Epiphany/notes/fresh-workspace-handoff.md

Fresh workspace handoff

Updated: 2026-08-25 Branch: codex/epiphany-shakedown-live Latest deployed non-production Epiphany source: 377be331b9b86d7404a441f0d9a9f62081b86126 Current Connector client/daemon: be1776ab455fd79bd74b393518ab07211dc9c1f0 / 80de3acc18e058f649c3b25ce617f8869f038670 Current pass: the one authorized gpt-5.6-luna comparison failed before its first tool round with an early authenticated socket close. The failed root is sealed; do not grant another attempt without an owner-level cause or verifier gap. Canonical direction lives in state/map.yaml. Production and Atlas Gate 1 remain paused.

Orientation

The five-day shakedown and Model Atlas operational Gate 1 are paused. Do not touch historical c011/proof volumes, reuse partial Gate roots, release autonomous scheduling, register operational topology in gamecult-ops, race Idunn's Yggdrasil CI/CD task with local compiler work, or wake production cognition without explicit operator resumption. Routine isolated capstone preservation, replacement, and cognition are standing physiology.

Epiphany is a supervised engineering alpha. Exact source d2ca6630 remains the production symlink body and is inactive. Historical Ox17 exact 27e1dca1 is sealed failed evidence; it does not authorize Gate 1 or seed the replacement body.

Current live deployment

• Epiphany source: d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4.
• Release: sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06.
• Release witness file SHA-256: 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357.
• Full-workspace test receipt SHA-256: de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482.
• Model provider: OpenRouter stealth/ox-alpha, selected explicitly and injected through the root-owned systemd credential boundary.
• epiphany.service and epiphany-swarm.service are inactive with zero restarts after the hard epoch refusal rollback. The d2ca stores and swarm brake remain historical production state; no newer package is admitted there.
• Historical Ox17 container c50a1a83118d ran immutable image sha256:12bc9a30ad455db2709c0b0749bde84e1c763c5cd36d1ea158112fdaa1deed9c from exact Epiphany 27e1dca1. Its state/work volumes and receipts are checksum-sealed read-only under /srv/epiphany/capstones/failures/20260825-c50a1a83118d-f4697376-caff-4b38-a331-24e31f334d8b; the container and volumes are deleted.
• Exited container 920c23d1a63159c2a2b293c4ff58476b283f2cc34eef1b38f0559e8bcfa9b400 runs immutable image sha256:af748394b5098f85a4d4571243e0f0937f3e9126f9ab5bec33ae0c89983981c0 from exact Epiphany 377be331b9b86d7404a441f0d9a9f62081b86126. Its failed roots have no continuation authority.
• Connector client be1776ab455fd79bd74b393518ab07211dc9c1f0 talks to daemon 80de3acc18e058f649c3b25ce617f8869f038670 as epiphany-model-runtime over the direct UFW-bounded container gateway. The root-owned credential is group-readable and mounted read-only; the guest proxy is deleted.
• Idunn exact 7e31921c4b53563d7a7f10e756d0dd1458fe7688 owns the isolated lifecycle. Deployed gamecult-ops policy exact 36892263864351b9bcf946e67f0edddc2d9e4ec0 admits both Epiphany and Ghostlight callers separately to gpt-5.6-luna.
• gamecult-ops b47f9084 removes Docker from Epiphany's future Idunn compile/package actuator. Native Rust 1.95.0 is installed under epiphany-builder; current source-change builds are native.
• Ox9 and Ox10 ran only in isolated fresh capstone roots. Neither is acceptance: Ox9 exposed coordinator-receipt resurrection; Ox10 exposed Body retry starvation after strict malformed-output refusal. No public consequence was emitted.

What just landed

Exact cf9fb445 repairs the duplicate terminal-failure write: a sealed provider failure now returns as the one worker outcome instead of falling through to a second generic failure identity. Exact 1e57bfac aligns both Epiphany Connector dependencies on the unicast-capable client. Exact 377be331 preserves the bounded Connector error source chain. Ops exact 0c48dd35 grants the acting UID read access through the credential's host group, and exact 5393a390 deletes the fragile guest proxy in favor of the direct UFW-bounded gateway route.

Three fresh gpt-5.4 roots then completed 6, 6, and 4 coherent authenticated provider/tool cycles. They terminated with provider SSE timeout, Connector I/O failure, and provider SSE timeout. Each produced exactly one typed terminal failure, with no Mind admission, Hands mutation, or public speech. The third body is sealed under /srv/epiphany/capstones/failures/20260825T123821Z-manual:redeploy:yggdrasil-epiphany-capstone-17:manual:redeploy:yggdrasil-epiphany-capstone-17:2026-08-25T12:27:14.826Z-877e506f-eacf-42c2-a066-03e0ffaaf6c9. The bridge and UFW aperture are stopped; production units remain inactive.

The authorized Luna comparison retained Epiphany's tool-bearing request shape and changed only the admitted model. Fresh root /var/lib/gamecult/epiphany/luna/runtime/runtime.cc launched Body Modeling job body-modeling-0122c8f7ad5240535f427b8b25e5cfb5aa02ad931d5e39c491fad2a7c3984a36-attempt-0. It failed before any tool round with connector client connection failed: failed to fill whole buffer. The Connector daemon, host bridge, and firewall aperture remained active; CAPSTONE-17.md was absent and there was no Hands mutation or public speech. The exited body is checksum-sealed at /srv/epiphany/capstones/failures/20260825T131038Z-capstone-17-luna-comparison-da62aa1d-a4bc-4e9f-985e-7c6541bcb826. Ghostlight's routine no-tool Luna completions falsify generic daemon nonfunction but do not make its request shape equivalent. Inspect the Connector-owned early close before admitting more inference budget.

Exact ed4ca58c deletes RepoFrontierAdoptedPlan::effective_action and effective_command; the operator projection and Hands consequence validator read the owning public fields directly. The closing audit found no further unearned public function in the five high-risk ownership modules. Every survivor has a production consumer, and the only low-fanout candidate protects resident objective authentication. Source subtraction stops here. The staged diff check passed; no mixed-worktree compilation is claimed. Construct the renamed exact Capstone 17 package and run a fresh isolated capstone next while production and Atlas Gate 1 remain paused.

The former package-only authority gap is closed by the immutable image witness and one-shot Idunn target. The failed root is terminal sealed evidence and no longer exists as a runnable body. Fresh Capstone 17 uses new volumes, request identities, and a reset three-failure budget. Production and Atlas Gate 1 remain paused.

Exact 9f189871 removes the admitted-direction prompt alias from the crate root, makes its renderer and supersession check crate-internal, and makes the Resident Self policy digest and death-completion helper private to their sole owner. The current-work launcher now names the prompt module directly. The cut removes one maintained line net and five false public/root surfaces without changing prompt text, digest inputs, supersession, or recovery. Current work passes 3/3 and Core checks cleanly. Verification generated 1.407 GiB across 2,428 files; cleanup restored the exact authenticated inspector.

Exact e7b66b35 demotes the complete causal-work identity module from the public crate ABI. Proposal Modeling, frontier Research, frontier Planning, PlanMind, frontier-verdict Modeling, and admitted-direction request IDs retain one shared length-framed SHA-256 law and all existing call sites; downstream crates can no longer mistake the construction helpers for a supported API. Seven public exports disappear with zero line, schema, dependency, or target growth. The focused Core library check passes. Verification generated 0.286 GiB across 1,026 files; cleanup restored the exact authenticated inspector.

Exact fca516f5 removes the test-only Resident Self terminal-receipt reader and the path-based RepoModel basis validator, and makes resident-provider document validation/loading private to their owning module. The supersession test now reads the exact typed terminal envelope directly; the Atlas basis test uses the production cache validator after refreshing its snapshot. No terminal-receipt, private-state, duplicate-owner, or complete-basis proof was dropped. The cut removes eight maintained lines net and four false public surfaces. Resident readiness passes 9/9, current work 3/3, the Atlas basis test passes, and Core checks cleanly. Verification generated 1.407 GiB across 2,428 files; cleanup restored the exact authenticated state inspector.

Exact 1a9dec56 collapses five copies of coordinator review physiology into one typed flow: exact result read, operator pause, family admission, event append, and status refresh. A private in-process target selects Research, Verification, proposal Modeling, Body Modeling, or frontier-verdict Modeling from the one current-work snapshot; it owns no state or admission. Each family still calls its exact CAS owner and emits the same event cargo, with Modeling priority unchanged. The cut removes 39 maintained lines net. Coordinator binary tests pass 4/4 without warnings. Verification generated 1.609 GiB across 2,145 files; cleanup restored the exact authenticated state inspector.

Exact d0a317bd deletes the five public one-caller family review-job-ID wrappers. The coordinator now pulls one typed current-work projection for the entire review dispatch and retains the existing Research, Verification, proposal Modeling, Body Modeling, and frontier-verdict Modeling priority. EpiphanyAgentPassAttemptProjection::review_job_id owns the shared rule that only a Review attempt exposes its job identity. No generic registry or admission path was added. The cut removes 33 maintained lines net. Current-work tests pass 3/3 and the release-owned coordinator checks cleanly. Verification generated 1.451 GiB across 2,554 files; cleanup restored the exact authenticated state inspector.

Exact f962c0bc deletes ResidentProviderHealth, authenticate_resident_provider, the dead provider_matches_authority boolean wrapper, and the duplicate predicate test that alone kept the second resident-health decision alive. Production startup still uses derive_resident_cognition_readiness and reports the exact failed authority predicates through provider_is_fresh. The surviving tests cover exact release/process/brake binding, bounded clock skew, CAS, and private-state refusal. The cut removes 204 maintained lines net. Resident readiness passes 9/9 and the release-owned swarm checks cleanly. Verification generated 2.012 GiB across 2,823 files; cleanup restored the exact authenticated state inspector.

Exact e905dcd9 inlines the sole canonical protected-surface list into the default swarm brake and removes its root export. The actual brake document and engage/release/read/write owners remain unchanged, including Model Atlas. The cut removes four maintained lines and one false public API. Both brake lifecycle tests pass. Verification produced 1.23 GiB across 1,888 files; cleanup restored the exact authenticated state inspector.

Exact 1e4fa533 inlines the one-caller packaged-release loader into authentication, makes required-binary enumeration and witness read/write private to construction, and demotes validation/file/digest checks to the parent packaged-release owner. Five unconsumed root exports disappear while package/publish/inspect/authentication remain public. The cut removes seven maintained lines. Packaged-release 15/15 and the release entrypoint pass. Verification produced 1.45 GiB across 2,554 files; cleanup restored the exact authenticated state inspector.

Exact 200732e9 deletes the 1,030-line idunn_provider_health module and eight Core export lines. Its query, candidate verification, monotonic admission store, typed admission family, and six self-tests had no production consumer. The release-owned swarm compiles without it and the real resident-readiness owner passes 11/11. The cut removes 1,038 maintained lines. Verification produced 1.45 GiB across 2,554 files; cleanup restored the exact authenticated state inspector.

Exact fab6a59a deletes the 505-line idunn_runtime_health module and seven Core export lines. Its signer, aggregate calculator, RUDP publisher, two public shapes, and five self-tests had no production caller. Idunn's live signed-health authority is external; Epiphany's swarm uses the separate resident-readiness path. The cut removes 512 maintained lines. Provider-health admission 6/6 and resident-readiness 11/11 pass. Verification produced 1.25 GiB across 1,888 files; cleanup restored the exact authenticated state inspector.

Exact 1e66e770 deletes three public Hands receipt convenience constructors and their too_many_arguments exemption. Their only caller was the current-work lifecycle test, which now uses explicit typed receipt literals. The three receipt writers remain as the real consequence-admission owner over route, intent, Substrate Gate grant, patch, successful command, commit, and exact Verification obligation. The cut removes 59 maintained lines. The complete keyed Modeling/Research/Hands/Verification lifecycle and concurrent Persona/Hands proof passes. Verification produced 1.25 GiB across 1,888 files; cleanup restored the exact authenticated state inspector.

Exact 8086d66f deletes the single-consumer epiphany-release-construction Cargo package. Its pure 1,222-line constructor moves byte-for-byte under Core's existing packaged-release module; fs2 moves with it. One workspace target, manifest, dependency edge, and seventeen stale lockfile lines disappear. The cut removes 39 maintained lines. Core check, packaged-release 15/15, resident-readiness 11/11, and the release entrypoint pass. Verification produced 1.60 GiB across 2,728 files; cleanup restored the exact authenticated state inspector.

Exact dfe3757b retains terminal Reorientation failure disposition inside the one current-work projection. The coordinator no longer reopens the runtime job to choose success or failure admission; each admission owner still validates its exact strong dependencies. Core check, Reorientation 1/1, and the release-owned coordinator compile pass. Verification produced 1.6 GiB across 2,924 files and was removed.

Exact b83c0416 deletes the provider-specific request-input, tool, stream, payload, and receipt mirrors. CodexConnector and OpenRouter now produce the one native model event and receipt family directly. Exact a721b763 then deletes the one-file epiphany-openai-adapter Cargo package and moves pure provider lowering beside the native contracts in epiphany-model-adapter. Together the cuts remove 174 maintained lines and one Cargo package without changing any durable CultCache identity or field order. Model adapter 5/5, decision context 8/8, runtime 21/21, and release model edge 12/12 pass. The two bounded build roots reached 3.9 GiB/5,598 files and 4.7 GiB/6,524 files; both were removed and only the exact authenticated state inspector remains.

The follow-up package audit retains epiphany-openai-runtime. Its single optional library target contains model/Persona orchestration and is enabled only for the two model-backed release binaries. The root release package owns nine production binaries; collapsing the library there would spread its compile graph or feature scaffolding across seven unrelated entrypoints. No source change was justified. The next subtraction audit is the single-consumer epiphany-release-construction package.

Independent repository GameCult/CodexConnector owns the Codex credential and transport authority as one Cargo package with one public daemon binary and no linked Codex crates. Exact 54d8bc2525b7e7fa1b9dd26b95871247ff4c7566 admits distinct authenticated callers, preserves caller-native and exact provider-request digests, passes typed text/tool/usage/failure results, and uses a digest-pinned official codex app-server child only as the private credential writer. The connector performs Responses HTTP/SSE transport itself; the child never sees prompts, tools, model output, or consumer identity.

Replay authority is now keyed CultCache over an owned Redb store rather than a volatile map or whole-file rewrite. The daemon seals Active before provider I/O and replaces it with the exact encrypted Completed response before socket reply. Completed retries survive restart byte-for-byte; a restart-era active identity returns explicit Indeterminate and never re-executes. A non-secret connection-key epoch detects rotation without persisting a secret-derived verifier. Its default feature set is now only the lean encrypted client/contract ABI; the daemon, CultCache, Ureq/Rustls, auth child, and replay owner are behind the daemon feature. Default acceptance passes 10/10 and the daemon feature passes 23/23 plus exact library/binary checks and Clippy. Every disposable connector target was removed completely.

Exact Epiphany ed7357a2 consumes that lean client ABI and deletes the entire epiphany-openai-codex-spine package, every compiled codex-login and codex-client dependency, direct Codex HTTP/SSE, CODEX_HOME, auth.json readiness, and Codex credential creation/argv. Model and Persona workers now pass an explicit loopback connector endpoint, caller runtime identity, and caller-key credential file. Connector receipts retain caller identity, native and provider request digests, transport identity, and cached-token usage in the durable model receipt; runtime/model-receipt epochs advance to v38/v1. OpenRouter remains direct through one Ureq/Rustls terminal-tool path and its separate credential.

The maintained non-lock source shrinks by 857 lines and Cargo.lock shrinks by 4,830 lines. Core passes 150/150, runtime 21/21, pure adapter 5/5, model edge 12/12, Persona 1/1, both launch targets compile, and focused adapter/root-edge Clippy passes. The test runs generated 6.2 GiB and 4.6 GiB in the bounded target; both roots were removed. Only the exact 1,776,640-byte state inspector remains, SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.

