diff --git a/README.md b/README.md index ab1ad5f..d87082c 100644 --- a/README.md +++ b/README.md @@ -53,7 +53,7 @@ The durable local state is split on purpose: Postgres holds jobs, audit events, There is also a project-memory spine now for future Codex sessions: `state/map.yaml`, `state/scratch.md`, `state/evidence.jsonl`, `notes/fresh-workspace-handoff.md`, and the helper CLIs under `tools/`. The point is to rehydrate from canonical files instead of pretending the transcript will stay coherent forever. -VoidBot also publishes a current swarm Eve/CultUI surface through CultMesh as `cultmesh://voidbot.local/eve/providers/voidbot.swarm`, backed by `.voidbot/status/cultmesh/voidbot-swarm-state.cc`. The generated `swarm-dashboard.html` is a local debug lowering of that surface. +Yggdrasil `voidbot.service` publishes the current swarm Eve/CultUI surface through CultMesh as `cultmesh://voidbot.local/eve/providers/voidbot.swarm`, backed by `.voidbot/status/cultmesh/voidbot-swarm-state.cc`. Odin discovers it, Gjallar embeds it in `gjallar.overview`, and Hermodr/EveCanvas lower that aggregate for graphical clients. The generated `swarm-dashboard.html` is a local debug lowering only. The live service does not restore the lost Discord bot, worker, Persona scheduler, Postgres, Qdrant, or resident cognition body; `voidbot-retrieval.service` remains separate. ## Quick Start @@ -565,7 +565,7 @@ The watchdog task also uses `Interactive` logon because the remote freshness che ## Resident Void Organs -Void's moderation, person-shaped rumination, physiology, memory maintenance, and candidate delivery run as separately gated resident daemon organs on Yggdrasil. +Void's moderation, person-shaped rumination, physiology, memory maintenance, and candidate-delivery organs remain source capabilities, but they are not part of the current Yggdrasil `voidbot.service` publisher body. Tracked prompt surfaces: @@ -610,11 +610,11 @@ If one of the swarm agents should speak as itself through the shared Discord pip node scripts/send-discord-message.mjs --channel-id --persona-name "Ghostlight Archivist" --persona-avatar-url "https://example.com/avatar.png" ``` -Moderation heartbeat, person-shaped rumination, physiology, memory maintenance, and candidate delivery are resident daemon organs on Yggdrasil. They are configured independently and deployed only by pushing upstream for Idunn; do not install local scheduled-task copies. +The moderation heartbeat, person-shaped rumination, physiology, memory maintenance, and candidate-delivery organs are not currently deployed on Yggdrasil. Do not revive local scheduled-task copies or infer their lifecycle from the swarm publisher. Chronological Discord evidence is acquired by the daemon's bounded evidence source. Semantic retrieval remains available for deeper context, but it does not own the heartbeat clock or cursor. -Agent access to Discord history and indexed sources executes inside the archive owner. The resident Yggdrasil worker publishes a stateless streamable-HTTP MCP endpoint on loopback `127.0.0.1:17875/mcp`, backed by the worker's existing archive repositories and retrieval service. The canonical SSH tunnel maps that endpoint to Starfire loopback. `.codex/config.toml` starts one task-local stdio bridge that forwards each tool request over HTTP and converts a deployment/tunnel gap into a normal tool error instead of permanently closing Codex's transport. The bridge owns no retrieval state and starts no SSH, Docker, or remote process. Verify the failure path with `QDRANT_URL=http://127.0.0.1:16333 node scripts/smoke-voidbot-mcp-bridge-recovery.mjs`. +Agent access to recovered Discord history and indexed sources belongs to the separate read-only retrieval service. The source tree still contains the worker-side streamable-HTTP MCP design and its bridge smoke, but no resident VoidBot worker currently owns `127.0.0.1:17875/mcp` on Yggdrasil. There is also a repo-weather helper: ```bash diff --git a/notes/voidbot-current-system-map.md b/notes/voidbot-current-system-map.md index b1a52eb..4eb9c6c 100644 --- a/notes/voidbot-current-system-map.md +++ b/notes/voidbot-current-system-map.md @@ -6,9 +6,13 @@ Verse-facing service contract: `docs/architecture/voidbot-verse-service-contract ## Deployment Authority -VoidBot runs on Yggdrasil. Idunn owns deployment and consumes upstream repository pushes. The supported deployment path is therefore `upstream main -> Idunn release drift -> Yggdrasil`; a local checkout is a development and diagnostic body only. Future agents must not search for, create, or revive a local VoidBot deployment. Idunn compares `origin/main` with the root-owned `/srv/voidbot/deploy/deployment.env` witness, builds an audited immutable release when they differ, atomically switches `/srv/voidbot/app/current`, and accepts success only after the service set is running and `DEPLOYED_REVISION` matches upstream. +VoidBot's current Yggdrasil body is