desk_door.rs owns who may speak, the socket's life and the frame bounds; Daemon::handle_desk owns which Mind method answers (Answer via desk_answer, the replay flag gating index.committed; Forks and Fork refused Unavailable until desk-door-reads). startup returns Started; run takes the door; its five callers pass it or None. desk_wire::answer_ref is the one spelling of a stored answer's ref.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
envelope.rs cores are generic over service id, schema and payload; the mind's five functions and the desk's five instantiate them. desk_answer's attribution parameter is authority. huginn.desk_request.v1 and huginn.desk_response.v1 are derived and pinned.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The desk request, response, envelope instantiations and constants do not exist yet; these tests name them and do not compile.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
S11 applied with the sequential check off and seen to fail on it. Finding desk-wire-replay-id-map-not-injective.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Soul's S12 (a second converter that agrees on every legal key) applied and seen to fail. Finding desk-wire-second-converter-evades-grep.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Padded, cased and trailing-junk spellings added to the existing tables; Soul's S1, S8, S9, S10 each applied and seen to fail. Finding desk-wire-pass-through-unpinned.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Kills Soul's S2, S3 and S5 (each applied and seen to fail). Finding desk-wire-asof-and-gate-thinly-pinned.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Her vectors hold no over-long fork id (deviation recorded). Finding desk-wire-long-fork-id-body-invalid.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
answer_desk's (answerer, request_id) lookup is now bound_answer, pub(crate) in desk.rs, and
Mind::desk_answer asks it so the gate runs only when nothing is stored. Finding
desk-wire-gate-shadows-replay.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Public sessions only; with a person her session was shown (not a Mind, not herself); text 1..4000 bytes; brakes re-read before the open; a refusal or a mouth that does not answer is a notice on her next line, never a failed step. No consent state is kept: the mouth reads it from Matrix.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Fixtures copied byte-for-byte from Bifrost main 73c6f50 (tests/fixtures/persona-chat-v4/), verified equal to the handoff copy.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Vendors fork-card-vectors.json at CultLib 8ca1d184 and retires the options-hash file it contains.
answer_desk's dead-code allowance goes: desk_answer is its live caller. No card is built here.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
body_digest writes retracted for the illegal form only, so forms (i) and
(iii) no longer share a digest; desk_steps refuses a value that is no
illegal form as body invalid. Tests pin the three illegal goldens, the
200-byte target, choice and Refused.retracts bounds, case-sensitive
labels and fork_closed before bad_retraction.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
PipelineFacts::DeskAnswer gains counts, derived through counted_answer over the
read's Docs::at(image, as_of); the stored outcome name stays the write-time record.
DeskOutcome::Refused carries the retraction target as sent; the record's choice is a
Short kept as sent (a choice_invalid choice is no label), and an illegal retraction
form keeps its choice and note. body_sha256 form unchanged. Schemas regenerated.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A bound (answerer, request_id) replays its stored outcome without re-running
probe validation; a malformed id binds nothing and still meets the probe.
Comment on the choice bound now says a Short (200 bytes).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
DeskBody::IllegalRetraction stores Refused bad_retraction after steps 4-6 (digest carries the form, so it never replays as a plain answer); a choice is any 1-200 byte text, stored Refused choice_invalid when no option label, grammar or not. claim_in_future compares against the whole-second received_at written to the record.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
DeskStamp carries answerer, attribution (Operator/Steward/Member per CultLib PR #72) and the decider
list; membership decides rule 5, the attribution never does. answer_desk and DeskStamp are crate-private.
The receipt names the operator only for the operator's account. counted_answer and R1 consider
options_hash. A stored answer keeps received_at, claim_in_future, request_id and a body digest;
the same (answerer, request_id) and body replays the stored outcome and writes nothing, another
body is request_id_conflict. Notes are Words (1..=4000 bytes, not blank); answered_at must be UTC.
The vector file is re-sliced byte for byte from PR #72 head 2dea6c56.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
