Squash of eureka-body/self-run-closes-run 55dd620..93f93c1 (Soul go; orphan
sweep cut: the mind admits one Self run in force and launch's close_dead closes
a dead holder). Operator: 'Look into the stale runs issue' and 'why has this
xenos filth not been replaced with nice clean CLI yet'.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A mention string, display name or name list could write the word you into
the quoted join and pass for her own id. Now only to_you=true, derived from
her own sender id, says a message names her. Restores the newline escape in
the line format.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The mouth delivers each message's mentions but the turn input never showed
them, so a Persona could not tell a reply to another Mind from one to her.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A link is checked by canonicalising it in the source against the canonical
seed root, so a link through another in-tree link cannot escape.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Opens claude only under an open Self run; one pure decide() owns flush, grace, headroom and escalation; process-group signals; ends on child exit or EOF. Soul s3 holds (eureka-body:verdict:cut-mind-self-run.s3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Persona claim-set property drew ids as doc-N and doc; they now come
from the instance-name generator (varied alphabets, both separators, edge
lengths), so a refusal keyed on id text cannot pass. Set shapes and sizes
are unchanged. Follow-up persona-claim-ids-varied.
Not yet built; verified at the head of the cut.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
eureka is held; eureka-two, eureka2 and xeureka are released with a dial and
open. Kills Soul's s-check-wrong-instance-by-prefix mutant. Follow-up
gate-prefix-neighbour-test.
Not yet built; verified at the head of the cut.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
When systemctl stop fails, stop_all asks is-active for each of the two
units and the error names each state (active, inactive, failed, unknown)
beside the exit status; brake hold says the brake is held and the stop
failed, not that the units were not stopped. Exit 2 and the held brake
are unchanged. Follow-up brake-partial-stop-message.
Not yet built; verified at the head of the cut.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Adds the row (heat 0.05, base cooldown u32::MAX, 85,899,345,900 s) to the
wait test so any ceiling on the wait fails, and gives the ignored host test its
command in a crate README (the lane that kills the host() mutants). Tests and
docs only; builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The env test pins the variable's name and that the flag wins over it. The ignored container test seeds a mind, serves it with the real huginn-daemon, writes the brake at its real root and runs the real mind-wake with an empty PATH (so no unit is reached): the run it opens must carry /proc/sys/kernel/hostname as host and mind-wake as agent, which kills the three host() mutants of finding host-survivors-reachable.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Closes the test gaps of findings cadence-clamp-unpinned and codes-and-agent-unpinned: a floor of 1 s or a ceiling of 80000 s on the wait now fails the cadence test, and the receipt's agent and the printed code of every refusal are compared with the spelling, not with the constant that produced them.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
wake::cycle reads the brake and dial through the one derivation behind
read_effective and the unit gate, returns Held before any query, admission or
unit call, finds the newest Persona turn of hers (any status) with one
descending single-row query, and launches through open_and_launch. The
mind-wake binary prints the outcome. control_path no longer echoes the
instance it refuses.
Does not build the public_surface snapshot yet (the next commit updates it).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The writers refuse an out-of-bounds dial, so the DialOutOfBounds reading is
produced through the unchecked store the crate's own tests already use. The
store directory holds a second file besides control.cc, so the no-write test
compares listings rather than counting one.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Exit 0 only when the one derivation reads Released; every other reading
(absent, held, no dial, dial out of bounds, undecodable store) is an error
and exits 2, which systemd's ExecCondition reads as skip. A pure read through
FileSource: no writer, no created file or directory.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
stop_args now builds each name through unit(), the one name path start and
alive use, so the stop argv cannot disagree with the units that run (the
:* glob matched none of them on real systemd). A launch test ties stop_args
to what start passes systemctl for several instances; two binary tests run
mind-control brake hold with a fake systemctl first on PATH, so main's
stopper wiring is pinned.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The previous commit (df21694) builds but fails the public_surface test: it did
not update the committed snapshot.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SystemdLauncher::stop_all runs one synchronous systemctl stop over the
instance's mind-self and mind-persona units (stop_args, built from the same
templates as start and alive). cli::run gains a stop_units parameter that only
brake hold calls, after the write whatever its outcome. The window probe uses
dial set instead of brake hold, since a real hold now runs systemctl.
Builds not yet verified on the stopgap at this commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Per ruling mind-launch-forge-scanner-bound: compile_fail doctests for the
struct literal and each derive-provided path on Grant; forbid(unsafe_code) in
the library; the gate property draws the mind's own instance from the same
slug generator as the Grant's and tests pairs; Persona claim shapes are drawn
and rotated by seed; the path-literal and static-keyword scanners are deleted
from the public-surface test, whose limits are written at its top.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A process-global is the one channel through which an existing public
function's body, whose signature the snapshot does not change, could carry a
root from one call to another. The library has none today; a new one is a
line the snapshot does not have.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The instance gate is checked against names generated from the real one:
every single-character substitution, deletion and insertion, every
transposition and permutation, rotations, prefixes and suffixes, case flips,
NUL and whitespace padding, repetitions, and seeded random names of the same
and other lengths. The Persona refusal is checked at every claim-set size
from one to 300 in four shapes, duplicates included, and for every kind
alone. A compare or bound weaker than equality passes neither.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tests/public_surface.rs reads the library source the way a consumer sees it
and compares every pub item with its signature, pub fields, derives, impl
headers and every path-looking string literal to tests/public_surface.txt.
A new pub static or pub fn under any name, a derive onto Grant, or a root
read from another path fails it. It replaces the three compile_fail
doctests that named with_root, TEST_ROOT and control_root. Dev-dependencies
syn, quote and proc-macro2, already in the graph through serde's derive.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
clippy.toml lists the std::env readers (var, var_os, vars, vars_os,
set_var, remove_var, args, args_os, current_exe, temp_dir, home_dir) and
libc::getenv as disallowed methods, and lib.rs forbids allowing them back.
main.rs and the self-spawning integration test carry the only allows.
The forge probe's environment sweep and its 22 guessed variable names go:
the lint covers a variable of any name, so the list was a second, weaker
path for the same rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cargo unifies features per target, so a target-specific line that restores
eureka-state's default features left a Linux graph clean while a Windows
build compiled the huginn CLI's parser. The test asks cargo tree for
--target all, for the control and for mind-body.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
