Epiphany/notes/fresh-workspace-handoff.md

Fresh workspace handoff

Updated: 2026-08-18

Current state

The Persona projection membrane now consumes Ghostlight's generalized ghostlight-persona-projection crate pinned to Ghostlight commit 51fc7495. The live executor projects transcript and typed Persona context before Persona cognition; Persona receives one lived stream only. Epiphany still owns typed effects, receipts, Mind admission, brakes, external consequence gates, and terminal commit. Focused core and OpenAI-runtime Persona suites pass.

The five-day shakedown remains paused. The active branch includes exact fc5d1a4a on codex/epiphany-shakedown-live: the keyed Mind foundation, federated Model Atlas vertical slice, ordinary Modeling authoring path, durable publisher identity, fresh seven-organ Mind bootstrap, and atomic RepoModel projection bootstrap are landed. Historical aggregate RepoModel and partial Gate stores are evidence only. No production model output, registry, command, admission path, projector, or repair path can restore their authority.

This is not yet the full Concurrent Mind cut. Persisted EpiphanyThreadStateEntry, its coordinator transaction, and multiple unmigrated launch/acceptance/status readers remain live production authorities. Baseline Body, Proposal, frontier-verdict Modeling, frontier Research, and frontier Verification are no longer among them: keyed Mind owns their work projections, operator and Resident launch, exact job-bound continuation, review, and semantic admission. Research is driven only by an explicit external-evidence obligation; accepted Eyes state, timestamps, generic regather, and role lanes cannot launch Eyes or gate Modeling. Fresh Gate preflight proved the consequence: both keyed semantic partitions reached ready, but status still called the organism missing because no thread aggregate existed. Model Atlas Gate 1 is therefore paused behind that deletion, not merely behind another operational retry.

The Atlas keeps the federation sharp. A provider Mind owns an offer. A consumer Mind owns a claim. Soul owns verification evidence for exact endpoint versions. Signed per-repository publishers carry those facts through Odin, a deterministic projector derives compatibility, cycles, freshness, and blast radius, Eve lowers one retained tree, and each consumer Self decides whether a local impact wakes Modeling or Soul. Nobody owns a shared edge. Atlas never grants Hands authority and no organ opens a foreign repository Mind store.

Epiphany exact 4c0cbd57 contains the typed contracts, per-family CAS planners, signing and trust, immutable publication stores, publisher/projector/ingress daemons, brake scopes, Resident Self scheduling, and three-repository smoke. Exact f60db0a2 closes the production authoring/evidence seam: ordinary Modeling emits semantic offer/claim transitions only; runtime proposal v2 binds the exact request, result, evidence set, and current Body basis; the planner resolves authenticated manifest digests and opaque IDs; and the publisher refuses drifted Body evidence. The projection and Eve tree carry endpoint labels/contracts/lifecycle/Body evidence, exact current Soul evidence, publisher age/watermarks, cycles, and blast radius. Odin exact d34cb7e persists and serves the publication, projection, and canonical Eve schema IDs without dependency semantics. Eve exact b597dab and 076d212 provide the canonical Atlas provider advertisement and one gamecult.eve.surface.v1 retained tree for GUI and TUI.

Verification is green at the latest ownership cut: Epiphany core library 559/559, OpenAI runtime 23/23, coordinator runtime 18/18, and core/OpenAI all-target checks pass. An unfiltered core package run also exposed two pre-existing epiphany-hands-action fixture failures: those fixtures omit the exact RepoFrontierHandsAuthority already required by production. The gate was not weakened; fixture repair remains separate test-harness debt. Earlier workspace checks remain accepted; Odin Node 1/1 and Rust 15/15; Eve Atlas conformance 4/4 and Eve contracts 6/6. The workspace-wide all-features check still reaches an older feature-gated workspace-coverage recovery smoke whose already-absent API predates this slice; no compatibility shim was added.

These are implementation and isolated proof claims. They are not sustained Starfire dogfood. Planning, reorientation, and final aggregate deletion are the next source rites; only then may Gate 1 use separate real stores and identities; keep impact ingress absent while ordinary Modeling seeds facts and publishers/projector establish signed sight; then engage all three Atlas brakes and prove later organ cycles are held while the last Eve projection remains visibly stale/read-only and no lane wakes.

Gate 1 preflight exposed and cut one publisher lifecycle defect before live evidence was admitted. The publisher now enrolls its private signing identity only when absent, reopens that exact identity on later heartbeats, and exports one idempotent public trust anchor to a separate operator-readable store. This keeps identity rotation impossible by retry and gives the projector a real public anchor to pin without reading private state. The focused identity reopen/export test passes; the operational gate remains in progress and is not yet accepted.

