Epiphany/notes/fresh-workspace-handoff.md

Fresh workspace handoff

Updated: 2026-08-24 Branch: codex/epiphany-shakedown-live Latest committed implementation cut: ffd91c20 Current worktree: documentation/evidence for fixed routing/retention cargo removal; Ox17 remains paused

Orientation

The five-day shakedown and Model Atlas operational Gate 1 are paused. Do not touch historical c011/proof volumes, reuse partial Gate roots, release autonomous scheduling, register operational topology in gamecult-ops, race Idunn's Yggdrasil CI/CD task with local compiler work, or wake resident cognition without an explicit operator resumption.

Epiphany is a supervised engineering alpha. Exact source d2ca6630 remains the production symlink body and is inactive. Exact ffd91c20 is the current build-affecting source. Historical live proofs remain evidence; they do not authorize the next capstone or Gate 1.

Current live deployment

• Epiphany source: d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4.
• Release: sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06.
• Release witness file SHA-256: 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357.
• Full-workspace test receipt SHA-256: de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482.
• Model provider: OpenRouter stealth/ox-alpha, selected explicitly and injected through the root-owned systemd credential boundary.
• epiphany.service and epiphany-swarm.service are inactive with zero restarts after the hard epoch refusal rollback. The d2ca stores and swarm brake remain historical production state; no newer package is admitted there.
• Idunn source 8b972715c47731f2418d0c423cb0dd2076940bd7 is provenance-exact and admits Epiphany through the shared authenticated daemon-health contract.
• gamecult-ops b47f9084 removes Docker from Epiphany's future Idunn compile/package actuator. Native Rust 1.95.0 is installed under epiphany-builder; current source-change builds are native.
• Ox9 and Ox10 ran only in isolated fresh capstone roots. Neither is acceptance: Ox9 exposed coordinator-receipt resurrection; Ox10 exposed Body retry starvation after strict malformed-output refusal. No public consequence was emitted.

What just landed

Exact ffd91c20 removes three fixed or non-causal fields outside Model Atlas. The Eyes evidence packet no longer repeats source_role_id = research; its request and decision-context identities own provenance. A Persona mention no longer repeats target_agent_id = epiphany.Persona; the Persona-owned queue and turn request own routing. Resident Self retention no longer accepts a clock only to store an unread retained_at_millis; counts plus the chained deletion digest remain the retention consequence. Eyes packet v2, Persona social mention v2, Resident Self state v3/retention head v1, and runtime v27 form a hard cut. Core and the swarm, model-runtime, and Persona-service entrypoints compile; Persona admission 7/7, Persona decision/retention 5/5, keyed Modeling/Research 1/1, and both writable-epoch refusals 1/1 pass. The maintained source delta is 6 net deletions. Model Atlas is untouched. Its component proofs are not a live inter-swarm collaboration result; that trial has not run.

Exact 2a435eb5 makes Persona-memory and tool-receipt provenance singular. Persona-memory v2 retains the exact Interpreter effect-document and decision- context IDs; its linked-event vector repeated that same effect ID and its relationship field was always None. Tool-receipt v1 retains exact result JSON or error; its sealed-raw-result reference was always None and had no producer or reader. Mind/runtime writable epochs advance to v10/v26 with no migrator or compatibility reader. Tool adapter compiles; tool MCP 8/8, Persona conversation and retention 5/5, old-epoch refusal 1/1, OpenAI runtime 23/23, and the packaged model-runtime entrypoint pass. The cut removes 10 net maintained lines. Atlas is untouched and live inter-swarm collaboration remains unproven.

Exact 9abadfe7 deletes the provider-frame observation DTO and callback APIs from both Codex Responses and OpenRouter transports. No runtime, binary, test, or operator surface consumed an observation; both live transport callers supplied a no-op closure. The SSE parser and OpenRouter response path still emit the same typed model stream events and receipts. A provider-specific transcript reader used only by one empty-text assertion, a callerless checkpoint constructor, a definition-only MCP label, and a historical constant-spelling health test are also gone. Provider spine 14/14, OpenAI runtime 23/23, tool MCP 8/8, Idunn runtime health 5/5, state-model, and the packaged model-runtime entrypoint pass. The cut removes 140 net maintained lines; state-model is 366 lines. Atlas is untouched and live inter-swarm collaboration remains unproven.

Exact a602fbdc deletes fifteen public state-model DTO types with no external consumer, two callerless OpenAI-runtime mouths, and eight definition-only type constants. Acceptance/runtime-link aggregates, duplicate graph and frontier DTOs, global retrieval and scratch state, generic job bindings, and churn state had no constructor, reader, writer, registry entry, test, or downstream consumer. Their live concepts already belong to keyed Mind/runtime receipts, keyed RepoModel documents, sealed reasoning passes, and exact runtime jobs. The standalone worker wrapper and direct model-request writer likewise had no caller; the release-owned observed worker path remains. State-model, core, OpenAI-runtime, and the packaged model-runtime entrypoint compile through the shared target. The cut removes 291 maintained lines, changes no writable schema, and leaves Atlas untouched. Live inter-swarm collaboration remains unproven.

Exact fed4b857 deletes the final duplicate Continuity recovery record. An accepted reorientation already persists its exact runtime result, sealed reasoning basis/context, typed Mind decision, strong-read admission, and Mind commit receipt. ContinuityRecoveryReceipt copied the same job/result, mode, checkpoint validity, summary, next move, files, and timestamp, and no reader consumed it. The entire continuity-gateway module, runtime registration, and derived-companion write are gone; success and failure use the ordinary exact Mind commit primitive. Runtime writable epoch advances to v25. Core compiles; decision-auditable reorientation 1/1, old-epoch refusal, and coordinator 5/5 pass. The cut removes 80 net maintained lines without touching Atlas.

Exact a6f73fc4 deletes the write-only Persona quarantine mirror. A blocked turn already atomically writes one terminal receipt containing exact crossing status/reason and mention digest, then marks each mention quarantined and binds it to that receipt. The duplicate blocked-pressure payload, wrapper document, construction branch, type constant, registry entry, and decoder are gone; nothing read them after the earlier duplicate projection was deleted. Core compiles, Persona consequence/retention 5/5 pass, and the feature-gated Persona service compiles. The cut is 63 pure deletions and does not touch Atlas.

Exact 2e3489c4 deletes the empty generic planning mirror. Four registered Mind document families—planning captures, backlog items, roadmap streams, and objective drafts—had no constructor, writer, admission owner, or consumer, yet were read and injected empty into every reasoning projection. Their document types, registry/validation/projection branches, reasoning field, and 256-line issue-tracker-shaped state-model vocabulary are gone. Real planning remains in frontier planning requests, candidates, Mind review, adopted decisions, checkpoints, Hands receipts, and their exact admission paths. Mind/runtime writable epochs advance to v9/v24. State model and core compile; sealed reasoning 8/8, old-epoch refusal, model runtime 23/23, and coordinator 5/5 pass. The cut removes 350 net maintained lines without touching Atlas.

Exact 0091e0e1 deletes the generic model-adapter and OpenAI-adapter status families. Every model pass wrote both mutable documents, but no query, router, admission owner, audit path, or display consumed either one. Their types, writers, status/auth-mode constructors, adapter-ID constants, one self-affirming OpenRouter status test, runtime registrations, two published schemas, and catalog entries are gone. Native and provider requests still own provider/model choice; transport construction still proves attached Codex auth or OpenRouter credentials. Runtime writable epoch advances to v23. Adapter libraries compile; provider spine 14/14, old-epoch refusal, and model runtime 23/23 pass. The cut removes 267 net maintained lines and does not touch Atlas.

Exact 3140d305 deletes ResidentSelfRuntimeReceipt, a durable type that was registered, accepted, and decoded but had no producer or reader. Its schema constant and every state-cache branch are gone. The definition-plus-export-only EpiphanyCoordinatorRoleResultStatus is also gone; the live role board retains its distinct coordinator role status. Resident Self writable state advances to v2, with one consequential proof that a v1 store refuses byte-identically. Resident Self 7/7 and swarm physiology 4/4 pass. The cut is net 32 maintained lines removed and does not touch Atlas.

Exact be611f24 deletes the producerless Imagination consideration-review request as one authority cut: writer, durable document, schema constant, public export, and runtime registration are all gone. It had no caller, reader, test, or Modeling admission path. Imagination requests and candidates retain their quoted-evidence, substitution, chronology, disposition, and route validation; adopted proposal Modeling remains owned by its actual lifecycle. Runtime writable epoch advances to v22 so a v21 store cannot carry the retired contract into current authority. Core checks, Imagination 8/8, old-epoch refusal, and coordinator 5/5 pass. The cut removes 71 net maintained lines and does not touch Atlas.

Exact f6a2ad7f deletes two exported read helpers with no workspace consumer. Packaged-release publication still writes its current-head document atomically, and release authentication still loads an exact release by ID; the unused standalone head reader is gone. Idunn signed-health admission still validates supplied typed trust anchors and preserves all continuity and substitution proofs; the unused trust-anchor file reader is gone. Core checks and Idunn provider-health 6/6 pass. The cut removes 25 net maintained lines without a schema, target, or Atlas change.

Exact 6ccaf937 deletes three public surfaces with no live consumer. The repository Body alias merely unwrapped assemble_mind_view; its proof now reads the typed Mind view directly. The Persona blocked-pressure helper rebuilt a sorted list already owned by keyed quarantine documents. The generic repo-work planning grant could mint read/snapshot Hands authority but no admission or actuator consumed it; exact coordinator and worker grant owners remain. Core checks, the read-only Body-basis proof, the fixed governed-tool operation proof, and coordinator 5/5 pass. The cut removes 41 net maintained lines without a schema, target, or Atlas change. Live inter-swarm collaboration remains unproven.

Exact 5a047944 deletes ninety pure lines of callerless helper API: a JSON-shaped state-ledger status projection and its dead label, generic role binding/owner lookups, a unique-string wrapper and implementation, and an unused successful-coordinator receipt wrapper. Typed ledger reads, exact role-family constants/schemas, and the live coordinator binding validator remain with their actual consumers. Core and the state binary compile warning-free; swarm remains 4/4. No durable contract, schema, target, test, or Atlas path changed. Live inter-swarm collaboration remains unproven.

Exact 0a97eef8 makes project_current_work the sole assembler of current typed work. The callerless Body-only and unresolved-Body projectors separately reopened Body, RepoModel, and runtime state to derive information already in that slice. Three callerless per-job continuation wrappers also rebuilt the whole projection; the live coordinator already uses the retained family review selectors. All five duplicate mouths are gone. The keyed Modeling/Research lifecycle still proves thread-free routing and zero live Body rescans; coordinator 5/5 passes. The cut removes 49 net maintained lines without a schema, target, test, or Atlas change. Live inter-swarm collaboration remains unproven.

