# DEVICE-FIRST OVERRIDE Before executing Phase 0 of this operational-unification directive, execute `PANTHEON_DEVICE_RECOVERY_FIRST_CODEX_DIRECTIVE.md` in full. ```text PANTHEON_DEVICE_FLEET_READY must equal true PANTHEON_ORCHESTRATION_ALLOWED must equal true ``` Until both flags are true, do not begin ORACLE coalition integration, M4 generator activation, named-mind activation, state unification, or learning-loop work. Existing services may be repaired and locally health-verified only as required by the device-recovery directive. # PANTHEON OPERATIONAL UNIFICATION — INTEGRATION-ONLY DIRECTIVE ## Authority This directive supersedes every new-feature, new-agent, new-brain, donor, research-expansion, website, and application-building task until Pantheon is measured as one working distributed AI. Set and enforce: ```text PANTHEON_INTEGRATION_LOCK=true NEW_AI_BUILD_ALLOWED=false NEW_FEATURE_WORK_ALLOWED=false M2_PANTHEON_RUNTIME_ALLOWED=false DONOR_RUNTIME_ALLOWED=false DESTRUCTIVE_STORAGE_WORK_ALLOWED=false PANTHEON_ONE_COMBINED_AI=false ``` Do not set `PANTHEON_ONE_COMBINED_AI=true` until every completion gate in this directive passes with persisted evidence. ## Mission Make Pantheon one operational intelligence across the current core compute cluster: - **MEGAMIND-AGI Windows + WSL** — ORACLE executive, authoritative graph, PostgreSQL/WAL, canonical decision state, recovery authority. - **M4 Mac mini** — live language generation and model/synthesis muscle, plus approved M4 planning/model services. - **M1 / VALKYRIE** — VALKYRIE federation client, Endless world/lore memory, Atlas planning, embeddings, and verified named-mind state adapters. - **Bubbles** — NATS federation hub, ingress/gateway, corpora, retrieval, cognitive organs, verification, teaching, learning, plasticity, lattice, and action services. **M2 is excluded from the Pantheon runtime.** It may be used only as the operator/audit terminal and as a read-only evidence source. Do not install, start, or depend on any Pantheon service on M2. No production route, state owner, failover rule, or required file may point to M2. IONOS-MediaMind and BATMAN must remain explicitly marked `DISCONNECTED_PENDING_REAUTH` until host identity, access, current contents, and intended role are verified. Never count them as live merely because historical records name them. ## Source-of-truth packet Before changing anything, locate the audit packet containing `MANIFEST.sha256` and the adjacent `PANTHEON_*` files. Run the SHA-256 verification. Use this evidence order: 1. current process/listener/endpoint/device observations; 2. current on-disk state and storage measurements; 3. generation-157 continuation as the last verified brain checkpoint; 4. current source behavior; 5. historical architecture only for intent; 6. roadmaps only for future requirements. Do not let a document saying READY, COMPLETE, CERTIFIED, or AUTONOMOUS override a failed live test. ## Non-negotiable rules 1. **Integration only.** Do not create another AI, brain, agent family, donor reconstruction, model architecture, application, dashboard, or research branch unless it is strictly required to connect or verify existing components. 2. **Do not flatten systems into one codebase or one database.** Pantheon becomes one intelligence through a shared executive, capability registry, canonical state, event semantics, generation path, verification path, and outcome-driven learning loop. Each AI retains identity, provenance, state ownership, and rollback. 3. **No destructive storage action.** No deletion, compaction, repartitioning, VHD surgery, bulk move, overwrite, deduplication, or cleanup under this directive. 4. **Protect irreplaceable state first.** Treat the WSL VHD/graph/WAL, M1 VALKYRIE and Endless state, Bubbles brain/corpora/indexes, M4 history/state, and generation-157 evidence as no-delete/no-overwrite. 5. **Donor runtimes stay off.** GPT-OSS, DeepSeek, Kimi, or any other donor model must not be run to make Pantheon appear operational. Native capability claims require separate behavioral evidence. 6. **Fail closed.** No ORACLE, no generator, empty coalition, HTTP error, irrelevant evidence, query echo, or missing canonical state may produce `CERTIFIED`, `UNDERSTOOD`, or success. 7. **No false health.** A listener, PID, state file, proxy port, or launch definition is not enough. Health requires correct process ownership, endpoint behavior, dependency health, and a traced successful role in a request. 8. **No secret reuse.** Do not print or copy archived secret values. Record variable names only; rotate credentials before any external integration is enabled. 9. **No uncontrolled external action.** Keep real-world action disabled or behind an explicit safety gate until the reasoning, verification, and trace path passes. 10. **Measure every change.