Targets 55b74275 (#11 and #17 in main; #15 docs only). #11 signs everyone out
once. Lists the validator's required keys by name, NetworkTagSecret (32+
chars) as a hard startup failure, put into step 3. Rehearsal through
sudo -u postgres and one start on a separate env file, scratch connection
string, throwaway KeysPath and a port other than 5080; no dotnet ef. Backs up
the data-protection key ring. Uses the real log files with a baseline count.
Notes bifrost-watchdog-notice.timer.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Bifrost ships as a release directory switched by Idunn; nothing here pulls an
image, and the job would fail on every push to main.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A __Host- cookie is only removed by a Set-Cookie that is itself Secure. The
hardening test now checks Secure on every header, deletion included, and the
completion tests pin that success and refusal both clear the attempt cookie
with Secure, Path=/ and no Domain.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Preconditions, ordered steps, live check and rollback for moving live
67072b2 to main (141 commits, two additive EF migrations, new
Heimdall:AppSecret). Plan only; nothing deployed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- answerInvites takes a fresh brake read after the long-poll
- readUpTo reads the brake when each receipt would post; held brake drops it, one log line
- the brake read and offline presence PUT precede the full-backlog early return
- a throwing logger cannot reject the unawaited receipt call
- tests: fake keeps the raw path and honours abort signals; the braked-round carve-out is offline presence PUTs only
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
An ack posts her public m.read per room at the newest covered event, fire and
forget (never awaited, failure logged once, no retry). syncOnce reads the brake
once per round, passes it to answerInvites, sends set_presence on /sync and one
presence PUT on a released-to-braked transition (first braked round included).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The room directory's gid must equal the Persona directory's, else store-failed (a setgid
directory in the wrong group would still give files the wrong group). A missing Persona
directory is refused rather than created; only the room directory is made. The stat is
injectable so the group case is testable where the sandbox cannot chown.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A chmod by bifrost, which is not in the Persona's group, clears the setgid bit, so files
would take bifrost's group and the Persona's reader could not open them. Directories and
files are now created with exact modes (fixed umask around mkdir and open), the room
directory must have inherited setgid from the installer's Persona directory or the image
is refused (store-failed), and the Persona directory is never chmodded. Adds behavioural
redirect-refused and fetch-timeout tests.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
m.image events in delivered messages are fetched as the receiving Persona,
classified by magic bytes, bounded by size and header pixel count, and stored
under IMAGE_STORE_ROOT/<persona>/<room hash>/<bytes hash>[.ext] (0640, dirs
2750). The delivery tuple gains index 11, nil or [path, mime, size, sha256];
the pending kind becomes gamecult.persona.chat_pending.v2 with Huginn's v3
golden bytes. Refusals keep the typed text line plus a fixed-word reason.
The mouth test homeserver is answered in-process so the suite runs under a
capped address space.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Session, OAuth correlation, antiforgery, voter and Heimdall attempt cookies all take the
__Host- prefix. The prefix forbids a narrower Path, so the voter (was /mill) and attempt
(was /auth/heimdall) cookies move to Path=/.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
REPORT.md E6 and results.md still held pre-fix numbers (half-cap 0.044/0.222, s max 0.953).
Regenerated with the current sim: s max 0.777; half-cap binding all four 0.000,
Patrons+Minds 0.008, Patrons alone 0.165. Weight is 0 only at amount <= unit/b (run.py,
REPORT.md, SPEC.md); the splitting table no longer prints a cliff "0 (below unit)". Test count 54.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Copies CultLib PR #9 (head 84f932ec) tests/vectors/stake_golden.csv unmodified and
checks log_weight and split_weight against all 26 rows. 25 match within rounding;
the one sub-unit row differs by design: the arm's cliff at unit is Libby's
min_amount_per_identity = unit, which the vectors do not set.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Docstrings state weight is per identity, not sybil-safe, hours unanalysed;
placeholder parameters marked in code; unit x roll sweep with interval;
identity-cost thresholds by bisection (about half the budget, not the
doubling-grid 51-82%); headline numbers pinned in a test; 'log bounds'
test renamed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Spec 5b (source: Golz et al. 2018 intro citing Behrens et al. 2014), copier
agents in estatesim.py, E3f alpha x cap x copy sweep with a computed
paired-interval verdict, 10 tests. Result: with copying the cap does not
reduce effective concentration. Earlier results.md sections unchanged.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