Yggdrasil now runs the independent Connector service and Idunn target for Ghostlight. Ghostlight observes its exact receipt but cannot build, select, restart, or roll it back. Epiphany's source client is present; a live Epiphany caller admission and round trip remain open while the selected Epiphany provider edge is OpenRouter.

Exact 07529fb5 deletes epiphany-state-model as a Cargo package. Only epiphany-core consumed it; the semantic Serde contracts now live in a plain Core-owned module. Unused JsonSchema/TypeScript derives, schemars, ts-rs, duplicate memory-graph re-exports, three stale WebSocket patch pins, and 99 lockfile lines are gone. The commit removes 201 maintained lines net and one package without changing serialized contracts or schema epochs. Core checks without warnings; the deterministic keyed-Mind and repository-path proofs pass. Whole-Core Clippy exposes 58 pre-existing lints outside this cut. Verification generated 1.842 GB across 2,718 files; cleanup restored only the exact state inspector.

Exact 2bcbf268 removes coordinator status's parallel scheduling mouth. The same current-work projection now carries the accepted manual-regather obligation to operator status and Resident Self; status no longer assembles Mind separately, and Resident Self no longer injects a counterfeit Continue. The six-state EpiphanyCrrcAction enum and coordinator-input field are gone. The existing decision-auditable Reorientation lifecycle now proves a durable regather decision reaches the user-visible regatherManually action. The cut removes 12 maintained lines net and adds no persisted schema, dependency, target, or process. Core check, current-work 3/3, Reorientation 1/1, operator-sanitization 1/1, and the release-owned coordinator compile pass. The focused build produced 1.6 GiB across 2,924 files; cleanup restored only the exact authenticated state inspector.

Exact 125d77a2 removes the last CRRC surface. Reorientation result review now pulls runtime state once and reads the job plus typed result from that cache. Its live status vocabulary is only Pending, Completed, or Failed. The never-used missing-store branch, six impossible status variants, synthetic backend-state translation, and surfaces/crrc.rs are gone. Store failures are errors; a completed job without its typed result is corruption. The existing Reorientation lifecycle exercises this public projection before Mind admission. The cut removes 64 maintained lines net and adds no schema, dependency, target, or process. Core check, Reorientation 1/1, and the release-owned coordinator compile pass. The focused build produced 1.6 GiB across 2,924 files; cleanup restored only the exact authenticated state inspector.

Exact edb5c3a3 deletes the duplicate pass-family authority from runtime physiology. Eight optional request-ID fields are gone from EpiphanyRuntimeWorkerLaunchRequest and its heartbeat options. The terminal role result no longer repeats those family identities, the Body observation basis, or the frontier route. Live current-work, admission, retry, provider schema selection, and tool setup decode the one sealed typed launch document. After retention deletes that live launch, the archived attempt retains exact request kind/ID beside the full structured decision and decision context.

Terminal success now requires the semantic payload named by the sealed family context; a typed failure requires one nonempty error and may carry no successful semantic cargo. Runtime advances to v39 and the role-result output contract to v5 with no old-store reader. The committed delta is 742 additions and 1,185 deletions: 443 maintained lines removed. Core and OpenAI runtime libraries and the release-owned model binary compile. The complete keyed state-flow test, content-addressed/context substitution tests, transcript-free decision audit, model-failure audit, concurrent disjoint/same-identity CAS proof, old-epoch refusal, and focused proposal/Verification/Planning/consideration/Mind/provider completion tests pass.

Exact cabdd6c3 splits coordinator incarnation authority from generic model sessions. Model sessions now contain only their grouping identity and an active/completed admission latch. Coordinator launch provenance is preserved in an immutable EpiphanyCoordinatorRunBasis; exact completion/failure receipts and process-death recovery compete through one deterministic EpiphanyCoordinatorRunTerminality document, so only one terminal outcome can commit while unrelated document inserts merge. The full typed winning authority remains beside the latch. Objective prose, session clocks, coordinator notes, four unused status variants, the redundant one-field session options wrapper, and the dead whole-snapshot append helper are gone. Runtime advances to v40 without a compatibility reader. Focused Core, model-failure audit, Persona, coordinator terminality/conflict, release coordinator, and release model-runtime checks pass. The code delta removes 62 maintained lines net. The focused checks created 6.3 GiB/7,017 Cargo files; cleanup restored exactly the 1,776,640-byte state inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.

Exact a46725a1 removes timestamp authority from generic runtime jobs. Jobs now carry only identity, session join, role, and a Queued/Completed/Failed admission latch; the unwritten Running, WaitingForReview, and Cancelled states plus both creation/update clocks are gone. Frontier Research derives the exact attempt set and refuses multiple live or successful authorities instead of selecting a latest creation time. Runtime advances to v41. Focused Core, epoch-refusal, model-failure, Persona replay, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 67 maintained lines net. Verification generated 3.2 GiB across 4,498 files; cleanup restored only the authenticated 1,776,640-byte state inspector.

Exact 10a70afc makes the generic runtime job an identity/status latch only. The sealed worker launch owns outer-worker role; the model execution binding owns model-session membership; outer workers belong structurally to the root session. Jobs and generic results lose role/session mirrors, results lose their empty metadata map, and heartbeat launch options lose constant root-session plus unused objective/note cargo. Session closure, retention, and tool admission derive exact joins. Job snapshots refuse multiple terminal results instead of selecting one by completion time. Runtime advances to v42. Keyed lifecycle, model-failure audit, transcript-free binding, tool continuation, Persona replay, coordinator terminality, epoch refusal, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 73 maintained lines net. Verification generated 3.7 GiB across 4,764 files; cleanup restored only the authenticated 1,776,640-byte state inspector.

Exact 53e869c0 removes generic terminal-result evidence and artifact mirrors. Structured role and reorientation outcomes remain their sole typed owners; transport and process-death physiology retain only verdict, terse summary/next move, completion time, and optional decision-context identity. Reorientation failure display no longer manufactures empty generic provenance. Runtime advances to v43. Keyed lifecycle, auditable model failure, epoch refusal, reorientation, typed worker admission, Persona replay, OpenAI runtime, release coordinator, and release model-runtime checks pass. The cut removes 51 maintained lines net. Verification generated 3.654 GiB across 4,759 files; Cargo cleanup restored only the authenticated 1,776,640-byte state inspector.

Exact 8eaa96c5 stops persisting generic job-result documents for structured role/reorientation outcomes. Runtime completion includes the exact structured envelope as a byte-identical strong dependency in the same job/process CAS. Fulfilled worker archives retain decision context plus the full typed role result, without a generic companion; coordinator reorientation success requires the typed reorientation result. Runtime advances to v44 and archived worker attempts to v3. Keyed lifecycle, decision audit, model-failure audit, reorientation, typed role admission, Persona replay, runtime-error/tool-loop failure, release coordinator, and release model-runtime checks pass. The source delta is +7 maintained lines because the exact CAS fence replaces a larger durable duplication. Verification generated 5.632 GiB across 6,826 files; Cargo cleanup restored only the authenticated 1,776,640-byte state inspector.

Exact 2c3335dc deletes the generic runtime job-result family completely: the durable type, completion DTO, result-bearing snapshot wrapper, schema registration, archive/session cargo, audit branch, and every summary/next-move/result-ID projection are gone. Typed role and reorientation outcomes atomically terminalize their own job and process claim. Native model receipts or EpiphanyModelPassFailure own model-pass terminality; the exact worker process claim owns process death. Reorientation failure admission binds the typed model failure directly.

The review caught and removed a split terminality scar before commit. One shared worker-outcome rule now maps success to Completed plus TerminalResult, and a nonempty typed failure to Failed plus TerminalFailure. Failed-attempt archives may retain their full typed failure instead of erasing it as though only successful decisions were structured. Runtime and Mind writable epochs advance to v45 and v11 with no compatibility reader. Core passes 152/152; OpenAI runtime passes 21/21; the release-owned model runtime passes 12/12; coordinator and Persona entrypoints compile. The cut removes 361 maintained lines net. Verification generated 6.349 GiB across 7,376 files; cleanup restored only the exact 1,776,640-byte authenticated state inspector at SHA-256 DD38855C6F092C2C53D2212A938E737643F41130F4681708840BA6075320A04E.

Exact dbb00c2b removes six echo-only fields from the in-memory model-turn summary and deletes the one-field session-closure options wrapper: 38 net lines. The completed session audit retains the live and archived documents for different reasons. The active/completed session latch is the explicit boundary that forbids new model/tool work after a pass with otherwise-terminal jobs is closed. The private archive retains retired session, job, model-request, and tool-intent identities plus the exact deletion-chain digest after their live bindings are deleted, so those identities cannot resurrect. Neither document duplicates a decision or transcript.

Exact 24023265 deletes Verification's live Hands-receipt reread path. The sealed Verification projection already contains the full intent, authority, patch, command, and commit records. The extra MCP tool reopened the mutable runtime store for decision-bearing input already fixed in the basis. Its tool schema, prompt mandate, dispatcher, source-store argument, three public read wrappers and exports, stale Substrate Gate allowlist entry, and one advertisement assertion are gone: 78 net lines. The consequence documents, writers, and atomic commit-to-Verification admission remain. Tool runtime passes 8/8, OpenAI runtime 21/21, the release-owned tool daemon compiles, and the full keyed lifecycle proof still commits concurrent Persona/Hands consequences and creates exact Verification work. Focused verification generated 4.909 GiB over 7,687 files; cleanup restored only the authenticated 1,776,640-byte state tool.

Exact a01c6842 deletes HandsActionReview, which the coordinator created as approved beside its own intent and grant. It had no independent reviewer or refusal producer, so it was paperwork impersonating authority. The adopted route owns the write ceiling, the Substrate Gate grant owns permitted operations and paths, the minimal intent binds the runtime job to that grant, and RepoFrontierHandsAuthority binds the exact route, intent, and grant. Patch, command, and commit receipts cite the intent; their other causal facts derive through that chain. Commit admission now requires exactly one patch and one successful command receipt for the intent instead of selecting a latest receipt by timestamp. Ambiguity refuses. Runtime advances to v46 and the sealed Verification context to v2 with no compatibility reader. The cut removes 381 maintained lines net. Core passes 152/152, the coordinator 4/4, and the OpenAI runtime 21/21. Verification generated 5.8 GiB across 6,583 target files; cleanup again restored only the authenticated state inspector.

Exact a6cf9383 quarantines concrete Codex/OpenRouter authentication, credential reading, and network transport at the two release entrypoints that perform inference. epiphany-openai-runtime now owns only exact native-request lowering, model-execution opening, typed provider-event admission, tool intent emission, terminal physiology, and durable audit. Its normal dependency graph contains no Codex crate. Persona retains its three-stage/replay owner while the concrete runner moves into the Persona service. The worker runtime has one governed tool-capable route; the duplicate no-tools route, DTOs, CLI mode, and coordinator switch are gone. Provider strict-shape proofs now live with the release-owned lowering edge. The cut removes 176 net source lines without a new crate, executable, process, schema, or epoch. Focused runtime, model, Persona, and coordinator checks pass. The pure runtime consequence-test root fell from 12.713 GiB/19,134 files to 1.869 GiB/2,942 files. At that intermediate boundary the release edge still reached 10.473 GiB/16,483 files through codex-login; exact ed7357a2 subsequently deletes that graph. Cleanup restored the exact 1,776,640-byte state inspector. Atlas is untouched; no live inter-swarm collaboration has run.

Exact ce6bff12 makes execution bindings identity edges instead of miniature copies of their owners. A model binding carries only request, session, and job identity; provider, source worker, and reasoning basis are loaded from the exact native model request. A tool binding carries only intent, session, and job identity; model ancestry is loaded from the exact tool intent. Validation, retention, public-source lookup, worker terminality, decision sealing, and tool continuation now follow those owners. Timestamp arguments and copied binding fields are gone. Runtime advances to v37. The focused core, epoch-refusal, transcript-free context, OpenAI continuation, and release-owned tool-runtime proofs pass. The cut removes 67 net source lines. The OpenAI test boundary generated 12.713 GiB across 19,134 files despite running one consequential test; Cargo cleanup restored the one 1.78 MiB state inspector. That dependency fan-out is the next source-shape audit. Atlas is untouched and remains operationally unaccepted: no live inter-swarm collaboration has run.

Exact b3e9b229 makes the Persona social terminal the sole local owner of a delivered speech consequence. The already-verified signed Bifrost receipt is folded directly into its message ID, crossing receipt ID, and exact receipt digest. The standalone PersonaDiscordDeliveryEvidence document, runtime registration/write/read path, and conversation receipt's copied evidence-ID vector are deleted. Retention reloads and cryptographically verifies the durable Bifrost request/receipt pair and matches that exact consequence against the terminal. Runtime advances to v36; social terminal and conversation execution advance to v2 with no compatibility reader. Core compiles, Persona consequence/retention passes 5/5, and the release-owned Persona service compiles. The cut removes 66 net maintained lines. Verification generated 3.1 GiB across 7,791 files; cleanup restored the one 1.78 MB state inspector. Atlas is untouched. No live inter-swarm collaboration has run; component tests do not claim otherwise.

Exact fdefb889 deletes public create_runtime_session and create_runtime_job plus their exports. Every caller was a fixture. Production session/job creation already belongs to family launch CAS, exact model-execution opening, and coordinator opening. OpenAI fixtures now use the real family preparation owner; native-tool tests seed only their prerequisite documents inside the test module rather than buying arbitrary production writers. Tool runtime passes 4/4, model runtime passes 8/8, the changed OpenAI request proof passes 1/1, and all affected production targets check. The cut removes 96 net maintained lines; runtime_spine.rs is 9,347 physical lines with 50 public functions and 25 public structs. Verification generated 11.56 GiB across 17,633 files; cleanup restored the shared target to the single 1.78 MB state inspector. No schema or Atlas path changed.

Exact 83611f9b makes the atomic Eyes.frontier_research Mind commit the sole Research acceptance authority. The never-persisted source-lookup DTO and the duplicate evidence packet are gone. Eyes still authenticates the exact Substrate Gate grant, tool intent/receipt, immutable source identity, and content digest before admission; the structured decision then becomes keyed Mind evidence/observation/checkpoint documents. Initial acceptance and archived re-entry use the same validated commit predicate. Runtime advances to v35. The core library check, full keyed Research lifecycle including conflict/replay and read-only re-entry, and old-epoch refusal pass. The cut removes 205 net maintained lines; runtime_spine.rs is 9,418 physical lines with 52 public functions and 25 public structs. Verification generated 2.0 GiB across 2,950 files; cleanup restored the shared target to the single 1.78 MB state inspector. Atlas and every inter-swarm contract remain untouched and operationally unaccepted.

Exact e60b924f deletes the callerless model-runtime preflight JSON self-certificate and its public registered-type catalog accessor. The command built a fresh empty schema cache and hashed its type-name list; it did not prove the deployed store or package could execute a decision. Actual Mind/runtime epoch admission and Idunn's frozen-package witnesses remain the owners.

Exact 3b991e40 then collapses epiphany-model-runtime onto its three earned commands: admitted run-worker, list-decisions, and audit-decision. Standalone model-turn, tool-followup, and tool-followup-turn, their option and JSON-ingress families, and three tests that animated only that dead ingress are gone. run-worker still owns OpenAI/OpenRouter execution, automatic tool continuation, typed terminal failure, and decision-context sealing. The remaining binary suite passes 8/8 and the exact packaged binary check passes. Together the cuts remove 532 net maintained lines and leave the binary source at 1,493 lines. Verification generated 9.36 GB across 13,992 files; Cargo removed 8.7 GiB and the shared target again contains only the 1.78 MB state inspector. Atlas and all inter-swarm contracts remain untouched.