Exact cd2177e8 deletes the duplicate public ensure_runtime_session writer. Only two model-runtime test fixtures called it, and an active ID collision made it return the existing session without comparing objective, creation time, or coordinator note. The fixtures now use strict create_runtime_session, which refuses identity collisions. Core checks, model-produced completion, and the packaged model runtime 11/11 pass. The cut removes 37 net maintained lines and leaves runtime_spine.rs at 9,730 lines with 53 public functions. Runtime stays at v21. Model Atlas is untouched and live inter-swarm collaboration remains unproven.

Exact 196222d9 removes session metadata plus job summary, artifact refs, and metadata from the live lifecycle documents. No reader consumed them, every metadata map and launch artifact list was empty, and terminal EpiphanyRuntimeJobResult already owns the summary and artifacts that matter. Sessions retain objective/coordinator note; jobs retain exact session, role, status, and time identity. The corresponding launch-option cargo, completion merge, and caller literals are gone. Runtime writable state advances to v21; the now-closed session/job catalog schemas are v1. Core and OpenAI libraries compile; old-epoch refusal, model-failure audit, model-produced completion, coordinator 5/5, and native tool-runtime 4/4 pass. The cut removes 95 net maintained lines and leaves runtime_spine.rs at 9,766 lines. Model Atlas is untouched; no live inter-swarm collaboration has yet run.

Exact 63d2991e reduces EpiphanyCoordinatorRunReceipt v1 to its terminal Self decision, timestamp, session/thread identity, plan-or-execute mode, and exact resident grant/launch/policy/argv/objective/release/manifest/executable provenance. Step count, provider echo, store path, artifact lists, arbitrary metadata, and final-job echo had no reader and are gone. Operator artifacts remain in the non-authoritative summary. The published JSON schema now matches the Rust receipt; its previous additionalProperties: false contract omitted the live resident fields. Runtime writable state advances to v20. JSON schemas parse; core check, old-epoch refusal, coordinator 5/5, and swarm 4/4 pass. The cut removes 59 maintained lines and leaves runtime_spine.rs at 9,807 lines.

Continue the registered-type, field-cargo, and test-liability audit after exact 2a435eb5. Model Atlas remains protected for its first live inter-swarm collaboration trial.

Exact 3ed1d564 deletes the public commit_repo_frontier_modeling_request mutation path. Production had no caller: accepted Verification already atomically commits its audit, Soul verdict, and derived frontier-Modeling request through one Mind transaction. The deleted writer reopened the store and existed only to feed an OpenAI test. That test now uses the real Body Modeling launcher and retains its consequential proofs for sealed input, structured completion, typed result/job persistence, provider failure, and output-contract failure. Its fabricated frontier, route, Verification result, and Soul verdict are gone. The cut removes 205 net source lines; runtime_spine.rs reached 9,819 lines with 54 public functions. The atomic Verification-to-Modeling lifecycle and release-owned model runtime pass.

Continue auditing public runtime-spine mutation/read wrappers and tests against real consumers and consequences. Preserve the unrun Atlas inter-swarm vertical slice until Gate 1.

Exact 8dbfcf63 deletes the persisted Body Modeling, Imagination consideration, and Reorientation launch-binding families. Their attempt, request, role, binding, timestamp, Body/projection, and launch-digest fields duplicated the immutable worker launch, typed family request/projection, runtime job/result, admission refusal, or typed pass failure. Canonical worker job identities now own contiguous attempt order. Retry CAS strong-reads prior launches and each family's exact terminal ancestry; stale model output is not rebased. The broad keyed Body/Imagination lifecycle, Reorientation success/failure/retry proof, old-epoch refusal, release-owned coordinator, and OpenAI runtime checks pass. The cut removes 24 net source lines and advances runtime writable state to v19.

No live inter-swarm collaboration has yet run. Model Atlas remains protected for the first real Gate 1 trial; its isolated component proofs are not acceptance. Continue the public runtime-spine and test-liability audit without narrowing Atlas publication, trust, transport, verification, admission, wake, brake, or Eve behavior.

Exact b55e96ea deletes the persisted Planning and PlanMind launch-binding families. Their twenty-four fields duplicated the immutable worker launch, typed requests, runtime job, canonical attempt identity, and typed failure review. Self derives contiguous attempts and current jobs from immutable worker launches, and retry CAS strongly reads each failed result and review. Runtime writable state advanced to v18.

Exact b0a4978d deletes the Proposal-Modeling launch-binding document family. The immutable worker launch already owns the exact typed request reference, job, role, binding, and sealed launch document. Current-work, retry counting, fulfillment, coordinator actuation, and archival now consume it directly. The registry entry, launch-digest mirror, deletion choreography, and operator JSON echo are gone. The broad keyed lifecycle, coordinator target, OpenAI runtime, and old-epoch refusal pass. The cut removes 70 net source lines and advances runtime writable state to v17.

Exact 6ccc7dd2 deletes the private 20-field Hands receipt-chain summary. The Hands commit owner now derives the deterministic Verification request directly from the persisted patch, command, and commit receipts plus the frontier authority. The summary's copied schema, job, grant, command-output, Git, path, prose, and timestamp fields owned nothing. Atomic Hands-to-Verification admission and the concurrent Persona/Hands lifecycle proof still pass. The cut removes 43 net source lines without adding state, schema, or tests.

Exact 5d507bfd reduces Self's autonomous Imagination-to-Modeling origin binding from 22 duplicate fields to six causal join fields: schema, exact direction-result identity, selected option ordinal, worker job identity, and exact worker-result/launch digests. Proposal identity and payload, direction request, runtime/thread, typed projection, Body/domain binding, option content, and canonical Modeling-request identity are now checked directly from their owning immutable documents. Atomic promotion and the broad keyed lifecycle remain proven. The cut removes 60 net source lines and advances runtime writable state to v15.

Exact ce306e23 preserves Model Atlas for the still-open inter-swarm collaboration trial while deleting its second local offer/claim author. Ordinary Modeling through keyed RepoModel operations now solely creates, deprecates, withdraws, and retires provider offers and consumer claims. Atlas retains its signed publication, pinned trust, transport, deterministic join/cycle/blast projection, Soul verification, Self impact admission, Resident Self wake, brakes, and Eve lowering. The direct Atlas offer/claim write-intent types, runtime commit APIs, registry entries, 518 planner lines, and two tests that only animated that duplicate authority are gone. The retained runtime proof now creates its offer and claim through RepoModel before exercising exact Soul verification and Body-drift refusal. The cut removes 593 net source lines, advances runtime writable state to v14, and leaves the three-repository direct/transitive Modeling proof passing. No Gate 1 run was started; no live inter-swarm collaboration has yet been tested.

Exact a276d0f4 collapses the generic public host_identity module into its sole production consumer, Bifrost Persona-feedback admission. CultNet now owns the shared public trust-anchor/signature shapes; the admission owner privately preserves the exact existing identity/signature domains and wire-compatible anchor schema. Generic verifier, anchor/signature aliases, enrollment/export test APIs, and four callerless public feedback-signing/admission helpers are gone: 144 net deletions. Epiphany still owns no Bifrost private key. Core and swarm compile, and all seven authenticated feedback, substitution, disclosure, recovery, and read-only import tests pass.

Exact f3360248 deletes three tests with no distinct behavioral claim and the single-use helper one of them existed to inspect: a release-cache filename prefix/determinism assertion already covered by cache stability and separation, a literal Git submodule argument-vector mirror, and a raw repeated-tool-round predicate test already covered by the retained guard-transition test. This is 46 net deletions. The actual source-cache replacement recovery, target/toolchain cache separation, repeated-loop transition, and terminal failed-worker receipt tests all pass.

Exact b78ffb25 deletes the counterfeit epiphany-hands-action consequence recorder, its release role, the coordinator's unconsumed recordPassCommand, and the recorder's main-only tests: 926 net deletions. The executable performed no patch, command, or commit and had no runtime caller; it accepted descriptions of consequences that had already happened and wrote receipts for them. The coordinator now reports awaitingHandsExecutor instead of claiming the gate is ready. Exact typed intent, review, path-scope, consequence, refusal, and Verification admission remain, and the current-work capstone still proves the retained chain. Cargo now has 11 executable targets. Epiphany has no admitted repository actuator yet; a future Hands owner must execute the operation and emit receipts from its own observed consequences.

Exact 94098223 removes Epiphany's unowned private host-identity custody and leaves only the Bifrost public-anchor contract plus signature verifier. The host-identity executable, release role, private identity schema/signer, enrollment/open/status/export APIs, default paths, Windows DPAPI, Linux seed masking, assurance claims, and direct random/zeroize/root OS dependencies are gone. Bifrost owns its private identity; Epiphany authenticates signed feedback against one pinned public anchor. A deterministic test-only signer replaces the production custody stack in verifier fixtures. The cut removes 561 net lines, leaves 12 Cargo executable targets, and passes focused verifier, Persona feedback, core, swarm, and release-construction checks.

Exact 900c5232 deletes the callerless epiphany-frontier-proposal command, its forced release role, CLI parser, JSON summary, and two parser-only tests: 188 pure deletions. At that cut, proposal intake and selection remained typed runtime/Self operations; exact 6e600e8d later removed that generic mouth as well and made admitted Imagination promotion the sole proposal owner. The current-work capstone now proves the real promotion, concurrent launch, sealed reasoning, admission, and read-only re-entry. Cargo then had 13 executable targets.

Exact 56267201 retires the three unadmitted Model Atlas daemon shells and their forced release roles: publisher, entanglement projector, and impact ingress. Their typed libraries, stores, signatures, CAS admissions, projections, transport, and impact evaluation remain. No current unit, deployment phase, caller, or independent failure-isolation contract justified three production processes before Gate 1. The vertical-slice map now describes library organs and requires a future admitted lifecycle to determine the minimum Idunn-managed topology. The cut removes 328 net lines and leaves 14 Cargo executable targets; focused Atlas runtime and release-construction tests pass.

Exact 3dda58a5 collapses Persona feedback ingress into Resident Self: the standalone binary, forced release role, command-only status/snapshot projections, snapshot replacement seam, and two tests that only animated that extinct Starfire transport are gone. Resident Self remains the sole polling owner for signed Bifrost feedback and immediately routes admitted deliveries into typed social state. The cut removes 426 net lines and leaves 17 Cargo executable targets. Seven authenticated admission, disclosure, substitution, recovery, and import tests pass; the Ygg swarm binary remains clean.

Exact ad2292ee deletes the callerless Persona mouth-identity and Discord permit-identity executables, their forced release roles, and the enrollment / anchor-export wrappers that only those binaries called: 177 pure deletions. The two helpers had no unit, deployment call, distinct runtime user, privilege boundary, or health contract; they merely caused every release to build and ship setup commands. The delivery-request and permit cryptographic identities remain distinct contracts. Their long-running consumers still open and verify already-admitted identities and pinned anchors; model turns and Bifrost cannot create or rotate them. Cargo now has 18 executable targets. Focused core, permit, Persona-service, and release-construction checks pass.

