Soul s2: under a permissive umask the store was group/world-writable between
CultCache's rename and the chmod, and an fd opened there survived it. The
mind-control binary now sets umask 077 first (the library never touches the
umask). The writer refuses to write through an existing directory, lock or store
that is not root's or is group/world-writable, with the typed UnsafeStore error
naming path, mode and owner. Tests: a non-root open-for-write probe against the
real binary under umask 000; refusals for 0777/0775 directories, 0666/0664
locks and stores, and a non-root-owned directory; accepted root installs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Modes under umask 000/022/077 via a re-executed test child; a non-root user
(setpriv uid 65534, skipped with a message when not root) cannot write the store
but can read it; an undecodable or NaN dial reads Held(Undecodable) whatever the
brake says, which kills the fail-open default-dial mutant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1: created under umask 000 the directory was 777 and the files 666, so a
non-root user could write the store. The writer now sets the directory (when it
creates it), the lock file and the store file explicitly, after the setter's own
refusals so a refused write still creates nothing. CultCache stages with the
process umask and offers no mode, so the store file is set after the rename.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two cargo-mutants survivors from the first run (main -> (), and the
--instance match guard -> true) are killed by a malformed-command table row
and a process-level test of the refused invocation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1 holds (eureka-substrate:verdict:cut-mind-authority.s1). Additive on the wire; the live upgrade must be daemon-first (follow-up mind-variant-daemon-first).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run, breaker, units and wake-frame rows follow every-wake-a-run and mind-launch r1;
the leaf rows state the as-landed crate, golden pin and AGPL license; the additive
rule names the `= absent` marker; F15-F17 added; Undone updated; stale future-tense
and Epiphany-owner lines made present tense.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Additive unit-enum variant; schemas regenerated by derivation. The query
alias domain now derives from the enum (unit_enums! exposes NAMES), so the
second authority list in huginn-mind rows.rs is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1-s3 hold (eureka-body:verdict:cut-leaf-into-huginn.s3); wire parity defended by committed golden bytes and the live-store read-back. Relicensed AGPL-3.0 (ruling leaf-relicensed-agpl).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LICENSE is the gnu.org agpl-3.0.txt verbatim (LF). The golden header now
names 44be4cd as the dump commit, the four kinds (cut_spec, cut_report,
finding, follow_up) whose source-path string was renamed relative to
Epiphany ef956865, and that 87b6455 differs only in test code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the AGPL-3.0 text as LICENSE and set the workspace license to
AGPL-3.0-only (rulings license-split, leaf-relicensed-agpl); the leaf's
provenance (Epiphany ef956865, PolyForm Noncommercial, relicensed by its sole
copyright holder 2026-10-09) is recorded in its Cargo.toml and README.
One [workspace.dependencies] entry per CultLib crate now owns the revision;
the crates inherit it. index.json lists Huginn's two wire schemas too, and the
catalogue test drops its huginn. prefix exclusion: every schema file is listed.
README and AGENTS stop naming Epiphany notes as the owner of the cut.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kills the one cargo-mutants survivor on eureka-pipeline (Display::fmt replaced
by Ok(Default::default())).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Seven notes copied verbatim from GameCult/Epiphany ef956865 notes/, each with
a one-line provenance comment on top: huginn-organ-cut and the eureka-* and
postmortem notes. Prose only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Package and lib become eureka-pipeline / eureka_pipeline; the crate joins the
workspace; huginn-mind's git dependency on GameCult/Epiphany is replaced by
the path, and Cargo.lock is regenerated (the Epiphany source entry is gone).
Every epiphany_pipeline mention in huginn-mind, huginn-daemon and eureka-state
is renamed. The schema-publication test reads ../../schemas/cultnet. The
leaf's license-file key (../LICENSE, which Huginn has no file for) is dropped.
Type ids, the epoch and every schema_id string are untouched. Schemas README
and the pipeline section of schemas/cultnet/README.md are rewritten for the
new home; README and AGENTS no longer say the leaf is pinned by git. New test:
the catalogue lists exactly the schema files beside it.
