683 lines
44 KiB
Markdown
683 lines
44 KiB
Markdown
# Epiphany Native Implementation Plan
|
|
|
|
This is the live campaign plan. The Codex-fork phase succeeded by starving
|
|
Codex of Epiphany authority; Epiphany is no longer implemented as a collection
|
|
of app-server routes.
|
|
|
|
## Objective
|
|
|
|
Build an inspectable native organism whose typed state, runtime, organ gates,
|
|
memory, scheduling, interfaces, and social crossings can operate without Codex
|
|
owning Epiphany cognition. Retain Codex-derived code only where it provides an
|
|
earned OpenAI-compatible authentication or model-transport capability.
|
|
|
|
## Current Mechanism
|
|
|
|
- `epiphany-state-model` owns shared typed semantic contracts; durable Mind is keyed CultCache owned by `epiphany-core`.
|
|
- `epiphany-core` owns keyed Mind admission, runtime spine, organ gates,
|
|
Resident Self physiology, Persona, and CultMesh integration. Coordinator policy,
|
|
status, and every migrated work family consume keyed Mind plus exact runtime
|
|
receipts. Persisted `EpiphanyThreadStateEntry`, the in-memory
|
|
`EpiphanyThreadState` schema, generic launch/update transactions, and global
|
|
launch revisions have been deleted with no compatibility path.
|
|
- Native binaries expose coordinator, status, state, model runtime, Persona,
|
|
repository Body observation, governed work, and Verse operations. Deployment
|
|
and daemon survival belong to Idunn; retrieval providers remain external
|
|
evidence sources until a typed reasoning consumer earns them.
|
|
- CultCache stores typed state and receipts; CultMesh/CultNet carry typed local
|
|
and federated projections.
|
|
- Vendored Codex exposes no Epiphany route, DTO, thread-state field, rollout
|
|
migration, scheduler, watcher, or bridge crate.
|
|
|
|
## Invariants
|
|
|
|
1. Mind is the only durable state-admission gateway.
|
|
2. Substrate Gate controls access; it does not admit state.
|
|
3. Eyes establishes provenance; Hands causes consequences; Soul verifies them.
|
|
4. Self coordinates but does not steal another organ's authority.
|
|
5. Heartbeat/Idunn own physiology and daemon survival, not project truth.
|
|
6. Persona speech and outside-world action preserve consent, identity,
|
|
provenance, and private-state seals.
|
|
7. CultMesh projections and Eve renderers never become owners.
|
|
8. Codex remains free of Epiphany state/process/interface authority.
|
|
|
|
## Completed Foundation
|
|
|
|
- Typed reasoning bases, terminal decision contexts, exact Mind batch CAS, and
|
|
keyed objective/RepoModel documents.
|
|
- Native coordinator facade and derived status/recommendation surfaces.
|
|
- CultCache runtime spine with worker, Mind, Eyes, Substrate Gate, Hands, Soul,
|
|
Continuity, and coordinator receipts.
|
|
- Native OpenAI auth/model/runtime spine.
|
|
- Native heartbeat, daemon supervision, and cluster liveness surfaces.
|
|
- Native Persona memory/turn/audit machinery and Bifrost-governed public mouths.
|
|
- Native repo-work planning, Hands/Soul/Mind closure, public-proof, credit, and
|
|
Bifrost accounting families.
|
|
- CultMesh local Verse, compact operator readbacks, Gjallar sight, Eve
|
|
connection receipts, and three-Verse trust boundaries. Organ contract
|
|
summaries derive directly from their CultNet owners; CultMesh persists no
|
|
parallel contract directory. Fixed Verse and public-room policy project
|
|
directly into the local context rather than occupying mutable store rows.
|
|
- Native runtime and keyed Mind receipts project without JSON-to-CultMesh
|
|
shadows. Unauthenticated pre-provider Odin/Eve/tool rows and their retirement
|
|
migrators are outside the live schema.
|
|
- Complete removal of the Epiphany Codex app-server compatibility surface and
|
|
`epiphany-codex-bridge`.
|
|
|
|
## Active Campaign
|
|
|
|
### 0. Federate Decision-Auditable Mind
|
|
|
|
Status: source-complete; exact-package capstone open. The persisted thread head,
|
|
global revision transaction, aggregate RepoModel, generic Mind gateway, and
|
|
dual readers are deleted. Concrete invariant owners submit exact-envelope
|
|
`MindMutation` plans; CultCache batch CAS merges disjoint identities and refuses
|
|
same-identity or changed-strong-read conflicts without partial writes.
|
|
|
|
- Preserve the sealed reasoning basis, exact final native/provider request,
|
|
governed tool observations, structured terminal decision/failure, and Mind
|
|
commit receipt.
|
|
- Keep family requests and admission owners concrete; share only pure identity,
|
|
continuation, binding-validation, and CAS invariants.
|
|
- Derive work from unresolved typed obligations. Events, lanes, timestamps,
|
|
thread provenance, and aggregate view digests remain projections only.
|
|
- Assemble RepoModel and semantic work from complete keyed document sets.
|
|
Fence namespace phantoms at the operation snapshot; do not invent a global
|
|
head to make set membership convenient.
|
|
|
|
Exit evidence:
|
|
|
|
- concurrent Persona, Hands, Modeling, and Verification writes to disjoint
|
|
identities all commit;
|
|
- same-key conflict, changed strong reads, and exact replay follow the declared
|
|
merge law;
|
|
- every model-backed success or failure can be audited to its exact sealed
|
|
projection without transcript retention;
|
|
- source guards reject persisted thread state, aggregate RepoModel authority,
|
|
caller-authored provider storage, and generic Mind mutation mouths.
|
|
|
|
### 1. Repair Modeling
|
|
|
|
- Keep `notes/epiphany-current-algorithmic-map.md` aligned with source.
