AlreadyStewarded and the withdrawal-over-later check each decided it with their own comparison, and disagreed when a later record was reinstated beside an earlier one. later_than's stewardship arm is gone.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
same_lineage replaces the Target and CutSpec arms. A target is superseded only within its campaign, a cut_spec within its campaign and cut, a ruling by any ruling (ruling supersession-lineage). Tests cover same-batch, first/last supersessor, subject in batch, cut_spec cross-campaign, and ruling cross-campaign.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Docs-level image holds a closed higher revision and another campaign's higher target; admission-level test for the foreign target. HM3 (min revision) is equivalent and noted in the test.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A lone foreign supersession closed a repo-naming target and narrowed membership to the opening set. Refuses IncompatibleResolution, as the cut_spec supersession rule does. Includes the admission tests (not yet verified).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
One appended golden line (target.repos) dumped by golden_dump, one header
comment line; the target, mind_request and mind_response schemas regenerated
from the derivation. No existing golden line changed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
PipelineTarget.repos (additive, `= absent`, epoch stays v2) names the
campaign's whole repo set from that revision on; repos_in_force is the one
owner of cut_spec membership and replaces the direct campaign.repos check;
a revision past the first may not empty the set its predecessor named
(EmptyRepos on the target id). Golden line and regenerated schemas follow
in the next commit (ruling campaign-repo-set-home).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Adds the row (heat 0.05, base cooldown u32::MAX, 85,899,345,900 s) to the
wait test so any ceiling on the wait fails, and gives the ignored host test its
command in a crate README (the lane that kills the host() mutants). Tests and
docs only; builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The env test pins the variable's name and that the flag wins over it. The ignored container test seeds a mind, serves it with the real huginn-daemon, writes the brake at its real root and runs the real mind-wake with an empty PATH (so no unit is reached): the run it opens must carry /proc/sys/kernel/hostname as host and mind-wake as agent, which kills the three host() mutants of finding host-survivors-reachable.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Closes the test gaps of findings cadence-clamp-unpinned and codes-and-agent-unpinned: a floor of 1 s or a ceiling of 80000 s on the wait now fails the cadence test, and the receipt's agent and the printed code of every refusal are compared with the spelling, not with the constant that produced them.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
wake::cycle reads the brake and dial through the one derivation behind
read_effective and the unit gate, returns Held before any query, admission or
unit call, finds the newest Persona turn of hers (any status) with one
descending single-row query, and launches through open_and_launch. The
mind-wake binary prints the outcome. control_path no longer echoes the
instance it refuses.
Does not build the public_surface snapshot yet (the next commit updates it).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The writers refuse an out-of-bounds dial, so the DialOutOfBounds reading is
produced through the unchecked store the crate's own tests already use. The
store directory holds a second file besides control.cc, so the no-write test
compares listings rather than counting one.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Exit 0 only when the one derivation reads Released; every other reading
(absent, held, no dial, dial out of bounds, undecodable store) is an error
and exits 2, which systemd's ExecCondition reads as skip. A pure read through
FileSource: no writer, no created file or directory.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
stop_args now builds each name through unit(), the one name path start and
alive use, so the stop argv cannot disagree with the units that run (the
:* glob matched none of them on real systemd). A launch test ties stop_args
to what start passes systemctl for several instances; two binary tests run
mind-control brake hold with a fake systemctl first on PATH, so main's
stopper wiring is pinned.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The previous commit (df21694) builds but fails the public_surface test: it did
not update the committed snapshot.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SystemdLauncher::stop_all runs one synchronous systemctl stop over the
instance's mind-self and mind-persona units (stop_args, built from the same
templates as start and alive). cli::run gains a stop_units parameter that only
brake hold calls, after the write whatever its outcome. The window probe uses
dial set instead of brake hold, since a real hold now runs systemctl.
Builds not yet verified on the stopgap at this commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Per ruling mind-launch-forge-scanner-bound: compile_fail doctests for the
struct literal and each derive-provided path on Grant; forbid(unsafe_code) in
the library; the gate property draws the mind's own instance from the same
slug generator as the Grant's and tests pairs; Persona claim shapes are drawn
and rotated by seed; the path-literal and static-keyword scanners are deleted
from the public-surface test, whose limits are written at its top.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A process-global is the one channel through which an existing public
function's body, whose signature the snapshot does not change, could carry a
root from one call to another. The library has none today; a new one is a
line the snapshot does not have.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The instance gate is checked against names generated from the real one:
every single-character substitution, deletion and insertion, every
transposition and permutation, rotations, prefixes and suffixes, case flips,
NUL and whitespace padding, repetitions, and seeded random names of the same
and other lengths. The Persona refusal is checked at every claim-set size
from one to 300 in four shapes, duplicates included, and for every kind
alone. A compare or bound weaker than equality passes neither.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tests/public_surface.rs reads the library source the way a consumer sees it
and compares every pub item with its signature, pub fields, derives, impl
headers and every path-looking string literal to tests/public_surface.txt.
A new pub static or pub fn under any name, a derive onto Grant, or a root
read from another path fails it. It replaces the three compile_fail
doctests that named with_root, TEST_ROOT and control_root. Dev-dependencies
syn, quote and proc-macro2, already in the graph through serde's derive.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
clippy.toml lists the std::env readers (var, var_os, vars, vars_os,
set_var, remove_var, args, args_os, current_exe, temp_dir, home_dir) and
libc::getenv as disallowed methods, and lib.rs forbids allowing them back.
main.rs and the self-spawning integration test carry the only allows.
The forge probe's environment sweep and its 22 guessed variable names go:
the lint covers a variable of any name, so the list was a second, weaker
path for the same rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cargo unifies features per target, so a target-specific line that restores
eureka-state's default features left a Linux graph clean while a Windows
build compiled the huginn CLI's parser. The test asks cargo tree for
--target all, for the control and for mind-body.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Builds (merge head 5da8b06 is green; this commit adds the manifest change and
the cargo tree test).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eureka-substrate:cut_report:cut-huginn-persona-state.h1-h3, held by Soul
(eureka-substrate:verdict:cut-huginn-persona-state.s3). Validated against the
published schema, replaced whole under CAS with a receipt. Not deployed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The repo stores LF; a scripted edit on Windows wrote CRLF. No content change:
git diff -w d5fddc3 shows only the three commits' real edits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One bounded line: absent, stored updatedAt=<stamp>, or unreadable; no value
of the document. Test over canned Whoami answers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
whoami's persona field derived from stored_updated_at, which ignores the
writing receipt, while persona_get requires one. Status now matches on
persona(), so a receiptless row is Unreadable on both. The test asserts
agreement for every planted row and for a put-written row (restoring the
is_err equality weakened in c5af029).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolves the eureka-state Cargo.toml comment block to main's, regenerates
Cargo.lock from main's with cargo update -w, adds the Persona and PersonaPut
arms to the CLI's unexpected-answer match and the persona field to the CLI
test MindStatus literals.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
read_effective(instance) reads CONTROL_ROOT/<instance>/control.cc. The root override is a thread-local under cfg(test) inside the crate; the reader tests and the Grant launch tests move in-crate to use it. The operator CLI's show derives its display line from the store it already read. An external forge probe and compile_fail examples pin the rule; the instance gate is pinned with same-length, prefix and extension forgeries, and the Persona refusal with a claim of every kind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
