Epiphany/notes/hands-cultnet-contracts.md

Hands CultNet Contracts

Objective: make Hands the action organ. Commands, patches, commits, PRs, and rollbacks are consequences, not thoughts. They enter as bounded action intents and leave receipts that can be verified, refused, or admitted into Mind state.

Authority Map

• Owner: Hands owns execution of bounded actions.
• Inputs: typed action intents, Substrate Gate access grants, requested commands or patches, current repo policy, Soul verification requirements, and coordinator authority.
• Outputs: Hands action reviews, command receipts, patch receipts, commit receipts, PR receipts, rollback receipts, and action refusal receipts.
• Derived state: diffs, command logs, commits, PR URLs, and rollback notes are action receipts. They are not durable Mind state until Mind admits them.
• Forbidden writers: raw workers, Persona, Eyes, Imagination, Self, compatibility JSON-RPC routes, and bridge tools must not execute repo-affecting commands, edit files, commit, publish, or roll back without the Hands path after Body access.
• Shared path: file edits, shell commands, commits, PRs, and rollbacks should share Hands action intent/review/receipt semantics.
• Deletion line: Substrate Gate grants access; it does not execute. Soul verifies; it does not execute. Mind records durable state; it does not execute.

Contract Families

• epiphany.hands.action_intent: request for bounded action.
• epiphany.hands.action_review: Hands decision and execution plan.
• epiphany.hands.command_receipt: proof of command execution.
• epiphany.hands.patch_receipt: proof of file mutation.
• epiphany.hands.commit_receipt: proof of commit creation.
• epiphany.hands.pr_receipt: proof of pull-request publication.
• epiphany.hands.rollback_receipt: proof that failed action was unwound.
• epiphany.hands.action_refusal_receipt: proof that Hands refused to act.

Neighboring Gates

Substrate Gate grants substrate access before Hands touches the repo. Eyes packages evidence for action reasoning. Soul verifies action results and invariants. Mind admits durable state after the action and verification receipts exist.

Hands is not a permission organ. It is the actuator. The wrench does not bless itself.

Executable Slice

The first runtime-spine proof chain now exists:

HandsActionIntent
-> HandsActionReview
-> HandsPatchReceipt
-> HandsCommandReceipt
-> HandsCommitReceipt

epiphany-core::hands_gateway owns the typed document bodies and constructors. epiphany-core::runtime_spine can persist and reread the intent, review, patch, command, and commit receipts from the runtime-spine CultCache store. epiphany-hands-action-smoke proves the compact chain without executing shell commands, editing files, or creating a real commit. The launch organ contract's repo-action proof profile now requires the full Hands chain, not only the final patch receipt. epiphany-mvp-coordinator now turns continueImplementation into a persisted Substrate Gate grant plus Hands intent/review gate and exposes the receipt ids in the operator step. epiphany-hands-action is the first native consequence recorder for that gate: record-patch, record-command, and record-commit load the stored intent/review, reject mismatches, require an approved review, enforce allowed operations, and keep patch/commit changed paths inside the requested scope. record-pass --gate-summary <coordinator-summary.json> consumes the coordinator artifact and emits patch, command, and commit receipts in one post-implementation call. epiphany-mvp-coordinator-smoke now proves the deterministic chain from simulated continueImplementation through gate emission to record-pass receipts.

This is still a gate and receipt artery, not full action execution. The next live-action cut must call the recorder from the implementation turn or local wrapper after real edits/checks/commit and before Soul/Mind call the result accepted.