Modes under umask 000/022/077 via a re-executed test child; a non-root user
(setpriv uid 65534, skipped with a message when not root) cannot write the store
but can read it; an undecodable or NaN dial reads Held(Undecodable) whatever the
brake says, which kills the fail-open default-dial mutant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1: created under umask 000 the directory was 777 and the files 666, so a
non-root user could write the store. The writer now sets the directory (when it
creates it), the lock file and the store file explicitly, after the setter's own
refusals so a refused write still creates nothing. CultCache stages with the
process umask and offers no mode, so the store file is set after the rename.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two cargo-mutants survivors from the first run (main -> (), and the
--instance match guard -> true) are killed by a malformed-command table row
and a process-level test of the refused invocation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1 holds (eureka-substrate:verdict:cut-mind-authority.s1). Additive on the wire; the live upgrade must be daemon-first (follow-up mind-variant-daemon-first).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run, breaker, units and wake-frame rows follow every-wake-a-run and mind-launch r1;
the leaf rows state the as-landed crate, golden pin and AGPL license; the additive
rule names the `= absent` marker; F15-F17 added; Undone updated; stale future-tense
and Epiphany-owner lines made present tense.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Additive unit-enum variant; schemas regenerated by derivation. The query
alias domain now derives from the enum (unit_enums! exposes NAMES), so the
second authority list in huginn-mind rows.rs is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1-s3 hold (eureka-body:verdict:cut-leaf-into-huginn.s3); wire parity defended by committed golden bytes and the live-store read-back. Relicensed AGPL-3.0 (ruling leaf-relicensed-agpl).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LICENSE is the gnu.org agpl-3.0.txt verbatim (LF). The golden header now
names 44be4cd as the dump commit, the four kinds (cut_spec, cut_report,
finding, follow_up) whose source-path string was renamed relative to
Epiphany ef956865, and that 87b6455 differs only in test code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the AGPL-3.0 text as LICENSE and set the workspace license to
AGPL-3.0-only (rulings license-split, leaf-relicensed-agpl); the leaf's
provenance (Epiphany ef956865, PolyForm Noncommercial, relicensed by its sole
copyright holder 2026-10-09) is recorded in its Cargo.toml and README.
One [workspace.dependencies] entry per CultLib crate now owns the revision;
the crates inherit it. index.json lists Huginn's two wire schemas too, and the
catalogue test drops its huginn. prefix exclusion: every schema file is listed.
README and AGENTS stop naming Epiphany notes as the owner of the cut.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kills the one cargo-mutants survivor on eureka-pipeline (Display::fmt replaced
by Ok(Default::default())).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Seven notes copied verbatim from GameCult/Epiphany ef956865 notes/, each with
a one-line provenance comment on top: huginn-organ-cut and the eureka-* and
postmortem notes. Prose only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Package and lib become eureka-pipeline / eureka_pipeline; the crate joins the
workspace; huginn-mind's git dependency on GameCult/Epiphany is replaced by
the path, and Cargo.lock is regenerated (the Epiphany source entry is gone).
Every epiphany_pipeline mention in huginn-mind, huginn-daemon and eureka-state
is renamed. The schema-publication test reads ../../schemas/cultnet. The
leaf's license-file key (../LICENSE, which Huginn has no file for) is dropped.
Type ids, the epoch and every schema_id string are untouched. Schemas README
and the pipeline section of schemas/cultnet/README.md are rewritten for the
new home; README and AGENTS no longer say the leaf is pinned by git. New test:
the catalogue lists exactly the schema files beside it.
Not yet built or tested; verification follows on Yggdrasil.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Byte-identical blobs of epiphany-pipeline/{Cargo.toml,src/lib.rs},
schemas/README.md and schemas/cultnet/* at Epiphany ef9568655e75, so Soul can
diff the copy against the source. Left out as the spec orders:
epiphany.work_organ_state.v0.schema.json and its index.json entry (no reader
outside Epiphany). Epiphany's schemas/cultnet/README.md is not copied over
Huginn's own README there; the next commit folds its pipeline section in.
