A run's instance must be this mind. Every claim must name a document in force
(MissingReference, CitesResolvedDocument); a claim held by another run in force
is refused AlreadyClaimed { item, run }, so the claim is the one consumption
fact. A byte-identical replay of an admitted run owes its claims no fresh
freedom and answers AlreadyAdmitted. A run resolves Recorded or Withdrawn only.
Runs cite their claims under role `claims`, so cites and cited selections reach
them; the header facts carry label, operator, turn, start and claims.
The published schemas that embed PipelineKind (finding, follow_up, question,
resolution, ruling) and the two mind wire schemas are re-derived: the Run
variant, PipelineFacts::Run, AlreadyClaimed and the claims role. The leaf commit
before this one has those five stale.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A run is the one record of what a Self or a Persona turn took on: key
<instance>:run:<label>, claims of CutSpec, Finding or FollowUp only (refused at
validate), a canonical-decimal budget, turn PersonaTurn or SelfRun per ruling
every-wake-a-run. The run sample is appended at the end of samples(); the golden
gains one line after sample.hand_off and no existing line changes. The
schema and its catalogue entry are derived from the type. No existing kind or
field is touched; the epoch stays v2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The four hand-spelled lists in rows.rs could drift from the leaf enums they
restate; each alias now reads its domain from the enum, as the authority
alias already does. No behaviour change.
Follow-up: eureka-substrate:follow_up:alias-lists-from-names
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1 holds (eureka-substrate:verdict:cut-mind-authority.s1). Additive on the wire; the live upgrade must be daemon-first (follow-up mind-variant-daemon-first).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run, breaker, units and wake-frame rows follow every-wake-a-run and mind-launch r1;
the leaf rows state the as-landed crate, golden pin and AGPL license; the additive
rule names the `= absent` marker; F15-F17 added; Undone updated; stale future-tense
and Epiphany-owner lines made present tense.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Additive unit-enum variant; schemas regenerated by derivation. The query
alias domain now derives from the enum (unit_enums! exposes NAMES), so the
second authority list in huginn-mind rows.rs is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1-s3 hold (eureka-body:verdict:cut-leaf-into-huginn.s3); wire parity defended by committed golden bytes and the live-store read-back. Relicensed AGPL-3.0 (ruling leaf-relicensed-agpl).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LICENSE is the gnu.org agpl-3.0.txt verbatim (LF). The golden header now
names 44be4cd as the dump commit, the four kinds (cut_spec, cut_report,
finding, follow_up) whose source-path string was renamed relative to
Epiphany ef956865, and that 87b6455 differs only in test code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the AGPL-3.0 text as LICENSE and set the workspace license to
AGPL-3.0-only (rulings license-split, leaf-relicensed-agpl); the leaf's
provenance (Epiphany ef956865, PolyForm Noncommercial, relicensed by its sole
copyright holder 2026-10-09) is recorded in its Cargo.toml and README.
One [workspace.dependencies] entry per CultLib crate now owns the revision;
the crates inherit it. index.json lists Huginn's two wire schemas too, and the
catalogue test drops its huginn. prefix exclusion: every schema file is listed.
README and AGENTS stop naming Epiphany notes as the owner of the cut.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kills the one cargo-mutants survivor on eureka-pipeline (Display::fmt replaced
by Ok(Default::default())).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Seven notes copied verbatim from GameCult/Epiphany ef956865 notes/, each with
a one-line provenance comment on top: huginn-organ-cut and the eureka-* and
postmortem notes. Prose only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Package and lib become eureka-pipeline / eureka_pipeline; the crate joins the
workspace; huginn-mind's git dependency on GameCult/Epiphany is replaced by
the path, and Cargo.lock is regenerated (the Epiphany source entry is gone).
Every epiphany_pipeline mention in huginn-mind, huginn-daemon and eureka-state
is renamed. The schema-publication test reads ../../schemas/cultnet. The
leaf's license-file key (../LICENSE, which Huginn has no file for) is dropped.
Type ids, the epoch and every schema_id string are untouched. Schemas README
and the pipeline section of schemas/cultnet/README.md are rewritten for the
new home; README and AGENTS no longer say the leaf is pinned by git. New test:
the catalogue lists exactly the schema files beside it.
Not yet built or tested; verification follows on Yggdrasil.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Byte-identical blobs of epiphany-pipeline/{Cargo.toml,src/lib.rs},
schemas/README.md and schemas/cultnet/* at Epiphany ef9568655e75, so Soul can
diff the copy against the source. Left out as the spec orders:
epiphany.work_organ_state.v0.schema.json and its index.json entry (no reader
outside Epiphany). Epiphany's schemas/cultnet/README.md is not copied over
Huginn's own README there; the next commit folds its pipeline section in.
