stop_all becomes SystemdLauncher::stop(StopScope): a Mind's two exact units,
or the swarm's mind-self@*.service and mind-persona@*.service globs. Both
holds write first, then stop whatever the write's outcome, with the same four
outcomes. Soul s1 swarm-hold-leaves-live-turn-running: a held swarm brake left
a live Persona turn running with its shell until the turn ended.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Delete the classifier, initiative, burn, base-rate dial, shares, Envelope dollars,
persona turn max_cost, --max-budget-usd and the Self-run settle. Add tempo::tally
and tempo::pick, self-declared urgency from the reply as a Pulse, the usage line in
Persona input, and the wire-v4 connector (lease v2, usage_readout).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Opens claude only under an open Self run; one pure decide() owns flush, grace, headroom and escalation; process-group signals; ends on child exit or EOF. Soul s3 holds (eureka-body:verdict:cut-mind-self-run.s3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
When systemctl stop fails, stop_all asks is-active for each of the two
units and the error names each state (active, inactive, failed, unknown)
beside the exit status; brake hold says the brake is held and the stop
failed, not that the units were not stopped. Exit 2 and the held brake
are unchanged. Follow-up brake-partial-stop-message.
Not yet built; verified at the head of the cut.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Exit 0 only when the one derivation reads Released; every other reading
(absent, held, no dial, dial out of bounds, undecodable store) is an error
and exits 2, which systemd's ExecCondition reads as skip. A pure read through
FileSource: no writer, no created file or directory.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
stop_args now builds each name through unit(), the one name path start and
alive use, so the stop argv cannot disagree with the units that run (the
:* glob matched none of them on real systemd). A launch test ties stop_args
to what start passes systemctl for several instances; two binary tests run
mind-control brake hold with a fake systemctl first on PATH, so main's
stopper wiring is pinned.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SystemdLauncher::stop_all runs one synchronous systemctl stop over the
instance's mind-self and mind-persona units (stop_args, built from the same
templates as start and alive). cli::run gains a stop_units parameter that only
brake hold calls, after the write whatever its outcome. The window probe uses
dial set instead of brake hold, since a real hold now runs systemctl.
Builds not yet verified on the stopgap at this commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
read_effective(instance) reads CONTROL_ROOT/<instance>/control.cc. The root override is a thread-local under cfg(test) inside the crate; the reader tests and the Grant launch tests move in-crate to use it. The operator CLI's show derives its display line from the store it already read. An external forge probe and compile_fail examples pin the rule; the instance gate is pinned with same-length, prefix and extension forgeries, and the Persona refusal with a claim of every kind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Grant carries the instance whose store was read; read_effective(root, instance)
derives the store path itself and no caller supplies a path or a source. The
launch refuses a Grant of another instance and a Persona request with claims,
both typed refusals that name no input. Launcher drops its dead label: liveness
is keyed by unit (instance, turn). Tests pin Persona step 0, the Operator-run
exclusion, the fiftieth ended run and the same-batch boundary.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s3: the window probe wrote a window-probe-<pid> instance under the real
/etc/gamecult/minds. A leading --root argv flag (argv, because sudo -E carries
the environment) replaces the default root; the probe points the real binary at
a tempdir, whose drop removes whatever a failed assert leaves. No test names
/etc/gamecult any more; the path-derivation test uses CONTROL_ROOT.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s2: under a permissive umask the store was group/world-writable between
CultCache's rename and the chmod, and an fd opened there survived it. The
mind-control binary now sets umask 077 first (the library never touches the
umask). The writer refuses to write through an existing directory, lock or store
that is not root's or is group/world-writable, with the typed UnsafeStore error
naming path, mode and owner. Tests: a non-root open-for-write probe against the
real binary under umask 000; refusals for 0777/0775 directories, 0666/0664
locks and stores, and a non-root-owned directory; accepted root installs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