The first fresh Eve bootstrap then falsified a second missing owner: repository Body bootstrap called the legacy agent-memory admission gate against an empty store, which correctly refused because no canonical organ rows existed. Fresh bootstrap now initializes the immutable swarm identity and all seven typed organ-memory rows before admitting generation one through the shared witness primitive. Legacy admission remains migration-only. The nine focused agent-memory tests pass, including exact fresh replay. The refused partial Eve root is retained in the Gate 1 artifact directory; the operational retry must use a new state root.

The next fresh three-repository bootstrap falsified a third missing owner. The keyed RepoModel seed committed, but bootstrap did not emit the Modeling semantic-projection obligation that readiness requires. Exact d11e6511 derives that obligation from the exact keyed seed envelopes and commits it as a derived runtime companion in the same batch CAS as seed provenance, keyed Mind documents, and the Mind commit receipt. It is not a Mind document and cannot be repaired by status or a projector. Replay validates the existing companion; the focused seed/replay test passes. The three partial stores without this companion remain read-only evidence. Resume Gate 1 only from a fresh state root.

Exact 2ba6b9dc closes the next preflight defect. The semantic projector body owned two canonical stores but enumerated only agent-memory Mind; it now loads and validates both Mind and Modeling inputs on every pulse while allowing one faulty source to remain visible without hiding the other. CultMesh semantic health also distinguishes terminal-ready from query-eligible, so a successful empty partition no longer degrades the provider. On the fresh root, Eve, Odin, and Epiphany each executed Modeling once, then settled idle with two inspected sources and zero source, retention, or health faults.

The following production status read falsified the remaining campaign premise: EpiphanyThreadStateEntry still owns coordinator presence/routing. Canonical docs previously described the keyed foundation too broadly. The hard cut is now the immediate campaign; Gate 1 cannot resume until production source has no thread aggregate writer or behavioral reader.

Public positioning was synchronized on 2026-08-16 without changing that next rite. docs/positioning.md is the current claim owner: Epiphany is the organizational layer above frontier AI workers; the primary failure is global coherence collapse rather than context-window exhaustion; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance; and GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Those organisms collaborate through governed typed surfaces while private Mind and consequence authority remain local. Durable public Persona relationships and visitor-facing surfaces are intended social infrastructure, not deployed capability. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain explicitly gated supervised-alpha targets.

The completed Decision-Auditable Concurrent Mind foundation uses typed, content-addressed reasoning bases that preserve exact source envelopes and a closed projection; terminal decision contexts preserve the exact native request, the provider request derived from it, and every ordered governed tool intent/receipt actually fed to the model. Worker model requests require a sealed basis, and structured role/reorient results plus their generic job result bind the terminal context. Tool-round-limit and repeated-tool-loop failures seal the last request context before worker failure. Model-session archives preserve their basis/context IDs, and fulfilled worker-attempt tombstones preserve and revalidate the exact decision context instead of collapsing it to a digest. Exact-envelope batch CAS merges disjoint Mind documents and explicitly refuses same-identity or changed-strong-read conflicts. All three Persona stages now seal predecessor-bound contexts, the effect and terminal commit atomically, and Persona retention preserves the structured effect, conversation/consequence receipts, terminal receipt, reasoning bases, and decision contexts while removing stage/execution scaffolding. Exact ee3d82c0 binds provider/runtime errors and watchdog timeouts to the exact admitted request held by the running pass, without inventing a persisted latest-request head. Exact 71505941 adds the keyed Mind document family, deterministic EpiphanyMindView, atomic runtime/Mind epoch identity, and a mutation gate that rejects non-Mind envelopes or semantic key drift. The keyed view is now the sole current RepoModel source; it does not read or translate historical aggregate stores.

Exact 2eb95df6 closes the external Body prompt seam. A repository observation is first authenticated against the Body store, then admitted into the runtime Mind as one immutable semantic-key document containing its exact typed basis and exact source envelope. The Body organ's provenance is recorded in the same Mind commit receipt; no raw transcript or JSON sidecar participates. The highest authenticated Body generation is derived from those admitted documents. Baseline Body Modeling work and sealed role reasoning now read that Mind state only. A focused counter proves current-work projection performs zero Body-store and zero repository-file reads, and a substituted external observation refuses without changing the Mind bytes.