The crate is not yet a workspace member and keeps its Epiphany names, so this
commit does not build as a package; nothing else changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Body facts, model page and rationale for the eureka-body campaign. The cut
specs and questions are the typed record in the mind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Eureka eureka-substrate cut huginn-admission-rules. Soul verdicts s1 and
s2. Report heads match commits short or full; a finding may defer to a
cut spec; MindSteward is Life (old receipts still decode); the campaign
stewardship check is gone (ruling stewardship-rule); depends_on entries
must name another cut in the campaign (rulings depends-on, self-dep).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Eureka eureka-substrate cut huginn-pin-and-refusals. Soul verdicts s1
(two findings, fixed by 0f491b00) and s2 (holds, no findings). Pins
epiphany-pipeline to the per-kind key bound; a pipeline_key error is
MindRefusal::Document, not Unavailable; the snapshot read-back test
re-keys all 244 stored documents and resolves every stuck subject.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
snapshot_admits_and_reads_back now counts pipeline envelopes apart from the
loop, asserts validate() and pipeline_key == stored key for every one, admits
a resolution for every stuck finding and a withdrawal for every unwithdrawable
resolution, and fails with the id named on any refusal.
The refusal tests assert the exact leaf refusal (field and value from
pipeline_key) at Mind::admit and at the helper, and eureka-state gains a
tool-level test that the typed refusal reaches the result intact.
Tests only; no production code changes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Admission wrapped every prepare error in Unavailable, so a key the leaf
could not compose reached the client as an unavailable organ. One private
prepare(document, cache) now keys through the leaf first, mapped to
MindRefusal::Document, then encodes; Mind::admit and the derived-write loop
both use it. Unavailable stays for store, cache-encode and decode faults.
Tests: an_unkeyable_document_is_refused_as_a_document (store and receipts
unchanged), prepare_classifies_a_key_refusal_as_a_document_and_encodes_the_rest
(the derived path cannot reach an unkeyable resolution after the per-kind
bound, so the helper is pinned directly), and the #[ignore]
snapshot_admits_and_reads_back, which opens a scratch copy of the live mind
named by HUGINN_MIND_SNAPSHOT, views every stored document back unchanged,
resolves the six stuck findings and withdraws one long-keyed resolution.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Moves the leaf from 73edee5cdaddece8bda9c6c3271e8ddd064337f9 to the
leaf-key-bound merge commit on Epiphany main,
ef9568655e75bb6cb362a038e2739a5ac5e777ee. Cargo.lock follows with that one
line; no other lock line moves.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Lands the live memory-organ branch on main per operator ruling
eureka-substrate:ruling:merge-to-main-first ("Merge to main first"),
cut spec eureka-substrate:cut_spec:cut-merge-huginn-main.r1.
The merged tree differs from the deployed release 9dd6d800 only by the two
docs/eureka-substrate-*.md files already on main; crates/, Cargo.toml and
Cargo.lock are identical to the release. eureka/memory-organ is kept and
receives no further commits.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The id parser bounds locals at 64 too; Faculty lives in Huginn; two
refusal sites map key errors to Unavailable; six findings unresolvable and
39 resolutions unwithdrawable in the live mind; the merges are safe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Campaign eureka-substrate, the Mind fixes the operator ruled next after
idunn-watchdog. Typed target and rulings live in Eureka's mind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eureka-state on Windows could not reach the daemon: the cultnet-rs RUDP
client bound 127.0.0.1, and a loopback-bound socket cannot send to
10.77.0.1 (os error 10051). CultLib 8fc74c7 binds the unspecified address
for a remote endpoint. The daemon and the client move together, because
the ack cuts between the revs changed the RUDP handshake.
epiphany-pipeline moves to Epiphany 73edee5, which pins the same CultLib,
so one cultcache-rs is in the graph and the pipeline's CultCache types
stay Huginn's.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
--qdrant-url, --ollama-url and --embedding-model are required since Cut 11a;
the example now runs. Point at the gamecult-ops runbook for the Yggdrasil
unit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Four tools 1:1 with the wire (whoami, admit, view, query); the server
fills instance and provenance.tool; config never kills startup; typed
TooLarge, Rejected, Unencodable and InvalidInput errors. The mind now
validates admission provenance (agent, session, tool) by the leaf's
Title rule. Two Soul passes; registered by the operator 2026-09-30.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A request that fails to encode is a defect in this client, not a transport
failure, so it is ClientError::Unencodable, typed Unencodable at the tool,
instead of the retryable Unavailable. A test reports a non-UTF-8
HUGINN_ENDPOINT as such.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
refuse_provenance validated only agent and session, and only for blank and a
handful of line breaks. It now covers agent, session and tool with the leaf's
Title character rule (an alphanumeric character, no control or line-break
character, no bidi control) inside Short's byte bound. The leaf keeps that rule
private, so a differential test holds the copy to a campaign Title. Restores
the stage doc comment that drifted above SHORT_MAX. Multibyte bound test kills
a chars-count mutant.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The source runtime id adds its field name when present, so exact sizes are
searched over both paddings. The attribution test admits a campaign, which
needs its repo stewarded first.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Request sizes step by four (the payload rides as base64), so a request of
exactly the limit is not reachable through the request. The client tests use
the largest request that fits and the smallest that does not; the raw-socket
test tops a message up with a source runtime id to reach the limit and one
byte past it, which pins the limit against the transport's own refusal.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
