Each top-level section and each subsection down to depth 3 of the vendored vectors is classified: replayed by a named
test (which must exist) or not judged, with the owner of the rule named (CultLib validators, Huginn's door). A re-pin that
adds or drops a section fails until classified. Also replays transport.listInvalid on the wire: the door refuses a
negative count and passes the rules it does not hold.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
DeskResponse declares Answered { answer, counted_answer_id, as_of: u64 }, Forks { list, as_of: u64 } and
Fork { entry, as_of: u64 } (desk_wire.rs at b299d6f7; the golden replies carry exactly those keys). The door now
requires as_of as an unsigned integer and refuses any other key, like every other contract map. First red: the six
wrapper tests (missing, nil, negative, text, bool, array, object as_of; extra keys).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
JsonRequired on DeskAnswerDocument.Answerer and ForkRecord.AnswererCount was a second owner of what Closed already
decides at the boundary; nothing the typed vector replays needed is lost (they now go through the door). Every key of
the list, entry, record and answer documents, taken from a real CultLib entry, is removed and nulled: a missing key, or a
nil where the contract has none, is a door failure. First red: the test that the typed records declare no required keys.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Pins bin in note, answerer, next_cursor, a card position (value, nil position, key name) and a record id, and 0xff 0xfe
as text in the same places, through list, read and answer. The door already refuses both (Walk's default branch throws
on Binary; the strict UTF-8 decoder throws on bad bytes), so no source changes: the mutants (Binary written as null;
StrictUtf8 = new(false,false)) go red.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
List pages (listScenarios and listShortPages), valid entries, scenario records, valid cards, valid stored answers
(withheld Revision and Retraction included), the entry and deskAnswer negatives and the resultsInvalid vectors are
served from responseHex / messagePackHex on a socket double and compared with the vector message as JSON text (keys,
key order, integers). The list pages also go through the HTTP edge for a decider and a non-decider. The typed
Deserialize replays and the FakeDeskDoor list replays they supersede are removed. Recorded in comments: what the door
judges (closed typed maps) and what it does not (the contract's rules).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Pins name the commits, the exact file list and each sha256; the verifier is proved to fail on a changed byte, an
extra file and a missing file, at both directory levels. The four golden request frames still reproduce. The
synthetic card-viewers and proposed non-decider fragments are gone: both reader views are now CultLib's own entry
bytes served through the door. Huginn's record-whole still has no answerer_count (its README says so), so the
fault test stays true and is re-pointed at it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
MessagePack is walked into JSON by the reader, so every control character is escaped and keys, order and
integers survive. Every contract map (list, entry, record, answer, refusal) is closed and typed; list.mind must
equal the call's Mind; a key written twice anywhere, a float, a binary, trailing bytes, or non-canonical base64
is a DeskDoorException, as is every malformed variant (null elements, non-map values).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Vectors re-vendored byte for byte (sha256 13afdcba...); ForkRecord gains
answerer_count, DeskAnswerDocument.Answerer is nullable, both required keys
(a missing one is a door fault, never an invented 0 or nil). The card stays opaque.
Huginn fixtures at 79d954c with UUID deciders, synthetic/proposed view fragments.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
One connection per call, one request frame, one reply frame, 1 s deadline,
65536-byte bound each way. Request frames reproduce Huginn's golden bytes;
replies are decoded by key and every failure is one DeskDoorException (503).
Adds the MessagePack package for the wire codec.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
CultLib is still changing gamecult.fork.card.v0 (raised_at). Bifrost reads and
edits nothing in it, so it passes through with every key, number and key order.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A Persona's Mind shell holds no Matrix token, so the mouth now keeps one named image for her: it reads her live membership and the room's full state, takes content.url from the fetched event only, checks info.sha256 against the hash it computed, stores the bytes in her image store and posts the inert org.gamecult.file_received receipt as her own user. Behind CHAT_FETCH (exactly 1), off by default; an off mouth answers the kind as UnknownKind. Not deployed by this merge.
Shipper: Eureka. Reviewed by Heimdall against cut-mouth-fetch-attachment.r7 (bundle 3a6b45d, then delta d4bccd4: one log line per fetch with a fixed cause=, event-id percent-encoding pinned, doc-only change to docs/bridge.md).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
