle tests pass. Verification produced 1.23 GiB across 1,888 files; cleanup restored the exact authenticated inspector.
  resident_provider_aggregate_cut: Exact f962c0bc deletes `ResidentProviderHealth`, `authenticate_resident_provider`, the dead `provider_matches_authority` boolean wrapper, and one duplicate predicate test. The deleted aggregate had no production caller; one module-local test alone animated it. Live startup remains owned by `derive_resident_cognition_readiness`, which loads the exact resident provider document, probes the process singleton, and reports the actual failed authority predicates through `provider_is_fresh`. The surviving tests assert exact predicate failures, bounded clock skew, release/process/brake binding, CAS, and private-state refusal. The cut removes 204 maintained lines net. Resident readiness passes 9/9 and the release-owned swarm checks cleanly. Verification generated 2.012 GiB across 2,823 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
  single_projection_family_review_cut: Exact d0a317bd deletes five public one-caller review-job-ID wrappers. A coordinator review dispatch now pulls one `EpiphanyCurrentWorkProjection`, keeps the established Research, Verification, proposal Modeling, Body Modeling, and frontier-verdict Modeling family order, and passes the selected exact job to the existing family result/admission owner. `EpiphanyAgentPassAttemptProjection::review_job_id` owns the shared rule that only a Review attempt exposes its job identity. No registry, persisted schema, or generic admission path is added. The cut removes 33 maintained lines net. Current-work tests pass 3/3 and the release-owned coordinator checks cleanly. Verification generated 1.451 GiB across 2,554 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
  family_review_consequence_cut: Exact 1a9dec56 replaces five copies of coordinator review physiology with one exact-result read, one operator-stop path, one family admission dispatch, one event append, and one status refresh. A private in-process `FamilyReviewTarget` selects Research, Verification, proposal Modeling, Body Modeling, or frontier-verdict Modeling from the already pulled current-work projection. It owns no persisted state, scheduling, callbacks, or admission logic; each match arm still calls the existing family CAS owner and preserves the prior event cargo and Modeling priority. The cut removes 39 maintained lines net. Coordinator binary tests pass 4/4 without warnings. Verification generated 1.609 GiB across 2,145 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
  test_only_state_surface_cut: Exact fca516f5 removes the test-only `resident_self_terminal_receipts` reader and `EpiphanyRepoModelBasis::validate_current` path wrapper, and makes `ResidentProviderReadiness::validate` plus `load_resident_provider_readiness` private to their owning module. The current-work verifier reads and decodes the exact typed terminal envelope; the Atlas verifier refreshes its existing cache and calls the production complete-basis validator. Private-state, duplicate-owner, terminal-receipt, and complete RepoModel-basis proofs remain. The cut removes eight maintained lines net and four false public surfaces. Resident readiness passes 9/9, current work 3/3, the Atlas basis test passes, and Core checks cleanly. Verification generated 1.407 GiB across 2,428 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
  causal_identity_visibility_cut: Exact e7b66b35 demotes the six causal-work identity constructors and their module re-export from the downstream crate ABI to crate visibility. Proposal Modeling, frontier Research, frontier Planning, PlanMind, frontier-verdict Modeling, and admitted-direction request IDs retain the one length-framed SHA-256 primitive and every existing call site. The cut removes seven public exports with zero maintained-line, schema, dependency, target, or behavior growth. The focused Core library check passes. Verification generated 0.286 GiB across 1,026 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.
  internal_cognition_helper_cut: Exact 9f189871 removes the admitted-direction prompt alias from the crate root, makes its renderer and supersession check crate-internal, and makes the Resident Self policy digest and death-completion helper private to their sole owner. Current work names the prompt module directly. Prompt text, digest inputs, supersession, and death recovery remain exact. The cut removes one maintained line net and five false public/root surfaces. Current work passes 3/3 and Core checks cleanly. Verification generated 1.407 GiB across 2,428 files; cleanup restored exactly the 1,776,640-byte inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.

