Epiphany pinned ghostlight-persona-projection at 2228189
(2026-08-16), which still carries the vendor/cultcache-py submodule
pointing at https://github.com/GameCult/cultcache-py.git. That repo
was folded into CultLib's packages/cultcache-py and no longer exists,
so a fresh clone that recursively fetches Ghostlight submodules fails
cargo's `unable to update` step even though Epiphany's own tree is
otherwise clean.
Move the pin to 22937b7 (2026-09-13), the nearest Ghostlight revision
without a dead submodule: it replaces vendor/cultcache-py with the
published cultcache-py PyPI package and keeps only vendor/eve. Between
the two revisions the crate's public surface stayed source-compatible
for the three call sites Epiphany uses, with three additive/field
changes: ProjectorPrompt and PersonaPrompt gained a required
word_budget field (set to 180, matching Ghostlight's own
PERSONA_WORD_BUDGET convention for narrative Persona controllers), and
InterpreterPrompt's output_schema became Option<&str> (wrapped in
Some(..) to keep the always-supplied schema).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Ruling 1 keeps schema ownership in Epiphany; ruling 17 puts admission in
Huginn. Huginn must not take on epiphany-core -- about 41,000 lines and 295
lock packages -- to use about 1,000 lines of document types. So the documents
leave as a leaf library, and epiphany-core keeps no pipeline surface at all:
its consumption is campaign two.
`epiphany-core/src/pipeline_documents.rs` moves whole to
`epiphany-pipeline/src/lib.rs`, with its nine tests. Only three things changed
in the move: the module doc now describes a package rather than a cut map
section; `anyhow` joins `rmp-serde` behind `cfg(test)`, because the write path
has been test-only since 186dbc62 and the live library's errors are all
`PipelineRefusal`; and the decode refusal, which was pinned against
epiphany-core's Mind commit receipt, is pinned against a local `ForeignDocument`
carrying that receipt's type id, since the receipt belongs to the harness.
The package declares four dependencies. chrono parses a Date, cultcache-rs
supplies DatabaseEntry, schemars derives the published schemas (Q5), and serde
is the document format. anyhow, rmp-serde and serde_json are dev-dependencies:
every use of them is `cfg(test)`. `autobins = false`, as a leaf library must.
The workspace lock grows by exactly one entry, the member itself; no new
third-party package.
Deleted rather than re-exported: epiphany-core's `mod pipeline_documents;` and
`pub use pipeline_documents::*;`, and `schemars` from its manifest, whose only
user was this module. No shim, no duplicate type.
`runtime_spine_cache_refuses_a_pipeline_store` stays in epiphany-core, because
the rule is the spine registry's: it registers its own types and nothing else.
It now builds its foreign envelope from a `cfg(test)` stand-in carrying
`epiphany.pipeline.campaign.v1` rather than from the moved documents, so the
rule keeps its test without the package keeping a dependency.
D2's three new kinds arrive with the move, each with a live consumer in the
organ: `instance` is a mind's identity document, `stewardship` records the
repos an instance is assigned, and `hand_off` records a reassignment in both
minds. All three hang off an instance rather than a campaign, so they compose
their own keys instead of borrowing the `<campaign>:<kind>:<local>` tail. A
repo inside a key is escaped to `Org_Repo`, because `/` is not a Label byte.
Thirteen schemas now derive. The five that embed `PipelineKind` gained three
enum variants, which is additive, so Q2 keeps `epiphany.pipeline.epoch.v1`.
epiphany-pipeline: 12 tests, 0 warnings. epiphany-core: 163 tests -- 172 minus
the nine that moved -- 0 warnings. epiphany-state.exe is byte-identical.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Soul mutated the collapsed commit owner twice and the suite survived both.
Neither rule was pinned; both are now, each by a test that fails under its own
mutation, and both mutations join the suite so the gap cannot reopen.
