1132 lines
75 KiB
Markdown
1132 lines
75 KiB
Markdown
# Epiphany Current Algorithmic Map
|
|
|
|
## Coordinator cold start and source-regather ownership (2026-07-16)
|
|
|
|
- Owner: typed `UserObjectiveIntake` owns first objective/state creation. It is
|
|
seed-only, atomic, idempotent for identical input, and refuses replacement.
|
|
- Eyes owns source gathering. An accepted CRRC `Regather` judgment becomes
|
|
`RegatherManually`, which Self maps to Research; the continuity judge does not
|
|
recursively relaunch itself after its judgment is accepted.
|
|
- Modeling owns Body mapping only after source inspection. Research, Modeling,
|
|
and Verification share bounded repository read/Git tools; tool receipts are
|
|
operator-safe evidence while direct thought stays sealed.
|
|
- Mind owns admission. Provider JSON Schema is a formatting projection, not
|
|
authority. Canonical worker-result parsing, exact launch Body-basis replay,
|
|
and Mind review/admission decide whether a RepoModel patch exists.
|
|
- Derived state: status, role boards, and coordinator decisions read one
|
|
canonical typed role/reorient result path. Display synthesis cannot remember
|
|
a finding that coordinator signals forget, or vice versa.
|
|
- Forbidden writers cut: sibling-path local-Verse inference, fake checkpoint
|
|
preparation, recursive reorientation after accepted regather, duplicate
|
|
display/coordinator result readers, and JSON null treated as a state patch.
|
|
- Failure lifecycle: failed and completed-unreviewable results require an
|
|
explicit supersession receipt before relaunch. Exact repeat is idempotent;
|
|
conflicting acceptance authority is refused.
|
|
- Current live evidence: Eyes produced and Mind accepted a code-grounded result.
|
|
Modeling subsequently produced a source-grounded Body-bound RepoModel
|
|
proposal, but Mind refused it because `Evolution` attempted an unrequested
|
|
frontier upsert. Ordinary evolution owns nodes and edges only; frontier
|
|
mutation remains request-bound. A second proposal correctly removed frontier
|
|
operations but invented a domain id and illegal lifecycle because launch
|
|
context exposed semantic nodes without the canonical aggregate shape.
|
|
Modeling launch context now includes current model revision/hash, exact
|
|
existing domains, and legal repo lifecycles. A fresh admission is pending.
|
|
|
|
## Observation and bootstrap authority correction (2026-07-12)
|
|
|
|
- Owner: diagnostics only project persisted CultMesh state; they never initialize it.
|
|
- Bootstrap owns static policy, topology, schema, brake, and organ-contract declarations. It does not own daemon liveness or provider availability.
|
|
- Daemons own heartbeat/status documents. Missing status produces no observed daemon row; declared targets remain separate and are never promoted to presence or `ready` by a reader or seeder.
|
|
- The provenance-free v0 Odin advertisement, Eve surface, and daemon-tool families are quarantined legacy vocabulary. Live provider directories return no rows from them; missing provider state produces no synthetic row.
|
|
- Forbidden writers removed in this pass: read-command calls to `seed_epiphany_local_verse_context`, loader fallback constructors, and bootstrap's default-ready daemon-status loop.
|
|
- Next authority cut: requester commands may author intents, but Bifrost, GitHub, tool providers, Eve providers, and daemon lifecycle owners must author their own response receipts.
|
|
|
|
## Declared topology versus observed presence (updated 2026-07-15)
|
|
|
|
- Owner of declaration: explicit bootstrap persists seven faculty routes, desired private-Verse addresses, and daemon/Eve targets as configuration.
|
|
- Owner of presence: a provider-authored daemon status/heartbeat is the only input that creates an observed daemon row.
|
|
- Outputs keep the distinction in their names: `declaredFacultyCount`, `declaredPrivateVerseRouteCount`, `declaredDaemonTargetCount`, and `observedDaemonCount`.
|
|
- Restart-policy sight may enumerate desired targets with `daemonStatus=unobserved`; that supports Idunn reconciliation but does not materialize a daemon.
|
|
- Prompt context labels topology as declared routes and targets. It cannot imply those addresses are inhabited.
|
|
- Forbidden substitutions: topology rows cannot become daemon or agent counts; daemon heartbeats cannot become agent counts; configured private-Verse ids cannot become active Verse counts.
|
|
- Cut line: the synthetic `unknown_daemon_status` constructor is deleted. A fresh bootstrap has seven declared targets and zero observed daemons; one persisted provider status yields exactly one observed daemon.
|
|
|
|
## Bifrost body-change request path (2026-07-12)
|
|
|
|
- Owner: the calling Hands/requester owns the body-change intent.
|
|
- Inputs: repository, branch, change summary, justification, changed paths, verification/review receipt references, authors, and credit subjects.
|
|
- Output: one persisted `gamecult.bifrost.body_change_publication_intent`; command status is `pending-bifrost`.
|
|
- Derived sight: requester-owned receipt-directory and publication surfaces show the pending intent and the absence of a provider response. There is no local Bifrost ledger or closure oracle.
|
|
- Forbidden writers: the requester CLI no longer constructs or writes Bifrost acceptance, ledger attribution, GitHub publication, PR, commit, publication URL, or credit receipts.
|
|
- Response owners: Bifrost may answer with its publication receipt; the GitHub publication adapter may answer only after real substrate evidence exists.
|
|
- Negative proof: after request submission, latest intent is present while latest Bifrost publication and GitHub publication receipts are absent.
|
|
- There is no Epiphany-local `bifrost-ledger` or accounting closure surface.
|
|
Missing provider response remains missing with no local follow-up command.
|
|
Provider closure requires a future authenticated provider ingress/admission
|
|
witness; typed local document presence is insufficient.
|
|
|
|
## Daemon tool request path (2026-07-12)
|
|
|
|
- Owner: the requesting agent owns the invocation intent; the advertised host daemon owns the response receipt.
|
|
- Input: a persisted capability plus requester identity, requester cluster, payload reference, and bounded reason/summary.
|
|
- Output: one `epiphany.cultmesh.daemon_tool_invocation_intent`, status `pending-provider`, and the host daemon id as `responseOwner`.
|
|
- Unknown host status does not block request queuing and is never promoted by the requester.
|
|
- Forbidden writers: `invoke-tool` cannot accept or synthesize receipt id/status, result reference, or result summary; it no longer executes local readback functions and labels them daemon results.
|
|
- Negative proof: request intent persists, latest provider receipt remains absent, and response-shaped CLI fields are refused.
|
|
|
|
## Daemon lifecycle request and heartbeat paths (updated 2026-07-15)
|
|
|
|
- Owners: Self/operator requests intervention; Idunn owns poke intent, command-attempt receipt, restart policy, and backoff; `epiphany-cluster-daemon` alone owns its provider heartbeat/status envelope.
|
|
- Inputs: persisted provider status, the heartbeat observed before intervention, restart policy, scheduler staleness observation, and the real command result.
|
|
- Outputs: immutable poke intent/receipt v1 events plus an atomically advanced chronological latest pointer. Exit zero yields `awaiting-provider-heartbeat`; command failure yields `restart-failed`.
|
|
- Derived state: scheduler staleness, lifecycle attention, receipt-directory resolution, and Idunn backoff are observations of provider state and attempts. They are not provider status.
|
|
- Forbidden writers: poke callers and the supervisor cannot assign provider status, operator action, or `last_heartbeat_utc`; command success cannot mint `ready`; stale status cannot be resolved by a heartbeat older than the completed attempt.
|
|
- Shared paths: manual reconcile and scheduled reconciliation use the same attempt primitive. Both retain restart pressure until a provider-authored heartbeat causally newer than the completed attempt proves recovery.
|
|
- Cut line: the supervisor's provider-status writer and synthetic heartbeat advancement are removed. Generated attempts use unique identities; exact retry is idempotent, identity collision is refused, and delayed replay cannot rewind `latest`.
|
|
- Verification: the survival rehearsal preserves the provider envelope across two successful restart commands, observes two distinct awaiting receipts, then publishes a real provider heartbeat and proves receipt resolution plus failure-count reset.
|
|
|
|
## Provider discovery and heartbeat authority (updated 2026-07-15)
|
|
|
|
- Owner: `epiphany-cluster-daemon` owns only its liveness heartbeat/status envelope. No central process currently owns provider advertisement, Eve composition, or hosted-tool availability.
|
|
- Inputs: heartbeat accepts persisted topology identity and daemon-local liveness evidence. Topology `eve_surface_id` is routing/address metadata only; it is not proof that a surface exists.
|
|
- Outputs: heartbeat writes liveness only. Live Odin, Eve, and tool directories remain empty until a future provider-authored contract is admitted.
|
|
- Derived state: topology, labels, expected routes, and test-only templates may describe stable addresses and legacy shape. They cannot become provider presence, composition content, supported actions, or executable capability.
|
|
- Forbidden writers: generic bootstrap, heartbeat, query CLI, and central template builders cannot publish the provenance-free v0 Odin advertisement, Eve surface, or daemon-tool families. Live consumers ignore those families, and explicit bootstrap retires any stale rows of exactly those types.
|
|
- Cut line: `publish_epiphany_cultmesh_provider_state` and the heartbeat call to it are deleted. The seven centrally synthesized surfaces and their tool claims are no longer live state.
|
|
- Re-admission invariant: provider discovery returns only after an owning provider emits a provenance-bearing typed contract whose origin can be verified; actions additionally require a real dispatcher and receipt path.
|
|
|
|
## Persona feedback and typed Imagination consideration boundary (updated 2026-07-18)
|
|
|
|
- Eve is presentation only. Epiphany has no Eve connection intent or receipt
|
|
document, writer, reader, prompt projection, query action, receipt-directory
|
|
row, or tool claim. Presentation connectivity cannot admit feedback or become
|
|
cognition authority.