|
|
- Distinguish historical evidence from current mechanism in long handoffs.
|
|
- Remove live-looking references to deleted bridge/routes from current docs,
|
|
prompts, wrapper help, and operator output.
|
|
- Add source guards where a removed authority could plausibly regrow.
|
|
|
|
Exit evidence:
|
|
|
|
- current canonical docs contain no false live paths;
|
|
- every mapped owner/file exists;
|
|
- source scans show no Epiphany Codex protocol authority.
|
|
|
|
### 2. Normalize Native Operator Contracts
|
|
|
|
Status: complete for the canonical coordinator/status boundary. The two-path
|
|
service constructor and status flags are deleted, native JSON emits `state`,
|
|
and the wrapper supplies the live unified store. Source guards reject the old
|
|
field and flags.
|
|
|
|
- Audit native JSON artifacts for compatibility-shaped field names and nested
|
|
Codex response assumptions.
|
|
- Rename only when no external contract depends on the old shape; otherwise
|
|
publish a typed migration and explicit expiry.
|
|
- Prefer CultCache/CultMesh documents as load-bearing state; keep JSON at CLI,
|
|
schema, MCP, OpenAI, and other xenos boundaries.
|
|
|
|
Exit evidence:
|
|
|
|
- native coordinator/status consumers read native fields directly;
|
|
- wrapper summaries are projections, not reconstructed policy;
|
|
- no load-bearing JSON sidecar decides behavior.
|
|
|
|
### 3. Close The Organ Loop
|
|
|
|
Status: active. The scheduler can no longer impersonate Modeling/Mind after
|
|
Hands execution, and closure refuses deterministic fallback or a passing
|
|
verdict without an explicit model-authored finding. That finding now persists
|
|
as a typed runtime document backed by a passing Soul receipt; Mind rereads it,
|
|
and repo-map/CultMesh admission carries its receipt ID. Repo-map admission is
|
|
now atomic: the typed canonical map entry and both Mind witnesses publish in one
|
|
CultCache batch, while CultMesh lowers the committed entry. The custom map
|
|
MessagePack owner is deleted. Stable phase IDs are immutable: identical retries
|
|
reread existing Soul, Modeling, and Mind/map documents, while conflicting retry
|
|
cargo fails without changing admitted state.
|
|
|
|
- Prove Hands → Soul → Modeling → Mind → Self on a fresh repository without
|
|
supervisor implementation or direct worker-thought inspection.
|
|
- Ensure every consequence has Substrate Gate scope, Hands receipts, Soul
|
|
verdict, Modeling map update, and Mind admission before the next Hands turn.
|
|
- Treat no-diff, unreviewable, timeout, and regather outcomes as explicit typed
|
|
states rather than success-shaped silence.
|
|
|
|
Exit evidence:
|
|
|
|
- fresh-repo live-fire closes one nontrivial work item;
|
|
- negative tests prove workers/Hands/Soul cannot bypass Mind;
|
|
- operator-safe artifacts explain owner, inputs, outputs, and verdicts.
|
|
|
|
### 4. Make Physiology Durable
|
|
|
|
- Finish Idunn-owned service installation/audit aftercare without moving
|
|
elevation authority into Self or wrappers.
|
|
- Prove cooldown-after-completion, no overlapping lane heartbeat, idle sleep,
|
|
explicit-pressure-only wakeup, and recovery across restart.
|
|
- Ensure scheduler and liveness receipts remain separate from project state.
|
|
|
|
Exit evidence:
|
|
|
|
- seven organ daemons survive restart under typed policies;
|
|
- complete lifecycle audits close the current elevated-service warning;
|
|
- no duplicate daemon keeper exists.
|
|
|
|
### 5. Publish Eve/CultUI Interfaces
|
|
|
|
- Emit typed Eve composition/state graphs for coordinator, organ status,
|
|
receipts, repo work, Persona, and daemon physiology through CultMesh.
|
|
- Lower those graphs in Aquarium/browser/TUI without renderer-owned truth.
|
|
- Keep private/internal, trusted-local, and public Verse surfaces distinct.
|
|
|
|
Exit evidence:
|
|
|
|
- one composition graph renders in at least GUI and compact TUI targets;
|
|
- commands route back through typed owner intents;
|
|
- UI timeline probes observe transition-time invariants.
|
|
|
|
### 6. Prove Federated Work And Social Citizenship
|
|
|
|
- Demonstrate a Bifrost-originated work item flowing through Epiphany lanes,
|
|
maintainer review, credit/ledger receipts, and operator-safe public proof.
|
|
- Demonstrate Persona discussion with keyed typed memory, consent, disagreement,
|
|
and governed external crossing.
|
|
- Treat foreign dreams as thought weather until a reviewed adoption receipt.
|
|
|
|
Exit evidence:
|
|
|
|
- public proof contains no private worker/operator context;
|
|
- Bifrost and Heimdall ownership remains explicit;
|
|
- local agency, refusal, exit, and provenance survive federation.
|
|
|
|
## Verification Strategy
|
|
|
|
- Unit tests prove local authority and validation.
|
|
- Adjacent-organ smokes prove typed handoff.
|
|
- Native end-to-end runs prove operator/product contracts.
|
|
- Negative source and runtime checks prove old owners cannot regain authority.
|
|
- Timeline checks cover load, user/programmatic transition, mid-transition,
|
|
settled state, and restart/re-entry where timing matters.
|
|
- Served/runtime versions and schema versions are exposed when deployment or
|
|
cache uncertainty could impersonate logic failure.