deliberately narrow. Idunn deploys upstream `main` into immutable releases under `/srv/voidbot/swarm/releases`, promotes `/srv/voidbot/swarm/current`, and verifies `/srv/voidbot/deploy/deployment.env`. `voidbot.service` runs only the typed `voidbot.swarm` Eve publisher on `127.0.0.1:17873`; its signed health is admitted as `voidbot.cultnet-rudp-stack-health`. `voidbot-retrieval.service` separately owns the bounded read-only recovery corpus. The lost Discord bot, worker, Persona scheduler, Postgres, Qdrant, and resident cognition state were not restored. -## Main Organs +The source-organ inventory below describes repository capabilities and the retired full-stack design. It is not a claim that those organs currently run on Yggdrasil. Restoring any of them requires a new recovery and authority map rather than expanding the swarm publisher by implication. + +The live graphical path is `voidbot.swarm` publisher -> Odin accepted state -> Gjallar `gjallar.overview` -> Hermodr lowering -> EveCanvas/browser. The Yggdrasil Hermodr body runs beside Odin; EVE currently reaches the Starfire LAN lowering. Both consume Odin/CultMesh and own no provider or aggregate truth. + +## Source Organs (Not Current Processes) - `apps/bot/src/discord-bot.ts` - Discord gateway shell: client bootstrap, provider wiring, event registration, and top-level orchestration. @@ -79,7 +83,7 @@ VoidBot runs on Yggdrasil. Idunn owns deployment and consumes upstream repositor - `packages/rag/src/source-document-archive.ts` - archived source/lore document manifest under `.voidbot/rag/source-documents.json` plus per-repo shards under `.voidbot/rag/source-documents.repos/`. -## Flow 1: Discord Request To Provider +## Retired Source Flow 1: Discord Request To Provider 1. `apps/bot/src/discord-bot.ts` receives a slash command or mention-driven request and delegates prompt/command work into `apps/bot/src/discord-bot-handlers.ts`. 2. Permission checks run through `packages/core/src/permission-engine.ts`. @@ -93,7 +97,7 @@ VoidBot runs on Yggdrasil. Idunn owns deployment and consumes upstream repositor - answers directly through `local_llm`, or - queues an owner job for the worker / `owner_codex` path. -## Flow 2: Owner Job Execution +## Retired Source Flow 2: Owner Job Execution 1. `apps/worker/src/index.ts` polls approved jobs from durable state. 2. The worker claims a job and dispatches it to the configured provider. @@ -102,7 +106,7 @@ VoidBot runs on Yggdrasil. Idunn owns deployment and consumes upstream repositor 4. If the answer fits the Discord-safe lane, the worker posts it back. 5. If the task needs deeper work, the worker writes a handoff bundle under `.voidbot/artifacts//` and posts the handoff response. -## Flow 3: Retrieval And Indexing +## Source Flow 3: Retrieval And Indexing 1. `packages/rag/src/message-archive.ts` and `packages/rag/src/source-document-archive.ts` keep the raw corpora. 2. Bot-directed prompts are tagged at ingest, kept in the raw Discord archive, and deliberately skipped when the history ingester builds semantic chunks so repeated summons stop poisoning normal retrieval. @@ -111,9 +115,9 @@ VoidBot runs on Yggdrasil. Idunn owns deployment and consumes upstream repositor 5. `scripts/reconcile-source-repos.ts` discovers local Git repos, refreshes push hooks, prunes stale repo shards, and indexes newly discovered repos. 6. `scripts/index-source-repos.ts` and `scripts/git-post-push-index.mjs` drive explicit or detached per-repo source/lore reindex work. 7. `apps/worker/src/mcp-server.ts` boots the MCP lane, while `mcp-server-resources.ts` and `mcp-server-tools.ts` expose retrieval to Codex and other sessions through `search_history`, `get_message_context`, `search_sources`, `get_source_context`, `get_exact_source_document`, and `list_indexed_repos`. Exact-document reads come from the canonical read-only source archive and return the complete archived content for consumer-owned hashing and receipts; they do not read a checkout or mutate the archive. -8. The resident worker starts `mcp-http-server.ts` beside its job loop and injects the same long-lived archive repositories, source ingester, and retrieval service used by the daemon. It publishes stateless streamable HTTP at Ygg loopback `127.0.0.1:17875/mcp`, mapped to Starfire by the canonical SSH tunnel. Codex connects to one task-local `serve-voidbot-mcp-bridge.mjs` process over stdio. That bridge owns only outer transport continuity: it creates a lightweight HTTP MCP client per tool request, converts daemon/tunnel unavailability into an ordinary tool error, and remains alive for later calls. It cannot read archives, Qdrant, repositories, or Void state itself and starts no SSH, Docker, or remote process. Qdrant stays loopback-private on Yggdrasil. The separate retained stdio server entrypoint exists only for bounded child-provider capability isolation inside the worker body. +8. The current Yggdrasil endpoint at `127.0.0.1:17875/mcp` belongs