|
|
- Daemon-tool invocation requests likewise remain pending until the advertised host daemon or authenticated ingest boundary supplies the typed response. Local response construction/writing/validation is test-only; aggregate smoke and receipt-directory projection prove intent-present/receipt-missing instead of manufacturing host acceptance.
|
|
- Idunn deployment and aftercare outcomes have no local production writer. The synthetic deployment-config family smoke and its green aggregate MVP-gate handoff are deleted; config audit/runbook remain pre-deployment surfaces, while typed Idunn readers await genuine daemon-authored ingest.
|
|
- Bifrost artifact-acceptance and metrics requests remain open until actual Bifrost/Maintainer receipts are ingested. The stale response-closing request-family smokes, accounting bundle, wrapper mode, and aggregate green gate are deleted.
|
|
- Repo-work readiness reports are sight only. The generic readiness-review approval command and writer are deleted because one caller supplied four unresolved reviewer labels. `repo.readiness_review_request` now assigns routing to Self, lists Maintainer/Soul/Mind/Bifrost as independent required reviewers, and names no readiness-approval owner; typed review readers await genuine multi-organ/provider evidence.
|
|
- Interpreter Brief is preparation cargo authored by Imagination from accepted public pressure. It requests Mind interpretation and remains `interpretation_admitted=false`; it is not Mind-owned state until a genuine Mind path supplies and admits interpretation evidence.
|
|
- Repo collaboration policy/topic files are proposals, not live social or renderer contracts. Imagination authors them, Persona owns discussion, Persona/Mind review policy, Mind admits repo policy, Bifrost owns publication, and requested public-room/Eve-surface identifiers remain unpublished until provider receipts exist. Epiphany does not own downstream Eve/TUI/GUI composition.
|
|
- The deterministic `repo.tool_capabilities` and `repo.eve_surface` safe families are deleted. Expected tool ids and invented surface/row/lowering catalogs cannot substitute for host advertisements or provider-published composition graphs. Live paths are typed tool requests/host receipts, Odin discovery, authenticated Bifrost feedback delivery, and provider-owned publication.
|
|
- `repo.body_manifest` is deleted. An unconsumed `epiphany.toml` that invents Body/Verse/Eve identity and capability hints is not observed runtime state or admitted birth configuration. Runtime state, repo birth receipts, and provider advertisements own those facts.
|
|
- Doctrine update requests split authority: Imagination authors, Self routes, Maintainer reviews, Soul verifies, Mind admits doctrine state, and Hands mutates `AGENTS.md` under receipts. There is no Maintainer/Mind composite owner or OR gate.
|
|
- Closure has no substring authority. Worklog, planning/checklist notes, managed/status sections, and task cards are explicitly presentation-only; closure relies on committed target/path/blob evidence instead of treating formatting text as Soul truth.
|
|
- Deployment requests split Self routing from independent Maintainer/Soul/Mind/Bifrost review and Idunn-only execution. Maintainer review cannot impersonate Idunn deployment; only Idunn deployment and aftercare receipts prove outcomes.
|
|
- PR requests split Self routing, Bifrost publication gating, Hands execution, and GitHub provider outcomes. GitHub receipt authorship does not grant publication-policy authority.
|
|
- Artifact acceptance requests split Self routing, Maintainer acceptance decisions, and Bifrost accounting. Acceptance receipts and accounting ledger rows no longer claim one composite owner.
|
|
- Metrics requests split Self routing, Bifrost accounting custody, and Maintainer review-load evidence. Spend/review receipts are observations and grant no spend or ledger authority.
|
|
- `repo.planning_brief` is deleted. It contained no candidate work-item records and let copied global catalog/schema/closure constants self-attest as per-item planning and readiness evidence. The live preparation chain is consensus draft -> interpretation request -> objective draft -> Mind adoption.
|
|
- There is no aggregate repo-swarm MVP gate. The former smoke manually aggregated fixture summaries into green rows and `demoReady=true`; it and its wrapper are deleted. Whole-organism readiness requires a live-fire path whose claimed consequences are observed at their owning boundaries.
|
|
- Bifrost owns authenticated Persona-feedback admission. Its signed packet is
|
|
feedback-only pressure, not an Eve connection, Persona command, objective, or
|
|
work proposal.
|
|
- Self owns an immutable Imagination consideration request binding one admitted
|
|
feedback packet digest to one exact admitted Modeling revision/hash/receipt
|
|
and one fixed question enum. Feedback prose is transported only as quoted
|
|
evidence.
|
|
- Imagination owns a proposal-only consideration candidate with `suggest`,
|
|
`hold`, or terminal `no_fit` disposition. The candidate has no state patch,
|
|
model patch, frontier candidate, Hands route, release, or deployment mouth.
|
|
- A separate Self review request is required before a suggestion may enter
|
|
Modeling review. It grants proposal-review authority only; it does not mutate
|
|
the map or adopt work.
|
|
- Eve and Persona render or discuss derived results. They do not own admission,
|
|
cognition, result completion, or adoption. The former Eve-dependent feedback
|
|
and synthetic consensus-receipt shapes are obsolete.
|
|
|
|
## Public-proof submission boundary (2026-07-12)
|
|
|
|
- Request source: an existing redacted `repo_work_public_proof` document is the complete pending publication cargo.
|
|
- Consumer command: `bifrost-public-proof` selects that proof and reports `pending-bifrost`; it writes no new receipt.
|
|
- Bifrost owner: ledger attribution, review and credit receipt binding, public destination, publication URL, publication status, and final receipt.
|
|
- Forbidden writers: the caller-facing command rejects all Bifrost result fields and leaves publication coordinates null.
|
|
- Negative check: absence of a pending proof fails without writing a publication receipt; response-shaped fields are rejected before mutation.
|
|
|
|
## Bifrost accounting request boundaries (2026-07-12)
|
|
|
|
- Artifact acceptance source: Mind-admitted `repo.artifact_acceptance_request`; caller output is pending `Maintainer/Bifrost` with null acceptance coordinates.
|
|
- Metrics source: Mind-admitted `repo.metrics_request`; caller output is pending `Bifrost/Maintainer` with null accounting coordinates.
|
|
- Forbidden artifact writers: caller cannot provide artifact/proof/review/ledger/receipt/status/accepted-by results.
|
|
- Forbidden metrics writers: caller cannot provide accepted artifact, model spend, review load, credit, proof, summary, receipt, or status results.
|
|
- Negative proof: missing requests fail without receipt mutation and response-shaped arguments fail before lookup or write.
|
|
|
|
## Operator snapshot authority boundary (2026-07-12)
|
|
|
|
- Owner: operator snapshot adapter owns only a bounded summary of an edge status artifact.
|
|
- Runtime spine owns daemon-tool execution intent and receipt truth.
|
|
- Forbidden projection: `/tools/invocations` JSON cannot be promoted into canonical daemon-tool schemas by snapshot import.
|
|
- Output explicitly returns null tool intent/receipt fields and `toolInvocationAuthority=runtime-spine-only`.
|
|
- Negative proof: forged accepted tool JSON produced a snapshot but no canonical intent or receipt.
|
|
|
|
## Fixture store quarantine (2026-07-12)
|
|
|
|
- `epiphany-verse-query smoke` owns synthetic contract fixtures only.
|
|
- Its only writable body is `.epiphany-smoke/verse-query-default/local-verse.ccmp` with runtime `verse-query-default-smoke`.
|
|
- Generic local Verse bootstrap owns policy, declared topology, initial brake,
|
|
and organ contracts only. It does not publish Odin provider
|
|
advertisements, Eve surfaces, or daemon-hosted tools. Those families require
|
|
provider publication; discovery preserves their absence.
|
|
- The generic Verse query CLI has no provider-advertisement preview or Odin
|
|
publication command. Provider bodies must publish their own discovery state;
|
|
central declared topology cannot be lowered into `active`/`daemon-live`
|
|
compatibility presence.
|
|
- `epiphany-cluster-daemon` owns heartbeat liveness only. Heartbeat/serve does
|
|
not publish Odin advertisements, Eve surfaces, or hosted tools. The former
|
|
daemon-ID-bounded central publisher is deleted.
|
|
- Cluster daemons never bootstrap the local Verse and never load its full
|
|
context. They require persisted topology, read narrow liveness, then write
|
|
only their bounded heartbeat. Explicit operator bootstrap
|
|
owns policy/topology/contract initialization.
|
|
- `epiphany-daemon-supervisor` also requires explicit persisted bootstrap for
|
|
every production lifecycle, policy, scheduler, runbook, audit, status, and
|
|
control path. Only its two synthetic audit-smoke commands may initialize
|
|
fixtures, and only beneath `.epiphany-smoke`.
|
|
- In `epiphany-verse-query`, only explicit seed commands and the fixed
|
|
quarantined smoke initialize local Verse state. Every operator/requester
|
|
mutation requires persisted status and topology before writing its bounded
|
|
brake, poke, tool, Eve, Bifrost, metrics, artifact, or feedback document.
|
|
- Coordinator launch-context assembly also requires persisted status and
|
|
topology. Rendering a worker prompt cannot initialize shared state. Its
|
|
standalone smoke accepts no path arguments and writes only beneath
|
|
`.epiphany-smoke`.
|
|
- Bifrost publication/GitHub/public-proof/artifact/metrics response constructors
|
|
are test-only. Production
|
|
retains typed schemas and readers for provider-authored ingest, but no local
|
|
shipped binary owns or writes those response documents.
|
|
- Bulk seven-daemon `ready` construction/writing is also test-only. Production
|
|
loaders enumerate topology keys without manufacturing status; only narrow
|
|
single-daemon heartbeat/observation writers remain. Aggregate synthetic
|
|
readiness exists solely inside the fixed Verse smoke body.