|
|
|
|
## Cut Line
|
|
|
|
Delete or demote:
|
|
|
|
- stale current-looking bridge/route prose;
|
|
- compatibility-shaped native code with no external consumer;
|
|
- wrapper policy duplicated from Rust owners;
|
|
- whole-context serialization where a narrow typed query exists;
|
|
- tests whose only purpose is keeping extinct compatibility anatomy alive;
|
|
- any cache, registry, adapter, mode, or metadata field without a named
|
|
invariant and owner.
|
|
|
|
## Immediate Next Action
|
|
|
|
Keep the five-day shakedown, Ox17 deployment, and Model Atlas operational Gate
|
|
1 paused. Continue the source-subtraction and test-authority audit from exact
|
|
`b0a4978d`. The current sequence has deleted the semantic-memory/workspace-coverage
|
|
projection system, its local daemon supervisor, and the surviving generic
|
|
RepoModel profile, impossible lifecycle, producerless receipt/summary, and
|
|
decorative scoring axes. Modeling consumes typed Body and keyed RepoModel state
|
|
directly. Domains are seed-owned; model passes mutate only live keyed operations.
|
|
Persona consumes keyed memory and social state directly. No
|
|
Epiphany-owned Rider or Unity bridge exists: Brokkr owns Unity through typed
|
|
Eve/CultMesh capabilities, and a future Rider daemon will own Rider. Do not
|
|
admit a fresh package until the remaining production surfaces and tests have
|
|
earned their authority under the same audit.
|
|
|
|
Model Atlas has component proofs but no live inter-swarm collaboration run.
|
|
Preserve its publication, trust, transport, projection, Soul verification, Self
|
|
admission, wake, brake, and Eve path until Gate 1 exercises the complete crossing.
|
|
Streamlining may remove duplicate authors and process shells; it may not spend
|
|
the only end-to-end collaboration path before it has carried real traffic.
|
|
|
|
Resident Self now solely imports authenticated Bifrost deliveries; exact
|
|
`3dda58a5` deletes the standalone Persona feedback ingress and its old Starfire
|
|
snapshot seam. Exact `56267201` deletes the three unadmitted Atlas daemon
|
|
shells while retaining their typed library owners. Exact `900c5232` deletes the
|
|
callerless frontier-proposal wrapper while retaining typed Self/runtime intake.
|
|
Exact `94098223` reduces host identity to provider-owned public-anchor
|
|
verification and deletes Epiphany's private-custody stack. Exact `b78ffb25`
|
|
then deletes the callerless Hands consequence recorder and command-description
|
|
handshake after proving that they executed nothing. Exact receipt-chain
|
|
admission remains; the coordinator reports `awaitingHandsExecutor` until a real
|
|
actuator owns execution and observed consequences. Exact `f3360248` deletes
|
|
three redundant helper-spelling/cache-policy tests while retaining the actual
|
|
source-cache recovery, cache-separation, tool-loop transition, and terminal
|
|
failure proofs. Exact `a276d0f4` then collapses the generic public host-identity
|
|
verifier into Bifrost feedback admission while preserving the exact existing
|
|
wire shape and cryptographic domains. Next audit the remaining eleven
|
|
executables by real lifecycle/privilege consumer, beginning with the Persona
|
|
Discord permit process.
|
|
|
|
Exact `f8412b69` closes the last known retention wound before that capstone:
|
|
the packaged model runtime can reconstruct a decision by context ID from its
|
|
sealed basis, exact terminal requests, tool observations, structured terminal
|
|
records, and Mind commit receipts. Worker attempt archival retains the typed
|
|
result family instead of reducing it to IDs and a digest. Runtime schema v2
|
|
refuses the superseded writable archive shape; there is no reader or migrator.
|
|
|
|
Exact `553f79d9` closes the provider-schema ownership wound exposed by the
|
|
packaged capstone. One shared Responses dialect compiler now serves role and
|
|
Persona passes: it removes provider-illegal conditional structure, preserves
|
|
supported standard-model constraints, compiles UUID formats into enforced
|
|
patterns, and leaves the full native schema as the only admission contract.
|
|
The failed package roots remain immutable evidence; no role-specific output
|
|
exception was added.
|
|
|
|
Exact `a8f3c1f0` closes the next packaged falsification at the RepoModel seed
|
|
owner. Repository bootstrap had passed immutable Git source identity where the
|
|
keyed model contract required the authenticated runtime Body binding. The
|
|
bootstrap now derives that value from the admitted Body observation, while the
|
|
RepoModel initializer independently validates the complete route before any
|
|
envelope is written. A hostile seed refuses byte-identically; no migration or
|
|
fallback identity exists.
|
|
|
|
Exact `bb823c54` closed the two wounds found by that native replay. One shared
|
|
model-pass terminal owner atomically binds a typed failure to its sealed
|
|
decision context and closes the exact Persona session. Its derived semantic
|
|
cache design was later proven unconsumed and deleted wholesale at `856648de`;
|
|
the sealed typed Body/RepoModel basis remains the current Modeling input.
|
|
|
|
Cut in this order:
|
|
|
|
1. **Landed at `79346523`:** replace the aggregate-shaped role reasoning input with one sealed typed
|
|
projection assembled from exact keyed Mind document versions. The final
|
|
model request must render that projection; citing keyed sources while
|
|
rendering the old thread snapshot is explicitly forbidden.
|
|
2. **Body admission landed at `2eb95df6`; current-work projection landed at `e42788c9`:** one pure typed projection now derives Body Modeling, Eyes continuation, proposal Modeling, frontier planning, and Hands readiness from keyed Mind/runtime receipts.
|
|
Modeling must derive from the current Body/RepoModel obligation; Eyes only
|
|
from explicit external-evidence obligations. Body-generation Modeling
|
|
identity, typed Body-to-Mind admission, sealed reasoning, and atomic decision
|
|
admission are landed. Current-work no longer reads the external Body store;
|
|
status consumes the shared projection. Exact `0a97eef8` deletes the later
|
|
callerless Body-only/unresolved-Body reconstruction paths and three unused
|
|
per-job continuation wrappers, leaving `project_current_work` as the sole
|
|
slice assembler.
