diff --git a/SKILL.md b/SKILL.md index f67ef8f..acecf70 100644 --- a/SKILL.md +++ b/SKILL.md @@ -40,7 +40,7 @@ its own brief. A faculty that grades its own work has lost the point. | Faculty | Runs against | Admits | Must not | |---|---|---|---| -| **Imagination** | the Body (source, docs, probes), plus the target | `question`s and `cut_spec`s specified to `file:line`; body facts and rationale go to the prose map | commit code, choose a product fork silently | +| **Imagination** | the Body (source, docs, probes), plus the target | `question`s and `cut_spec`s specified to `file:line`, and `follow_up`s for work no cut owns; body facts and rationale go to the prose map | commit code, choose a product fork silently | | **Hands** | one `cut_spec` | small pushed commits, then one `cut_report` | redesign the spec, work around a fork | | **Soul** | Hands' *executed* commits | one `verdict` and its `finding`s | edit or commit a repo, or review a plan (a pass on a plan is Imagination) | | **Life** | memory surfaces | nothing: named mutations and proposals | touch Body code, restate what an owner records | @@ -59,14 +59,21 @@ finished when Hands can go straight to the cut. ### 0. Reach the mind, map the substrate, scope, target -- **Call `whoami` first.** If `reachable` is false, stop and tell the operator. - Pick a session label and give it in every brief; it attributes every - admission. +- **Check that the `eureka-state` tools are in this session.** If they are + absent, stop and tell the operator: a server registered after the session + started needs a new session. Never fall back to prose. +- **Call `whoami`.** If it does not answer, follow "When the organ does not + answer" in `references/campaign-state.md`: one retry, then stop. Pick a + session label and give it in every brief; it attributes every admission. - **Map the real substrate before you propose anything.** Run parallel read-only exploration of the old system and the new one, of any prior attempts and why they failed (git history, rollbacks), and of every consumer across repos. -- Admit the stewardships, the `campaign` and the `target` (Self's checklist in - `references/briefs.md`). The target holds the ends, not the means: labelled +- **Write and commit the target document first**, on the campaign's working + branch: its rationale, and the design truths the migration will produce. The + `campaign` and the `target` cite it by `DocRef`, and a `DocRef` names a + commit. +- Then admit the stewardships, the `campaign` and the `target` (Self's + checklist in `references/briefs.md`). The target holds the ends, not the means: labelled invariants that must survive (wire parity, one owner per decision, what the operator refuses to lose), and what is explicitly **not** a consumer. For example, AetheriaEve was "taxidermy", and saying so up front saved every later @@ -177,12 +184,15 @@ Templates are in `references/briefs.md` and `references/campaign-state.md`. ### 2. Operator rulings -Put the open questions to the operator together, from the open-items recipe, +Put the open questions to the operator together, from the open-questions recipe, each with its options, recommendation, and what depends on the answer. Self admits every answer as a `ruling` that answers its question, keeping the operator's words in `operator_quote` when they carry meaning a paraphrase would -lose. A ruling that changes an earlier one supersedes it by a `resolution`, -never by an edit, so the rulings-in-force recipe shows one live design. +lose. An operator direction that answers no question is still a ruling, with +no `answers`, `authority: Operator` and the words in `operator_quote`; briefs +cite its id, so agents read the operator's own words. A ruling that changes an +earlier one supersedes it by a `resolution`, never by an edit, so the +rulings-in-force recipe shows one live design. **The operator channel is this session.** Eureka has no Persona: Self is the operator-facing surface, because a question costs one message and loses no @@ -232,7 +242,9 @@ nothing is pasted or paraphrased. The brief says: - **Follow the spec, do not redesign.** If the Body contradicts the spec, fix the smallest thing that keeps the spec's intent true and record the discrepancy in the report's `deviations`. If it is a real fork, admit it as a `question` - raised in the spec, **stop, and report**. + raised in the spec, **stop, and report**. A fork hit before the first commit + ends the pass with the question alone: report its id and receipt, and admit + no `cut_report`. - **Gaps are filled in their owner, never worked around locally.