A __Host- cookie is only removed by a Set-Cookie that is itself Secure. The
hardening test now checks Secure on every header, deletion included, and the
completion tests pin that success and refusal both clear the attempt cookie
with Secure, Path=/ and no Domain.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Session, OAuth correlation, antiforgery, voter and Heimdall attempt cookies all take the
__Host- prefix. The prefix forbids a narrower Path, so the voter (was /mill) and attempt
(was /auth/heimdall) cookies move to Path=/.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
REPORT.md E6 and results.md still held pre-fix numbers (half-cap 0.044/0.222, s max 0.953).
Regenerated with the current sim: s max 0.777; half-cap binding all four 0.000,
Patrons+Minds 0.008, Patrons alone 0.165. Weight is 0 only at amount <= unit/b (run.py,
REPORT.md, SPEC.md); the splitting table no longer prints a cliff "0 (below unit)". Test count 54.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Copies CultLib PR #9 (head 84f932ec) tests/vectors/stake_golden.csv unmodified and
checks log_weight and split_weight against all 26 rows. 25 match within rounding;
the one sub-unit row differs by design: the arm's cliff at unit is Libby's
min_amount_per_identity = unit, which the vectors do not set.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Docstrings state weight is per identity, not sybil-safe, hours unanalysed;
placeholder parameters marked in code; unit x roll sweep with interval;
identity-cost thresholds by bisection (about half the budget, not the
doubling-grid 51-82%); headline numbers pinned in a test; 'log bounds'
test renamed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Spec 5b (source: Golz et al. 2018 intro citing Behrens et al. 2014), copier
agents in estatesim.py, E3f alpha x cap x copy sweep with a computed
paired-interval verdict, 10 tests. Result: with copying the cap does not
reduce effective concentration. Earlier results.md sections unchanged.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
3-of-4 for ordinary rules, all four for a short named entrenched list,
reduction rule with floor/notice/delay, incentive-first framing, Minds
count once with dissent recorded, no notice no approval, freeze risk
stated beside the veto rules. Numbers remain placeholders.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
m.image/m.file/m.audio/m.video reached Personas as a bare filename and
dropped content.url. The delivery text now leads with
[kind filename mime size url], then the caption. Applies to the delivery
and to context lines. Wire v1 is unchanged. Nothing is fetched: a Persona
turn is a tool-less text call.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A send queued at the room gate passed the brake check at entry only, so a
brake placed while it waited still let the PUT through. The check now also
runs inside the gate, just before the PUT, and answers a typed Brake refusal.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Removes the bare PUT; the one PUT now lives inside the room gate. v1 stays served unchecked through the same gate.
Wire: chat_send_request.v2 (basis) and chat_send_receipt.v2 (newer); RoomMoved is v2 only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The per-room in-memory history map is gone: a restart emptied it and /sync resumed from the
cursor, so every room (a DM first) lost its past. When a delivery is built the mouth now reads
the room's timeline from the homeserver as that Persona (GET /messages dir=b, or the thread's
root plus /relations m.thread for a threaded message), keeps m.room.message from everyone
including her own, oldest first, ending before the delivered event. Newest lines are kept to a
16 KiB byte budget (each clipped to limits.contextBytes), at most the 20 lines the delivery
tuple carries. One fetch per room or thread per sync round. A failed fetch gives empty context
and a redacted log line; the delivery still goes out.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
SLUG is the Persona slug upper-cased with "." and "-" turned into "_". Lists are
deduplicated; an absent variable gives shared rooms only; a malformed project alias,
or two Personas mapping to one variable, is refused at start. The send path's
UnknownRoom check already reads the mouth's own list, so another Persona's project
room is refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two Persona turns running at once no longer take each other's session. Requests run in order per client, not across clients.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merges gamecult-chat/bifrost-oidc-backchannel-logout (83daabe..37c8fe1).
gamecult-chat:cut_report:cut-bifrost-oidc-backchannel-logout.h1/h2; Soul s1 and s2 hold. Not deployed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A pass that cannot read its subjects (a scope factory failing like a database outage) is logged
by exception type only and retried after the interval, never in a tight loop. The earlier loop
test reached this catch through a per-subject exception, which the isolation now absorbs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Caught per subject, logged at error with the subject id and exception type only, authorizations
left valid; cancellation still stops the pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The named logout HttpClient's primary handler disables auto-redirect, so a 3xx from MAS is a
non-delivery retried like any non-2xx instead of being followed to a final 2xx that revokes.
Pinned through the real DI registration against a real loopback listener answering 302, and
the registered client's Timeout is pinned to exactly 10 s. The unexpected-exception test is
replaced by the isolation test (its fix is the next commit) and the cancellation test stands alone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