S7, a regression from base. The owner resolves the backing store once and
reuses it for the cache load, the CAS and the conflict re-read, and its doc
comment says no path in the function can target a second store. Re-deriving the
CAS handle from the same path left the whole suite green. The old profile test
had caught it only because its store was deliberately not the commit path; the
replacement asserted the temp dir holds one store, which a same-path
re-derivation satisfies exactly. A handle carries nothing but its path today,
so no assertion about files or contents can see the second one. The `.redb` arm
makes the difference real -- redb permits one writable handle per path -- and
the map plans redb for the organ's minds.
So the probe is the resolution itself: `runtime_spine_backing_store` records
every path it hands out, under `cfg(test)` only, and
`mind_commit_reads_and_writes_one_store` asserts a commit resolves its store
exactly once. The log is per-path and compared as a delta, so tests running in
parallel cannot see each other. Mutation MS1 re-derives from the same path and
the count reads 2.
S8, pre-existing. Narrowing validation to the first write also survived,
because no test committed a batch carrying more than one distinct write. The
existing mutation neuters validation for every write, which any single-write
batch catches; nothing covered the loop's reach. Added
`mind_commit_validates_every_write_in_the_batch`: two distinct writes, the
second refused, and the batch is refused whole with nothing written -- the
valid first write included. Mutation MS2 takes the first write only and the
test gets a commit where it expected a refusal.
M2's rule text is corrected to match what it actually pins, now that MS2 owns
the stronger half.
S10, cosmetic. The renamed test's fixture still said "mind-profile-test" after
the profile it named was deleted. The pinned receipt digest does not depend on
it and is unchanged.
Builds clean: 172 tests, 0 warnings. Seven mutations, each killed by its own
test.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Cut 2 generalised the one commit owner into a profile so a pipeline profile
could share it. Ruling 20 sends admission to Huginn, so the second profile left
the repo and the abstraction had exactly one implementation. A
one-implementation abstraction is a named STOP condition, so it goes. Cut 2's
generalisation did not pay off; this says so rather than keeping the shape to
avoid admitting it.
Deleted: `struct TypedCommitStore`, `const MIND_COMMIT_STORE`, the
`store: &TypedCommitStore` parameter, `fn validate_mind_writes`, and the
`&MIND_COMMIT_STORE` argument at each of the five Mind wrappers. The three
choices the profile carried are re-inlined at their one use: the backing store,
the runtime spine opener, and the write validator, plus the literal
"epiphany-mind" as the receipt's store id. `RuntimeSpineBackingStore` lost its
last use in this file and left the import.
Behaviour is unchanged, including the pinned receipt digest
mind-commit-sha256:415283...281e. The owner's order is unchanged and stays
fail-closed: identities unique, store open (which refuses a foreign epoch),
writes validated, and only then may a stored receipt answer a replay.
The profile's two tests could not survive the thing they tested, so their rules
are re-expressed against the concrete owner. The two profile-shaped tests are
replaced by three that reach the same rules through the Mind path:
validation-before-replay now plants exactly the receipt the batch would produce
and asserts the refusal wins; uniqueness-before-validation pins which refusal a
duplicated invalid batch reports; and one-store asserts a commit touches only
the store it was given. Two surviving tests lost "profile" from their names,
which had become a lie.
Builds clean: 171 tests, 0 warnings.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Soul's F9 on the Cut 4 fix batch: `prepare` and
`validate_pipeline_write_envelope` still wore
`cfg_attr(not(test), expect(dead_code))`, and Soul proved both dead in a
non-test build. `prepare` was structurally unreachable — it needs a CultCache
with the pipeline types registered, and the only registrar has been `cfg(test)`
since this cut. A waiver that describes a caller Cut 8 has not written yet is
the file claiming a live path it does not have.
Both become `#[cfg(test)]`, which is what they honestly are, and the waivers go.
Two things are test-only with them: `decode`, whose only caller was the
validator, and the `CultCache`/`CultCacheEnvelope` imports, which looked live
only because dead code mentioned them. The live path keeps the type ids.
