Epiphany/state/map.yaml

experiment:
  name: Epiphany
  body: F:\Projects\Epiphany
  purpose: Native, inspectable agent organism with typed state and explicit organ authority.

objective:
  current: Prove every Epiphany organ individually and in live coordination on the shakedown branch before treating the organism as deployment-ready.

architecture:
  body: Repository, runtime, service processes, stores, interfaces, and deployment substrate.
  mind: CultCache-backed typed state admitted through Mind-owned transactions.
  self: Routes pressure and work; does not inherit another organ's authority.
  eyes: Establishes source and observation provenance before change.
  modeling: Maintains the source-grounded RepoModel and Body map.
  imagination: Proposes futures without adopting or executing them.
  hands: Changes the Body only through an admitted action route and scoped gate.
  soul: Verifies consequences and invariants at the layer where failure appears.
  persona: Owns public cognition and speech eligibility.
  continuity: Owns recovery, compaction, sleep, and restart protocol.
  substrate_gate: Owns access grants, not state admission.
  crossings:
    bifrost: Owns governed external transport and its signed receipts.
    idunn: Owns deployment observation and actuation.
    cultmesh: Projects typed state without becoming its owner.
    codex: Retained only for OpenAI-compatible authentication and model transport.

invariants:
  - Mind is the sole durable state-admission authority.
  - Modeling maps the Body; Eyes establishes provenance; Hands acts; Soul verifies; Self routes.
  - Persona speech and external consequences require explicit typed authority and signed receipts.
  - Bifrost owns external transport; Idunn owns deployment actuation; neither may impersonate Epiphany cognition.
  - CultMesh and Eve are projections, never owners of project truth.
  - The canonical swarm brake blocks cognition and consequences while preserving read-only physiology and operator sight.
  - Corrupted Epiphany runtime state is an operator-enginseer intervention surface, not a permission boundary. Repair it proactively from authoritative evidence, preserve immutable evidence, and record exact before/after receipts; this standing repair authority does not bypass typed gates for new external consequences.
  - Evidence and git retain history; this map retains only state that changes future decisions.

