[EPIC] Persona, typed evidence, governed experience and ContextManifest #4

Parent roadmap: #2 · 设计修订 4：https://github.com/jamespud/MAGI-system/blob/6fb34f052c33386bffd0e123ab5b36556a4c5415/docs/magi-final-personality-acceptance.md · 静态核对代码基线：98c69a14b274bc1d74561b01bd4de2f1e81f4c33

目标与设计追溯

适用章节：§5–8、§17–19。主要不变量：PER-01..03、MEM-01..04、EVID-01..02。本 Epic 组织阶段性实现与测试，不直接等同最终验收通过；具体任务须由 Implementation 模板 单独拆解并说明非目标。

已知实现差异（历史静态核对；现状见末尾对账）

Casper 目前偏创新机会评分，与正式 PersonaSpec 的已认证利益相关者目标/自治/退出权不同；ReliabilityScore 混合可信度，没有四类断言与验证资格；同源引用会重复加分。FreezeManifest 只冻结执行参数，没有各角色经验快照、实际 read-set 或上下文撤销代次；RAG 删除不通知在途任务；AutoApply 回归结果守卫存在缺陷。

交付切片（进入 Ready 前各自拆为可单独验证的子 Issue）

1. 实现 Melchior、Balthasar、Casper 三份正式 PersonaSpec 1.0 与结构化最低调查/弃权/纠错输出；预算含总量边界；Casper 不擅自发明用户同意。
2. 事实、预测、用户偏好、外部权限四类断言分别验证；来源真实不等于 VERIFIED；独立验证者、同源去重、反证、期限和域限制具有权威状态。
3. 每轮固定 ContextManifest：共享事实/偏好与各人格 PersonaSpec/ExperienceSnapshot、allowed contexts、实际 read-set、source dependencies 和 revocation epoch。
4. 构建撤销反向依赖、缓存/压缩摘要/在途票据/动作失效；新经验发布不热替换有效旧快照；自动经验发布按参考域保持关闭。
5. 治理经验的事件、条件、预测、实际结果、冲突分区、版本兼容和人工校准；禁止以模型自评替代经验验证。

阶段退出所需证据

• 每人格最低调查、故意同票但独立审查、预算用尽后真实弃权，PersonaSpec 替换与兼容边界。
• 同源重复材料、自证、过期/冲突事实无法升为 VERIFIED；无工具时不得不受控降低决定性证据标准。
• 中途撤销与终票/最终外发竞争；RAG 删除、历史压缩和恢复任务不能继续引用失效材料；新经验仅影响新任务。
• 每个交付切片标注规范条款/不变量、代码基线、依赖、可运行的正反例和 RED→GREEN/模型检查/故障注入证据。
• 更新 README/API/迁移、观测和能力边界（如适用）；保留未覆盖项，不把模拟通过误报成完整最终验收。

依赖、范围及新发现分流

主要依赖：与 DecisionCharter、票据摘要先行锁定接口；与授权/出口共同定义每次 FINAL CHECK 的上下文有效性验证。

明确非目标：本 Epic 不批准更改最终规范，不承诺特定生产环境的写操作，不在接口契约未明确时要求一次性大 PR 重写所有子系统。

待拆解事项（在当前阶段准备实施前补充）

• 复核最新 main 与当前未合并 PR，移除已修复或过时的旧基线差异。
• 标出交付切片的真实阻塞依赖、可并行范围及迁移顺序。
• 对实施中新增、非阻塞的问题记录不变量/证据/原因；仅在排期和 DoD 明确后新建 Issue。

管理限制：同一不变量的新反例先补当前 Issue；独立阻塞 Bug 拆分并建立阻塞关系；需要降低或修改规范时先走 Design Change。父级路线图的 WIP 上限适用于本 Epic 所有在制任务。

首批已创建的对应 Bug

• #12 — 属于本工作包，独立执行并附具名 RED→GREEN 测试。

以上复选框仅表示 Bug 修复和证据完成，创建 Issue 本身不构成通过。

2026-10-23 · Implementation progress reconciliation (main 37ec45997a62e4e2829f69e7384ed6f1a6c4447e)

已交付（离线能力，不是人格行为）： PR #34 C1-A DomainProfile/PersonaSpec/ContextManifest 结构契约；#35 ReadSet 类型 rset_ 注册（尚无完整 Snapshot 语义）；#36 DomainProfile 严格解析/语义/身份/回读；#37 MELCHIOR/BALTHASAR/CASPER 三份 v1.0 固定机器基线、领域引用、预算交集、身份/回读与跨语言 Golden。#12 的既有 AutoApply 回归缺陷已修复关闭。
历史差异更正： 文首 Casper、FreezeManifest 和 AutoApply 描述是原始代码诊断；当前已有 PersonaSpec 的离线规范校验，但这没有替换/证明真实 Agent 人格行为，也没有为旧 FreezeManifest 自动补齐 ContextManifest。
未完成： typed evidence 资格与来源独立验证、ContextManifest 运行时冻结、ReadSetJournal/依赖闭包/撤销、经验治理与外部发布、PER-01..03/§17.5 真实行为测试。有效 PersonaSpec Behavior=NOT_RUN、资格 UNVERIFIABLE_REFERENCE。
依赖： 先完成 #3 Decision Artifact v2 精确字段绑定，再开展 C1-C ContextManifest 离线实现；可信注入/关闭仍受 #5/#6 权威顺序阻塞。保持 Open。