  runtime_spine_surface_cut: `runtime_spine.rs` owns immutable runtime identity, minimal model sessions/jobs and process claims, model/tool execution bindings, family admission, consequence receipts, retention, and identity-resurrection fences. Provider requests remain exact durable audit input; provider events/receipts normalize into one native persisted stream/receipt family. The sealed typed worker launch owns live pass-family identity and outer-worker role. Model execution bindings own model-session membership; outer-worker root membership is structural. Archived worker attempts retain exact request kind/ID, deletion digest, decision context, and full typed structured outcome after live launch deletion, including typed failures. Model sessions carry only grouping identity plus the active/completed phase latch; completed-session retention derives its exact jobs from model bindings and writes one private tombstone containing retired identities plus the deletion-chain digest. The live and archived documents protect distinct admission and resurrection invariants and do not duplicate decision cargo. Runtime jobs carry only job identity plus the Queued/Completed/Failed latch. No job clock, role/session mirror, intermediate status, generic terminal-result document, latest-result selector, or model-turn identity echo participates in causality. Typed role/reorientation outcomes own structured terminal decisions and atomically close their job/process physiology; native model receipt/failure records own model-pass terminality; process claims own process death. Verification reasons from the exact route, authority, intent, patch, command, and commit bodies sealed in its basis and has no review document or live receipt-reread tool. Mind/runtime writable epochs remain v11/v47; archived worker attempts are v3. Family launch CAS, model execution, and coordinator basis admission are the only session/job creation owners. Continue subtraction through the remaining single-caller runtime-spine surfaces; do not recreate deleted authority through registries, adapters, compatibility readers, or summary DTOs.

  runtime_event_cut: Exact 27fe11ae deletes persisted generic runtime events, their registry and CultNet contract, CLI/status surfaces, coordinator and lifecycle shadows, archival dependencies, and the obsolete legacy coordinator repair path. Exact d66baa27, 058751fb, and 573ddc8b first removed provider-event duplication, the arbitrary event writer, and paired lifecycle events. Runtime session/job state plus exact typed results, failures, coordinator run receipts, and coordinator death recoveries solely own terminal facts. Events cannot route work, authenticate terminality, or resurrect authority because no runtime-event document remains.

active_subgoals:
  - "Eureka pipeline state campaign (operator ruling 2026-09-15, branch codex/eureka-pipeline-state; ends in notes/eureka-pipeline-state-target.md). Epiphany owns typed schemas and admission for pipeline state: findings, rulings, cut specs and reports, follow-ups. The Eureka Claude Code skill reaches that state through a per-session Rust stdio MCP server built as an Epiphany package, writing only through a public organ-provenance admission path. An instance owns its mind and is assigned stewardship over repos (operator rulings 2026-09-16, superseding both the user-level store and the repo-committed store). A memory organ service on Yggdrasil owns that state, so minds leave version control: no per-clone lease, no git preconditions, no divergence between clones. The organ is Huginn, whose dormant .cc-to-Eve CLI retires because generic inspection belongs to CultCache Studio; it depends on Qdrant directly rather than voidbot, embeds through Ollama on Nightwing, speaks CultNet behind a thin eureka-state stdio MCP client, and refuses loudly when unreachable rather than spooling a second copy. Epiphany adopting Eureka's habits is a second, later campaign. The first cut re-pins CultLib from e171eca3 to a0813c6. This campaign does not touch the Luna diagnosis, production, Atlas, or deployment."
  - Complete the fresh exact-package Decision-Auditable Concurrent Mind capstone before any further operational Gate run.
  - Prove the ordered Model Atlas Gate 1 with real isolated stores: establish signed sight before engaging all brakes, then prove frozen read-only state and no local Modeling or Soul wakes.
  - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
  - Prove a live coordinated path from source gathering through the Hands gate and post-action verification.
  - Bound artifact retention and prove supervised restart, crash recovery, session closure, and long-duration resource behavior.
  - Keep source editing on F:. Idunn on upgraded Yggdrasil owns source-triggered compilation, testing, packaging, deployment, and daemon survival; do not duplicate that work on Starfire.