current_status:
  summary: Epiphany is a supervised engineering alpha on Starfire, not deployment-ready. Exact b8138a6b active-child SIGTERM and restart, exact 9f369528 deterministic warm packaging, exact c930f505 cross-container ownership, exact ed15f83a resident lifecycle retention, and exact 16c4b19f coordinator receipt and Heartbeat artifact retention are proven. Gamecult-ops 059821f makes journald the sole Yggdrasil supervisor/projector stream-retention owner. The exact 16c4b19f genuine-idle control completed 900 refused pulses with constant state, zero artifacts, flat RSS, and clean direct-PID exits. Exact c77824ef and 61d06140 prove package authentication, typed completion, restart-persistent cooldown, and one-grant-per-Heartbeat-turn issuance; neither proves bounded active endurance because the completed grant became selectable again. The 61d run showed the terminal acknowledgement itself was absent while singleton Self closure state survived. Source now makes each ResidentSelfHeartbeatGrant own its own terminality; acknowledgements remain Heartbeat-facing evidence. Another exact-package replay remains required. Broad session/model/event/tool retention and stable Starfire firewall ownership remain open. Yggdrasil is the small public crossing body, never the release forge.
  latest_phase: Exact 61d06140 packaged as warning-free 24-binary release sha256-07d63fb815aa2298b95f240d856e912ca41ed4dc70ebe17ed559fc29766b4a71 with witness sha256-06cd8373ca37c29e0123298484a67b6346b4b8ec0b8c93cd959237b3d8b7787a. A fresh 7,668-file accepted-idle copy matched with zero hash differences. Its exact typed turn completed, persisted nextEligibleAtMillis=1786308887955, and a zero-exit Self restart slept through the deadline. Heartbeat issued no second grant. After expiry, preparation nevertheless selected the exact completed grant. Typed inspection found no completion acknowledgement and no lifecycle-retention head for that run, while ResidentSelfState retained closure/cooldown and shutdown later wrote a cancellation acknowledgement. Receipts are under .epiphany-run/active-cognition5-61d06140 and the run is rejected. Completion and cancellation now mark the exact ResidentSelfHeartbeatGrant terminal in the same CAS that clears its active lease; pending selection and Heartbeat issuance read grant-owned terminality before the mutable consumed marker. The focused test deletes the acknowledgement and regresses consumed_at_millis, then proves the exact grant remains dead and a later Heartbeat turn may still grant later pressure. Twenty-four resident, eight swarm, and eleven heartbeat-state tests pass; packaging and exact replay of this grant-owned terminal fence are open.
  operational_state:
    local_worktree: coordinator_receipt_retention_packaged_proven
    operator_wireguard: restored
    yggdrasil: canonical_small_public_crossing_body
    starfire: temporary_epiphany_cognition_body
    starfire_runtime_identity: epiphany-starfire
    starfire_swarm_brake: released
    starfire_release: exact_76afdaf0_sha256_30caab9e_published_9b8df0b4_body_active_on_resident_c005
    starfire_repository_body: bound_and_observed
    starfire_verse_topology: bound_to_current_repository_body
    starfire_native_status: supervised_shakedown_active
    bifrost: exact_cb3239aa_f67f5122_native_runtime_active_on_yggdrasil
    bifrost_persona_feedback: ready_on_yggdrasil
    bifrost_feedback_binding: gamecult_aquarium_to_epiphany_starfire
    bifrost_feedback_crossing: authenticated_transport_only
    bifrost_persona_mouth: active_on_yggdrasil_10_77_0_1_17876
    starfire_persona_permit: authenticated_prior_release_pid_19024_10_77_0_2_17877
    persona_first_live_consequence: signed_failed_expired_without_repost
    persona_second_live_consequence: signed_unknown_unreceipted_bridge_refusal_without_repost
    persona_permit_probe: unique_node_rust_node_request_completed
    persona_fresh_consequence: blocked_by_absent_yggdrasil_discord_credential
    yggdrasil_epiphany_services: absent
    yggdrasil_live_capacity_2026_08_08: 2_vcpu_1_9_gib_ram_2_gib_swap_516_mib_swap_used_14_gib_disk_free
    yggdrasil_linux_physiology_smoke: exact_b5140288_runtime_spine_sha256_14143382_passed_and_removed
    starfire_linux_model_cognition: exact_a0d56f94_model_runtime_sha256_c72f33ed_two_turns_passed_20_mib_peak_rss
    starfire_linux_resident_coordination: exact_c0055772_heartbeat_self_plan_coordinator_passed
    starfire_linux_resident_peak: 62590976_bytes_self_plus_coordinator_plus_model_worker
    starfire_linux_role_cognition: eyes_and_modeling_tools_results_and_acceptance_proven_zero_consequence
    starfire_linux_modeling_peak: 109887488_bytes_resident_body_plus_modeling_circuit
    yggdrasil_epiphany_service_contract: repaired_in_gamecult_ops_812b427_not_installed
    resident_physiology: authenticated_9b8df0b4_c005_bound_to_eyes_tools_nervous_system_with_217dd_and_bd96305e_helpers_running
  unresolved_authority: Coordinator receipt, Heartbeat pulse-artifact, deployed supervisor/projector log retention, genuine-idle resource plateau, one exact live typed-fulfillment closure, restart-persistent cooldown refusal, and schedule/action issuance cardinality are accepted. The c778 and 61d endurance bodies are rejected because preparation relaunched their exact completed grant after restart. Grant-owned terminality is tested source only. Broader semantic/runtime histories remain unbounded pending a typed archived-session owner. Repository Body observation still performs two authenticated full-tree Git index/manifest passes. Execute-mode workers require a persistent process body. Keyed storage has not earned live migration. One Discord consequence remains blocked by the absent Yggdrasil credential.
  next_action: Commit and push exact-grant-owned terminality, package and authenticate the exact source, then replay from a fresh accepted-idle copy. Require restart and cooldown expiry to leave the completed grant permanently unselectable even with its acknowledgement absent and consumed marker regressed; later pressure may launch only from a new grant owned by a different Heartbeat schedule/action. Prove bounded plateau/retention, clean direct-PID exits, and zero external consequence. Preserve active c005. Do not compact session/model/event/tool history until typed archived-session ownership exists.

active_subgoals:
  - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually.
  - Prove a live coordinated path from source gathering through the Hands gate and post-action verification.
  - Bound artifact retention and prove supervised restart, crash recovery, session closure, and long-duration resource behavior.
  - Keep cognition and release builds on Starfire until measured runtime demand supports a deliberate Yggdrasil size.