Not yet built or tested; verification follows on Yggdrasil.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Byte-identical blobs of epiphany-pipeline/{Cargo.toml,src/lib.rs},
schemas/README.md and schemas/cultnet/* at Epiphany ef9568655e75, so Soul can
diff the copy against the source. Left out as the spec orders:
epiphany.work_organ_state.v0.schema.json and its index.json entry (no reader
outside Epiphany). Epiphany's schemas/cultnet/README.md is not copied over
Huginn's own README there; the next commit folds its pipeline section in.
The crate is not yet a workspace member and keeps its Epiphany names, so this
commit does not build as a package; nothing else changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Body facts, model page and rationale for the eureka-body campaign. The cut
specs and questions are the typed record in the mind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Eureka eureka-substrate cut huginn-admission-rules. Soul verdicts s1 and
s2. Report heads match commits short or full; a finding may defer to a
cut spec; MindSteward is Life (old receipts still decode); the campaign
stewardship check is gone (ruling stewardship-rule); depends_on entries
must name another cut in the campaign (rulings depends-on, self-dep).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Eureka eureka-substrate cut huginn-pin-and-refusals. Soul verdicts s1
(two findings, fixed by 0f491b00) and s2 (holds, no findings). Pins
epiphany-pipeline to the per-kind key bound; a pipeline_key error is
MindRefusal::Document, not Unavailable; the snapshot read-back test
re-keys all 244 stored documents and resolves every stuck subject.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
snapshot_admits_and_reads_back now counts pipeline envelopes apart from the
loop, asserts validate() and pipeline_key == stored key for every one, admits
a resolution for every stuck finding and a withdrawal for every unwithdrawable
resolution, and fails with the id named on any refusal.
The refusal tests assert the exact leaf refusal (field and value from
pipeline_key) at Mind::admit and at the helper, and eureka-state gains a
tool-level test that the typed refusal reaches the result intact.
Tests only; no production code changes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Admission wrapped every prepare error in Unavailable, so a key the leaf
could not compose reached the client as an unavailable organ. One private
prepare(document, cache) now keys through the leaf first, mapped to
MindRefusal::Document, then encodes; Mind::admit and the derived-write loop
both use it. Unavailable stays for store, cache-encode and decode faults.
Tests: an_unkeyable_document_is_refused_as_a_document (store and receipts
unchanged), prepare_classifies_a_key_refusal_as_a_document_and_encodes_the_rest
(the derived path cannot reach an unkeyable resolution after the per-kind
bound, so the helper is pinned directly), and the #[ignore]
snapshot_admits_and_reads_back, which opens a scratch copy of the live mind
named by HUGINN_MIND_SNAPSHOT, views every stored document back unchanged,
resolves the six stuck findings and withdraws one long-keyed resolution.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Moves the leaf from 73edee5cdaddece8bda9c6c3271e8ddd064337f9 to the
leaf-key-bound merge commit on Epiphany main,
ef9568655e75bb6cb362a038e2739a5ac5e777ee. Cargo.lock follows with that one
line; no other lock line moves.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Lands the live memory-organ branch on main per operator ruling
eureka-substrate:ruling:merge-to-main-first ("Merge to main first"),
cut spec eureka-substrate:cut_spec:cut-merge-huginn-main.r1.
The merged tree differs from the deployed release 9dd6d800 only by the two
docs/eureka-substrate-*.md files already on main; crates/, Cargo.toml and
Cargo.lock are identical to the release. eureka/memory-organ is kept and
receives no further commits.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The id parser bounds locals at 64 too; Faculty lives in Huginn; two
refusal sites map key errors to Unavailable; six findings unresolvable and
39 resolutions unwithdrawable in the live mind; the merges are safe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Campaign eureka-substrate, the Mind fixes the operator ruled next after
idunn-watchdog. Typed target and rulings live in Eureka's mind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eureka-state on Windows could not reach the daemon: the cultnet-rs RUDP
client bound 127.0.0.1, and a loopback-bound socket cannot send to
10.77.0.1 (os error 10051). CultLib 8fc74c7 binds the unspecified address
for a remote endpoint. The daemon and the client move together, because
the ack cuts between the revs changed the RUDP handshake.
epiphany-pipeline moves to Epiphany 73edee5, which pins the same CultLib,
so one cultcache-rs is in the graph and the pipeline's CultCache types
stay Huginn's.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
--qdrant-url, --ollama-url and --embedding-model are required since Cut 11a;
the example now runs. Point at the gamecult-ops runbook for the Yggdrasil
unit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