|
|
Exact `5a047944` also removes the callerless JSON ledger-status helper,
|
|
generic role lookup helpers, unique-string wrapper, and successful-receipt
|
|
wrapper. Live typed owners remain; no generic utility replacement is added.
|
|
Exact `6ccaf937` removes the one-field repository Body Mind-view alias, the
|
|
unconsumed sorted Persona-quarantine projection, and the unconsumed generic
|
|
repo-work planning grant. Typed Mind/quarantine owners and exact live
|
|
coordinator/worker grants remain.
|
|
Exact `f6a2ad7f` removes the callerless packaged-release-head and Idunn
|
|
trust-anchor file readers. Exact release authentication and typed signed
|
|
health admission remain with their live consumers.
|
|
Exact `be611f24` removes the producerless Imagination consideration-review
|
|
writer and durable contract together. Candidates remain proposal-only
|
|
outcomes; actual adopted proposal Modeling stays in its existing lifecycle.
|
|
Runtime writable epoch is v22.
|
|
Exact `3140d305` removes the producerless Resident Self runtime-receipt
|
|
document and the definition-only coordinator role-result enum. Resident Self
|
|
state v2 refuses v1 stores; actual terminal receipts and runtime retention
|
|
remain with their live owners.
|
|
Exact `0091e0e1` removes the unread generic/OpenAI adapter-status documents,
|
|
their per-pass writers and construction helpers, one self-affirming test,
|
|
two schemas, and both runtime registrations. Exact request/provider context
|
|
and live transport construction remain. Runtime writable epoch is v23.
|
|
Exact `2e3489c4` removes four uninhabited generic planning document families,
|
|
their empty reasoning-projection field, and the 256-line issue-tracker DTO
|
|
vocabulary beneath them. Actual frontier planning and adoption remain.
|
|
Mind/runtime writable epochs are v9/v24.
|
|
Exact `a6f73fc4` removes the write-only Persona quarantine-pressure document.
|
|
The terminal turn receipt and receipt-bound quarantined mentions remain the
|
|
single blocked-consequence authority.
|
|
Exact `fed4b857` removes the unread Continuity recovery-receipt companion and
|
|
its entire module. Exact reorientation result, typed Mind decision/failure,
|
|
sealed context, and commit receipt remain the sole recovery audit path.
|
|
Runtime writable epoch is v25.
|
|
Exact `a602fbdc` removes fifteen unconsumed state-model DTO types, two
|
|
callerless OpenAI-runtime mouths, and eight definition-only type constants.
|
|
Exact keyed Mind/runtime receipts, RepoModel documents, pass-local reasoning,
|
|
and the release-owned observed worker route remain. No schema epoch changes
|
|
because none of the deleted vocabulary was registered or persisted.
|
|
Exact `9abadfe7` removes the unconsumed provider-frame observation DTO and
|
|
callback APIs from both transports, plus the provider-specific transcript
|
|
reader used only by one test assertion. Typed stream events/receipts remain;
|
|
no audit or admission path depends on frame previews or transcript text.
|
|
Exact `2a435eb5` advances Persona memory to v2 and tool receipts to v1 while
|
|
deleting duplicate effect-event provenance, an always-empty relationship,
|
|
and an always-empty raw-result reference. Mind/runtime epochs are v10/v26;
|
|
old writable stores refuse without migration.
|
|
Exact `ffd91c20` deletes three more derived fields: the fixed Research role
|
|
from Eyes packets, the fixed Epiphany Persona agent from queued mentions,
|
|
and the unread Resident Self retention timestamp. Their owning request/
|
|
context, Persona queue/turn request, and chained retention digest remain.
|
|
Eyes packet v2, Persona mention v2, Resident Self state v3/retention head v1,
|
|
and runtime v27 form the hard cut. Model Atlas remains intact for its first
|
|
live inter-swarm collaboration run; component proofs are not acceptance.
|
|
3. **Baseline transaction landed at `9f7b164f`; operator routing at `587c56d2`; Resident continuation and keyed acceptance at `478fb923`:** baseline Body Modeling is now thread-free from unresolved Body obligation through Launch/Wait/Review and exact Mind admission. Resident and operator callers consume the same family projection and acceptance owner. Thread ID remains immutable pass provenance only.
|
|
4. **Proposal Modeling landed at `d1b031cb`:** its immutable request, worker launch, runtime attempt/result, and `Modeling.proposal_frontier` commit now own Launch/Wait/Review and admission. The aggregate launcher refuses proposal cargo; the old selector, validator, context builder, and generic-launch hint are deleted. Body and Proposal share only the exact-envelope launch CAS invariant, not a mutable family registry. Exact `b0a4978d` deletes the later duplicate launch-binding document entirely; the worker launch is the sole launch owner.
|
|
5. **Continuation vocabulary landed at `e404c105` and was named truthfully at `fc5d1a4a`:** concrete pass families share one pure `EpiphanyAgentPassContinuationAction`; their semantic requests, projections, validators, and admission owners remain separate.
|
|
6. **Dormant claim-repair authority deleted at `20dd66c8`:** no request/binding/context schema, runtime carrier, coordinator branch, result cargo, export, or model lowering survives. The independent Eyes challenge fact remains. The same pass fixed two-snapshot Body/Proposal launch derivation and stress-proved single Proposal launch 20/20.