Exact 03140a47 deletes the packaged epiphany-runtime-spine command and the false service authority it carried: 649 lines of operator/debug mutation CLI, callerless Hello/schema-catalog writers, a hand-maintained mutation-contract mirror, and its source-shape test. CultCache exact fdbf3bf now exposes the types actually registered in a cache. Runtime status and model preflight derive from that single registry instead of a second list. The production Mind store and its typed jobs, decisions, and receipts remain; only the duplicate mouth is gone. Cargo now has 21 executable targets and zero duplicate binary-source owners. Core checks without warnings and release construction passes 17/17.

Exact 500125d5 deletes the separately packaged epiphany-mvp-status command. Nothing in deployment or operations invoked it; the coordinator instead textually included the binary source as a module. The live status projection, operator rendering, and thought sealing now live once in epiphany-core. The CLI parser, default store, output-file writer, package role, and redundant release assertion are gone. Cargo has 20 executable targets and zero duplicate binary-source owners. Coordinator compilation, the exact operator-sealing test, and release construction 17/17 pass.

Exact 63939fa2 deletes Persona's hand-written projector-output language tribunal. Projector and Persona prose are inert private cognition; only the Interpreter's closed typed effect enum can propose a state or speech consequence. Keyword matches on STATE NOTE, SAY, JSON punctuation, or field names therefore added retries without adding authority. The cut also deletes a test-only prompt wrapper and two tests that blessed prompt phrases/forbidden words. Three-stage execution and replay, channel-escape refusal, substituted provider/model refusal, typed-effect validation, and all OpenAI-runtime targets pass.

Exact bf2f39eb deletes two tests that could not falsify live behavior: one compared identical causal-ID calls and named the equality provenance independence; the other repeated generic unknown-field refusal for a field whose production path is already gone. Family lifecycle/admission tests still exercise exact request identity, and Body substitution still exercises strict ingress refusal. Core and OpenAI-runtime all-target checks pass.

Exact 104bf390 deletes the tool runtime's duplicate immutable-GitHub identity test and a permanently ignored live-network test pinned to a historical README. The canonical parser and its malformed/canonical-set behavior remain tested in epiphany-core; the ignored request was never part of CI and its assertion that the downloaded prose contained Epiphany did not protect transport behavior. The tool MCP runtime checks cleanly with 75 test lines removed.

Exact 777dd1a5 deletes epiphany-tool-mcp-runtime smoke, a callerless command that printed fixed JSON constants and observed no runtime state. Its sole test compared those constants with themselves and checked that the prose did not say Codex. With the command gone, the one-variant CLI enum also collapses into a direct run parser. The four retained release-owned tests exercise typed execution, receipt persistence, Resident-state binding, and unbound refusal.

Exact 013c3bf1 deletes the callerless epiphany-repository-body smoke command. It created two temporary stores against the current checkout, repeated the production bind/observe/read path, printed ok, and deleted its files. The shipped Body binary retains only bootstrap, bind, observe, and status. Its actual owner tests pass 23/23, including authenticated projection, tamper refusal, generation, Git semantics, and no repository mutation.

Exact ce90f911 deletes the model runtime's callerless smoke route. That route opened no provider transport: it wrote a synthetic request, synthetic tool call, synthetic completed receipt, and smoke_no_network marker into a writable runtime store, then reported not-opened. It could therefore manufacture authentic-looking physiology without provider evidence. The real model-turn, worker, follow-up, decision-list, and decision-audit commands remain; their release-owned suite passes 12/12.

Exact 0bb6a883 narrows tool-runtime stdout to intent ID, receipt ID, and terminal status. The removed adapter ID, caller-supplied store path, and static intent/receipt schema map were display echoes; the model runtime did not read them and exact authority already lives in the typed CultCache receipt. The four release-owned tool-runtime tests remain green.

No Epiphany-owned Rider or Unity code, target, schema, or actuator exists. Brokkr owns Unity through Eve/CultMesh. A future Rider daemon owns Rider. Epiphany may consume their typed capabilities and receipts; it does not poke either editor directly.

Exact 856648de deletes the unused semantic-memory and workspace-coverage projection subsystem: 32,866 net source lines, four binaries, the competing local daemon supervisor, Qdrant/Ollama/Postgres configuration, projector policy/lifecycle/heartbeat/recovery state, query/context packets, aggregate RepoModel revision/hash cargo, and Persona's always-empty semantic-recall plumbing.

No agent request builder or sealed reasoning projection consumed those caches. Modeling now reads the exact typed Body and keyed RepoModel projection directly; Persona reads keyed memory and typed social state directly. Future retrieval evidence must earn a typed provider receipt and an explicit reasoning consumer. Idunn remains the sole deployment and daemon-survival authority. Core 165/165, OpenAI runtime 25/25, and release construction 19/19 pass serially.

The active editor boundary is clean. Epiphany owns no Rider or Unity bridge, command schema, or editor-specific actuator. Brokkr owns Unity through Eve/CultMesh; a future Rider daemon will own Rider. Historical architecture snapshots retain their dated record but cannot be mistaken for executable or current authority.

Four subsequent cuts narrow RepoModel to what Modeling can actually decide:

• 6ea4ff3c removes the redundant memory-profile axis, dead SHA-1 ID factory, empty profile module, seven cache/Persona-only node kinds, seven cache-only edge kinds, and seventeen impossible lifecycle states.
• 5218cf2c deletes the producerless RepoModel lifecycle-receipt document family and all of its empty projection/fixture plumbing.
• 8bb039af makes domain creation seed-only and deletes the unreachable summary operation, summary document family, validation, registry contract, and the test cargo that alone produced it. The retained atomic graph test now follows the live seeded-domain then node/edge path.
• ab1afc27 removes node salience/confidence and edge confidence because no owner read, validated, routed, or displayed them; they merely perturbed exact document identity.

Affected targets check cleanly. Core remains 165/165; focused RepoModel tests pass 5/5 and reasoning-context tests pass 8/8.

The global thread-state authority is gone.

• 1662a012 makes coordinator policy a pure projection over keyed Mind, exact current-work families, Resident pressure, and runtime receipts.
• 07d891ba deletes persisted EpiphanyThreadStateEntry, coordinator_state_transaction, generic coordinator state/update/launch/ acceptance/interrupt services, and their aggregate writers.
• ec1431ff deletes EpiphanyThreadState itself, global launch revision cargo, generic launch/interrupt request types, aggregate prompt/freshness/graph- context surfaces, the obsolete Repo graph importer, and the historical prompt-context smoke.
• f7948795 deletes the generic MindGatewayReview and MindStateCommitReceipt v0 authority, its interpreter prompt, runtime registration/read APIs, false state-effect/thought/adoption CultNet mouths, and launch proof profiles that required phantom gateway receipts. CultMesh now projects only the sealed reasoning basis, decision context, and exact EpiphanyMindCommitReceipt, all read-only.
• 1c9aafd8 seals the exact terminal decision context before a model-backed frontier-Planning failure is written. The typed faculty failure and generic runtime job now cite the same context; transport-only failure remains physiological and cannot impersonate a Mind decision.
• e0e75a30 deletes EpiphanyRoleStatePatchDocument, its generic parser and three role-policy tribunals. Research now emits one closed EpiphanyResearchDecision; its admission owner derives keyed evidence, observation, and checkpoint writes. The old generic Imagination planning patch had no current-work owner and was deleted rather than generalized. Runtime role-result and worker output contracts advanced to v4.
• 12b1b285 makes runtime model/tool binding validation one shared owner for both execution and decision-context sealing. Exact native/provider lowering, ToolCall arguments, ToolResult bytes, terminal receipts, session/job/basis, and source-worker authority must describe one family. Hostile provider, receipt, and stored-binding substitutions refuse; reasoning bases and decision contexts remain valid after native/provider transcript deltas are deleted.
• 01602fd3 advances the Mind epoch to v2 and runtime-spine schema to v1. Opening any store that claims runtime or Mind identity now requires one exact current identity pair before registered runtime writers can see it. Old v1/v0 stores and split identities refuse byte-identically; unrelated Persona and coverage physiology stores remain outside this authority. There is no schema migrator or dual reader.
• 26b6a5bf closes the first fresh concurrency slice. Two independently planned Modeling-node writes commit simultaneously and assemble into one valid reopened graph; competing writes to one semantic identity yield one winner and one typed conflict; exact winner replay returns the original receipt. A real Verification admission also commits simultaneously with an unrelated Modeling-node write. Raw mutation primitives are crate-private, so external callers cannot manufacture generic Mind CAS plans.
• 7c2ebd81 removes the live Persona consequence path from the legacy agent-memory aggregate. Interpreter state_note decisions now become keyed EpiphanyMindPersonaMemoryDocument writes under the exact Interpreter decision context. Exact replay returns the original Mind commit. A concrete Hands commit and Persona admission run simultaneously and both commit.
• 79c0e373 seals the complete assembled Persona pass input as one typed Mind document before inference. It records the exact heartbeat, agent-memory, and admitted Body versions observed; all three Persona stages cite the sealed Mind version. Substitution refuses byte-identically, replay reuses the original input, and direct Git inspection is gone. Persona-only input and memory documents are excluded from generic role projections.
• d3300bba makes re-entry consume only an authenticated admitted Persona pass-input. The loader requires one exact Persona.pass_input Mind commit receipt, validates its content-addressed identity, and refuses a naked typed document. A restarted execution plan performs no heartbeat, agent-memory, Body, repository, or model read when that input and terminal decision already exist. Current-work reconstruction is identical and byte-for-byte read-only at Launch, Wait, completed, and post-Research boundaries.
• f8412b69 makes decision audit an operator capability rather than a test claim. reasoning_context::audit_decision_context reconstructs the sealed basis, decoded typed projection, exact terminal native/provider requests, governed tool observations, structured terminal records, and exact Mind commit receipts without consulting streams, events, or current Mind state. Worker archival now retains the complete typed role/generic result family; the digest-only archive shape is deleted. Runtime schema v2 refuses the prior writable archive epoch.
• 553f79d9 makes the OpenAI Responses schema projector one explicit dialect compiler shared by every model pass. It types literal-only schemas, removes parent-relative and unsupported conditional validation from provider cargo, preserves supported type-specific constraints, and lowers decision-bearing UUID formats to exact lexical patterns. The full native schema remains the Mind-admission contract; no provider projection can weaken native decoding. This cut was forced by three preserved packaged falsifications: untyped literal/parent refinements, rejected uniqueItems, and an invalid UUID after over-stripping provider guidance. No role-specific prompt/schema exception survives.
• a8f3c1f0 repairs the Body identity seam exposed only after the first fully typed packaged Modeling decision. Bootstrap had supplied Git source identity to the keyed RepoModel's Body-binding field. Bootstrap now uses the admitted RepositoryBodyObservationBasis, and RepoModel initialization independently refuses any seed that disagrees with the authenticated runtime Body route before writing a single envelope. The negative test proves the entire store remains byte-identical.
• Exact bb823c54 closes the model-pass failure seam exposed by the native capstone. EpiphanyModelPassFailure is one shared typed terminal record over the sealed basis/context for role, reorient, and Persona cognition. The terminal owner derives the exact transport session/job from that context, atomically closes a still-live transport job plus the exact model session, and prevents generic transport failure from impersonating decision authority. Restart reuses the terminal record instead of inferring again. Persona success closes the session only after the effect document and terminal receipt are durable.
• Reorientation failure admission now requires that same exact EpiphanyModelPassFailure. A generic failed worker result plus a plausible context can no longer manufacture a Continuity decision.
• Provider request authorship is also cut at the owner. Runtime execution and decision sealing both derive the provider request internally from the exact native request. Public model-turn ingress accepts only native requests; caller-authored provider requests refuse before opening model authority, and no public provider-request storage function survives.
• Exact bb823c54 also closes the bootstrap-only semantic work seam. Modeling projection work is derived on each pulse from the complete exact keyed RepoModel document-version set and the Mind commit receipts that own those versions. The cache work item is content-addressed and stays outside Mind mutation CAS, so unrelated graph commits remain concurrent. Older work cannot suppress a newly assembled basis. Each projector operation validates the complete current keyed namespace from its opening snapshot, and acquisition uses full-snapshot CAS so a concurrent disjoint insert cannot hide as a phantom. Modeling retention uses exact basis identity rather than synthetic aggregate generation or timestamp order.
• Exact 470d4cb5 removes historical coordinator receipts from behavioral routing. Family admission owners materialize typed obligations, and one pure current-work projection is now the scheduler input. Exact d48f69b7 repairs Body Modeling retry identity. Exact 9b9b5c85 completes the shared law: simple model passes carry one typed attempt projection, Research and two-stage Planning retain their full exact lifecycles in current-work, and proposal Modeling preserves canonical failed/cancelled attempt identity. A failure changes pressure identity once without counters or event authority.

