Epiphany/notes/fresh-workspace-handoff.md

Fresh workspace handoff

Updated: 2026-08-16

Current state

The Persona projection membrane now consumes Ghostlight's generalized ghostlight-persona-projection crate pinned to Ghostlight commit 51fc7495. The live executor projects transcript and typed Persona context before Persona cognition; Persona receives one lived stream only. Epiphany still owns typed effects, receipts, Mind admission, brakes, external consequence gates, and terminal commit. Focused core and OpenAI-runtime Persona suites pass.

The five-day shakedown remains paused. The active source is exact 2ba6b9dc on codex/epiphany-shakedown-live: the keyed Mind hard cut, federated Model Atlas vertical slice, ordinary Modeling authoring path, durable publisher identity, fresh seven-organ Mind bootstrap, and atomic RepoModel projection bootstrap are landed. Historical aggregate RepoModel and partial Gate stores are evidence only. No production model output, registry, command, admission path, projector, or repair path can restore their authority.

This is not yet the full Concurrent Mind cut. Persisted EpiphanyThreadStateEntry, its coordinator transaction, and multiple launch/acceptance/status readers remain live production authorities. Fresh Gate preflight proved the consequence: both keyed semantic partitions reached ready, but status still called the organism missing because no thread aggregate existed. Model Atlas Gate 1 is therefore paused behind that deletion, not merely behind another operational retry.

The Atlas keeps the federation sharp. A provider Mind owns an offer. A consumer Mind owns a claim. Soul owns verification evidence for exact endpoint versions. Signed per-repository publishers carry those facts through Odin, a deterministic projector derives compatibility, cycles, freshness, and blast radius, Eve lowers one retained tree, and each consumer Self decides whether a local impact wakes Modeling or Soul. Nobody owns a shared edge. Atlas never grants Hands authority and no organ opens a foreign repository Mind store.

Epiphany exact 4c0cbd57 contains the typed contracts, per-family CAS planners, signing and trust, immutable publication stores, publisher/projector/ingress daemons, brake scopes, Resident Self scheduling, and three-repository smoke. Exact f60db0a2 closes the production authoring/evidence seam: ordinary Modeling emits semantic offer/claim transitions only; runtime proposal v2 binds the exact request, result, evidence set, and current Body basis; the planner resolves authenticated manifest digests and opaque IDs; and the publisher refuses drifted Body evidence. The projection and Eve tree carry endpoint labels/contracts/lifecycle/Body evidence, exact current Soul evidence, publisher age/watermarks, cycles, and blast radius. Odin exact d34cb7e persists and serves the publication, projection, and canonical Eve schema IDs without dependency semantics. Eve exact b597dab and 076d212 provide the canonical Atlas provider advertisement and one gamecult.eve.surface.v1 retained tree for GUI and TUI.

Verification is green: Epiphany core 555/555, OpenAI runtime 23/23, coordinator 18/18, and workspace all-target check; Odin Node 1/1 and Rust 15/15; Eve Atlas conformance 4/4 and Eve contracts 6/6. The workspace-wide all-features check still reaches an older feature-gated workspace-coverage recovery smoke whose already-absent API predates this slice; no compatibility shim was added.

These are implementation and isolated proof claims. They are not sustained Starfire dogfood. Gate 1 is the next rite: use separate real stores and identities; keep impact ingress absent while ordinary Modeling seeds facts and publishers/projector establish signed sight; then engage all three Atlas brakes and prove later organ cycles are held while the last Eve projection remains visibly stale/read-only and no lane wakes.

Gate 1 preflight exposed and cut one publisher lifecycle defect before live evidence was admitted. The publisher now enrolls its private signing identity only when absent, reopens that exact identity on later heartbeats, and exports one idempotent public trust anchor to a separate operator-readable store. This keeps identity rotation impossible by retry and gives the projector a real public anchor to pin without reading private state. The focused identity reopen/export test passes; the operational gate remains in progress and is not yet accepted.

The first fresh Eve bootstrap then falsified a second missing owner: repository Body bootstrap called the legacy agent-memory admission gate against an empty store, which correctly refused because no canonical organ rows existed. Fresh bootstrap now initializes the immutable swarm identity and all seven typed organ-memory rows before admitting generation one through the shared witness primitive. Legacy admission remains migration-only. The nine focused agent-memory tests pass, including exact fresh replay. The refused partial Eve root is retained in the Gate 1 artifact directory; the operational retry must use a new state root.

