A non-decider reads a fork only while the Mind's desk_listing for it is in force; a decider sees
every showable fork. Counts, pages and cursors are over the visible set; a hidden fork reads as a
missing one (same bytes). New kind desk_listing (epiphany.pipeline.desk_listing.v2, key
<campaign>:desk_listing:<question-label>; unlist = Withdrawn resolution, relist = withdraw that),
new citation role Listed (ALL is 27), admitted on the Admit door only (the desk door refuses one).
subject and every deciders entry are AccountId (lowercase D-format UUID) at decode, refused as
payload-not-a-request naming the field and never the value; the stored desk_answer.answerer is an
AccountId. The longest kind name is now desk_listing, so the resolution local bound is 112.
Tests move to account ids (fixtures::account); refused-request fixtures and their failure frames;
all published schemas, the golden envelopes and the catalog index regenerated.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The card gains raised_at (the question's first admission, UTC, nil when unknown; an import's
source time wins) and decider_count (1..64) right after deciders: 18 keys, DE 00 12. The record
gains answerer_count (distinct answerers over every stored answer, refusals included) fifth:
header 86. ForkDeskAnswer.answerer is a required nullable key. The reads now take the call's
subject: a subject in the call's deciders is a decider and is told the ids; any other reader gets
deciders empty, answerer nil and the counts. The card decoder refuses a count outside 1..64 or a
non-empty deciders of another length.
Huginn's types decode and re-encode all 14 vendored CultLib vectors byte for byte (replaces
huginn_types_do_not_yet_carry_the_pinned_shapes); vectors/fork-card-vectors.json re-vendored at
d3025d3c; entry-bearing golden fixtures for both views; desk request/response schemas regenerated;
docs/desk-feed-door.md describes the built shapes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Soul on d08b888: CultLib main's card requires 16 keys, not 17. The
account-id grammar test now rejects 36 hex digits with no dash, a
37-character id and a dash off position. The reader-view test says it
pins mirror types only.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Persona's ruling (follow-up chat-mind-20261111T150417226Z-t167): a
reader is a decider when subject is in the call's deciders; any other
reader gets no decider or answerer ids, only counts, and Huginn does it
because the card is opaque to Bifrost. CultLib's closed card (deciders
minItems 1, no count) and non-null answerer cannot carry it yet, so the
doc names the proposal to Libby and the fixtures add clearly synthetic
card fragments and a proposed non-decider record, with a test that no
account id appears in a non-decider's bytes and a decider keeps them.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
subject, deciders and answerer are Bifrost UserAccount ids (lowercase
D-format, as Bifrost's validator requires and as Huginn names
RequestId). The fixtures used "7"/"12"; they now carry synthetic UUIDs,
and a test pins the grammar and refuses Matrix ids, emails and handles.
The doc states that Huginn's door does not refuse other shapes yet (owed
by cut-desk-feed-listing.r4) and that card.deciders echoes the ids.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Soul pass on 66e6fe8: document and fixture the read form of
fork_too_large (live on main; CultLib limitation 13 is stale), the
ResponseTooLarge 503 and a unit-variant Refused; say that only operation
messages have sorted keys, what failure diagnostics and the schema
catalog reply are, where forks come from, and that the listing gate is
not live (no receiver on a Mind with private questions before
cut-desk-feed-listing). Fixtures use a held fork id, synthetic record.
.gitattributes keeps .bin/.msgpack binary and .hex LF.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
docs/desk-feed-door.md states the list and read wire already on main
(frame, CultNet envelope, named MessagePack payload), the per-Mind
peer-checked socket, 503 for the addressed Mind only, the raw-answerer
trust boundary (Bifrost masks), raised_at as ruled by CultLib (card
bytes not pinned until the re-pinned card vectors land) and the planned
listing gate (default not listed).
crates/huginn-mind/tests/desk_feed_fixtures.rs writes the fixtures with
Huginn's own encoders and checks them; HUGINN_WRITE_DESK_FIXTURES=1
rewrites. No card bytes in any fixture.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A mouth that restarts keeps its seq counter but loses its pending, so its unacked events come back from the homeserver under fresh,
higher seqs. The client keyed everything on seq and told them twice. Progress now remembers the answered event ids; a delivery whose event
was answered is dropped from the poll and acked through (leading run only).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- ElementVisitor reads newtype-struct, some and enum shapes (msgpack ext, timestamp) as Other, so that delivery's reply link drops with the
warning and the message is delivered unchanged. Lists inside the link are skipped, not recursed into.
