The cell that acted is second in the frozen order; the first is in flight when
the run ends. Closes the order dependence budget_exhausted_stops_before_the_clock_and_resumes
only passed around.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A row that carries its submission body is resumed whatever the caller's scope
digest (the world answers it by command id); a row still in flight keeps the
digest gate. World and scope must always match. GroupedRun.refused names each
constituent that did not commit (LeftBeforeSelection, ScopeChanged,
WorldRefused); needs keeps decode problems only. A group submits declines
first, then exercises in the world's attention order read once.
Not verified at this commit (written before the first build).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The tick index is the world's TimeAdvanced count, read through a driver-only
mailbox door, and derive_cover takes it instead of now and the span. A tick
document ghostlight.verse_tick.v1 is written before the first cell and read by
any later run, so a resume under another span or cover budget finishes the open
tick as it was opened. The clock id is clock_command_id(world, ordinal) and is
pinned by a test. TickIndex::of and run_tick's per-call derive_cover are gone.
Fixes findings resume-rederives-tick-identity, tick-identity-collides-across-spans,
clock-id-unpinned. Not yet built or run at this commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pins the operator-log cut at the tick's start revision against the act the
interrupted run left at that very revision. Builds; the mutation pass named it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pins the exit status of a Failed run against a provider that refuses every call,
and the positive-integer guard for ticks and token cap. Builds; the earlier
mutation pass named these as survivors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A run that ends inside a tick (budget, pending cell, failed clock) now keeps
that tick's checkpoint with closed false, so what its cells committed is not
lost. A cell that committed before an interruption meets a moved scope
digest when the tick resumes and is refused as ScopeMoved; nothing commits
twice. Removes the temporary diagnostic. Builds; not yet re-verified.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The faction that acted holds no opportunity until the clock moves, so the open
tick re-derives with one cell. Builds and passes except this assertion, which
this commit corrects.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
run_manual advances the verse world tick by tick under the recording port's
token cap: snapshot, opportunities and agency graph from the mailbox,
derive_cover, each cell on its members' current opportunities, one clock
advance, a checkpoint in ghostlight.verse_run.v1. A tick that cannot finish
leaves the clock where it was, so a later run re-derives the same cells and
command ids and the kernel answers from its ledger.
WorldMailbox::opportunities is the tick driver's own door beside agency_graph.
OperatorEvent now names the verb, its render path and the bound roles.
Not yet built or tested: this commit is the first write of the pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pins the trim of a faction Name into its institution label, genesis twice
(same intent: same receipt, nothing changes; another command id:
CreationTargetOccupied), and, as evidence for the open question
ship-acts-are-not-speech, that a phase A ship verb commits only as an
utterance. Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CreateVerseWorldIntent lowers to one CreateWorld bound to the catalog's
grammar: a commons, one affordance per non-speak grammar verb (the kernel
supplies speak), and per faction an import-keyed institution granted every
verb plus a canonical fact citing aetheria:<commit>:aetheria.faction/<key>.
WorldMailbox::create_verse sends it through create_authenticated. The role
lowering moves into GrammarVerb::role_specs, which admits_roles now uses.
Also pins the reader's non-string allegiance key and invalid-UTF-8 refusals.
All commits build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The store re-sorts rows it writes, so the reversed-rows test never reached the
reader unsorted. Both file-shape tests now splice raw snapshot rows. Builds;
test-only change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The store's writer keeps one row per record key, so the previous test never
held two rows. Builds; the test crate is the only change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reader mints every faction and allegiance ImportKey and refuses a
non-canonical one as a typed NonCanonicalKey naming record and field (0 or 12);
two faction rows under one record key are DuplicateFaction. Payloads decode
through rmpv so a MessagePack bin or ext cell at a higher key (C# byte[],
DateTime) no longer fails the record. Tests pin the record-key sort and a
non-map Allegiance. Schema-version check (item 2) not done: CultLib gap.
All commits build (not yet run; the suite runs next).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Aetheria-written fixture binds only Faction, Cargo and Place, so mutants
deleting the Person and Population arms survived. The new test authors each
code at the role's key and reads it back as its own kind. Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
read_aetheria_catalog opens the catalog read-only, mirrors
aetheria.verse_grammar, aetheria.verse_verb and aetheria.faction by integer
key, and refuses unknown enums, bad verb or role names and a missing grammar
by record key. Fixture written by Aetheria's own fixture writer at master
92b82e9a (provenance beside it). Also the NFD/NFC position sweep for import
keys. Not yet built or run when committed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The replay-key test now covers schema_id, reasoning_summary,
output_format_name, tool_choice and prompt_cache_key beside the ten it
had, over a Vec so a future keyed field is one more row. Tests only;
every commit builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tests only, no production change. Both build. A late NFD sequence and a
late format character in a long lore-shaped path kill an is_nfc-on-prefix
mutant; a resolved effect carrying two subjects with one key kills a
fresh declared set in admit_resolved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The run ledger is the one owner of what a run began as: its cap and the
world id and state digest it started from. Replay takes the store, the run
and a restored world and refuses a different world up front with a typed
error naming the field. Restores the decode checks the ledger rules do not
imply, makes the replay key an exhaustive destructure, and pins the
over-bound edge. Not yet built or tested at this commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul's forgeries shaped as real keys (NFC vs NFD, ZWSP, NUL, BOM, RLO, BEL,
double space, tab, NBSP), a lore path with spaces admitted, and a loaded
state with a shared or malformed key refused. Test-only commit; builds if
the prior commit does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The record key is canonical free text per ruling import-key-canonical-text
(NFC, no Cc/Cf, only U+0020 whitespace, no edge or doubled space). The
resolver, admit_resolved and verify_state_shape all call the same predicate
and import_key_fault; admit_resolved's second held-set iteration is deleted.
