Epiphany/notes/perfect-machine-audit-roadmap.md

Perfect Machine audit roadmap

Updated: 2026-08-11

Objective

Prove every Epiphany faculty both at its own authority boundary and in live coordination before treating the organism as deployment-ready. Tests prove only the seam they observe. Packaged Linux bodies, copied-state falsification, and actual c006 behavior are the live gates.

Current body

• Source branch: codex/epiphany-shakedown-live.
• Accepted runtime implementation: exact c9a2a979.
• Linux release: sha256-78b09d7c32867c71d593951f328a191b7261600a1d9e81d7fdcd35ce7414f218.
• Witness: sha256-ddf32da018f5a53eb87f3ed5b87ccfa57616203970d6fdab9641ee1ac8f71f24.
• Actual c006: Heartbeat and resident Self alive in distinct containers, cognitive brake engaged, resident revision 34, readiness active with no reasons.
• Build body: Starfire. Yggdrasil is the small public crossing and never builds this graph.

Live authority matrix

Faculty	Owner	Accepted proof	Remaining live gate
Self	resident Self state machine	single-consumption Heartbeat grants, typed fulfillment, exact recovery/requeue, cooldown and brake behavior; actual c006 completed two receipt-bound causal grants after its retained proposal-Modeling grant	autonomous turnover from a genuinely new typed frontier; current awaitFrontierProposal is correctly idle
Substrate Gate	substrate_gate	scoped read/mutation grants on Eyes and Hands paths	audit remaining utility and compatibility actuators for bypasses
Eyes	Eyes gateway and authenticated source tools	challenged-claim Windows circuit and governed Linux tool circuit accepted into Mind	one broader foreign/public Verse evidence adoption path
Modeling	runtime-owned typed Modeling contracts	causal Eyes-to-Modeling acceptance, direct proposal Modeling, archived fulfillment	broader Body-map coverage across a changing live repository
Imagination	typed proposal/consideration producers	proposal-only candidates, exact fulfillment, no Hands adoption leak	native multi-option autonomous turnover beyond bounded fixtures
Hands	Hands gateway	bounded patch, command, commit, push, and changed-path receipts	audit non-repo-work actuators for direct consequence paths
Soul	Soul gateway	consequence-bound verdict, causal Modeling route, retention and replay	collapse remaining verifier-specific broad projections into narrow receipt reads
Mind	canonical transactions and specialized admission	atomic RepoModel admission, launch-owned adjudication, semantic/runtime retention	audit remaining state families for legacy writers and run longer memory behavior
Persona	Persona turn, speech audit, public mouth	cross-host request/permit/receipt, signed failure and unknown no-repost behavior, conversation retention	one completed public consequence; currently blocked by absent Yggdrasil Discord credential
Continuity	runtime/resident recovery and retention	graceful shutdown, exact process-death recovery, session closure/archive, lifecycle retention, non-resurrection, and latest-body long-duration plateau	later deployed restart supervision
Nervous system	Heartbeat, runtime spine, Idunn, CultMesh	detached scheduling, typed jobs, provider readiness, active/warming transitions across PID namespaces, latest-body 923-pulse plateau, and two consecutive causal grants	continue narrowing whole-Verse reads
Body	Rust binaries, named-volume CultCache stores, model transport	deterministic 24-binary packaging, fast warm replay, named-volume interruption proof	deployment-sized endurance and remaining inspection surfaces

Accepted coordinated circuits

1. Substrate Gate -> Eyes -> Mind evidence admission.
2. Heartbeat -> Self -> coordinator -> runtime worker -> typed fulfillment -> exact resident settlement.
3. Eyes acceptance -> causal Modeling launch -> Modeling acceptance -> route consumption.
4. Imagination proposal -> Modeling -> Mind admission -> new direction pressure, without accidental Hands authority.
5. Hands consequence -> Soul verdict -> Modeling update -> Mind transaction.
6. Process death -> Continuity recovery -> canonical requeue or fulfilled settlement -> archive/retention without resurrection.
7. Persona feedback crossing -> bounded consideration -> speech audit -> signed permit/refusal/no-repost boundary.

Accepted latest-body endurance

Actual c006 completed the detached latest-body plateau from iteration 572 to 1496. Thirty samples observed a 923-pulse delta with zero authority violations, exact-zero state/workspace growth, Heartbeat RSS 28.63-28.88 MiB, resident RSS 54.11-55.50 MiB, both role owners alive, and final authenticated readiness active under the engaged brake. Receipts: .epiphany-run/c006-endurance-16407f7e.

Exact c9a2a979 then completed two consecutive receipt-bound causal grants on actual c006. The first performed one exact Modeling failure-review supersession; the second refused stale action before consequence and settled on awaitFrontierProposal. Both grants terminalized, resident state returned idle at revision 34, protected consequence families stayed byte-identical, and the cognitive brake was re-engaged. Receipts: .epiphany-run/c006-continuation-c9a2a979.

Completed narrow local Verse consumer audit

Lifecycle and single-target commands read only the state families that own their decisions. Managed-task install/control, generic service-runbook construction, and repo-work service audit read only the canonical brake. Single-daemon restart-policy writing reads exact daemon status. Direct reconciliation reads exact status, exact policy, and brake. Single-target poke-daemon reads exact status, brake, topology-family display metadata, and its exact written intent.

Every surviving production aggregate context read has an aggregate output:

Consumer	Why the aggregate is owned
coordinator launch context	assembles the bounded multi-organ prompt packet
supervisor scheduler tick	enumerates restart policies, daemon statuses, and brake scope
cluster daemon runbook	enumerates topology and matching status rows
seed and query	explicitly emit the complete local Verse projection
receipt directory	joins several receipt families into one operator report
bulk poke and swarm triage	enumerate non-ready daemons and topology
quarantined smokes/tests	falsify the aggregate projection itself without production authority

No remaining single-family decision reads the full context. Do not decompose these legitimate aggregates into ad hoc query piles.

Selected next bounded cut

Run the full affected Rust suites, commit the classified source batch, package one exact Linux release through the persistent Starfire cache, and exercise the narrow loaders against copied state. The live gate is read isolation: adding unrelated hostile or malformed state families must not change policy, reconciliation, or single-target poke decisions. Actual c006 remains braked until the copied gate passes.

Completion standard

The shakedown is complete only when every matrix row has current authoritative evidence, every explicit remaining gate is either proven or recorded as an operator-owned external dependency, the live coordinated circuit survives endurance and restart, and no stale roadmap claim is being mistaken for state.