|
|
7. **Frontier-verdict Modeling landed at `d367e525`:** one exact Soul verdict
|
|
atomically creates its deterministic request; the sealed role projection,
|
|
deterministic attempt, shared Launch/Wait/Review state, and
|
|
`Modeling.frontier_verdict` commit own the complete lifecycle. Admission
|
|
accepts disjoint keyed changes but refuses a changed strong frontier without
|
|
mutation. Accepted Eyes timestamps, latest-result slots, aggregate prompt
|
|
construction, and generic role lanes cannot create or suppress this work.
|
|
8. **Frontier Research landed at `c7412998`:** the v3 request seals the exact
|
|
frontier/dependency document closure, while the full RepoModel projection is
|
|
audit cargo only. One deterministic attempt, terminal decision context,
|
|
request-bound Eyes packet, and `Eyes.frontier_research` Mind mutation own
|
|
Launch/Wait/Review/admission. Stale terminal decisions remain durable, exact
|
|
strong-state changes refuse admission byte-identically, and disjoint keyed
|
|
writes merge. Accepted Eyes, role lanes, timestamps, generic regather, and
|
|
Modeling hints cannot launch Eyes or gate Modeling. CultCache `ba6a487`
|
|
supplies the shared named nested-document encoding boundary used by Mind.
|
|
9. **Frontier Verification landed at `fc5d1a4a`:** one exact Hands commit and
|
|
its deterministic Verification request publish atomically. The sealed
|
|
request/launch/result/context lifecycle owns Launch/Wait/Review; admission
|
|
writes the keyed audit, Soul verdict, frontier-Modeling request, and Mind
|
|
commit receipt atomically. Disjoint keyed writes merge, exact-frontier drift
|
|
refuses byte-identically, and replay is stable. Generic launch/acceptance,
|
|
accepted-at/latest-result selection, dynamic telemetry prompts, and
|
|
model-authored causal IDs no longer own this family.
|
|
Exact `6ccc7dd2` removes the later transient 20-field receipt-chain summary;
|
|
the request is derived directly from its patch, command, and commit owners.
|
|
10. **Frontier Planning and PlanMind landed at `c9329ed6`:** the Planning
|
|
request seals exact frontier/dependency versions plus per-claim obligation
|
|
guards. Current-work owns deterministic Imagination and Mind attempts;
|
|
Imagination authors a typed candidate, while Mind alone adopts it through a
|
|
sealed PlanMind request and family-owned frontier mutation. Claim challenge
|
|
admission atomically updates the target claim-obligation document, so stale
|
|
planning conflicts without turning unrelated graph writes into a global
|
|
head. Thread provenance, generic coordinator validators/constructors,
|
|
aggregate role lanes, and accepted-at/latest-result behavior no longer own
|
|
this family. Exact `b55e96ea` deletes both later duplicate launch-binding
|
|
document families. Immutable worker launches now own attempt identity and
|
|
current jobs; exact failed results plus typed failure reviews own retry
|
|
ancestry and are strong reads of the retry launch transaction.
|
|
11. **Reorientation landed at `d5df53ae`:** one keyed request seals the exact
|
|
continuity projection and source document versions; deterministic attempts
|
|
bind an exact reasoning basis and terminal decision context. The family
|
|
owner alone admits resume/regather plus its continuity receipt. Model-backed
|
|
failure retains a typed Mind failure document before retry. Status and
|
|
coordinator routing use the same current-work projection. Aggregate
|
|
launch/acceptance, checkpoint/freshness recommendation, latest binding,
|
|
global revision acceptance, and accepted-at comparison no longer own this
|
|
family. Exact `8dbfcf63` deletes its later duplicate launch-binding document;
|
|
the immutable worker launch owns request/job/attempt identity, while retry
|
|
CAS strongly reads the typed failure and exact terminal runtime result.
|
|
The same cut deletes the duplicate Body Modeling and Imagination
|
|
consideration binding families. Canonical job identities and immutable
|
|
family-referenced worker launches now own all three attempt sequences.
|
|
Their semantic requests, sealed projections, result admission, substrate
|
|
grants, typed failures, and refusal/retry invariants remain family-owned.
|
|
Runtime writable state advances to v19. Model Atlas and the unrun
|
|
inter-swarm collaboration path are unchanged.
|
|
Exact `3ed1d564` then deletes the standalone public writer for the derived
|
|
frontier-Modeling request. Accepted Verification is the sole writer and
|
|
atomically commits its audit, Soul verdict, and request. The deleted path had
|
|
no production caller and survived only because an OpenAI test fabricated a
|
|
parallel Verification/Soul tableau; that test now uses ordinary Body
|
|
Modeling while preserving provider, contract, structured-result, and job-
|
|
terminality proofs.
|
|
Exact `63d2991e` then reduces the coordinator terminal receipt to the
|
|
terminal Self decision and exact resident-launch provenance continuity
|
|
consumes. Operator artifact inventory, provider/store echoes, arbitrary
|
|
metadata, step count, and final-job echo stay in their existing owners or
|
|
disappear when unread. Receipt/schema version is v1 and runtime writable
|
|
state is v20; the published schema now describes the live resident fields.
|
|
Exact `196222d9` then makes runtime sessions/jobs minimal lifecycle records:
|
|
session metadata and job metadata, summary, and artifact refs disappear
|
|
because no reader consumed them and the terminal job result already owns
|
|
consequential summary/artifact truth. Launch options no longer accept those
|
|
echoes. Runtime writable state is v21 and the closed session/job catalog
|
|
schemas are v1. Model Atlas remains intact for the unrun live inter-swarm
|
|
Gate 1.
|
|
Exact `cd2177e8` then deletes the duplicate `ensure_runtime_session` writer.
|
|
Its two test consumers now use strict session creation; a reused active ID
|
|
can no longer substitute a different objective, creation time, or
|
|
coordinator note. No persisted shape changes and runtime remains v21.
