The workspace's inverse dependency tree lists the leaf alone in every
dependency kind, so the recompile of epiphany-core after a leaf-only
change was a shared target directory evicting a fingerprint under another
session's build, the accepted cost of sharing one directory. Not a
dependency, and not the explanation Hands gave.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The document and refusal types now serialise with a tag equal to the kind
name, which is what lets Cut 10 carry a batch without a second registry.
An unexplained recompile of epiphany-core after a leaf-only change is
recorded as suspect for the next Soul, not accepted on the explanation
offered, because the core is not a dependent of the leaf.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The leaf owns the document and refusal types, so it owns their
serialisation. Huginn's admission batch cannot derive Serialize while
PipelineDocument does not, and mirrors PipelineRefusal through a
serde(remote) definition kept in step by hand; neither is the wire's
business.
PipelineDocument is adjacently tagged on the kind name: a document on a
wire is { kind, value }, and kind is exactly PipelineKind::name(), so a
reader dispatches on the kind segment it already knows from the key and
needs no second registry mapping variant spellings to kinds. Adjacent
rather than internal because a value is a named map of its own.
PipelineRefusal stays externally tagged, serde's default, which is what
keeps every variant's field and value on the wire under their own names.
No kind, field, type id or epoch moves, and the published per-kind
schemas are untouched: the envelope is the wire's shape, not a document's.
every_document_and_refusal_serialises_and_reads_back round-trips every
sample document and every refusal variant through serde_json and
rmp_serde, and holds each derived schema's variant list to the thirteen
kinds by name and to the four refusals. Mutations D1 (the tag rename
removed) and D2 (a refusal's field skipped) are both killed by it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The organ opens a mind fail-closed over CultCache's owned store, lands a
batch whole with a receipt naming its bytes, and admits through one
ordered path with every cross-document rule in it. Twenty mutations,
twenty killed, inside the build budget. One finding for Cut 10: the leaf
must derive serialisation on the document and refusal types before a
batch can cross a wire.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The harness now handles a sidecar that outlives its file and a nested
sidecar without a raw exception, and the leaf's doc comments describe the
leaf. Cut 8's store paragraph now says the single-writer mechanism is
CultCache's owned store and its compare-and-swap batch, with redb as the
engine beneath, after the operator caught the misattribution.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Doc comments only. The crate doc, `prepare`, `register_pipeline_document_types`,
`ForeignDocument`, `PIPELINE_SCHEMA_EPOCH` and `validate_pipeline_write_envelope`
spoke of "the memory organ" and "Huginn" in the present tense as a consumer
that exists; Huginn's crates are empty stubs at this commit. Each now says what
the item does and guarantees, and where a consumer must be named, calls it the
organ that will admit these documents. The sentence claiming Huginn pins the
foreign-document rule against its real receipt type is gone; no such test
exists.
`decode` now says what it does not do: it validates neither bounds nor the
key. A decoded document is a typed read, and `validate_pipeline_write_envelope`
is the check before a write.
No code change: `cargo test -p epiphany-pipeline --lib` is 27 passed with no
warnings, and `schemas/cultnet/` and `Cargo.lock` are untouched.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Soul's XF: a sidecar whose file was gone hit the `if`/`else` empty-array
collapse of Windows PowerShell 5.1, so `Find-FirstDifference` threw a raw
`ArgumentNullException`, the sidecar stayed, and every later run in that
repo died the same way before M0. A missing file is now its own case,
decided before any comparison: it is recreated from the sidecar, whose
bytes are the only copy, hash-verified, and the run says so.
`Find-FirstDifference` refuses a null array with the harness's own words.
Soul's XG: a sidecar of a sidecar was repaired in enumeration order, so
the inner sidecar's body became the file and the outer one then crashed
on its missing target. No run leaves that shape and the two cannot be
ordered, so the repair pass now stops before touching anything, naming
both files.
Soul's F2: the `.eureka-mutation-overwritten` copy was written before the
restore was attempted, so a locked target (XC) left a copy claiming an
overwrite that never happened. The copy is still written first, because
once the restore lands it is the only home of the pre-repair bytes; a
restore that fails without opening the file removes it again, and one
that changed the file before failing keeps it and says so.
Every repair step now sits inside one `try`/`catch` per sidecar, so the
"could not repair" message is the error that escapes, with the cause
appended, never a bare .NET exception.