There is no compatibility aggregate, dual reader, bootstrap thread, or migrator. Thread identifiers may survive only as immutable pass-creation provenance; they do not own identity, currentness, or conflict.

Verification at this boundary:

• cargo test --workspace --all-targets --locked -- --test-threads=1 passes natively;
• every Epiphany core target compiles;
• core library 491/491;
• OpenAI runtime library 25/25;
• OpenAI Codex spine 12/12;
• model-runtime binary 10/10;
• OpenAI-runtime binary 10/10;
• Persona service 1/1.
• tool runtime 14/14, with only the explicitly live immutable-GitHub test ignored;
• release construction 21/21.

Canonical machine now

The runtime Mind .cc is the sole decision-bearing store. Keyed Mind and RepoModel documents assemble deterministic views; their projection digests are audit/display identities, not mutable authority revisions.

reasoning_context::commit_mind_mutation is the crate-private canonical commit primitive. Concrete invariant owners supply exact strong reads and complete typed writes. Disjoint identities merge, same-identity divergence conflicts, changed strong reads refuse without mutation, and exact replay returns the original receipt. Model output is never silently rebased.

current_work.rs derives work from unresolved typed state obligations and exact runtime receipts:

• Modeling consumes Body/RepoModel obligations directly.
• Eyes launches only for an explicit outside-evidence obligation.
• Verification consumes exact Hands consequences and invariant obligations.
• Persona consumes typed unread social/relationship state.
• Hands consumes an adopted plan/route and exact capability receipts.

Events, timestamps, role lanes, latest-result slots, and accepted-at ordering are projections only.

Decision-audit foundation

The intended retained chain is:

1. exact typed Mind document versions;
2. sealed EpiphanyReasoningBasis with a closed typed projection;
3. exact final native model request;
4. internally derived provider request;
5. exact ordered governed tool intents/receipts supplied to the pass;
6. sealed EpiphanyDecisionContext;
7. structured terminal decision or typed pass failure;
8. invariant-owned MindMutation and EpiphanyMindCommitReceipt.

Transcripts, SSE frames, reasoning deltas, and intermediate prose are optional and non-authoritative. A retained decision must remain auditable after deleting them.

Model opening requires the sealed basis for worker passes and derives the provider request internally from the native request; callers cannot supply a second provider-shaped truth. Structured role/reorient results, the three Persona stages, and retained worker/session/Persona authority already bind and preserve exact decision contexts. Concrete Body, Proposal, frontier-verdict Modeling, Research, Verification, Planning/PlanMind, and Reorientation admissions use keyed mutations. Research is driven only by explicit external-evidence obligations; Eyes does not gate Body Modeling.

Accepted migration boundary

The source-level Decision-Auditable Concurrent Mind migration is accepted.

Context validation is now exact and DRY: execution and sealing share the same model/tool binding owners, native/provider lowering is exact, final ToolCall/ ToolResult bytes are closed, and request-owned public-source observations stay distinct from model-continuation observations.

Retention must preserve direct reachability: worker attempt or Persona terminal to decision context to reasoning basis. No raw stream event, request family, or transcript may be required for that query after archival.

The packaged epiphany-model-runtime audit-decision command exposes that read-only projection by exact context ID. Its JSON is an operator/xenos rendering only; it never writes Mind or reconstructs prompts from live state. Exact source 5f66d6c9 adds list-decisions to the same runtime. It deterministically lists only contexts with a complete validated terminal audit chain; sealed nonterminal contexts remain physiology and are omitted. This surface and its portable-test repairs through exact ebc0ffe4 have now passed Idunn's full Yggdrasil workspace gate and are sealed in the exact Linux package described below.

The cross-repository operator-plane cut is complete: Epiphany 39adf3a4, Bifrost 8b9ab65, VoidBot 78763ea, and gamecult-ops ca09ba8/c44fb05/448e368. Eve/CultMesh projections, local typed enginseer tools, Persona transport, and governed consequence receipts remain. The standalone Discord command daemon, bridge admission worker, operator Mind writers, deployment gate, unit, and readiness claims do not.

Exact ab321b34 introduces one explicit, decision-auditable model-provider boundary. The native request remains canonical; provider selection lowers it internally into the exact OpenAI or OpenRouter request recorded in the decision context. Exact 547404fa projects public provider identity without exposing credentials. Exact c1a6034f preserves supervisor, heartbeat, and Resident Self read-only physiology while the swarm brake is engaged. Exact 6b44b4d3 publishes the shared Idunn signed-health wire schema.

Idunn compiled, tested, packaged, deployed, and health-admitted exact current source d2ca66301fb6af4e7d2d27fff0b772b0f0fccdf4 natively on upgraded Yggdrasil. The full workspace gate passed under test receipt SHA-256 de0fc6b360ce03493b13208d917dc8349801f03364617d966152c85846c47482. Idunn sealed 26 immutable root-owned binaries plus release-witness.ccmp as release sha256-46407552b4a0937f63d2b7f2bd09a1dacb89d671a6e3807c97209159541aef06; the witness file SHA-256 is 348785ffb0fc3130d3b4538329870c6e6f8442a8da4a01b32fa9b7ffb1f01357. The successful request is manual:redeploy:yggdrasil-epiphany:manual:redeploy:yggdrasil-epiphany:2026-08-22T16:35:41.670Z. epiphany-operator-command remains absent.

The provider boundary exposed two deployment ownership defects rather than earning provider-specific compensators. Idunn's validator now consumes its canonical authenticated daemon-health record; the root actuator supplies the exact trust store. Runtime credential readiness is inspected inside Resident Self's systemd mount namespace, where LoadCredential actually exists. These cuts are live at Idunn 8b972715 and gamecult-ops through b47f9084. No transient Epiphany container, named volume, package root, or per-run test root remains.

The bounded redeploy request helper opens an exact, expiring brake grant and immediately returns after waking Idunn; it does not own terminal observation or brake closure. During the 470d4cb5 transaction the operator poll reached a successful terminal receipt before re-engaging the brake. Exact release binding refused contemporaneous stale Odin/Ghostlight requests, so no unrelated target mutated, but the released record briefly survived transaction closure. Future operator transactions must treat terminal observation plus explicit deployment-brake-engage as their final step. Idunn cannot possess the private operator identity used to close its own mutation authority.

Fresh source tests prove the retained chain, concurrent keyed commits, old-epoch refusal, deterministic current-work re-entry, and Persona replay without input reformulation or inference. This is source acceptance, not yet a package/live claim.

Exact clean packages at 55fb4cf8, edd664db, and 1e01c339 preserved the three provider-boundary falsifications above. Exact clean 553f79d9 then packaged 27 Linux binaries as release sha256-e6c19d2b231a73023772f1162b15dac63bd4c7957a7a1cea82a86c8d75f35ac9 with witness sha256-fbee2857c558bde47f4b422b59fe675362fd1955388b084b3d44a188f8a6c82a. Its fresh capstone completed concurrent three-stage Persona cognition and a terminal Body-Modeling decision after five governed source-tool rounds. Review then refused before Mind mutation because the seeded RepoModel carried Git source identity instead of the authenticated Body binding. That failed root is preserved and is not replay input.

Exact clean a8f3c1f0 now packages natively on Windows as 27 binaries, release sha256-19d40048f46355486e66c2abc766abb277122c552cb121a9161e6e95a471be46, witness sha256-ee8bf0574b5e7d489adc47f6dca491fe5224c8b3e61b3d2fd8c2e67c36d5f903, with privateStateExposed=false. Its fresh store projected launchModeling directly from the Body obligation and launched Persona plus Modeling concurrently. Both provider calls then failed because this task token cannot reach chatgpt.com; no positive decision was fabricated.

That failure found a real architecture gap. Modeling already sealed a typed, transcript-free failure context, but Persona left its session active. The Exact bb823c54 repairs the shared owner. A native negative replay produced basis reasoning-basis-sha256:d31179fe..., context decision-context-sha256:a89ba921..., and model-pass failure dd058f3f...; the Persona session is Completed, transcriptRequired=false, and restart left runtime SHA-256 C7723AD7... plus heartbeat SHA-256 2996AAA8... byte-identical. Its 2.09 MB temporary replay root is .epiphany-run/native-model-failure-20260818-a; evidence is distilled and the temporary root owns no continuing proof.

The admitted d2ca6630 release was compiled and packaged natively on Yggdrasil with Rust 1.95.0 under epiphany-builder. The live Idunn actuator contains no Docker path. A build container or cloned source volume owns no durable proof.

Ox9 proved typed Persona and Modeling decisions, then exposed that historical coordinator receipts could resurrect stale direction. Exact 470d4cb5 cut that authority and made Resident Self consume only current unresolved typed state. Ox10 proved the replacement route: Body launched Modeling directly with no Eyes result, while Persona ran concurrently. Modeling sealed its exact basis/context and failed closed because Ox emitted duplicate tension cargo; no Mind commit occurred. Three Persona projector attempts independently timed out opening the provider stream and each terminalized as typed failure.

