Carried summary lines must start YGG-SUMMARY/<nonce>:, the nonce exported into the
job; others are counted and ignored. Carried lines no longer drop failure sections.
Red summaries say NAMES MISSING when counts exceed names. wait trusts a .done only
when its run id matches .run; a missing summary never yields a bare exit 1.
mutation-table.sh must print the nonce prefix (separate branch).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SUMMARY=<log> keeps the full log and prints a bounded verdict summary;
wait <log> blocks at most 270 s and returns it once. mutation-table.sh runs
hand mutants in one verify job and returns a kill table. testparse.sh is the
one parser for both. Fixtures: real cargo and mutation logs from Yggdrasil
(tiny-crate), plus hand-written dotnet, vitest, pytest, exit-0-but-failed and
no-verdict logs. Every commit here builds; verified live on Yggdrasil.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Soul verdict eureka-substrate:verdict:cut-skill-recipes.s1 findings
stale-steward-recipe and defer-spec-live.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Applies references/tool-calling-cut.md section 5 under the section 8 rulings
(Q1 A, Q3 C, Q4 B). Briefs: agents wait in the foreground in calls of at most
270 s and never end a turn before the report; commits from Git Bash; every
dispatch names its model; agents cap at about 300k context or 150 calls.
SKILL.md: Self rotation rule, notify-before-report defect, Shared tools
section, sizing by calls, Yggdrasil limits corrected to the script's 5 slots
and 6 GiB. tools/INDEX.md lists ygg-verify.sh. Changelog quotes the rulings.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Operator ruling eureka-substrate:ruling:gap-home. The 19 gap-* follow-ups
moved from idunn-watchdog by superseding resolutions; the recipe and two
cited ids now name the new root.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cargo-mutants --jobs N workers all built into /src/target and tested each
other's binaries, so parallel kill counts were noise (idunn-watchdog Soul
s3). Cargo's default target dir is already inside /src.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Slot queueing, not compilation, dominates a Soul pass. Soul now reruns
the tests the cut touches while probing, runs the full suite once at the
end with its mutation run, batches probes, and mutates in parallel.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sccache 0.18.0 as RUSTC_WRAPPER with a shared eureka-sccache volume.
Idunn lib test build: 51 s cold, 29 s warm (83/83 hits). Slot wait, not
compilation, is the larger cost.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Exporting SHELLOPTS also exported a job's own `set -u` to every bash-wrapped
tool; kotlinc died on `JAVA_OPTS: unbound variable` (put-serve Hands, 2026-09-30).
Probed on Yggdrasil: `false | cat` in a child script still returns 1, and a
parent's `set -u` no longer reaches child shells.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul proved bash -o pipefail -c "bash job.sh" leaves the script without
pipefail; a failing piped test came back exit 0. Probe: false|cat exits 1,
true|cat exits 0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The gap table in campaign-state.md duplicated eight typed follow-ups; it now
gives the query instead. The first campaign no longer admits the list; every
campaign runs the query. Imagination edits the model page when a probe
changes a row. Stewardship is universal (operator, 2026-09-30).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Self's triage of Soul pass 2 on 272f5ca:
- Soul's rehydrate runs rulings in force, so standing operator directions
(including ones admitted after the spec) reach it, and it claims against
them. A verdict claim has no ruling reference, so Soul starts the claim
text with the ruling id; recorded as a substrate gap (epiphany-pipeline).
- Gaps table: a cold semantic embed exceeds the client's 15 s deadline
(Huginn, with the embedder).
- Self does not TaskStop an agent halted on Unavailable; it holds the
unadmitted record and is resumed when the organ answers.
- A fix batch's cut_report is the next attempt on the finding's in-force
cut_spec, on that spec's branch; landing elsewhere needs a revised spec
first (SKILL step 5, Hands brief).
- mutations holds survivors plus the kills Soul should rerun (at most 64);
totals go in verification evidence.
- InvalidInput and TooLarge are caller-fixable and retried after fixing
the call; only Unavailable after a retry and other errors stop.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Self's triage of Soul's first pass on hands/cut15-typed-state:
- Soul views every ruling the cut_spec cites and makes one claim per
ruling, beside the promises; Hands' self-report never bounds the pass.
- Only Self closes a finding Fixed, after a Soul pass on the fix holds.
Finding and verdict reads filter faculty Soul; faculty being
attribution-only joins a new substrate-gaps table in campaign-state.md.
- A fork before Hands' first commit ends the pass with the question
alone; the blocked-spec check reads questions raised in a spec.