- The excerpt strip also removes U+034F, U+115F, U+1160, U+17B4, U+17B5, U+180B-180D, U+2800, U+3164; the header and the ReplyTo doc say an
emptied excerpt reads as no text.
- trace_inputs records the quote line she was shown under the message.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Exactly "1" is on, anything else is off, nothing is echoed.
Spec: gamecult-chat:cut_spec:cut-chat-reply-link-decode.r4
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The quote is data on its own line after its message, every variable part
quoted, role derived from the sender id. Dropped links never render.
Spec: gamecult-chat:cut_spec:cut-chat-reply-link-decode.r4
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
RudpChat::with_reply_link asks the v4 kind first and steps down one rung per
UnknownKind refusal (v4 -> v2 -> v1); flag off sends today's bytes. The
dropped-reply warning prints once per event id and reply_defects counts them.
Spec: gamecult-chat:cut_spec:cut-chat-reply-link-decode.r4
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ChatDelivery gains reply_to (tuple index 14): Absent, Quote(ReplyTo) or
Dropped(ReplyViolation). A reply_to outside the contract is dropped whole and
never fails the poll; reply_warnings words and deduplicates the organ-side
warning. Sender and event id are held to Matrix id shapes; the excerpt is
bounded at 240 code points as sent, then stripped of invisible characters.
Adds the v4 consts and the unicode-general-category direct dependency
(already in Cargo.lock).
Spec: gamecult-chat:cut_spec:cut-chat-reply-link-decode.r4
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The CLI sends every positional text as `texts` and never `text`; help says each
is a topic and the lists are fused. Daemon and CLI deploy together. Cut
gamecult-chat:cut_spec:cut-source-query-texts.r1, commit 4.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Zero, nine and blank texts answer Refused naming `texts` and never reach the
index; two texts are one queued search. Cut
gamecult-chat:cut_spec:cut-source-query-texts.r1.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
search() embeds each distinct trimmed text (Instruct:-prefixed) in one batch,
searches once per vector, and fuses with reciprocal rank (k=60, depth 50) only
when more than one text remains; one text is searched top_k deep and answers
with the cosine scores as before. Cut
gamecult-chat:cut_spec:cut-source-query-texts.r1, commit 3.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
fuse is a pure generic function over ranked lists and a key closure, with
FUSE_K = 60 (Cormack, Clarke, Buttcher, SIGIR 2009) and FUSE_DEPTH = 50 named
beside CORPUS. Nothing calls it yet. Cut
gamecult-chat:cut_spec:cut-source-query-texts.r1, commit 2.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SourceQuery gains `texts` (one to eight, SOURCE_TEXTS_MAX) beside the
transitional `text`; check() refuses neither, both, more than eight and blank
entries, naming `texts`. SourceHit.score documents cosine versus reciprocal-rank
sum. Published request and response schemas regenerated. Cut
gamecult-chat:cut_spec:cut-source-query-texts.r1, commit 1.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Userinfo is everything before the last @ of the authority, which ends at / ? # backslash, quotes,
brackets, angle brackets or ASCII whitespace; a path @ (github.com/@user, pkg@1.2.3, a//b@c) is left
alone, non-ASCII stays inside userinfo. Protocol-relative // opens an authority only at a word start.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
NBSP, U+2028 and other Unicode whitespace stay inside userinfo, so a secret holding them is redacted whole.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Candidate run is everything to the next whitespace, userinfo up to its last @; protocol-relative
// and the narrow word:secret@host.tld/ shape are covered; scanning no longer slices inside a
multibyte character. persona::structured_output redacts each string through the same function.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