Exact bd5034cd is the first live authority cut. Operator objective intake now atomically writes one semantic objective document, its immutable typed operator provenance, and one Mind commit receipt. It writes no thread-state aggregate; thread identity is provenance, and replacement refuses without changing store bytes. The commit authority is explicitly model context or operator provenance, so operator decisions do not counterfeit model reasoning. The aggregate-only Modeling acceptance repair writer and commands are deleted; frontier execution inspection/amendment remains under a truthfully named binary.

The keyed RepoModel foundation now gives identity, domain, node, edge, summary, frontier, lifecycle receipt, and per-node unresolved-claim obligations separate CultCache identities. Its deterministic validated view is part of EpiphanyMindView and has no revision/hash head. Documents store canonical named MessagePack behind typed constructors because direct compact nesting let skipped middle fields shift into the wrong schema positions. Mind CAS strong reads are now genuine read fences: CultCache receives byte-identical expected envelopes as required by its physical primitive, while the commit receipt lists only semantic writes. A stale read-only dependency blocks the whole mutation without partial insertion. Full core remains 690 passing with one ignored cross-process helper.

The concrete RepoModel mutation planner now accepts a persisted typed semantic proposal and owns dependency derivation for domains, nodes, edges, summaries, and frontier documents. Node and edge retirement are semantic operations; admission and lifecycle receipts remain runtime-owned. Callers do not supply a strong-read list. One mutation can create a complete domain/node/edge/summary slice in dependency-reversed order, while duplicate semantic identities refuse. A fresh node retirement and a concurrent new frontier target both write the same previously absent obligation identity, so only one can commit.

Exact 8ad16be0 cuts the first aggregate RepoModel bootstrap path. epiphany-repository-body bootstrap now admits an EpiphanyRepoModelSeed as typed operator provenance and atomically writes only keyed RepoModel documents, derived claim obligations, and the generic Mind commit receipt. Identical seed replay is inert; divergent replay and any aggregate RepoModel envelope refuse. The seed contains no revision/hash head. Full core passes 692 tests with one ignored cross-process helper, and the repository-body binary checks cleanly. Exact 18d3783a deletes the old thread-state-to-aggregate bootstrap binary. Exact 120663fa removes aggregate bootstrap/read behavior from launch context: prompt assembly loads EpiphanyRepoModelView, derives a nonpersisted query-only graph projection, and renders only its projection digest. The derived snapshot has no revision/hash authority. All seven launch-context tests and the full core suite pass.

Operational correction: the original c011 resident and Heartbeat containers are not alive; both exited 255 on 2026-08-11. Their named volumes are quiescent and remain untouched. Historical c011 zero-zombie and organ-circuit evidence is still valid, but it is not current liveness. Every copied public-Eyes body is braked and stopped. Yggdrasil remains the public crossing and never builds Epiphany.

Consolidation cut

The shakedown found the same missing invariants in different clothes. The consolidation now gives each repeated invariant one named owner.

• causal_work_identity is the single pure derivation owner for Proposal Modeling, Research, frontier Planning, PlanMind, and Admitted Model Direction request identities. Runtime plus immutable admitted cause determine identity. Coordinator thread and timestamps are provenance only.
• Coordinator launch cannot restore a superseded request thread into canonical state. The current admitted thread owns transport; the request's creation thread remains inspectable provenance.
• ImmutableGithubSource is the single parser, validator, canonicalizer, and renderer for immutable public GitHub identities. Modeling selection, Eyes execution, and Mind receipt authentication use the same type.
• Mind now independently rejects a malformed but internally self-consistent public-source receipt. Provider validation is no longer trusted as a substitute for admission validation.
• runtime_worker_attempt owns the complete typed request-family association and process-status classification for one launch/process/result/archive family.
• Self decides Research launch currency from the exact current causal frontier; a stale terminal Research role projection cannot suppress new Eyes work.
• The typed RepoFrontierResearchRequest owns the exact allowed public-source set. One launch-to-request derivation is shared by Self coverage, Research acceptance, and final Mind revalidation. Capability grants, prompts, and locally inspected files are not substitutes for exact requested receipts.
• RepoFrontierResearchLifecycle owns the exact current Research continuation. Resident Self, coordinator policy, and status consume its typed Launch/Review action. A completed superseded role lane is display history, not a launch suppressor or compensating repair path.
• Worker reaping consumes the full ProcessInstanceIdentity, not a PID. The kernel wait occurs only after that exact incarnation is observed exited. A historical claim cannot reap a reused coordinator child.