Exact a4356d1f keeps runtime identity and swarm binding as the explicit writable-root epoch owners, then removes fixed schema-version echoes from thirteen child physiology documents: sessions, jobs, model/tool bindings, archived sessions, launches, process claims, worker archives, role/reorientation and generic job results, coordinator receipts, and coordinator death recovery. Exact lifecycle identity, causal bindings, terminal outcomes, decision contexts, and retention chains remain. Runtime advances to v34; old writable stores still refuse byte-identically. Core, keyed lifecycle, reorientation audit, model-failure audit, transcript-free binding audit, provider mapping, coordinator, swarm, and model-runtime checks pass. The cut removes 122 net maintained lines and leaves runtime_spine.rs at 9,440 lines. Verification generated 10.92 GB across 16,251 files; cleanup restored the shared target to the single 1.78 MB state inspector. Atlas and external crossings are untouched.

Exact 718ce9c1 removes fixed schema-version fields and fixed contract prose from thirteen durable repository-frontier documents spanning Proposal through Planning, PlanMind, Hands, Verification, Soul verdict, Research, and Modeling. CultCache envelopes and runtime epoch v33 own their internal type/schema identity. Semantic IDs, exact source-document versions, strong dependencies, decision contexts, dispositions, evidence, and consequences remain. Sealed worker contexts retain explicit schema and contract fields because those bytes are part of the exact model input. The full keyed lifecycle, old-store refusal, provider candidate mapping, core library, and release-owned coordinator target pass. The cut removes 177 net maintained lines. Focused verification generated 9.61 GB across 12,514 files; cleanup returned the shared target to the single 1.78 MB state inspector. Atlas is untouched. Its first real inter-swarm collaboration run remains required before any narrowing of the crossing.

Exact 952dcd9f keeps the typed human objective assertion and its atomic singleton Mind-objective commit, but removes the fixed schema prose, stored key identity, derived objective digest, and contract text from the intake payload. The public outcome now returns only the current Mind projection digest, exact commit receipt, and changed bit; it no longer exports a full intake or full Mind view that production never consumed. The coordinator-binary test that only replayed the library seed/idempotency/refusal proof is deleted. The library proof now requires byte-identical replay, while the wrapper-specific resident-grant provenance proof remains. Runtime advances to v32. Objective intake, resident provenance, and old-store refusal pass (1/1 each). The cut removes 54 net maintained lines. Initial package cleanup removes 18.5 GiB; the 1.7 MiB state tool is then preserved across cleanup of 961.1 MiB regenerated artifacts. Atlas is untouched.

Exact 6f5d6600 preserves the immutable typed repository-domain receipt while cutting it from nine fields to the two facts it alone owns: the canonical organizational repository name and the exact authenticated Body hash. CultCache owns the envelope type, key, and schema; the authenticated Body route owns runtime, swarm, and workspace. Binding time and fixed contract prose owned no behavior. Bootstrap still authenticates the live Body and atomically strong-reads runtime identity plus Body route; proposal promotion and fulfillment still refuse repository or Body-hash substitution. Runtime advances to v31. The full keyed lifecycle and old-store refusal pass (1/1 each), package cleanup removes 677.2 MiB, and the cut removes 50 net maintained lines. Atlas remains protected: no live inter-swarm collaboration has run, so component tests cannot authorize narrowing its only complete crossing.

Exact d9a196a0 makes RepoFrontierProposalModelingRequest the sole durable owner of autonomous proposal origin. It carries the exact direction-result, option-ordinal, and worker-job identities. The separate binding type, schema constant, runtime registration, third CAS envelope, replay collision branch, and duplicate worker-result/launch hashes are gone. The referenced launch and result remain immutable typed documents and promotion strongly reads them when atomically inserting the proposal/request pair. Runtime advances to v30. The existing full keyed lifecycle passes promotion, concurrent launch, retry ancestry, Modeling admission, concurrent Persona/Hands, and Verification (1/1); epoch refusal passes (1/1). Package cleanup removes 677.6 MiB. The cut removes 53 net maintained lines. Atlas remains untouched and no live inter-swarm collaboration has run.

Exact 65bf044f removes fixed schema-version strings and unread contract prose from Hands patch, command, and commit receipts. CultCache already owns their type/schema identity; exact intent, review, Substrate Gate grant, runtime job, paths or command, consequence summary, time, and immutable envelope remain the admission proof. Fourteen definition-only shadow type constants and one callerless reorient display enum are also gone. Runtime advances to v29 and old writable state refuses. The existing keyed lifecycle proof passes Hands through concurrent Persona admission into exact Verification work (1/1); epoch refusal passes (1/1). Package cleanup removes the generated 678.6 MiB. The cut removes 67 net maintained lines. Model Atlas is untouched: component proofs are not collaboration acceptance, and no live inter-swarm exchange has run.

Exact 695af6c6 removes thirteen Cargo dependency declarations with no consumer in their owning package, the tracked .gitignore that kept the extinct epiphany-openai-auth-spine directory alive, and a production-only unused import. The release bundle no longer directly owns nine libraries used only by leaf crates or not used anywhere in its executable sources; affected leaf/dev manifests drop unused serde_json, futures, pretty_assertions, and a dev-only state-model edge. The lock graph contracts from 757 to 732 packages and the cut removes 284 net manifest, lock, and source lines. All nine production binaries compile individually; release construction and the OpenAI Codex spine compile; core and OpenAI-runtime library test targets compile. Package-scoped cleanup removes 56,581 disposable files and 124.2 GiB from the five packages compiled during verification. The shared target is 108.42 GiB, the prebuilt state tool remains healthy, and no alternate target root was created. Model Atlas is untouched; live inter-swarm collaboration remains unproven.

Exact dbed11b3 and 8bb0719b delete the false hand-maintained CultNet schema registry. The first cut removes the nonexistent runtime-event contract and the obsolete public schema for the private archived-session tombstone. The second removes runtime-local identity, session, job, binding, coordinator, native model/tool, and state-ledger JSON mirrors. Those documents remain typed CultCache state and are discovered from native registration or projected by their owning CultMesh provider; no live CultNet crossing consumed their schema files, and several files contradicted their Rust owners. The catalog now contains only the exact OpenAI-compatible provider request plus the portable Persona and work-organ contracts: 3 rows, 3 files, 0 missing, 0 unindexed, and 0 internal contract references. The cuts remove 850 net maintained lines. No Rust build was activated because runtime source and registrations are unchanged. Model Atlas is untouched; live inter-swarm collaboration remains unproven.

Exact fe118e13 removes the second persisted copy of every provider stream event and terminal receipt. OpenAI/OpenRouter transport values now normalize immediately into the native EpiphanyModelStreamEvent and EpiphanyModelReceipt family used by tool continuation, assistant reconstruction, terminal validation, and runtime retention. The exact provider request remains durable in every decision context. Duplicate runtime writes, registrations, archival validation/deletion, provider schema IDs, two public CultNet schemas/index rows, and the include-only model-runtime shell are gone. Runtime advances to v28 and the public catalog has 18 schemas. The cut removes 270 net maintained lines. Adapter 1/1, provider spine 14/14, reasoning context 8/8, OpenAI runtime 23/23, model entrypoint 11/11, swarm 4/4, epoch refusal 1/1, and release construction 15/15 pass. Model Atlas is untouched; its live inter-swarm collaboration trial remains open.

Exact ffd91c20 removed three fixed or non-causal fields outside Model Atlas. The then-live Eyes evidence packet stopped repeating source_role_id = research; exact 83611f9b later removed that packet family entirely. A Persona mention no longer repeats target_agent_id = epiphany.Persona; the Persona-owned queue and turn request own routing. Resident Self retention no longer accepts a clock only to store an unread retained_at_millis; counts plus the chained deletion digest remain the retention consequence. Persona social mention v2, Resident Self state v3/retention head v1, and runtime v27 formed that hard cut. Core and the swarm, model-runtime, and Persona-service entrypoints compile; Persona admission 7/7, Persona decision/retention 5/5, keyed Modeling/Research 1/1, and both writable-epoch refusals 1/1 pass. The maintained source delta is 6 net deletions. Model Atlas is untouched. Its component proofs are not a live inter-swarm collaboration result; that trial has not run.

Exact 2a435eb5 makes Persona-memory and tool-receipt provenance singular. Persona-memory v2 retains the exact Interpreter effect-document and decision- context IDs; its linked-event vector repeated that same effect ID and its relationship field was always None. Tool-receipt v1 retains exact result JSON or error; its sealed-raw-result reference was always None and had no producer or reader. Mind/runtime writable epochs advance to v10/v26 with no migrator or compatibility reader. Tool adapter compiles; tool MCP 8/8, Persona conversation and retention 5/5, old-epoch refusal 1/1, OpenAI runtime 23/23, and the packaged model-runtime entrypoint pass. The cut removes 10 net maintained lines. Atlas is untouched and live inter-swarm collaboration remains unproven.

Exact 9abadfe7 deletes the provider-frame observation DTO and callback APIs from both Codex Responses and OpenRouter transports. No runtime, binary, test, or operator surface consumed an observation; both live transport callers supplied a no-op closure. The SSE parser and OpenRouter response path still emit the same typed model stream events and receipts. A provider-specific transcript reader used only by one empty-text assertion, a callerless checkpoint constructor, a definition-only MCP label, and a historical constant-spelling health test are also gone. Provider spine 14/14, OpenAI runtime 23/23, tool MCP 8/8, Idunn runtime health 5/5, state-model, and the packaged model-runtime entrypoint pass. The cut removes 140 net maintained lines; state-model is 366 lines. Atlas is untouched and live inter-swarm collaboration remains unproven.

Exact a602fbdc deletes fifteen public state-model DTO types with no external consumer, two callerless OpenAI-runtime mouths, and eight definition-only type constants. Acceptance/runtime-link aggregates, duplicate graph and frontier DTOs, global retrieval and scratch state, generic job bindings, and churn state had no constructor, reader, writer, registry entry, test, or downstream consumer. Their live concepts already belong to keyed Mind/runtime receipts, keyed RepoModel documents, sealed reasoning passes, and exact runtime jobs. The standalone worker wrapper and direct model-request writer likewise had no caller; the release-owned observed worker path remains. State-model, core, OpenAI-runtime, and the packaged model-runtime entrypoint compile through the shared target. The cut removes 291 maintained lines, changes no writable schema, and leaves Atlas untouched. Live inter-swarm collaboration remains unproven.

Exact fed4b857 deletes the final duplicate Continuity recovery record. An accepted reorientation already persists its exact runtime result, sealed reasoning basis/context, typed Mind decision, strong-read admission, and Mind commit receipt. ContinuityRecoveryReceipt copied the same job/result, mode, checkpoint validity, summary, next move, files, and timestamp, and no reader consumed it. The entire continuity-gateway module, runtime registration, and derived-companion write are gone; success and failure use the ordinary exact Mind commit primitive. Runtime writable epoch advances to v25. Core compiles; decision-auditable reorientation 1/1, old-epoch refusal, and coordinator 5/5 pass. The cut removes 80 net maintained lines without touching Atlas.

Exact a6f73fc4 deletes the write-only Persona quarantine mirror. A blocked turn already atomically writes one terminal receipt containing exact crossing status/reason and mention digest, then marks each mention quarantined and binds it to that receipt. The duplicate blocked-pressure payload, wrapper document, construction branch, type constant, registry entry, and decoder are gone; nothing read them after the earlier duplicate projection was deleted. Core compiles, Persona consequence/retention 5/5 pass, and the feature-gated Persona service compiles. The cut is 63 pure deletions and does not touch Atlas.

Exact 2e3489c4 deletes the empty generic planning mirror. Four registered Mind document families—planning captures, backlog items, roadmap streams, and objective drafts—had no constructor, writer, admission owner, or consumer, yet were read and injected empty into every reasoning projection. Their document types, registry/validation/projection branches, reasoning field, and 256-line issue-tracker-shaped state-model vocabulary are gone. Real planning remains in frontier planning requests, candidates, Mind review, adopted decisions, checkpoints, Hands receipts, and their exact admission paths. Mind/runtime writable epochs advance to v9/v24. State model and core compile; sealed reasoning 8/8, old-epoch refusal, model runtime 23/23, and coordinator 5/5 pass. The cut removes 350 net maintained lines without touching Atlas.

Exact 0091e0e1 deletes the generic model-adapter and OpenAI-adapter status families. Every model pass wrote both mutable documents, but no query, router, admission owner, audit path, or display consumed either one. Their types, writers, status/auth-mode constructors, adapter-ID constants, one self-affirming OpenRouter status test, runtime registrations, two published schemas, and catalog entries are gone. Native and provider requests still own provider/model choice; transport construction still proves attached Codex auth or OpenRouter credentials. Runtime writable epoch advances to v23. Adapter libraries compile; provider spine 14/14, old-epoch refusal, and model runtime 23/23 pass. The cut removes 267 net maintained lines and does not touch Atlas.

Exact 3140d305 deletes ResidentSelfRuntimeReceipt, a durable type that was registered, accepted, and decoded but had no producer or reader. Its schema constant and every state-cache branch are gone. The definition-plus-export-only EpiphanyCoordinatorRoleResultStatus is also gone; the live role board retains its distinct coordinator role status. Resident Self writable state advances to v2, with one consequential proof that a v1 store refuses byte-identically. Resident Self 7/7 and swarm physiology 4/4 pass. The cut is net 32 maintained lines removed and does not touch Atlas.

Exact be611f24 deletes the producerless Imagination consideration-review request as one authority cut: writer, durable document, schema constant, public export, and runtime registration are all gone. It had no caller, reader, test, or Modeling admission path. Imagination requests and candidates retain their quoted-evidence, substitution, chronology, disposition, and route validation; adopted proposal Modeling remains owned by its actual lifecycle. Runtime writable epoch advances to v22 so a v21 store cannot carry the retired contract into current authority. Core checks, Imagination 8/8, old-epoch refusal, and coordinator 5/5 pass. The cut removes 71 net maintained lines and does not touch Atlas.

Exact f6a2ad7f deletes two exported read helpers with no workspace consumer. Packaged-release publication still writes its current-head document atomically, and release authentication still loads an exact release by ID; the unused standalone head reader is gone. Idunn signed-health admission still validates supplied typed trust anchors and preserves all continuity and substitution proofs; the unused trust-anchor file reader is gone. Core checks and Idunn provider-health 6/6 pass. The cut removes 25 net maintained lines without a schema, target, or Atlas change.

Exact 6ccaf937 deletes three public surfaces with no live consumer. The repository Body alias merely unwrapped assemble_mind_view; its proof now reads the typed Mind view directly. The Persona blocked-pressure helper rebuilt a sorted list already owned by keyed quarantine documents. The generic repo-work planning grant could mint read/snapshot Hands authority but no admission or actuator consumed it; exact coordinator and worker grant owners remain. Core checks, the read-only Body-basis proof, the fixed governed-tool operation proof, and coordinator 5/5 pass. The cut removes 41 net maintained lines without a schema, target, or Atlas change. Live inter-swarm collaboration remains unproven.

Exact 5a047944 deletes ninety pure lines of callerless helper API: a JSON-shaped state-ledger status projection and its dead label, generic role binding/owner lookups, a unique-string wrapper and implementation, and an unused successful-coordinator receipt wrapper. Typed ledger reads, exact role-family constants/schemas, and the live coordinator binding validator remain with their actual consumers. Core and the state binary compile warning-free; swarm remains 4/4. No durable contract, schema, target, test, or Atlas path changed. Live inter-swarm collaboration remains unproven.