Cut 6 now moves four `cfg(test)` items rather than two live ones; the spec's
Keeps list still holds, since what moves is the same code under a different
gate. The refusal picture is unchanged: `ForeignStore` and `InvalidIdentity`
were already raised only from these two, and the enum stays `pub`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Soul's Cut 4 pass found one rule no test could reach and two with no test left
standing over them. F1 is the sharp one: `validate_pipeline_write_envelope`
raised `ForeignEpoch` for an identity envelope, but `EpiphanyPipelineIdentity`
had no constructor anywhere in the repo, so no test could build one to reach the
branch. Replacing the guard with `if false {` left all 168 tests passing. Code
that cannot be constructed cannot be tested, and testing it would have meant
writing the constructor the organ is going to own anyway.
So it goes, rather than growing a test to justify it. Deleted: the epoch branch
and the `ForeignEpoch` variant, `EpiphanyPipelineIdentity`,
`EpiphanyPipelineProvenance`, `PipelineProvenance`, `Faculty`, and
`PIPELINE_SCHEMA_EPOCH`, whose only reader was the deleted branch. D2 already
assigns admission, identity and the epoch refusal to `huginn-mind`; Cut 8 writes
them there against a store its tests can construct. Carrying about fifteen
unreachable lines across two repos costs more than re-adding them where they
work. Every one of the four types was checked for a live producer first: none
has one, in code, test, schema file or `index.json`.
What stays is what is reachable: `validate_pipeline_write_envelope` keeps its
bounds, formats and key recomputation, and `PipelineRefusal` keeps four variants,
each with a raiser.
Two tests for the two rules that survived Cut 4 untested. F2:
`decode_refuses_an_envelope_of_a_foreign_type` pins the `ForeignStore` refusal
against a commit receipt — a type a pipeline store may legitimately hold, and
still not a document. The existing round-trip test pinned only the positive
match. F4: `runtime_spine_cache_refuses_a_pipeline_store` restores coverage that
died with `pipeline_store.rs`, against the surviving mechanism in
`runtime_spine.rs`. It asserts first that `validate_runtime_store_epoch` passes
a pipeline store, because every neighbouring test is epoch-based and the epoch
checks cannot see this: the registry is the only thing refusing.
`register_pipeline_document_types` is now `#[cfg(test)]` instead of a live path
wearing `expect(dead_code)`. Its only callers are tests, and saying so is
honest; the organ registers its own types in Cut 8.
Builds: `cargo test -p epiphany-core --lib`, 170 passed, 0 failed, 0 warnings.
`cargo check -p epiphany-release-bundle --bin epiphany-state` clean. Mutations
for both new rules land with the next commit.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Cut 4. Rulings 14 and 15 moved the state off the repo: an instance owns its
mind and a service owns that state. Every layer that existed only to make a
repo-resident, git-committed, multi-clone store safe is now dead weight.
`epiphany-core/src/pipeline_store.rs` goes whole, 1,251 lines: the commit
profile, the epoch/foreign-type opener, the committed-blob checks, the
main-work-tree resolution, the read handle, the writer lease and its branch
binding, the holder record, and the 20 tests that pinned those rules. With it
go `PipelineWriterHolder` and its wrapper, `validate_pipeline_writes`, the two
`lib.rs` lines, the `.gitattributes` binary marker and the `.gitignore` lock
line. No Epiphany code can now open a pipeline store, take a lease, or read
git for pipeline purposes.
`pipeline_documents.rs` gains a local `PipelineRefusal` in place of the import.
D2 splits the landed thirteen variants: the six repo-store refusals
(`NotRepoRoot`, `NoMainWorkTree`, `StoreNotMarkedBinary`, `LockNotIgnored`,
`WrongBranch`, `WriterLeaseHeld`) die here, and so do `MissingIdentity` and
`Unavailable`, which lost their last raiser with the opener and the lease.