Core passes 687 active tests with one intentional ignored cross-process helper. The packaged no-grant execution gate passed under --network none with byte-identical state and no receipt. Exact packaged f90f1186, release sha256-0e41c9106eb0e37a9cf3e7a4b67671d494b880b7e71fec65336a8c3e7e1129b4, witness sha256-a310c72292a44f950ce7b0ab469779d02e6edd1068670fe37f990f7d82846ee4, then completed two copied immutable-public-source Research/Mind acceptance cycles. Public tool receipts advanced from 53 to 61, Hands stayed false, and both daemons stopped braked with exit zero.

The preceding 08383c6d run is retained as falsification evidence: it proved the typed Research lifecycle cut, then died with ECHILD because PID-only reaping let a historical worker claim steal a reused coordinator child's wait status. f90f1186 removes the PID-only API and survived the same process turnover.

Authority map

• Owner: causal work identity owns deterministic request identity.

• Inputs: runtime identity plus the immutable proposal, admitted model/frontier, accepted result, candidate digest, or admission receipt appropriate to the explicit request family.

• Outputs: deterministic typed request IDs.

• Derived state: creation thread and timestamps are provenance; job, process, grant, model execution, and tool IDs own attempts beneath the request.

• Forbidden writers: current coordinator thread, resident projection, launch callback, retry loop, and worker output cannot fork or repair request identity.

• Shared paths: direct and resident launches consume the same derived identity; current admitted thread carries the launch without rewriting request provenance.

• Cut line: family-local hash formulas, current-thread selection gates, and downstream thread-restoration behavior are removed or demoted.

• Owner: immutable public-source identity owns GitHub identity grammar and canonical rendering.

• Inputs: owner, repository, exact 40-hex commit, and bounded repository path.

• Outputs: canonical lowercase revision, repository ref, and source ref.

• Derived state: provider URL and receipt display fields.

• Forbidden writers: tool output and mutually consistent JSON strings cannot define source identity.

• Shared paths: Modeling, Eyes, and Mind call the same typed owner.

• Cut line: the runtime composite parser and provider-local validators are gone.

Deliberately separate lifecycle authorities

Do not collapse these into one enum or service:

• Heartbeat schedules and consumes acknowledgements.
• Resident Self owns grants, leases, cooldown, cancellation, and requeue.
• Coordinator owns one process incarnation and its terminal receipt.
• Runtime worker attempt owns launch, exact process claim, result, and archive.
• Mind decides adoption; fulfillment is evidence, not admission.

The narrow runtime_worker_attempt module now owns the serialized process-status vocabulary, live/fulfilled/failed/retry classification, and the complete set of typed request families carried by one launch. Runtime, resident, and coordinator consumers call those predicates and accessors instead of maintaining local string sets and parallel family arrays. Persisted documents and transactions are unchanged; the lifecycle authorities above remain separate.

Model Atlas rollout gates

1. Run isolated Epiphany, Odin, and Eve stores with impact ingress absent. Seed the local facts through ordinary Modeling, then run publishers/projector to establish signed publications, watermarks, rejection telemetry, and the canonical Eve tree. Engage all three Atlas brakes, rerun the publisher, projector, and first ingress cycles, and prove held writes/scheduling plus visibly stale read-only retained state.
2. Release only Atlas Modeling/Soul wake scopes. Change the temporary Eve contract and prove Odin Modeling then Epiphany Modeling wake without an operator Continue; Hands remains under its existing gate.
3. Put the organs under the daemon supervisor and sustain the three-repository pilot with lag, watermarks, cycles, rejections, and pending impacts visible through CultMesh/Eve.
4. Register topology and recovery runbooks in gamecult-ops only after the sustained proof. Keep Yggdrasil and the public Verse outside V1.

Immediate next action

Complete the persisted thread-state hard deletion described in the campaign plan. Exact 79346523 replaces the aggregate role prompt with a sealed v2 role projection assembled from the exact keyed Mind and RepoModel documents it names; the final native/provider request renders that projection, and baseline Modeling admission writes its Body-work decision receipt in the same Mind CAS as any graph mutation. Exact 2eb95df6 admits Body observations into keyed Mind before they can steer that projection. Exact e42788c9 lands the shared pure EpiphanyCurrentWorkProjection and moves status consumption of Hands readiness, Eyes continuation, proposal Modeling, and planning stage onto it. Baseline Body work is visible there. Exact 9f7b164f adds its atomic thread-free launch owner: one exact Body strong read commits the runtime job/request/event, family launch binding, and read-only Substrate Gate grant without a thread-state write. Exact 587c56d2 routes status and operator baseline Modeling through that owner while preserving distinct proposal/repair/verdict families. Exact 478fb923 completes the reference lifecycle: Resident Self derives exact Body pressure from the same current-work projection, coordinator receipts retain the exact runtime job, Launch/Wait/Review never consult a role lane, and operator/Resident acceptance share one accept_body_modeling_result MindMutation owner. The legacy aggregate acceptance branch delegates this exact family to that owner rather than retaining a second semantic opinion.