** If CultMath lacks a function, CultMath gets it; the consumer does not grow a helper. - **Delete before adding.** No shims, no compatibility layers the map did not @@ -249,9 +261,10 @@ nothing is pasted or paraphrased. The brief says: name: a behavioural test is missing, a fixture is degenerate (see below), or the mutant is equivalent and gets a one-line reason. Boundary flips on float thresholds are equivalent by default and are not chased. The score is - not a gate; the triaged survivor list is the record. It goes in the report's - `mutations`, and a survivor that stays alive goes in `deviations` or becomes a - `follow_up`. Soul reruns the tool on the range rather than trusting Hands' + not a gate; the triaged survivor list is the record. Every mutation goes in + the report's `mutations`; each survivor also gets a `deviations` entry with + its triage, because the mutation record has no field for it (a substrate gap + in `references/campaign-state.md`). Soul reruns the tool on the range rather than trusting Hands' triage. - **No committed hand-written mutation suites, and no fallback harness.** The operator ruled this on 2026-09-22: "Better to have nothing than a @@ -322,8 +335,11 @@ not fine in the same working tree, and never while a Soul pass reads that tree. ### 4. Soul falsifies Brief Soul with the `cut_report` id and the session label. The report carries -the exact range and Hands' promises; the target in force carries the operator -invariants. Point Soul at the specific places a shortcut would hide. Soul: +the exact range and Hands' promises. **Soul's claims are not bounded by what +Hands chose to promise.** Soul also views every ruling the `cut_spec` cites and +makes one claim per ruling, and measures the target invariants the cut touches. +Hands' self-report is one input to attack, never the list of what gets checked. +Point Soul at the specific places a shortcut would hide. Soul: - reruns builds, tests and captures itself instead of trusting the report; - reruns a selection of Hands' mutations, and designs its own that are not plain @@ -333,8 +349,8 @@ invariants. Point Soul at the specific places a shortcut would hide. Soul: real compiler, run the other runtime's decoder; - checks the invariant at the layer where it would actually fail (wire bytes, another runtime, the editor, the GPU), not only in the unit test; -- admits one `verdict`, measuring every promise in the report, together with - its `finding`s: each `Confirmed` or `Plausible`, with locations, a failure +- admits one `verdict`, with a claim for every promise and for every cited + ruling, together with its `finding`s: each `Confirmed` or `Plausible`, with locations, a failure scenario, a severity and the target invariants it breaks. Soul works read-only on repos. It creates temporary worktrees for anything that @@ -358,8 +374,8 @@ exists. For each finding in force, decide: -- **fix now:** brief Hands with the finding's id; the landing closes it - `Fixed`; +- **fix now:** brief Hands with the finding's id. Only Self closes the finding + `Fixed`, and only after a Soul pass on the fix's report holds; - **operator fork:** a `question` raised in the finding, with a recommendation; - **defer:** a `follow_up` with the reason it can wait, and the finding resolved `Deferred` to it; @@ -408,7 +424,8 @@ later. After each cut: - Progress is a query, not a section to update: the recipes for specs with no - report, reports with no verdict, and open items. + report (minus those blocked on a question), reports with no verdict, and open + questions, follow-ups and findings. - Self reconciles the subtraction ledger with the ledger recipe (each spec's `estimate` against its reports' `structural_delta`). A miss is allowed, but it must be explained. The CultCache core missed its size @@ -429,10 +446,11 @@ and reconciles the target doc with the Body. query it. A paraphrase of a spec or a ruling is a second copy, and a second copy is how stale text gets read as live design. Tell the operator what matters in words. Tell agents the id. -- **When the organ is unreachable, stop.** Say so to the operator and wait, or - work on something that does not touch campaign state. Never keep the record in - prose or memory "until it is back": that is a second copy, and it breaks the - invariant that the mind is the only store. +- **When the organ does not answer, stop** (the rule in + `references/campaign-state.md`). Say so to the operator. Continue a stopped + agent with `SendMessage` once `whoami` answers. Never keep the record in prose + or memory "until it is back": that is a second copy, and the mind is the only + store. - **Keep the prose map current.