organ_readiness:
  persona: partial; cross-host request/receipt/permit organs, distinct identities, exact release admission, unique permit completion, signed failure/unknown receipts, and no-repost behavior are live. Exact Bifrost cb3239aa fixes positional permit bodies and binds the Discord bridge command receipt to the signed request. A completed public consequence remains unproven because Yggdrasil has no Discord bot credential.
  self: partial; proposal recovery, Mind admission, current-model Hands routing, Soul lifecycle precedence, verdict incorporation, proposal preemption, challenge-aware Eyes routing, in-process status ownership, and causal Research/Soul-to-Modeling routing are live. Broader autonomous frontier turnover remains open.
  eyes: proven for one bounded Windows challenged-claim circuit and one coordinated Linux resident circuit. Linux Eyes job eaf25324 invoked exactly three governed native read-only source tools, completed a typed role result, and was accepted as evidence ev-research-856fb6d1 with no external consequence. Broader source coverage remains open.
  modeling: proven for the current bounded Windows circuit and the causal Linux resident Eyes-to-Modeling route. Modeling job 3333e537 invoked three governed read-only tool rounds, completed typed result result-worker-3333e537, and was accepted as ev-modeling-11da531d. Modeling acceptance is newer than Research and modelingResultAcceptedAfterResearch is true, proving the single-use causal route was consumed. Broader Body-map coverage remains open.
  imagination: proven for three bounded live circuits. The resident Linux chain completed native job f62738f1 and produced one typed candidate for the smallest coordinated cognition proof; Self committed a dedicated Mind request without adopting it or granting Hands. Broader option generation remains open.
  hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind reviewed path ceilings to exact changed-path subsets.
  soul: proven for the current bounded route-chain consequence; exact d3bfbda0 launched Verification through typed plan-decision provenance, result f23fe2b6 was accepted at revision 57, and Self then derived Modeling before any repeated Hands authority.
  mind: proven for launch-owned resident frontier adjudication; two historical attempts failed closed, exact bd96305e derived immutable identity from authenticated launch, authorized retry 2d2a3e8b completed, and Self atomically committed terminal adopt decision e7d7f3c7. Broader memory retention and long-duration behavior remain open.
  continuity: partial; authenticated 55660d78 terminalized the copied v28 dead worker once and refused duplicate restart, while sealed v28 remained unchanged. Exact 100d8854 closes only all-terminal sessions, emits one deterministic event, and refuses post-close jobs. Exact 42bc665a proves bounded retention and restart sequence recovery. A digest-pinned Linux runtime-spine at b5140288 repeated closure invariants on Yggdrasil. Authenticated c005 proves typed resident state survives hard exit, executable-body replacement, runtime-topology correction, and restart while preserving awaitFrontierProposal. Exact b8138a6b proves active-child and idle SIGTERM closure with exit zero and final braked state. Exact c930f505 proves cross-container resident ownership refusal without state mutation while Heartbeat retains its distinct typed lock. Exact ed15f83a packages resident lifecycle retention. Exact 16c4b19f packages coordinator receipt retention: 21 old receipts retired into revision-1 digest sha256:63587221d745315af81c705824d16313d2f748b6ff9840a2b4152127a6758fbd, the newest plus an old receipt named by resident state/pending acknowledgement survived, 720 unrelated runtime envelopes retained digest sha256:c21a12653ce1bf0e64342c6fcbf98d006aeb8fa707de69527886db20e4c20e1c, resident authority counts did not change, and replay did not advance the head or create work. Broader runtime/log retention and the long-duration plateau remain open.
  nervous_system: partial; detached scheduling, runtime jobs, typed feedback, ordinary Windows coverage-store identity, and operator projection work. Exact c0055772 proves Linux heartbeat acknowledgement/regrant, Self single-consumption launch, authenticated plan coordinator completion, and a persistent resident body. It also proves detached model workers cannot survive a one-shot container PID 1 exit. The accepted Linux Eyes-to-Modeling circuit proves detached role workers, native read-only tool loops, typed admission, and causal next-organ routing at a measured 109887488-byte peak. Modeling job commit spent 160183ms in two cold Repository Body scans. A source cut now reuses one private index across both equality scans; 25 focused observer tests pass and a live-worktree mechanism benchmark reduced the pair from 3832ms to 1537ms. Packaged coordinator timing remains open. Authenticated d910158f isolates Self policy behind one root-graph optional coordinator feature; warm policy invalidation is 6.02s. Root Linux packaging is 12m33s cold and 9.08s warm with persistent caches. Long-duration pressure and resource plateau remain open. Yggdrasil is not a release forge at its current memory budget.

forbidden_actions:
  - Do not issue a speculative deployment grant.
  - Do not reboot Yggdrasil as part of diagnosis.
  - Do not build the complete governed stack on constrained Yggdrasil until its disk and memory budget has been deliberately increased.
  - Do not treat stored status, process liveness, or an old receipt as current authority.

memory_policy:
  canonical_map: state/map.yaml
  live_handoff: notes/fresh-workspace-handoff.md
  durable_evidence: state/ledgers.msgpack
  historical_provenance: Git history and archived notes
  rule: If a fact does not constrain a current decision or explain a live invariant, it does not belong in the active Mind.