Per ruling mind-launch-forge-scanner-bound: compile_fail doctests for the
struct literal and each derive-provided path on Grant; forbid(unsafe_code) in
the library; the gate property draws the mind's own instance from the same
slug generator as the Grant's and tests pairs; Persona claim shapes are drawn
and rotated by seed; the path-literal and static-keyword scanners are deleted
from the public-surface test, whose limits are written at its top.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A process-global is the one channel through which an existing public
function's body, whose signature the snapshot does not change, could carry a
root from one call to another. The library has none today; a new one is a
line the snapshot does not have.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The instance gate is checked against names generated from the real one:
every single-character substitution, deletion and insertion, every
transposition and permutation, rotations, prefixes and suffixes, case flips,
NUL and whitespace padding, repetitions, and seeded random names of the same
and other lengths. The Persona refusal is checked at every claim-set size
from one to 300 in four shapes, duplicates included, and for every kind
alone. A compare or bound weaker than equality passes neither.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tests/public_surface.rs reads the library source the way a consumer sees it
and compares every pub item with its signature, pub fields, derives, impl
headers and every path-looking string literal to tests/public_surface.txt.
A new pub static or pub fn under any name, a derive onto Grant, or a root
read from another path fails it. It replaces the three compile_fail
doctests that named with_root, TEST_ROOT and control_root. Dev-dependencies
syn, quote and proc-macro2, already in the graph through serde's derive.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
clippy.toml lists the std::env readers (var, var_os, vars, vars_os,
set_var, remove_var, args, args_os, current_exe, temp_dir, home_dir) and
libc::getenv as disallowed methods, and lib.rs forbids allowing them back.
main.rs and the self-spawning integration test carry the only allows.
The forge probe's environment sweep and its 22 guessed variable names go:
the lint covers a variable of any name, so the list was a second, weaker
path for the same rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cargo unifies features per target, so a target-specific line that restores
eureka-state's default features left a Linux graph clean while a Windows
build compiled the huginn CLI's parser. The test asks cargo tree for
--target all, for the control and for mind-body.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Builds (merge head 5da8b06 is green; this commit adds the manifest change and
the cargo tree test).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eureka-substrate:cut_report:cut-huginn-persona-state.h1-h3, held by Soul
(eureka-substrate:verdict:cut-huginn-persona-state.s3). Validated against the
published schema, replaced whole under CAS with a receipt. Not deployed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The repo stores LF; a scripted edit on Windows wrote CRLF. No content change:
git diff -w d5fddc3 shows only the three commits' real edits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One bounded line: absent, stored updatedAt=<stamp>, or unreadable; no value
of the document. Test over canned Whoami answers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
whoami's persona field derived from stored_updated_at, which ignores the
writing receipt, while persona_get requires one. Status now matches on
persona(), so a receiptless row is Unreadable on both. The test asserts
agreement for every planted row and for a put-written row (restoring the
is_err equality weakened in c5af029).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolves the eureka-state Cargo.toml comment block to main's, regenerates
Cargo.lock from main's with cargo update -w, adds the Persona and PersonaPut
arms to the CLI's unexpected-answer match and the persona field to the CLI
test MindStatus literals.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
read_effective(instance) reads CONTROL_ROOT/<instance>/control.cc. The root override is a thread-local under cfg(test) inside the crate; the reader tests and the Grant launch tests move in-crate to use it. The operator CLI's show derives its display line from the store it already read. An external forge probe and compile_fail examples pin the rule; the instance gate is pinned with same-length, prefix and extension forgeries, and the Persona refusal with a claim of every kind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eureka-substrate:cut_report:cut-huginn-cli.h1 and h2, held by Soul
(eureka-substrate:verdict:cut-huginn-cli.s2). Strict JSON in and out, read-back
after admit, exit codes per the map; clap behind the default cli feature.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The shared request decoder (envelope.rs) no longer quotes decoder text or
envelope fields: a refusal names the field path and the class. MindStatus.persona
is PersonaStatus {Absent, Stored, Unreadable}, so whoami answers in the persona
door's own terms.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Grant carries the instance whose store was read; read_effective(root, instance)
derives the store path itself and no caller supplies a path or a source. The
launch refuses a Grant of another instance and a Persona request with claims,
both typed refusals that name no input. Launcher drops its dead label: liveness
is keyed by unit (instance, turn). Tests pin Persona step 0, the Operator-run
exclusion, the fiftieth ended run and the same-batch boundary.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pins identity-write-all-visible: publicName, publicDescription, presentation
and values change through put_persona with no per-field rule and no rate
limit beyond the monotone updatedAt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The match on type, key and bytes was three conditions for one fact; the
newest receipt writing the persona identity is that fact. Tests pin the
declared-name walk and the receipt of each of five consecutive puts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The strict decode stopped at the first document with a lost key and let
serde read a struct from a JSON array. It now names every lost path in the
batch and refuses a non-object document or selection.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A new bin of eureka-state, crates/eureka-state/src/bin/huginn/: the agents'
shell door to the mind. Text out, typed exit codes, strict decode of
agent-written JSON (unknown key paths refused, never values), the named
campaign-state recipes, and a read-back after every committed admission.
lib.rs, main.rs and tests/mcp.rs are untouched.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eureka-substrate:cut_report:cut-clippy-pin.h1, held by Soul
(eureka-substrate:verdict:cut-clippy-pin.s1). View is boxed in
HuginnMindResponse; the wire form is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The jsonschema error kind lives in jsonschema::error; the eureka-state tool
closures own their input; huginn.mind_request/response.v1 carry the persona
operations (derived by the existing published_wire_schemas test).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The holder RunId is grammar-checked only, so the launch asks the mind for its
in-force Self-run holders and refuses a name the mind does not show as this
instance's own. One reader of the slot serves step 0 and this check. The
admission test compares the refusal's run to the literal run key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mind-persona@<instance>.service and mind-self@<instance>.service; the run
label no longer enters the unit name, and only the instance is validated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Authority table for her templated units, users, the brake check verb and
Idunn's view of one-shot units, from the Imagination pass that admitted
cut-mind-unit-gate and cut-mind-units-install.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Model page per class of prose knowledge, the one earned kind (observation),
voidbot's index as the one retrieval path for prose, sequencing, and the
triage of the census's 49 unmapped items (eureka-body:follow_up:
prose-knowledge-inventory, ruling prose-knowledge-into-mind).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
open_and_launch takes a Grant by value. Step 0 reads the in-force runs of
hers of the request's turn on the instance (typed facts): a live unit or a
run inside START_GRACE_S answers Busy; a dead one is closed Recorded in the
same admission that opens the next run, so the in-force record is the one
owner of liveness. Admission's AlreadyLive maps to Busy. The alias Busy query
and the whole-mind breaker scan are deleted: the breaker counts the documents
that cite the item, starting after the newest question raised in it, and a
trip's question is keyed by the run label. SystemdLauncher holds no
instance; unit names are validated before systemctl sees them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The run cap and cadence leave the control reader only inside a Grant with
private fields, so a cap cannot exist without a released brake and an
in-bounds dial. effective() is private; its one caller is read_effective.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