** After a ruling changes a design, sweep the map's body facts and rationale, and the target doc, for the old version the same day. The specs and rulings need no sweep, because their resolutions @@ -479,7 +497,8 @@ and reconciles the target doc with the Body. is remembered only as "the docs got messy". This is not a reason to wait on the missing thing or route work to it: work around it and leave evidence. The evidence is a `follow_up` whose source is the document where the run felt the - gap, and whose owner is the missing thing's owner. + gap, and whose owner is the missing thing's owner. The gaps already known are + listed in `references/campaign-state.md`. - **Never claim an agent's result before its notification arrives.** ## Git and tooling rules (scars) diff --git a/references/briefs.md b/references/briefs.md index 7959e17..81d8fa1 100644 --- a/references/briefs.md +++ b/references/briefs.md @@ -9,7 +9,10 @@ ruling or a finding. The agent reads those itself. Recipes are in Every brief that reads or admits campaign state carries: - the campaign slug ``, and the session label `` for its admissions; -- the Rehydrate block below, as the agent's first step. +- the Rehydrate block below, as the agent's first step, with `` set to + the recipes that brief names. + +This block is the one definition of rehydration; the other files point here. ## Contents - Rehydrate (every faculty that touches campaign state) @@ -26,15 +29,19 @@ Every brief that reads or admits campaign state carries: ## Rehydrate ``` -Campaign state lives in the instance's mind, through the eureka-state tools. -1. Call whoami. If reachable is false, stop and report that; do not work from - prose or memory instead. -2. Run the recipes named for your faculty in references/campaign-state.md, - with root = . -3. view any id this brief names. +Campaign state lives in the instance's mind, through the eureka-state tools +(whoami, admit, view, query). Recipes are in references/campaign-state.md. +0. If those tools are not in your tool surface, stop and report that. Never + work from prose or memory instead. +1. Call whoami. On Unavailable, retry once; if it still does not answer, stop + and report the error. Self will continue you once the mind answers. +2. Run the campaigns recipe. If there is no campaign, or is not among + them, stop and report which. +3. Run , with root = , and view every id this brief names. Admit as faculty , agent , session . A refusal -names the rule that refused: fix the batch and admit again. isError means no -answer: stop and report it. +names the rule that refused: fix the batch and admit again. Retrying an admit +is safe (AlreadyAdmitted). Any other isError, or the mind going away mid-pass: +stop where you are and report the step; never send your record as prose. ``` ## Self: open a campaign, rule, triage @@ -42,20 +49,30 @@ answer: stop and report it. Self's own checklist; Self admits as `SelfFaculty`. ``` -Open: whoami (the mind's instance document, :instance:self, already -exists). For each repo in scope with no stewardship in force, admit a -stewardship (sequence = latest + 1). Then admit the campaign (every repo a cut -may touch) and target revision 1 (labelled invariants, not in scope, -canonical implementations, doc = the committed target document). +Open: check the eureka-state tools are present, then whoami (the mind's +instance document, :instance:self, already exists). Write the target +document and commit it on the working branch. For each repo in scope with no +stewardship in force, admit a stewardship (sequence = latest + 1). Then admit +the campaign (slug, title, every repo a cut may touch, working_branch, +target_doc = a DocRef to that commit) and target revision 1 (labelled +invariants, not in scope, canonical implementations, doc = the same DocRef). +In the first campaign, admit a follow_up for each substrate gap listed in +campaign-state.md. Rule: for each operator answer, a ruling (answers, choice, authority, and -operator_quote when the words matter). A changed ruling carries a resolution -superseding the old one, in the same batch. +operator_quote when the words matter). A direction that answers no question is +a ruling with no answers, authority Operator, and the words verbatim in +operator_quote. A changed ruling carries a resolution superseding the old one, +in the same batch. -Triage each finding in force: a Hands brief (Fixed on landing), a question -raised