organ_readiness:
  model_atlas: code-complete and locally verified; ordinary Modeling uses runtime-authored proposal v2, authenticated Body-manifest evidence, derived opaque IDs, and exact CAS. Publishers revalidate Body evidence; signed transport, deterministic enriched projection, one Eve tree, local impact admission, Resident Self lane pressure, brakes, partition staleness, cycle policy, and no-Hands boundary pass. Real ordered Starfire Gate 1 and sustained dogfood remain open.
  persona: partial; the live Projector -> Persona -> Interpreter loop now consumes Ghostlight's exact-revision generalized projection membrane, and the Persona receives only one lived narrative stream rather than parallel raw transcript, memory, mention, activity, or typed-state authorities. Epiphany retains stage receipts, effect validation, Mind admission, brakes, Bifrost consequence gates, and terminal commit. Cross-host request/receipt/permit organs, distinct identities, exact release admission, unique permit completion, signed failure/unknown receipts, and no-repost behavior are live. Exact Bifrost cb3239aa fixes positional permit bodies and binds the Discord bridge command receipt to the signed request. A completed public consequence remains unproven because Yggdrasil has no Discord bot credential.
  self: partial; proposal recovery, Mind admission, current-model Hands routing, Soul lifecycle precedence, verdict incorporation, proposal preemption, explicit-obligation Eyes routing, in-process status ownership, causal Soul-to-Modeling routing, and grant-owned lifecycle projection are live. Exact c7412998 removes accepted Eyes, generic regather, role lanes, and Modeling hints from Research launch authority; the exact Research lifecycle alone drives Launch/Wait/Review, and accepted Eyes alone cannot manufacture Modeling. Exact d4907ee8 proves first-attempt proposal Modeling fulfillment, exact grant terminalization, and one terminal downstream review whose receipt carries the post-transaction awaitFrontierProposal action without replay.
  eyes: local and copied Linux source-gathering circuits are proven. Immutable GitHub identity, execution revalidation without a grant, frontier-owned continuation, request-owned exact public-source coverage, sealed decision context, and keyed evidence/observation admission share typed owners. Exact c7412998 makes one Research lifecycle own launch, terminal decision durability, review, and Eyes.frontier_research admission; full RepoModel state is audit cargo while the exact frontier closure owns conflicts. Exact 3d13b1ea rejects zero, partial, or unrequested public lookup sets. Exact c40aa286 shares terminal receipt validation across provider and Mind. Exact packaged f90f1186 completed two immutable public lookup and Mind-acceptance cycles, advanced authenticated tool receipts from 53 to 61, produced no Hands consequence, survived process turnover, and stopped braked with both daemons exiting zero. GitHub's August 2026 service incidents are classified as external provider downtime; they do not falsify Epiphany's source identity or gate ownership. Denial-before-network and successful immutable lookup remain separate proofs.
  modeling: proven for the current bounded Windows circuit, the causal Linux resident Eyes-to-Modeling route, governed live directory observation, typed resident grant sight, first-attempt proposal-frontier publication, and single-consumption coordinator review. Exact d367e525 proves the full frontier-verdict lifecycle from atomic Soul request through deterministic launch, sealed decision, disjoint keyed merge, same-frontier refusal, and Modeling.frontier_verdict admission. Exact d4907ee8 proves one outer proposal job, one terminal review, post-transaction awaitFrontierProposal publication, and no replay. Broader Body-map coverage remains open.
  imagination: proven for three bounded live circuits, exact packaged receipt-free settlement, and genuine packaged model-produced option generation. Exact acd91e6e accepted signed public feedback into one proposal-only request, derived all causal identity and quoted-evidence references from authenticated runtime context, atomically published worker result plus candidate companion, settled Self once without retry, and neither adopted the proposal nor granted Hands. The rejected b661ec4b copied run remains evidence that model-authored evidence identifiers were an illicit provenance mouth; its three failed attempts were braked and sealed.
  hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind adopted route ceilings to exact changed-path subsets.
  soul: proven for the current bounded route-chain consequence; exact d367e525 makes Verification acceptance atomically own the Soul verdict and deterministic frontier-Modeling request rather than relying on later accepted-at selection. Exact d3bfbda0 launched Verification through typed plan-decision provenance, result f23fe2b6 was accepted at revision 57, and Self then derived Modeling before any repeated Hands authority.
  mind: proven for launch-owned resident frontier adjudication; two historical attempts failed closed, exact bd96305e derived immutable identity from authenticated launch, authorized retry 2d2a3e8b completed, and Self atomically committed terminal adopt decision e7d7f3c7. Broader memory retention and long-duration behavior remain open.
