Epiphany/state/scratch.md

Scratch

This file is disposable working memory for the current bounded subgoal.

Current Subgoal

Make Body-bound workspace coverage operational without letting Qdrant, mutable model tags, process guesses, or service telemetry impersonate truth.

Landed checkpoint aa6b3efe proves sealed text/vector input validation, exact managed Qdrant metadata, whole-collection point/payload observation, and exact Body/plan/claim/prior-head terminal CAS. The following service work is still uncommitted and under hostile review.

Current authority map:

• Repository Body CultCache owns source observation, obligation, plan, claim, attempt, receipt, and coverage head.
• The dedicated workspace-coverage projector owns one authenticated execution incarnation. Its fixed supervisor policy derives only runtime store, Verse, interval, Qdrant endpoint, and Ollama tag. It cannot accept workspace, Body-store, collection, dimensions, or arbitrary command authority.
• Qdrant is disposable projection. Ollama is an embedding actuator. Neither can mint coverage state.
• A claim must bind executor incarnation and startup receipt. Unknown or malformed claim/attempt state refuses overwrite.
• Recovery is intentionally absent. A newer launch plus ready heartbeat does not prove the prior owner dead. Add supervisor-issued typed termination/death evidence bound to the prior launch before any recovery CAS exists.

Soul blockers found 2026-07-15:

1. Bind authenticated launch runtime id to the runtime Body route before any Body access. This hardening is now in the worktree.
2. Observe and hash exact stored vectors, not only point IDs/payloads.
3. Bind the plan to immutable Ollama model artifact digest, not mutable tag plus dimensions.
4. Replace per-file full Body-store reloads with one authenticated read session and classify exact Current before rematerializing bytes.
5. Give failed, fenced, and superseded claim collections an explicit retirement owner; claim/epoch isolation without GC leaks a collection per retry.
6. Do not print raw chained backend/filesystem faults while claiming privateStateExposed=false; publish typed sanitized fault classes.

Local backend proof: Ollama is live at 127.0.0.1:11434 with qwen3-embedding:0.6b, digest ac6da0dfba84a81fdbfbaf330198c33cd77c4cdfc53e8bc50eb581914a15621d, 1024 dimensions. Docker container voidbot-qdrant uses Qdrant 1.17.1 but is stopped. The hostile proof fixes passed; a real ignored smoke started Qdrant, projected through Ollama, exact-scroll-verified payloads and vectors, classified the result Current, deleted its isolated collection, verified no coverage collection remained, and stopped Qdrant again.

Exact native process identity (2026-07-16)

The process-observation foundation now identifies a process incarnation by PID, native creation token, and canonical executable path. Windows compares identity through a held process handle before classifying it alive or exited; Toolhelp absence is distinct from access denial and query failure. Linux uses boot id, proc starttime, executable identity, and zombie state. Unsupported Unix targets refuse to pretend they have Linux /proc evidence.

The legacy PID-only projection is display-only and can emit only Alive or Missing; it cannot mint death evidence. Tests prove current-instance life, PID-incarnation replacement, and exact child exit. Next add enrolled OS-host identity, then reserved launch/heartbeat and immutable termination documents before any recovery CAS.

Enrolled host incarnation (2026-07-16)

The host root is now a dedicated non-workspace CultCache document with one immutable Ed25519 enrollment and a narrow signing handle. Existing, malformed, unprotectable, or binding-mismatched state fails closed; enrollment never silently regenerates identity. Windows stores it under LocalAppData, protects the seed with CurrentUser DPAPI, and labels its limited assurance honestly. Linux uses the XDG/home state root, 0700/0600 permissions and machine-id binding, explicitly labeled cloneable. This is enrolled OS-installation continuity, not a claim about physical chassis. Purpose-bound signature and immutable/fail- closed tests pass. The next cut is specialized reserved launch/heartbeat state.

Reserved managed-process authority map (2026-07-16)

Generic lifecycle and daemon-heartbeat documents are no longer acceptable owners for the reserved coverage projector. The replacement has three typed documents with separate authority:

• Idunn's signed launch binds the exact current policy envelope, enrolled host record, proven boot, PID+creation-token+canonical executable, executable digest, provider incarnation, and an ephemeral provider public key.
• The provider's signed heartbeat binds that exact launch envelope and repeats the host/boot/process tuple with monotonic per-launch sequence.
• Idunn's immutable termination observation names the exact prior launch and last heartbeat and may record only exact exit, exact missing/replaced process on the same proven boot, or a different proven boot on the same enrolled host.

Termination must be persisted before replacement spawn. Replacement launch and signed ready heartbeat follow; only then may one Body CAS terminalize the old claim/attempt and acquire epoch+1. Generic lifecycle/heartbeat writers must reject reserved coverage identities after migration. Timeout, staleness, newer launch, Qdrant state, PID-only absence, inaccessible process, unknown boot, or host mismatch are never death evidence. The provider signing seed travels in one fixed-size binary frame over reserved-child stdin (Stdio::piped()), never argv/env/store/logs. The child requires exact frame length plus EOF, derives the public key, then waits for and authenticates the launch document before acting. Write or persistence failure kills and waits the child; all nonreserved service stdin is explicitly null. This uses Rust's stable cross-platform child-stdin contract instead of bespoke inherited-handle plumbing.

