61 lines
4.4 KiB
Markdown
61 lines
4.4 KiB
Markdown
# Perfect Machine audit roadmap
|
|
|
|
Updated: 2026-08-12
|
|
|
|
## Operating state
|
|
|
|
The live shakedown is paused for architectural consolidation. Source development
|
|
continues on `codex/epiphany-shakedown-live`; accepted live c011 remains exact
|
|
`465af24d` on Starfire, braked at revision 384 with no active lease, admitted
|
|
work, or defunct children. Yggdrasil is the public crossing, never the forge.
|
|
|
|
No new capability surface or live-body replacement is authorized until the
|
|
consolidation gates below close.
|
|
|
|
## Architectural consolidation
|
|
|
|
| Invariant | Owner | Current evidence | Remaining gate |
|
|
|---|---|---|---|
|
|
| Durable request identity excludes mutable transport provenance | `causal_work_identity` | Proposal Modeling, Research, Planning, PlanMind, and Admitted Model Direction use one pure derivation owner; stale thread restoration refuses byte-identically | replay packaged coordinated circuits after worker-attempt extraction |
|
|
| Immutable GitHub identity has one grammar | `ImmutableGithubSource` | Modeling selection, Eyes execution, and Mind authentication share one parser/canonicalizer; malformed identities fail at Mind | copied packaged public success and no-grant denial |
|
|
| One worker attempt has one process/result/archive authority | `runtime_worker_attempt` | typed status classes and request association are shared by runtime, resident, and coordinator; core 684/684 (+1 ignored), tool runtime 14/14 (+1 ignored), OpenAI runtime 39/39 | replay packaged settlement/archive circuits |
|
|
| Canonical state admission has one writer | coordinator state transaction / Mind | CAS companions and negative source guards accepted | continue legacy-writer audit only when source evidence finds a live seam |
|
|
|
|
## Worker-attempt extraction boundary
|
|
|
|
- Owner: `runtime_worker_attempt` owns immutable launch, exact process claim,
|
|
semantic result terminality, authenticated fulfillment, and archive tombstone.
|
|
- Inputs: typed launch, runtime job, exact process identity/activation token,
|
|
semantic result, exact OS observation, Mind admission evidence, and the
|
|
resident-live request set.
|
|
- Outputs: typed attempt projection, allowed transitions, fulfillment evidence,
|
|
and failed/fulfilled tombstones.
|
|
- Derived state: runtime job/result/event are audit projections; resident
|
|
grant/ack are scheduling projections; coordinator receipt closes an
|
|
incarnation. None independently owns attempt success.
|
|
- Forbidden writers: Heartbeat, coordinator receipt, generic job status,
|
|
process liveness without exact identity, retention, and archived tombstones
|
|
cannot synthesize semantic fulfillment.
|
|
- Cut line: remove process-status string matching and repeated typed-request
|
|
family arrays from `runtime_spine`, `resident_self`, and `coordinator_launch`.
|
|
Do not merge stores or create a universal lifecycle service.
|
|
|
|
## Shakedown acceptance matrix
|
|
|
|
| Circuit | Positive | Negative | Timeline/restart | Status |
|
|
|---|---|---|---|---|
|
|
| Heartbeat -> Self -> coordinator -> worker -> settlement | packaged genuine workers | no dual grant/process authority | endurance, SIGTERM, restart, receipt-order skew | accepted on c011 ancestry |
|
|
| Eyes immutable public source -> Mind | provider source proof and source tests | malformed identity rejected by Mind; missing grant source test | copied packaged success/denial pair | source complete, live gate open |
|
|
| Proposal/Planning causal identity | deterministic shared owner | stale carrier cannot restore thread | cross-incarnation replay | source complete |
|
|
| Hands -> Soul -> Modeling -> Mind -> Self | bounded adjacent circuits | bypass/substitution refusals | fresh-repository full loop | capstone open |
|
|
| Persona -> Bifrost -> public consequence | signed failure/unknown/no-repost | private-state and permit refusal | successful receipted consequence | blocked by external credential |
|
|
| Worker process -> result/death -> archive | genuine Linux workers and zero-zombie reaping | resurrection and competing retry refused | both receipt orderings and restart | source extraction complete; packaged replay pending |
|
|
| Eve/CultUI operator interface | typed state surfaces | renderer cannot own truth | load/transition/settled/re-entry probes | open |
|
|
|
|
## Immediate order
|
|
|
|
1. Commit and push `runtime_worker_attempt`.
|
|
2. Replay the accepted worker settlement/archive circuits.
|
|
3. Resume shakedown with the packaged public Eyes success/denial pair.
|
|
4. Run the fresh-repository full-organ capstone before any deployment-ready
|
|
claim.
|