to the standalone read-only `voidbot-retrieval.service`, not a resident worker or job loop. It owns bounded recovery access to the retained archives and source corpus and has no bot, job, Persona, scheduler, or swarm-publication authority. The task-local `serve-voidbot-mcp-bridge.mjs` remains transport-only: it converts endpoint or tunnel unavailability into an ordinary tool error, cannot read archives or Void state itself, and starts no SSH, Docker, or remote process. -## Flow 4: Ops And Recovery +## Historical Flow 4: Ops And Recovery - `scripts/start-voidbot-stack.ps1` - stack bootstrap, health checks, fresh build, stale-process cleanup, source-repo reconcile, bot/worker restart, runtime status emission. @@ -165,17 +169,17 @@ VoidBot runs on Yggdrasil. Idunn owns deployment and consumes upstream repositor - `apps/persona-scheduler/src/persona-scheduler-runner.ts` owns one complete typed scheduler tick in-process. The resident `index.ts` serializes calls to that runner directly; it does not spawn a TypeScript script per pulse. Pause/disabled checks happen before registry, Discord, embedding, provider, or dispatch work. `persona-participant-dispatcher.ts` owns participant-spec projection plus repo-Persona/Void dispatch, while `persona-prompt-inspection.ts` owns the explicit prompt-inspection workflow. `scripts/run-repo-face-heartbeats.ts` is only a 31-line CLI adapter over the runner or inspection organ. - `apps/persona-scheduler/src/void-physiology-domain.ts` owns pure Void sleep and speaking-pressure projection. `void-physiology-organ.ts` loads typed Mind and applies only `update_sleep_cycle` / `update_speaking_pressure` operations. The resident coordinator serializes organs, so physiology does not infer activity from a filesystem lock. Typed speech receipts own `lastSpokeAt`; sleep-time short-term pressure becomes a maintenance intent and cannot directly launch a model or mutate memory. - `packages/core/src/bifrost-discord-command.ts` owns the typed Bifrost Discord command/receipt crossing for all VoidBot callers. Worker repo-Face speech and the resident `void-candidate-delivery-organ.ts` supply identity, target, reply, and content through that one port; neither owns CultMesh document definitions, command pumping, receipt polling, or transport completion policy. Candidate delivery marks typed state spoken only after a completed Bifrost receipt and is independently gated by `VOID_CANDIDATE_DELIVERY_ENABLED`. -- Resident person-shaped rumination is independently gated by `VOID_RUMINATION_DAEMON_ENABLED` and its own minimum five-minute cadence. A due pass reads one bounded chronological Discord window plus the dedicated rumination doctrine, server rules, and Void voice; `void-rumination-organ.ts` receipts the stable pressure fingerprint before its one model attempt. It cannot run merely because the one-minute Persona observation clock fired, and it remains disabled on Yggdrasil while the model credential is stale. +- The source design gates person-shaped rumination through `VOID_RUMINATION_DAEMON_ENABLED` and its own minimum five-minute cadence. A due pass reads one bounded chronological Discord window plus the dedicated rumination doctrine, server rules, and Void voice; `void-rumination-organ.ts` receipts the stable pressure fingerprint before its one model attempt. This organ is not deployed in the current Yggdrasil body. - `apps/persona-scheduler/src/bifrost-governance-source.ts` owns the remaining Bifrost governance digest subprocess contract. It supplies the CLI path, arguments, timeout, JSON parsing, and typed command/parse failure topics; Persona prompt composition receives a `BifrostGovernanceDigest` and cannot invoke Bifrost directly. - The scheduler state has one write authority. `initiative-engine.ts` commits participant reconciliation, operator controls, pause/disabled skips, stale-turn recovery witnesses, semantic pressure, pending-attention consumption, queue outcomes, and tick finalization. `run-repo-face-heartbeats.ts` contains no direct participant/state assignment or history append; its sources and actuators return facts to engine commits. - `apps/persona-scheduler/src/turn-actuator.ts` is the worker-queue output port. Given a completed prompt, output channel, evidence fields, provider, identity, timestamp, and narrow `createJob` capability, it builds the canonical worker actor/guild `ContextBundle`, creates one approved `repo-face-rumination` job, and returns `{created, activeJobId, requestMessageId}`. It cannot choose a Persona, mutate scheduler state, or compose prompt content. The orchestration shell no longer knows `ContextBuilder`, job approval defaults, worker command names, or `createJob` mechanics. - `apps/persona-scheduler/src/turn-routing.ts` owns channel selection and projection. It turns registered channel permissions, the configured default, and the newest pending-attention channel into one `PersonaChannelPlan` containing the primary