|
|
- Topology-derived Odin advertisement, Eve surface, and tool-capability builders
|
|
survive only as test fixtures for legacy v0 document shapes. Live consumers
|
|
ignore provenance-free v0 rows, and explicit bootstrap retires them. Topology
|
|
`eve_surface_id` remains address metadata, not availability evidence.
|
|
- Generic bootstrap owns declarations and initial control state, not operator
|
|
observation. The template-based operator-status writer and its writerless
|
|
schema/context/prompt/reader family are deleted. Operator snapshots remain
|
|
source-artifact-derived documents.
|
|
- Agent-state SoA sync requires an existing bootstrapped Verse before mirroring
|
|
the persisted agent store. SoA report is filesystem-pure on a missing store.
|
|
Wrapper mode `agent-state-soa` explicitly composes sync then report; the
|
|
report itself never refreshes canonical state.
|
|
- Merely naming a CultMesh store does not create its body. Query, cluster-daemon,
|
|
and daemon-supervisor parsers perform no filesystem writes; missing status or
|
|
topology prerequisites preserve absence because CultCache pulling bypasses
|
|
lock acquisition when the backing file is absent. Full context query refuses
|
|
a nonexistent store. Explicit bootstrap or a real writer owns body creation;
|
|
individual loaders do not carry duplicate absence compensators.
|
|
- Store/runtime overrides fail before fixture seeding or receipt construction.
|
|
- Negative proof: targeting `state/local-verse.ccmp` was rejected and its SHA-256 did not change.
|
|
- Positive proof: the built-in quarantined smoke completes successfully and reports its quarantine coordinates.
|
|
|
|
## Operator-run completion receipt boundary (2026-07-12)
|
|
|
|
- Intent owner: operator orchestration writes run id, mode, roots, limits, and artifact coordinates before execution.
|
|
- Completion evidence: matching latest intent plus a valid JSON result inside the canonical artifact root, modified at or after intent creation.
|
|
- Receipt status is derived as `completed`; callers cannot submit status.
|
|
- Forbidden evidence: missing, non-JSON, pre-intent, out-of-root, or mismatched-run artifacts.
|
|
|
|
## Daemon-supervisor install authority boundary (2026-07-12)
|
|
|
|
- Plan commands force non-execution and may only write planned artifacts/receipts.
|
|
- Execute commands force execution intent and must pass the existing elevation gate before service-manager mutation.
|
|
- Wrapper command identity matches the Rust command exactly; no hidden `--execute-install` switch selects reality.
|
|
- Ambiguous install aliases are not accepted.
|
|
- Negative proof: hostile plan flag cannot mutate; execute without elevation produces an explicit refusal receipt.
|
|
|
|
## Standalone receipt fixture boundaries (2026-07-12)
|
|
|
|
- Deployment-family fixture receipts live only in a disposable repo under `<root>/.epiphany-smoke`.
|
|
- Weksa fixture receipts live only at `.epiphany-smoke/weksa-interlingua/local-verse.ccmp`.
|
|
- Neither smoke accepts a caller-selected receipt store.
|
|
- Redirect arguments fail before synthetic receipt construction.
|
|
|
|
This is the source-grounded map of the live machine. Historical route and
|
|
bridge anatomy belongs in git history and evidence ledgers, not here.
|
|
|
|
## Objective
|
|
|
|
Epiphany is a native typed organism. Persistent Mind, coordinator policy,
|
|
worker lifecycle, organ receipts, prompt context, operator surfaces, and Verse
|
|
publication are owned by Epiphany Rust/CultCache/CultMesh/CultNet organs.
|
|
Vendored Codex retains Codex-native behavior and the OpenAI-compatible
|
|
authentication/model-transport reliquary. It owns no Epiphany state, prompt,
|
|
scheduler, route, notification, or interface contract.
|
|
|
|
## Authority Map
|
|
|
|
| Owner | Inputs | Outputs | Invariant |
|
|
|---|---|---|---|
|
|
| `epiphany-state-model` | typed state fields | `EpiphanyThreadState` and prompt projection | State is typed; rendering is not authority. |
|
|
| `coordinator_state_transaction.rs` | expected state, next state, typed companion envelopes | one atomic canonical-state transaction | Sole production writer of `THREAD_STATE_KEY`; companions cannot impersonate state. |
|
|
| `coordinator_state.rs` | current state plus validated ordinary update | proposed next state and transaction request | Owns update meaning, not persistence. |
|
|
| `coordinator_launch.rs` | validated launch plan, state, runtime envelopes | state-plus-launch transaction request | Launch constructs runtime companions; the transaction owner commits them. |
|
|
| `coordinator_acceptance.rs` | reviewed finding, Mind review, commit receipt | state-plus-Mind-witness transaction request | Acceptance owns admission meaning; the transaction owner commits its witnesses. |
|
|
| `thread_state_store.rs` | typed state entry | low-level CultCache codec/read access | Substrate, not policy; it exposes no production writer. |
|
|
| `coordinator_service.rs` | state/runtime store paths and typed commands | state update, launch, accept, interrupt results | Facade routes typed work; it contains no policy or protocol mapping. |
|
|
| `surfaces/*` | native state, runtime snapshots, pressure/freshness inputs | scene, jobs, roles, planning, context, graph, CRRC, coordinator recommendations | Read surfaces derive; they do not mutate. |
|
|
| `runtime_spine.rs` | typed launch/result/receipt documents | CultCache runtime records | Runtime lifecycle and evidence are durable typed documents. |
|
|
| `mind_gateway.rs` and coordinator acceptance | worker findings and proposed patches | review, rejection, or state-commit receipts | Worker thought cannot write Mind directly. |
|
|
| `substrate_gate.rs` | bounded access intent | scoped access grant/refusal | Repository access and state admission are separate authorities. |
|
|
| `eyes_gateway.rs` | inspected source under a grant | evidence review/packet/refusal | Looked-at truth carries provenance. |
|
|
| `hands_gateway.rs` | approved action intent | patch/command/commit/PR receipts | Consequence is bounded, attributable, and reviewable. |
|
|
| `soul_gateway.rs` | claimed consequence plus evidence | verdict/refusal receipt | Work is not true merely because it ran. |
|
|
| `continuity_gateway.rs` | rupture/checkpoint/recovery facts | continuity receipts | Survival state is explicit, not transcript residue. |
|
|
| `heartbeat_state.rs` and daemon binaries | durable schedule/liveness policy | pulses, launch pressure, sleep/rumination state | Scheduling is physiology, not project truth. |
|
|
| `cultmesh_integration.rs` and `epiphany-verse-query` | typed local documents | private/local/public Verse projections | Visibility never creates authority or declassifies private state. |
|
|
| Persona loop | state projection, stimulus, semantic recall | natural speech plus interpreted candidate actions | Imagination projects; Persona speaks; Mind interprets. |
|
|
| vendored Codex | Codex sessions and OpenAI-compatible auth/model transport | Codex behavior and model transport | No Epiphany protocol or durable Epiphany state crosses this boundary. |
|
|
|
|
## Primary State Flow
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
I["Typed intent or worker finding"] --> G["Mind gateway review"]
|
|
G -->|reject| R["Typed rejection receipt"]
|
|
G -->|admit| V["State validation"]
|
|
V --> C["Single coordinator commit path"]
|
|
C --> S["Native thread-state CultCache"]
|
|
S --> P["Derived native surfaces"]
|
|
P --> O["Coordinator / operator / Eve projections"]
|
|
```
|
|
|
|
`coordinator_state_transaction::{open_coordinator_state_transaction,
|
|
commit_coordinator_state_transaction}` is the single persistence owner.
|
|
Ordinary updates, launch transactions, and accepted findings construct their
|
|
domain-specific next state or companion documents, then submit them to that
|
|
owner. It rejects stale expected state, refuses companion envelopes that target
|
|
the canonical key, and commits state plus companions in one prepared batch.
|
|
`thread_state_store.rs` retains typed codec/read access only; its production raw
|
|
writers and their public exports are deleted. A source guard rejects any second
|
|
production `THREAD_STATE_KEY` writer. `EpiphanyCoordinatorService` is the narrow
|
|
caller-facing facade.
|
|
|
|
Forbidden writers:
|
|
|
|
- worker result payloads;
|
|
- operator display JSON;
|
|
- Codex rollouts or Codex thread objects;
|
|
- derived scene/coordinator/context projections;
|
|
- heartbeat telemetry;
|
|
- CultMesh mirrors and public Verse documents.
|
|
|
|
## Worker And Receipt Flow
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
C["Self / coordinator"] --> L["Typed worker launch request"]
|
|
L --> RS["Runtime spine"]
|
|
RS --> M["Model runtime"]
|
|
M --> F["Typed role or reorient finding"]
|
|
F --> MG["Mind review"]
|
|
MG --> SC["State commit receipt"]
|
|
SC --> S["Native thread state"]
|
|
```
|
|
|
|
`runtime_spine.rs` registers and persists worker launch requests, worker
|
|
results, Mind reviews, Mind commit receipts, Eyes packets, Substrate Gate
|
|
grants, Hands consequence receipts, Soul verdicts, Continuity receipts, and
|
|
coordinator run receipts. `EpiphanyCoordinatorService` now accepts one `store`
|
|
path for canonical state and its atomic runtime/witness companions. The native
|
|
status mouth exposes the same boundary as one `--store` argument. Document
|
|
families remain typed and separately owned inside the cache; filesystem path
|
|
plurality no longer pretends to be an authority boundary.