Reproduced against a scratch copy with Soul's soul-cut8e-harness-attack:
XF recreates the file and removes the sidecar; XG stops with both files
named and the target untouched; XC leaves no overwritten copy. XA, XB,
XD, XE, XH, XI unchanged. An empty existing file beside a sidecar (XK)
repairs without the null path.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The door holds from outside: the four functions and the constant are
reachable, the wrappers and the id reader are not, and every kind
round-trips through the public path with its own key. Huginn pins
a65c6420. What Soul found is a harness that crashes without a word when a
sidecar outlives its file, and doc comments that describe an organ nobody
has built yet.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The client depends on the organ's library for types only, pinned by a grep
that it never opens or admits. The mind file is named for the engine that
holds it, because the selector and Studio both key on the extension. The
engine's provenance is recorded beside the ruling so nobody asks again.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The fix outcome's sha is checked whether or not a reference is given, the
supersession bound is pinned in the validator and not only the schema, and
the harness repairs any sidecar under the repo and never discards bytes
without saving them. The leaf's write path is live and public for the
organ, with the epoch back in code as one constant.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
`epiphany-pipeline` was the organ's type library with its prepare,
decode, register and validate path gated `cfg(test)` "until the organ
prepares writes (Cut 8)". This is Cut 8. The four are `pub` and
un-gated: `register_pipeline_document_types` registers the thirteen
kinds and nothing else, `PipelineDocument::prepare` and `::decode` are
the one door to the crate-private wrappers, and
`validate_pipeline_write_envelope` returns `PipelineRefusal` directly,
which drops the `downcast_ref` in the key test. `anyhow` and `rmp-serde`
move from dev to normal dependencies; both were already in the lock, so
the lock is unchanged. The test stand-in `ForeignDocument` stays
`cfg(test)` and is registered by the tests' `schema_cache`, no longer by
the live registrar.
`PIPELINE_SCHEMA_EPOCH` returns as one `pub const` beside the schemas it
names, with the README's evolution rule as its doc comment: additive
keeps it, a widened `PipelineKind` is additive, a breaking bump refuses
the old store. `every_kind_is_at_the_epochs_version` reads the version
off the constant and holds every type id to it, and counts the live
registrar's types against `PipelineKind::ALL`.
Verification: `cargo check -p epiphany-pipeline --lib --tests` and
`cargo test -p epiphany-pipeline --lib` (27 passed, 0 warnings);
`cargo check -p epiphany-core --lib --tests` untouched; `cfg(test)` in
lib.rs is now only `derived_schema`, `ForeignDocument` and `mod tests`;
`schemas/cultnet/` and `Cargo.lock` unchanged. Mutations
`tools/eureka-cut8-epiphany-mutations.psd1`: M0 green, E1 (epoch `.v2`),
E2 (one kind fewer registered), E3 (the stand-in registered again under
`cfg(test)`) all killed by the new test.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Soul's extra attacks on the mutation harness found the crash repair too
narrow and too eager. A sidecar left beside a file outside this run's
targets was ignored (XA), so a dead run's mutant survived in the tree; a
hand edit made after a crash was overwritten by the sidecar without a
word (XB); a locked target threw a bare IOException with no path (XC);
and a sidecar equal to its file was reported as a repair (XD).
At startup the harness now walks the repo root (`target/`,
`node_modules/` and `.git/` pruned) for every `*.eureka-mutation-original`
and repairs each. A file equal to its sidecar is left alone and the run
says "sidecar matched; nothing to restore". A file that differs has its
current bytes written to `<file>.eureka-mutation-overwritten` first, with
the path and SHA-256 printed. A write that fails prints the path and
"could not repair, sidecar kept" before rethrowing.
`-Repo` names the root the entries, targets and commands are relative to,
defaulting to this script's parent, so a suite in another repo runs
through this one harness.
Reproduced against a scratch copy with a fake runner: XA repairs b.rs
and removes its sidecar; XB keeps the hand-edited bytes in the
overwritten copy (same hash) and restores the original; XC stops with
the path and the sidecar kept; XD removes the sidecar and restores
nothing.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Soul's own suite found three validator rules no test measured: a fix's
commit was unpinned once `by` was `Some`, the validator's own bound on a
supersession was unpinned (only the schema's `maxItems` was), and the
reason on `Recorded` and `Withdrawn` had no bound test. Each is now a
forgery in the test that owns the arm: `Fixed { commit: "dirty-worktree",
by: Some(ruling) }` refused at `resolution.outcome.commit`; nine
supersessors refused as `FieldBound` at `resolution.outcome.by`, eight
accepted; a 1,001-byte reason refused at `resolution.outcome.reason` on
both outcomes.
Soul's S2, S14 and S10 join the Cut 6c suite under their own ids. Rerun:
M0 green (26 passed); M16-M22, S2, S14, S10 killed.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Every shape, schema and key promise held, including byte-identical derived
schemas and unmoved keys. Three fixtures were missing, the important one
being that a fix outcome's commit sha goes unchecked whenever a reference
is also given, which is half of ruling B. Three harness follow-ups. One
count of Self's corrected.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The old section was anchored to pins from before every key moved and
before the Ghostlight shapes retyped the referents admission validates.
Two things the old section had wrong: Epiphany is touched, because the
leaf's prepare, decode, register and validate path is test-only today and
Huginn cannot re-declare the wrappers without becoming a second authority
over the wire shape; and the rule set lived only in git history, so the
map now owns it in full. The store is the owned redb store, which gives
one-writer a lock instead of a sentence, and the receipt is duplicated,
bounded and smaller, with moving it priced and declined for now.