|
|
12. **Landed at `1662a012`, `07d891ba`, and `ec1431ff`:** coordinator policy now
|
|
projects keyed current work; persisted `EpiphanyThreadStateEntry`,
|
|
`coordinator_state_transaction`, generic coordinator services, the
|
|
`EpiphanyThreadState` schema/prompt renderer, aggregate freshness/context
|
|
views, generic launch/interrupt requests, and global launch revisions are
|
|
deleted. No dual reader, bootstrap aggregate, or migrator survives.
|
|
13. **Generic Mind gateway deleted at `f7948795`:**
|
|
`MindGatewayReview`, `MindStateCommitReceipt` v0, their generic interpreter
|
|
prompt, runtime registration/read APIs, phantom thought/state-effect/public-
|
|
adoption CultNet mouths, and stale launch receipt profiles are gone.
|
|
CultMesh exposes reasoning basis, decision context, and exact Mind commit
|
|
receipt as read-only audit projections; no runtime schema-catalog mirror
|
|
survives.
|
|
14. **Model-backed Planning failure repaired at `1c9aafd8`; generic role patch
|
|
deleted at `e0e75a30`:** the runtime seals
|
|
one exact terminal decision context before writing a typed frontier-Planning
|
|
failure, and the typed failure plus generic job result cite that same
|
|
context. Transport-only failure remains physiological. Research emits one
|
|
closed typed decision and its owner derives keyed Mind writes. The unowned
|
|
generic Imagination planning lane, generic patch parser, and policy
|
|
tribunals are gone.
|
|
15. **Decision-context binding unified at `12b1b285`:** runtime execution and
|
|
context sealing consume the same exact model/tool binding validators.
|
|
Provider, tool-call, tool-result, receipt, session, job, basis, and worker
|
|
substitution refuse, and transcript delta deletion leaves the retained
|
|
basis/context usable.
|
|
16. **Writable epoch cut landed at `01602fd3`:** Mind epoch v2 and runtime-spine
|
|
schema v1 are admitted only through one exact identity pair. Historical or
|
|
split runtime stores refuse before registered writers see them; foreign
|
|
physiology stores remain outside Mind ownership. No schema migrator or dual
|
|
reader exists.
|
|
17. **Keyed concurrency landed at `26b6a5bf`:** simultaneous disjoint
|
|
Modeling-node writes merge; simultaneous Verification admission and an
|
|
unrelated Modeling-node write merge; same-identity competitors yield one
|
|
winner and one typed conflict; exact replay returns the original receipt;
|
|
and reopening assembles one valid graph.
|
|
18. **Persona consequence ownership landed at `7c2ebd81`:** Interpreter
|
|
`state_note` output commits keyed Persona-memory documents through its exact
|
|
decision context; the legacy agent-memory aggregate is no longer a writer on
|
|
this path. A real Hands consequence and Persona Mind admission commit
|
|
simultaneously.
|
|
19. **Persona ingress landed at `79c0e373`:** one typed Mind pass-input
|
|
document seals the exact assembled projector input and observed source
|
|
versions before inference; every Persona stage cites it, replay reuses it,
|
|
substitution refuses, and generic role projections exclude Persona-private
|
|
documents.
|
|
20. **Restart/re-entry landed at `d3300bba`:** one exact validated Mind commit
|
|
receipt authenticates the admitted Persona input. Plan construction is
|
|
sealed behind that loader; naked typed input refuses; terminal replay makes
|
|
no external observation or model call. Current-work projection reopens
|
|
identically and without mutation across Launch, Wait, completed, and
|
|
post-Research boundaries. Build the exact clean-source package and run the
|
|
fresh-store capstone. Only then restart Model Atlas Gate 1 from a new
|
|
external root.
|
|
21. **Provider schema ownership landed at `553f79d9`:** one shared Responses
|
|
dialect compiler serves role and Persona passes. Unsupported conditional
|
|
fragments and `uniqueItems` leave provider cargo; supported standard-model
|
|
constraints remain; literal-only variants receive explicit types; UUID
|
|
formats lower to lexical patterns. Full native decoding remains the only
|
|
terminal-decision admission boundary. Three failed packaged roots are
|
|
retained as falsification evidence rather than hidden by a family prompt
|
|
patch.
|
|
22. **RepoModel seed ownership landed at `a8f3c1f0`:** the authenticated
|
|
runtime Body route, not Git source identity or caller convention, owns the
|
|
keyed model's Body binding. Bootstrap derives it from the admitted
|
|
observation and initialization reauthenticates it before writing. The exact
|
|
`553f79d9` package proved concurrent Persona plus terminal Modeling cognition,
|
|
then correctly exposed the bad seed during admission. Rebuild and replay the
|
|
capstone from exact `a8f3c1f0`; do not transplant the prior decision.
|
|
23. **Terminality and provider-authorship landed at `bb823c54`; its cache projection was superseded by `856648de`:**
|
|
a provider or contract failure seals one `EpiphanyModelPassFailure`; its
|
|
sealed context, not caller arguments, identifies and atomically closes the
|
|
exact model transport job/session. Role, reorient, and Persona failures share
|
|
this owner, while generic transport results carry no decision authority.
|
|
Provider requests are derived internally from native requests at execution
|
|
opening, event recording, and context sealing; the public caller-authored
|
|
provider store is deleted. Reorientation failure admission requires the
|
|
same canonical model-pass failure rather than a generic failed worker result
|
|
plus context. Restart cannot silently infer again. Modeling seals exact keyed
|
|
document versions and their owning Mind commit receipts directly into its
|
|
reasoning basis. The later cache/projector layer that duplicated this source
|
|
set had no reasoning consumer and is gone. Concurrency is protected by keyed
|
|
Mind CAS and exact basis identity rather than aggregate revision or timestamp
|
|
order.
