The shared request decoder (envelope.rs) no longer quotes decoder text or
envelope fields: a refusal names the field path and the class. MindStatus.persona
is PersonaStatus {Absent, Stored, Unreadable}, so whoami answers in the persona
door's own terms.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pins identity-write-all-visible: publicName, publicDescription, presentation
and values change through put_persona with no per-field rule and no rate
limit beyond the monotone updatedAt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The match on type, key and bytes was three conditions for one fact; the
newest receipt writing the persona identity is that fact. Tests pin the
declared-name walk and the receipt of each of five consecutive puts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The jsonschema error kind lives in jsonschema::error; the eureka-state tool
closures own their input; huginn.mind_request/response.v1 carry the persona
operations (derived by the existing published_wire_schemas test).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
put_persona replaces the mind's gamecult.persona_state.v0 whole through the
commit primitive: schema-valid against the published file, personaId is the
instance, canonical provenance, CAS on updatedAt, monotone updatedAt. The
document is an opaque seventeenth stored type, one per mind. Wire operations
persona_get and persona_put, MindStatus.persona, HuginnClient methods and the
eureka-state persona tools. Published wire schemas follow in the next commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rust-toolchain.toml owns which rustc and clippy judge the tree. View in
HuginnMindResponse is boxed so the large_enum_variant allow on the wire
type is deleted; the PipelineDocument allow keeps a sharpened reason.
Type aliases, is_multiple_of, slice::from_ref and a literal refused()
clear the rest. Wire bytes and schemas are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cargo clippy -D warnings failed at df7507b on PipelineDocument (masking these downstream); the two enums
are returned once per commit or request, and admission.rs resolution matrix returned a let binding. Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cargo clippy --locked --workspace --all-targets -- -D warnings 2>&1 | tail -30
echo "CLIPPY-RC ${PIPESTATUS[0]}"
cargo test --locked --workspace 2>&1 | grep -E "^test result" | awk '{p+=$4; f+=$6} END {print "TOTAL passed", p, "failed", f}'
EOS
S=$(pwd); (SUMMARY=$S/v4.log nohup bash C:/Users/Meta/.claude/skills/eureka/tools/stopgap/ygg-verify.sh /f/Projects/Huginn-leaf-anchors HEAD rust "$(tr -d '\r' < v4.sh)" > v4.launch 2>&1 &); sleep 1; echo ok
Allow clippy::large_enum_variant on PipelineDocument
CutSpec.reads grows the largest variant past clippy's 200-byte gap to the next; boxing a variant would change every construction site, and a document is a transient wrapper around one value. Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two golden lines appended (dumped by golden_dump on Yggdrasil at 44c010c; numstat 3 added, 0 deleted
against the base) and the six schemas regenerated from the types. Builds; with 44c010c the
workspace tests are expected to pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds Absent, Symbol, ReadAnchor and read_window_is_bounded, the marker in
value_types!, the workspace fixtures and the reads admission test. The
golden file and the six published schemas are not regenerated yet, so the
golden, schema and wire-schema tests fail at this commit (it builds).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1-s3 hold (eureka-substrate:verdict:cut-run-kind.s3). Additive on the wire; the live upgrade must be daemon-first (follow-up huginn-upgrade-daemon-first).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s3: the window probe wrote a window-probe-<pid> instance under the real
/etc/gamecult/minds. A leading --root argv flag (argv, because sudo -E carries
the environment) replaces the default root; the probe points the real binary at
a tempdir, whose drop removes whatever a failed assert leaves. No test names
/etc/gamecult any more; the path-derivation test uses CONTROL_ROOT.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
run_claims_rule is the one check for a run's claims (in force, held by no
other live run), called by opening and by the withdrawal that reinstates.
Tests: contested second claim on reinstatement, resolved claim refused and
live claims allowed, a repeated non-first claim refused at validate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Under the binary's umask 077 a first write would have left /etc/gamecult/minds
0700 and unreadable by the units. The attacker reports how much it swept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s2: under a permissive umask the store was group/world-writable between
CultCache's rename and the chmod, and an fd opened there survived it. The
mind-control binary now sets umask 077 first (the library never touches the
umask). The writer refuses to write through an existing directory, lock or store
that is not root's or is group/world-writable, with the typed UnsafeStore error
naming path, mode and owner. Tests: a non-root open-for-write probe against the
real binary under umask 000; refusals for 0777/0775 directories, 0666/0664
locks and stores, and a non-root-owned directory; accepted root installs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Withdrawing a run's closure now asks docs.claim_holder, the same owner the
opening rule uses, and refuses AlreadyClaimed when another live run holds a
claim. Duplicate claims within a run are refused at validate. Tests pin the
reinstatement sequence, second-claim holders, and same-key different-content
IdentityCollision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Modes under umask 000/022/077 via a re-executed test child; a non-root user
(setpriv uid 65534, skipped with a message when not root) cannot write the store
but can read it; an undecodable or NaN dial reads Held(Undecodable) whatever the
brake says, which kills the fail-open default-dial mutant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1: created under umask 000 the directory was 777 and the files 666, so a
non-root user could write the store. The writer now sets the directory (when it
creates it), the lock file and the store file explicitly, after the setter's own
refusals so a refused write still creates nothing. CultCache stages with the
process umask and offers no mode, so the store file is set after the rename.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A run's instance must be this mind. Every claim must name a document in force
(MissingReference, CitesResolvedDocument); a claim held by another run in force
is refused AlreadyClaimed { item, run }, so the claim is the one consumption
fact. A byte-identical replay of an admitted run owes its claims no fresh
freedom and answers AlreadyAdmitted. A run resolves Recorded or Withdrawn only.