  continuity: partial; authenticated 55660d78 terminalized the copied v28 dead worker once and refused duplicate restart, while sealed v28 remained unchanged. Exact 100d8854 closes only all-terminal sessions, emits one deterministic event, and refuses post-close jobs. Exact 42bc665a proves bounded retention and restart sequence recovery. A digest-pinned Linux runtime-spine at b5140288 repeated closure invariants on Yggdrasil. Authenticated c005 proves typed resident state survives hard exit, executable-body replacement, runtime-topology correction, and restart while preserving awaitFrontierProposal. Exact b8138a6b proves active-child and idle SIGTERM closure with exit zero and final braked state. Exact c930f505 proves cross-container resident ownership refusal without state mutation while Heartbeat retains its distinct typed lock. Exact ed15f83a packages resident lifecycle retention. Exact 16c4b19f packages coordinator receipt retention without resurrection. Exact 75b84180 packaged Linux proves worker start gating, claimed/active orphan death recovery, canonical resident requeue, and one distinct same-request retry without dual live authority. Exact 7637b1cf packages and proves atomic generic job/result/event plus terminal-failure process closure, canonical resident settlement, and a distinct same-request retry with no dual live authority. Exact 2e66433f packaged Self proves admitted-model-direction valid-result-before-receipt closes once without retry. Exact 52ee6b53 packages the corrected full-backing resident retention fence. Exact 53678374 packages authenticated failed and fulfilled outer-worker archival: window one retires only the older exact seven-envelope family, retained authority stays live, archived failure cannot resurrect, and archived fulfillment remains queryable. Direct packaged proposal Modeling and deployed journald ownership are accepted. Exact a4756857 packages CultCache 0ba8745 and proves named-volume publication across forty SIGKILL writers plus ten million concurrent lockless reads. Exact f04abd6b restarts a sealed braked resident with startup maintenance, stable revision/hashes, no grant resurrection, 0.36% sampled CPU, and a second clean SIGTERM exit zero.
  nervous_system: partial; detached scheduling, runtime jobs, typed feedback, ordinary Windows coverage-store identity, and operator projection work. Exact c0055772 proves Linux heartbeat acknowledgement/regrant, Self single-consumption launch, authenticated plan coordinator completion, and a persistent resident body. The accepted Linux Eyes-to-Modeling circuit proves detached role workers, native read-only tool loops, typed admission, and causal next-organ routing. Exact 16407f7e adds cross-container readiness ownership and an actual c006 923-pulse braked plateau. Exact c9a2a979 adds two consecutive causal grants with clean terminal settlement, then completed 36,700 total Heartbeat iterations across a 10h23m braked endurance run with bounded artifacts, stable authority hashes, and clean dual exit zero. Exact 3f37503e makes the brake a true cognition-ingress boundary and proves 0.29-0.33% copied resident CPU at one-second cadence. Exact f04abd6b decouples maintenance from polling and proves released sleeping CPU about 3.0% at five-second cadence with stable authority, no grant, restored brake, and clean shutdown. Exact ec54666c closes the local-Verse reader classification. Exact acd91e6e proves signed Bifrost ingress through Heartbeat, Self, coordinator, OpenAI Imagination, runtime-owned candidate admission, terminal acknowledgement, and braked restart with one grant and no resurrection. Historical container runs used bounded local logs. The prior migration suite was compiled natively before the Idunn boundary correction; all subsequent source-change compilation, testing, packaging, and deployment belongs to Idunn on upgraded Yggdrasil. Deployment admission remains outside this source pass.

forbidden_actions:
  - Do not issue a speculative deployment grant.
  - Do not mutate or restart Yggdrasil from this source task while the deployment task owns its preparation.
  - Do not reuse pre-upgrade Yggdrasil capacity measurements or service topology as current deployment truth.
  - Do not treat stored status, process liveness, or an old receipt as current authority.

memory_policy:
  canonical_map: state/map.yaml
  live_handoff: notes/fresh-workspace-handoff.md
  durable_evidence: state/ledgers.msgpack
  historical_provenance: Git history and archived notes
  rule: If a fact does not constrain a current decision or explain a live invariant, it does not belong in the active Mind.