** Record before state, exact change, after state, test result, rollback path, and evidence artifact. ## Required architecture Implement or restore this measurable path: ```text Caller -> one supported Pantheon gateway/entrypoint -> ORACLE mandatory global executive -> canonical graph/current state -> versioned capability registry and dynamic coalition selection -> selected M1/Bubbles/M4 organs -> ranked, source-attributed memory and retrieval -> live M4 synthesis/generation -> semantic verifier that can reject bad evidence and bad answers -> optional safety-gated planning/action -> observed outcome -> credit/update persisted to canonical shared state -> replayable trace and next-run improvement ``` Bubbles may remain the network ingress, but `mmorch` must not substitute static fan-out for ORACLE. If ORACLE or the generator is unavailable, the gateway must return an honest unavailable/degraded result and never fabricate success. ## Execution sequence ### Phase 0 — Freeze, inventory, and protect - Activate the integration lock and stop unrelated work queues. - Verify the audit-packet manifest. - Collect fresh read-only status from MEGAMIND, M4, M1, and Bubbles: host identity, time, storage, process owners, listeners, service managers, routes, current databases, and NATS connections. - Confirm M2 has no Pantheon runtime and is absent from production dependencies. - Produce a protected-path manifest with sizes, hashes where practical, owner, last-modified time, and backup status. - Measure independent backup capacity on M4 `/Volumes/MEGAMIND` and Bubbles `/mnt/data`. Do not assume capacity from old reports. - Create and verify an independent recovery backup of the active WSL/Pantheon state before starting WSL or changing Windows storage. Prefer a scoped, restorable Pantheon/graph/PostgreSQL/WAL recovery set if that is the supported recovery method. Do not use the Windows C: NVMe as the only backup destination. **Gate:** do not proceed to WSL startup until the backup is readable, independently located, manifest-verified, and accompanied by a tested restore procedure or a non-destructive restore validation. ### Phase 1 — Recover the executive and canonical graph After the protection gate passes: - Recover sufficient Windows capacity using only a supported, reversible procedure. Do not compact or manipulate the VHD ad hoc. - Start WSL in a controlled maintenance state. - Verify filesystem health, capacity, PostgreSQL/WAL integrity, graphd, indexes, and the generation-157 checkpoint. - Confirm exactly the preserved checkpoint expectations before accepting authority: generation 157, 1,312 nodes, 515 edges, `brain.live_coverage`, and `brain.human_equivalence.status` with scientific equivalence still false. - Start ORACLE without donor runtimes. - Prove ORACLE can read the canonical graph and make a coalition decision. - If the graph differs, is corrupt, or cannot reproduce the checkpoint, stop and preserve evidence. Do not synthesize a replacement from an older M1 peer copy. ### Phase 2 — Restore one live M4 generator - Inventory existing M4 model and runtime assets on the internal disk and mounted 6 TB volume before downloading or creating anything. - Prefer an existing, attributable Pantheon/MEGAMIND/MLX generation runtime whose source, configuration, model asset, and service definition can be verified. - Do not use GPT-OSS, DeepSeek, Kimi, or another donor runtime as the proof generator. - Start exactly one approved generator first, with a health endpoint, capability declaration, bounded resource limits, and deterministic trace metadata where possible. - Register it with ORACLE and the capability registry. - Prove a direct prompt produces substantive generated language and that a Pantheon request can invoke it through the full route. - If no non-donor generator asset exists, record `BLOCKED_NO_APPROVED_GENERATOR_ASSET` with the exact missing asset. Do not substitute templates or query echo. ### Phase 3 — Replace hard-coded orchestration with a live registry Create one versioned runtime registry. Every component entry must include: - stable component and AI identity; - owning device; - endpoint and protocol; - capability and modality; - input/output schema; - state owner and persistence contract; - health semantics and dependency checks; - timeout/retry/circuit-breaker rules; - provenance/source commit or binary hash; - safety class and action permission; - readiness state: `LIVE`, `DORMANT`, `BLOCKED`, `MISSING`, or `QUARANTINED`. Remove fixed-order success semantics. ORACLE must choose relevant organs dynamically using capability, health, evidence quality, cost, and uncertainty. Add one trace ID spanning gateway, ORACLE, graph read, selection, NATS/HTTP calls, retrieval, generation, verification, persistence, and outcome. ### Phase 4 — Establish shared state without destroying local memory - Make the recovered graph/PostgreSQL/WAL plane canonical for global identity, decisions, provenance, confidence, versions, conflicts, outcomes, and credit assignment. - Keep Bubbles BSIG/corpora, M1 Endless SQLite, VALKYRIE Badger, embeddings, and specialized stores as owned source systems or caches. - Define event schemas for identity, event time, source