Four questions raised; two are defaults taken, two are for the operator.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The Ghostlight shapes are in: two unit enums, a promise type, five fields,
four parsed referents where strings were, and one estimate type where two
were. Six schemas regenerated with the supersession bound carried into the
published JSON. The harness now restores on every path and repairs itself
after a killed run. Four scars recorded, the first being that a widened
type only reads as a kill when the fixture is spelled so the wider tree
still compiles.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Seven entries through the shared harness: the Superseded list checked by
length only (M16), the outcome's whole match body replaced by Ok (M17),
the fix's commit unvalidated (M18), the mutation label widened to Short
(M19), its commit widened to Short (M20), the sample estimate's line
counts transposed under a two-line anchor that carries the opener (M21),
and a claim's mutations bound widened to sixteen (M22). Each is killed by
the Cut 6c test that pins it; the key suite is blind to all seven.
The first run left M19 and M20 with no verdict: the sample and the test
spelled the label and the commit with the narrow constructors, so the
widened tree did not compile instead of admitting the forgery. Both now
go through From<&str>, which every text type has, and the forgeries
reach validation and kill.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Ghostlight's independently run campaign named what the documents could
not say: a report's promises, a ruling's authority, a finding's origin,
and a resolution's referents as anything but unparsed text. Zero new
kinds, no key moves, epoch unchanged.
Added: RulingAuthority and FindingOrigin as unit enums; Promise beside
LandedName, identified by its report and label like a TargetInvariant;
promises on the cut report, authority on the ruling, origin on the
finding, and promise plus a bounded mutations list on a verdict claim.
Retyped: MutationRecord carries a key-safe label, a location, the exact
before and after, and the commit it ran against; the cut spec's estimate
is a StructuralDelta, the same shape as the report's actual, so the two
compare on every axis; ResolutionOutcome's referents are PipelineRefs,
Superseded a list of at most eight (its maxItems carried by schemars
extend, since the enum is outside value_types!), Fixed a Sha with an
optional record (ruling B). The Bounded impl is the replacement written
whole: the list validates every item, and every arm names its field.
Five tests pin the shapes: a referent is a full id of the kind it
declares, with a wrong-kind forgery at by[1] refused by field, and an id
no resolution derives left to admission; a fix's commit is lowercase hex;
a mutation's label is dot-free and its commit a sha; a claim's promise
and mutations are labels, nine mutations refused at eight; the sample
spec estimates a net addition of 900 lines and equals the sample
report's actual.
Six schemas regenerate from the derivation test's temp directory:
ruling, cut_spec, cut_report, verdict, finding, resolution. index.json
and the other seven are byte-identical.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The deletes go before any field is added, so the dead estimate shape and
the delta that replaces it never coexist at a commit. SubtractionEstimate
and its comment, the cut spec's subtraction_estimate field and its sample
literal, the hand-written Bounded impl for ResolutionOutcome (replaced
whole in the next commit, never patched, since every arm changes referent
type and a patched impl is how a length-only check survives), and
MutationRecord's free-text mutation field with its sample value are gone.
The list-default comment now stands on StructuralDelta alone.
This commit does not build: PipelineResolution's outcome has no Bounded
impl until the next commit gives it the parsed one.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Soul's X1 and X11 survived the second fix batch: a reader that trimmed a
trailing dot from the root or from the local before its dotted_text check
passed every test, because the only fixtures with a trailing dot went
through the writer, which never composes one. Four malformed ids now
read through pipeline_id in keys_read_back_as_ids_of_their_kind and are
refused: a trailing dot on the root, a trailing dot, a leading dot and an
empty part on the local. X1 and X11 join the Cut 6b suite as entries,
each killed by that test.
The resolution arm's comment named "the 64-byte bound in local"; the
bound is LOCAL_MAX and the comment now says so.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The parity manifest agrees with Eve's metadata, the fixture no longer names
Huginn anywhere, and AGENTS says the crates are stubs. Three small edits
with their checks pasted; no separate Soul pass, and the next Soul on
Huginn rereads AGENTS at Cut 8.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Soul held the deletion line and the no-consumer claim, and found the fixture's
owner recorded in a third repo that now disagrees, three more Huginn-naming
fields, and AGENTS describing unbuilt cuts in the present tense. Two errors
were the map's own: a follow-up number used twice, and a negative grep that
ripgrep cannot parse.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Soul's second attack on the mutation harness found three ways a target
stayed mutated. A multi-target entry wrote its targets outside the try,
so a write that threw on the second target skipped the finally and left
the first mutated. M0's write-through had no finally at all. And a hard
kill mid-entry, which is what a tool timeout is, runs no finally, so the
target stayed mutated with nothing recording what it had been.
Every write now sits inside a try whose finally restores every target the
step touched, M0's included, each proven by hash; a target that cannot be
restored is printed with RESTORE FAILED and its original SHA-256 before
the run throws. Before any target is written its original bytes go to a
sidecar beside it, deleted only after a verified restore, and a run that
finds a sidecar at startup restores from it, verifies, removes it and
says a previous run died mid-mutation. Commands run through a Process
with a -TimeoutSeconds limit (1800 by default) and are killed with their
tree by the harness inside its own finally, so a hung cargo ends inside
the entry's restore rather than under the operator's tool.