|
|
24. **Build/run retention is bounded:** Idunn on upgraded Yggdrasil owns the
|
|
source-triggered compile/test/package/deploy path. Starfire does not run a
|
|
parallel release build. Any containerized run must use exact run labels and remove disposable
|
|
containers, copied-source volumes, and writable roots at terminal
|
|
settlement. Accepted proof stores remain only when this plan or the handoff
|
|
names the invariant they preserve. Exact source
|
|
`470d4cb5b46f94a5490a479dba19604828e1b5d1` passed Idunn's native serialized
|
|
Yggdrasil workspace gate, then sealed 26 binaries plus witness as release
|
|
`sha256-ce4a287ebb915ff9410dd04e022285d82998e0bf4c9acb3b04a44db661aea90c`.
|
|
It is deployed, authenticated-health admitted, and deliberately braked.
|
|
Transient Epiphany containers, volumes, package roots, and the per-run test
|
|
target are absent. The unused Discord/Bifrost/VoidBot operator bridge is
|
|
deleted across source and deployment; Starfire is not a fallback.
|
|
25. **Decision discovery is read-only:** exact source `5f66d6c9` adds
|
|
`list-decisions` beside `audit-decision` in the existing packaged model
|
|
runtime. It lists only fully validated terminal decision contexts, persists
|
|
nothing, and omits nonterminal pass physiology. That surface is now inside
|
|
the admitted Idunn-built `470d4cb5` package.
|
|
26. **Explicit OpenRouter/Ox transport is live at `6b44b4d3`:** exact
|
|
`ab321b34` makes provider selection typed and keeps the native request
|
|
canonical; the provider request is internally derived and retained in the
|
|
decision context. Exact `c1a6034f` preserves read-only physiology while the
|
|
swarm brake is engaged. Exact `6b44b4d3` publishes Idunn's shared signed
|
|
daemon-health schema. Idunn exact `8ddf8140` validates the canonical generic
|
|
health record; gamecult-ops `a9e9f79`/`0c0dbd1` bind validation to the root
|
|
trust store and inspect systemd credentials in the target mount namespace.
|
|
Ox decisions produced in isolated capstone roots are durable audit evidence,
|
|
not production authority or capstone acceptance.
|
|
27. **Future Epiphany builds are native at gamecult-ops `89f0d78`:** the
|
|
earlier disposable Yggdrasil builders and their volumes were removed. The
|
|
admitted `470d4cb5` release was built natively. The installed Idunn actuator invokes
|
|
fixed Rust `1.95.0` directly as `epiphany-builder`; Docker, image, and CID
|
|
authority are absent. This does not manufacture a reason to rebuild the
|
|
already admitted body while cognition is paused.
|
|
28. **Current typed state owns routing at `470d4cb5`:** coordinator receipts,
|
|
historical terminal slots, timestamps, and role-lane state are audit/display
|
|
cargo only. Concrete family owners materialize unresolved obligations, one
|
|
pure current-work projection schedules them, and Resident Self pressure is
|
|
content-addressed to that projection plus its recommended action. Ox9 is the
|
|
preserved falsification that forced the deletion.
|
|
29. **Body retry identity is normalized at `d48f69b7`:** Body Modeling no
|
|
longer splits launch-only semantic work from a sibling action field. One
|
|
family projection owns the exact work, continuation action, and latest job
|
|
identity through Launch/Wait/Review. Failure therefore changes state and
|
|
produces one fresh deterministic grant; unchanged failure replay remains
|
|
idempotent. Ox10 is sealed failed evidence, not resumable state.
|
|
30. **Attempt identity is generalized at `9b9b5c85`:** Body, proposal and
|
|
frontier-verdict Modeling, Verification, consideration,
|
|
admitted-direction consideration, and Reorientation carry one shared typed
|
|
attempt projection. Research and two-stage Planning retain their full exact
|
|
lifecycle projections in current-work instead of lossy action/stage fields.
|
|
Proposal attempt ordinals are canonical and contiguous; older nonterminal
|
|
attempts refuse. The Ox12-shaped test proves one failed attempt changes
|
|
Resident pressure exactly once and the next launch becomes attempt 1. Exact
|
|
`d2ca6630` remains the admitted production source.
|
|
31. **Agent admission refusal is replayable at `e046a4d1`:** Body, proposal,
|
|
and frontier-verdict Modeling plus frontier Verification write one exact
|
|
typed refusal and commit receipt when semantic mutation or a strong-read CAS
|
|
refuses a structured terminal result. The result remains truthful model
|
|
transport evidence; current-work excludes it from fulfillment and launches
|
|
a fresh attempt carrying the prior refusal. RepoModel claim targets and
|
|
frontier dependencies are distinct in the output contract. Mind/runtime and
|
|
proposal-context epochs cut to v3/v4/v2, so Ox12 is historical evidence and
|
|
a new fresh-store capstone is mandatory.
|
|
32. **Persona owns one outer turn deadline at `3b958a83`:** packaged Ox13
|
|
proved the admission-refusal lifecycle, then four exact Persona projector
|
|
failures exposed a separate 90-second timeout hidden inside the shared
|
|
provider transport. Persona service now accepts one explicit
|
|
`--turn-timeout-seconds` budget, defaults it to 600 seconds, wraps the whole
|
|
native pass once, and lowers provider transport with no independent request
|
|
timer. The shared transport error no longer impersonates an OpenAI-direct
|
|
path when OpenRouter owns the request. Ox13 is historical; later fresh roots
|
|
use a non-restarting Persona unit so provider failure counts remain exact.
|
|
33. **Proposal semantics stay inside admission at `8812945e`:** proposal
|
|
current-work does not grow a second rules tribunal for model-authored graph
|
|
operations. The existing family mutation planner and generic RepoModel
|
|
validator remain the semantic owners; refusal is durable typed state and a
|
|
fresh pass receives the exact prior refusal.
