Soul s1-s3 hold (eureka-body:verdict:cut-leaf-into-huginn.s3); wire parity defended by committed golden bytes and the live-store read-back. Relicensed AGPL-3.0 (ruling leaf-relicensed-agpl).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LICENSE is the gnu.org agpl-3.0.txt verbatim (LF). The golden header now
names 44be4cd as the dump commit, the four kinds (cut_spec, cut_report,
finding, follow_up) whose source-path string was renamed relative to
Epiphany ef956865, and that 87b6455 differs only in test code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the AGPL-3.0 text as LICENSE and set the workspace license to
AGPL-3.0-only (rulings license-split, leaf-relicensed-agpl); the leaf's
provenance (Epiphany ef956865, PolyForm Noncommercial, relicensed by its sole
copyright holder 2026-10-09) is recorded in its Cargo.toml and README.
One [workspace.dependencies] entry per CultLib crate now owns the revision;
the crates inherit it. index.json lists Huginn's two wire schemas too, and the
catalogue test drops its huginn. prefix exclusion: every schema file is listed.
README and AGENTS stop naming Epiphany notes as the owner of the cut.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kills the one cargo-mutants survivor on eureka-pipeline (Display::fmt replaced
by Ok(Default::default())).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Seven notes copied verbatim from GameCult/Epiphany ef956865 notes/, each with
a one-line provenance comment on top: huginn-organ-cut and the eureka-* and
postmortem notes. Prose only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Package and lib become eureka-pipeline / eureka_pipeline; the crate joins the
workspace; huginn-mind's git dependency on GameCult/Epiphany is replaced by
the path, and Cargo.lock is regenerated (the Epiphany source entry is gone).
Every epiphany_pipeline mention in huginn-mind, huginn-daemon and eureka-state
is renamed. The schema-publication test reads ../../schemas/cultnet. The
leaf's license-file key (../LICENSE, which Huginn has no file for) is dropped.
Type ids, the epoch and every schema_id string are untouched. Schemas README
and the pipeline section of schemas/cultnet/README.md are rewritten for the
new home; README and AGENTS no longer say the leaf is pinned by git. New test:
the catalogue lists exactly the schema files beside it.
Not yet built or tested; verification follows on Yggdrasil.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Byte-identical blobs of epiphany-pipeline/{Cargo.toml,src/lib.rs},
schemas/README.md and schemas/cultnet/* at Epiphany ef9568655e75, so Soul can
diff the copy against the source. Left out as the spec orders:
epiphany.work_organ_state.v0.schema.json and its index.json entry (no reader
outside Epiphany). Epiphany's schemas/cultnet/README.md is not copied over
Huginn's own README there; the next commit folds its pipeline section in.
The crate is not yet a workspace member and keeps its Epiphany names, so this
commit does not build as a package; nothing else changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Body facts, model page and rationale for the eureka-body campaign. The cut
specs and questions are the typed record in the mind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Eureka eureka-substrate cut huginn-admission-rules. Soul verdicts s1 and
s2. Report heads match commits short or full; a finding may defer to a
cut spec; MindSteward is Life (old receipts still decode); the campaign
stewardship check is gone (ruling stewardship-rule); depends_on entries
must name another cut in the campaign (rulings depends-on, self-dep).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Eureka eureka-substrate cut huginn-pin-and-refusals. Soul verdicts s1
(two findings, fixed by 0f491b00) and s2 (holds, no findings). Pins
epiphany-pipeline to the per-kind key bound; a pipeline_key error is
MindRefusal::Document, not Unavailable; the snapshot read-back test
re-keys all 244 stored documents and resolves every stuck subject.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
snapshot_admits_and_reads_back now counts pipeline envelopes apart from the
loop, asserts validate() and pipeline_key == stored key for every one, admits
a resolution for every stuck finding and a withdrawal for every unwithdrawable
resolution, and fails with the id named on any refusal.
The refusal tests assert the exact leaf refusal (field and value from
pipeline_key) at Mind::admit and at the helper, and eureka-state gains a
tool-level test that the typed refusal reaches the result intact.
Tests only; no production code changes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Admission wrapped every prepare error in Unavailable, so a key the leaf
could not compose reached the client as an unavailable organ. One private
prepare(document, cache) now keys through the leaf first, mapped to
MindRefusal::Document, then encodes; Mind::admit and the derived-write loop
both use it. Unavailable stays for store, cache-encode and decode faults.
Tests: an_unkeyable_document_is_refused_as_a_document (store and receipts
unchanged), prepare_classifies_a_key_refusal_as_a_document_and_encodes_the_rest
(the derived path cannot reach an unkeyable resolution after the per-kind
bound, so the helper is pinned directly), and the #[ignore]
snapshot_admits_and_reads_back, which opens a scratch copy of the live mind
named by HUGINN_MIND_SNAPSHOT, views every stored document back unchanged,
resolves the six stuck findings and withdraws one long-keyed resolution.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Moves the leaf from 73edee5cdaddece8bda9c6c3271e8ddd064337f9 to the
leaf-key-bound merge commit on Epiphany main,
ef9568655e75bb6cb362a038e2739a5ac5e777ee. Cargo.lock follows with that one
line; no other lock line moves.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Lands the live memory-organ branch on main per operator ruling
eureka-substrate:ruling:merge-to-main-first ("Merge to main first"),
cut spec eureka-substrate:cut_spec:cut-merge-huginn-main.r1.