|
|
|
|
## Hands → Soul → Modeling Loop
|
|
|
|
1. Self emits a bounded Hands gate with requested paths and required receipts.
|
|
2. Substrate Gate records the access grant.
|
|
3. Hands records intent/review plus patch, command, and commit receipts.
|
|
4. `coordinator_launch_context.rs` builds sealed work-loop telemetry from that
|
|
receipt chain for Soul.
|
|
5. Soul emits a verdict receipt against the actual consequence.
|
|
6. Modeling receives the verified consequence and proposes a map/state patch.
|
|
7. `coordinator_acceptance.rs` commits an admitted proposal with its Mind
|
|
review/commit witnesses before Self routes another Hands turn.
|
|
|
|
The repo-work scheduler obeys the same order. After a branch-local execute
|
|
receipt it stops at `await-modeling`; it cannot invoke closure or manufacture
|
|
Modeling/Mind evidence. `epiphany-work close` requires explicit model
|
|
authorship, model reference, verdict, and finding before it can admit a map.
|
|
Deterministic checks remain Soul evidence, not a substitute for Modeling. The
|
|
verified consequence now crosses an explicit
|
|
`epiphany.modeling.repo_work_request.v0` boundary authored by Self. The request
|
|
is immutable, references the passing Soul receipt, commit, and changed paths,
|
|
and grants Modeling interpretation authority without granting Self authority to
|
|
write the result. A Modeling finding is refused unless it answers that exact
|
|
request and matches its verified consequence. The current close command writes
|
|
both phase documents from explicit CLI cargo; scheduler launch and asynchronous
|
|
result collection remain the next cut.
|
|
|
|
Soul verification is now an explicit phase of the shared closure pipeline.
|
|
`epiphany-work verify` and the first post-execution scheduler pulse run only
|
|
that phase: deterministic verification, immutable Soul verdict, and immutable
|
|
Self-to-Modeling request. Modeling absence or a non-passing Modeling verdict can
|
|
no longer make Soul report failure. The partial closure artifact is
|
|
`status=awaiting-modeling`; overview and later scheduler pulses preserve that
|
|
gate rather than mistaking file existence for Mind admission. The scheduler
|
|
source contains neither the Modeling finding writer nor map admission.
|
|
|
|
Repo work now has a native third worker launch kind beside generic role and
|
|
reorientation work: `repo-work-modeling`. It runs through the existing
|
|
`epiphany-openai-runtime`, carries the immutable request plus the bounded
|
|
Soul-verified commit diff, and requires
|
|
`epiphany.worker.repo_work_modeling_result.v0`. The runtime—not Self—converts
|
|
model output directly into the canonical `RepoWorkModelingFinding`. Scheduler
|
|
pulses launch one detached runtime job, wait without duplication, consume only
|
|
the typed finding, and then resume the existing immutable Mind/map admission.
|
|
A non-passing finding is immutable and stops for reviewed revision rather than
|
|
being overwritten or silently retried.
|
|
|
|
The former direct CLI writer is cut. `epiphany-work close --model-authored ...`
|
|
may no longer create a Modeling finding; closure can only reread the canonical
|
|
runtime document. The obsolete direct-CLI closure smoke was deleted. A live
|
|
negative probe returned exit 1 for forged passing CLI cargo while leaving the
|
|
typed request awaiting its real Modeling worker.
|
|
|
|
Detached worker physiology is now Idunn-owned. `epiphany-work` opens the typed
|
|
runtime job and invokes `epiphany-daemon-supervisor service-launch`; it contains
|
|
no child-process `spawn`. The supervisor launches the existing model runtime,
|
|
owns Windows hidden-process behavior, redirects stdout/stderr to explicit
|
|
artifacts, and publishes an
|
|
`epiphany.cultmesh.daemon_service_lifecycle_receipt.v0` containing service and
|
|
process identity. Self receives that receipt ID as routing evidence only. Live
|
|
item `idunn-owned-modeling` crossed this boundary and reached the Bifrost gate.
|
|
|
|
The current Modeling request is owned by
|
|
`epiphany.modeling.repo_work_route.v0`, not the filesystem closure projection.
|
|
Generation zero lands atomically with its Soul-backed request. A later
|
|
generation can advance only through `advance_repo_work_modeling_route`: the
|
|
current finding must exist and be non-passing, the new request must preserve
|
|
item/Soul/commit/paths, and a Mind acceptance must grant only
|
|
`repoWork.modelingRoute`. Request, Mind review, and stable route pointer commit
|
|
in one CultCache batch; old request/finding documents remain immutable.
|
|
`epiphany-work revise-modeling --review-ref ... --rationale ...` is the explicit
|
|
review mouth. Scheduler job IDs include the route generation and derive the
|
|
stable route key from the item, so neither close JSON nor an old completed job
|
|
can select current work.
|
|
|
|
Before any Modeling runtime job is opened, the exact consumer executable runs
|
|
`preflight` against the actual runtime store. Its own schema registry must read
|
|
the store and advertise the required route, request, finding, and worker-launch
|
|
types. Preflight hashes both executable bytes and the ordered supported schema
|
|
catalog. Idunn refuses a typed launch without the passing schema flag,
|
|
executable SHA-256, schema-catalog SHA-256, witness ID, and required document
|
|
list; all are persisted in the daemon service lifecycle receipt. The preflight
|
|
ID is correctly a witness, not a fake independent receipt. Preflight precedes
|
|
`open_runtime_spine_heartbeat_job`, so stale consumers leave no queued corpse.
|
|
|
|
The
|
|
accepted interpretation is persisted as
|
|
`epiphany.modeling.repo_work_finding.v0`; it references the passing Soul verdict,
|
|
commit, and changed paths. Mind rereads that typed receipt and the admitted repo
|
|
map plus CultMesh projection carry its receipt ID.
|
|
|
|
The canonical repo-work map entry is `epiphany.repo_work.map_entry.v0` in the
|
|
same runtime CultCache. `commit_repo_work_map_admission` validates it against
|
|
the persisted Modeling finding, then publishes the map entry, Mind review, and
|
|
Mind commit in one prepared batch. The former bespoke
|
|
`.epiphany/state/repo-work-map.msgpack` owner is deleted. CultMesh remains a
|
|
projection after admission and cannot repair or override the canonical entry.
|
|
|
|
Closure phase documents are immutable by stable receipt ID. An identical retry
|
|
reuses the existing Soul verdict and Modeling finding, rereads an already
|
|
admitted Mind/map batch, and regenerates only operator/CultMesh projections.
|
|
Conflicting same-ID Soul, Modeling, or map cargo is refused; no reconciliation
|
|
loop may overwrite the earlier truth.
|
|
|
|
Manual edits and programmatic actions converge at the same receipt and Mind
|
|
admission boundaries. A later action cannot retroactively make an unrecorded
|
|
consequence valid.
|
|
|
|
## Read And Recommendation Flow
|
|
|
|
`epiphany-mvp-status` reads the unified native coordinator store.
|
|
It derives:
|
|
|
|
- scene via `surfaces/scene.rs`;
|
|
- pressure via `surfaces/pressure.rs`;
|
|
- freshness via `surfaces/freshness.rs`;
|
|
- jobs via `surfaces/jobs.rs`;
|
|
- role board via `surfaces/role_board.rs`;
|
|
- planning via `surfaces/planning.rs`;
|
|
- reorientation via `surfaces/reorient.rs`;
|
|
- CRRC via `surfaces/crrc.rs`;
|
|
- coordinator status via `surfaces/coordinator.rs`.
|
|
|
|
`epiphany-mvp-coordinator` consumes that native status shape. Requested Hands
|
|
paths come from the scene checkpoint/frontier. Revision comes from
|
|
`/scene/scene/revision`. There is no Codex `read.thread.epiphanyState` fallback.
|
|
|
|
## Persona Flow
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
T["Typed Persona state + visible stimulus"] --> PR["Imagination Projector"]
|
|
PR --> PE["Persona turn"]
|
|
PE --> IN["Mind Interpreter"]
|
|
IN --> CA["Candidate actions / memory proposals"]
|
|
CA --> G["Review and external authority gates"]
|
|
```
|
|
|
|
Semantic memory recall is a bounded context input, not a state writer. Outside
|
|
world actions pass through Bifrost identity/governance and Heimdall capability
|
|
proofs. Persona speech audits are typed CultMesh witnesses; public speech does
|
|
not expose private worker or operator state.
|
|
|
|
## Heartbeat And Daemon Physiology
|
|
|
|
`heartbeat_state.rs`, `epiphany-heartbeat-store`,
|
|
`epiphany-daemon-supervisor`, and `epiphany-cluster-daemon` own scheduling and
|
|
liveness. A lane is not relaunched while its prior turn is active. Cooldown
|
|
begins after completion. Idle physiology may ruminate, distill memory, or dream
|
|
without claiming project-state authority.
|
|
|
|
Idunn owns daemon survival. Self and Downstream consumers may inspect and recommend; they do
|
|
not become alternate daemon keepers.
|
|
|
|
## Verse And Interface Projection
|
|
|
|
CultMesh is the preferred local typed interface over CultCache/CultNet.
|
|
|
|
- `epiphany-internal`: private thoughts, reviews, receipts, and local organ
|
|
coordination;
|
|
- `gamecult-local`: trusted operator-safe GameCult sharing;
|
|
- `epiphany-global`: public dreams and Persona/public discussion documents.
|
|
|
|
Eve/CultUI surfaces lower typed CultMesh composition/state. Renderers and
|
|
wrappers do not own the projected truth.
|
|
|
|
## Codex Boundary
|
|
|
|
The following are structurally absent:
|
|
|
|
- `thread/epiphany/*` requests and notifications;
|
|
- `ThreadEpiphany*` protocol DTOs and generated bindings;
|
|
- `Thread.epiphanyState` in Codex app-server payloads;
|
|
- Epiphany rollout migration or replay;
|
|
- app-server phase-6 Epiphany smokes;
|
|
- Codex-backed MVP status/interruption;
|
|
- `epiphany-codex-bridge`.