Exact d1b031cb applies the same doctrine to Proposal Modeling without making a generic registry. The immutable proposal request, exact family launch binding, runtime attempt/result, and Modeling.proposal_frontier commit derive Launch, Wait, Review, and completion. Proposal intake no longer requires a current thread; thread ID is pass provenance only. Operator, status, and Resident use that projection, while accept_proposal_modeling_result alone owns semantic admission. The aggregate coordinator launcher now refuses proposal cargo; its proposal selector, validator, context builder, and generic-launch hint are deleted. A shared exact-envelope launch CAS remains because it protects the same atomic publication invariant for Body and Proposal, not because it owns family policy.

Exact e404c105 removed the duplicate Body/Proposal continuation enums; exact fc5d1a4a names the shared vocabulary EpiphanyAgentPassContinuationAction. It names Launch, Wait, and Review; each family retains its own request, projection, validity rules, and admission owner.

Exact 20dd66c8 deletes claim-repair's request/binding/context schemas, runtime carriers, coordinator launch branch, reasoning projection, result cargo, exports, and OpenAI lowering. The Eyes claim-challenge fact remains because it still blocks unsafe planning. No Rust/TOML production symbol for the dormant family survives. During verification, the concurrent Proposal launch test exposed two-snapshot attempt derivation; Body and Proposal launchers now revalidate launchability and ordinal from the exact cache snapshot used by the CAS. Proposal convergence passes 20/20 stress iterations.

Exact d367e525 migrates frontier-verdict Modeling onto one atomic typed chain. Verification acceptance commits the exact Soul verdict and its deterministic Modeling request together. EpiphanyCurrentWorkProjection, operator/status, Resident pressure, deterministic attempt identity, sealed role projection, and accept_frontier_verdict_modeling_result carry that request through Launch/Wait/Review and Modeling.frontier_verdict admission. The request seals the exact routed frontier version. A disjoint keyed node commit after basis sealing merges; a changed frontier refuses with the store byte-identical, so model output is never silently rebased. Accepted Eyes state is display/audit input only and cannot manufacture Modeling work. The aggregate telemetry prompt, accepted-at Research boundary, latest Verification selector, parallel authority MessagePack, and generic role-lane review path are gone for this family.

Exact c7412998 migrates frontier Research onto its v3 request, exact frontier/dependency document closure, deterministic attempt, sealed reasoning basis and decision context, request-bound EyesEvidencePacket, and Eyes.frontier_research Mind commit. The complete RepoModel projection is immutable audit cargo, not one global conflict head. A result may terminalize after its strong frontier changes so the decision remains auditable; admission then refuses byte-identically instead of rebasing the output. Disjoint keyed writes still merge. Research evidence, observations, and optional checkpoints are separate Mind documents, and accepted Eyes does not implicitly create Modeling work. The generic coordinator launch/acceptance and Self lane/timestamp paths now refuse or ignore Research authority.

The same pass exposed compact positional MessagePack as unsafe for nested structs with omitted middle optionals. CultCache exact ba6a487 adds named nested preparation; Mind envelopes retain their typed numeric slots while nested document fields remain named. Objective, Body, and Research Mind writers now share that boundary.

Exact fc5d1a4a completes that Verification cut. The exact Hands commit and derived RepoFrontierVerificationRequest publish atomically; current-work owns Launch/Wait/Review; the sealed role projection carries the exact route, frontier, Hands authority and receipts; and Soul.verification admission writes the keyed audit, Soul verdict, deterministic frontier-Modeling request, and Mind commit receipt in one transaction. A disjoint keyed node commit merges, an exact-frontier change refuses byte-identically, and replay returns the original receipt. Generic Verification launch/acceptance, accepted-at/latest selection, dynamic telemetry prompt mutation, and model-authored causal IDs are gone.

Map and migrate frontier Planning and PlanMind next onto their exact frontier, candidate, decision-context, and keyed Mind authorities. Continue with reorientation, then delete the aggregate schema/transaction. Run the source guards and fresh-store concurrency/decision-context suite. Only after that may Model Atlas Gate 1 restart from a new external root. Keep the current fresh and partial roots read-only; do not release scheduling, register operational topology, touch the original c011 volumes, or build on Yggdrasil.