Reproduced against a fake repo: A1 (M0 target write-locked) and A2 (the
second of two targets locked, in both hashtable orders) leave every
target byte-identical with no sidecar; A3 (tree killed mid-entry) leaves
the mutant and the sidecar, and the rerun reports the repair and kills
the entry; a 3-second timeout against a 12-second runner reports TIMED
OUT (no verdict) and restores.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The operator reached npm signup today, so yesterday's blocked subnet is no
longer a Body fact. The ruling stands on a different reason: registry
publication is a later pass. Recorded in the operator's words beside the
earlier statement so the map does not carry a claim its author withdrew.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Every grammar pin held under non-revert mutations. What survived is the
harness under failure: writes outside the restoring finally, no guard on
the control's own write-through, nothing that survives a killed process,
and one reader fixture for trailing dots. A third batch takes those and
Cut 6c follows in the same tree.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Huginn's TypeScript body is gone and an empty Rust workspace stands in its
place; Eve's fixture says it is Eve's. The spec's file and line arithmetic
was off and is corrected in the landing note rather than the table, and the
conformance fixture's third Huginn-naming field is flagged for Soul.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The operator's ruling carries a Body fact the maps had not recorded: npmjs
is unreachable from this network, so no GameCult package can be published
there. Cut 7 needed no publish. The QUIC map's Q5 assumed one; that is
raised there separately.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Operator correction: the CultLib QUIC cut may run without Huginn, but the
StreamPixels migration must run with it, because a portfolio piece should
demonstrate the full pipeline on typed state. The campaign no longer pauses
after Cut 6c; Cuts 7-16 follow, alongside QUIC where the repos allow it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The harness now restores from the original bytes on every path and checks
its own round trip before it writes; dotted roots and the reader's root-kind
check have tests and mutations; the local bound is one named constant. The
Cut 6 entry notes name the entries that actually pin their rules.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Soul's second pass on the key grammar found four gaps, none in the
grammar itself: nothing pinned them.
No test keyed or read back a root with a dot in it, so both the
composer's root check and the reader's could have been a label check
(Soul's N9 and N10 survived). `dotted_roots_key_and_read_back` keys a
campaign `game.cult` and an instance `ygg.drasil`, reads each back by
`pipeline_id` recovering the root exactly, keys a target under the
dotted campaign and reads it back, and keys a resolution of the dotted
campaign as `game.cult:resolution:campaign.self`.
The reader's kind check was unpinned for the root kinds: excusing the
Instance kind from it survived (N6). `keys_read_back_as_ids_of_their_kind`
is extended, the first change to its body since Cut 6: an instance key
read as an instance succeeds, an instance key read as a campaign is
refused, and a campaign key read as an instance is refused.
The depth test restated the composer's bound as a literal, so moving
the bound and the test's 64s together survived (N4). `LOCAL_MAX` now
names the bound; `local` and the depth test both read it, and that
mutation is no longer a single-site edit. The Cut 6b entries that
anchored the literal, M4 and S5, anchor the name.
Cut 6's M5, M12 and M13 were deleted in d03a32df with notes pointing at
Cut 6b's M6 and S2, which pin neither the tail part nor the escape.
Soul's N3, N7 and N8 are those rules re-anchored: N3 skips the label
check on the last part of a local, N7 makes `key_segment` the identity,
N8 escapes `/` to a bare `_` with `_` unescaped. N6, N9 and N10 join
them in tools/eureka-cut6b-mutations.psd1, and the Cut 6 notes for M5,
M12, M13 and M15 now name the entries that pin them.
Every suite runs green through the harness: Cut 6b sixteen entries
killed (nine prior verdicts unchanged, N3, N6, N7, N8, N9, N10 killed),
Cut 6 ten killed, Cut 5 seven killed, M0 green in each. 21 tests in
epiphany-pipeline, no warnings. schemas/cultnet is unchanged.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Soul's attack on tools/eureka-mutations.ps1 found two faults. M0 proved
the I/O path by writing the target and comparing hashes, so a broken
write path corrupted the target in the act of checking it, and the
harness could not put it back because it had only ever read text. And
"exactly once" counted non-overlapping matches, so an anchor that
overlaps itself, `}\n}\n` in `}\n}\n}\n`, counted as one site and the
splice at the first would have changed a region the entry does not
describe.
The harness now reads every target as bytes and keeps those bytes as
the restore source. M0 decodes, re-encodes through the one path every
write uses, and compares the result to the original bytes before
anything is written; a difference names the target and the first
differing offset, writes nothing, and runs no entry. Only then is the
target rewritten through the write path and hashed, with the original
bytes written back before the throw if the write lands other bytes.