Ox10 then exposed one remaining asymmetry. Body Modeling projected its semantic work and continuation action in separate fields and omitted the failed job from the current-work digest. The unresolved obligation remained launchable, but Resident Self correctly refused to mint the same pressure identity twice. Exact d48f69b7 deletes that Body split shape. Exact d2ca6630 adds restart-safe resident objectives and durable recovery for a dead runtime worker, and is the current admitted Yggdrasil body.

Private Ox12 proved the repaired Body path in package reality: Body Modeling launched directly without Eyes, completed, and admitted; admitted-direction Imagination also completed. Under exact 9b9b5c85, OpenRouter then completed proposal Modeling attempt 1 with a structured result. The result put RepoModel node/claim identities in dependency_item_ids, whose contract is frontier identity. The mutation planner correctly refused the absent frontier dependency and changed no graph state.

That correct semantic refusal exposed a generalized lifecycle gap: model transport success remained terminal while its failed Mind admission was not a durable routing input. Exact e046a4d1 adds one typed EpiphanyAgentPassAdmissionRefusal Mind document for Body, proposal, and frontier-verdict Modeling plus frontier Verification. The refusal binds exact request, job, result, decision context, invariant owner, refusal kind, reason, and commit. Current-work derives a fresh attempt from it; proposal retry carries the ordered prior refusals. A successful model result remains truthful and is not rewritten as a failed worker job. Output contracts now distinguish claim targets from frontier dependencies. Mind/runtime/proposal context cut to epochs v3/v4/v2; old writable stores are refused. Ox12 is therefore historical evidence and must not resume. Local core 491/491, coordinator 12/12, status 2/2, swarm 10/10, and all core targets pass.

Exact 85061129 then passed Idunn's full Yggdrasil workspace gate and sealed release sha256-238a7911650c406c67b710b19642451c1b1e7bdbe66e9dc7605e46e098a780dd. Private fresh-store Ox13 proved the new refusal lifecycle in package reality: Body Modeling launched without Eyes and admitted, Imagination completed, and a structurally valid proposal result wrote a typed admission-refusal commit before attempt 1 completed with corrected semantics. Transcript-free exact audit is retained under the Ox13 root. Persona concurrently exposed an independent deadline-owner defect: its provider transport hardcoded 90 seconds while worker passes used one outer 600-second budget. A stop race let systemd begin four typed projector failures rather than the live-observed three; none committed Mind or public speech. Ox13 is sealed, inactive, and must never resume.

Exact 3b958a83 gives Persona one explicit outer --turn-timeout-seconds budget, defaults it to 600 seconds, removes the inner provider request timer, and makes the shared error provider-neutral. The focused provider/runtime suites pass: provider spine 17/17, runtime library 26/26, model-runtime binaries 13/13 each, and Persona service 1/1.

Ox15 is sealed historical fresh-store evidence. It proved Persona no longer dies at the old inner transport timeout, then exposed a separate proposal currentness fault. Exact 8812945e keeps proposal semantics inside the family admission owner, and exact 749d977e makes a completed historical direction decision valid evidence for its proposal across later disjoint RepoModel changes without turning an aggregate model revision back into authority.

Exact 749d977e passed Idunn's Yggdrasil gate under test receipt SHA-256 39229d8a526a7af7e7b29cec28d27b07f89ba5f5792658947e3d1d039b9449c4 and sealed package sha256-5d9bc25612dd46511620671ccd5113f3b5e0e3c060c85e97dcdc199f9126a230. Private fresh-store Ox16 launched direct Body Modeling without Eyes while all three Persona stages ran concurrently. Body and proposal admission survived later disjoint RepoModel changes. No public delivery succeeded. Planning then remained unavailable because the active Imagination frontier used inspected evidence paths as its supposed future write scope, omitted OX-CAPSTONE.md, and was unordered. Dependent proposal pressure began to form, so Ox16 was braked and sealed before the forest grew. No Hands consequence or capstone marker exists; Ox16 must never resume.

Exact 5b799b12 is the hard architectural cut from that evidence. It deletes source_scope/sourceScope, makes repository_scope the canonical sorted repository-relative ceiling for future Planning/Hands consequences, and names the adopted route narrowing authorized_paths. Generic RepoModel validation owns the intrinsic path law and refuses an invalid routed frontier atomically before any graph document is written. Inspected files and evidence remain in their existing typed audit cargo. Mind/runtime/RepoModel epochs advance to v4/v5/v2. Local acceptance is core 494/494, OpenAI runtime 26/26, coordinator 12/12, swarm 10/10, and model-runtime 13/13.

Immediate next action

The Ox17 deployment lane is paused. Continue the registered-document and test- liability audit from exact ffd91c20; do not compile or deploy through Idunn yet. Delete an abstraction with tests that merely animate it when it has no decision-bearing consumer. Preserve keyed Mind, sealed reasoning, direct Body- to-Modeling flow, family admission owners, Persona social state, provider boundaries, consequence-verifying receipts, and the complete Model Atlas vertical slice until its first live inter-swarm collaboration trial.

Yggdrasil previously exposed 96 GiB of dead native Cargo targets after interrupted full-workspace builds; exact cleanup returned the builder target root to 4 KiB. Exact 1d5a1f17 landed the first causal cut:

• 21 duplicate core/release binary declarations are gone; each production entrypoint has one Cargo owner;
• 19 generic repo-request smoke executables are gone because Cargo compiled them but their main() assertions were not tests;
• the runtime-store migrator CLI and the unshipped repo-personality birth subsystem, parallel agents.msgpack initialization, schemas, prompts, and stale contract plans are gone;
• the non-vendor diff removes 19,252 net lines and reduces epiphany-core from 75 to 30 binary targets;
• core library tests remain 494/494 and Hands remains 5/5 under the sole release package owner.

Exact 387afe49 is the second verified cut. It deletes the runtime_store_migration module/test, all 29 remaining unshipped core executables, the shipped epiphany-verse-query parallel control plane, the local PowerShell launcher, and its orphan Rider bridge. epiphany-core now owns only epiphany-prepare-compaction; the release bundle owns 25 runtime executables. Focused core, supervisor, and release-construction tests pass 493/493, 32/32, and 21/21.

Exact bf516f99 deletes the agent-memory migration, repair, lifecycle, trait-seed, and SoA authorities with the tests that preserved them. It also deletes the second CultMesh SoA mirror, its timestamp-selected latest head, and its prompt injection. Persona now reads learned memory only from keyed EpiphanyMindPersonaMemoryDocument rows in the assembled Mind view; those documents participate in the exact projection digest and source set. Dead test-only alternate Resident Self and direct Continuity writers are also gone. The final core library passes 483/483 and Persona service re-entry passes 1/1.

Exact 360073a3 was an intermediate reduction of semantic projection. Exact 856648de later proved the remaining cache had no reasoning consumer and deleted the subsystem wholesale. Modeling now seals the live typed Body and keyed RepoModel basis directly; no vector readiness or workspace-coverage gate stands between Body and Modeling.

Exact d1685df8 deletes heartbeat aggregate cognition: personality/mood timing, appraisal, rumination, dreaming, the void routine, and its memory graph. Exact 39dd9fdb deletes the remaining agent-memory identity/generation store, the 64-float utterance vector, generic selfPatch decoding/admission, the phantom sleep-distillation contract, stale aggregate/thread schemas, and nine more constructor/static-vector tests. Native role ingress now refuses unknown model cargo instead of accepting forbidden identity and silently ignoring it. Core passes 455/455 and the provider runtime passes 27/27. The obsolete repository- local Cargo target was 2.5 GiB and was removed; compilation remains in the shared target.

Exact 2164bd0a first collapsed heartbeat to Resident Self and Persona scheduling. It deletes Ghostlight scene scheduling, manual tick/pump/heat/complete and queue-mention controls, adaptive pacing/initiative heat, five fake organ lanes, five dead schemas, and eight self-referential tests: 2,145 deletions against 118 additions. The strict heartbeat state is now v1; the owning binary checks cleanly and the surviving core suite passes 448/448.

The keyed Persona cut completes the separation. Pending Persona mentions, immutable requests, terminal receipts, quarantine records, and retention state are keyed CultCache documents. Persona derives and reserves its own work; the heartbeat daemon has no Persona path. The exact social request envelope is the pass-input provenance. Failed turns produce a new deterministic retry identity, and retention excludes its immutable retired frontier instead of deleting decision history. The old heartbeat bridge/terminal names and writable types have no compatibility reader.

Exact 4d0db2c7 deletes the final singleton heartbeat scheduler: module, binary, schema, store, service, deployment lifecycle, artifact tree, stale repair, pacing/history state, and acknowledgement consumer. Resident Self now owns pressure-to-grant CAS, launch exclusion, leases, terminal receipts, retry, and retention directly. The same cut deletes twenty-one tests that guarded source spelling, constructor copies, or one-line helpers instead of behavior.

Exact 67a3a57b deletes every remaining Rust test that parses its own source: nineteen daemon-supervisor/workspace-coverage string and ordering assertions, plus two exact argument-vector mirrors. This removes 591 lines. The focused native supervisor suite now passes 10/10 and the workspace-coverage behavioral slice passes 74/74. The retained tests exercise validation, owned-store exclusion, process observation, CAS conflict, signed authority, recovery, and re-entry. The deleted tests named several legitimate sequencing invariants but proved none of them. The 4.7-kiloline daemon supervisor is therefore an exposed launch/reconcile authority knot; split it before restoring transition-level proof rather than adding a mock shell around the monolith.

Exact bbe5fcf1 deletes four CultMesh tableau tests and replaces their production-absent seven-cluster Odin/Eve/daemon world with the minimum retired provider rows needed by the surviving authority tests. The real tests still prove that legacy rows cannot become live discovery state, explicit retirement touches only those rows, private-state tool requests refuse, and typed intent/receipt persistence round-trips. The cut removes 396 net lines; CultMesh integration passes 57/57 and the non-test core check is clean.

Exact f236e1cd deletes the six parallel Mind, Substrate Gate, Eyes, Hands, Soul, and Continuity CultMesh contract families. Their DTOs, type/schema constants, registry bindings, field-copy mappers, writers, seed calls, mirror tests, and public reexports are gone. The local Verse now derives summaries directly from each organ's owning CultNet contract factory. This removes 607 net lines; CultMesh integration passes 51/51 and non-test core remains clean. A store containing the deleted derived envelopes refuses under the new registry; there is no migrator or dual reader.

Exact fe591b33 deletes the persisted Verse-policy and global-room-policy families. Their registry rows, schema/type constants, seed-time writers, public writer APIs, and two literal-copy tests are gone; EpiphanyLocalVerseContext projects the fixed policy tables directly. This removes 130 net lines and the focused CultMesh suite remains clean at 49/49.

