Per thing2:ruling:eve-dashboards-quarantined. Removes eveSurfaces from the provider advertisement and its schema, the two surface URIs, the eve.gui/eve.tui publish capabilities, and Eve wording in docs.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Directory.Build.props names CultLibRoot (CULTLIB_ROOT, else the sibling checkout) and pins CultLibRevision to cultlib-unity-v2.0.0 (42dce361). Directory.Build.targets fails the build unless that checkout is at the pin and clean, as Aetheria's guard does. Project references use CultLibRoot.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Eyes pass 2026-10-10: tools, limits and security posture of the official
Blender Lab MCP, the community BlenderMCP and Blender Agent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The editor service is the one command owner, the sink is off by default,
command ids are single-use, and stale intents expire on enable in one
conditional cache commit. Soul pass 4 verdict: merge. Recorded follow-up:
TryCommitEnableAsync does not retry when a concurrent PutAsync leaves
staged writes; unreachable on Unity's main thread and fails safe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The enable commit is conditional (ExpectUnchanged) and lives in the new
Runtime BrokkrCommandStore, with the pull-recompute-retry loop in
BrokkrCommandDrain.EnableAsync, so the tests exercise the shipped code. An
intent landing between the pull and the commit is expired, not run; eight
refusals in a row fail the enable loudly with the sink off. The probe is now
a thin fault-injecting wrapper over the real store, not a copy of it.
- Every editor write to the command lane is one cache commit; durable shard
logs are off (no server, no reader).
- No receipt is pruned before ten minutes, whatever the count, and the CLI
refuses a wait over five minutes. Fixed the comments that claimed otherwise.
- Pending and Prunable count a document only under the key its own id names.
- README and snapshot comment: the token stops stale EditorPrefs, it does not
authenticate writers; a restored or sync-conflict copy of the editor's own
store can rerun answered intents.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Database.PutAsync appends a mutation-log entry per record, so expiring 2000
intents took 17 s even with one flush. The drain's two bulk writes are now
atomic CultCache commits, so the enable cannot half-apply and the cost is per
commit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Soul pass 2 findings S1, S2, S3, S4.
- Enabling the sink is the drain's EnableAsync: every intent already in the
store gets an "expired" receipt and the enable marker is written, all in one
flush. No decision compares StoredAt with a clock any more, so a fast
writer clock and the Rust daemon's secs.nanosZ stamps stop mattering.
- The operator's EditorPrefs hold a token, and the sink runs only while the
store carries the marker with that token. A re-clone or a copied .brokkr has
no such marker, so a stale "enabled" authorizes nothing and the editor drops
it. The epoch and agentCommandsEnabledAt (host snapshot key 19) are gone.
- Selection is one pass over the store per tick (Pending), not a copy and sort
per intent.
- Receipts are capped at the newest 1000, pruned 128 pairs per tick with the
intent deleted before its receipt.
- A marker that could not be written is withdrawn, so the intent reads as
never started and is retried, not "interrupted".
- The drain writes through IBrokkrCommandStore; puts stage and one flush makes
them durable.
- The CLI timeout text no longer says the intent "stays written" without the
expiry caveat; the check-then-write window on --command-id is documented.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A store that fails to open is not always unreadable (a held lock does it too),
so the message says what happened. The catch-all's test now corrupts the store
after the CLI opened it, which the open's own handling cannot see.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The sink-off gate lives in the Unity service, not the drain, so the harness test
proved nothing about the machine. The new test reaches the CLI's last-resort
exit code with a failure that happens after the store opened.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Any exception now exits 2 with a message. An empty or legacy store fails with
a message that names the path instead of aborting with 134.
- A --command-id that already has a receipt is refused with exit 2, so a stale
receipt is never reported as the answer to a new intent.
- The wait treats the editor's "attempted" marker as not yet a verdict.
- The action theory passes --output so captureEditorView clears admission now
that the harness runs the real policy.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The window republished a snapshot it had captured earlier, which could carry a
stale agentCommandsEnabled. Publish Mirror and Auto Publish now ask the service
to capture and publish a fresh one; the window keeps the returned snapshot for
display only.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
BrokkrCommandDrain owns every rule between a pending intent and its receipt.
The service and the scenario harness now run the same drain instead of two
copies of the loop.
- An "attempted" receipt is written and flushed before Execute. A crash or a
failing final receipt write can no longer re-run an intent; the next drain
rewrites a leftover marker as "interrupted" and the operator decides.
- The host snapshot carries the sink's enable epoch. Intents stored before the
latest enable get an "expired" receipt and never run (operator ruling
2026-09-30).
- One drain handles at most 16 intents, expired and denied ones included.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
editor.assets.refresh, editor.lifecycle.write and editor.view.capture join
the Unity surface, in the provider contract and the advertisement test. The
donor's prefab mirror rows are not taken; that pipeline is parked.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
BrokkrCommandPolicy (Runtime, pure, tested outside Unity) is consulted by
BrokkrEditorService before every BrokkrUnityCommandExecutor.Execute; it is the
only call path into the executor. The per-project allowed-action list defaults
to scene mutation plus lifecycle; createScriptableObject, createPrefabVariant
and saveScene are shipped denied (parked Q4 = A), and an action the list does
not name is denied. A denial gets a receipt with status denied and a reason.
The window's buttons write intents like any other caller, so operator and
agent share the gate.
Re-landed from the donor as fresh code: refreshAssets, setEditorPlayState,
setEditorPaused, captureEditorView, and the play-state fields on the host
snapshot (keys 14-17). The donor's captureEditorView wrote to any rooted
outputPath; it now resolves the path through one function that accepts only a
plain relative .png path under <project>/.brokkr/captures and refuses drive
letters, rooted or UNC paths, stream suffixes and any .. segment on every host
OS, and dimensions are bounded to 8192. requestedBy joins the intent (key 17)
and is echoed on the receipt (key 6). saveScene is new.