in it, a follow_up plus a Deferred resolution, or a Recorded or -Withdrawn resolution. A missing tool or surface a faculty worked around is a -follow_up owned by the missing thing's owner. +Triage each open finding: a Hands brief, then a Fixed resolution admitted by +Self only after a Soul pass on the fix's report holds; a question raised in the +finding; a follow_up plus a Deferred resolution; or a Recorded or Withdrawn +resolution. A missing tool or surface a faculty worked around is a follow_up +owned by the missing thing's owner. + +Before a Hands brief, check that the spec is not blocked by an open question +raised in it (campaign-state.md, specs with no report). hand_off is parked (Huginn Cut 12): one mind, no transfer. ``` @@ -70,8 +87,8 @@ You are Imagination for . Produce the model page in . Do not map cuts, do not write code, do not commit; the root agent commits. -Rehydrate (recipes: rulings in force, open items; view the target in force). -Read enough of the Body to enumerate the persistent kinds. +Rehydrate (recipes: target in force, rulings in force, open questions and +follow-ups). Read enough of the Body to enumerate the persistent kinds. Give one table, a row per persistent kind: - Identity: what names it. Is the namespace stated? Is the name injective? Can @@ -100,8 +117,9 @@ prose map at , edit only body facts and rationale. Do not commit; the root agent commits. Do not change code in any repo. Scratch probes in are fine. -Rehydrate (recipes: rulings in force, open items, specs with no report, one -cut's record for ; view the target in force). +Rehydrate (recipes: target in force, rulings in force, open questions and +follow-ups, specs with no report, one cut's record for ). Body facts to verify (not trust): - @@ -130,18 +148,23 @@ verification. Where only the operator can decide, admit a question with a recommended option, raised in the spec it blocks. -Report: the ids you admitted, findings you could not assign to a cut, and the -HEAD you pinned to. +Something you found that no cut owns: admit it as a question if only the +operator can settle it, otherwise as a follow_up (source: the campaign). + +Report: the ids you admitted and the HEAD you pinned to. ``` ## Hands: execute a cut ``` -You are Hands for . The spec is . Rehydrate, then view the -spec and each ruling it cites. Follow the spec; do not redesign it. If the Body -contradicts it, fix the smallest thing that keeps its intent true and record the -discrepancy in the report's deviations. If you hit a real operator fork, admit -it as a question raised in the spec, stop, and report. +You are Hands for . The spec is . Rehydrate (no recipes: +view the spec and each ruling it cites, operator directions included). Follow +the spec; do not redesign it. If the Body contradicts it, fix the smallest +thing that keeps its intent true and record the discrepancy in the report's +deviations. If you hit a real operator fork, admit it as a question raised in +the spec, stop, and report. If that happens before your first commit, the pass +ends there: report the question id and its receipt, and admit no cut_report +(a report needs a commit). Repo/branch: at HEAD . Check that git status is clean first. Pinned siblings: . Do not change them. @@ -165,10 +188,12 @@ cites, read by id): Every rule the spec or the operator names gets a behavioural test. Measure the suite with , scoped to this cut's diff (`--since:` or the tool's equivalent), against the final spelling of the -code. Triage every survivor in the report's mutations by name and line: killed -by a new test, killed by fixing a degenerate fixture, or equivalent with a -one-line reason. A survivor that weakens a rule and cannot be killed goes in -deviations, not hidden. Code no tool reaches gets behavioural tests at the layer where the +code. Record every mutation in the report's mutations. Triage every survivor +by name and line: killed by a new test, killed by fixing a degenerate fixture, +or equivalent with a one-line reason. The mutation record has no field for that +reason, so each survivor also gets one deviations entry (what: its label; why: +the triage). A survivor that weakens a rule and cannot be killed says so there, +not hidden. Code no tool reaches gets behavioural tests at the layer where the rule is decided, never a committed mutation suite (operator, 2026-09-22). A fix for a proxy-for-truth defect is not done until every other site that draws a conclusion from the same class of evidence has been enumerated and @@ -304,7 +329,7 @@ narrative of the pass, no restating the brief