The next fresh three-repository bootstrap falsified a third missing owner. The keyed RepoModel seed committed, but bootstrap did not emit the Modeling semantic-projection obligation that readiness requires. Exact d11e6511 derives that obligation from the exact keyed seed envelopes and commits it as a derived runtime companion in the same batch CAS as seed provenance, keyed Mind documents, and the Mind commit receipt. It is not a Mind document and cannot be repaired by status or a projector. Replay validates the existing companion; the focused seed/replay test passes. The three partial stores without this companion remain read-only evidence. Resume Gate 1 only from a fresh state root.

Exact 2ba6b9dc closes the next preflight defect. The semantic projector body owned two canonical stores but enumerated only agent-memory Mind; it now loads and validates both Mind and Modeling inputs on every pulse while allowing one faulty source to remain visible without hiding the other. CultMesh semantic health also distinguishes terminal-ready from query-eligible, so a successful empty partition no longer degrades the provider. On the fresh root, Eve, Odin, and Epiphany each executed Modeling once, then settled idle with two inspected sources and zero source, retention, or health faults.

The following production status read falsified the remaining campaign premise: EpiphanyThreadStateEntry still owns coordinator presence/routing. Canonical docs previously described the keyed foundation too broadly. The hard cut is now the immediate campaign; Gate 1 cannot resume until production source has no thread aggregate writer or behavioral reader.

Public positioning was synchronized on 2026-08-16 without changing that next rite. docs/positioning.md is the current claim owner: Epiphany is the organizational layer above frontier AI workers; the primary failure is global coherence collapse rather than context-window exhaustion; prompts are bounded projections of governed organizational state; humans retain purpose, judgment, authority, disagreement, exceptions, and acceptance; and GameCult is the forge and longitudinal evidence program for a target federation of one locally owned Epiphany project organism per living project Body. Those organisms collaborate through governed typed surfaces while private Mind and consequence authority remain local. Durable public Persona relationships and visitor-facing surfaces are intended social infrastructure, not deployed capability. The fleet, real three-repository Gate 1, complete Bifrost attribution, sustained autonomous production, visitor experience, and external design-partner pilots remain explicitly gated supervised-alpha targets.

The completed Decision-Auditable Concurrent Mind foundation uses typed, content-addressed reasoning bases that preserve exact source envelopes and a closed projection; terminal decision contexts preserve the exact native request, the provider request derived from it, and every ordered governed tool intent/receipt actually fed to the model. Worker model requests require a sealed basis, and structured role/reorient results plus their generic job result bind the terminal context. Tool-round-limit and repeated-tool-loop failures seal the last request context before worker failure. Model-session archives preserve their basis/context IDs, and fulfilled worker-attempt tombstones preserve and revalidate the exact decision context instead of collapsing it to a digest. Exact-envelope batch CAS merges disjoint Mind documents and explicitly refuses same-identity or changed-strong-read conflicts. All three Persona stages now seal predecessor-bound contexts, the effect and terminal commit atomically, and Persona retention preserves the structured effect, conversation/consequence receipts, terminal receipt, reasoning bases, and decision contexts while removing stage/execution scaffolding. Exact ee3d82c0 binds provider/runtime errors and watchdog timeouts to the exact admitted request held by the running pass, without inventing a persisted latest-request head. Exact 71505941 adds the keyed Mind document family, deterministic EpiphanyMindView, atomic runtime/Mind epoch identity, and a mutation gate that rejects non-Mind envelopes or semantic key drift. The keyed view is now the sole current RepoModel source; it does not read or translate historical aggregate stores.

Exact bd5034cd is the first live authority cut. Operator objective intake now atomically writes one semantic objective document, its immutable typed operator provenance, and one Mind commit receipt. It writes no thread-state aggregate; thread identity is provenance, and replacement refuses without changing store bytes. The commit authority is explicitly model context or operator provenance, so operator decisions do not counterfeit model reasoning. The aggregate-only Modeling acceptance repair writer and commands are deleted; frontier execution inspection/amendment remains under a truthfully named binary.