After every entry the original bytes are written back and the file is
hashed against them; the offset reverse edit is gone, since the bytes
it reconstructed were in hand all along. Anchor sites are counted by an
IndexOf loop advancing one character per hit, so an overlapping anchor
is two and refused.
The usage comment records that -Test is split on whitespace with no
quoting, so a path with a space cannot be expressed.
Soul's attack script, re-targeted at the new Write-Text line: the
Set-Content variant, the BOM-encoder variant and the BOM-bearing second
target all leave every target byte-identical, the first two stopping at
M0 with no entry run; the overlapping anchor throws "matches 2 times".
The Cut 6b suite runs green through the fixed harness: M0 green, nine
entries killed.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The four unpinned checks are pinned and the mutation harness is one script
with a built-in control. Soul then attacked the harness itself and found
the control could rewrite a target it cannot restore, the anchor guard
counted non-overlapping matches, dotted roots and the reader's root-kind
check were unpinned, and Self's own instruction to delete rather than
re-anchor five Cut 6 entries had cost the suite coverage it still claimed.
All of it is in a second fix batch.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The Cut 5, 6 and 6b suites each carried the same scaffold around their
entries, and Cut 6c would have made a fourth. tools/eureka-mutations.ps1
is now the single harness: it takes an entries file, the target files
and the cargo command; reads and writes byte-exact UTF-8; requires every
anchor to match exactly once; applies each edit by offset and reverses
it by the same offset, verified by SHA-256; keeps a compile-must-fail
entry shape; and runs M0 before any entry, rewriting every target
through its own I/O path and running every command bare, stopping with
"harness broken" if anything moves or fails.
The three suites are now entries only, as .psd1 data files. Cut 6's M5,
M12, M13, M14 and M15 matched nothing after Cut 6b rewrote the grammar;
each is deleted with a note naming the Cut 6b entry that pins the rule
now. Cut 6b's file carries Soul's S2, S4 and S5, the mutations the
previous commit's tests kill.
All three suites run green through the harness: every entry killed,
M0 green.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The nesting depth was described as "five" when the bound is the 64-byte
local: a chain n deep over a depth-one local of L bytes composes
11 * (n - 1) + L bytes, so `ruling.A` keys six deep and `question.Q1`
five. The arm comment and the test say the arithmetic, and the test
computes the deepest chain from it for both subjects and asserts the
first refusal.
The escape's `_` half was pinned only through an OrgRepo; a receiver
`a_db` and a receiver `a.b` now key differently, the former through
`a__db`. The composer's root check was pinned by `a:b` alone; a trailing
dot, a leading dot, an empty part and a 65-byte root are each refused
by `pipeline_key` without `validate()`. The whole-local bound was
unpinned on both sides; a 64-byte local keys and a 65-byte one refuses,
for a plain label and for an escaped repo.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Cut 6b landed in three commits and Soul's whole-key probe found no collision
across 212,450 adversarial keys. Three checks were unpinned (the underscore
half of the escape, the composer's root check, the 64-byte boundary) and are
in a fix batch with Soul's own surviving mutants as their killers. Two map
claims were wrong and are corrected: nesting depth follows from the subject's
local rather than being five, and a validated date passes raw because it is
already a label.
The Cut 6c spec is folded in as reissued against the landed grammar, with the
supersession fixture only the new grammar makes nameable and the mutation
entries pointed at the shared harness the fix batch is factoring out.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Six mutations, each restoring one of the old permissivenesses the grammar
made impossible, and M0, a no-op control that rewrites the file through
the harness's own I/O path and requires the suite to stay green before
any verdict is trusted. All file I/O is byte-exact UTF-8 without BOM,
since the file carries an `é` literal that the 5.1 default round-trip
corrupts into a fake kill. Every anchor must match exactly once, multi-line
anchors are converted to the file's own line endings, restoration is the
reverse edit checked against the original's hash, and a mutation whose
tree does not build is an error rather than a survival.
Result on this tree: M0 green; M1-M6 each killed by its named test.
This commit builds; it changes no Rust source.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Every key is now `<root>:<kind>:<local>`, three segments with no kind
excused. The root is a `Slug`, the kind is its literal name, and the
local is `Label`s joined by `.`, so no part carries the separator and a
reader recovers the parts by splitting. Roots take the constant local
`self`; a resolution is keyed inside its subject's root with the subject's
kind and local as its own local, so a resolution of a resolution is an
ordinary id bounded by the 64-byte local and needs no guard.
- `local` is the one composer: every part through `label_text`, the join
bounded whole, once. `pipeline_key` has thirteen arms and one exit.
- `pipeline_id` is the grammar read backwards, with no per-kind branch.
- `repo_segment` becomes `key_segment`: the same injective escape, now for
any `Slug` or `OrgRepo` entering a local. `hand_off.to_instance`, the
only raw `Slug` that reached a local, goes through it.
- `parent_cut` indexes the split parts instead of splitting from the right.
Every key moves, and nothing outside this file reads one. No schema file,
kind, type, field, dependency or epoch changes.
