The failed-upsert revert test now expects chunks of two commits, since
nothing is deleted before the new chunks land.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Source refresh now upserts a repo's new chunks first and deletes what is
left in scope under another commit afterwards, so a failed embed never
removes indexed content (embed-outage-empties-repo). The cursor is still
dropped before the first write.
The pool's reserve endpoints use EmbedBounds::RESERVE (30 s a text, 60 s
floor) instead of the GPU default (reserve-bounded-like-a-gpu).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Retirement aborted the run on the first repo whose delete failed; it now logs,
names the repo in Refreshed.failed and goes on, leaving that repo's cursor and
mirror to be found again. Names are compared as written, so a repo the forge
now spells in another case is retired under its old spelling instead of kept by
a case-insensitive match while its points carried the old name (Soul
retire-edge-cases).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Retirement read the repo list as complete, so an empty or truncated answer
would have deleted every repo it failed to name (Soul catalog-shrink-retires).
The catalog now carries a shortfall: the pages summed before filtering are
checked against X-Total-Count, and a missing header counts as unvouched. The
run refuses to retire on a short or empty catalog, refreshes the repos it did
see, says so in Refreshed.retirement_withheld, and huginn-sources exits 1.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A failed run from A to B followed by a head C that reverts the files to A's
content diffed A..C as empty and kept the deleted chunks deleted (Soul
cursor-revert-hole: 32 of 40 chunks, cursor at C). With the cursor gone the
next run takes the whole-repo path whatever head it finds.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
query-embed-on-cpu, follow-up daemon-embedder-gpu-pool: huginn-daemon takes
repeated --ollama-url (GPU hosts) and --reserve-ollama-url (CPU hosts) and
builds the same EmbedderPool as huginn-sources, through one ollama::pool
constructor. A lone --ollama-url is a pool of one.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
pool-blackhole-stalls: each due endpoint's identity is read on its own thread
under a 5 s bound, and a batch waits for reads only while no healthy primary
exists to start on, so a dark endpoint never delays work a healthy one can do.
pool-pins-first-identity: the pool is told the model the collection was built
with (Embedder::built_under, called by reconcile and refresh before the
identity read) and never writes with an endpoint serving another; it adopts a
model only when there is no collection, in list order.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Twenty members, top_k 15 and 200: the index limit and the row count are both
asserted. Unverified at this commit: built and tested once at the end of the batch.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
filter and params are asserted by value, so must_not and a top-level exact
fail. live_index_smoke searches a strict subset that leaves out the nearest
point. Unverified at this commit: built and tested once at the end of the batch.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The mind decides membership (Mind::members) before the index is asked; the
index scores exactly the members (Qdrant has_id + exact) and the page carries
one cosine score per row. Deletes OVERSAMPLE_MAX, the x4 oversample, the
unfiltered VectorIndex::search contract and check_semantic.
Not yet compiled when committed: the first Yggdrasil run follows.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The shared request decoder (envelope.rs) no longer quotes decoder text or
envelope fields: a refusal names the field path and the class. MindStatus.persona
is PersonaStatus {Absent, Stored, Unreadable}, so whoami answers in the persona
door's own terms.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
put_persona replaces the mind's gamecult.persona_state.v0 whole through the
commit primitive: schema-valid against the published file, personaId is the
instance, canonical provenance, CAS on updatedAt, monotone updatedAt. The
document is an opaque seventeenth stored type, one per mind. Wire operations
persona_get and persona_put, MindStatus.persona, HuginnClient methods and the
eureka-state persona tools. Published wire schemas follow in the next commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rust-toolchain.toml owns which rustc and clippy judge the tree. View in
HuginnMindResponse is boxed so the large_enum_variant allow on the wire
type is deleted; the PipelineDocument allow keeps a sharpened reason.
Type aliases, is_multiple_of, slice::from_ref and a literal refused()
clear the rest. Wire bytes and schemas are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds Absent, Symbol, ReadAnchor and read_window_is_bounded, the marker in
value_types!, the workspace fixtures and the reads admission test. The
golden file and the six published schemas are not regenerated yet, so the
golden, schema and wire-schema tests fail at this commit (it builds).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the AGPL-3.0 text as LICENSE and set the workspace license to
AGPL-3.0-only (rulings license-split, leaf-relicensed-agpl); the leaf's
provenance (Epiphany ef956865, PolyForm Noncommercial, relicensed by its sole
copyright holder 2026-10-09) is recorded in its Cargo.toml and README.