2026-10-24 · PR #39 merged and C1-C1 scoped

• Cross-Epic dependency unblocked at contract level: PR #39 completed #38 Decision Artifact v2 explicit Charter/Domain, Candidate/Manifest and final-shared receipt, ReadSet/Closure and Ballot bindings. Merged main=f0277e15c356b426ee25be995d9f49c929534ec8; static Go/Python identity/negative evidence exists, not runtime qualification.
• Next independently scoped issue: #40 — C1-C1 ContextManifest v1 offline semantic validation is PLANNED / Open, not Ready or merged. Reuse the frozen v1 Schema, three fixed role views, exact descriptor closure, C0 ctxm_ identity and Domain/Persona validators; check v2 schema's ContextManifest v1 mirror against input-artifacts schema. Report missing authentic Charter/Persona governance and source qualifications explicitly, fail closed when required.
• C1-C2 separate and blocked: true read-set Journal/controlled injection, three verified provider delivery receipts, CandidateConfirmation, EVIDENCE_CLOSED atomic closure, revocation propagation and seal are not delivered by docs(decision): draft Decision Artifact v2 contract #39 or [IMPL] C1-C1 — Validate ContextManifest v1 semantics and immutable offline identity #40; authoritative integration needs reviewed C2/C3 common-order interfaces. No PER behavior or source-authenticity claim. Keep Epic [EPIC] Persona, typed evidence, governed experience and ContextManifest #4 Open.

2026-10-24 · PR #41 merged; #40 completed; C1-C2A #42 scoped

• #40 · C1-C1 ContextManifest v1 OFFLINE semantic validation COMPLETED by merged PR #41; main 737ee9381ec0fdc57d26e605d557a844bdefd3d1, final PR Head a95289e99958d5a631f162aaaefd41c9bd88864c, CI #40055630479 6/6. Three exact role views and snapshot descriptor closure, correct Persona partial-domain state propagation (F41-02), usage-after-freeze rule (F41-01), canonical ctxm_, supplied raw-byte digests, Envelope + independent resource limits, 2 Python/Go full-body Golden, 14-definition/schema mirror guard and named negative tests. 127 Context PASS events + 2 explicit offline boundary skips. Offline only; no real read or permission/authority qualification.
• #42 · C1-C2A ReadSetSnapshot v2 offline semantic validator PLANNED/Open. New independent issue; no implementation PR or acceptance evidence. Enforce rset_ full-body canonical identity, ReadEvent continuous prefixes, dependency DAG/SourceNode closure, accurate post-cutoff rereads, Manifest/role/candidate/receipt/closure references as untrusted declarations, independent Golden and fail-closed NOT_RUN/qualification.
• Still blocked: C1-C2B trusted controlled session/append-only Journal, genuine read exposure and source qualification, three provider final shared receipts, one EVIDENCE_CLOSED/MySQL conditional commit, online context revocation, C2/C3 common sequence, Persona §17.5 behavior. Generation fencing [BUG] Fence cross-attempt artifact cleanup and stale writers with durable execution generation #17 does not supply context/authority epoch validity.
• The original implementation gaps on this Epic remain. Do not mark complete; CAS-9 still In Progress.

2026-10-24 · Joint Stage #43 activated as tracked execution programme

Joint tracked workstream A: reuse existing #42 C1-C2A (ReadSetSnapshot offline v2 validator), followed by separately reviewable #44 C1-C2B durable append-only Journal/controlled material admission and provider unknown-result reconciliation. The joint integrator #49 requires A + C2/C3 real trust/ordering interfaces and tests; the shared coordination plan is #43. Workstream B independently begins contract #45. Max two active Implementation/Bug PRs; launch #42/#45 first. No actual model reads, provider delivery, completeness, authorized closure, Context revocation or Persona behavior is certified by planning; original Epic obligations remain Open.

2026-10-24 · Stage #43 first-wave #51/#50 merged; #42/#45 complete

• #42 C1-C2A ReadSetSnapshot v2 offline semantic consumer CLOSED within offline DoD after PR #50 merged (c2c56912). Full-body rset_ Golden, role/Manifest/candidate/receipt/closure declaration binding, source graph/ancestor/cutoff, expiry and body/Envelope. F50-01 shared package expiry defect fixed with source-validity equality + half-open event injection.
• Paired dependency #45/PR #51 has been merged, freezing C2/C3 typed interface only.
• #44 C1-C2B real Journal/controlled admission NEXT ELIGIBLE / NOT STARTED on current main=c2c56912; real provider exposure, independent reconciliation and authoritative admission remain blocked until their genuine implementations/qualification and C2/C3 live ordering exist. Stage [STAGE] C1-C2 / C2 / C3 joint implementation — two workstreams and gated Evidence Closure #43 and Epic [EPIC] Persona, typed evidence, governed experience and ContextManifest #4 remain Open. Do not claim a synthetic delivery/COMMITTED proves actual reading.

2026-10-24 · Stage #43 second wave #52/#53 merged; gated slices only

#44 partially implemented but still Open: PR #53 merged under Stage #43 at 1585ae11ae66fbc32600e3aa12c13260eac2bd4c. New S31 MySQL ReadSetJournalRepository.Register durable pre-exposure event/delivery registration, positive Generation fencing, DB-time lease/source freshness revalidation (F53-01), continuous prefix, bounded closed acyclic source DAG and reverse edges, same-ID same-body idempotency/conflict, persisted UNKNOWN/transition lineage. Real dedicated MySQL race/fault tests and Head CI #40100073962 6/6.
Still missing: Provider verified APPLY, independent actual reads/completeness, trusted C2 resolver and C3 common-order JOURNAL_ADMIT, fully controlled injection, closure/high-watermarks/revocation, three-party receipts and EVIDENCE_CLOSED. Capability OFF; never treat durable registration as observed exposure or unknown replay as authorization. #44 stays Open, #49 BLOCKED.