The window gains an Allowed Actions field bound to a per-project preference.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Re-landed from the donor as a fresh file (read with git show, not merged).
Changes from the donor: the CultLibRoot default is ..\..\CultLib instead of a
directory that does not exist; every field of brokkr.unity.command_intent.v0
has a --kebab option (the donor mapped six of seventeen), and unknown options
are refused before anything is written; keys come from BrokkrCommandLedger;
exit is 0 accepted, 1 other receipt, 2 usage error or timeout; readHost opens
the store read-only and prints the agent-commands flag; a timeout says when
the editor reports the sink off. The intent gains the capture fields at keys
13-16, which the CLI needs and A4's executor will read.
Tests run the built CLI as a process against the editor probe: field mapping,
fresh id per invocation, exit code from the receipt, timeout leaves only the
intent, unknown option writes nothing, and every action name reaches the
editor once with one receipt.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The dedup already retired an id once any receipt answered it. What changes
is that this is now the stated contract (docs/provider-contract.md, Unity
Command Transport) and two tests name it, so a later move to reusable
desired-state slots (F6=B) has to break them.
The Rust sync's stable_id slots are not touched here; see the report.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Deleted: the window's command drain (OnEditorUpdate poll, Poll Mirror Command,
PublishCommandAndPoll executing), the window's own second mirror, and the
machine-global AutoPollCommands setting. The mirror lost its Watch-fed queue
and its in-memory dedup sets; BrokkrCommandLedger derives "pending" from the
cache on every call.
BrokkrEditorService ([InitializeOnLoad], one EditorApplication.update
registration, no asset-import or reload-script hooks) owns the mirror, the
one-second pull and the drain. AgentCommandsEnabled is per project and false
until the operator ticks the window toggle; loading the package opens no
store. The flag is published in the host snapshot. The mirror uses the
directory store with StartServer=false, so there is no listener.
The store path preference is now keyed by project too: it was one value for
every project on the machine, so enabling the sink in one project could have
opened another project's .brokkr.
Not compiled: Unity code is checked by the operator (see the A1 smoke steps).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The key tie-break was redundant: AllStoredDocuments already sorts by schema
then key and OrderBy is stable. Stamps are minted per write in ticks, so a
tie cannot be built through the cache API to pin it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The rule that decides which Unity command intents still await execution
(an id is answered by any receipt for it; oldest stored-at then key first)
was inline in the mirror and untestable outside Unity. It is now a
stateless ledger over a CultCache in Runtime/, compiled by
brokkr-contracts and pinned by brokkr-contracts.Tests, which also carries
the Imagination probe as an editor-without-Unity scenario harness.
The host snapshot gains agentCommandsEnabled (Key 18; 14-17 are held for
the play-state fields). Nothing in Unity uses the ledger yet.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Soul: merge. Every external type resolves in cultlib-unity-v1.0.60; 27 DLLs
(3.47 MB) gone. Operator check still owed: Unity compile in Aetheria (R3 and
MessagePack reach Brokkr only transitively through GameCult.CultLib).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
README no longer tells the reader to run `brokkr-daemon -- serve`, a
subcommand that does not exist; it lists the real subcommands and says the
daemon is a CLI over cache files. The Unity install path is F:/. check.ps1
takes -CultLibRoot (default F:\Projects\CultLib) and fails, instead of
skipping, when the CultLib packages directory is absent; the Blender CultMesh
smoke loads the three Python packages through blender_target._load_cultmesh.
Cut M2 of docs/brokkr-adoption-cut.md. check.ps1 is a Starfire check.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Delete the 27 vendored assemblies (55 files under Plugins/CultMesh, plus
Plugins.meta) and tools/vendor-cultmesh-unity.ps1. The package now declares
org.gamecult.cultlib 1.0.60 and both asmdefs reference GameCult.CultLib, the
shape CultLib's own editor-tools package uses. check.ps1 asserts the package
ships no .dll and declares the dependency, without pinning a version string.
The unity README names the host-manifest requirement.
Cut M1 of docs/brokkr-adoption-cut.md. Unity compile is an operator check.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Maintenance (drop 27 vendored DLLs for org.gamecult.cultlib 1.0.60, cut stale
claims) is split from the parked editor-control capability and an unread prefab
CDN pipeline. F1-F6 open.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The standalone GameCult/cultcache-rs repo is being retired; CultLib
(packages/cultcache-rs) is the only canonical Rust CultCache implementation.
brokkr-daemon still depended on the local standalone clone via a relative
path, which meant that repo had to keep existing just for Brokkr to build.
Switch to the same pinned-git-dependency pattern CodexConnector already uses,
pointing at CultLib's package by name and pinning to CultLib origin/main
(c2a9a6e5). No source changes were needed: CultLib's cultcache-rs exposes the
same CacheBackingStore/CultCacheEnvelope/SingleFileMessagePackBackingStore API
Brokkr already uses, with identical field names and signatures.
Cargo.lock gains redb 4.2.0 and windows-sys 0.59 as new transitive dependencies of CultLib cultcache-rs; they are not version bumps, and Brokkr never opens a redb store.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CultLib's Python runtime is now cultcache-py, cultnet-py and cultmesh-py,
one per layer like the Rust crates. `CultLib Python Source` therefore
names the CultLib packages directory and the loader puts each package's
src on sys.path, instead of one src directory that no longer holds all
three modules. The default also leaves E:\, which has not existed since
the July 2026 relocation.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
