The gate body moves out of the ignored test into one function over a Mind, now
also refusing a receipted pipeline write with no stored document. The ignored
test is a thin caller; CI plants each fault on a 135-document store.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Mind::view becomes validate_ref then Reader::at(head).view(id); Reader::view is
its lookup, so a caller holding one Reader views many documents from one
snapshot. stored_documents_read_back (ignored, HUGINN_MIND_SNAPSHOT) decodes,
validates, rekeys, re-prepares and views every stored document through one
Reader: O(N) where the deleted per-document Mind::view loop was O(N^2).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
mind::tests::snapshot_admits_and_reads_back (an O(N^2) per-document Mind::view loop
plus the six idunn-watchdog resolutions and over-64-byte withdrawals of the
2026-10-01 migration) and eureka-pipeline tests::stored_documents_read_back go,
with the leaf README's real-store section. The one gate follows in huginn-mind.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
With projection gone the walk spreads Selection::default(); an explicit
descending: false was a mutant no test could tell from the default.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The previous commit's test admitted a Superseded resolution of a question,
which admission refuses. Cite r2 through subject and superseded_by instead.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The walk never reads projection (select reads it only in validate and the
cursor digest), so the assignment and its "headers only" comment decided
nothing. A new test cites Q1 through two roles by rows of one schema and
asserts exact members and matched for subject, superseded_by and no role.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The previous commit's test expected plain key order and fails; this one builds
and corrects it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
walk_selection is deleted: members is the only place the walk is spelled.
Members carries the number of select pages taken. The page-size test calls
members with caller limit 1 and document projection over 590 questions and
asserts the exact ids and exactly 3 pages. A new test pins that the cites
hop limits members and matched to the cited rows.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Twenty members, top_k 15 and 200: the index limit and the row count are both
asserted. Unverified at this commit: built and tested once at the end of the batch.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
filter and params are asserted by value, so must_not and a top-level exact
fail. live_index_smoke searches a strict subset that leaves out the nearest
point. Unverified at this commit: built and tested once at the end of the batch.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The walk selection is built field by field from the caller's filters, so a
caller's limit, projection, order or cursor cannot reach it (one select per
member at limit 1 measured 300 ms against 14 ms). A test pins it.
Unverified at this commit: built and tested once at the end of the batch.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
cargo-mutants showed deleting it survives: ids come from rows whatever the
projection, so the override decided nothing.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The previous commit wrote raw newlines into the JSON string, which the
published file must not hold.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The first commit's huginn-mind test module did not compile (helper shadowed
by a local binding, and a mechanical rewrite had touched the helper body).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The mind decides membership (Mind::members) before the index is asked; the
index scores exactly the members (Qdrant has_id + exact) and the page carries
one cosine score per row. Deletes OVERSAMPLE_MAX, the x4 oversample, the
unfiltered VectorIndex::search contract and check_semantic.
Not yet compiled when committed: the first Yggdrasil run follows.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Admit deny reaches the model (prefixed "hook error"); SubagentStart context
and the admit hook both reach subagents; PreToolUse updatedInput on Agent
does rewrite the subagent's prompt (GitHub #39814 does not hold here).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Imagination pass for cut recall-admit (session self-2026-10-23-eureka-b):
hook input fields, digest stability, latency, fail-open rationale, and the
re-scoped trigger order with the prompt hook last.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Opens claude only under an open Self run; one pure decide() owns flush, grace, headroom and escalation; process-group signals; ends on child exit or EOF. Soul s3 holds (eureka-body:verdict:cut-mind-self-run.s3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Persona claim-set property drew ids as doc-N and doc; they now come
from the instance-name generator (varied alphabets, both separators, edge
lengths), so a refusal keyed on id text cannot pass. Set shapes and sizes
are unchanged. Follow-up persona-claim-ids-varied.
Not yet built; verified at the head of the cut.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
eureka is held; eureka-two, eureka2 and xeureka are released with a dial and
open. Kills Soul's s-check-wrong-instance-by-prefix mutant. Follow-up
gate-prefix-neighbour-test.
Not yet built; verified at the head of the cut.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
When systemctl stop fails, stop_all asks is-active for each of the two
units and the error names each state (active, inactive, failed, unknown)
beside the exit status; brake hold says the brake is held and the stop
failed, not that the units were not stopped. Exit 2 and the held brake
are unchanged. Follow-up brake-partial-stop-message.
Not yet built; verified at the head of the cut.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Adds the row (heat 0.05, base cooldown u32::MAX, 85,899,345,900 s) to the
wait test so any ceiling on the wait fails, and gives the ignored host test its
command in a crate README (the lane that kills the host() mutants). Tests and
docs only; builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The env test pins the variable's name and that the flag wins over it. The ignored container test seeds a mind, serves it with the real huginn-daemon, writes the brake at its real root and runs the real mind-wake with an empty PATH (so no unit is reached): the run it opens must carry /proc/sys/kernel/hostname as host and mind-wake as agent, which kills the three host() mutants of finding host-survivors-reachable.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Closes the test gaps of findings cadence-clamp-unpinned and codes-and-agent-unpinned: a floor of 1 s or a ceiling of 80000 s on the wait now fails the cadence test, and the receipt's agent and the printed code of every refusal are compared with the spelling, not with the constant that produced them.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
wake::cycle reads the brake and dial through the one derivation behind
read_effective and the unit gate, returns Held before any query, admission or
unit call, finds the newest Persona turn of hers (any status) with one
descending single-row query, and launches through open_and_launch. The
mind-wake binary prints the outcome. control_path no longer echoes the
instance it refuses.
Does not build the public_surface snapshot yet (the next commit updates it).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The writers refuse an out-of-bounds dial, so the DialOutOfBounds reading is
produced through the unchecked store the crate's own tests already use. The
store directory holds a second file besides control.cc, so the no-write test
compares listings rather than counting one.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Exit 0 only when the one derivation reads Released; every other reading
(absent, held, no dial, dial out of bounds, undecodable store) is an error
and exits 2, which systemd's ExecCondition reads as skip. A pure read through
FileSource: no writer, no created file or directory.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
stop_args now builds each name through unit(), the one name path start and
alive use, so the stop argv cannot disagree with the units that run (the
:* glob matched none of them on real systemd). A launch test ties stop_args
to what start passes systemctl for several instances; two binary tests run
mind-control brake hold with a fake systemctl first on PATH, so main's
stopper wiring is pinned.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The previous commit (df21694) builds but fails the public_surface test: it did
not update the committed snapshot.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SystemdLauncher::stop_all runs one synchronous systemctl stop over the
instance's mind-self and mind-persona units (stop_args, built from the same
templates as start and alive). cli::run gains a stop_units parameter that only
brake hold calls, after the write whatever its outcome. The window probe uses
dial set instead of brake hold, since a real hold now runs systemctl.
Builds not yet verified on the stopgap at this commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