or the report. ``` You are Soul for . Soul preserves invariants by falsifying the promises Hands made about executed work: shortcuts, split authority, trivial tests. -Admit findings only. +Admit one verdict and its findings, and nothing else. - Do not edit or commit in any repo. - Restore after every mutation and leave the tree clean. - Use a temporary detached worktree for other checkouts, and remove it @@ -318,12 +343,15 @@ Admit findings only. Yielding to announce the wait is the same violation: block in-turn or read the finished output, never end the turn to say you are waiting. -Scope: . Rehydrate, then view the report (its range and its -promises), the cut_spec it cites, and the target in force (the operator -invariants, by label). Admitting your verdict is a write to the mind, not to -a repo. +Scope: . Rehydrate (recipes: target in force, one cut's record +for ), then view the report (its range and its promises), the cut_spec it +cites, and every ruling the spec cites. Admitting your verdict is a write to +the mind, not to a repo. -Falsify every promise in the report, and specifically: +Hands' promises are one input, not the boundary of the pass. Falsify every +promise, every ruling the spec cites (operator directions included, in the +operator's own words), and every target invariant the cut touches, and +specifically: - - ) and its findings in one batch: - one claim per promise in the report, Holds, Falsified or Unproven, each with its evidence (the numbers: test counts, entries killed, the survivors you retriaged) and the report's mutation labels it reran -- claims of your own for what you attacked beyond the promises +- one claim per ruling the spec cites, naming the ruling id, whether or not + Hands promised anything about it +- claims of your own for what you attacked beyond those - each finding Confirmed or Plausible, with its locations (file:line), failure scenario, severity, origin, and the target invariant labels it breaks. A Falsified claim names a Confirmed finding. @@ -389,8 +419,9 @@ cut unless an invariant moved. ``` Phase boundary: . The authoritative record is -the campaign's mind (read it through the recipes; you admit nothing) and the -prose map and target doc; don't edit those. +the campaign's mind and the prose map and target doc; don't edit those, and +admit nothing. Rehydrate (recipes: rulings in force, open questions and +follow-ups) to check memory against the mind. Surfaces: . @@ -418,7 +449,8 @@ what was missing and what it would have prevented. ``` You are Eyes. Read only. Write findings to /.md and return a -short summary. +short summary. You read the campaign's mind with query and view only, through +the Rehydrate block (recipes: ); you never admit. Sources: - diff --git a/references/campaign-state.md b/references/campaign-state.md index c60ccb1..e18dca3 100644 --- a/references/campaign-state.md +++ b/references/campaign-state.md @@ -41,8 +41,23 @@ The instance and the daemon are the server's configuration answers `AlreadyAdmitted`, so retrying a batch is safe. - **`isError: true` means no answer:** `Unavailable` (the daemon is down or unreachable), `Rejected` (it refused the envelope), `Misconfigured`, - `TooLarge`, `Unencodable`, `InvalidInput` or `Internal`. When this happens, - stop and say so. Never keep the record somewhere else meanwhile. + `TooLarge`, `Unencodable`, `InvalidInput` or `Internal`. + +### When the organ does not answer + +This is the one rule for every faculty. + +1. **The tools are missing** from the session's tool surface: stop and tell the + operator (a subagent tells Self). A server registered after the session + started appears only in a new session. Never fall back to prose. +2. **`Unavailable`:** retry the same call once. A cold semantic embed after an + idle spell took over 15 s live, which is the client's whole timeout. + Retrying `admit` is safe, because an exact replay answers `AlreadyAdmitted`. +3. **Still no answer, or any other `isError`:** stop. A subagent reports the + error and the step it stopped at, and stays resumable: Self continues it + with `SendMessage` once `whoami` answers. Never send the record to Self as + prose, and never keep it anywhere else meanwhile. The mind is the only + store. ## The document set @@ -57,12 +72,12 @@ mismatch. The root is the campaign slug, or the instance for `instance`, | `campaign` | `self` | Self | title, repos (each stewarded), working branch, target doc | | | `target` | `r` | Self | invariants (`label`, `statement`), not in scope, canonical implementations, doc | | | `question` | `