Exact 0a97eef8 makes project_current_work the sole assembler of current typed work. The callerless Body-only and unresolved-Body projectors separately reopened Body, RepoModel, and runtime state to derive information already in that slice. Three callerless per-job continuation wrappers also rebuilt the whole projection; the live coordinator already uses the retained family review selectors. All five duplicate mouths are gone. The keyed Modeling/Research lifecycle still proves thread-free routing and zero live Body rescans; coordinator 5/5 passes. The cut removes 49 net maintained lines without a schema, target, test, or Atlas change. Live inter-swarm collaboration remains unproven.

Exact cd2177e8 deleted the duplicate public ensure_runtime_session writer. Only two model-runtime test fixtures called it, and an active ID collision made it return the existing session without comparing objective, creation time, or coordinator note. Exact fdefb889 later deletes the remaining generic session and job writers after proving they too had only fixture callers. Core checks, model-produced completion, and the packaged model runtime 11/11 pass. The cut removes 37 net maintained lines and leaves runtime_spine.rs at 9,730 lines with 53 public functions. Runtime stays at v21. Model Atlas is untouched and live inter-swarm collaboration remains unproven.

Exact 196222d9 removes session metadata plus job summary, artifact refs, and metadata from the live lifecycle documents. No reader consumed them, every metadata map and launch artifact list was empty. At that cut, EpiphanyRuntimeJobResult still owned the terminal summary and artifacts; exact 2c3335dc later deleted that family after moving each terminal fact to its exact typed owner. Sessions retain objective/coordinator note; jobs retain exact session, role, status, and time identity. The corresponding launch-option cargo, completion merge, and caller literals are gone. Runtime writable state advances to v21; the now-closed session/job catalog schemas are v1. Core and OpenAI libraries compile; old-epoch refusal, model-failure audit, model-produced completion, coordinator 5/5, and native tool-runtime 4/4 pass. The cut removes 95 net maintained lines and leaves runtime_spine.rs at 9,766 lines. Model Atlas is untouched; no live inter-swarm collaboration has yet run.

Exact 63d2991e reduces EpiphanyCoordinatorRunReceipt v1 to its terminal Self decision, timestamp, session/thread identity, plan-or-execute mode, and exact resident grant/launch/policy/argv/objective/release/manifest/executable provenance. Step count, provider echo, store path, artifact lists, arbitrary metadata, and final-job echo had no reader and are gone. Operator artifacts remain in the non-authoritative summary. The published JSON schema now matches the Rust receipt; its previous additionalProperties: false contract omitted the live resident fields. Runtime writable state advances to v20. JSON schemas parse; core check, old-epoch refusal, coordinator 5/5, and swarm 4/4 pass. The cut removes 59 maintained lines and leaves runtime_spine.rs at 9,807 lines.

Continue the registered-type, field-cargo, and test-liability audit after exact 2a435eb5. Model Atlas remains protected for its first live inter-swarm collaboration trial.

Exact 3ed1d564 deletes the public commit_repo_frontier_modeling_request mutation path. Production had no caller: accepted Verification already atomically commits its audit, Soul verdict, and derived frontier-Modeling request through one Mind transaction. The deleted writer reopened the store and existed only to feed an OpenAI test. That test now uses the real Body Modeling launcher and retains its consequential proofs for sealed input, structured completion, typed result/job persistence, provider failure, and output-contract failure. Its fabricated frontier, route, Verification result, and Soul verdict are gone. The cut removes 205 net source lines; runtime_spine.rs reached 9,819 lines with 54 public functions. The atomic Verification-to-Modeling lifecycle and release-owned model runtime pass.

Continue auditing public runtime-spine mutation/read wrappers and tests against real consumers and consequences. Preserve the unrun Atlas inter-swarm vertical slice until Gate 1.

Exact 8dbfcf63 deletes the persisted Body Modeling, Imagination consideration, and Reorientation launch-binding families. Their attempt, request, role, binding, timestamp, Body/projection, and launch-digest fields duplicated the immutable worker launch, typed family request/projection, runtime job/result, admission refusal, or typed pass failure. Canonical worker job identities now own contiguous attempt order. Retry CAS strong-reads prior launches and each family's exact terminal ancestry; stale model output is not rebased. The broad keyed Body/Imagination lifecycle, Reorientation success/failure/retry proof, old-epoch refusal, release-owned coordinator, and OpenAI runtime checks pass. The cut removes 24 net source lines and advances runtime writable state to v19.

No live inter-swarm collaboration has yet run. Model Atlas remains protected for the first real Gate 1 trial; its isolated component proofs are not acceptance. Continue the public runtime-spine and test-liability audit without narrowing Atlas publication, trust, transport, verification, admission, wake, brake, or Eve behavior.

Exact b55e96ea deletes the persisted Planning and PlanMind launch-binding families. Their twenty-four fields duplicated the immutable worker launch, typed requests, runtime job, canonical attempt identity, and typed failure review. Self derives contiguous attempts and current jobs from immutable worker launches, and retry CAS strongly reads each failed result and review. Runtime writable state advanced to v18.

Exact b0a4978d deletes the Proposal-Modeling launch-binding document family. The immutable worker launch already owns the exact typed request reference, job, role, binding, and sealed launch document. Current-work, retry counting, fulfillment, coordinator actuation, and archival now consume it directly. The registry entry, launch-digest mirror, deletion choreography, and operator JSON echo are gone. The broad keyed lifecycle, coordinator target, OpenAI runtime, and old-epoch refusal pass. The cut removes 70 net source lines and advances runtime writable state to v17.

Exact 6ccc7dd2 deletes the private 20-field Hands receipt-chain summary. The Hands commit owner now derives the deterministic Verification request directly from the persisted patch, command, and commit receipts plus the frontier authority. The summary's copied schema, job, grant, command-output, Git, path, prose, and timestamp fields owned nothing. Atomic Hands-to-Verification admission and the concurrent Persona/Hands lifecycle proof still pass. The cut removes 43 net source lines without adding state, schema, or tests.

Exact 5d507bfd reduces Self's autonomous Imagination-to-Modeling origin binding from 22 duplicate fields to six causal join fields: schema, exact direction-result identity, selected option ordinal, worker job identity, and exact worker-result/launch digests. Proposal identity and payload, direction request, runtime/thread, typed projection, Body/domain binding, option content, and canonical Modeling-request identity are now checked directly from their owning immutable documents. Atomic promotion and the broad keyed lifecycle remain proven. The cut removes 60 net source lines and advances runtime writable state to v15.

Exact ce306e23 preserves Model Atlas for the still-open inter-swarm collaboration trial while deleting its second local offer/claim author. Ordinary Modeling through keyed RepoModel operations now solely creates, deprecates, withdraws, and retires provider offers and consumer claims. Atlas retains its signed publication, pinned trust, transport, deterministic join/cycle/blast projection, Soul verification, Self impact admission, Resident Self wake, brakes, and Eve lowering. The direct Atlas offer/claim write-intent types, runtime commit APIs, registry entries, 518 planner lines, and two tests that only animated that duplicate authority are gone. The retained runtime proof now creates its offer and claim through RepoModel before exercising exact Soul verification and Body-drift refusal. The cut removes 593 net source lines, advances runtime writable state to v14, and leaves the three-repository direct/transitive Modeling proof passing. No Gate 1 run was started; no live inter-swarm collaboration has yet been tested.

Exact a276d0f4 collapses the generic public host_identity module into its sole production consumer, Bifrost Persona-feedback admission. CultNet now owns the shared public trust-anchor/signature shapes; the admission owner privately preserves the exact existing identity/signature domains and wire-compatible anchor schema. Generic verifier, anchor/signature aliases, enrollment/export test APIs, and four callerless public feedback-signing/admission helpers are gone: 144 net deletions. Epiphany still owns no Bifrost private key. Core and swarm compile, and all seven authenticated feedback, substitution, disclosure, recovery, and read-only import tests pass.

Exact f3360248 deletes three tests with no distinct behavioral claim and the single-use helper one of them existed to inspect: a release-cache filename prefix/determinism assertion already covered by cache stability and separation, a literal Git submodule argument-vector mirror, and a raw repeated-tool-round predicate test already covered by the retained guard-transition test. This is 46 net deletions. The actual source-cache replacement recovery, target/toolchain cache separation, repeated-loop transition, and terminal failed-worker receipt tests all pass.

Exact b78ffb25 deletes the counterfeit epiphany-hands-action consequence recorder, its release role, the coordinator's unconsumed recordPassCommand, and the recorder's main-only tests: 926 net deletions. The executable performed no patch, command, or commit and had no runtime caller; it accepted descriptions of consequences that had already happened and wrote receipts for them. The coordinator now reports awaitingHandsExecutor instead of claiming the gate is ready. Exact typed intent, review, path-scope, consequence, refusal, and Verification admission remain, and the current-work capstone still proves the retained chain. Cargo now has 11 executable targets. Epiphany has no admitted repository actuator yet; a future Hands owner must execute the operation and emit receipts from its own observed consequences.

Exact 94098223 removes Epiphany's unowned private host-identity custody and leaves only the Bifrost public-anchor contract plus signature verifier. The host-identity executable, release role, private identity schema/signer, enrollment/open/status/export APIs, default paths, Windows DPAPI, Linux seed masking, assurance claims, and direct random/zeroize/root OS dependencies are gone. Bifrost owns its private identity; Epiphany authenticates signed feedback against one pinned public anchor. A deterministic test-only signer replaces the production custody stack in verifier fixtures. The cut removes 561 net lines, leaves 12 Cargo executable targets, and passes focused verifier, Persona feedback, core, swarm, and release-construction checks.

Exact 900c5232 deletes the callerless epiphany-frontier-proposal command, its forced release role, CLI parser, JSON summary, and two parser-only tests: 188 pure deletions. At that cut, proposal intake and selection remained typed runtime/Self operations; exact 6e600e8d later removed that generic mouth as well and made admitted Imagination promotion the sole proposal owner. The current-work capstone now proves the real promotion, concurrent launch, sealed reasoning, admission, and read-only re-entry. Cargo then had 13 executable targets.

Exact 56267201 retires the three unadmitted Model Atlas daemon shells and their forced release roles: publisher, entanglement projector, and impact ingress. Their typed libraries, stores, signatures, CAS admissions, projections, transport, and impact evaluation remain. No current unit, deployment phase, caller, or independent failure-isolation contract justified three production processes before Gate 1. The vertical-slice map now describes library organs and requires a future admitted lifecycle to determine the minimum Idunn-managed topology. The cut removes 328 net lines and leaves 14 Cargo executable targets; focused Atlas runtime and release-construction tests pass.

Exact 3dda58a5 collapses Persona feedback ingress into Resident Self: the standalone binary, forced release role, command-only status/snapshot projections, snapshot replacement seam, and two tests that only animated that extinct Starfire transport are gone. Resident Self remains the sole polling owner for signed Bifrost feedback and immediately routes admitted deliveries into typed social state. The cut removes 426 net lines and leaves 17 Cargo executable targets. Seven authenticated admission, disclosure, substitution, recovery, and import tests pass; the Ygg swarm binary remains clean.

Exact ad2292ee deletes the callerless Persona mouth-identity and Discord permit-identity executables, their forced release roles, and the enrollment / anchor-export wrappers that only those binaries called: 177 pure deletions. The two helpers had no unit, deployment call, distinct runtime user, privilege boundary, or health contract; they merely caused every release to build and ship setup commands. The delivery-request and permit cryptographic identities remain distinct contracts. Their long-running consumers still open and verify already-admitted identities and pinned anchors; model turns and Bifrost cannot create or rotate them. Cargo now has 18 executable targets. Focused core, permit, Persona-service, and release-construction checks pass.

Exact 03140a47 deletes the packaged epiphany-runtime-spine command and the false service authority it carried: 649 lines of operator/debug mutation CLI, callerless Hello/schema-catalog writers, a hand-maintained mutation-contract mirror, and its source-shape test. CultCache exact fdbf3bf now exposes the types actually registered in a cache. Runtime status and model preflight derive from that single registry instead of a second list. The production Mind store and its typed jobs, decisions, and receipts remain; only the duplicate mouth is gone. Cargo now has 21 executable targets and zero duplicate binary-source owners. Core checks without warnings and release construction passes 17/17.

Exact 500125d5 deletes the separately packaged epiphany-mvp-status command. Nothing in deployment or operations invoked it; the coordinator instead textually included the binary source as a module. The live status projection, operator rendering, and thought sealing now live once in epiphany-core. The CLI parser, default store, output-file writer, package role, and redundant release assertion are gone. Cargo has 20 executable targets and zero duplicate binary-source owners. Coordinator compilation, the exact operator-sealing test, and release construction 17/17 pass.

Exact 63939fa2 deletes Persona's hand-written projector-output language tribunal. Projector and Persona prose are inert private cognition; only the Interpreter's closed typed effect enum can propose a state or speech consequence. Keyword matches on STATE NOTE, SAY, JSON punctuation, or field names therefore added retries without adding authority. The cut also deletes a test-only prompt wrapper and two tests that blessed prompt phrases/forbidden words. Three-stage execution and replay, channel-escape refusal, substituted provider/model refusal, typed-effect validation, and all OpenAI-runtime targets pass.

Exact bf2f39eb deletes two tests that could not falsify live behavior: one compared identical causal-ID calls and named the equality provenance independence; the other repeated generic unknown-field refusal for a field whose production path is already gone. Family lifecycle/admission tests still exercise exact request identity, and Body substitution still exercises strict ingress refusal. Core and OpenAI-runtime all-target checks pass.

Exact 104bf390 deletes the tool runtime's duplicate immutable-GitHub identity test and a permanently ignored live-network test pinned to a historical README. The canonical parser and its malformed/canonical-set behavior remain tested in epiphany-core; the ignored request was never part of CI and its assertion that the downloaded prose contained Epiphany did not protect transport behavior. The tool MCP runtime checks cleanly with 75 test lines removed.

Exact 777dd1a5 deletes epiphany-tool-mcp-runtime smoke, a callerless command that printed fixed JSON constants and observed no runtime state. Its sole test compared those constants with themselves and checked that the prose did not say Codex. With the command gone, the one-variant CLI enum also collapses into a direct run parser. The four retained release-owned tests exercise typed execution, receipt persistence, Resident-state binding, and unbound refusal.

Exact 013c3bf1 deletes the callerless epiphany-repository-body smoke command. It created two temporary stores against the current checkout, repeated the production bind/observe/read path, printed ok, and deleted its files. The shipped Body binary retains only bootstrap, bind, observe, and status. Its actual owner tests pass 23/23, including authenticated projection, tamper refusal, generation, Git semantics, and no repository mutation.

Exact ce90f911 deletes the model runtime's callerless smoke route. That route opened no provider transport: it wrote a synthetic request, synthetic tool call, synthetic completed receipt, and smoke_no_network marker into a writable runtime store, then reported not-opened. It could therefore manufacture authentic-looking physiology without provider evidence. The real model-turn, worker, follow-up, decision-list, and decision-audit commands remain; their release-owned suite passes 12/12.

Exact 0bb6a883 narrows tool-runtime stdout to intent ID, receipt ID, and terminal status. The removed adapter ID, caller-supplied store path, and static intent/receipt schema map were display echoes; the model runtime did not read them and exact authority already lives in the typed CultCache receipt. The four release-owned tool-runtime tests remain green.

No Epiphany-owned Rider or Unity code, target, schema, or actuator exists. Brokkr owns Unity through Eve/CultMesh. A future Rider daemon owns Rider. Epiphany may consume their typed capabilities and receipts; it does not poke either editor directly.

Exact 856648de deletes the unused semantic-memory and workspace-coverage projection subsystem: 32,866 net source lines, four binaries, the competing local daemon supervisor, Qdrant/Ollama/Postgres configuration, projector policy/lifecycle/heartbeat/recovery state, query/context packets, aggregate RepoModel revision/hash cargo, and Persona's always-empty semantic-recall plumbing.