Live reserved authority migration (2026-07-16)

The supervisor/projector chain now consumes the specialized documents. Idunn generates the ephemeral provider seed, spawns, captures exact process identity, writes the fixed stdin frame, then host-signs and persists the launch; every failure after spawn kills and waits. The child reads exact frame+EOF and checks host, current policy, boot, PID generation/path, launch digest, and derived public key before any service pulse. Heartbeats are specialized and signed.

Generic lifecycle and generic heartbeat writers now refuse the reserved coverage identities, and the old coverage lifecycle authenticator is gone. Claim/attempt schema v1 binds managed_process_launch_id; v0 positional state cannot impersonate the new semantic owner. A native epiphany-host-identity enroll/status actuator was added, and this Windows installation was enrolled once at the default DPAPI CurrentUser path. Next build immutable termination evidence before replacement and only then the Body recovery CAS.

Immutable exact termination evidence (2026-07-16)

Idunn can now publish one host-signed termination observation for one exact coverage launch. It exact-CASes the current policy, signed launch, and that launch's latest signed heartbeat while inserting an immutable per-launch key; there is no global termination head. Different proven boot, exact exit, exact same-boot absence, and exact PID replacement are the only outcomes. Alive, inaccessible, indeterminate, unknown boot, host mismatch, collisions, and moved source envelopes fail closed. The fake observation seam is module-private. Authentication rejoins the signed record to all exact persisted sources.

Next wire reconcile order: termination first, replacement launch second, replacement signed-ready third, then one Body recovery CAS. No timer gets a vote.

Exact abandoned-claim transfer and Idunn wiring (2026-07-16)

Recovery now derives the Body store from the runtime route, authenticates the live Body basis, joins obligation/plan/claim to it, verifies exact old launch and immutable termination, requires the replacement's signed causal edge plus current ready heartbeat, and commits failed history, epoch+1 successor, and an immutable recovery receipt in one Body CAS. The receipt binds exact CultMesh envelope digests and reconstructs against CultMesh plus current Body state.

Idunn has a reserved reconciliation branch. Generic lifecycle PID receipts no longer decide workspace-coverage survival. Exact termination precedes spawn; the launch writer admits one replacement for that termination; signed ready precedes Body recovery. A concurrent launch loser is killed.

Remaining wound: termination requires a latest heartbeat. A child dying after signed launch persistence but before heartbeat sequence one can strand the chain. Make heartbeat optional additional termination evidence, then run an isolated live death/replacement/recovery smoke. Reboot still needs live operator approval.

Pre-readiness death seam closed (2026-07-16)

Launch, heartbeat, and termination now contend on one typed per-launch process evidence head. Launch creates generation 1; heartbeat advances it; termination seals it. Termination v1 can carry no heartbeat when the exact signed launch and native host/boot/process proof already establish death. A late heartbeat cannot resurrect the launch. Six focused process tests, supervisor/projector suites, and all-target check pass. Next: real GUID-scoped recovery smoke.

Live workspace coverage recovery passed (2026-07-16)

Proof: C:\Users\Meta\AppData\Local\Temp\epiphany-workspace-coverage-a577f820-b0e2-4733-b628-529ee3bdb143\proof.json. Initial epoch 1 owner was killed; Idunn produced exact termination, unique causal replacement, signed readiness, epoch 2 Body authority, and reconstructable receipt 2b44f28f-7c0f-4ad2-aefe-d7c8222e8642. The replacement was killed only after exact launch-incarnation revalidation and only the two cryptographically derived fixture collections were eligible for deletion. Operator orchestration restored voidbot-qdrant to stopped. Before emitting success the smoke verified both owned collections absent. The proof binds the executed binary hash, exact embedded smoke-source hash, source head, and tracked-source diff digest; it proves fresh-store reopen authentication, not an OS process restart.

The run found and cut two last-minute lies: PID 4 was not a normal-user Windows boot oracle, so boot identity now comes from native kernel boot time; and the replacement could not resume its own recovered running claim, so exact v3 owner resumption is allowed while all foreign incarnations remain contended.

Next: full deployability audit. Reboot/logon proof still requires permission.

Deployability audit cut (2026-07-16)

Operational after login, not artifact-clean. Yggdrasil Qdrant/Ollama and both packaged semantic query gates pass. Installed siblings predate 34802407 and are mutable/mixable. Build one immutable commit-addressed release witness before replacement. Mind still needs the R1/model+admission/live-semantic/live-coverage/ R2 repository-readiness join. The readiness plan's June queue was stale and is now an evidence matrix. Sight surfaces no longer say queryAdmission=false; they never owned that decision. Final reboot/logon proof needs live approval.

Witnessed release deployed (2026-07-16)

Commit dd80f4a5 packaged as release sha256-c941...f923, witness sha256-f039...e04a. Exact detached source plus initialized submodules plus tracked lockfile plus isolated --locked build; four siblings only. Task and Idunn pin the witness. Reconciler 21228 -> projector 22736; Mind/Modeling query admission passed. Exact-path child kill -> direct-child projector 19748, launch receipt 86a42d51-9930-4b5d-9e61-e74c82a0d808, ready heartbeat 4fc91977-b635-474b-812b-c364847e2b4b, witnessed digest match. Next is Mind's repository readiness join. Reboot remains permission-bound.