|
|
|
|
Native coordinator/status projections emit `state`, not the deleted Codex
|
|
`Thread.epiphanyState` spelling. Source guards reject that compatibility field
|
|
and reject the old two-store status flags.
|
|
|
|
Codex app-server protocol has no dependency on `epiphany-state-model`.
|
|
App-server has no Epiphany state-model/core/bridge dependency. Negative source
|
|
checks in native launch/coordinator code reject renewed Codex route authority.
|
|
|
|
## Verification Layers
|
|
|
|
| Claim | Evidence layer |
|
|
|---|---|
|
|
| State mutation law | `state_update.rs` and coordinator-state unit tests |
|
|
| Worker/Mind admission | runtime-spine and coordinator-acceptance tests |
|
|
| Read-only derived surfaces | focused `surfaces/*` tests |
|
|
| Native status/interrupt | `epiphany-mvp-status` tests and executable smoke paths |
|
|
| Hands/Soul loop | Hands receipt tests plus coordinator launch-context tests |
|
|
| Protocol starvation | source scans, app-server compile, generated-schema equivalence |
|
|
| Verse privacy/authority | CultMesh/Verse focused smokes and typed receipt readbacks |
|
|
| Public crossings | Persona mouth contract smokes: fail-closed eligibility, single-crossing receipt binding, and private-state seals; no provider-readiness projection |
|
|
|
|
### Persona mouth / provider-readiness boundary
|
|
|
|
Owner: the participating Bifrost/provider boundary owns the consequence of a
|
|
public crossing. Epiphany owns only Persona speech eligibility and artifact
|
|
binding.
|
|
|
|
Inputs: one eligible Discord, Reddit, or named future-surface request plus the
|
|
configured actuator coordinates and target-shaped identity/capability
|
|
references.
|
|
|
|
Outputs: one validated transport/request receipt bound to that one
|
|
speech/request artifact.
|
|
|
|
Derived state: the receipt is artifact-local evidence of the named consequence.
|
|
It does not derive provider inventory, liveness, capability, readiness,
|
|
publication, or future operability. Missing evidence remains unknown.
|
|
|
|
Forbidden writers: MVP status, wrapper summaries, fixture aggregators,
|
|
sibling-path/executable probes, subprocess exit status, parseable JSON, and
|
|
caller-supplied booleans cannot write provider readiness.
|
|
|
|
Shared paths: Discord, Reddit, and future-surface mouths all use the same
|
|
fail-closed eligibility-to-receipt boundary, but each single-mouth smoke proves
|
|
only its own crossing. No cross-mouth aggregate remains.
|
|
|
|
Deletion line: remove the sibling advertisement subprocess projection, both
|
|
aggregate smoke binaries, aggregate output fields, and status/wrapper
|
|
presentation. Retain only the scoped mouth consequence receipts.
|
|
|
|
Repo-work map admission is a canonical generation-bound transaction. A map
|
|
entry names its `RepoWorkModelingRoute` and generation; the runtime spine loads
|
|
that route and admits only a passing immutable finding selected by the route's
|
|
current request. CLI closure is a caller of this invariant, not its owner.
|
|
Non-passing findings and stale generations therefore cannot become durable Mind
|
|
state even through a forged-looking admission call.
|
|
|
|
The model runtime has a deterministic generation-retry proof at
|
|
`epiphany-openai-runtime/src/lib.rs`: both findings pass through the production
|
|
assistant-result parser and runtime-owned finding writer. Generation zero is
|
|
non-passing, Mind alone advances the route, generation one is passing and
|
|
admitted, and a stale generation-zero admission is refused. This proves typed
|
|
handoff and ownership without provider/network variance. The remaining smoke
|
|
boundary is process composition through `epiphany-work revise-modeling`, the
|
|
scheduler's consumer preflight, and Idunn's child lifecycle receipt.
|
|
|
|
Scheduler dry-run is now an authority projection rather than a vague promise.
|
|
When a current typed Modeling request has no finding or job, its
|
|
`advancedResult` names the current route, generation, request, generation-bound
|
|
job id, required preflight, and Idunn lifecycle ownership without opening a job
|
|
or spawning a process. A disposable authority test drives the production
|
|
revision mouth and scheduler and proves generation one is selected. The final
|
|
process proof must compare this projection with a real preflighted Idunn launch
|
|
receipt; it must not add a fake production runtime mode.
|
|
|
|
The physical comparison passes. A real generation-one scheduler pulse matched
|
|
the deterministic route/request/job projection, consumer preflight
|
|
fingerprinted the executable and compiled schema catalog, Idunn persisted the
|
|
launch lifecycle receipt, and the detached model runtime completed a passing
|
|
typed finding with empty stderr. A later scheduler dry-run saw that finding as
|
|
`admit-modeling`; it did not relaunch generation zero. This closes the
|
|
generation-retry authority path. Re-enter through a source-grounded Perfect
|
|
Machine audit rather than adding more closure machinery.
|
|
|
|
## Current Cut Line
|
|
|
|
Keep:
|
|
|
|
- native typed state and runtime stores;
|
|
- explicit organ gates and receipts;
|
|
- native coordinator/status surfaces;
|
|
- CultMesh/CultNet/Eve projection;
|
|
- Codex-compatible auth/model transport where still required.
|
|
|
|
Cut or correct next:
|
|
|
|
- current plans and handoff prose that still describe deleted Codex routes or
|
|
bridge files as live mechanisms;
|
|
- wrapper arguments named for Codex when they no longer cross a Codex boundary;
|
|
- compatibility-shaped JSON field names inside native-only operator artifacts
|
|
when no external contract requires them;
|
|
- misleading state/runtime store path names;
|
|
- any remaining full-context serializer or summary that duplicates typed owner
|
|
state instead of projecting it narrowly.
|
|
|
|
## Native Heartbeat Service Boundary
|
|
|
|
The refreshed Perfect Machine audit selects runtime physiology as the next
|
|
organ boundary. `epiphany-heartbeat-store serve` now owns a native interval
|
|
loop around the existing `run_void_routine_store` primitive. It writes one
|
|
iteration directory per pulse, emits only a compact pulse receipt containing
|
|
artifact identity and success, supports bounded clean shutdown through
|
|
`--max-iterations`, and contains no child-process spawn or second state writer.
|
|
Heartbeat owns pulse timing; the next cut is to launch this binary through
|
|
Idunn and prove restart/resume, swarm-brake observability, and lifecycle
|
|
readback before demoting the PowerShell rumination vigil.
|
|
That cut is now proven. An engaged brake produced two compact refused pulses
|
|
without terminating `serve`; releasing it let the same persisted store complete
|
|
a routine. Idunn then launched two pulses and a separate one-pulse restart from
|
|
that store with empty stderr and lifecycle receipts. The attached PowerShell
|
|
vigil is deleted. The remaining service boundary is durable Idunn policy and
|
|
operator readback: advertise/configure the heartbeat service through typed
|
|
daemon state so restart intent survives beyond one explicit `service-launch`.
|
|
Source inspection corrected the proposed owner: standing daemon restart policy
|
|
requires a topology daemon and liveness status, while heartbeat is an
|
|
Idunn-managed child service. The durable owner must therefore be a typed
|
|
managed-service desired-state document keyed by service id. It delegates all
|
|
starts to the existing service lifecycle primitive and must not invent an
|
|
`epiphany-daemon-heartbeat` topology identity.
|
|
The typed desired-state surface is now implemented as
|
|
`epiphany.cultmesh.managed_service_policy.v0`, persisted at a service-id key.
|
|
`epiphany-daemon-supervisor managed-service-policy` writes command, args, cwd,
|
|
enabled/restart/backoff intent, sealed log refs, and the latest lifecycle
|
|
witness; `managed-service-read` projects desired state plus
|
|
`latestLifecycle`. It deliberately reports process observation as unknown
|
|
until a real reconcile probe exists, so an old launch receipt cannot claim the
|
|
service is alive.
|
|
That probe now exists. `managed-service-reconcile` reads only the service policy
|
|
and lifecycle history, observes the latest PID through the native platform
|
|
process API, applies enabled/restart-mode/cooldown decisions, and delegates a
|
|
restart to `service_launch`. Launch receipt ids now carry attempt time, so
|
|
restarts preserve history. Live root
|
|
`C:\Users\Meta\AppData\Local\Temp\epiphany-managed-reconcile-8e3d7cc5fe0b4c5fa38b18b3d00cea0c`
|
|
proved restart receipt
|
|
`daemon-service-lifecycle-receipt-idunn-managed-heartbeat-launch-1783858125893`
|
|
and PID `19736` were observed alive after the prior process was killed. Next
|
|
fold this reconcile into Idunn's own serve loop and cut the full-context Verse
|
|
load from service launch.
|
|
Both cuts are landed. Service plan/launch now load only the typed swarm brake
|
|
and rely on their own typed writers to open/register the store; they do not
|
|
reseed or serialize the local Verse. `managed-service-serve` is a distinct Idunn
|
|
loop from standing-daemon `serve`, so child service desired state is not blocked
|
|
by absent topology restart policies. Live root
|
|
`C:\Users\Meta\AppData\Local\Temp\epiphany-idunn-unattended-3394ecfaa03f41d8935f9fb70411ca75`
|
|
proved PID `44276` was observed alive without duplication, then after forced
|
|
death the next pulse launched PID `40532` under unique receipt
|
|
`daemon-service-lifecycle-receipt-idunn-managed-heartbeat-launch-1783859054234`.
|
|
The next boundary is provider-owned Eve sight over managed service desired/observed
|
|
state.