No agent request builder or sealed reasoning projection consumed those caches. Modeling now reads the exact typed Body and keyed RepoModel projection directly; Persona reads keyed memory and typed social state directly. Future retrieval evidence must earn a typed provider receipt and an explicit reasoning consumer. Idunn remains the sole deployment and daemon-survival authority. Core 165/165, OpenAI runtime 25/25, and release construction 19/19 pass serially.

The active editor boundary is clean. Epiphany owns no Rider or Unity bridge, command schema, or editor-specific actuator. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon will own Rider. Historical architecture snapshots retain their dated record but cannot be mistaken for executable or current authority.

Four subsequent cuts narrow RepoModel to what Modeling can actually decide:

• 6ea4ff3c removes the redundant memory-profile axis, dead SHA-1 ID factory, empty profile module, seven cache/Persona-only node kinds, seven cache-only edge kinds, and seventeen impossible lifecycle states.
• 5218cf2c deletes the producerless RepoModel lifecycle-receipt document family and all of its empty projection/fixture plumbing.
• 8bb039af makes domain creation seed-only and deletes the unreachable summary operation, summary document family, validation, registry contract, and the test cargo that alone produced it. The retained atomic graph test now follows the live seeded-domain then node/edge path.
• ab1afc27 removes node salience/confidence and edge confidence because no owner read, validated, routed, or displayed them; they merely perturbed exact document identity.

Affected targets check cleanly. Core remains 165/165; focused RepoModel tests pass 5/5 and reasoning-context tests pass 8/8.

The global thread-state authority is gone.

• 1662a012 makes coordinator policy a pure projection over keyed Mind, exact current-work families, Resident pressure, and runtime receipts.
• 07d891ba deletes persisted EpiphanyThreadStateEntry, coordinator_state_transaction, generic coordinator state/update/launch/ acceptance/interrupt services, and their aggregate writers.
• ec1431ff deletes EpiphanyThreadState itself, global launch revision cargo, generic launch/interrupt request types, aggregate prompt/freshness/graph- context surfaces, the obsolete Repo graph importer, and the historical prompt-context smoke.
• f7948795 deletes the generic MindGatewayReview and MindStateCommitReceipt v0 authority, its interpreter prompt, runtime registration/read APIs, false state-effect/thought/adoption CultNet mouths, and launch proof profiles that required phantom gateway receipts. CultMesh now projects only the sealed reasoning basis, decision context, and exact EpiphanyMindCommitReceipt, all read-only.
• 1c9aafd8 seals the exact terminal decision context before a model-backed frontier-Planning failure is written. The typed faculty failure and generic runtime job now cite the same context; transport-only failure remains physiological and cannot impersonate a Mind decision.
• e0e75a30 deletes EpiphanyRoleStatePatchDocument, its generic parser and three role-policy tribunals. Research now emits one closed EpiphanyResearchDecision; its admission owner derives keyed evidence, observation, and checkpoint writes. The old generic Imagination planning patch had no current-work owner and was deleted rather than generalized. Runtime role-result and worker output contracts advanced to v4.
• 12b1b285 makes runtime model/tool binding validation one shared owner for both execution and decision-context sealing. Exact native/provider lowering, ToolCall arguments, ToolResult bytes, terminal receipts, session/job/basis, and source-worker authority must describe one family. Hostile provider, receipt, and stored-binding substitutions refuse; reasoning bases and decision contexts remain valid after native/provider transcript deltas are deleted.
• 01602fd3 advances the Mind epoch to v2 and runtime-spine schema to v1. Opening any store that claims runtime or Mind identity now requires one exact current identity pair before registered runtime writers can see it. Old v1/v0 stores and split identities refuse byte-identically; unrelated Persona and coverage physiology stores remain outside this authority. There is no schema migrator or dual reader.
• 26b6a5bf closes the first fresh concurrency slice. Two independently planned Modeling-node writes commit simultaneously and assemble into one valid reopened graph; competing writes to one semantic identity yield one winner and one typed conflict; exact winner replay returns the original receipt. A real Verification admission also commits simultaneously with an unrelated Modeling-node write. Raw mutation primitives are crate-private, so external callers cannot manufacture generic Mind CAS plans.
• 7c2ebd81 removes the live Persona consequence path from the legacy agent-memory aggregate. Interpreter state_note decisions now become keyed EpiphanyMindPersonaMemoryDocument writes under the exact Interpreter decision context. Exact replay returns the original Mind commit. A concrete Hands commit and Persona admission run simultaneously and both commit.
• 79c0e373 seals the complete assembled Persona pass input as one typed Mind document before inference. It records the exact heartbeat, agent-memory, and admitted Body versions observed; all three Persona stages cite the sealed Mind version. Substitution refuses byte-identically, replay reuses the original input, and direct Git inspection is gone. Persona-only input and memory documents are excluded from generic role projections.
• d3300bba makes re-entry consume only an authenticated admitted Persona pass-input. The loader requires one exact Persona.pass_input Mind commit receipt, validates its content-addressed identity, and refuses a naked typed document. A restarted execution plan performs no heartbeat, agent-memory, Body, repository, or model read when that input and terminal decision already exist. Current-work reconstruction is identical and byte-for-byte read-only at Launch, Wait, completed, and post-Research boundaries.
• f8412b69 makes decision audit an operator capability rather than a test claim. reasoning_context::audit_decision_context reconstructs the sealed basis, decoded typed projection, exact terminal native/provider requests, governed tool observations, structured terminal records, and exact Mind commit receipts without consulting streams, events, or current Mind state. Worker archival at that point retained the complete typed role/generic result family; exact 2c3335dc later deleted the generic companion while preserving typed success and failure decisions. The digest-only archive shape remains deleted. Runtime schema v2 refused the prior writable archive epoch.
• 553f79d9 makes the OpenAI Responses schema projector one explicit dialect compiler shared by every model pass. It types literal-only schemas, removes parent-relative and unsupported conditional validation from provider cargo, preserves supported type-specific constraints, and lowers decision-bearing UUID formats to exact lexical patterns. The full native schema remains the Mind-admission contract; no provider projection can weaken native decoding. This cut was forced by three preserved packaged falsifications: untyped literal/parent refinements, rejected uniqueItems, and an invalid UUID after over-stripping provider guidance. No role-specific prompt/schema exception survives.
• a8f3c1f0 repairs the Body identity seam exposed only after the first fully typed packaged Modeling decision. Bootstrap had supplied Git source identity to the keyed RepoModel's Body-binding field. Bootstrap now uses the admitted RepositoryBodyObservationBasis, and RepoModel initialization independently refuses any seed that disagrees with the authenticated runtime Body route before writing a single envelope. The negative test proves the entire store remains byte-identical.
• Exact bb823c54 closes the model-pass failure seam exposed by the native capstone. EpiphanyModelPassFailure is one shared typed terminal record over the sealed basis/context for role, reorient, and Persona cognition. The terminal owner derives the exact transport session/job from that context, atomically closes a still-live transport job plus the exact model session, and prevents generic transport failure from impersonating decision authority. Restart reuses the terminal record instead of inferring again. Persona success closes the session only after the effect document and terminal receipt are durable.
• Reorientation failure admission now requires that same exact EpiphanyModelPassFailure. A generic failed worker result plus a plausible context can no longer manufacture a Continuity decision.
• Provider request authorship is also cut at the owner. Runtime execution and decision sealing both derive the provider request internally from the exact native request. Public model-turn ingress accepts only native requests; caller-authored provider requests refuse before opening model authority, and no public provider-request storage function survives.
• Exact bb823c54 also closes the bootstrap-only semantic work seam. Modeling projection work is derived on each pulse from the complete exact keyed RepoModel document-version set and the Mind commit receipts that own those versions. The cache work item is content-addressed and stays outside Mind mutation CAS, so unrelated graph commits remain concurrent. Older work cannot suppress a newly assembled basis. Each projector operation validates the complete current keyed namespace from its opening snapshot, and acquisition uses full-snapshot CAS so a concurrent disjoint insert cannot hide as a phantom. Modeling retention uses exact basis identity rather than synthetic aggregate generation or timestamp order.
• Exact 470d4cb5 removes historical coordinator receipts from behavioral routing. Family admission owners materialize typed obligations, and one pure current-work projection is now the scheduler input. Exact d48f69b7 repairs Body Modeling retry identity. Exact 9b9b5c85 completes the shared law: simple model passes carry one typed attempt projection, Research and two-stage Planning retain their full exact lifecycles in current-work, and proposal Modeling preserves canonical failed/cancelled attempt identity. A failure changes pressure identity once without counters or event authority.

There is no compatibility aggregate, dual reader, bootstrap thread, or migrator. Thread identifiers may survive only as immutable pass-creation provenance; they do not own identity, currentness, or conflict.

Verification at this boundary:

• cargo test --workspace --all-targets --locked -- --test-threads=1 passes natively;
• every Epiphany core target compiles;
• core library 491/491;
• OpenAI runtime library 25/25;
• OpenAI Codex spine 12/12;
• model-runtime binary 10/10;
• OpenAI-runtime binary 10/10;
• Persona service 1/1.
• tool runtime 14/14, with only the explicitly live immutable-GitHub test ignored;
• release construction 21/21.

Canonical machine now

The runtime Mind .cc is the sole decision-bearing store. Keyed Mind and RepoModel documents assemble deterministic views; their projection digests are audit/display identities, not mutable authority revisions.

reasoning_context::commit_mind_mutation is the crate-private canonical commit primitive. Concrete invariant owners supply exact strong reads and complete typed writes. Disjoint identities merge, same-identity divergence conflicts, changed strong reads refuse without mutation, and exact replay returns the original receipt. Model output is never silently rebased.

current_work.rs derives work from unresolved typed state obligations and exact runtime receipts:

• Modeling consumes Body/RepoModel obligations directly.
• Eyes launches only for an explicit outside-evidence obligation.
• Verification consumes exact Hands consequences and invariant obligations.
• Persona consumes typed unread social/relationship state.
• Hands consumes an adopted plan/route and exact capability receipts.

Events, timestamps, role lanes, latest-result slots, and accepted-at ordering are projections only.

Decision-audit foundation

The intended retained chain is:

1. exact typed Mind document versions;
2. sealed EpiphanyReasoningBasis with a closed typed projection;
3. exact final native model request;
4. internally derived provider request;
5. exact ordered governed tool intents/receipts supplied to the pass;
6. sealed EpiphanyDecisionContext;
7. structured terminal decision or typed pass failure;
8. invariant-owned MindMutation and EpiphanyMindCommitReceipt.

Transcripts, SSE frames, reasoning deltas, and intermediate prose are optional and non-authoritative. A retained decision must remain auditable after deleting them.

Model opening requires the sealed basis for worker passes and derives the provider request internally from the native request; callers cannot supply a second provider-shaped truth. Structured role/reorient results, the three Persona stages, and retained worker/session/Persona authority already bind and preserve exact decision contexts. Concrete Body, Proposal, frontier-verdict Modeling, Research, Verification, Planning/PlanMind, and Reorientation admissions use keyed mutations. Research is driven only by explicit external-evidence obligations; Eyes does not gate Body Modeling.

Accepted migration boundary

The source-level Decision-Auditable Concurrent Mind migration is accepted.

Context validation is now exact and DRY: execution and sealing share the same model/tool binding owners, native/provider lowering is exact, final ToolCall/ ToolResult bytes are closed, and request-owned public-source observations stay distinct from model-continuation observations.

Retention must preserve direct reachability: worker attempt or Persona terminal to decision context to reasoning basis. No raw stream event, request family, or transcript may be required for that query after archival.

The packaged epiphany-model-runtime audit-decision command exposes that read-only projection by exact context ID. Its JSON is an operator/xenos rendering only; it never writes Mind or reconstructs prompts from live state. Exact source 5f66d6c9 adds list-decisions to the same runtime. It deterministically lists only contexts with a complete validated terminal audit chain; sealed nonterminal contexts remain physiology and are omitted. This surface and its portable-test repairs through exact ebc0ffe4 have now passed Idunn's full Yggdrasil workspace gate and are sealed in the exact Linux package described below.

The cross-repository operator-plane cut is complete: Epiphany 39adf3a4, Bifrost 8b9ab65, VoidBot 78763ea, and gamecult-ops ca09ba8/c44fb05/448e368. Eve/CultMesh projections, local typed enginseer tools, Persona transport, and governed consequence receipts remain. The standalone Discord command daemon, bridge admission worker, operator Mind writers, deployment gate, unit, and readiness claims do not.

Exact ab321b34 introduces one explicit, decision-auditable model-provider boundary. The native request remains canonical; provider selection lowers it internally into the exact OpenAI or OpenRouter request recorded in the decision context. Exact 547404fa projects public provider identity without exposing credentials. Exact c1a6034f preserves supervisor, heartbeat, and Resident Self read-only physiology while the swarm brake is engaged. Exact 6b44b4d3 publishes the shared Idunn signed-health wire schema.

Idunn compiled, tested, packaged, deployed, and health-admitted exact current source d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4 natively on upgraded Yggdrasil. The full workspace gate passed under test receipt SHA-256 de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482. Idunn sealed 26 immutable root-owned binaries plus release-witness.ccmp as release sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06; the witness file SHA-256 is 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357. The successful request is manual:redeploy:yggdrasil-epiphany:manual:redeploy:yggdrasil-epiphany:2026-08-22T16:35:41.670Z. epiphany-operator-command remains absent.

The provider boundary exposed two deployment ownership defects rather than earning provider-specific compensators. Idunn's validator now consumes its canonical authenticated daemon-health record; the root actuator supplies the exact trust store. Runtime credential readiness is inspected inside Resident Self's systemd mount namespace, where LoadCredential actually exists. These cuts are live at Idunn 8b972715 and gamecult-ops through b47f9084. No transient Epiphany container, named volume, package root, or per-run test root remains.

The bounded redeploy request helper opens an exact, expiring brake grant and immediately returns after waking Idunn; it does not own terminal observation or brake closure. During the 470d4cb5 transaction the operator poll reached a successful terminal receipt before re-engaging the brake. Exact release binding refused contemporaneous stale Odin/Ghostlight requests, so no unrelated target mutated, but the released record briefly survived transaction closure. Future operator transactions must treat terminal observation plus explicit deployment-brake-engage as their final step. Idunn cannot possess the private operator identity used to close its own mutation authority.

Fresh source tests prove the retained chain, concurrent keyed commits, old-epoch refusal, deterministic current-work re-entry, and Persona replay without input reformulation or inference. This is source acceptance, not yet a package/live claim.

Exact clean packages at 55fb4cf8, edd664db, and 1e01c339 preserved the three provider-boundary falsifications above. Exact clean 553f79d9 then packaged 27 Linux binaries as release sha256-e6c19d2b231a73023772f1162b15dac63bd4c7957a7a1cea82a86c8d75f35ac9 with witness sha256-fbee2857c558bde47f4b422b59fe675362fd1955388b084b3d44a188f8a6c82a. Its fresh capstone completed concurrent three-stage Persona cognition and a terminal Body-Modeling decision after five governed source-tool rounds. Review then refused before Mind mutation because the seeded RepoModel carried Git source identity instead of the authenticated Body binding. That failed root is preserved and is not replay input.

Exact clean a8f3c1f0 now packages natively on Windows as 27 binaries, release sha256-19d40048f46355486e66c2abc766abb277122c552cb121a9161e6e95a471be46, witness sha256-ee8bf0574b5e7d489adc47f6dca491fe5224c8b3e61b3d2fd8c2e67c36d5f903, with privateStateExposed=false. Its fresh store projected launchModeling directly from the Body obligation and launched Persona plus Modeling concurrently. Both provider calls then failed because this task token cannot reach chatgpt.com; no positive decision was fabricated.