- One rule for an organ that does not answer: missing tools stop, one
retry on Unavailable (admit replays are safe), then a resumable stop
that never sends the record as prose.
- Survivor triage goes in deviations, one entry per survivor, because
MutationRecord has no reason field (a recorded gap).
- The target document is written and committed before the campaign and
target cite it; Self's checklist names working_branch and target_doc.
- Operator directions are rulings with no answers and the words verbatim.
- One Rehydrate definition with a no-campaign / unknown-slug branch;
per-brief recipes; Eyes reads the mind read-only; the postmortem
template sources from the mind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
SKILL.md, briefs.md and README now route every faculty through the
instance's mind: Self calls whoami first and stops when the organ is
unreachable, admits stewardships, campaign, target and rulings;
Imagination admits questions and cut specs; Hands views its cut_spec and
admits a cut_report; Soul admits a verdict and its findings, staying
read-only on repos. Triage outcomes are resolutions and follow-ups, and
progress is a set of recipes instead of a status header. Briefs give ids
and recipe names and start with a Rehydrate block; they no longer paste
specs or rulings. "Record the substrate you needed and did not have" stays,
and its record is a follow_up. The errors-never-echo rule is unchanged.
Huginn Cut 15 (Epiphany notes/huginn-organ-cut.md at 74804d83), under Q-H6 A.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
references/cut-map.md becomes references/campaign-state.md: the
eureka-state tools, the typed document set with its keys, the admission
rules that shape a batch, the resolution matrix, the selection vocabulary
(aliases, roles, hops, projection, paging, semantic), and the recipes that
replace the status header and the deleted open_items, rulings_in_force and
history presets. The prose-map template shrinks to body facts, the model
page and rationale.
Huginn Cut 15 (Epiphany notes/huginn-organ-cut.md at 74804d83), under Q-H6 A.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
At 8 slots /proc/pressure/io showed full avg60=41% and live Odin fsyncs
stalled route challenges.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ygg-verify.sh gains a kotlin alias tagged by kotlin.Dockerfile's hash; the
remote build step is generalised from rust.Dockerfile to <name>.Dockerfile.
PowerShell comes from the GitHub tarball because the Ubuntu 26.04 base has no
Microsoft apt package. Proven with CultLib ack Cut K0: green on hands/ack-K0,
red on a deliberately failing self-test.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Measured 2026-09-30 00:17 CEST: 40% CPU idle, 53 of 62 GiB available,
~20 jobs queued, running jobs ~1 GiB each. 8 x 6 GiB worst case still
leaves the services their memory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An ack Cut 2 job piped a failing test run into cut and reported exit 0.
The rake was documented; agents kept stepping on it. pipefail now holds
for every job; the comment says what it still does not rescue.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Idunn verification now runs cargo check --target x86_64-pc-windows-gnu
--bin idunn-host so a Windows-only compile break is caught on Yggdrasil.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Git LFS's pre-push hook rejected the scp-style host:path remote and stalled
every Aetheria verify (found by Imagination and Soul, 2026-09-30). The mirror
never needs LFS objects; jobs that need one smudge it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On 2026-09-30 three hung test binaries held all three slots for up to an hour
at ~2% CPU while Yggdrasil sat at load 1.5 of 16. The operator wants
Yggdrasil pinned. CPU caps now oversubscribe on purpose (jobs run niced);
memory is the ceiling, so the per-job cap drops to 8 GiB. The watchdog samples
docker stats each minute and kills a container under 5% of a core for IDLE
seconds (default 900), reporting it red.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The watchdog subshell reported its own killed sleep as "Terminated" on
every job, successful or not. Agents read that as the job failing: one
Hands reported "the script reports exit 0 after Terminated even when the
job fails", which is false. Tested: exit 3 gives rc 3, and true gives rc 0.
Now the subshell's stderr is /dev/null and the TIMEOUT notice goes out
through fd 3. Checked: TIMEOUT=20 on sleep 60 prints TIMEOUT and exits
137, and a clean run prints no stray line. The watchdog is also reaped
with wait.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A Hands pass on Aetheria Cut 12.3 edited and built the main checkout by
using absolute Read/Edit paths, while its shell sat in the worktree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Operator ruling, 2026-09-25: Epiphany and Aquarium call this organ Life
(role id `reorientation`), and it is "a much better fit as the actual
load-bearing organ". The eureka-site landing page already says Life.