Tests: six new (`every_key_has_exactly_three_segments`,
`roots_of_different_kinds_do_not_share_a_key`,
`a_resolution_names_its_subjects_kind`,
`a_resolution_of_a_resolution_reads_back`,
`a_composed_local_is_bounded_whole`,
`no_local_part_carries_the_separator`); thirteen expected keys move in
the samples; `composed_keys_cannot_collide`'s composer probe moves into the
separator test and its dotted receiver now escapes.
Spec deviations, in the report: `local` takes `&[&str]` rather than a
const array because the resolution and finding arms carry a parent's
parts; the whole-local bound refuses `InvalidFormat` to match the spec's
own test and the reader's refusal of the same string; `key_segment` is a
pure escape and each caller validates its source type by its own field.
This commit builds and its tests pass.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Three fix passes each made one key composition site injective and left the
site above it open. Soul's third pass found campaign and instance sharing a
root namespace, a resolution key discarding its subject's kind, and nested
resolutions composing an unreadable key. That is a missing owner, not three
bugs, so the grammar is redesigned as Cut 6b: root:kind:local, three segments
always, no local part a slug, roots keyed with the constant self. The
exceptions are deleted, not guarded.
The Ghostlight shapes become Cut 6c and land after 6b, once Imagination
reissues them against the settled grammar. The campaign pauses after 6c; the
QUIC realtime plane in CultLib goes first because StreamPixels is the
portfolio piece, and Huginn resumes after it ships.
Also recorded: the second Cut 6 fix batch and the findings it closed; the
mutation-harness audit, which found the corrupting round-trip in no committed
suite but no no-op control in any suite either; corrections 19-24 (the dot
escape, the unstated resolution key, the std::process grep, the ruled
target-dir deviation, the second byte-identical claim, the README's foreign
consumer promise); and Q10-Q12 with recommendations.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The key space had four shapes because three of thirteen kinds returned a
key the composer never saw, and the reader undid them with a per-kind
match and a kind-guessing helper. Every confirmed defect lived in one of
those exceptions. This commit removes them before anything replaces them,
so no commit holds both the exceptions and the new composer:
- `declared_kind`, the inference that hardcoded `Campaign` for a bare slug
- the `match kind` block in `pipeline_id` (root arm, resolution arm and
its recursion)
- `KeyParts`, its constructors, `key`, and the "only the head may carry
the separator" doctrine comment
- the three early `return`s in `pipeline_key` (instance, campaign,
resolution)
This commit does not build: `pipeline_key` references `KeyParts` and the
tests reference the deleted shapes. The next commit lands the grammar.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Soul G3: the comment asserted only the half that improved -- a passing
run leaves nothing -- and was silent about the failing run, which is the
only case that creates a directory at all and now leaks one permanently,
one per failing run where the shared directory was overwritten however
often it failed. The trade is still right; the comment now names its
cost and says who cleans up.
Comment only. No behaviour, so no mutation.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Soul G2: F3's defect survived for `Resolution`, unpinned in both
directions. A resolution's key is `resolution:<subject id>`, and the
reader demanded `<campaign>:resolution:<local>`. The two are disjoint, so
`pipeline_id` refused every id a resolution actually has and accepted one
no resolution can ever carry: a document that can be written but never
referenced, and a reference that names nothing. `PipelineRef` takes any
kind, so both are reachable -- a question's `raised_in`, a follow-up's
`source`, a resolution's own `subject`.
The reader now accepts what `pipeline_key` derives: a `resolution:`
prefix, then the subject's id parsed as an id of the kind that id names
itself as. `declared_kind` reads that kind from the id's own kind
segment, or calls a bare slug a root. A key and an id are the same
string, and now no kind is excused from that.
`keys_read_back_as_ids_of_their_kind` loses its resolution special case:
the loop covers every kind with no exception, which is the pin the last
batch's doc-comment curiosity should have been.
Mutations, each run against the committed suite and reversed after:
- Soul's survivor, `| PipelineKind::Resolution` on the root case: now
fails `a_resolution_is_named_by_the_key_it_has` and
`keys_read_back_as_ids_of_their_kind`. It compiles with an unreachable
pattern warning, because the resolution case is an arm of the same
match.
- the resolution case falls through to the campaign tail (the landed
behaviour): the same two tests fail.
- a generous reader that takes the prefix when it is there and falls
through when it is not: the negative direction fails on its own,
`eureka-state:resolution:R8` still being accepted.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Soul G1: the hand-off key was not injective. Its local was
`{to_instance}.{repo}.{date}`, and `.` was admitted on both sides of the
first boundary: `to_instance` is a `Slug`, `repo_segment` passed a dot
straight through, and `OrgRepo` imposes no byte class at all. So
`thought-cage.GameCult` + `Epiphany/thing` and `thought-cage` +
`GameCult.Epiphany/thing` both validated and both keyed to
`yggdrasil:hand_off:thought-cage.GameCult.Epiphany_-thing.2026-09-15`.
