Epiphany/notes/repo-frontier-organ-loop.md

Repo Frontier Organ Loop

Objective

Preserve the Aetheria-shaped engineering loop as typed causal identity, not as coordinator memory or prompt roleplay. One repository wound must remain the same wound while Modeling describes it, Mind admits it, Self routes it, Hands acts on it, Soul judges it, and Modeling closes or revises it.

This closed route is the first proof slice, not the whole Aetheria lesson. The larger success was corrective circulation between distinct organs: Eyes could invalidate substrate assumptions, Imagination could revise campaign shape, Soul could reject a locally green implementation, and Self could reorder work from those durable artifacts. RepoModel is connective tissue for that cognition; it is not a substitute for it. Later slices must admit typed challenges and plan revisions from those organs without giving any of them direct model-write authority.

Authority Map

• Owner: the canonical RepoModel entry inside the runtime-spine CultCache.
• Inputs: immutable Modeling worker result, exact patch bytes and base model identity, accepted evidence, and—when resolving work—the exact frontier route, Hands consequence chain, and Soul verdict.
• Outputs: a replacement model plus immutable specialized Mind review and model admission receipt committed in one conditional batch.
• Derived state: thread-state graphs/frontier/checkpoint are continuity and UI projections; semantic indexes rank eligible typed claims; prompt context and gate JSON explain admitted authority but never create it.
• Forbidden writers: sibling-store refresh, generic Modeling statePatch anatomy, coordinator reason strings, frontierNodeIds, evidence-id prefix matching, and dashboard/operator projections.
• Shared path: Modeling patch -> Mind admission -> Self route F -> Hands intent and consequence F -> Soul request and verdict F -> Modeling resolves F.
• Deletion line: remove sibling memory-graph.msgpack as a live authority after one explicit import; remove Modeling graph/frontier writes from generic role acceptance; refuse ContinueImplementation without an admitted current route; replace prefix-based Hands-chain inference with typed reload and validation.

Atomic Boundaries

1. Modeling result is immutable worker evidence.
2. Exact current-model compare-and-swap plus specialized Mind review and model admission receipt is one runtime-spine store transaction.
3. Self route insertion verifies the same current model and frontier item under the conditional store lock.
4. Hands preflight verifies current route before consequence; immutable receipts preserve historical truth afterward.
5. Soul request binds one complete typed Hands chain; accepted verdict binds that request and route.
6. Resolution admission validates the same route and verdict before replacing the model and making the frontier ineligible for subsequent selection.

Invariants

• No model effect exists without its admission receipt in the same snapshot.
• No admission receipt can claim a model revision/hash absent from that snapshot.
• A route freezes model revision/hash, frontier item hash, target claims, source scope, and selected organ.
• Hands cannot act from prompt prose or gate JSON; it requires the persisted route.
• Soul cannot judge a substituted or partial Hands chain.
• A resolution patch can affect only the routed frontier item in the first closed loop slice.
• Once F is resolved, retired, or superseded, Self cannot select F again.

Landed Causal Slice

1. Conditional atomic batches and absent-only insertions protect the single-file CultCache store under its cross-process lock.
2. Runtime-spine owns the imported canonical RepoModel and specialized Modeling result plus Mind admission documents.
3. Self selects an eligible frontier item and binds the main-agent Hands gate to an immutable route; no actionable route means no Hands authority.
4. Immutable Substrate, Hands, Soul verification, and Modeling request documents preserve exact causal identity. Final admission replays the complete chain.
5. Verdict incorporation changes exactly the routed frontier item. Pass resolves; nonpass blocks. Hostile substitution, concurrent identity, stale model, split-retry, and terminal nonselection proofs pass, and independent Soul review accepts this slice.

Selected Proposal Ingress

The first upstream contribution path now preserves the same causal discipline. A User proposal is inert evidence. Coordinator selection does not make it true, and a request ID is not a bearer token. The coordinator launch transaction atomically binds one selection to one Modeling job and injects the exact typed proposal projection into that job's persisted launch document. The binding seals the worker-visible document hash. Modeling may contribute one contestable frontier interpretation; Mind admits it only after replaying the exact proposal/request/projection/job/result/review chain. No plan, route, Hands authority, or frontier lifecycle decision is created by this ingress.

Ordinary Modeling Evolution may revise repository anatomy but cannot mutate frontier. Selected-proposal Evolution may perform exactly one frontier operation: one proposal-citing UpsertFrontier. This keeps the proposal mouth from becoming a hidden workflow engine while leaving later Eyes, Imagination, Self, Hands, and Soul artifacts free to challenge and reshape the contribution.

Next Organ Line

The parallel RepoWorkModelingRequest/route/finding/map authority has already been cut; remaining historical rows are sight-only and cannot feed gates, actions, closure, or publication. Do not resurrect that deletion as future work.

The next live cut is corrective circulation: admit typed Eyes challenges that can invalidate or stale exact RepoModel claims and create evidence pressure without giving Eyes model-write authority. Then bind the existing Self planning request to a real Imagination worker result and Mind adoption. Only after those artifacts circulate cleanly should an adopted plan gain a distinct Self execution route.