The keyed RepoModel foundation now gives identity, domain, node, edge, summary, frontier, lifecycle receipt, and per-node unresolved-claim obligations separate CultCache identities. Its deterministic validated view is part of EpiphanyMindView and has no revision/hash head. Documents store canonical named MessagePack behind typed constructors because direct compact nesting let skipped middle fields shift into the wrong schema positions. Mind CAS strong reads are now genuine read fences: CultCache receives byte-identical expected envelopes as required by its physical primitive, while the commit receipt lists only semantic writes. A stale read-only dependency blocks the whole mutation without partial insertion. Full core remains 690 passing with one ignored cross-process helper.

The concrete RepoModel mutation planner now accepts a persisted typed semantic proposal and owns dependency derivation for domains, nodes, edges, summaries, and frontier documents. Node and edge retirement are semantic operations; admission and lifecycle receipts remain runtime-owned. Callers do not supply a strong-read list. One mutation can create a complete domain/node/edge/summary slice in dependency-reversed order, while duplicate semantic identities refuse. A fresh node retirement and a concurrent new frontier target both write the same previously absent obligation identity, so only one can commit.

Exact 8ad16be0 cuts the first aggregate RepoModel bootstrap path. epiphany-repository-body bootstrap now admits an EpiphanyRepoModelSeed as typed operator provenance and atomically writes only keyed RepoModel documents, derived claim obligations, and the generic Mind commit receipt. Identical seed replay is inert; divergent replay and any aggregate RepoModel envelope refuse. The seed contains no revision/hash head. Full core passes 692 tests with one ignored cross-process helper, and the repository-body binary checks cleanly. Exact 18d3783a deletes the old thread-state-to-aggregate bootstrap binary. Exact 120663fa removes aggregate bootstrap/read behavior from launch context: prompt assembly loads EpiphanyRepoModelView, derives a nonpersisted query-only graph projection, and renders only its projection digest. The derived snapshot has no revision/hash authority. All seven launch-context tests and the full core suite pass.

Operational correction: the original c011 resident and Heartbeat containers are not alive; both exited 255 on 2026-08-11. Their named volumes are quiescent and remain untouched. Historical c011 zero-zombie and organ-circuit evidence is still valid, but it is not current liveness. Every copied public-Eyes body is braked and stopped. Yggdrasil remains the public crossing and never builds Epiphany.

Consolidation cut

The shakedown found the same missing invariants in different clothes. The consolidation now gives each repeated invariant one named owner.

• causal_work_identity is the single pure derivation owner for Proposal Modeling, Research, frontier Planning, PlanMind, and Admitted Model Direction request identities. Runtime plus immutable admitted cause determine identity. Coordinator thread and timestamps are provenance only.
• Coordinator launch cannot restore a superseded request thread into canonical state. The current admitted thread owns transport; the request's creation thread remains inspectable provenance.
• ImmutableGithubSource is the single parser, validator, canonicalizer, and renderer for immutable public GitHub identities. Modeling selection, Eyes execution, and Mind receipt authentication use the same type.
• Mind now independently rejects a malformed but internally self-consistent public-source receipt. Provider validation is no longer trusted as a substitute for admission validation.
• runtime_worker_attempt owns the complete typed request-family association and process-status classification for one launch/process/result/archive family.
• Self decides Research launch currency from the exact current causal frontier; a stale terminal Research role projection cannot suppress new Eyes work.
• The typed RepoFrontierResearchRequest owns the exact allowed public-source set. One launch-to-request derivation is shared by Self coverage, Research acceptance, and final Mind revalidation. Capability grants, prompts, and locally inspected files are not substitutes for exact requested receipts.
• RepoFrontierResearchLifecycle owns the exact current Research continuation. Resident Self, coordinator policy, and status consume its typed Launch/Review action. A completed superseded role lane is display history, not a launch suppressor or compensating repair path.
• Worker reaping consumes the full ProcessInstanceIdentity, not a PID. The kernel wait occurs only after that exact incarnation is observed exited. A historical claim cannot reap a reused coordinator child.