Exact 4ed3a6e0 deletes nine dead CultMesh document families: the JSON-derived operator snapshot, coordinator receipt, Hands gate, and role-review event; unauthenticated Odin advertisement, Eve surface, daemon capability, daemon-tool intent, and daemon-tool receipt. Their DTOs, registries, parsers, validators, writers, latest slots, prompt branches, exports, fixtures, and ten tests are gone. The provider-row retirement path and the daemon supervisor's retired operator-status migration command are also gone. The hard cut removes 2,398 net lines. Non-test core check, CultMesh 39/39, prompt projection 1/1, and daemon supervisor 10/10 pass.

Next audit the remaining round-trip tests for duplicated CultCache derive coverage: retain tests only when they prove Epiphany validation, monotonicity, authentication, conflict behavior, projection, or an authority boundary.

Exact e8bc0382 deletes the unused CultMesh Persona-speech-audit and Weksa-lowering-receipt shadows plus all four tests that alone animated them. The real Persona and Weksa typed owners remain intact. This removes 432 lines; non-test core check and CultMesh 35/35 pass.

Exact db6a7131 deletes the unused CultMesh operator-run intent/receipt and generic work-loop telemetry shadows. Their runtime-spine declarations, prompt branch, test-only prompt seed, and two tests are gone; native runtime and keyed Mind receipts remain the owners. This is 829 pure deletions. Non-test core, CultMesh 33/33, and prompt projection 1/1 pass.

Exact 75ead942 deletes the four RepoWork aggregate families, their latest heads/loaders, the unused service-execution audit helper, unused Bifrost artifact/metrics/public-proof receipt families, and every test that alone animated those surfaces. The apparent public-proof crossing had no production consumer: its context field was assembled and then ignored. This removes 1,410 net lines. Non-test core, CultMesh 30/30, and prompt projection 1/1 pass.

Exact 753707ff makes persisted runtime-bound cluster topology the sole local-Verse bootstrap witness. The duplicate singleton status document, writer, loader, supervisor precondition, exports, and round-trip test are gone. Two foreign-row preservation tests now use an honest test-local foreign type and a real swarm-brake row instead of borrowing the dead status schema as scenery. This removes another 99 net lines. Non-test core, CultMesh 29/29, the affected readiness and Persona tests, and daemon supervisor 10/10 pass.

Exact 967743cc deletes seven daemon-poke and Bifrost latest/exact loader APIs that only tests called. The remaining tests consume EpiphanyLocalVerseContext, the same view as runtime prompt/supervision paths, and are named for immutable identity, monotonic latest selection, and governed receipt correlation rather than serialization. This removes 85 net lines; non-test core and CultMesh 29/29 pass.

Exact 1ab0859b deletes two more CultMesh tableau tests: one copied static topology strings already exercised at prompt/liveness boundaries, and one still claimed to reject provider-owned bootstrap state after those provider fields had been deleted. This is 78 pure test-line deletions; CultMesh passes 27/27.

Exact ab5b16ec deleted a #[cfg(test)] generic managed-service-policy writer and the two assertions that summoned it. The specialized projector writers and tests that survived that intermediate cut were later deleted with the entire unconsumed subsystem at 856648de.

Exact c977d149 deletes Epiphany's unused v0 Idunn deployment-receipt and aftercare-audit families. VoidBot, gamecult-ops, and the local Odin/Idunn body show that live authority is gamecult.idunn.deployment_manifest.v3 plus signed daemon-health admission; nothing produces the Epiphany-local envelopes. They had no writer, test, or consumer beyond unused context slots and loaders. The cut removes 151 lines; non-test core, CultMesh 27/27, and prompt projection 1/1 pass.

An intermediate producer audit found no production writer for EpiphanyCultMeshDaemonStatusEntry; only CultMesh tests call its public writer. The daemon supervisor and local-Verse context read this manually conjured aggregate, while the real semantic/workspace projectors already publish their own heartbeat/readiness receipts. Do not add a status publisher. In the supervisor split, consume family-owned health directly and delete the generic status/poke mirror once its command paths have moved.

Exact c553868d completes that deletion. It removes the generic daemon status, poke intent/receipt, restart-policy, and scheduler-receipt document families; their registry entries, loaders, writers, local-Verse fields, reconciliation loop, CLI flags, and nine fixture-driven tests; and one helper kept alive only by those tests. The cut is 1,808 net lines. Non-test release-bundle supervisor check passes, CultMesh passes 20/20, and the remaining supervisor tests pass 8/8. No source reference to the deleted schemas or reconciliation path remains. That left an intermediate specialized managed-service path. Exact 856648de later deleted it because neither projector fed a reasoning basis.

Exact f9eeb460 then removes the remaining self-referential supervisor display test and its helper. The test asserted only that a non-authoritative label matched the helper's own branches; correlation and provider status were already projected separately. The workspace recovery test was reduced to its real invariant: the recovery write runs for ExactAlive and not for Missing. Supervisor check and the resulting consequence-bearing suite pass 7/7; the cut removes another 47 net lines.

Exact 30c66080, 008bd493, 7e16e758, and 3312880e remove the generic command entrances, legacy lifecycle lineage, fallback/finite launch modes, and caller-authored service identity/configuration. They subtract 596 net lines. Exact afb223da removes two more tests that guarded formatting and a five-line match, collapses the latter wrapper into its only call site, and advances the managed-service policy schema to v1. Fixed owner, restart mode, unused backoff, decorative update time, and prose notes are gone; old policy rows refuse at the load boundary. The cut subtracts 84 net lines.

Exact ffe707ff removes the global lifecycle latest mirror, local-Verse slot, receipt-history scan, timestamp election, and two tests that preserved those surfaces. Each service now owns one exact current receipt head; its atomic CAS conflicts on concurrent same-service replacement while disjoint services remain independent. The cut subtracts 209 net lines. Focused native checks pass: CultMesh 18/18, workspace process authority 11/11, and supervisor 5/5.

Exact 47454e61 was the last intermediate supervisor split and correctly deleted Epiphany's Windows Task Scheduler control plane. Exact 856648de deletes the remaining native spawn mechanic and both cache-process launch owners. Idunn on Yggdrasil is the sole deployment and daemon-survival authority. The obsolete semantic-projector runbook is deleted rather than preserved as current deployment guidance.

Exact 803e3447 deletes the unconsumed semantic-projector-service-status command and its ad hoc JSON projection: 40 net lines. Typed lifecycle and heartbeat state plus Idunn's signed aggregate health remain the read paths. Supervisor check and 4/4 consequence tests pass.

Exact da8ed840 removed 484 net lines of console-shaped reconcile state. Its remaining supervisor and cache recovery authorities were subsequently deleted at 856648de; signed Idunn health is the operational truth.

Exact 2aeab7a9 deletes the generic organ dependency/proof-profile subsystem, its persisted worker-launch field, Persona prompt injection, evaluator, and three self-certifying tests: 700 net lines. The universal dependency matrix was never consumed by admission and contradicted direct Body-to-Modeling work. Worker-launch schema v2 and Persona projector prompt v1 make the hard cut. Family validators, typed launch documents, sealed reasoning projections, and concrete invariant owners remain. Focused acceptance is core 378/378, OpenRouter runtime 27/27, packaged runtime 13/13, and Persona re-entry 1/1.

Exact ef92e853 deletes the callerless view-lens registry, legacy role and reorientation acceptance-bundle builders, two #[cfg(test)] raw-JSON result parsers, and the six tests that animated them: 797 net lines. The typed runtime result interpreter remains in use by current work and reorientation. Core is 372/372.

Exact a292979d plus formatting receipt 77e817c1 delete the second CRRC recommendation algorithm, its unused input model, and four tests: 206 lines. The keyed status composer remains the sole recommendation projection. Core check and the remaining surface slice 12/12 pass.

Exact 3b94bf6e deletes the duplicate nested status view and the false --coordinator-only/auxiliary label: 25 net lines. Exact 59c5e3a6 deletes the ignored cwd and historical no-op presentation arguments: 12 lines. Exact 7c9b0cf3 deletes the fixed synthetic job table, its role-board cargo and mapping helpers, and its one test: 338 net lines. Role lanes and coordinator routing now derive directly from exact current work. Focused coordinator/status checks pass; the operator thought-sealing test remains 1/1.

Exact 2ce91461 deletes the duplicate scene/planning Mind reconstructions, epiphany-self-policy, unused prompt templates, four counterfeit surface schemas, and ten tests that guarded producers or source text rather than a consequence: 1,723 net lines. Exact 78836f3b deletes eight more unconsumed status tableaux, the pressure calculator production only invoked without telemetry, its unreachable compaction route, one counterfeit schema, and six tests: another 518 net lines. Status now contains Mind identity, exact current work, one action/reason decision, and readable role lanes. Core 356/356, status 1/1, coordinator 8/8, and release construction 19/19 pass.

Exact f10f7fb3 completes that audit: all twelve remaining surface schemas and their ten catalog entries had zero producer and zero consumer. The 692-line pure deletion includes global-revision status shapes, old Rider/Unity/Void bridges, and the artifact-list Persona surface; gamecult.persona_state.v0 remains the portable Persona contract. The publication index contains zero epiphany.surface.* documents.

Exact ab3cacfb deletes thirty-one more producerless contracts: abandoned RepoWork aggregates, CultMesh operator-run shadows, generic launch/accept intents, swarm receipts, Persona artifacts, and every Epiphany-owned Rider and Unity command schema. Runtime sessions now advertise read-only lifecycle state instead of a nonexistent coordinator intent path. Brokkr owns Unity editor capabilities through CultMesh/Eve; a future Rider daemon owns Rider. The same cut found a 415-line prompt-context module and the specialist TOML prompt system were consumed only by their own four tests. Module, exports, configuration, dependency, and tests are deleted. Native core, OpenAI runtime, and release bundle checks pass; the behavioral core suite passes 352/352; the published catalog contains 23 local schemas and none of the deleted families.

Exact 16d85b1b deletes all six remaining direct agent_launch schema tests and two OpenAI-runtime self-source searches: 209 pure test-line deletions. The schema tests duplicated stronger provider-lowering and typed-ingress/admission proofs; the source searches proved only that forbidden function names were not spelled in one file. Core checks cleanly and the retained OpenAI runtime suite passes 25/25.

Exact 06f93f70 deletes the test-only OpenAI-to-native request mapper. Two retained runtime tests now construct the canonical native request first and derive the provider request through the production adapter. This removes sixty net lines and makes test ancestry obey the same one-way ownership rule as live inference; focused typed-storage and tool-followup tests pass.

Exact 203bcc41 deletes Epiphany's fabricated Bifrost body-change and GitHub publication family: four CultMesh document types, three singleton latest heads, their constructors, validators, writers, local-Verse advertisement and projection, public exports, and five tests that manufactured both ends of the crossing. A cross-repository producer audit found no live Bifrost or gamecult-ops owner for any of these types. The real Bifrost Persona feedback/delivery stores and signed crossing receipts remain owned by Bifrost. Core checks, release-bundle checks, and the remaining CultMesh suite pass 13/13.