That failure found a real architecture gap. Modeling already sealed a typed, transcript-free failure context, but Persona left its session active. The Exact bb823c54 repairs the shared owner. A native negative replay produced basis reasoning-basis-sha256:d31179fe..., context decision-context-sha256:a89ba921..., and model-pass failure dd058f3f...; the Persona session is Completed, transcriptRequired=false, and restart left runtime SHA-256 C7723AD7... plus heartbeat SHA-256 2996AAA8... byte-identical. Its 2.09 MB temporary replay root is .epiphany-run/native-model-failure-20260818-a; evidence is distilled and the temporary root owns no continuing proof.

The admitted d2ca6630 release was compiled and packaged natively on Yggdrasil with Rust 1.95.0 under epiphany-builder. The live Idunn actuator contains no Docker path. A build container or cloned source volume owns no durable proof.

Ox9 proved typed Persona and Modeling decisions, then exposed that historical coordinator receipts could resurrect stale direction. Exact 470d4cb5 cut that authority and made Resident Self consume only current unresolved typed state. Ox10 proved the replacement route: Body launched Modeling directly with no Eyes result, while Persona ran concurrently. Modeling sealed its exact basis/context and failed closed because Ox emitted duplicate tension cargo; no Mind commit occurred. Three Persona projector attempts independently timed out opening the provider stream and each terminalized as typed failure.

Ox10 then exposed one remaining asymmetry. Body Modeling projected its semantic work and continuation action in separate fields and omitted the failed job from the current-work digest. The unresolved obligation remained launchable, but Resident Self correctly refused to mint the same pressure identity twice. Exact d48f69b7 deletes that Body split shape. Exact d2ca6630 adds restart-safe resident objectives and durable recovery for a dead runtime worker, and is the current admitted Yggdrasil body.

Private Ox12 proved the repaired Body path in package reality: Body Modeling launched directly without Eyes, completed, and admitted; admitted-direction Imagination also completed. Under exact 9b9b5c85, OpenRouter then completed proposal Modeling attempt 1 with a structured result. The result put RepoModel node/claim identities in dependency_item_ids, whose contract is frontier identity. The mutation planner correctly refused the absent frontier dependency and changed no graph state.

That correct semantic refusal exposed a generalized lifecycle gap: model transport success remained terminal while its failed Mind admission was not a durable routing input. Exact e046a4d1 adds one typed EpiphanyAgentPassAdmissionRefusal Mind document for Body, proposal, and frontier-verdict Modeling plus frontier Verification. The refusal binds exact request, job, result, decision context, invariant owner, refusal kind, reason, and commit. Current-work derives a fresh attempt from it; proposal retry carries the ordered prior refusals. A successful model result remains truthful and is not rewritten as a failed worker job. Output contracts now distinguish claim targets from frontier dependencies. Mind/runtime/proposal context cut to epochs v3/v4/v2; old writable stores are refused. Ox12 is therefore historical evidence and must not resume. Local core 491/491, coordinator 12/12, status 2/2, swarm 10/10, and all core targets pass.

Exact 85061129 then passed Idunn's full Yggdrasil workspace gate and sealed release sha256-238a7911650c406c67b710b19642451c1b1e7bdbe66e9dc7605e46e098a780dd. Private fresh-store Ox13 proved the new refusal lifecycle in package reality: Body Modeling launched without Eyes and admitted, Imagination completed, and a structurally valid proposal result wrote a typed admission-refusal commit before attempt 1 completed with corrected semantics. Transcript-free exact audit is retained under the Ox13 root. Persona concurrently exposed an independent deadline-owner defect: its provider transport hardcoded 90 seconds while worker passes used one outer 600-second budget. A stop race let systemd begin four typed projector failures rather than the live-observed three; none committed Mind or public speech. Ox13 is sealed, inactive, and must never resume.

Exact 3b958a83 gives Persona one explicit outer --turn-timeout-seconds budget, defaults it to 600 seconds, removes the inner provider request timer, and makes the shared error provider-neutral. The focused provider/runtime suites pass: provider spine 17/17, runtime library 26/26, model-runtime binaries 13/13 each, and Persona service 1/1.

Ox15 is sealed historical fresh-store evidence. It proved Persona no longer dies at the old inner transport timeout, then exposed a separate proposal currentness fault. Exact 8812945e keeps proposal semantics inside the family admission owner, and exact 749d977e makes a completed historical direction decision valid evidence for its proposal across later disjoint RepoModel changes without turning an aggregate model revision back into authority.

Exact 749d977e passed Idunn's Yggdrasil gate under test receipt SHA-256 39229d8a526a7af7e7b29cec28d27b07f89ba5f5792658947e3d1d039b9449c4 and sealed package sha256-5d9bc25612dd46511620671ccd5113f3b5e0e3c060c85e97dcdc199f9126a230. Private fresh-store Ox16 launched direct Body Modeling without Eyes while all three Persona stages ran concurrently. Body and proposal admission survived later disjoint RepoModel changes. No public delivery succeeded. Planning then remained unavailable because the active Imagination frontier used inspected evidence paths as its supposed future write scope, omitted OX-CAPSTONE.md, and was unordered. Dependent proposal pressure began to form, so Ox16 was braked and sealed before the forest grew. No Hands consequence or capstone marker exists; Ox16 must never resume.

Exact 5b799b12 is the hard architectural cut from that evidence. It deletes source_scope/sourceScope, makes repository_scope the canonical sorted repository-relative ceiling for future Planning/Hands consequences, and names the adopted route narrowing authorized_paths. Generic RepoModel validation owns the intrinsic path law and refuses an invalid routed frontier atomically before any graph document is written. Inspected files and evidence remain in their existing typed audit cargo. Mind/runtime/RepoModel epochs advance to v4/v5/v2. Local acceptance is core 494/494, OpenAI runtime 26/26, coordinator 12/12, swarm 10/10, and model-runtime 13/13.

Historical subtraction ledger

The Ox17 deployment lane remained paused through this cut. Exact Epiphany c37cae8b closes the remaining two-stage Codex request seam. The consumer adapter now derives and seals one closed durable provider-request document: either the exact final CodexProviderRequest or the exact OpenRouter request. The release edge no longer rewrites Codex schemas, tools, call IDs, tool choice, or output format; it only wraps the sealed request in the authenticated Connector invocation. Runtime and decision-context writable schemas are v47/v3. The source cut is 10 net maintained deletions and passes Core 152/152, runtime 21/21, adapter 5/5, model edge 12/12, and Persona 1/1.

CodexConnector source exact 6dc80f6d266db4d82566d2434adcc55a48e8ecad includes current mainline transport diagnostics and exposes three compile surfaces: contract-only with no features, the default encrypted socket client, and the daemon. Contract/client/daemon tests pass 8/8, 10/10, and 29/29. Documentation exact 8c57be4 records that boundary. Epiphany pins the contract-only surface in its adapter and enables the client only at the release edge.

Exact 87ea81db pins the current Connector source and deletes Epiphany's stale 106-line public JSON schema for the extinct generic request; the public catalog now contains only the portable Persona and work-organ contracts.

Ghostlight exact 8e7d980 pinned the same Connector source contract. The later Yggdrasil cut installed Connector as an independent service and Idunn target; Ghostlight can consume its ABI but cannot deploy or mutate the daemon.

Exact 7a125d78 deletes the entire 3,592-file vendored Codex tree: 851,099 net lines removed. Cargo metadata and manifest/source guards prove it had no build consumer. Its seven dirty files contained only formatting churn, so no semantic work was lost or embalmed as a patch artifact. The workspace exclusion, obsolete search instructions, vendor-specific license clauses, and two superseded live migration notes are gone. Gamecult-ops exact cb63e77 repairs the inventory to name the independent yggdrasil-codex-connector Idunn target; no service or deployment state changed.

The subsequent source-subtraction passes grouped runtime_spine.rs by semantic owner and removed single-caller wrappers, duplicate reads, and unowned cargo. The current next action is owned by the handoff header and state/map.yaml, not this historical ledger.

Yggdrasil previously exposed 96 GiB of dead native Cargo targets after interrupted full-workspace builds; exact cleanup returned the builder target root to 4 KiB. Exact 1d5a1f17 landed the first causal cut:

• 21 duplicate core/release binary declarations are gone; each production entrypoint has one Cargo owner;
• 19 generic repo-request smoke executables are gone because Cargo compiled them but their main() assertions were not tests;
• the runtime-store migrator CLI and the unshipped repo-personality birth subsystem, parallel agents.msgpack initialization, schemas, prompts, and stale contract plans are gone;
• the non-vendor diff removes 19,252 net lines and reduces epiphany-core from 75 to 30 binary targets;
• core library tests remain 494/494 and Hands remains 5/5 under the sole release package owner.

Exact 387afe49 is the second verified cut. It deletes the runtime_store_migration module/test, all 29 remaining unshipped core executables, the shipped epiphany-verse-query parallel control plane, the local PowerShell launcher, and its orphan Rider bridge. epiphany-core now owns only epiphany-prepare-compaction; the release bundle owns 25 runtime executables. Focused core, supervisor, and release-construction tests pass 493/493, 32/32, and 21/21.

Exact bf516f99 deletes the agent-memory migration, repair, lifecycle, trait-seed, and SoA authorities with the tests that preserved them. It also deletes the second CultMesh SoA mirror, its timestamp-selected latest head, and its prompt injection. Persona now reads learned memory only from keyed EpiphanyMindPersonaMemoryDocument rows in the assembled Mind view; those documents participate in the exact projection digest and source set. Dead test-only alternate Resident Self and direct Continuity writers are also gone. The final core library passes 483/483 and Persona service re-entry passes 1/1.

Exact 360073a3 was an intermediate reduction of semantic projection. Exact 856648de later proved the remaining cache had no reasoning consumer and deleted the subsystem wholesale. Modeling now seals the live typed Body and keyed RepoModel basis directly; no vector readiness or workspace-coverage gate stands between Body and Modeling.

Exact d1685df8 deletes heartbeat aggregate cognition: personality/mood timing, appraisal, rumination, dreaming, the void routine, and its memory graph. Exact 39dd9fdb deletes the remaining agent-memory identity/generation store, the 64-float utterance vector, generic selfPatch decoding/admission, the phantom sleep-distillation contract, stale aggregate/thread schemas, and nine more constructor/static-vector tests. Native role ingress now refuses unknown model cargo instead of accepting forbidden identity and silently ignoring it. Core passes 455/455 and the provider runtime passes 27/27. The obsolete repository- local Cargo target was 2.5 GiB and was removed; compilation remains in the shared target.

Exact 2164bd0a first collapsed heartbeat to Resident Self and Persona scheduling. It deletes Ghostlight scene scheduling, manual tick/pump/heat/complete and queue-mention controls, adaptive pacing/initiative heat, five fake organ lanes, five dead schemas, and eight self-referential tests: 2,145 deletions against 118 additions. The strict heartbeat state is now v1; the owning binary checks cleanly and the surviving core suite passes 448/448.

The keyed Persona cut completes the separation. Pending Persona mentions, immutable requests, terminal receipts, quarantine records, and retention state are keyed CultCache documents. Persona derives and reserves its own work; the heartbeat daemon has no Persona path. The exact social request envelope is the pass-input provenance. Failed turns produce a new deterministic retry identity, and retention excludes its immutable retired frontier instead of deleting decision history. The old heartbeat bridge/terminal names and writable types have no compatibility reader.

Exact 4d0db2c7 deletes the final singleton heartbeat scheduler: module, binary, schema, store, service, deployment lifecycle, artifact tree, stale repair, pacing/history state, and acknowledgement consumer. Resident Self now owns pressure-to-grant CAS, launch exclusion, leases, terminal receipts, retry, and retention directly. The same cut deletes twenty-one tests that guarded source spelling, constructor copies, or one-line helpers instead of behavior.

Exact 67a3a57b deletes every remaining Rust test that parses its own source: nineteen daemon-supervisor/workspace-coverage string and ordering assertions, plus two exact argument-vector mirrors. This removes 591 lines. The focused native supervisor suite now passes 10/10 and the workspace-coverage behavioral slice passes 74/74. The retained tests exercise validation, owned-store exclusion, process observation, CAS conflict, signed authority, recovery, and re-entry. The deleted tests named several legitimate sequencing invariants but proved none of them. The 4.7-kiloline daemon supervisor is therefore an exposed launch/reconcile authority knot; split it before restoring transition-level proof rather than adding a mock shell around the monolith.

Exact bbe5fcf1 deletes four CultMesh tableau tests and replaces their production-absent seven-cluster Odin/Eve/daemon world with the minimum retired provider rows needed by the surviving authority tests. The real tests still prove that legacy rows cannot become live discovery state, explicit retirement touches only those rows, private-state tool requests refuse, and typed intent/receipt persistence round-trips. The cut removes 396 net lines; CultMesh integration passes 57/57 and the non-test core check is clean.

Exact f236e1cd deletes the six parallel Mind, Substrate Gate, Eyes, Hands, Soul, and Continuity CultMesh contract families. Their DTOs, type/schema constants, registry bindings, field-copy mappers, writers, seed calls, mirror tests, and public reexports are gone. The local Verse now derives summaries directly from each organ's owning CultNet contract factory. This removes 607 net lines; CultMesh integration passes 51/51 and non-test core remains clean. A store containing the deleted derived envelopes refuses under the new registry; there is no migrator or dual reader.

Exact fe591b33 deletes the persisted Verse-policy and global-room-policy families. Their registry rows, schema/type constants, seed-time writers, public writer APIs, and two literal-copy tests are gone; EpiphanyLocalVerseContext projects the fixed policy tables directly. This removes 130 net lines and the focused CultMesh suite remains clean at 49/49.

Exact 4ed3a6e0 deletes nine dead CultMesh document families: the JSON-derived operator snapshot, coordinator receipt, Hands gate, and role-review event; unauthenticated Odin advertisement, Eve surface, daemon capability, daemon-tool intent, and daemon-tool receipt. Their DTOs, registries, parsers, validators, writers, latest slots, prompt branches, exports, fixtures, and ten tests are gone. The provider-row retirement path and the daemon supervisor's retired operator-status migration command are also gone. The hard cut removes 2,398 net lines. Non-test core check, CultMesh 39/39, prompt projection 1/1, and daemon supervisor 10/10 pass.

Next audit the remaining round-trip tests for duplicated CultCache derive coverage: retain tests only when they prove Epiphany validation, monotonicity, authentication, conflict behavior, projection, or an authority boundary.

Exact e8bc0382 deletes the unused CultMesh Persona-speech-audit and Weksa-lowering-receipt shadows plus all four tests that alone animated them. The real Persona and Weksa typed owners remain intact. This removes 432 lines; non-test core check and CultMesh 35/35 pass.

Exact db6a7131 deletes the unused CultMesh operator-run intent/receipt and generic work-loop telemetry shadows. Their runtime-spine declarations, prompt branch, test-only prompt seed, and two tests are gone; native runtime and keyed Mind receipts remain the owners. This is 829 pure deletions. Non-test core, CultMesh 33/33, and prompt projection 1/1 pass.

Exact 75ead942 deletes the four RepoWork aggregate families, their latest heads/loaders, the unused service-execution audit helper, unused Bifrost artifact/metrics/public-proof receipt families, and every test that alone animated those surfaces. The apparent public-proof crossing had no production consumer: its context field was assembled and then ignored. This removes 1,410 net lines. Non-test core, CultMesh 30/30, and prompt projection 1/1 pass.

Exact 753707ff makes persisted runtime-bound cluster topology the sole local-Verse bootstrap witness. The duplicate singleton status document, writer, loader, supervisor precondition, exports, and round-trip test are gone. Two foreign-row preservation tests now use an honest test-local foreign type and a real swarm-brake row instead of borrowing the dead status schema as scenery. This removes another 99 net lines. Non-test core, CultMesh 29/29, the affected readiness and Persona tests, and daemon supervisor 10/10 pass.