SKILL.md (frontmatter description, faculty table, dispatch lines, step 6,
model allocation), README.md and briefs.md now say Life. The role itself is
unchanged. SKILL.md defers to global doctrine for the agent type, which the
operator owns and which still says mind-steward. Dated records keep the old
name: changelog entries as written, a note on the 2026-09-15 Epiphany
comparison, and "then called Mind Stewards" in the CultCache postmortem.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Operator direction, 2026-09-25: moderate inference spend mainly by making
cuts smaller, so each Hands agent carries less context. Sonnet degrades at
about 0.5M tokens.
SKILL.md step 3 now owns cut sizing: Self estimates the brief, the source
Hands must read, one verification and one fix round, and the item count,
treats 0.5M as the danger line, splits when the estimate passes about half
of it, and checks the reported token total afterwards. The Self-owned
clauses ("Self sizes a cut", one fix batch per file) moved out of the Hands
brief template into step 3; the Imagination template's split clause names
the budget. Section 5 no longer frames the 2026-09-23 spend as misplaced:
the operator counts it as legitimate work, the regret being the model.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From the StreamPixels transport campaign, 2026-09-23 to 2026-09-24:
- SKILL.md section 5: quota is spent through scope. One Soul gate per cut,
fix batches only for critical-path findings, and narrow passes for
small deltas.
- briefs.md: one fix batch per file (800k and 550k runs); require a
non-zero test count for each named file; a failure called
"pre-existing" still needs a one-line cause.
- changelog: the evidence, with StreamPixels commit refs.
Staged by path. The unrelated uncommitted Ghostlight hunks in briefs.md
and changelog.md are left in the working tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The watchdog added in 9359e9c ran in a subshell that inherited the slot
lock's file descriptor. When a job finished early, `kill $watchdog`
ended the subshell but not its `sleep` child. That orphaned sleep kept
the slot for up to TIMEOUT seconds. Two slots were held this way on
2026-09-23, and four jobs queued behind them.
The subshell now closes the lock fd before sleeping, and the cleanup
kills the watchdog's children before the watchdog itself.
Tested on Yggdrasil: a fast job exited 0, and a TIMEOUT=15 hang exited
137 with the TIMEOUT line. Afterwards no sleep process held any
slot lock.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Investigating a QUIC interop failure (native bridge client vs .NET managed
server, both on libmsquic, both over loopback) needs to test IPv6-disabled
Docker networking as a hypothesis, which the script had no way to express:
no docker-args hook existed. DOCKER_ARGS is forwarded verbatim into the
container's own `docker run`, word-split by the remote shell, appended right
before the image name — e.g. DOCKER_ARGS='--sysctl net.ipv6.conf.all.disable_ipv6=0'
or DOCKER_ARGS='--network host'. Empty by default, so every existing caller is
unaffected.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A Cut 4 test process sat at 0% CPU for 25 minutes on Yggdrasil. It had
no JS work left, but its event loop never exited. The Hands agent
waiting on the job was never woken, and nothing moved until Self went
looking.
The job's container is now named, and a watchdog kills it after
TIMEOUT seconds (default 3600). Killing the docker client alone would
have left the container running. A timed-out job prints a TIMEOUT line
and exits 137.
Tested on Yggdrasil: TIMEOUT=20 on `sleep 90` exited 137 with the
TIMEOUT line, and a fast job exited 0. No containers were left behind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A job piped into tail loses its exit status, because the command runs under
bash -c and the sentinel then reports the pipeline's zero rather than the
job's. That is the same false-green the CRLF fix closed, arriving by a
different road, and it cost a Soul run today.
The second is smaller and just as costly to rediscover: CultLib has no
Cargo.toml at its root, so a rust job must cd into the package first or cargo
fails in a way that looks like a broken image.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A brief said "use ygg-verify.sh" where earlier ones gave the full path. The
agent could not find it, verified the whole batch on the operator's
workstation instead, and said so plainly rather than claiming the bar was met.
A name is a guess; a path is an instruction. The brief must also say what to
do when a named tool is missing: stop and report, never substitute, because a
substitution can silently relocate work onto a host the load budget forbids.
Second scar. A redundancy ruling of Self's was wrong for the second time in
one campaign, and this one shipped: a guard was deleted on the premise that
aliases are unique per descriptor, which the source contradicts, and a legal
document shape then faulted on every hop path. Both Self and Hands reasoned
from the same unchecked property. Build the input that would need the guard
and watch the other authority handle it, or the argument is just the claim
restated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