Exact 11d99de1 deletes the producerless HandsPrReceipt family: the CultCache type and registration, dead test-only writer, read API, public exports, relinquishment branch, and two Hands contract advertisements. No production or test caller could create the receipt. Hands now owns local patch, command, and commit consequences; exact remote publication evidence belongs to the remote provider/Bifrost crossing. Core and release-bundle checks pass, and the rebuilt 43-entry schema catalog contains no deleted PR family.

Exact a4af4734 deletes the second CultNet contract author and the false bootstrap witness: six organ-specific contract DTO/factories, the callerless EpiphanyLocalVerseContext query/seed bundle, fixed Verse/room policy prose, the mind_contracts module and its self-affirming test, persisted seven-cluster topology, its dead writer/loader, the supervisor's nonempty-row bootstrap check, and the diagnostic test that kept the loader alive. Exact 03140a47 later deletes the remaining standalone contract mirror; live providers own their CultMesh/CultNet catalogs. Supervisor readiness continues to depend on exact runtime/store identity, packaged release, brake, service policy, process identity, and signed health. Core and release-bundle checks, CultMesh 12/12, and supervisor 4/4 pass. The cut removes 1,005 net source lines.

Exact beb9fd32 deletes the producerless EpiphanyToolCapability family from the tool adapter, runtime registration/mutation table, standalone JSON schema, schema index, and MCP smoke banner. No writer, reader, constructor call, admission path, or test existed. Exact model-request tool definitions, RuntimeToolExecutionBinding, invocation intents, and governed receipts remain the tool authority. The canonical catalog drops from 43 to 42 schemas and keeps tool intent/receipt. Four affected packages compile; the tool runtime passes 14/14 active tests with one explicit live-source test still ignored.

Exact ca2d2cf2 deletes four prose-only Continuity contract families: packet, compaction checkpoint, stale-turn repair, and refusal. They had constants and runtime mutation-table rows but no typed documents, schemas, stores, writers, readers, or tests. At that cut, accepted reorientation still wrote a separate ContinuityRecoveryReceipt; exact fed4b857 later removes that unread copy in favor of the typed Mind decision and commit receipt. Core/release checks pass and the decision-auditable reorientation test passes 1/1.

Exact f8974d52 deletes five prose-only Soul families: generic verification request, invariant check, regression receipt, review receipt, and verification refusal. They had constants and mutation-table prose but no typed documents, schemas, stores, writers, readers, or tests. The keyed repo-frontier verification request and persisted SoulVerdictReceipt remain the real request/result path. Core/release checks pass; focused verification tests pass 3/3.

Exact 201fa192 deletes three prose-only Eyes families: generic evidence request, evidence review, and evidence refusal. They had constants, exports, and mutation-table prose but no typed documents, schemas, stores, writers, readers, or tests. Authenticated source lookup receipts and the exact research decision's persisted evidence packet remain the real Eyes path. Core/release checks and focused Research 2/2 pass.

Next continue the test-authority audit after exact ffcf036f, beginning with remaining direct schema, prompt-rendering, CLI-parser, and CultMesh projection tests. Audit every claimed cross-service contract against its real producer before preserving it. Retain a test only when it reaches Epiphany validation, ownership, authentication, monotonicity, CAS conflict, replay, projection, or an externally visible consequence; delete test-only APIs and fixtures with the tests they animate. Preserve exact current work and the four consequence-bearing supervisor tests. Do not run a full-workspace compile, package, deployment, or Ox root until subtraction closes. Never resume Ox10, Ox12, Ox13, Ox15, or Ox16.

Latest authority cuts

Exact bf997ce0 hard-cuts frontier plan-decision receipts to v2. The two permanently empty legacy worker echoes are gone, decision provenance is required, and unused public type aliases no longer pretend to be contracts. Exact e00ea70f deletes the PID-only process-observation compatibility API and its unused path helper; exact process-incarnation identity remains the only liveness and termination authority.

Exact 87983ffc makes runtime identity immutable bootstrap state and advances runtime spine toward its current v7 shape. Launches no longer rewrite a shared singleton merely to refresh stored_at, an update timestamp, a derived capability list, or temporary evacuation metadata. Existing identity and root-session envelopes are replayed byte-for-byte as strong reads, so disjoint keyed jobs can merge without losing identity substitution protection. The existing current-work capstone now proves the identity envelope survives all launch families unchanged; focused core and OpenAI-runtime native checks pass.

Exact a319146b deletes the public non-atomic worker-launch path that only test fixtures called; executor fixtures now seed through the canonical preparation path. Exact 76fd259b deletes two source-layout tests while retaining actual CLI refusal behavior. Exact b95a3266 removes the superseded, unpackaged epiphany-openai-spine debug binary and two tests that animated its private status helper.

Exact 6f93134d makes the release bundle the sole package owner of every production entrypoint. Leaf libraries disable automatic binaries, Cargo metadata reports no multiply owned binary source, and the release builder's hardcoded shadow target map plus two self-affirming tests are gone. The packaged body reached 22 executable targets rather than 26. Exact c04c3aff collapses the five-reexport auth wrapper crate into the transport's narrow direct codex-login imports. Exact ffcf036f advances runtime spine to v7 and derives the constant native runtime kind instead of persisting it. Focused release construction passes 17/17; the three release-owned daemon targets and current runtime epoch checks compile and pass.

Exact 03140a47 then deletes the packaged runtime-spine CLI and its duplicate Hello/catalog contract mirror, leaving 21 executable targets. Live providers own their CultMesh/CultNet catalogs; model preflight derives accepted document types from the real CultCache registration.

Exact 8c20f896 reduces Substrate Gate from six advertised contract families to its one real immutable repo-access grant. Request, review, refusal, snapshot, and mutation were prose-only constants with no typed body, writer, reader, or consequence. Two constructor-literal tests went with them; the governed-tool allowlist denial test remains.

Exact bb6f2ef6 deletes the fictional Hands rollback receipt and the alternate JSON gate-authority path. The coordinator now passes the exact persisted Hands intent/review IDs directly to the recorder. coordinator-summary.json remains operator display and cannot decide action authority.

Exact d66baa27, 058751fb, 573ddc8b, and 27fe11ae delete the generic runtime-event organ completely. Provider frames and typed model stream events are no longer copied into a second event family; arbitrary CLI callers cannot author event claims; session/job/failure commits no longer create duplicate terminal witnesses; and coordinator start/completion/death, retention, archival, status, CLI, registry, CultNet, and legacy-repair paths no longer read or write event shadows. Session/job state and exact typed terminal documents are the sole lifecycle owners. Core 337/337, model runtime 25/25, coordinator 8/8, swarm 4/4, coordinator-core 4/4, and affected native checks pass.

Exact a78c1802 deletes the final epiphany-core executable: a 366-line pre-compaction checker that re-rendered epiphany-state status, Git status/log, and substring checks over canonical documents. The state steward and Git remain the direct owners; no replacement abstraction was added. Cargo now reports ten executable targets, the state binary and core library check cleanly, and epiphany-core is library-only.

The Persona Discord permit target survives this audit. Bifrost's actual delivery tool consumes its short-lived request-bound signature, and the permit key is intentionally distinct, so the process has a real external consumer and privilege boundary. Deployment is stale: Ygg configuration still targets the old Starfire endpoint and installs no issuer unit. Idunn must repair that before Persona consequence readiness; deleting the consequence gate would falsify the architecture.

Exact d2aee1ce deletes the 97-line epiphany-package leaf CLI and its Cargo target. epiphany-release already owns the same package and inspect operations plus publish, and no live caller named the wrapper. Cargo now reports nine executable targets; the release-construction library and real release binary check cleanly. Each survivor has a deployed lifecycle, external protocol/privilege boundary, or live operator/Idunn contract.

Exact ede5c669 deletes a single-use coordinator runtime-options factory and the test that asserted its literal assignments, a stop-policy literal-membership test that never exercised continuation, a private Unix credential-mode test duplicated by file-level permission proof, and a same-call cache equality. Release construction remains 15/15, coordinator 5/5, and core checks cleanly.

Exact 79292fe3 replaces Repository Body's repeated validate/reopen/reconstruct flows with one authenticated snapshot loader over the runtime route, Body binding, historical observation, and manifest. Basis validation, Mind admission, Modeling projection, and manifest consumers now use that single snapshot. The private scanner-session spelling test and fixture-wide route assertions are gone; public Body behavior remains 22/22, reasoning context 8/8, RepoModel 5/5, Atlas runtime 2/2, and affected current-work proofs pass.

Exact 25d4d1fa begins the runtime-spine cut. Twenty-four public functions had no caller in Epiphany, its live neighboring services, or its deployment/runtime body. Their read wrappers, mutation wrappers, status projections, exports, and tool-status DTO are gone. The audit also found a complete Hands route-relinquishment lifecycle—writer, refusal receipt, Mind receipt, schema registration, and prose—with no caller and no verifier; it is deleted rather than preserved as fictional safety. The live Hands owner remains the exact intent/review/grant and patch/command/commit receipt chain, whose commit atomically creates Verification work. The cut removes 800 source lines and adds three words of corrected live documentation. Core compiles without warnings; the focused keyed lifecycle proof passes, including concurrent Persona and Hands commits. runtime_spine.rs now has 10,990 lines, 73 public functions, and 30 public structs.

Continue there. Delete the last callerless Hands receipt-chain reader and demote its private summary cargo, then audit single-caller archive, status, and retention helpers. Preserve immutable identity, exact job/session terminality, decision audit, model/tool binding, atomic Hands-to-Verification admission, conflict/replay, and retention fences that prevent authority resurrection.

Exact 1fea7bde completes that immediate reader cut: the timestamp-selected Hands-chain query and its selector are gone. Exact 6ccc7dd2 later deletes the private summary cargo and derives the Verification request directly from the owning receipts. Exact 40d00bc5 then removes the detailed planning-eligibility tableau, its two DTOs, and two public APIs. No consumer read its per-candidate blocker fields; Self reduced the entire projection to a boolean already owned by the shared actionable-frontier predicate. Hands and Imagination both still require unchallenged target claims. The focused keyed lifecycle proof passes. The runtime spine now has 10,820 lines, 70 public functions, and 29 public structs.

Exact ac6455c5 removes five dormant transaction-injection callbacks and demotes the completed-session and failed/fulfilled-worker archive actuators behind their retention owners: 107 net deletions. The callbacks were always || Ok(()); exact envelope snapshots, batch CAS, replacement/deletion sets, and retention fences remain unchanged.