Core passes 687 active tests with one intentional ignored cross-process helper. The packaged no-grant execution gate passed under --network none with byte-identical state and no receipt. Exact packaged f90f1186, release sha256-0e41c9106eb0e37a9cf3e7a4b67671d494b880b7e71fec65336a8c3e7e1129b4, witness sha256-a310c72292a44f950ce7b0ab469779d02e6edd1068670fe37f990f7d82846ee4, then completed two copied immutable-public-source Research/Mind acceptance cycles. Public tool receipts advanced from 53 to 61, Hands stayed false, and both daemons stopped braked with exit zero.

The preceding 08383c6d run is retained as falsification evidence: it proved the typed Research lifecycle cut, then died with ECHILD because PID-only reaping let a historical worker claim steal a reused coordinator child's wait status. f90f1186 removes the PID-only API and survived the same process turnover.

Authority map

• Owner: causal work identity owns deterministic request identity.

• Inputs: runtime identity plus the immutable proposal, admitted model/frontier, accepted result, candidate digest, or admission receipt appropriate to the explicit request family.

• Outputs: deterministic typed request IDs.

• Derived state: creation thread and timestamps are provenance; job, process, grant, model execution, and tool IDs own attempts beneath the request.

• Forbidden writers: current coordinator thread, resident projection, launch callback, retry loop, and worker output cannot fork or repair request identity.

• Shared paths: direct and resident launches consume the same derived identity; current admitted thread carries the launch without rewriting request provenance.

• Cut line: family-local hash formulas, current-thread selection gates, and downstream thread-restoration behavior are removed or demoted.

• Owner: immutable public-source identity owns GitHub identity grammar and canonical rendering.

• Inputs: owner, repository, exact 40-hex commit, and bounded repository path.

• Outputs: canonical lowercase revision, repository ref, and source ref.

• Derived state: provider URL and receipt display fields.

• Forbidden writers: tool output and mutually consistent JSON strings cannot define source identity.

• Shared paths: Modeling, Eyes, and Mind call the same typed owner.

• Cut line: the runtime composite parser and provider-local validators are gone.

Deliberately separate lifecycle authorities

Do not collapse these into one enum or service:

• Heartbeat schedules and consumes acknowledgements.
• Resident Self owns grants, leases, cooldown, cancellation, and requeue.
• Coordinator owns one process incarnation and its terminal receipt.
• Runtime worker attempt owns launch, exact process claim, result, and archive.
• Mind decides adoption; fulfillment is evidence, not admission.

The narrow runtime_worker_attempt module now owns the serialized process-status vocabulary, live/fulfilled/failed/retry classification, and the complete set of typed request families carried by one launch. Runtime, resident, and coordinator consumers call those predicates and accessors instead of maintaining local string sets and parallel family arrays. Persisted documents and transactions are unchanged; the lifecycle authorities above remain separate.

Model Atlas rollout gates

1. Run isolated Epiphany, Odin, and Eve stores with impact ingress absent. Seed the local facts through ordinary Modeling, then run publishers/projector to establish signed publications, watermarks, rejection telemetry, and the canonical Eve tree. Engage all three Atlas brakes, rerun the publisher, projector, and first ingress cycles, and prove held writes/scheduling plus visibly stale read-only retained state.
2. Release only Atlas Modeling/Soul wake scopes. Change the temporary Eve contract and prove Odin Modeling then Epiphany Modeling wake without an operator Continue; Hands remains under its existing gate.
3. Put the organs under the daemon supervisor and sustain the three-repository pilot with lag, watermarks, cycles, rejections, and pending impacts visible through CultMesh/Eve.
4. Register topology and recovery runbooks in gamecult-ops only after the sustained proof. Keep Yggdrasil and the public Verse outside V1.

Immediate next action

Complete the persisted thread-state hard deletion described in the campaign plan. The Body-generation Modeling work identity now exists at exact 59292e2f, but do not admit its decision receipt yet: first replace the aggregate-shaped role prompt with one sealed typed projection assembled from the exact keyed Mind versions it cites. Then finish current-work routing, migrate status/coordinator consumers and family acceptance, and delete the aggregate schema/transaction. Run the source guards and fresh-store concurrency/decision-context suite. Only after that may Model Atlas Gate 1 restart from a new external root. Keep the current fresh and partial roots read-only; do not release scheduling, register operational topology, touch the original c011 volumes, or build on Yggdrasil.