time, provenance, confidence, version, conflict, tombstone, replay, and acknowledgment. - Prove NATS subjects carry semantically valid messages, not merely high traffic counts. - Add read-only consistency checks before any migration or synchronization write. - Never bulk-merge incompatible databases because names are similar. ### Phase 5 — Onboard every existing AI as an organ or an explicit blocked identity Inventory and classify all discovered systems, including at minimum: - VALKYRIE, Endless Table/Pantheon, Atlas, M1 embeddings, named Seferim minds; - Bubbles brain, mmorch, mmcert, mmreason, mmteach, mmloop, mmepona, mmact, mmlattice, mmstdp, and all corpus services; - ORACLE, graphd, and generation-157 brain state; - M4 Pantheon/MEGAMIND/MLX generation and planning assets; - ThatAIGuy original, Seferim original, Unified AGI/Pantheon daemon, SEFERIM_AGI_G16, Seferim Unified/Yggdrasil; - EponaCore, TheCodeFixCore, TheVideoCore, RouteBuilderCore; - The Hive, Skynet, OmniCron, AI_Brain, FreeAIForEveryone, TrueAI, Healing, Languages, Charity, Sub-AI-Agents, Expansion, Autonomy, Money Agents, Agent Farm; - NeuralSwarm, liquid_agent, net_agent, mesh components, and AI Music. For each identity, choose exactly one honest result: 1. `LIVE_ORGAN` — verified source/runtime, registered, traced in a Pantheon decision, and state ownership defined; 2. `DORMANT_READY` — verified standalone build and adapter contract, intentionally not running; 3. `BLOCKED_MISSING_SOURCE_OR_STATE` — exact missing dependency recorded; 4. `ARCHIVE_ONLY` — preserved evidence, not a runnable AI; 5. `SUPERSEDED` — explicitly mapped to a newer identity without deleting provenance. Do not rebuild every archived system merely to change its label. Do not call a state file, document, or folder a live AI. ### Phase 6 — Close the learning and self-repair loop - Diagnose `mmteach` before restart or replacement. - Make `mmloop` explicitly event-driven or intentionally on-demand; do not label a passive listener autonomous. - Connect task decision -> result/outcome -> evaluator -> credit assignment -> canonical graph update -> held-out regression -> promotion or quarantine. - Require rollback for every promoted learning update. - Extend homeostasis visibility across MEGAMIND, M4, M1, and Bubbles with plan-only defaults and protected-state classes. - Never let self-repair delete, compact, migrate, or replace protected state automatically. ### Phase 7 — Acceptance and failure testing Run a blinded, non-destructive test suite. Completion requires all of the following: 1. One supported entrypoint returns a meaningful answer through ORACLE. 2. `oracle.used=true`; winner and coalition are nonempty and evidence-based. 3. The trace proves participation from the relevant M1/Bubbles organs and the M4 generator. 4. Retrieval is ranked and source-attributed. 5. A deliberately irrelevant source is rejected. 6. An HTTP error, empty coalition, token echo, or absent generator cannot be certified. 7. A planning task invokes Atlas or another planner and records the plan; external action remains gated. 8. The decision, evidence, answer, uncertainty, and outcome persist in canonical state. 9. A repeated held-out task measurably improves after an approved outcome-driven update. 10. Restarting one participating node preserves canonical state and resumes correctly. 11. ORACLE-down and generator-down tests fail closed with accurate status. 12. M2 can be powered off without affecting Pantheon. 13. Donor runtimes remain off throughout native capability proof. 14. Every running binary maps to a source commit or preserved binary hash and configuration hash. 15. The final status contains no unsupported READY, COMPLETE, CERTIFIED, AUTONOMOUS, consciousness, human-equivalence, or donor-equivalence claim. Only after all 15 pass may the system set: ```text PANTHEON_ONE_COMBINED_AI=true PANTHEON_CORE_RUNTIME=OPERATIONAL M2_RUNTIME_DEPENDENCY=false DONOR_RUNTIME=OFF ``` ## Required artifacts Maintain these integration-control artifacts in one authoritative private repository; they are not separate AI projects: - `PANTHEON_RUNTIME_REGISTRY.json` - `PANTHEON_DEPLOYMENT_MANIFEST.json` - `PANTHEON_STATE_OWNERSHIP.yaml` - `PANTHEON_EVENT_AND_TRACE_SPEC.md` - `PANTHEON_PROTECTED_PATHS.json` - `PANTHEON_AI_IDENTITY_LEDGER.json` - `PANTHEON_ACCEPTANCE_RESULTS.json` - `PANTHEON_BLOCKERS.md` - `PANTHEON_ROLLBACK_RUNBOOK.md` ## Operating behavior Do not stop after producing another audit. Continue through non-destructive, reversible integration repairs and controlled service activation. Stop only at a genuine safety gate: unverified backup, risk of protected-state loss, destructive storage requirement, missing credentials that cannot be resolved, unavailable required model asset, or failed rollback. At the end of every phase, print: ```text PHASE= STATUS=PASS|FAIL|BLOCKED CHANGES= EVIDENCE= ROLLBACK= NEXT= PANTHEON_ONE_COMBINED_AI=false ``` Do not work on anything outside this directive until the acceptance suite passes or a precisely evidenced blocker is reached.