Exact 6e600e8d rebuilds the broad current-work proof through the real admitted Imagination direction path, including the exact reasoning basis, decision context, worker result, option digest, Body/domain binding, autonomous proposal binding, and atomic Modeling request. It then deletes the test-only user proposal input, generic writer and selector, User/Persona/Bifrost source variants, constant actor/source/privacy/public-source fields, the legacy hash branch, and the provider's four-way schema branch: 192 net source deletions. Proposal Modeling may route only to Eyes or Imagination; Hands still requires an adopted plan. Mind/runtime writable epochs advance to v5/v8. The broad proof still covers proposal retries and admission, Hands-to-Verification atomicity, and concurrent Persona/Hands commits. Focused core lifecycle, epoch refusal, OpenAI proposal mapping, strict provider schema, swarm, and coordinator checks pass. runtime_spine.rs now has 10,520 lines, 64 public functions, and 29 public structs.

Next, trace the remaining proposal fields against the exact Imagination result, autonomous binding, Modeling request, and final sealed prompt. Delete only constant or duplicated cargo; then resume the public runtime-spine/test-owner audit. Ox17 remains paused and no local package/deployment run is authorized.

Exact 82f4733d completes the constant-field half of that pass. The proposal's desired_outcome always equaled its body, scope_hints was always empty, and proposed_at merely copied the exact bound Imagination result timestamp. All three leave the durable proposal, payload hash, and sealed Modeling projection: 37 net deletions. Proposal/context schemas advance to v2/v4; Mind/runtime writable epochs advance to v6/v9. The exact proposal lifecycle, epoch refusal, provider mapping, and strict-schema tests pass. Next inspect whether the proposal's repository/workspace/thread/runtime coordinates protect anything not already owned by the atomic Modeling request and autonomous binding.

Exact 6fbd8184 answers that question by moving all four coordinates out of inert proposal content. The atomic Modeling request owns them; autonomous validation derives that request from binding runtime plus proposal ID/hash and checks its repository/workspace/thread/runtime against the authenticated Body/domain and exact Imagination chain. The proposal schema is v3 and Mind/runtime writable epochs are v7/v10. The broad lifecycle proof, epoch refusal, and coordinator compile pass. runtime_spine.rs is 10,500 lines. Resume the public runtime-spine/test-liability audit next.

Exact 2dfd8c72 removes the producerless Eyes claim-challenge side channel. No live role result, interpreter, or admission owner could create it; one capstone fixture fabricated an Eyes packet and challenge, called the only writer, and then proved the gating it had manufactured. The contract, writer, registry row, validation/routing branches, active_challenge_ids cargo, and fixture-only packet inserter are gone: 465 net source deletions. Exact keyed claim/frontier envelopes still own stale-state refusal. External evidence must enter Modeling and change the keyed RepoModel rather than let Eyes separately decide Planning or Hands actionability. Claim-obligation documents are v3; Mind/runtime writable epochs are v8/v11. runtime_spine.rs is 10,216 lines, with 63 public functions and 29 public structs. The focused core check, keyed lifecycle proof, and epoch-refusal proof pass without warnings. Continue the public runtime-spine and test-liability audit.

Exact 3eca3394 deletes the thirteen-field aggregate runtime status DTO. Its only behavioral consumers checked present or read runtime_id; the remaining fields forced scans of every session, job, result, tool intent, and tool receipt only to populate a coordinator JSON artifact with no reader. Live readiness now uses one exact optional EpiphanyRuntimeIdentity read. OpenAI schema preflight continues to derive document support from the actual CultCache registration, not a copied status list. The redundant coordinator summary member and runtime-spine-status.json artifact are gone: 96 net source deletions and one public struct removed. runtime_spine.rs is 10,132 lines, with 63 public functions and 28 public structs. The focused core library, OpenAI library, release-owned coordinator, and model-runtime targets check cleanly. Continue the runtime-spine/test-liability audit.

Exact 27c8389c removes PreparedRuntimeSpineHeartbeatJob. Every caller used only its prepared envelope vector; none read the duplicated full job value. The preparation function now returns that exact vector directly. The job document remains inside the atomic batch, so launch identity, admission, and CAS behavior do not change. The cut removes ten net source lines and one public struct. runtime_spine.rs is 10,126 lines, with 63 public functions and 27 public structs. The focused core check plus the OpenAI-library and release-owned model-runtime test harnesses compile cleanly.

Exact bda8d8c6 deletes twelve aggregate-Mind fields from EpiphanyRoleWorkerLaunchDocument and all thirteen constructors. Every producer supplied empty defaults, while the sealed reasoning basis already owns the exact typed Mind projection and source-document versions. Role launch now carries only pass identity plus family-specific authority; there is no parallel scratch/graph/planning/evidence/observation/checkpoint/churn state mouth. The cut removes 255 net source lines. Core and both OpenAI runtime owners compile; reasoning-context tests pass 8/8, and narrow Modeling request, typed failure, and repeated-tool-loop terminality proofs pass. Epiphany still owns no Rider or Unity editor integration: Brokkr owns Unity through CultMesh/Eve, and a future Rider daemon must own Rider.

Exact 5ed5ca88 internalizes the typed-request fulfillment family. The request reference, worker-process status classifier, fulfillment function, typed attempt reader, and fulfillment evidence DTO had no external consumer. They are crate-only now; the DTO's unread request-ID echo and one helper-spelling status-class test are deleted. Exact job/result identity, live and archived structured-result validation, admission-refusal filtering, retry semantics, and Resident Self recovery remain. The cut removes 31 net source lines, two public runtime-spine functions, one public runtime-spine struct, and one test. runtime_spine.rs is 10,124 lines, with 61 public functions and 26 public structs. The core check is warning-free and the complete keyed Modeling/Research/Verification/Hands/Persona lifecycle proof passes.

Exact 7cf6d45c makes the completed model-session archive a private minimal tombstone. Its only behavioral purpose is to prevent retired session, job, model-request, and tool-intent identities from resurrecting while binding the deletion to one exact envelope-chain digest. Seven unread summary fields, the duplicate archive/session identity, and the unused archive-time argument are gone. Decision-bearing reasoning bases, decision contexts, and structured outcomes remain durable outside session retention. The cut removes 59 net source lines and one public struct. runtime_spine.rs is 10,070 lines, with 61 public functions and 25 public structs. Runtime writable epoch is v12; archived-session schema is v1. Core and the release-owned swarm harness compile without warnings; old-store refusal and the full keyed lifecycle proof pass.

Exact 09001d89 minimizes the decision-bearing archived worker attempt. It still preserves exact job/request identity, terminal process class, deletion digest, decision context, structured role result, and terminal job results, so decision audit survives removal of live worker authority. Duplicate archive/job identity, archive timestamp, retired-type/count summaries, and the unused vectors returned by both retention families are gone. The cut removes 41 net source lines. runtime_spine.rs is 10,036 lines, with 61 public functions and 25 public structs. Runtime writable epoch is v13; archived-worker-attempt schema/type is v2. Core and swarm compile without warnings; reasoning-context audit tests pass 8/8, and old-store refusal plus the full keyed lifecycle proof pass.

Competitive Eyes/Imagination pass

notes/munder-difflin-launch-intelligence-2026-08-23.md distills the 2026-08-22 Munder Difflin launch, its growth trail, product/source architecture, HN criticism, public failure ledger, pricing and trust boundaries, and implications for Epiphany, Aquarium, CultMesh, Bifrost, Idunn, and Model Atlas.

The durable signal is not an architectural victory claim. Munder has real category heat and is materially ahead at packaging, provider reuse, cross-platform reach, visual comprehension, distribution, community feedback, and commercial experimentation. Users appear to want an operator-attention surface over plans, questions, blockers, decisions, consequences, and liveness. Retention, reliable autonomy, and paid conversion remain unproven. The note proposes falsifiable golden-path, Aquarium, orchestration-overhead, memory, Body-binding, provider, federation, and willingness-to-pay experiments; none is adopted roadmap authority. The test-authority audit and Ox17 brake remain unchanged.

Interface correction: Epiphany does not currently expose its internal faculty and ecosystem vocabulary through a general operator UI. Beyond engineering tools, the concrete human-facing surface is Persona projection into shared asynchronous chat. CultMesh remains the projection-neutral state API. A social Aquarium, dense operator cockpit, TUI, and audit surface may use distinct Eve compositions and interaction models over the same provider-owned facts; no one projection should fossilize its layout into shared truth.

Operational state that matters

• Original c011 resident and Heartbeat containers are not running; both exited 255 on 2026-08-11. Their named volumes are quiescent historical evidence.
• Historical accepted live release: source 465af24d, c011 package SHA-256 089e0005; it is not the current source body.
• The old Yggdrasil capacity measurement is obsolete. The upgraded host is the intended swarm body and CI/CD machine. Idunn owns source-change compilation, testing, release construction, deployment, and daemon survival there; its current deployment truth belongs to Idunn's typed deployment receipts.
• Idunn is active, provenance-exact, and independent at installed source 8b972715c47731f2418d0c423cb0dd2076940bd7. Exact Epiphany source d2ca6630 remains the current symlink target; Starfire remains outside the compilation path. Production Epiphany units are inactive after exact rollback and deployment.env is absent. Idunn has zero restarts.
• Exact 9b9b5c85 passed Idunn's native gate under receipt SHA-256 6c6a71359f8c31297419665d2872f6982a89f84e197d71fc5b36a7fc86216093 and remains sealed as release sha256-30a910785a380224bbdbd56a7b742c8d058fa70cb72dab3562e3907903e0d191. A foreign-target helper restarted Idunn during its candidate transaction; exact rollback prevented false admission but exposed the missing cross-target transaction mutex.
• OpenRouter stealth/ox-alpha credential readiness is proven inside Resident Self's mount namespace. The production organism remains braked. Ox decisions exist only in isolated failed capstone roots and do not authorize production state.
• Bifrost public crossing remains active on Yggdrasil and publishes typed readiness. Its current Idunn observation is diagnostic-only rather than a lifecycle-authenticated admission. Frozen private Ox12 must prove Persona effects and exact context without emitting public speech.
• Model Atlas code and isolated component proofs remain accepted. No live inter-swarm collaboration has yet run. Signed Gate 1 sight, brake freeze, autonomous cascade, partition exercise, and endurance remain open.
• GitHub's August 2026 service incidents were external provider downtime. They do not count as Epiphany source-identity or grant failures; successful lookup and denial-before-network remain separately required evidence.

Git/worktree caution

The shared worktree contains unrelated pre-existing modifications, including vendored Codex/CultMesh files and a dirty vendor/cultnet-rs submodule. Preserve them. Stage only intentional migration/documentation paths. Do not use reset or checkout to clean the tree.

Re-entry

Read, in order:

1. state/map.yaml
2. this handoff
3. notes/epiphany-current-algorithmic-map.md
4. notes/epiphany-fork-implementation-plan.md

Then run the shared-target epiphany-state.exe status. Persisted next action is orientation, not automatic authority to resume a live Gate.