Epiphany/notes/persona-conversation-authority-map.md

Persona Conversation Authority Map

Objective

Let a human address an Epiphany Persona in Discord, have that pressure enter the resident swarm's own heartbeat physiology, run through the native Projector -> Persona -> Interpreter loop, and return a governed reply to the same conversation without VoidBot owning cognition, scheduling, or Persona state.

Owner

• Bifrost owns Discord transport identity, inbound target admission, actor and guild/channel binding, signatures, and outbound delivery receipts.
• Heartbeat owns durable conversation obligations, CTB opportunity, active-turn exclusion, and completion-gated cooldown.
• Imagination owns the Persona Projector. Persona owns natural speech. Mind's Interpreter owns conversion into typed candidate effects.
• Mind owns durable Persona-state admission. Epiphany owns the signed speech request and its eligibility. Bifrost owns the token-bearing transport worker and alone proves external delivery.

VoidBot is reference lineage and may remain the room moderator. It owns no writer or scheduler in this path.

Inputs

• A Bifrost-observed Discord event addressed to the configured Epiphany Persona.
• Exact guild, channel, message, reply target, actor, target runtime/repository, target Persona, content digest, and visible prompt.
• Current Persona state and semantic recall, recent home-repo activity, raw conversation context, social affordances, and organ dependencies.
• Root-owned model configuration, two dedicated service-identity anchors, and the canonical swarm brake.

Outputs

• One signed Bifrost conversation delivery.
• One immutable Epiphany ingress receipt and one durable pending mention.
• One typed Persona turn request with exact reserved mention cargo.
• Exact Projector, Persona, and Interpreter stage receipts.
• A closed typed Interpreter-effects document.
• Optional admitted Persona self-state mutation.
• Optional signed Epiphany speech request and signed Bifrost Discord receipt.
• One terminal Persona-turn receipt that consumes, retains, or quarantines every mention and starts heartbeat cooldown.

Derived State

• Discord/operator summaries, Aquarium bubbles, schedule JSON, model stream events, semantic recall, and speech previews are sight or cargo. None owns admission, delivery, or mention consumption.
• Qdrant is retrieval evidence, not Persona memory authority.

Forbidden Writers

• VoidBot may not write Epiphany conversation obligations or select Persona turns.
• Resident Self feedback pressure may not impersonate addressed conversation.
• The operator-command path may not become ordinary chat ingress.
• Heartbeat may not delete a mention merely because it selected a turn.
• Model output may not mutate Mind or claim delivery directly.
• The Discord mouth may not synthesize Persona speech.
• Epiphany may not read Discord credentials or invoke a token-bearing bridge.
• An indeterminate or terminally failed external delivery may not return to the schedulable mention queue under a fresh request id.
• Schedule/artifact files may not become the only surviving turn request.

Shared Paths

Direct mentions, role mentions, replies to a Persona message, retries after restart, heartbeat selection, model failures, explicit silence/drop, state mutation, public reply, and delivery reconciliation use the same typed ingress, turn reservation, Interpreter admission, and terminal commit primitives.

Cut Line

1. Replace the Bifrost/VoidBot observation dependency with Bifrost-native Discord ingress and delete literal VoidBot observer authority.
2. Admit each signed delivery once into a durable mention obligation.
3. Atomically reserve mention cargo when heartbeat selects persona_turn; do not consume it before terminal disposition.
4. Execute Projector, Persona, and Interpreter as typed model stages. Interpreter emits a strict schema, not text blocks parsed by rules.
5. Publish one immutable signed Epiphany request into its single-writer crossing store. Let the Bifrost-owned worker publish one signed receipt into the opposite single-writer store; no Discord credential crosses that boundary.
6. Quarantine exact conversational pressure after a signed failed or unknown receipt so automatic scheduling cannot retry an external consequence whose outcome is terminal or indeterminate.
7. Commit terminal outcome, delivery evidence, mention disposition, and heartbeat completion together or through replay-safe exact predecessors.

Verification Layer

The full-path proof observes: duplicate Discord event -> one obligation -> CTB selection -> no private substrate leakage -> natural Persona turn -> typed effects -> exact Mind admission -> Bifrost reply to the source message -> delivery receipt -> terminal mention disposition. Negative proofs cover brake, crash before/after each stage, invalid model output, replay, wrong target, foreign guild/channel, bot/self input, unknown delivery outcome, and service restart.