The crate is not yet a workspace member and keeps its Epiphany names, so this
commit does not build as a package; nothing else changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Body facts, model page and rationale for the eureka-body campaign. The cut
specs and questions are the typed record in the mind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Eureka eureka-substrate cut huginn-admission-rules. Soul verdicts s1 and
s2. Report heads match commits short or full; a finding may defer to a
cut spec; MindSteward is Life (old receipts still decode); the campaign
stewardship check is gone (ruling stewardship-rule); depends_on entries
must name another cut in the campaign (rulings depends-on, self-dep).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Eureka eureka-substrate cut huginn-pin-and-refusals. Soul verdicts s1
(two findings, fixed by 0f491b00) and s2 (holds, no findings). Pins
epiphany-pipeline to the per-kind key bound; a pipeline_key error is
MindRefusal::Document, not Unavailable; the snapshot read-back test
re-keys all 244 stored documents and resolves every stuck subject.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
snapshot_admits_and_reads_back now counts pipeline envelopes apart from the
loop, asserts validate() and pipeline_key == stored key for every one, admits
a resolution for every stuck finding and a withdrawal for every unwithdrawable
resolution, and fails with the id named on any refusal.
The refusal tests assert the exact leaf refusal (field and value from
pipeline_key) at Mind::admit and at the helper, and eureka-state gains a
tool-level test that the typed refusal reaches the result intact.
Tests only; no production code changes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Admission wrapped every prepare error in Unavailable, so a key the leaf
could not compose reached the client as an unavailable organ. One private
prepare(document, cache) now keys through the leaf first, mapped to
MindRefusal::Document, then encodes; Mind::admit and the derived-write loop
both use it. Unavailable stays for store, cache-encode and decode faults.
Tests: an_unkeyable_document_is_refused_as_a_document (store and receipts
unchanged), prepare_classifies_a_key_refusal_as_a_document_and_encodes_the_rest
(the derived path cannot reach an unkeyable resolution after the per-kind
bound, so the helper is pinned directly), and the #[ignore]
snapshot_admits_and_reads_back, which opens a scratch copy of the live mind
named by HUGINN_MIND_SNAPSHOT, views every stored document back unchanged,
resolves the six stuck findings and withdraws one long-keyed resolution.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Moves the leaf from 73edee5cdaddece8bda9c6c3271e8ddd064337f9 to the
leaf-key-bound merge commit on Epiphany main,
ef9568655e75bb6cb362a038e2739a5ac5e777ee. Cargo.lock follows with that one
line; no other lock line moves.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Lands the live memory-organ branch on main per operator ruling
eureka-substrate:ruling:merge-to-main-first ("Merge to main first"),
cut spec eureka-substrate:cut_spec:cut-merge-huginn-main.r1.
The merged tree differs from the deployed release 9dd6d800 only by the two
docs/eureka-substrate-*.md files already on main; crates/, Cargo.toml and
Cargo.lock are identical to the release. eureka/memory-organ is kept and
receives no further commits.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The id parser bounds locals at 64 too; Faculty lives in Huginn; two
refusal sites map key errors to Unavailable; six findings unresolvable and
39 resolutions unwithdrawable in the live mind; the merges are safe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Campaign eureka-substrate, the Mind fixes the operator ruled next after
idunn-watchdog. Typed target and rulings live in Eureka's mind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eureka-state on Windows could not reach the daemon: the cultnet-rs RUDP
client bound 127.0.0.1, and a loopback-bound socket cannot send to
10.77.0.1 (os error 10051). CultLib 8fc74c7 binds the unspecified address
for a remote endpoint. The daemon and the client move together, because
the ack cuts between the revs changed the RUDP handshake.
epiphany-pipeline moves to Epiphany 73edee5, which pins the same CultLib,
so one cultcache-rs is in the graph and the pipeline's CultCache types
stay Huginn's.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
--qdrant-url, --ollama-url and --embedding-model are required since Cut 11a;
the example now runs. Point at the gamecult-ops runbook for the Yggdrasil
unit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Four tools 1:1 with the wire (whoami, admit, view, query); the server
fills instance and provenance.tool; config never kills startup; typed
TooLarge, Rejected, Unencodable and InvalidInput errors. The mind now
validates admission provenance (agent, session, tool) by the leaf's
Title rule. Two Soul passes; registered by the operator 2026-09-30.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A request that fails to encode is a defect in this client, not a transport
failure, so it is ClientError::Unencodable, typed Unencodable at the tool,
instead of the retryable Unavailable. A test reports a non-UTF-8
HUGINN_ENDPOINT as such.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