|
|
That first sight boundary is now implemented. `observe_native_process` moved
|
|
from the supervisor binary into a shared narrow core organ. Query aliases
|
|
`managed-services` and `idunn-services` join typed
|
|
service policy with latest lifecycle history and native observation, then read
|
|
only the compact heartbeat serve pulse line from the sealed stdout artifact.
|
|
Live row PID `25236` transitioned from `READY/alive` to `ATTN/dead` while
|
|
retaining pulse `completed`, iteration `1`, and lifecycle receipt
|
|
`daemon-service-lifecycle-receipt-idunn-managed-heartbeat-launch-1783859373793`.
|
|
No command args or routine payloads are projected. Next merge these rows into
|
|
the main provider-owned Eve composition rather than keeping a specialist query only.
|
|
|
|
## Semantic Projector Executor Authority
|
|
|
|
Canonical Mind and Modeling admission own projection demand. Their transaction
|
|
writes the exact semantic-projection obligation beside the canonical source
|
|
head; neither Idunn nor the projector may invent that demand. Idunn owns the
|
|
decision to assign an executor or fence an abandoned executor. The projector
|
|
owns only the claim-bound Qdrant mutation, post-write observation, attempt
|
|
terminalization, and exact success receipt.
|
|
|
|
The execution chain is now:
|
|
|
|
`canonical obligation -> Idunn acquisition CAS -> consumed executor grant + running claim/attempt -> epoch-isolated Qdrant synchronization -> canonical authority reauthentication -> terminal claim/attempt + exact receipt CAS`.
|
|
|
|
Acquisition binds scope, obligation, executor identity and incarnation,
|
|
purpose, Idunn incarnation, predecessor claim, and resulting claim epoch in one
|
|
consumed typed grant. `execute` cannot reopen an exact succeeded claim;
|
|
`repair` requires that exact predecessor. The execution CLI accepts a claim id,
|
|
not an executor label, and authenticates the consumed authority behind the
|
|
claim before touching Qdrant. Acquisition reauthenticates the complete sealed
|
|
canonical input and carries its authority envelopes through the same CAS, so a
|
|
persisted historical obligation cannot reopen an advanced source head.
|
|
|
|
Running-claim recovery reloads the exact Idunn poke intent/receipt and a
|
|
provider-authored immutable heartbeat event from CultMesh. It requires an
|
|
`awaiting-provider-heartbeat` lifecycle result followed by a newer ready
|
|
heartbeat for the replacement provider incarnation, hashes those source
|
|
envelopes, requires the heartbeat to name the exact restart receipt as its
|
|
startup cause, and consumes a typed recovery authorization in the same CAS that
|
|
fails the abandoned attempt and advances the claim epoch. The old executor can
|
|
thereafter write only its physically isolated abandoned Qdrant namespace and
|
|
cannot terminalize the active CultCache claim.
|
|
|
|
Projection health, elapsed time, process status, command exit, Qdrant counts,
|
|
CultMesh mirrors, Eve, and swarm overview remain derived sight. They cannot
|
|
create an obligation, grant, claim, attempt, success receipt, recovery, or
|
|
query admission. Initial execution, retry, repair, and recovered execution all
|
|
use the same claim-authenticating execution primitive; only acquisition and
|
|
recovery differ in how Idunn establishes the claim authority.
|
|
|
|
Verification covers concurrent acquisition with one winner and no issued
|
|
litter, predecessor/epoch ordering, purpose separation, claim-authority
|
|
authentication, evidence field substitution, lifecycle/heartbeat causal
|
|
ordering, recovery single use, and the inability of the recovery command to
|
|
execute projection work itself.
|
|
|
|
The packaged workstation body now contains the single projector owner, Idunn
|
|
supervisor, and semantic query verifier. Task Scheduler owns current-user
|
|
after-login presence of the foreground Idunn reconciler; the reserved typed
|
|
policy owns the exact projector launch shape; Idunn seals the launch receipt;
|
|
and the projector authenticates that receipt before taking the host-wide
|
|
canonical-store-pair singleton. `gamecult-ops` separately owns the foreground
|
|
Yggdrasil tunnel that exposes Qdrant on workstation loopback. Canonical store
|
|
and Qdrant placement remain one topology; dual projectors are forbidden.
|
|
|
|
Provider correlation is derived sight. The service-status projection reports
|
|
`provider-correlated` or `provider-degraded`, never semantic readiness. Query
|
|
admission authenticates the newest exact obligation/current/success chain and
|
|
alone owns readiness. Deployment proof uses the packaged verifier with explicit
|
|
`EPIPHANY_QDRANT_URL` and `EPIPHANY_OLLAMA_BASE_URL`; both Mind and Modeling
|
|
queries have returned semantic ranking under those explicit coordinates.
|
|
|
|
Stopping the scheduled reconciler does not kill its detached projector child.
|
|
Process ancestry is therefore current observation, not durable ownership, and
|
|
a task restart can reuse an already-running child. The missing proof is a real
|
|
operator-approved reboot/logon cycle that observes both tasks restored, the
|
|
tunnel ports live, a fresh post-boot reconciler -> exactly-one-projector chain,
|
|
a new launch-correlated provider heartbeat, and semantic ranking from both
|
|
packaged queries. This proves after-login physiology only. Reboot is outside
|
|
agent authority until the operator grants that exact host-wide action.
|
|
|
|
## Coordinator action authority and smoke boundary (2026-07-15)
|
|
|
|
The production coordinator now derives one path:
|
|
`typed status/evidence -> coordinator action -> shared action arm -> optional Hands gate`.
|
|
Typed status and accepted evidence own action selection; Hands/Substrate review
|
|
owns permission. Current typed thread state, accepted role results, and review
|
|
evidence are inputs. The action, run receipt, and optional Hands gate are
|
|
outputs. Smoke fixtures and scenario controls are derived verification state.
|
|
|
|
Production callers, wrappers, fixture flags, and smoke helpers are forbidden
|
|
writers of action, `canAutoRun`, review requirements, bootstrap state, and Hands
|
|
permission. The seven former production fixture flags and their override/helper
|
|
paths are deleted. The dedicated smoke creates fixtures only under
|
|
`.epiphany-smoke/mvp-coordinator`, then exercises the shared typed paths; it
|
|
rejects attempts to reintroduce those flags.
|
|
|
|
Future audit frontier, not established anatomy: sibling Bifrost subprocess JSON
|
|
used by readiness needs a focused identity/schema/provenance audit before any
|
|
cut or confirmed finding.
|
|
|
|
## Freshness -> reorientation authority (2026-07-15)
|
|
|
|
```text
|
|
canonical retrieval state -----------------------> retrieval judgment --+
|
|
legacy graph checkpoint + churn + frontier -----> legacy graph judgment -+--> reorientation decision --> CRRC/coordinator/launch
|
|
positive watcher changes ------------------------> watcher judgment -----+
|
|
durable investigation checkpoint ---------------------------------------+
|
|
```
|
|
|
|
`derive_freshness` owns the first three judgments. Retrieval Ready becomes
|
|
Clean only with an empty dirty-path set; otherwise it derives Stale. The legacy
|
|
thread graph can prove Stale from explicit frontier pressure, but cannot prove
|
|
Clean/Ready because it has no legal Modeling writer and cannot see canonical
|
|
RepoModel admission. Missing authority stays Missing/Unknown. Watcher silence stays
|
|
Unavailable/Unknown because no continuity receipt exists; Changed is positive
|
|
evidence. `surfaces/jobs.rs` consumes the same graph judgment for remap work.
|
|
|
|
`recommend_reorientation` alone owns Resume/Regather. Resume requires a
|
|
resume-ready investigation checkpoint, retrieval Clean, graph Clean, and a
|
|
watcher that is Clean or Unknown. Any retrieval/graph non-clean value or
|
|
watcher Dirty/Stale/Changed forces Regather. Path matches, status labels,
|
|
worker-launch documents, coordinator rows, and CRRC recommendations are derived
|
|
consumers and forbidden decision writers.
|
|
|
|
Canonical RepoModel is the admitted map, not the repository Body. Its exact
|
|
revision/hash and Mind-issued `RepoModelAdmissionReceipt` prove map identity
|
|
only. Future Ready additionally requires a nervous-system-owned, continuity-
|
|
bearing Body observation and retrieval coverage bound to the same source
|
|
generation; Mind derives readiness from that exact join. Legacy graph
|
|
checkpoints retain only checkpoint identity and frontier content; churn retains
|
|
understanding and diff pressure. Neither can publish graph freshness or a graph
|
|
revision. Generic thread patches, watcher silence, snapshot source metadata,
|
|
and unrelated thread revisions are forbidden readiness writers. Until every
|
|
authority is present and current, Unknown is the truthful result.
|
|
|
|
## Repository Body observation substrate (2026-07-15)
|
|
|
|
`repository_body_observer.rs` owns bounded `git_worktree` observation. A
|
|
separate bind command consumes the existing validated runtime swarm binding and
|
|
pins a caller-supplied workspace ID, exact runtime/swarm/source-identity hash,
|
|
canonical Git root, object format, scope, and ignore policy; observe cannot mint
|
|
identity. Two disposable-index `read-tree`/`git add --all -- .`/
|
|
`write-tree` scans must agree. CultCache MessagePack persists immutable
|
|
generations and an exact-CAS current head; unchanged raw manifest preserves the
|
|
generation. The observer makes no historical continuity claim and has no Ready field.
|
|
Sparse checkout fails closed, submodules are gitlink-only, and RepoModel/
|
|
retrieval/scheduler/Mind integration is absent. The CultCache store must remain
|
|
outside the observed worktree so observer writes cannot become observed input.
|
|
Machine-global excludes are disabled during observation. Only accepted stable
|
|
observations persist; failed/unstable attempts return errors and advance no
|
|
head. HEAD absence counts as unborn only when a symbolic ref is proven absent.