One of the two documents was lost. This is the invariant S1 named and the
sentence `label_text` uses to keep dots out of labels.
Neither side could be forbidden: a dotted repo name is ordinary and a
dotted instance slug is what `Slug` is for. So the composition is fixed
rather than the one key. Every non-root, non-resolution key now composes
through `KeyParts::key`: the root is validated, the head may carry the
separator, and every tail part is a `Label`. A kind's tail length is
fixed by the arm that builds it, so a reader recovers the parts by
splitting from the right once per tail part. `repo_segment` escapes `.`
as `_d` alongside `__` and `_-`, which keeps the repo a legal tail part
and keeps the escape injective.
Stewardship and hand-off stop composing their own keys and lose their
early returns: their root is an instance rather than a campaign, and that
was the whole difference. The finding key's separate `label_text` call
goes with them -- the tail rule is that check.
`composed_keys_cannot_collide` now pins the rule on the composer every
kind goes through, so it covers whatever kind is added next rather than
the two kinds it happened to list, plus Soul's hand-off pair.
Mutations, each run against the committed suite and reversed after:
- drop the `.` escape from `repo_segment`: `composed_keys_cannot_collide`
fails on the hand-off pair.
- let a tail part be `dotted_text` instead of `label_text`: the same test
fails on the composer rule, `a.b.c` composing two ways.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The escape correction is the one that mattered: the map specified a key segment
that could not tell two legal repos apart, and the test that was supposed to
pin it asserted the property in a comment while checking one half of the pair.
The map now carries the injective encoding and the reason the obvious doubling
trick does not work either.
Two record corrections against Hands' own report. The byte-identical claim for
epiphany-state.exe is withdrawn as false rather than unverified, and no hash
replaces it, because that artifact's hash depends on the build root. The
omission in 7ab838f1's message is half what Self first relayed; the other half
belongs to a commit that does describe it.
Correction 14 is the second ledger drift this campaign, both times after a
correction raised one side of an estimate and left the other.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The operator ruled on 2026-09-16 that widening a `PipelineKind` enum is
additive. The README's additive rule named only a new field with a serde
default, which is true and stays, but did not cover the case.
The clause says why in the README's own voice: these readers are ours and each
ships with the variants it knows, so a reader that meets a kind it has never
heard of refuses it on the kind, not on the epoch. That is also the answer to
the tension with the wire note two sentences earlier -- the contracts do cross
out of this repo, and the rule holds because the readers on the other side are
still ours. If that stops being true, the rule needs revisiting.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Soul F4. The derivation test wrote its stale copies into one shared temp
directory and cleared it first with `remove_dir_all(...).ok()`. The clear was
best-effort and unverified: a held handle refuses the delete on Windows, `.ok()`
swallows the refusal, and a previous run's file survives in a directory whose
path the failure message invites the reader to copy from. The mutation suite
runs M8 and M11 against this test and never cleans up after them, so the
leftovers it would hide are mutated schemas no committed type produces.
The directory is now per-run, named by process id and nanosecond, so there is
no sharing to defend and the clear and its `.ok()` are gone rather than
hardened. It is still created only when something is stale, so a passing run
leaves nothing behind.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Soul F3. `pipeline_key` made the instance a root and `pipeline_id` was left
behind: it special-cased `campaign` alone and demanded three `:` segments of
everything else, so `PipelineRef { kind: Instance, id: "yggdrasil" }` was
refused as `InvalidFormat` and no resolution could ever take an instance as its
subject. The reader now knows both roots.
Nothing caught it because the key tests assert strings and never read one back.
`keys_read_back_as_ids_of_their_kind` walks every sample, keys it, and parses
the key back as an id of its kind; a resolution is the one kind whose key is
not an id of itself, so its subject is what reads back.
That test also carries Soul F2, which was Soul's surviving mutation: the
instance root's slug was validated nowhere the key could see, so an instance
named `thought cage` keyed to `thought cage` -- a store key holding a byte no
`Label` may carry. Stewardship and hand-off validate every slug they key by;
the instance now does too, and M14 is Soul's survivor turned into an entry.
M15 puts the shipped reader back.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Soul F1. `/` -> `_` is not injective: `GameCult_Epiphany/thing` and
`GameCult/Epiphany_thing` both key to
`yggdrasil:stewardship:GameCult_Epiphany_thing`, so an instance stewarding both
silently loses one document. Keys are identity, not convenience.
`_` is now escaped too, and both codes are two bytes starting with `_`: `_`
becomes `__` and `/` becomes `_-`. Every other byte passes through and is never
`_`, so a reader going left to right takes each `_` with the byte after it and
never has a choice to make. The encoding is reversible, therefore injective.
That is the smallest change that buys the property: nothing else moves, and the
segment stays inside the `Label` byte class.