One [workspace.dependencies] entry per CultLib crate now owns the revision;
the crates inherit it. index.json lists Huginn's two wire schemas too, and the
catalogue test drops its huginn. prefix exclusion: every schema file is listed.
README and AGENTS stop naming Epiphany notes as the owner of the cut.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Package and lib become eureka-pipeline / eureka_pipeline; the crate joins the
workspace; huginn-mind's git dependency on GameCult/Epiphany is replaced by
the path, and Cargo.lock is regenerated (the Epiphany source entry is gone).
Every epiphany_pipeline mention in huginn-mind, huginn-daemon and eureka-state
is renamed. The schema-publication test reads ../../schemas/cultnet. The
leaf's license-file key (../LICENSE, which Huginn has no file for) is dropped.
Type ids, the epoch and every schema_id string are untouched. Schemas README
and the pipeline section of schemas/cultnet/README.md are rewritten for the
new home; README and AGENTS no longer say the leaf is pinned by git. New test:
the catalogue lists exactly the schema files beside it.
Not yet built or tested; verification follows on Yggdrasil.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eureka-state on Windows could not reach the daemon: the cultnet-rs RUDP
client bound 127.0.0.1, and a loopback-bound socket cannot send to
10.77.0.1 (os error 10051). CultLib 8fc74c7 binds the unspecified address
for a remote endpoint. The daemon and the client move together, because
the ack cuts between the revs changed the RUDP handshake.
epiphany-pipeline moves to Epiphany 73edee5, which pins the same CultLib,
so one cultcache-rs is in the graph and the pipeline's CultCache types
stay Huginn's.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MAX_DEFERRED_BODY_BYTES was the daemon's constant, but a client caps its
content fetch at the same number, and the client crate cannot depend on the
daemon. It moves to huginn-mind::wire next to the response schema it bounds;
the daemon imports it, the pin test stays in bodies.rs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
envelope.rs (encode/decode request and response, OperationFailure,
FAILURE_SCHEMA) leaves huginn-daemon for huginn-mind, next to the wire types
it wraps. The daemon imports it and no longer re-exports it. base64 moves
with it; the daemon keeps base64 because serve.rs measures and decodes
payloads. schemars leaves the daemon, whose only user was the envelope's
OperationFailure derive. The two envelope tests run unchanged from their new
home on huginn-mind fixtures.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two mutants survived Soul pass 4: dropping `self.settle()` from reconcile,
and dropping `!projector.stale()` from take_search. One test each.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Losing a collection the worker found whole at start-up is a rebuild. The
mutation that left Build::Unbuilt in place on a matching label survived,
because nothing observed the difference until the collection was lost.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The test read the queued search's due moment through the sink's lock right
after asking, but the worker can take the search first: it failed under the
load of cargo-mutants' baseline run. The stamp is pinned without a worker in
the_sink_owns_the_searchs_deadline_and_tells_the_loop, which is the test that
owns it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
S1. serve_search absorbed the inbox and judged pending under one lock and
popped the search under a second, so an admission acknowledged before the
search was asked could be missed. The absorb, the judgement and the take are
now one critical section, and take_search never takes a search while the inbox
is non-empty or anything ahead of it is owed.
S2. The projector carries Build (Unbuilt, Built, Rebuilding). A collection made
again (label mismatch, or lost after it was once built) is Rebuilding until the
entries it owes are written; settle() is the one place that clears it, so a
failure mid-refill does not end the rebuild. Rebuilding reports Reconciling.
unsearchable stays the only refusal predicate.
S3. A mind whose index was never built is Unbuilt: its first build reports
Behind, so the search waits and answers whichever side looked first. Only a
rebuild of an index that exists refuses.
S5. ServeOptions::search_timeout is deleted. The sink owns the deadline
(Backoff::search_deadline, stamped on every search) and the serve loop asks
the daemon for it (IndexSink::search_deadline), so the loop's wait and the
worker's bound are one value. A mind with no identity and documents owed is
Reconciling, so a search is taken and refused rather than left for a spinning
worker.
S4. A test pins that a later call's bound shrinks as the search spends time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