`ForeignEpoch` and `ForeignStore` stay because `decode` and
`validate_pipeline_write_envelope` still raise them; D2 hands them to the organ
when admission moves.
The seven document tests the cut map names, plus the schema derivation test,
move into `pipeline_documents.rs` rather than waiting for Cut 6, so no rule
sits unpinned in between. They lose the git scaffolding that has nothing left
to set up, and the key test now validates one envelope directly instead of
going through the deleted batch validator. Sample payloads that named the
deleted file were rewritten so the negative greps are honest.
This cut removes an owner and installs no replacement; the organ becomes the
owner in Cut 8.
Builds clean with no warnings: `cargo check -p epiphany-core --lib --tests`
and `cargo check -p epiphany-release-bundle --bin epiphany-state`.
`cargo test -p epiphany-core --lib` passes 168/168, down from 180: 20 tests
died with the file and 8 came back with the documents.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The first attempt at these two tests still failed no mutation, because in both
cases another check answered first. A test that only passes is not evidence; it
has to be the thing that fails when its own rule is removed.
The marker rule. `cut-3a.h1` and `cut-3a.s1` cite the wrong kind's marker, but
`h1` and `s1` are not digits, so the digits rule refuses them whether or not the
marker is required. `cut-3a.1` is the case that isolates it: a well-formed
number with no marker at all, which only the marker rule refuses.
The enclosing-repo case. A separate git dir in its own temp directory is refused
even without the `.git` check, because the parent is not a work tree and the
toplevel verification fails anyway. The case the check actually exists for is a
clone whose git dir sits inside *another* repo's working tree: there the common
dir's parent is a real, valid work tree, so without the check `main_work_tree`
resolves to the enclosing repo and the store lands in a tree that does not own
it. The test now builds exactly that, and asserts the enclosing repo's store is
never created.
Builds clean with no warnings; `cargo test -p epiphany-core --lib` passes
180/180.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The mutation pass found two rules that no test failed for, both because an
earlier check answered first.
The marker rule. Every bad parent in `parent_ids_are_parsed_strictly` also
violated the digits rule, so removing the `<marker>` requirement altogether
(Soul's S3) still refused every case and killed nothing. Two cases now cite the
right kind with a well-formed number and the wrong kind's marker, which only the
marker rule refuses.
The odd-layout refusal. `a_bare_clone_has_no_main_work_tree` asserted
`NotRepoRoot`, which a bare clone hits before `main_work_tree` is ever reached,
so `NoMainWorkTree` was unpinned and dropping the `.git` check failed nothing.
The test is renamed to `a_bare_clone_is_not_a_repo_root` for what it actually
pins, and `a_separate_git_dir_has_no_main_work_tree` covers ruling 10's odd
layout: a work-tree top level whose git dir is not a sibling `.git`, refused on
both the write and the read path.
Builds clean with no warnings; `cargo test -p epiphany-core --lib` passes
180/180.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
One store per clone, numeric attempt and pass, and identity enforced by the
profile that owns the commit. The three files change together because the
profile's validator signature, the documents that implement it and the store
that installs it are one interlocking contract; no smaller split builds.
Ruling 10, one store per clone. `main_work_tree` resolves the clone's main
working tree from any worktree through the git common dir, and both
`PipelineStore::open` and `PipelineWriter::attach` go through it, so a caller
in a worktree reads and admits into the main tree's store. A bare clone or any
layout without one main tree refuses `NoMainWorkTree`; there is no
worktree-only mode. `require_branch` binds to the main tree, so a campaign
whose branch is checked out only in a linked worktree is refused rather than
quietly given a second store.
Ruling 11, numeric labels. `attempt` and `pass` are `u32`, keyed
`cut-<cut>.h<N>` and `cut-<cut>.s<N>`.
Ruling 12, identity on first write. `TypedCommitStore` now validates a whole
batch against the image it will be applied to (`validate_writes`), replacing
the per-envelope hook rather than adding a second one. The pipeline profile
refuses a first write that does not carry the identity, so the single owner can
never admit a store its own opener refuses (F1).