output room, nearby snapshot rooms, normalized options, and low-threshold topics. It also owns the bounded channel-speed multiplier used by participant specs. Context readers and prompt renderers consume this plan without deciding routes. - `apps/persona-scheduler/src/control-source.ts` owns operator-control observation. It reads the pause witness with explicit absent/running and malformed/fail-closed semantics, loads the typed `voidbot.swarm_control_state` CultMesh document, validates heat bounds, and returns neutral facts. It cannot write scheduler state; engine commits own control application and skip witnesses. - `apps/persona-scheduler/src/repo-activity-source.ts` owns the home-repo activity subprocess boundary. It resolves the source repo and Face cursor, invokes `export-recent-repo-activity.mjs` with a bounded 96-hour/five-commit window and mandatory `--read-only`, and returns a typed observation. Prompt composition renders that observation and cannot invoke or parse the exporter. -- Idunn invokes the root-owned audited manifest at `/srv/odin/deploy-manifests/voidbot`; `/usr/local/sbin/deploy-voidbot` is a byte-identical inspection/recovery copy, not the live path. Both derive from `gamecult-ops/scripts/deploy-voidbot.sh`. The `idunn` user exclusively owns mutable Git state in `/srv/build/VoidBot` and `/srv/build/cultcache-ts`, including lazy partial-clone object fetches; the root actuator owns immutable artifact construction/promotion, systemd, and deployment witnesses without running Git as root. +- Idunn invokes the root-owned audited manifest at `/srv/odin/deploy-manifests/voidbot`; `/usr/local/sbin/deploy-voidbot` is a byte-identical inspection/recovery copy, not the live path. Both derive from `gamecult-ops/scripts/deploy-voidbot.sh`. The `idunn` user owns mutable Git state in `/srv/build/VoidBot`; the current publisher deployment archives the exact source commit without a package build. The root actuator owns immutable release promotion, systemd, and deployment witnesses without running Git as root. - The same scheduler derives semantic `responsePressure` for scheduler-eligible Personas by embedding canonical Face identity-card projections and recent human messages from channels each Face may enter. Pressure decays by message age, aggregates with noisy-OR, awakens at most three eligible Faces, and exposes its message-scoped cosine evidence. It produces bounded `dynamicHeat` for the next scheduled recovery calculation; an unseen message crossing the Persona's interrupt threshold may pull readiness to the current initiative clock exactly once. It cannot create a job, bypass rest or active-turn brakes, impersonate a direct mention, or write inferred desire into Persona state. - - The Windows omnibus and per-organ wrappers are deleted. `voidbot.service` deploys `persona-scheduler` beside bot, worker, Qdrant, and the CultMesh publisher. Heat changes Persona recovery only and cannot manufacture intent. - - The registry includes Nibu for `AetheriaLore`, with typed Face state and an Aquarium channel allow-list. Her Persona turns use the resident scheduler and normal worker queue; no local orchestrator exists. + - The Windows omnibus and per-organ wrappers are deleted. The retired full-stack body deployed `persona-scheduler` beside bot, worker, Qdrant, and the CultMesh publisher; current `voidbot.service` deploys only the publisher. + - The source registry includes Nibu for `AetheriaLore`, with typed Face state and an Aquarium channel allow-list. No current resident scheduler or worker executes her Persona turns. - The local ignored registry now also includes Epiphany for `EpiphanyAgent`, with Face state in `E:/Projects/EpiphanyAgent/.voidbot/state/epiphany.cc`, Discord role id `1506375937439301642`, and Aquarium channel allow-list `1501196543150264332`. Her repo-local `.voidbot` birth surface has completed in plan/review mode; the generated EpiphanyAgent startup packets still require Self review before accepted native birth mutations. Her jurisdiction is the self-improvement spine: typed state, CultCache/CultNet, Codex bridge boundaries, birth/init rites, low-copy runtime contracts, review gates, graph-shaped memory, heartbeat physiology, and deletion of duplicated authority. - `scripts/export-random-discord-history.mjs` - plain Node helper for novelty excursions that samples one random archived Discord seam, returns a local context window around the anchor message, and skips bot-directed prompt rows by default. @@ -253,7 +257,7 @@ Migration order: Huginn demotion line: VoidBot may carry repo Face `.cc` state paths, MCP diagnostics, and Discord compatibility registry data, but Persona/.cc inspection and portable Persona publication belong to Huginn. VoidBot must not let its private registry, static HTML, or legacy MCP state tools become the canonical Persona authority. -## Storage Boundaries +## Source Storage Boundaries (Not Current Runtime) - Postgres: - jobs @@ -278,7 +282,7 @@ Within the Postgres path, the implementation is split on purpose now too: - `state-storage-postgres-bootstrap.ts` handles schema/bootstrap/import work - per-domain modules own queue, audit, interaction-memory, and rate-limit behavior -## Flow 5: Resident Person-Shaped Rumination +## Retired Source Flow 5: Resident Person-Shaped Rumination 1. `apps/persona-scheduler/src/index.ts` owns an independent disabled-by-default rumination cadence; the Persona observation clock cannot authorize it. 2. A due pass acquires one bounded chronological Discord window and reads the dedicated doctrine, server rules, and Void voice surfaces. @@ -288,7 +292,7 @@ Within the Postgres path, the implementation is split on purpose now too: 6. Speech remains a queued candidate. `void-candidate-delivery-organ.ts` independently selects at most one targeted candidate, crosses the shared typed Bifrost port, and marks it spoken only after a complete receipt. 7. Yggdrasil keeps rumination inference disabled while the configured model credential is stale; this does not disable transport-only delivery of already-authorized candidates. -## Flow 6: Physiology Runtime +## Retired Source Flow 6: Physiology Runtime 1. The resident `apps/persona-scheduler` daemon invokes `void-physiology-organ.ts` on its own five-minute cadence, independent of whether Persona initiative is paused. 2. The organ reads typed documents from `.voidbot/private/void-self-state.cc` and derives the most recent speech time from typed receipts. Resident coordinator serialization is the mutual-exclusion boundary. @@ -296,7 +300,7 @@ Within the Postgres path, the implementation is split on purpose now too: 4. When a nap has short-term residue, physiology emits a typed memory-maintenance intent. It does not perform memory policy, launch PowerShell, or call a model. 5. The Windows omnibus mood writer has been removed. Legacy mood scripts may remain as fixtures or manual compatibility bodies, but they are not a deployed recurrence or runtime owner. -## Flow 7: Typed Memory Maintenance +## Retired Source Flow 7: Typed Memory Maintenance 1. `void-memory-maintenance-organ.ts` consumes a typed physiology intent containing the nap start and short-term pressure count. 2. It checks typed scheduled-run receipts, then records `void-memory-maintenance-attempt:` before inference. This makes one attempt per nap structurally enforceable even when inference fails or returns malformed output. diff --git a/notes/voidbot-daemon-organ-migration-map.md b/notes/voidbot-daemon-organ-migration-map.md index 2c1e7be..b11bf3f 100644 --- a/notes/voidbot-daemon-organ-migration-map.md +++ b/notes/voidbot-daemon-organ-migration-map.md @@ -1,6 +1,6 @@ # VoidBot Daemon Organ Migration Map -Observed 2026-07-16 after the Yggdrasil replacement. This map distinguishes live process ownership from old scheduled-task documentation. +Historical migration map observed 2026-07-16. Its resident full-stack target was lost with the retired Yggdrasil body; the current runtime is recorded below so this document cannot be mistaken for a startup inventory. ## Live Bodies @@ -9,10 +9,11 @@ Observed 2026-07-16 after the Yggdrasil replacement. This map distinguishes live - Starfire `Void Mood Drift`: disabled. - Starfire `VoidBot Operations Watchdog`: disabled. - Starfire `Bifrost Agent Dispatch`: disabled. -- Yggdrasil `voidbot.service`: active; Compose runs the resident Persona scheduler. -- Yggdrasil Bifrost web: active, but no Bifrost dispatch worker was found in the queried service/container set. +- Yggdrasil `voidbot.service`: active; Compose runs only the typed `voidbot.swarm` Eve publisher at `127.0.0.1:17873`. +- Yggdrasil `voidbot-retrieval.service`: active as a separate bounded read-only recovery service. +- Discord bot, worker, Persona scheduler, Postgres, Qdrant, and resident cognition organs: not restored. -The disabled tasks are not standby owners. The listed organs currently have no recurring pulse unless another independently supervised service is introduced. +The disabled tasks are not standby owners. The historical organ rows below describe the intended ownership model, not live process evidence. ## Authority Map @@ -52,4 +53,4 @@ The disabled tasks are not standby owners. The listed organs currently have no r The Windows omnibus, installer, and hidden launcher are deleted, and watchdog logic cannot recognize them as health owners. Remaining per-organ Starfire tasks are operational debris, not standby paths; remove any installed copies rather than restoring repository launchers. -As of deployed revision `9deebb3`, the listed Starfire task husks are unregistered, the promoted artifact contains none of the old Void runners, Persona state accepts only repo/native Persona turn kinds, and Yggdrasil runs one resident scheduler process. This migration map is satisfied; future work should add capabilities inside these ownership boundaries rather than