Exact 967743cc deletes seven daemon-poke and Bifrost latest/exact loader APIs that only tests called. The remaining tests consume EpiphanyLocalVerseContext, the same view as runtime prompt/supervision paths, and are named for immutable identity, monotonic latest selection, and governed receipt correlation rather than serialization. This removes 85 net lines; non-test core and CultMesh 29/29 pass.

Exact 1ab0859b deletes two more CultMesh tableau tests: one copied static topology strings already exercised at prompt/liveness boundaries, and one still claimed to reject provider-owned bootstrap state after those provider fields had been deleted. This is 78 pure test-line deletions; CultMesh passes 27/27.

Exact ab5b16ec deleted a #[cfg(test)] generic managed-service-policy writer and the two assertions that summoned it. The specialized projector writers and tests that survived that intermediate cut were later deleted with the entire unconsumed subsystem at 856648de.

Exact c977d149 deletes Epiphany's unused v0 Idunn deployment-receipt and aftercare-audit families. VoidBot, gamecult-ops, and the local Odin/Idunn body show that live authority is gamecult.idunn.deployment_manifest.v3 plus signed daemon-health admission; nothing produces the Epiphany-local envelopes. They had no writer, test, or consumer beyond unused context slots and loaders. The cut removes 151 lines; non-test core, CultMesh 27/27, and prompt projection 1/1 pass.

An intermediate producer audit found no production writer for EpiphanyCultMeshDaemonStatusEntry; only CultMesh tests call its public writer. The daemon supervisor and local-Verse context read this manually conjured aggregate, while the real semantic/workspace projectors already publish their own heartbeat/readiness receipts. Do not add a status publisher. In the supervisor split, consume family-owned health directly and delete the generic status/poke mirror once its command paths have moved.

Exact c553868d completes that deletion. It removes the generic daemon status, poke intent/receipt, restart-policy, and scheduler-receipt document families; their registry entries, loaders, writers, local-Verse fields, reconciliation loop, CLI flags, and nine fixture-driven tests; and one helper kept alive only by those tests. The cut is 1,808 net lines. Non-test release-bundle supervisor check passes, CultMesh passes 20/20, and the remaining supervisor tests pass 8/8. No source reference to the deleted schemas or reconciliation path remains. That left an intermediate specialized managed-service path. Exact 856648de later deleted it because neither projector fed a reasoning basis.

Exact f9eeb460 then removes the remaining self-referential supervisor display test and its helper. The test asserted only that a non-authoritative label matched the helper's own branches; correlation and provider status were already projected separately. The workspace recovery test was reduced to its real invariant: the recovery write runs for ExactAlive and not for Missing. Supervisor check and the resulting consequence-bearing suite pass 7/7; the cut removes another 47 net lines.

Exact 30c66080, 008bd493, 7e16e758, and 3312880e remove the generic command entrances, legacy lifecycle lineage, fallback/finite launch modes, and caller-authored service identity/configuration. They subtract 596 net lines. Exact afb223da removes two more tests that guarded formatting and a five-line match, collapses the latter wrapper into its only call site, and advances the managed-service policy schema to v1. Fixed owner, restart mode, unused backoff, decorative update time, and prose notes are gone; old policy rows refuse at the load boundary. The cut subtracts 84 net lines.

Exact ffe707ff removes the global lifecycle latest mirror, local-Verse slot, receipt-history scan, timestamp election, and two tests that preserved those surfaces. Each service now owns one exact current receipt head; its atomic CAS conflicts on concurrent same-service replacement while disjoint services remain independent. The cut subtracts 209 net lines. Focused native checks pass: CultMesh 18/18, workspace process authority 11/11, and supervisor 5/5.

Exact 47454e61 was the last intermediate supervisor split and correctly deleted Epiphany's Windows Task Scheduler control plane. Exact 856648de deletes the remaining native spawn mechanic and both cache-process launch owners. Idunn on Yggdrasil is the sole deployment and daemon-survival authority. The obsolete semantic-projector runbook is deleted rather than preserved as current deployment guidance.

Exact 803e3447 deletes the unconsumed semantic-projector-service-status command and its ad hoc JSON projection: 40 net lines. Typed lifecycle and heartbeat state plus Idunn's signed aggregate health remain the read paths. Supervisor check and 4/4 consequence tests pass.

Exact da8ed840 removed 484 net lines of console-shaped reconcile state. Its remaining supervisor and cache recovery authorities were subsequently deleted at 856648de; signed Idunn health is the operational truth.

Exact 2aeab7a9 deletes the generic organ dependency/proof-profile subsystem, its persisted worker-launch field, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. The universal dependency matrix was never consumed by admission and contradicted direct Body-to-Modeling work. Worker-launch schema v2 and Persona projector prompt v1 make the hard cut. Family validators, typed launch documents, sealed reasoning projections, and concrete invariant owners remain. Focused acceptance is core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1.

Exact ef92e853 deletes the callerless view-lens registry, legacy role and reorientation acceptance-bundle builders, two #[cfg(test)] raw-JSON result parsers, and the six tests that animated them: 797 net lines. The typed runtime result interpreter remains in use by current work and reorientation. Core is 372/372.

Exact a292979d plus formatting receipt 77e817c1 delete the second CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. The keyed status composer remains the sole recommendation projection. Core check and the remaining surface slice 12/12 pass.

Exact 3b94bf6e deletes the duplicate nested status view and the false --coordinator-only/auxiliary label: 25 net lines. Exact 59c5e3a6 deletes the ignored cwd and historical no-op presentation arguments: 12 lines. Exact 7c9b0cf3 deletes the fixed synthetic job table, its role-board cargo and mapping helpers, and its one test: 338 net lines. Role lanes and coordinator routing now derive directly from exact current work. Focused coordinator/status checks pass; the operator thought-sealing test remains 1/1.

Exact 2ce91461 deletes the duplicate scene/planning Mind reconstructions, epiphany-self-policy, unused prompt templates, four counterfeit surface schemas, and ten tests that guarded producers or source text rather than a consequence: 1,723 net lines. Exact 78836f3b deletes eight more unconsumed status tableaux, the pressure calculator production only invoked without telemetry, its unreachable compaction route, one counterfeit schema, and six tests: another 518 net lines. Status now contains Mind identity, exact current work, one action/reason decision, and readable role lanes. Core 356/356, status 1/1, coordinator 8/8, and release construction 19/19 pass.

Exact f10f7fb3 completes that audit: all twelve remaining surface schemas and their ten catalog entries had zero producer and zero consumer. The 692-line pure deletion includes global-revision status shapes, old Rider/Unity/Void bridges, and the artifact-list Persona surface; gamecult.persona_state.v0 remains the portable Persona contract. The publication index contains zero epiphany.surface.* documents.

Exact ab3cacfb deletes thirty-one more producerless contracts: abandoned RepoWork aggregates, CultMesh operator-run shadows, generic launch/accept intents, swarm receipts, Persona artifacts, and every Epiphany-owned Rider and Unity command schema. Runtime sessions now advertise read-only lifecycle state instead of a nonexistent coordinator intent path. Brokkr owns Unity editor capabilities through CultMesh/Eve; a future Rider daemon owns Rider. The same cut found a 415-line prompt-context module and the specialist TOML prompt system were consumed only by their own four tests. Module, exports, configuration, dependency, and tests are deleted. Native core, OpenAI runtime, and release bundle checks pass; the behavioral core suite passes 352/352; the published catalog contains 23 local schemas and none of the deleted families.

Exact 16d85b1b deletes all six remaining direct agent_launch schema tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. The schema tests duplicated stronger provider-lowering and typed-ingress/admission proofs; the source searches proved only that forbidden function names were not spelled in one file. Core checks cleanly and the retained OpenAI runtime suite passes 25/25.

Exact 06f93f70 deletes the test-only OpenAI-to-native request mapper. Two retained runtime tests now construct the canonical native request first and derive the provider request through the production adapter. This removes sixty net lines and makes test ancestry obey the same one-way ownership rule as live inference; focused typed-storage and tool-followup tests pass.

Exact 203bcc41 deletes Epiphany's fabricated Bifrost body-change and GitHub publication family: four CultMesh document types, three singleton latest heads, their constructors, validators, writers, local-Verse advertisement and projection, public exports, and five tests that manufactured both ends of the crossing. A cross-repository producer audit found no live Bifrost or gamecult-ops owner for any of these types. The real Bifrost Persona feedback/delivery stores and signed crossing receipts remain owned by Bifrost. Core checks, release-bundle checks, and the remaining CultMesh suite pass 13/13.

Exact 11d99de1 deletes the producerless HandsPrReceipt family: the CultCache type and registration, dead test-only writer, read API, public exports, relinquishment branch, and two Hands contract advertisements. No production or test caller could create the receipt. Hands now owns local patch, command, and commit consequences; exact remote publication evidence belongs to the remote provider/Bifrost crossing. Core and release-bundle checks pass, and the rebuilt 43-entry schema catalog contains no deleted PR family.

Exact a4af4734 deletes the second CultNet contract author and the false bootstrap witness: six organ-specific contract DTO/factories, the callerless EpiphanyLocalVerseContext query/seed bundle, fixed Verse/room policy prose, the mind_contracts module and its self-affirming test, persisted seven-cluster topology, its dead writer/loader, the supervisor's nonempty-row bootstrap check, and the diagnostic test that kept the loader alive. Exact 03140a47 later deletes the remaining standalone contract mirror; live providers own their CultMesh/CultNet catalogs. Supervisor readiness continues to depend on exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health. Core and release-bundle checks, CultMesh 12/12, and supervisor 4/4 pass. The cut removes 1,005 net source lines.

Exact beb9fd32 deletes the producerless EpiphanyToolCapability family from the tool adapter, runtime registration/mutation table, standalone JSON schema, schema index, and MCP smoke banner. No writer, reader, constructor call, admission path, or test existed. Exact model-request tool definitions, RuntimeToolExecutionBinding, invocation intents, and governed receipts remain the tool authority. The canonical catalog drops from 43 to 42 schemas and keeps tool intent/receipt. Four affected packages compile; the tool runtime passes 14/14 active tests with one explicit live-source test still ignored.

Exact ca2d2cf2 deletes four prose-only Continuity contract families: packet, compaction checkpoint, stale-turn repair, and refusal. They had constants and runtime mutation-table rows but no typed documents, schemas, stores, writers, readers, or tests. At that cut, accepted reorientation still wrote a separate ContinuityRecoveryReceipt; exact fed4b857 later removes that unread copy in favor of the typed Mind decision and commit receipt. Core/release checks pass and the decision-auditable reorientation test passes 1/1.

Exact f8974d52 deletes five prose-only Soul families: generic verification request, invariant check, regression receipt, review receipt, and verification refusal. They had constants and mutation-table prose but no typed documents, schemas, stores, writers, readers, or tests. The keyed repo-frontier verification request and persisted SoulVerdictReceipt remain the real request/result path. Core/release checks pass; focused verification tests pass 3/3.

Exact 201fa192 deleted three prose-only Eyes families: generic evidence request, evidence review, and evidence refusal. They had constants, exports, and mutation-table prose but no typed documents, schemas, stores, writers, readers, or tests. Exact 83611f9b later deletes the never-persisted lookup DTO and the duplicate evidence packet as well. The live Eyes path authenticates the real grant/tool chain and atomically admits keyed Mind evidence/observations with one exact commit receipt.

Next continue the test-authority audit after exact ffcf036f, beginning with remaining direct schema, prompt-rendering, CLI-parser, and CultMesh projection tests. Audit every claimed cross-service contract against its real producer before preserving it. Retain a test only when it reaches Epiphany validation, ownership, authentication, monotonicity, CAS conflict, replay, projection, or an externally visible consequence; delete test-only APIs and fixtures with the tests they animate. Preserve exact current work and the four consequence-bearing supervisor tests. Do not run a full-workspace compile, package, deployment, or Ox root until subtraction closes. Never resume Ox10, Ox12, Ox13, Ox15, or Ox16.

Latest authority cuts

Exact bf997ce0 hard-cuts frontier plan-decision receipts to v2. The two permanently empty legacy worker echoes are gone, decision provenance is required, and unused public type aliases no longer pretend to be contracts. Exact e00ea70f deletes the PID-only process-observation compatibility API and its unused path helper; exact process-incarnation identity remains the only liveness and termination authority.

Exact 87983ffc makes runtime identity immutable bootstrap state and advances runtime spine toward its current v7 shape. Launches no longer rewrite a shared singleton merely to refresh stored_at, an update timestamp, a derived capability list, or temporary evacuation metadata. Existing identity and root-session envelopes are replayed byte-for-byte as strong reads, so disjoint keyed jobs can merge without losing identity substitution protection. The existing current-work capstone now proves the identity envelope survives all launch families unchanged; focused core and OpenAI-runtime native checks pass.

Exact a319146b deletes the public non-atomic worker-launch path that only test fixtures called; executor fixtures now seed through the canonical preparation path. Exact 76fd259b deletes two source-layout tests while retaining actual CLI refusal behavior. Exact b95a3266 removes the superseded, unpackaged epiphany-openai-spine debug binary and two tests that animated its private status helper.

Exact 6f93134d makes the release bundle the sole package owner of every production entrypoint. Leaf libraries disable automatic binaries, Cargo metadata reports no multiply owned binary source, and the release builder's hardcoded shadow target map plus two self-affirming tests are gone. The packaged body reached 22 executable targets rather than 26. Exact c04c3aff collapses the five-reexport auth wrapper crate into the transport's narrow direct codex-login imports. Exact ffcf036f advances runtime spine to v7 and derives the constant native runtime kind instead of persisting it. Focused release construction passes 17/17; the three release-owned daemon targets and current runtime epoch checks compile and pass.

Exact 03140a47 then deletes the packaged runtime-spine CLI and its duplicate Hello/catalog contract mirror, leaving 21 executable targets. Live providers own their CultMesh/CultNet catalogs; model preflight derives accepted document types from the real CultCache registration.

Exact 8c20f896 reduces Substrate Gate from six advertised contract families to its one real immutable repo-access grant. Request, review, refusal, snapshot, and mutation were prose-only constants with no typed body, writer, reader, or consequence. Two constructor-literal tests went with them; the governed-tool allowlist denial test remains.

Exact bb6f2ef6 deletes the fictional Hands rollback receipt and the alternate JSON gate-authority path. The coordinator now passes the exact persisted Hands intent/review IDs directly to the recorder. coordinator-summary.json remains operator display and cannot decide action authority.

Exact d66baa27, 058751fb, 573ddc8b, and 27fe11ae delete the generic runtime-event organ completely. Provider frames and typed model stream events are no longer copied into a second event family; arbitrary CLI callers cannot author event claims; session/job/failure commits no longer create duplicate terminal witnesses; and coordinator start/completion/death, retention, archival, status, CLI, registry, CultNet, and legacy-repair paths no longer read or write event shadows. Session/job state and exact typed terminal documents are the sole lifecycle owners. Core 337/337, model runtime 25/25, coordinator 8/8, swarm 4/4, coordinator-core 4/4, and affected native checks pass.

Exact a78c1802 deletes the final epiphany-core executable: a 366-line pre-compaction checker that re-rendered epiphany-state status, Git status/log, and substring checks over canonical documents. The state steward and Git remain the direct owners; no replacement abstraction was added. Cargo now reports ten executable targets, the state binary and core library check cleanly, and epiphany-core is library-only.

The Persona Discord permit target survives this audit. Bifrost's actual delivery tool consumes its short-lived request-bound signature, and the permit key is intentionally distinct, so the process has a real external consumer and privilege boundary. Deployment is stale: Ygg configuration still targets the old Starfire endpoint and installs no issuer unit. Idunn must repair that before Persona consequence readiness; deleting the consequence gate would falsify the architecture.