F2: a finding label carries no dot and parent locals parse strictly, so two
documents cannot compose one key. Soul's collision pairs are tested.
F3: parent ids are parsed with an exact segment count, a campaign match, a kind
match, a validated local, and a marker followed by digits.
F4: a resolution's subject id is validated as a full id of its declared kind,
by `PipelineRef` itself, so kind and id cannot disagree anywhere.
F5: the ten document wrappers, the identity, provenance and holder wrappers and
their value fields are crate-private, and the crate's only commit path to a
pipeline store is a `cfg(test)` helper taking `&PipelineWriter`. Binding the
owner to the lease is Cut 3b.
F6: covered by ruling 10, with the previous claim corrected: a worktree does
not keep its own store, and a second attach from any tree is refused.
F7: the holder record is written only under the lock and removed on drop, and a
refusal names a holder only when it is plausibly current, matching host and
live process incarnation. A record left by a crash names nobody.
F8: the git checks read the committed blob at HEAD, so they answer the same on
every machine. Attribute and exclude files are nulled on every git child. The
working tree and `.git/info/exclude` deliberately do not count, because the rule
is about what the repository commits.
Low items: `value_types!` is the single field list, emitting each struct and its
`Bounded` impl from the same tokens, and format rules moved into the field types
(`Label`, `Slug`, `OrgRepo`, `FullSha`, `Sha256Hex`), so a field cannot be
declared without being validated and a list without a cap does not compile. That
applies the `Org/Repo` check to every repo field. `LandedNameKind` is deleted and
`LandedName` is a name and a path. The schemas carry `maxLength` and `maxItems`.
Builds clean with no warnings; `cargo test -p epiphany-core --lib` passes
179/179.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Cut 3a of the Eureka pipeline state campaign (cut map D1-D3).
- pipeline_documents.rs: the ten kinds as serde + JsonSchema values in
one-slot DatabaseEntry wrappers (epiphany.pipeline.<kind>.v1), the
identity, provenance and writer-holder documents, UTF-8 byte bounds,
semantic key derivation, and the pipeline write validator (bounds, then
key recomputation).
- pipeline_store.rs: PipelineStore::open (read-only, no lease),
PipelineWriter::attach (fs2 lock in the git common dir, display-only
holder file, binary/ignore checks), require_branch, PipelineRefusal,
and PIPELINE_COMMIT_STORE on the one commit owner. The opener refuses
foreign types, missing identity and foreign epochs before attaching.
- schemars 1 is an unconditional core dependency (Q5-A); the ten published
schemas are derived and checked byte-for-byte, with index.json entries.
The profile and the prepare path carry expect(dead_code) naming Cut 3b as
their consumer, so the attribute fails the build once admission uses them.
Builds: yes. cargo test -p epiphany-core --lib: 171/171, 0 warnings.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Soul's Cut 2 findings, fixed before Cut 3a.
- TypedCommitStore gains `backing_store: fn(&Path) -> Result<RuntimeSpineBackingStore>`,
and `open_cache` now takes the resolved store instead of a path. The owner
resolves the store once per commit and uses it for the cache load, the batch
CAS, and the conflict re-read, so a profile can no longer read one store and
write another. The hard-coded `runtime_spine_backing_store(store_path)` calls
in the owner are gone.
- `runtime_spine_cache` delegates to the new `open_runtime_spine_cache`, which
the Mind profile uses as its opener. The epoch check stays in that opener.
- The profile's implicit contracts are documented on the type.
- Tests: the test profile's backing store is a sibling of the commit path, so
re-deriving the store from the path fails; a foreign-epoch Mind store refuses
a commit with nothing written; a replay through a profile whose validator now
refuses the batch is refused rather than answered with the stored receipt.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Cut 2 of the Eureka pipeline state campaign, behaviour-preserving.
commit_authorized_mind_mutation stays the only code that builds receipts,
replays and runs batch CAS, but no longer hard-codes the Mind store:
- TypedCommitStore { store_id, open_cache, validate_write } is its first
argument.