recreating schedulers. +Revision `9deebb3` completed this historical source migration and removed the Starfire task husks. That deployment verdict is no longer current: the present Yggdrasil body runs no resident scheduler or cognition organs. Keep this map as an ownership contract for any explicitly authorized future recovery, not as proof that recovery already exists. diff --git a/state/map.yaml b/state/map.yaml index 8780325..524cf27 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -65,7 +65,7 @@ active_subgoals: - Treat `notes/agent-swarm-teardown-plan-2026-05-21.md` as the historical teardown authority and the restart checklist. The repo Face swarm is live again, but only because the scheduler, prompt, model-output logs, parent Interpreter, Bifrost routing, and worker side-effect rails now have explicit observable boundaries. Keep watching for prompt/parser/transport Jenga before adding new swarm features. - Make the new project-state surfaces the default continuity path for nontrivial VoidBot work. - Keep the rebuilt moderation/self-state foundation on canonical CultCache `.cc` typed operations, never an editable JSON working projection. - - The resident `apps/persona-scheduler` process inside `voidbot.service` owns repo Face and native Persona turn pulses on Yggdrasil. Its `initiative-engine.ts` owns participant reconciliation, operator heat/speed projection, semantic-pressure commits, wall-clock advancement, active-turn freeze/completion recovery, queue-result commits, stale rescheduling, mention priority, rest/idle eligibility, and ready-order selection as a pure state machine. `state-store.ts` is the sole persistence/migration port: canonical state is one typed `voidbot.persona_scheduler_state` record in `repo-face-heartbeats.cc`; the old JSON shape is accepted only as a one-time migration source and emitted afterward only as a debug/dashboard projection. Missing state is explicit, malformed CultCache fails closed, and the backing store promotes atomic MessagePack writes. Discord attention crosses through immutable per-mention `voidbot.persona_attention_command` CultCache inbox documents resolved from that same canonical path; the bot creates commands, while the scheduler alone ingests, deduplicates, commits, and acknowledges them after durable state. `active-turn-source.ts` reports only Persona job liveness and may fail stale queue claims; it has no Void lock or moderation authority. Persona initiative never registers or dispatches a built-in Void system participant. Void moderation, rumination, physiology, memory, and candidate delivery are independent resident organs. + - The source-level `apps/persona-scheduler` design assigns repo Face and native Persona turn pulses to one scheduler process. Its `initiative-engine.ts` owns participant reconciliation, operator heat/speed projection, semantic-pressure commits, wall-clock advancement, active-turn freeze/completion recovery, queue-result commits, stale rescheduling, mention priority, rest/idle eligibility, and ready-order selection as a pure state machine. `state-store.ts` is the sole persistence/migration port: canonical state is one typed `voidbot.persona_scheduler_state` record in `repo-face-heartbeats.cc`; the old JSON shape is accepted only as a one-time migration source and emitted afterward only as a debug/dashboard projection. Missing state is explicit, malformed CultCache fails closed, and the backing store promotes atomic MessagePack writes. Discord attention crosses through immutable per-mention `voidbot.persona_attention_command` CultCache inbox documents resolved from that same canonical path; the bot creates commands, while the scheduler alone ingests, deduplicates, commits, and acknowledges them after durable state. `active-turn-source.ts` reports only Persona job liveness and may fail stale queue claims; it has no Void lock or moderation authority. Persona initiative never registers or dispatches a built-in Void system participant. No current Yggdrasil process runs this scheduler or the independent moderation, rumination, physiology, memory, and candidate-delivery organs. - `persona-state-packet-projector.ts` owns pure assembly of typed memory sections, social context, topic attraction, curiosity facts, pressure sections, and human-clarity pressure into the deterministic Persona state packet. The orchestration shell supplies observations and one explicit observation time. It cannot rewrite projected language: the old regex vocabulary cleaner and its dead narrative helpers were deleted rather than moved. - `persona-text-projection-actuator.ts` owns Codex process execution for optional model-backed Persona memory projection: ordered model fallback, read-only arguments, timeout, stdout/stderr capture, final-message decoding, retry classification, and model-output telemetry. It receives a complete prompt and returns text; it cannot acquire Persona/Discord state, select initiative, or queue