|
|
34. **Historical direction proof is not current-work authority at `749d977e`:**
|
|
a completed admitted-direction decision remains valid evidence for the
|
|
proposal it created even when later disjoint RepoModel documents change.
|
|
Current work is still projected from unresolved typed obligations, not from
|
|
an aggregate model freshness comparison. Ox16 proved this cut in package
|
|
reality before exposing the separate path-scope fault.
|
|
35. **Repository consequence authority is explicit at `5b799b12`:** the old
|
|
`source_scope` name conflated evidence provenance with future write
|
|
authority. The hard cut replaces it with `repository_scope`, names the
|
|
adopted Hands narrowing `authorized_paths`, and makes generic RepoModel
|
|
validation own canonical sorted repository-relative paths. Unresolved Eyes,
|
|
Imagination, or Hands frontiers without a valid ceiling refuse atomically.
|
|
Prompt schemas state that not-yet-created outputs belong in the ceiling and
|
|
inspected evidence does not. Mind/runtime/RepoModel epochs advance to
|
|
v4/v5/v2 with no compatibility reader. Ox16 is historical; Ox17 starts from
|
|
a fresh store and exact package.
|
|
36. **Runtime identity is immutable at `87983ffc`/`ffcf036f`:** the v7 hard cut removes
|
|
update time, derived document-type cargo, and temporary metadata from the
|
|
runtime identity. Current-work launch preserves the exact identity and
|
|
existing root-session envelopes as strong reads instead of reconstructing
|
|
them with fresh storage timestamps. Unrelated job launches therefore share
|
|
bootstrap identity without turning it into a global mutation head.
|
|
37. **Production binary ownership is singular at `6f93134d`:** the root release
|
|
bundle alone owns model runtime, Persona service, and tool MCP runtime
|
|
entrypoints. Leaf crates are libraries, Cargo metadata has no duplicate
|
|
binary-source owner, and release construction no longer maintains a
|
|
hardcoded package map that does not drive the build. Exact `b95a3266`
|
|
separately deletes the superseded OpenAI debug executable; exact `c04c3aff`
|
|
deletes the auth re-export crate.
|
|
38. **Runtime document registration has one owner at `03140a47`:** the packaged
|
|
runtime-spine CLI, callerless Hello/schema-catalog writers, and hand-written
|
|
mutation-contract mirror are deleted. CultCache exact `fdbf3bf` exposes its
|
|
actual registered type identities; runtime status and model preflight read
|
|
that registry directly. Cargo has 21 executable targets and no duplicate
|
|
binary-source owner. Brokkr owns Unity editor capability through Eve/CultMesh;
|
|
a future Rider daemon owns Rider. Epiphany owns neither editor bridge.
|
|
39. **Coordinator status is a projection, not a program, at `500125d5`:** the
|
|
unconsumed packaged status executable is deleted. Its live current-work
|
|
projection, rendering, and operator-thought sealing live once in
|
|
`epiphany-core`; the coordinator imports that module directly. Cargo falls to
|
|
20 executable targets without losing the operator-sealing check.
|
|
40. **Persona consequence safety is typed at `63939fa2`:** projector and Persona
|
|
prose are inert stage outputs, so a hand-written forbidden-word tribunal
|
|
cannot add authority. Only the Interpreter's closed effect enum can propose
|
|
consequence. The tribunal, test-only prompt wrapper, prompt-substring test,
|
|
and forbidden-word test are deleted; exact stage/context and typed-effect
|
|
refusal tests remain.
|
|
41. **Tests must falsify live behavior at `bf2f39eb`:** an identical-call
|
|
causal-ID tautology and a duplicate unknown-field check for extinct generic
|
|
patch cargo are deleted. Family lifecycle/admission and runtime-owned
|
|
identity-substitution checks retain the actual invariants.
|
|
42. **Public-source tests have one owner at `104bf390`:** the tool runtime's
|
|
duplicate immutable-GitHub identity test and permanently ignored historical
|
|
README network probe are deleted. Canonical identity parsing remains tested
|
|
in `epiphany-core`; CI no longer carries a test it never executes.
|
|
43. **Tool execution has no static status mouth at `777dd1a5`:** the callerless
|
|
`smoke` command, fixed JSON summary, parser branch, and branding test are
|
|
deleted. Signed health owns liveness and typed receipts own execution; the
|
|
surviving single command parses directly without a one-variant enum.
|
|
44. **Repository Body verification is not a release command at `013c3bf1`:**
|
|
the callerless `smoke` path and its temporary stores are deleted. The shipped
|
|
binary keeps the four operational commands; 23 owner tests retain the actual
|
|
bind, observation, projection, Git-semantics, and tamper invariants.
|
|
45. **Provider physiology cannot be counterfeited at `ce90f911`:** the
|
|
callerless model-runtime `smoke` command is deleted. It opened no provider;
|
|
it wrote synthetic request, tool-call, completion, and receipt documents into
|
|
a writable runtime store. Real execution and transcript-free decision audit
|
|
remain, and the release-owned model-runtime suite passes 12/12.
|
|
46. **Tool completion does not mirror static contracts at `0bb6a883`:** the
|
|
run summary loses its fixed adapter/schema catalogue and caller-supplied
|
|
store echo. Exact authority remains the typed receipt; stdout returns only
|
|
intent ID, receipt ID, and terminal status.
|
|
|
|
Do not preserve the aggregate for compatibility, manufacture a bootstrap
|
|
thread, release autonomous scheduling, register topology in `gamecult-ops`,
|
|
race the separate Yggdrasil deployment task, reuse historical/partial Gate
|
|
roots, or treat semantic readiness as coordinator acceptance.
|