Adds unicode-normalization and unicode-properties. Not yet verified on
Yggdrasil; build status of this commit unproven.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ImportKey (schema, record) rides SubjectDeclaration and SubjectState as an
optional field (serde default, skipped when None, so keyless worlds keep their
digests) and is exposed on SubjectSnapshot. resolve_patch, the one resolution
owner for genesis and the owner, consumer, Play and elaborator doors, refuses a
malformed key, a key declared twice in one patch, and a key any existing subject
holds, retired included. admit_resolved, the subjects map's only writer, holds
the same injectivity as an invariant. Typed mismatches name the handle only.
Compile-checked (cargo check --tests) on Starfire; tests not yet run, so no
claim that this commit's tests pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A record with a run id that is no key segment has no readable ledger, and a
record at sequence zero fails the density rule at open; the two decode_row
conditions were equivalent mutants (cargo-mutants missed both). Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner declares unanswered only in Draft, and the forged-effect twin refuses
a kind the world already holds. Test-only; builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GrammarBinding::refusal is the single grammar predicate. The resolver maps it
to Mismatch, and admit_resolved (the catalog's only writer, reached by
apply_effect) maps it to an Invariant error, so an effect resolved elsewhere
cannot install an out-of-grammar entry. The speak entry must also be bound as
a Conversation verb (Mismatch::SpeakRenderPathDisagreesWithGrammar).
Tests: owner, play, consumer and elaborator doors refuse kind and role
signature after the revision has moved past genesis; speak bound as ShipAction
is refused at bind; apply_effect refuses a forged effect.
Builds (cargo check --tests, Starfire compile only). Merge of origin/main
8d263bb was mechanical (no conflicts).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two reserve mutants timed out because the test spun waiting for a call a
mutant had refused. The wait is now bounded and fails. Builds: yes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The in-memory run tally no longer counts rows (only open used it); the store
test pins a record whose run id is not a key segment; the lend_tool_results
forwarding has a test; the in-flight test fails by timeout instead of hanging
when a held call is let through. Builds: yes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ProviderCallRecord (ghostlight.verse_provider_call.v1) keyed (run id, sequence),
CallRecordStore over an owned redb CultCache file, RecordingInferencePort
(bound check before the call, real usage charged after, record written before
the output returns) and ReplayInferencePort. InferenceFaultClass gains
BudgetExhausted. Not yet compiled or run: this commit may not build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follow-up hosted-key-del-pin: a mutant allowing DEL survived the key-shape
test. The case list gains an interior DEL. Builds: yes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds hosted_binding_refuses_a_key_shape_that_cannot_ride_a_header (interior
newline, CR, tab, NUL, leading space, trailing space, non-ASCII, leading
newline; typed refusal at open, no key or path echoed) and the missing
prompt_tokens half of the usage-absence test. Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
key-shape-late-fault: the key must be one run of visible ASCII after the trailing
newline is stripped; an interior newline, whitespace, control or non-ASCII byte
is refused at open with HostedKeyUnreadable, which names no value.
null-count-widened: a present-but-null prompt or completion count fails to
decode (BadReply, integrity violation) on both lanes as the local lane did
before the cut; only an absent count or absent usage is a typed absence.
Builds: yes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
InferenceOutput gained a persisted usage field without a version bump, so a v17
row written before the cut was refused at open as not canonical. Rows now bump
to v18 the way the v16 -> v17 bump did: the earlier version is refused at open
with the store's named fault, not migrated; the recipe slot, its drift check and
the ontology doc move with it. The earlier-version refusal test now pins v17.
Builds: yes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The empty, newline-only and padded key cases all pointed at one file that the
last write replaced, so the production empty-key check was never exercised
(cargo-mutants survivor 544:23).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CreateWorld gains an optional GrammarBinding (schema id, revision, content
digest derived from the kind-sorted verbs, never caller-supplied). Genesis
installs it on the empty state, so resolve_patch checks the genesis patch and
every later AdmitPatch against it: an affordance kind the grammar lacks is
AffordanceKindNotInGrammar, a differing role signature (name, referent kind,
order) is AffordanceRolesDisagreeWithGrammar, and the kernel speak entry is
held to the same check. WorldSnapshot reports the grammar's identity and each
AffordanceSnapshot derives its render path from it. Worlds with no grammar
are unchanged: the field is absent from state and command bytes, pinned by a
journal written at base 367e2eb.
Builds: not verified on Yggdrasil yet at this commit (cargo check clean locally).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