|
|
Every Git subprocess strips ambient repository, worktree, object, ref,
|
|
namespace, index, shallow/graft, and injected-config environment authority.
|
|
The index owns ignore-aware UTF-8 path, Git mode, and gitlink enumeration; its
|
|
clean-filtered tree OID is auxiliary. Raw regular-file bytes and lengths, or
|
|
non-followed symlink-target bytes, feed ordered typed entries. A domain-separated
|
|
SHA-256 root over workspace, scope policy, and those entries is authoritative
|
|
Body identity. Manifest, observation, and manifest-root head land in one CAS.
|
|
Gitlinks remain nonrecursive. Unsafe or unrepresentable paths fail closed.
|
|
|
|
The bind rite also writes one immutable runtime-side
|
|
`RuntimeRepositoryBodyStoreBinding`. It names the canonical external Body-store
|
|
locator and hashes the exact Body binding while repeating runtime, swarm, and
|
|
workspace identity. Every read reopens the Body store and validates that chain.
|
|
One runtime cannot silently switch between Body stores; relocation or replacement
|
|
requires a future explicit migration receipt.
|
|
|
|
Every coordinator-owned Modeling launch now obtains a typed
|
|
`RepositoryBodyObservationBasis` before the worker thinks. The immutable launch
|
|
binds runtime/swarm/workspace/scope, Body-binding hash, observation
|
|
generation/id/root, and scan interval. Modeling output contract v3 requires the
|
|
worker-authored exact echo; result ingress rejects missing or substituted basis.
|
|
Non-Modeling launches and results cannot carry it. Mind review v1 and admission
|
|
receipt v5 preserve the same basis. Admission validates exact
|
|
launch/result/review equality and the referenced immutable historical Body
|
|
artifacts before copying it into the CAS receipt. It does not resample current
|
|
Body. Direct Mind adoption and legacy migration remain explicitly ungrounded.
|
|
|
|
## Mind readiness join boundary (2026-07-15)
|
|
|
|
A truthful whole-repository readiness join does not yet exist. Body-grounded
|
|
RepoModel admission now exists; Mind must own a
|
|
derived `RepositoryReadinessProjection`; Body observation, Modeling, retrieval,
|
|
semantic projection, schedulers, watchers, jobs, and UI are forbidden writers.
|
|
Its required inputs are a fresh validated Body observation, the canonical
|
|
RepoModel plus its exact Mind admission receipt carrying its Body basis,
|
|
the authenticated Modeling semantic projection receipt for that admitted model,
|
|
and exact workspace-retrieval coverage bound to the same Body manifest and a
|
|
named inclusion policy. Derivation must retry if any participating head advances.
|
|
|
|
The join is a race-bounded operation: observe Body root R1, validate every exact
|
|
artifact against R1, then observe again and require R2=R1 before emitting an
|
|
`observed-ready-at` receipt whose truth interval ends at the second scan. Later
|
|
reads must revalidate rather than present it as timeless Ready. A→B→A is harmless
|
|
when all artifacts are content-addressed to A. Gap-free watcher or journal
|
|
continuity is not required and cannot prove truth after its own final event.
|
|
Legacy retrieval `Ready`, empty dirty paths, timestamps, watcher silence, Git
|
|
tree or HEAD OIDs, Qdrant existence, counts, and unrelated generations are not
|
|
substitutes. Watchers and Hands receipts may trigger recomputation but cannot
|
|
replace either Body observation. The lossy JSON workspace manifest remains cache metadata, not
|
|
coverage authority. Semantic-projector Ready remains exact query eligibility for
|
|
the admitted RepoModel projection; it does not prove repository Body coverage.
|
|
|
|
## Counterfeit workspace retrieval organ removed (2026-07-15)
|
|
|
|
The old `retrieval.rs` module was not wired to any runtime, CLI, scheduler, or
|
|
app-server caller. It stored JSON under `CODEX_HOME`, identified files by
|
|
path/size/mtime/chunk count, used different filesystem walkers for exact and
|
|
semantic search, named Qdrant collections from workspace path plus model, and
|
|
could emit `Ready` from a missing manifest or query-time BM25. It had no Body,
|
|
runtime, swarm, workspace, policy, content-root, or observed point-set binding.
|
|
The module and re-exports are deleted. Legacy `EpiphanyRetrievalState` remains
|
|
presentation-only: clean `Ready` projects Missing, and its index job is
|
|
unavailable and unowned; dirty/stale data may warn but cannot authorize coverage.
|
|
|
|
The replacement starts from an authenticated historical Body manifest,
|
|
classifies every entry under one versioned inclusion policy, verifies eligible
|
|
live bytes against Body hashes, builds a Body-root/policy/index-epoch isolated
|
|
Qdrant projection, observes its deterministic point set, and only then publishes
|
|
an immutable CultCache coverage receipt. Qdrant remains disposable.
|
|
|
|
## Body-bound workspace coverage substrate (2026-07-15)
|
|
|
|
`workspace_retrieval_coverage.rs` now defines the truthful contract boundary
|
|
without pretending the projector exists. Obligation derivation reloads the exact
|
|
historical Body manifest through the authenticated runtime Body-store route;
|
|
callers cannot hand it a manifest-shaped claim. One versioned policy classifies
|
|
every ordered Body entry and seals the complete classification set into the
|
|
obligation. A separate projection plan seals chunker, projection, embedding, and
|
|
expected point-set identity, while deriving its physical Qdrant collection from
|
|
the Body-bound authority instead of accepting a caller-selected namespace.
|
|
|
|
Receipts validate only when an exact Qdrant scroll observation matches that
|
|
sealed plan, and heads join one workspace, obligation, plan, and receipt. This
|
|
module has no store writer, Qdrant actuator, query gate, or readiness writer.
|
|
The next organ must own CAS persistence and execution: verify eligible bytes
|
|
against the historical Body hashes, project, scroll-observe, then atomically
|
|
publish the receipt/head. Until then coverage remains absent.
|
|
|
|
### Projector authority map
|
|
|
|
Repository Body owns observed substrate only: its binding, immutable
|
|
observations/manifests, and current Body head. Projection activity must not
|
|
rewrite `body.cc`. Live Yggdrasil candidate `c94fa580` falsified the old shared-
|
|
store ownership by attributably rewriting `body.cc` while projection ran; it
|
|
remains rejected.
|
|
|
|
Commit `261c7bc8` adds the pinned transactional store foundation. The runtime
|
|
record `epiphany.runtime.workspace_coverage_store_binding.v0` selects one
|
|
canonical store path and file identity while sealing the exact repository Body
|
|
route/envelope and Body-binding hash. The store-local
|
|
`gamecult.epiphany.workspace_coverage_store_binding.v0` repeats runtime, swarm,
|
|
workspace, file identity, Body-binding hash, repository source identity,
|
|
projection scope, and backend. `open_workspace_coverage_authority` validates
|
|
both bindings and returns the owned transactional store together with exact
|
|
read-only Body authority. A naked path is never sufficient.
|
|
|
|
The workspace-coverage store owns obligation, plan, immutable claim/attempt and
|
|
recovery history, current-claim authority, checkpoint events/head, progress
|
|
events/latest, terminal receipt, coverage head, and retirement history. Qdrant
|
|
is disposable derived state. This ownership is the target, not yet the live
|
|
implementation: commit `261c7bc8` provides bindings and transactional keyed
|
|
storage, but existing projector writers still persist projection records in
|
|
Body or local Verse.
|
|
|
|
Inputs are the exact pinned Body route/binding and current observation basis,
|
|
sealed policy/plan/model identity, authenticated managed launch and provider
|
|
incarnation, exact Idunn recovery evidence, and waited Qdrant readback. Outputs
|
|
are the typed lifecycle/proof records above. Current claim, progress, coverage,
|
|
warming, active, readiness, and query eligibility are derived joins; none may
|
|
be manufactured by a path, heartbeat, Qdrant count, or stale head.
|
|
|
|
Forbidden writers are explicit: Body observer/bootstrap never writes projection
|
|
state; projector/checkpoint/recovery never writes Body; local Verse retains
|
|
managed process lifecycle but not coverage progress; Idunn, deploy scripts,
|
|
health, heartbeat, Qdrant, Eve, and swarm overview cannot advance coverage
|
|
authority.
|
|
|
|
The shared execution path resolves the runtime coverage binding, opens exact
|
|
Body read authority, then acquires against the exact current Body chain,
|
|
verify every included live file against its historical length and SHA-256,
|
|
derive deterministic chunks and UUIDv5 point descriptors, embed and write into
|
|
a claim/epoch-fenced plan collection, scroll the whole collection with typed
|
|
payloads, then terminal-CAS success in the coverage store after reopening and
|
|
reauthenticating the still-current Body head. Plans
|
|
must seal an ID-to-payload binding root; equal counts or equal IDs do not prove
|
|
the indexed content. Receipt/head constructors and writers remain projector-
|
|
private. Live query eligibility re-observes Qdrant; a stored receipt proves only
|
|
that one exact observation completed.
|
|
|
|
Each waited batch/readback must transactionally admit its checkpoint event/head
|
|
and derived progress event/latest together in the coverage store. Cross-store
|
|
atomicity is not invented: Body is authenticated before the coverage CAS and
|
|
reopened afterward; if it moved, the projection evidence remains historical and
|
|
cannot become current. Claim authority is scoped to Body generation so an old
|
|
running claim cannot block new Body work. Same-Body abandoned-owner recovery
|
|
remains possible only through exact Idunn predecessor termination and
|
|
replacement authority.