- MIND_COMMIT_STORE = { "epiphany-mind", runtime_spine_cache,
validate_mind_write_envelope }, passed by all six wrappers.
- Deleted from the owner: runtime_spine_cache(store_path),
validate_mind_write_envelope(write), and the two "epiphany-mind"
literals on receipt versions.
The backing store for CAS stays runtime_spine_backing_store(store_path).
Tests:
- typed_commit_store_profile_owns_open_validate_and_store_id: a test
profile with a two-type registry and a key-refusing validator; a
refused write leaves the store byte-identical, and receipt versions
carry the profile's store id.
- mind_commit_store_profile_keeps_mind_validation_receipts_replay_and_conflicts:
through a Mind wrapper, Mind semantic-identity validation refuses
without writing, receipt versions carry "epiphany-mind", the receipt id
equals a pinned digest, exact replay returns the stored receipt, and a
stale strong read maps to Conflict naming it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Soul's Cut 1 finding F2: the two read pins only proved the seeded store
file's mtime was unchanged, so a store attached at a shadow path (every
read writing path.with_extension("shadow.cc")) survived all 156 tests.
state_cache_reads_without_writing_the_store and
persona_social_cache_reads_without_writing_the_store now snapshot every
directory entry (name, length, mtime) before and after the read, require
exactly the store and its lock file, and require the snapshot unchanged.
cultcache-rs at a0813c6 exposes no backing-store count on CultCache, so
the directory is the observable layer.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The re-pin swapped load_envelope for put_envelope on the claim that each
site's cache has no store attached, so put_envelope stays memory-only.
No existing test observed that: attaching the store in state_cache left
every resident_self test passing, because re-pushing the envelope just
read rewrites identical bytes.
Each test seeds its store, sets the file's modified time to a fixed past
instant, reopens the cache and requires the time to be unchanged. Any
push replaces the file through a staged rename, so attaching a store to
state_cache or persona_social_cache now fails the matching test. The
retirement-receipt site takes a snapshot slice with no path, so it cannot
acquire a store without a signature change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Cut 1 of the Eureka pipeline state campaign. Moves every CultLib
dependency from e171eca3 to main a0813c6.
- load_envelope was deleted upstream (CultLib 4ed9871). The 12 sites in
persona_conversation, persona_social_state and resident_self now call
put_envelope. Each site feeds a cache built with CultCache::new() in
the same function with no backing store attached, so home_index
returns None and put_envelope only inserts into memory, exactly as
load_envelope did. validate_envelope is byte-identical across the pins.
- add_generic_backing_store now returns Result; the three production
sites and five test sites propagate it with ?.
No ownership change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The worktree had been sitting on a partial `cargo fmt` run: 15 files reflowed,
mostly multi-line derive attributes collapsed onto one line, with no semantic
change anywhere in the diff. It was never finished -- `cargo fmt --check` still
flagged resident_readiness.rs, which the pass had not reached.
Completed rather than reverted, since the formatting is what rustfmt produces
and leaving it half-applied is the only bad option. 16 test binaries pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Epiphany carried three vendored copies: CultCache and CultNet as submodules on
their own branches of the retiring standalone repos, and a 491-line in-tree
CultMesh, a third Rust CultMesh lineage after CultLib's and Odin's.
None of it was load-bearing. Against CultLib the CultCache fork held nothing
unique, CultNet held one function that CultLib had all along but kept private,
and CultMesh held two thin delegations to CultCache. All three are now exposed
in CultLib, so this repoint needed no code changes at all: the workspace
compiles and its 16 test binaries pass against the pinned revision unchanged.
The submodule working tree also carried an uncommitted change, which turned out
to be a rustfmt reflow of one test expression. Nothing was lost with it.
Only the manifests move here. The in-flight epiphany-core work is left
uncommitted and untouched.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