work. Capacity/tool-availability failures may try the next configured model; prompt/contract failures do not. - `persona-turn-assembler.ts` is the single final-composition owner for queued and inspection Persona turns. It combines supplied observations through conversation projection and turn-prompt policy, derives jurisdiction cadence, and returns one prompt plus one bounded deduplicated image bundle. It cannot acquire source state, select initiative, or queue work; the shell and actuator cannot maintain parallel prompt opinions. @@ -224,19 +224,20 @@ accepted_design: - The `voidbot.swarm` CultMesh store at `.voidbot/status/cultmesh/voidbot-swarm-state.cc` is derived provider state. If duplicate global documents corrupt it, archive the bad store and regenerate from `scripts/render-voidbot-swarm-dashboard.mjs`; do not treat the broken generated store as canonical truth. - Eve v2 live state has one owner path. CultLib dev supplies typed live-publication handles, authenticated retained provider sessions, reconnect evidence, and application receipts (`ebd8c78c`, `d4934233`, `8965f3c0`). Eve resolves component `stateBindings` and owns subscription teardown/rebind without receipt DOM writes (`85b0139`, `522df00`). Hermodr ingests provider sessions and emits ordered snapshot/update/stale/reconnected events without polling (`5cb819e`, `561e320`). VoidBot publishes accepted heat as typed control state and binds both visible heat components to it (`060da23`, `3d86b93`). Live-fire proved initial, provider-driven, and browser-command updates converge through that one path. - `voidbot.swarm_operator_view.v1` is the live authority for swarm summary, queue, selected Face detail/channels, operations, pressure, pending mentions, recent events, and route state. Eve binds those values as text/list props; the composition renderer no longer computes those browser-visible facts from its generation snapshot. The static HTML artifact may still lower a snapshot for debugging, but it cannot own live browser state. - - The production Eve browser nerve is Starfire Chrome -> `http://10.77.0.1:8798` -> Hermodr on Yggdrasil -> Odin discovery and provider-owned VoidBot RUDP on Yggdrasil. Hermodr's browser listener is WireGuard-only, its authenticated retained-publication ingress is host-loopback `127.0.0.1:17874`, and VoidBot remains the state/command owner at `127.0.0.1:17873`. Starfire owns no Hermodr, Odin, or VoidBot deployment body. - - The resident Yggdrasil worker owns the streamable-HTTP MCP organ at loopback `127.0.0.1:17875/mcp` and injects its existing archive repositories, vector stores, and retrieval service into the MCP context. The canonical Yggdrasil SSH tunnel maps the same port to Starfire. Codex attaches to one task-local stdio bridge whose only authority is transport continuity: each tool request uses a fresh lightweight HTTP client to the resident daemon, daemon/tunnel outages become tool errors, and the outer Codex transport remains usable afterward. The bridge starts no SSH, Docker, or remote process and owns no retrieval state. `scripts/smoke-voidbot-mcp-bridge-recovery.mjs` proves success, outage-as-tool-error, and recovery on one unchanged outer client. + - The production Eve nerve is provider-owned VoidBot RUDP on Yggdrasil -> Odin discovery -> Gjallar aggregate -> Hermodr lowering -> EveCanvas/browser. Yggdrasil Hermodr binds `10.77.0.1:8798`; the iPad currently reaches a local Starfire Hermodr lowering at `http://192.168.178.146:8798`. Both Hermodr bodies read Odin/CultMesh and own no provider or aggregate truth. VoidBot remains the state/command owner at `127.0.0.1:17873` on Yggdrasil. + - The separate read-only `voidbot-retrieval.service` owns the recovered archive/source retrieval endpoint at loopback `127.0.0.1:17875`; no resident VoidBot worker is running there. The source tree retains the task-local stdio bridge and its recovery smoke as transport design, but the bridge starts no SSH, Docker, or remote process and owns no retrieval state. - Long-running work should expose durable logs or status files instead of relying on one attached session and hope. - Persistent project memory must stay ruthlessly distilled; git history and artifacts carry routine proof. -landed_baseline: +historical_source_baseline: + runtime_scope: These capabilities landed in source or belonged to the retired full-stack body. They are not evidence of the current Yggdrasil runtime; current_status is authoritative. phases: - - Discord bot, worker, provider registry, and retrieval stack are live. - - Postgres-backed jobs, audit events, interaction memory, and rate-limit state are live. - - Qdrant-backed history and source retrieval are live. - - Local and offsite backups, watchdogs, and the operations dashboard are live. - - The stack now has a dedicated logon startup task path so bot and worker can come back after a reboot without waiting for manual resurrection. - - Interaction memory and