|
|
|
|
Migration/cut line: quiesce projection, create and bind the coverage store,
|
|
copy projection envelopes from Body and progress envelopes from Verse while
|
|
preserving exact envelopes/digests, validate every chain, activate the runtime
|
|
binding as the single authority switch, then CAS-remove legacy records. After
|
|
activation legacy residue is inert. Missing binding, divergent sources, or
|
|
partial migration fail closed. No dual-read or fallback path survives. Every
|
|
bootstrap/deploy path must create the bound store before service start.
|
|
|
|
The execution path is reachable only through the reserved packaged workspace-
|
|
coverage projector managed by Idunn. It validates plan-sealed text hashes and vector
|
|
dimensions, creates or authenticates one exact managed claim/epoch Qdrant
|
|
collection, writes no empty upsert, whole-scrolls typed payloads, rejects cyclic
|
|
pagination plus duplicate/extra/missing/substituted points, and terminal-CASes
|
|
the receipt/head against the exact current Body authority, immutable plan,
|
|
running claim/attempt, and prior coverage head acquired at start. A CAS loser
|
|
cannot mint a receipt; failure can terminalize after Body advance.
|
|
|
|
The dedicated workspace-coverage projector binds claims to an authenticated
|
|
executor incarnation and reserved managed-process launch. Its pulse has an exact
|
|
`Current` result and rematerializes text through the authenticated historical
|
|
Body session rather than caller-supplied bytes. Abandoned-claim recovery admits
|
|
only immutable host-signed termination, one causally linked replacement launch,
|
|
and that replacement's latest signed ready heartbeat before one Body-store CAS.
|
|
Time, Qdrant state, generic policy, process guesses, and caller strings are not
|
|
abandonment authority. If Body advanced, recovery terminalizes the stale claim
|
|
and lets normal acquisition derive a new plan; it never resurrects stale work.
|
|
|
|
### Dedicated service and exact semantic proof
|
|
|
|
The dedicated service is now a real reserved managed body, not a generic job.
|
|
Its policy fixes the packaged sibling executable and exact runtime/Verse/
|
|
Qdrant/Ollama arguments. Startup authenticates the policy-bound launch receipt,
|
|
PID, executable hash, runtime identity, immutable Body-store route, and one
|
|
host-wide singleton. Claims and attempts bind that executor incarnation and
|
|
startup receipt.
|
|
|
|
Each pulse reloads only the persisted current Body basis, resolves the mutable
|
|
Ollama tag to its installed artifact digest, and probes dimensions. An exact
|
|
head/obligation/plan/receipt fast path returns Current without reading worktree
|
|
files. Needed work opens one authenticated Body read session, verifies every
|
|
eligible file and chunk, embeds only after claim acquisition, and observes both
|
|
typed payloads and exact stored vectors. Receipt identity includes the vector-
|
|
binding set; wrong, missing, nonfinite, or wrong-dimensional vectors cannot mint
|
|
success. Body history derives retirement candidates for terminal non-current
|
|
claim collections; current and running collections are preserved, and Qdrant
|
|
deletion requires exact managed metadata.
|
|
|
|
Recovery is present through Idunn's reserved reconciliation path. Launch,
|
|
heartbeat, and termination serialize through one per-launch process-evidence
|
|
head. Host-signed termination binds host+boot incarnation, exact native process
|
|
identity, executable, policy, and launch; it may seal death before heartbeat one
|
|
without turning timeout or PID absence into authority. One termination admits
|
|
one causal replacement slot. Recovery then requires the replacement's latest
|
|
signed ready heartbeat and commits failed history, epoch+1 successor, and an
|
|
immutable evidence-digest receipt in one Body CAS. PID reuse, access failure,
|
|
indeterminate observation, stale ready replay, and timeout remain inadmissible.
|
|
|
|
### Resident organizational Self
|
|
|
|
Resident wake scheduling has one owner. The standard heartbeat consumes one
|
|
pending typed pressure and atomically emits one single-consumption Self grant;
|
|
`epiphany-swarm` does not invent work from an idle loop. Accepted pressure is
|
|
bounded to operator objective, Body-map drift, and reviewable Imagination
|
|
proposal documents. Persona feedback remains persisted pressure and cannot
|
|
become a resident grant or coordinator objective; it enters Imagination only
|
|
through the separate typed consideration carrier. Those documents request
|
|
attention only. They
|
|
cannot adopt Mind state, authorize Hands, publish a release, or deploy it.
|
|
|
|
Resident Self owns the grant-to-coordinator process transaction. Its inputs are
|
|
the authenticated packaged-release witness, separate resident/runtime/Verse/
|
|
Mind stores, the heartbeat grant, the swarm brake, and exact process
|
|
observations. It outputs an immutable preparation, child claim, exact active
|
|
turn lease, coordinator terminal receipt binding, and terminal acknowledgement
|
|
back to heartbeat. The active turn and cooldown are derived from that chain;
|
|
PID, exit code, journal output, and an unbound coordinator receipt are sight,
|
|
not completion authority.
|
|
|
|
Preparation and grant consumption share one CAS. The packaged coordinator must
|
|
claim the preparation before cognition, binding process id, creation token,
|
|
executable path and digest, grant, and launch digest. Resident Self then
|
|
acknowledges exactly that claim. Completion requires the same turn, grant,
|
|
launch digest, release identity, and coordinator receipt. Brake or timeout
|
|
drains the exact process and cannot silently abandon a live lease. A prepared
|
|
launch survives scheduler restart: an unclaimed preparation safely retries the
|
|
same grant and launch contract, while a claimed preparation reattaches only to
|
|
the exact process incarnation recorded by the packaged child before cognition.
|
|
|
|
Forbidden writers are the old source-tree/Cargo `epiphany-swarm` wrapper,
|
|
`epiphany-work` queue machinery, free-running heartbeat loops, Persona,
|
|
Imagination, Modeling, coordinator artifacts, process exit, systemd, and
|
|
presentation projections. Direct operator objectives and domain-derived
|
|
pressure use the same pressure -> heartbeat grant -> preparation -> child claim
|
|
-> lease -> exact receipt -> terminal acknowledgement path. The cut line removes
|
|
the former `online`, `run`, `run-queue`, and `pulse` authority and packages the
|
|
swarm, coordinator, model runtime, and tool spine as witnessed sibling binaries.
|
|
|
|
Verification belongs at the typed transition layer: CAS-loss and replay tests,
|
|
store-separation checks, packaged-witness authentication, brake/timeout process
|
|
timeline tests, child-claim-before-cognition proof, exact receipt substitution
|
|
rejection, and negative scans proving no runtime Cargo or historical queue path
|
|
survives. A nonblocking trust seam remains: the parent currently compares its
|
|
post-launch process observation with the child's atomic claim. The claim closes
|
|
child bootstrap authority, but a future hardening pass should replace parent
|
|
observation trust with an OS-authenticated parent/child launch channel where the
|
|
host supports one; it is not permission to accept PID-only identity.
|
|
|
|
### Resident deployment and organizational loop
|
|
|
|
Heartbeat `serve` owns one physiology sequence: reconcile an exact terminal
|
|
acknowledgement; retain pressure under the brake; refuse replacement while a
|
|
coordinator is active; emit one grant when clear and pressured; otherwise run
|
|
bounded void/sleep work. Restart resumes typed state rather than inferring
|
|
completion from exit codes or journals.
|
|
|
|
`epiphany-swarm status` is a non-actuating join over exact
|
|
runtime/release/witness/source identity, packaged siblings, physical store
|
|
separation, heartbeat and Self freshness/coherence, lease sight,
|
|
runtime-scoped brake, writable workspace, and credential posture. The daemon
|
|
supervisor remains the sole signed Idunn health writer and may aggregate the
|
|
exact heartbeat/Self provider pair. Wrong-release evidence contradicts;
|
|
missing evidence warms; stale or incoherent evidence degrades. Readiness,
|
|
health, systemd, and PID sight cannot write deployment admission.
|
|
|
|
Yggdrasil separates provenance from Body. `/srv/epiphany/source/current` is
|
|
immutable release source. `/var/lib/gamecult/epiphany/workspace` is the writable
|
|
domain Body carrying repository binding, persistent Modeling map, Mind state,
|
|
and Hands consequences. Service authority is split as follows:
|
|
|
|
- `epiphany.service`: supervisor/projector and signed aggregate health;
|
|
- `epiphany-heartbeat.service`: heartbeat pressure, state, and grants;
|
|
- `epiphany-swarm.service`: resident-Self state and bounded coordinator turns.
|
|
|
|
Coordinator, model runtime, and tool spine are witnessed bounded children.
|
|
Deployment authenticates them, preserves coverage checkpoints across retries,
|
|
initializes heartbeat, manages the three units together, waits for typed
|
|
readiness, and crosses admission only through Idunn.
|
|
|
|
```text
|
|
domain Body -> persistent Modeling map -> Self pressure -> Imagination proposal
|
|
^ ^ |
|
|
| +-- Self proposal-review request ----------+
|
|
| ^ v
|
|
| signed feedback -> Self consideration -> Imagination candidate
|
|
| Mind review/adoption
|
|
| |
|
|
+---------------- Hands consequence <- explicit route -------+
|
|
|
|
|
Bifrost exact release
|
|
|
|
|
Idunn deployment
|
|
```
|
|
|
|
Every arrow is a typed request or receipt. Persona owns conversation;
|
|
Modeling owns the persistent map; Imagination proposes; Mind adopts, refuses,
|
|
or holds; Hands changes the Body only through an explicit route; Bifrost and
|
|
Idunn separately own release and deployment. Operator silence permits bounded
|
|
observation, map maintenance, rumination, and proposals. It grants none of the
|
|
later consequences.
|
|
|
|
This map must change when ownership changes. Historical scars belong in git,
|
|
evidence, or an explicitly archived note—not in the machine's Modeling state.
|