The merged tree differs from the deployed release 9dd6d800 only by the two
docs/eureka-substrate-*.md files already on main; crates/, Cargo.toml and
Cargo.lock are identical to the release. eureka/memory-organ is kept and
receives no further commits.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The id parser bounds locals at 64 too; Faculty lives in Huginn; two
refusal sites map key errors to Unavailable; six findings unresolvable and
39 resolutions unwithdrawable in the live mind; the merges are safe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Campaign eureka-substrate, the Mind fixes the operator ruled next after
idunn-watchdog. Typed target and rulings live in Eureka's mind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eureka-state on Windows could not reach the daemon: the cultnet-rs RUDP
client bound 127.0.0.1, and a loopback-bound socket cannot send to
10.77.0.1 (os error 10051). CultLib 8fc74c7 binds the unspecified address
for a remote endpoint. The daemon and the client move together, because
the ack cuts between the revs changed the RUDP handshake.
epiphany-pipeline moves to Epiphany 73edee5, which pins the same CultLib,
so one cultcache-rs is in the graph and the pipeline's CultCache types
stay Huginn's.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
--qdrant-url, --ollama-url and --embedding-model are required since Cut 11a;
the example now runs. Point at the gamecult-ops runbook for the Yggdrasil
unit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Four tools 1:1 with the wire (whoami, admit, view, query); the server
fills instance and provenance.tool; config never kills startup; typed
TooLarge, Rejected, Unencodable and InvalidInput errors. The mind now
validates admission provenance (agent, session, tool) by the leaf's
Title rule. Two Soul passes; registered by the operator 2026-09-30.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A request that fails to encode is a defect in this client, not a transport
failure, so it is ClientError::Unencodable, typed Unencodable at the tool,
instead of the retryable Unavailable. A test reports a non-UTF-8
HUGINN_ENDPOINT as such.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
refuse_provenance validated only agent and session, and only for blank and a
handful of line breaks. It now covers agent, session and tool with the leaf's
Title character rule (an alphanumeric character, no control or line-break
character, no bidi control) inside Short's byte bound. The leaf keeps that rule
private, so a differential test holds the copy to a campaign Title. Restores
the stage doc comment that drifted above SHORT_MAX. Multibyte bound test kills
a chars-count mutant.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The source runtime id adds its field name when present, so exact sizes are
searched over both paddings. The attribution test admits a campaign, which
needs its repo stewarded first.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Request sizes step by four (the payload rides as base64), so a request of
exactly the limit is not reachable through the request. The client tests use
the largest request that fits and the smallest that does not; the raw-socket
test tops a message up with a source runtime id to reach the limit and one
byte past it, which pins the limit against the transport's own refusal.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- The client refuses a request whose encoded size exceeds what one RUDP send
carries (65,507 less the 36-byte header and the 6-byte channel id), before
connecting, as ClientError::TooLarge { bytes, limit }. It was reported as
a retryable Unavailable ("Message too long"). The MCP tools surface it as
isError with {"error":"TooLarge","bytes","limit"}.
- Arguments that fail to deserialize are still a tool error, now with the
same typed body as every other one: {"error":"InvalidInput","detail"}.
- A non-UTF-8 EUREKA_INSTANCE or HUGINN_ENDPOINT is reported as not valid
UTF-8 and not as unset.
- Tests: the schema walk asserts no $id or $schema below any tool's root; the
15 s timeout is measured against a silent daemon; the semantic part of a
query is observed on the wire; Internal's and TooLarge's bodies and the
InvalidInput rewrite are pinned; attribution is refused through the MCP
admit; oversize is TooLarge at and one past the limit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A batch's agent and session were committed as given: "", " ", a 5,000
character string and a string with a line break all became the receipt's
admitting session. The mind now refuses, at A1 before any document is read,
an agent or session that is longer than Short's 200 bytes (FieldBound), blank
after trim, or spread over more than one line (InvalidFormat), so every
writer gets the check. The refusals are the leaf's own, since the fields are
the leaf's Short type; the published wire schema does not change. Short
exposes no validator, so the bound is a constant pinned to the maxLength its
schema publishes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
cargo-mutants on the Cut 13b diff: replacing get_info with Default::default()
survived, and a client that does not see a tools capability does not list tools.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
8041d82 did not build on its own: the moved Inert index names PipelineRef and
the import stayed behind in client.rs.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The eureka-state binary serves whoami, admit, view and query over stdio (rmcp
2.2.0), each one HuginnClient call. EUREKA_INSTANCE and HUGINN_ENDPOINT are
process configuration: the server fills in the instance and provenance.tool, so
input can name neither. Bad configuration never stops startup; whoami reports
it and every other tool refuses with the typed body. A mind's refusal is a
normal result; Unavailable, Rejected and Misconfigured are results with
isError. The query input schema bundles CultLib's selection schema into $defs
(vendored; a test pins it to the cultnet-rs revision).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