behavioral profiling are live. + - Discord bot, worker, provider registry, and retrieval stack landed in the retired full-stack body. + - Postgres-backed jobs, audit events, interaction memory, and rate-limit state landed in source and historical runtime. + - Qdrant-backed history and source retrieval landed in source and historical runtime. + - Local and offsite backups, watchdogs, and the operations dashboard describe historical operations. + - The retired stack had a dedicated logon startup task path; it is not a current recovery mechanism. + - Interaction memory and behavioral profiling remain source capabilities, not live-runtime evidence. - Tool-driven retrieval is live, and source-grounding hints now bias the reply lanes instead of hard-gating them with a lexical pre-classifier. - The operations watchdog can now load ignored local extension checks, so adjacent-service fire signals can piggyback on the owner DM path without turning the public repo into cross-project gossip. - The owner Codex lane is now split into orchestration, runtime/parsing, shared helpers, and rendering modules instead of one swollen provider file. @@ -252,7 +253,7 @@ landed_baseline: - State storage is now split into a thin factory plus per-domain Postgres/file store modules and bootstrap/migration helpers instead of one persistence omnibus. - Source archive storage is now sharded by repo behind a manifest plus per-repo shard directory instead of one giant `source-documents.json` blob. - Source repo indexing now reconciles automatically during stack startup and watchdog runs, refreshing hooks, indexing newly discovered repos, and pruning stale repo shards when repos disappear from `SOURCE_REPO_ROOT`. - - Typed moderation heartbeat/enforcement, person-shaped rumination, physiology, memory maintenance, and candidate delivery are resident Yggdrasil daemon organs with independent gates and cadences. The Local Orchestrator no longer owns any of them. + - Typed moderation heartbeat/enforcement, person-shaped rumination, physiology, memory maintenance, and candidate delivery were designed as resident Yggdrasil daemon organs with independent gates and cadences. None is present in the current publisher-only body. - The active self-state service no longer registers, reads, or writes the legacy moderation document during routine operations. - The old memory-organ cleanup/vector-incubation/agency stack, legacy state template, legacy moderation context exporter, legacy moderation-state store, and JSON projection paths are deleted or offline; replacements must be typed-operation native. - Resident memory maintenance has a typed organ boundary: physiology emits a nap intent; the organ projects bounded context, pre-receipts one attempt, performs one tool-free model call, validates the full operation array, applies it through the typed state service, and verifies no short-term residue remains. @@ -291,5 +292,5 @@ rejected_paths: reason: sleep/distillation that collapses concrete claims into generic abstraction creates memory nonsense and then forces later cleanup compensators current_status: - summary: VoidBot's resident Yggdrasil daemon owns Persona initiative, physiology, nap-deduped memory maintenance, moderation heartbeat/enforcement, and bounded person-shaped rumination as separate organs. The swarm is paused, moderation and rumination model cadences remain cold while the MiMo credential is stale, and semantic pressure can authorize at most one committed turn per evidence item. Worker Face speech and Void candidate delivery now share one typed Bifrost CultMesh Discord command/receipt port; candidate delivery remains a separate parent-owned organ and never lets the rumination model touch transport. - next_action: The daemon-organ migration is complete. Keep the Persona swarm paused and moderation/rumination inference disabled until a valid model credential is installed. The next operational pass is a bounded credential smoke followed by one controlled log-only moderation window and one explicitly reviewed rumination window; it is not another ownership migration. + summary: Yggdrasil `voidbot.service` currently owns only the typed `voidbot.swarm` Eve publisher at `127.0.0.1:17873`. Idunn deployed revision `a4a5bd9a3ce781876e5563817d8b8db178cd289d`, accepts its signed `voidbot.cultnet-rudp-stack-health` as authenticated, and Gjallar composes the provider into `gjallar.overview`. The lost Discord bot, worker, Persona scheduler, Postgres, Qdrant, and resident cognition body were not restored. `voidbot-retrieval.service` remains a separate read-only recovery service. + next_action: Treat the live swarm surface as a retained operational projection of the surviving typed state, not proof that the full cognition stack is running. Any future restoration of bot, worker, scheduler, databases, or model inference requires a fresh authority and recovery map; do not grow `voidbot.service` around stale full-stack claims.