The test claimed the property and checked one half of the colliding pair, which
asserts nothing about collision. It now keys both halves and asserts they
differ. M12 is re-anchored on the new spelling, and M13 is new: it puts the
shipped `/` -> `_` back, which the pair kills.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Every rule the moved code carries keeps a test that fails under its own
mutation, so the suite moves with the code rather than being left pointing at a
file that no longer exists. M1-M9 are Cut 4's entries re-anchored into
`epiphany-pipeline/src/lib.rs`; each entry now names its own package as well as
its own file, because M10 still mutates the spine in epiphany-core. All twelve
were run and all twelve were killed by their own test.
M10's mutation changed shape. It used to register the pipeline documents into
the spine's schema cache, and epiphany-core no longer has them; it now declares
its own type carrying `epiphany.pipeline.campaign.v1` inline, exactly as the
test it attacks now does.
Two entries are new. M12 keeps the repo escaping honest: drop the `/`-to-`_`
substitution and `stewardship_key_escapes_the_repo_slash` fails. M11 is the
cut's "change a value type and leave its schema alone" mutation, expressed as a
new enum variant rather than a new field: a field cannot be added without
breaking every struct literal that builds the value, which fails the whole
target and would prove nothing about the derivation test in particular. M11
changes exactly one derived schema, and the test names exactly that one.
`tools/eureka-cut4-mutations.ps1` is deleted rather than left to throw. Every
one of its ten entries is above, and its first act was to read a file this
branch moved, so it could not run again. It still runs at `a9f06c2a`, where its
receipt is.
The derivation test now empties its derived-schema directory before writing to
it. It did not, and this pass nearly published a schema from an earlier
mutation run's leftovers: the directory is shared, `Short` had `maxLength: 201`
in it from Cut 4's M8, and a copy of everything in there landed in the working
tree before the diff caught it. The gate that exists to stop a hand-written
schema should not be the thing that hands one over.
The stale-anchor guard is unchanged and still hard: an anchor that matches
anything but exactly once throws before a single test runs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The Main Families entry still said pipeline state is "stored per repo at
`.epiphany/pipeline/pipeline.cc`", which Cut 4 deleted, and the wire note still
sent these contracts to the voidbot projection. Both describe a machine that no
longer exists.
Pipeline state now lives in an instance's mind, owned by the Huginn memory
organ, and the contracts cross to that organ and its `eureka-state` client. The
three kinds this branch added are named, since the list is the entry's point.
The `[value]` payload sentence, the derivation sentence and the Q2 evolution
sentence stand; the derivation sentence now says which package runs the check.
Documentation only: no build, no test.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Ruling 1 keeps schema ownership in Epiphany; ruling 17 puts admission in
Huginn. Huginn must not take on epiphany-core -- about 41,000 lines and 295
lock packages -- to use about 1,000 lines of document types. So the documents
leave as a leaf library, and epiphany-core keeps no pipeline surface at all:
its consumption is campaign two.
`epiphany-core/src/pipeline_documents.rs` moves whole to
`epiphany-pipeline/src/lib.rs`, with its nine tests. Only three things changed
in the move: the module doc now describes a package rather than a cut map
section; `anyhow` joins `rmp-serde` behind `cfg(test)`, because the write path
has been test-only since 186dbc62 and the live library's errors are all
`PipelineRefusal`; and the decode refusal, which was pinned against
epiphany-core's Mind commit receipt, is pinned against a local `ForeignDocument`
carrying that receipt's type id, since the receipt belongs to the harness.
The package declares four dependencies. chrono parses a Date, cultcache-rs
supplies DatabaseEntry, schemars derives the published schemas (Q5), and serde
is the document format. anyhow, rmp-serde and serde_json are dev-dependencies:
every use of them is `cfg(test)`. `autobins = false`, as a leaf library must.
The workspace lock grows by exactly one entry, the member itself; no new
third-party package.
Deleted rather than re-exported: epiphany-core's `mod pipeline_documents;` and
`pub use pipeline_documents::*;`, and `schemars` from its manifest, whose only
user was this module. No shim, no duplicate type.
`runtime_spine_cache_refuses_a_pipeline_store` stays in epiphany-core, because
the rule is the spine registry's: it registers its own types and nothing else.
It now builds its foreign envelope from a `cfg(test)` stand-in carrying
`epiphany.pipeline.campaign.v1` rather than from the moved documents, so the
rule keeps its test without the package keeping a dependency.
D2's three new kinds arrive with the move, each with a live consumer in the
organ: `instance` is a mind's identity document, `stewardship` records the
repos an instance is assigned, and `hand_off` records a reassignment in both
minds. All three hang off an instance rather than a campaign, so they compose
their own keys instead of borrowing the `<campaign>:<kind>:<local>` tail. A
repo inside a key is escaped to `Org_Repo`, because `/` is not a Label byte.
Thirteen schemas now derive. The five that embed `PipelineKind` gained three
enum variants, which is additive, so Q2 keeps `epiphany.pipeline.epoch.v1`.
epiphany-pipeline: 12 tests, 0 warnings. epiphany-core: 163 tests -- 172 minus
the nine that moved -- 0 warnings. epiphany-state.exe is byte-identical.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