Runs cite their claims under role `claims`, so cites and cited selections reach
them; the header facts carry label, operator, turn, start and claims.
The published schemas that embed PipelineKind (finding, follow_up, question,
resolution, ruling) and the two mind wire schemas are re-derived: the Run
variant, PipelineFacts::Run, AlreadyClaimed and the claims role. The leaf commit
before this one has those five stale.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two cargo-mutants survivors from the first run (main -> (), and the
--instance match guard -> true) are killed by a malformed-command table row
and a process-level test of the refused invocation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A run is the one record of what a Self or a Persona turn took on: key
<instance>:run:<label>, claims of CutSpec, Finding or FollowUp only (refused at
validate), a canonical-decimal budget, turn PersonaTurn or SelfRun per ruling
every-wake-a-run. The run sample is appended at the end of samples(); the golden
gains one line after sample.hand_off and no existing line changes. The
schema and its catalogue entry are derived from the type. No existing kind or
field is touched; the epoch stays v2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The four hand-spelled lists in rows.rs could drift from the leaf enums they
restate; each alias now reads its domain from the enum, as the authority
alias already does. No behaviour change.
Follow-up: eureka-substrate:follow_up:alias-lists-from-names
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Additive unit-enum variant; schemas regenerated by derivation. The query
alias domain now derives from the enum (unit_enums! exposes NAMES), so the
second authority list in huginn-mind rows.rs is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LICENSE is the gnu.org agpl-3.0.txt verbatim (LF). The golden header now
names 44be4cd as the dump commit, the four kinds (cut_spec, cut_report,
finding, follow_up) whose source-path string was renamed relative to
Epiphany ef956865, and that 87b6455 differs only in test code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the AGPL-3.0 text as LICENSE and set the workspace license to
AGPL-3.0-only (rulings license-split, leaf-relicensed-agpl); the leaf's
provenance (Epiphany ef956865, PolyForm Noncommercial, relicensed by its sole
copyright holder 2026-10-09) is recorded in its Cargo.toml and README.
One [workspace.dependencies] entry per CultLib crate now owns the revision;
the crates inherit it. index.json lists Huginn's two wire schemas too, and the
catalogue test drops its huginn. prefix exclusion: every schema file is listed.
README and AGENTS stop naming Epiphany notes as the owner of the cut.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kills the one cargo-mutants survivor on eureka-pipeline (Display::fmt replaced
by Ok(Default::default())).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Package and lib become eureka-pipeline / eureka_pipeline; the crate joins the
workspace; huginn-mind's git dependency on GameCult/Epiphany is replaced by
the path, and Cargo.lock is regenerated (the Epiphany source entry is gone).
Every epiphany_pipeline mention in huginn-mind, huginn-daemon and eureka-state
is renamed. The schema-publication test reads ../../schemas/cultnet. The
leaf's license-file key (../LICENSE, which Huginn has no file for) is dropped.
Type ids, the epoch and every schema_id string are untouched. Schemas README
and the pipeline section of schemas/cultnet/README.md are rewritten for the
new home; README and AGENTS no longer say the leaf is pinned by git. New test:
the catalogue lists exactly the schema files beside it.
Not yet built or tested; verification follows on Yggdrasil.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Byte-identical blobs of epiphany-pipeline/{Cargo.toml,src/lib.rs},
schemas/README.md and schemas/cultnet/* at Epiphany ef9568655e75, so Soul can
diff the copy against the source. Left out as the spec orders:
epiphany.work_organ_state.v0.schema.json and its index.json entry (no reader
outside Epiphany). Epiphany's schemas/cultnet/README.md is not copied over
Huginn's own README there; the next commit folds its pipeline section in.
The crate is not yet a workspace member and keeps its Epiphany names, so this
commit does not build as a package; nothing else changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