Exact d2aee1ce deletes the 97-line epiphany-package leaf CLI and its Cargo target. epiphany-release already owns the same package and inspect operations plus publish, and no live caller named the wrapper. Cargo now reports nine executable targets; the release-construction library and real release binary check cleanly. Each survivor has a deployed lifecycle, external protocol/privilege boundary, or live operator/Idunn contract.

Exact ede5c669 deletes a single-use coordinator runtime-options factory and the test that asserted its literal assignments, a stop-policy literal-membership test that never exercised continuation, a private Unix credential-mode test duplicated by file-level permission proof, and a same-call cache equality. Release construction remains 15/15, coordinator 5/5, and core checks cleanly.

Exact 79292fe3 replaces Repository Body's repeated validate/reopen/reconstruct flows with one authenticated snapshot loader over the runtime route, Body binding, historical observation, and manifest. Basis validation, Mind admission, Modeling projection, and manifest consumers now use that single snapshot. The private scanner-session spelling test and fixture-wide route assertions are gone; public Body behavior remains 22/22, reasoning context 8/8, RepoModel 5/5, Atlas runtime 2/2, and affected current-work proofs pass.

Exact 25d4d1fa begins the runtime-spine cut. Twenty-four public functions had no caller in Epiphany, its live neighboring services, or its deployment/runtime body. Their read wrappers, mutation wrappers, status projections, exports, and tool-status DTO are gone. The audit also found a complete Hands route-relinquishment lifecycle—writer, refusal receipt, Mind receipt, schema registration, and prose—with no caller and no verifier; it is deleted rather than preserved as fictional safety. The live Hands owner remains the exact intent/review/grant and patch/command/commit receipt chain, whose commit atomically creates Verification work. The cut removes 800 source lines and adds three words of corrected live documentation. Core compiles without warnings; the focused keyed lifecycle proof passes, including concurrent Persona and Hands commits. runtime_spine.rs now has 10,990 lines, 73 public functions, and 30 public structs.

Continue there. Delete the last callerless Hands receipt-chain reader and demote its private summary cargo, then audit single-caller archive, status, and retention helpers. Preserve immutable identity, exact job/session terminality, decision audit, model/tool binding, atomic Hands-to-Verification admission, conflict/replay, and retention fences that prevent authority resurrection.

Exact 1fea7bde completes that immediate reader cut: the timestamp-selected Hands-chain query and its selector are gone. Exact 6ccc7dd2 later deletes the private summary cargo and derives the Verification request directly from the owning receipts. Exact 40d00bc5 then removes the detailed planning-eligibility tableau, its two DTOs, and two public APIs. No consumer read its per-candidate blocker fields; Self reduced the entire projection to a boolean already owned by the shared actionable-frontier predicate. Hands and Imagination both still require unchallenged target claims. The focused keyed lifecycle proof passes. The runtime spine now has 10,820 lines, 70 public functions, and 29 public structs.

Exact ac6455c5 removes five dormant transaction-injection callbacks and demotes the completed-session and failed/fulfilled-worker archive actuators behind their retention owners: 107 net deletions. The callbacks were always || Ok(()); exact envelope snapshots, batch CAS, replacement/deletion sets, and retention fences remain unchanged.

Exact 6e600e8d rebuilds the broad current-work proof through the real admitted Imagination direction path, including the exact reasoning basis, decision context, worker result, option digest, Body/domain binding, autonomous proposal binding, and atomic Modeling request. It then deletes the test-only user proposal input, generic writer and selector, User/Persona/Bifrost source variants, constant actor/source/privacy/public-source fields, the legacy hash branch, and the provider's four-way schema branch: 192 net source deletions. Proposal Modeling may route only to Eyes or Imagination; Hands still requires an adopted plan. Mind/runtime writable epochs advance to v5/v8. The broad proof still covers proposal retries and admission, Hands-to-Verification atomicity, and concurrent Persona/Hands commits. Focused core lifecycle, epoch refusal, OpenAI proposal mapping, strict provider schema, swarm, and coordinator checks pass. runtime_spine.rs now has 10,520 lines, 64 public functions, and 29 public structs.

Next, trace the remaining proposal fields against the exact Imagination result, autonomous binding, Modeling request, and final sealed prompt. Delete only constant or duplicated cargo; then resume the public runtime-spine/test-owner audit. Ox17 remains paused and no local package/deployment run is authorized.

Exact 82f4733d completes the constant-field half of that pass. The proposal's desired_outcome always equaled its body, scope_hints was always empty, and proposed_at merely copied the exact bound Imagination result timestamp. All three leave the durable proposal, payload hash, and sealed Modeling projection: 37 net deletions. Proposal/context schemas advance to v2/v4; Mind/runtime writable epochs advance to v6/v9. The exact proposal lifecycle, epoch refusal, provider mapping, and strict-schema tests pass. Next inspect whether the proposal's repository/workspace/thread/runtime coordinates protect anything not already owned by the atomic Modeling request and autonomous binding.

Exact 6fbd8184 answers that question by moving all four coordinates out of inert proposal content. The atomic Modeling request owns them; autonomous validation derives that request from binding runtime plus proposal ID/hash and checks its repository/workspace/thread/runtime against the authenticated Body/domain and exact Imagination chain. The proposal schema is v3 and Mind/runtime writable epochs are v7/v10. The broad lifecycle proof, epoch refusal, and coordinator compile pass. runtime_spine.rs is 10,500 lines. Resume the public runtime-spine/test-liability audit next.

Exact 2dfd8c72 removes the producerless Eyes claim-challenge side channel. No live role result, interpreter, or admission owner could create it; one capstone fixture fabricated an Eyes packet and challenge, called the only writer, and then proved the gating it had manufactured. The contract, writer, registry row, validation/routing branches, active_challenge_ids cargo, and fixture-only packet inserter are gone: 465 net source deletions. Exact keyed claim/frontier envelopes still own stale-state refusal. External evidence must enter Modeling and change the keyed RepoModel rather than let Eyes separately decide Planning or Hands actionability. Claim-obligation documents are v3; Mind/runtime writable epochs are v8/v11. runtime_spine.rs is 10,216 lines, with 63 public functions and 29 public structs. The focused core check, keyed lifecycle proof, and epoch-refusal proof pass without warnings. Continue the public runtime-spine and test-liability audit.

Exact 3eca3394 deletes the thirteen-field aggregate runtime status DTO. Its only behavioral consumers checked present or read runtime_id; the remaining fields forced scans of every session, job, result, tool intent, and tool receipt only to populate a coordinator JSON artifact with no reader. Live readiness now uses one exact optional EpiphanyRuntimeIdentity read. OpenAI schema preflight continues to derive document support from the actual CultCache registration, not a copied status list. The redundant coordinator summary member and runtime-spine-status.json artifact are gone: 96 net source deletions and one public struct removed. runtime_spine.rs is 10,132 lines, with 63 public functions and 28 public structs. The focused core library, OpenAI library, release-owned coordinator, and model-runtime targets check cleanly. Continue the runtime-spine/test-liability audit.

Exact 27c8389c removes PreparedRuntimeSpineHeartbeatJob. Every caller used only its prepared envelope vector; none read the duplicated full job value. The preparation function now returns that exact vector directly. The job document remains inside the atomic batch, so launch identity, admission, and CAS behavior do not change. The cut removes ten net source lines and one public struct. runtime_spine.rs is 10,126 lines, with 63 public functions and 27 public structs. The focused core check plus the OpenAI-library and release-owned model-runtime test harnesses compile cleanly.

Exact bda8d8c6 deletes twelve aggregate-Mind fields from EpiphanyRoleWorkerLaunchDocument and all thirteen constructors. Every producer supplied empty defaults, while the sealed reasoning basis already owns the exact typed Mind projection and source-document versions. Role launch now carries only pass identity plus family-specific authority; there is no parallel scratch/graph/planning/evidence/observation/checkpoint/churn state mouth. The cut removes 255 net source lines. Core and both OpenAI runtime owners compile; reasoning-context tests pass 8/8, and narrow Modeling request, typed failure, and repeated-tool-loop terminality proofs pass. Epiphany still owns no Rider or Unity editor integration: Brokkr owns Unity through CultMesh/Eve, and a future Rider daemon must own Rider.

Exact 5ed5ca88 internalizes the typed-request fulfillment family. The request reference, worker-process status classifier, fulfillment function, typed attempt reader, and fulfillment evidence DTO had no external consumer. They are crate-only now; the DTO's unread request-ID echo and one helper-spelling status-class test are deleted. Exact job/result identity, live and archived structured-result validation, admission-refusal filtering, retry semantics, and Resident Self recovery remain. The cut removes 31 net source lines, two public runtime-spine functions, one public runtime-spine struct, and one test. runtime_spine.rs is 10,124 lines, with 61 public functions and 26 public structs. The core check is warning-free and the complete keyed Modeling/Research/Verification/Hands/Persona lifecycle proof passes.

Exact 7cf6d45c makes the completed model-session archive a private minimal tombstone. Its only behavioral purpose is to prevent retired session, job, model-request, and tool-intent identities from resurrecting while binding the deletion to one exact envelope-chain digest. Seven unread summary fields, the duplicate archive/session identity, and the unused archive-time argument are gone. Decision-bearing reasoning bases, decision contexts, and structured outcomes remain durable outside session retention. The cut removes 59 net source lines and one public struct. runtime_spine.rs is 10,070 lines, with 61 public functions and 25 public structs. Runtime writable epoch is v12; archived-session schema is v1. Core and the release-owned swarm harness compile without warnings; old-store refusal and the full keyed lifecycle proof pass.

Exact 09001d89 minimizes the decision-bearing archived worker attempt. It still preserves exact job/request identity, terminal process class, deletion digest, decision context, structured role result, and terminal job results, so decision audit survives removal of live worker authority. Duplicate archive/job identity, archive timestamp, retired-type/count summaries, and the unused vectors returned by both retention families are gone. The cut removes 41 net source lines. runtime_spine.rs is 10,036 lines, with 61 public functions and 25 public structs. Runtime writable epoch is v13; archived-worker-attempt schema/type is v2. Core and swarm compile without warnings; reasoning-context audit tests pass 8/8, and old-store refusal plus the full keyed lifecycle proof pass.

Competitive Eyes/Imagination pass

notes/munder-difflin-launch-intelligence-2026-08-23.md distills the 2026-08-22 Munder Difflin launch, its growth trail, product/source architecture, HN criticism, public failure ledger, pricing and trust boundaries, and implications for Epiphany, Aquarium, CultMesh, Bifrost, Idunn, and Model Atlas.

The durable signal is not an architectural victory claim. Munder has real category heat and is materially ahead at packaging, provider reuse, cross-platform reach, visual comprehension, distribution, community feedback, and commercial experimentation. Users appear to want an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness. Retention, reliable autonomy, and paid conversion remain unproven. The note proposes falsifiable golden-path, Aquarium, orchestration-overhead, memory, Body-binding, provider, federation, and willingness-to-pay experiments; none is adopted roadmap authority. The test-authority audit and Ox17 brake remain unchanged.

Interface correction: Epiphany does not currently expose its internal faculty and ecosystem vocabulary through a general operator UI. Beyond engineering tools, the concrete human-facing surface is Persona projection into shared asynchronous chat. CultMesh remains the projection-neutral state API. A social Aquarium, dense operator cockpit, TUI, and audit surface may use distinct Eve compositions and interaction models over the same provider-owned facts; no one projection should fossilize its layout into shared truth.

Operational state that matters

• Original c011 resident and Heartbeat containers are not running; both exited 255 on 2026-08-11. Their named volumes are quiescent historical evidence.
• Historical accepted live release: source 465af24d, c011 package SHA-256 089e0005; it is not the current source body.
• The old Yggdrasil capacity measurement is obsolete. The upgraded host is the intended swarm body and CI/CD machine. Idunn owns source-change compilation, testing, release construction, deployment, and daemon survival there; its current deployment truth belongs to Idunn's typed deployment receipts.
• Idunn is active, provenance-exact, and independent at installed source 8b972715c47731f2418d0c423cb0dd2076940bd7. Exact Epiphany source d2ca6630 remains the current symlink target; Starfire remains outside the compilation path. Production Epiphany units are inactive after exact rollback and deployment.env is absent. Idunn has zero restarts.
• Exact 9b9b5c85 passed Idunn's native gate under receipt SHA-256 6c6a71359f8c31297419665d2872f6982a89f84e197d71fc5b36a7fc86216093 and remains sealed as release sha256-30a910785a380224bbdbd56a7b742c8d058fa70cb72dab3562e3907903e0d191. A foreign-target helper restarted Idunn during its candidate transaction; exact rollback prevented false admission but exposed the missing cross-target transaction mutex.
• OpenRouter stealth/ox-alpha credential readiness is proven inside Resident Self's mount namespace. The production organism remains braked. Ox decisions exist only in isolated failed capstone roots and do not authorize production state.
• Bifrost public crossing remains active on Yggdrasil and publishes typed readiness. Its current Idunn observation is diagnostic-only rather than a lifecycle-authenticated admission. Frozen private Ox12 must prove Persona effects and exact context without emitting public speech.
• Model Atlas code and isolated component proofs remain accepted. No live inter-swarm collaboration has yet run. Signed Gate 1 sight, brake freeze, autonomous cascade, partition exercise, and endurance remain open.
• GitHub's August 2026 service incidents were external provider downtime. They do not count as Epiphany source-identity or grant failures; successful lookup and denial-before-network remain separately required evidence.

Git/worktree caution

The shared worktree contains unrelated pre-existing Core/CultMesh modifications and a dirty vendor/cultnet-rs submodule. Preserve them. Stage only intentional migration/documentation paths. Do not use reset or checkout to clean the tree.

Re-entry

Read, in order:

1. state/map.yaml
2. this handoff
3. notes/epiphany-current-algorithmic-map.md
4. notes/epiphany-fork-implementation-plan.md

Then run the shared-target epiphany-state.exe status. Persisted next action is orientation, not automatic authority to resume a live Gate.

Exact 7374be5e makes current-work projection honest about its input. One pulled CultCache snapshot now feeds Mind assembly, keyed RepoModel assembly, Research and Planning lifecycle, Hands readiness, Modeling launches, reasoning-basis assembly, and Reorientation. The former path-based helpers could reopen the same .cc file up to six times while claiming to emit one state projection; three wrappers and numerous repeated reload sequences are gone, and Research plus Verification admission reuse their already authenticated cache. The cut adds no schema, dependency, target, or process and removes one maintained line net. Core check, current-work 3/3, reasoning-context 8/8, Reorientation 1/1, Mind determinism 1/1, and RepoModel determinism 1/1 pass. The focused build produced 2.0 GiB across 2,867 files; cleanup restored only the authenticated 1,776,640-byte state inspector.

The Connector architecture needs no second daemon or generic provider layer. The independent daemon owns Codex credentials, caller admission, provider transport, and replay. Its lean typed client is the ABI stub shared by Epiphany and Ghostlight; removing that stub would merely duplicate encryption and framing in both consumers. Consumers continue to own their exact native and provider requests, prompts, tools, decisions, and state admission.

Exact 5f1bea39 extends the same snapshot law through typed fulfillment. Research, Verification, Proposal Modeling, PlanMind continuation, fulfilled worker archival, and Resident Self now validate an immutable result against the cache they already pulled instead of reopening runtime state mid-decision. The generic path wrapper is deleted; provider execution retains the sole path-based role-result CAS writer. The cut is 17 maintained lines net additive because the private cache-local seam replaces repeated physical reads without adding schema, dependency, target, process, or authority. Core check, current-work 3/3, reasoning-context 8/8, structured-failure refusal, and the release-owned swarm entrypoint pass. The focused build produced 2.2 GiB across 3,189 files; cleanup again restored only the exact authenticated state inspector.