mind-persona@<instance>.service and mind-self@<instance>.service; the run
label no longer enters the unit name, and only the instance is validated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
open_and_launch takes a Grant by value. Step 0 reads the in-force runs of
hers of the request's turn on the instance (typed facts): a live unit or a
run inside START_GRACE_S answers Busy; a dead one is closed Recorded in the
same admission that opens the next run, so the in-force record is the one
owner of liveness. Admission's AlreadyLive maps to Busy. The alias Busy query
and the whole-mind breaker scan are deleted: the breaker counts the documents
that cite the item, starting after the newest question raised in it, and a
trip's question is keyed by the run label. SystemdLauncher holds no
instance; unit names are validated before systemctl sees them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The run cap and cadence leave the control reader only inside a Grant with
private fields, so a cap cannot exist without a released brake and an
in-bounds dial. effective() is private; its one caller is read_effective.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AlreadyLive and AlreadyClaimed carry RunId, which parses as a run key on
every door, so a peer cannot fill it with an arbitrary string. The live
check applies only to a run the batch leaves in force. Tests pin a holder
that differs in start, host and budget, a born-closed run, and the second
live Persona turn's admission refusal in mind-body.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Admission now holds one live run of hers per turn, so the budget test that
launched three Persona turns in a row without ending any is refused at the
second. It ends each turn; mind-launch r3 rewrites this test next.
7ef8669 does not pass this test; this commit does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ff259a1 and 11af610 carry the schema block one indent level too deep, so
published_wire_schemas_match_derivation fails on them; this commit fixes it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The previous commit (ff259a1) does not build its tests: RunTurn was not in
scope in admission.rs's test module. This commit builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ruling one-live-self-run, decided where batches are serialized: run_rule
(was run_claims_rule) now also refuses an opening or reinstated run whose
instance and turn already have an in-force operated_by Mind run. The
fixture run() is an operator's run; mind_run() is hers. Unverified: this
commit has not been built when written; verification follows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds the turn and operated_by aliases on the run kind, and in mind-body the
Launcher port with SystemdLauncher, the work queue, the repetition breaker and
open_and_launch. Not yet built: this commit may not compile.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Imagination imagination-brake-stop, session self-2026-10-09-eureka: body
facts F18-F20, model rows for run, Brake and Units, and the rationale for
a synchronous stop owned by `mind-control brake hold`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1-s3 hold (eureka-substrate:verdict:cut-run-kind.s3). Additive on the wire; the live upgrade must be daemon-first (follow-up huginn-upgrade-daemon-first).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1-s4 hold (eureka-body:verdict:cut-mind-control-store.s4). Nothing installed on Yggdrasil yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s3: the window probe wrote a window-probe-<pid> instance under the real
/etc/gamecult/minds. A leading --root argv flag (argv, because sudo -E carries
the environment) replaces the default root; the probe points the real binary at
a tempdir, whose drop removes whatever a failed assert leaves. No test names
/etc/gamecult any more; the path-derivation test uses CONTROL_ROOT.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
run_claims_rule is the one check for a run's claims (in force, held by no
other live run), called by opening and by the withdrawal that reinstates.
Tests: contested second claim on reinstatement, resolved claim refused and
live claims allowed, a repeated non-first claim refused at validate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Under the binary's umask 077 a first write would have left /etc/gamecult/minds
0700 and unreadable by the units. The attacker reports how much it swept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s2: under a permissive umask the store was group/world-writable between
CultCache's rename and the chmod, and an fd opened there survived it. The
mind-control binary now sets umask 077 first (the library never touches the
umask). The writer refuses to write through an existing directory, lock or store
that is not root's or is group/world-writable, with the typed UnsafeStore error
naming path, mode and owner. Tests: a non-root open-for-write probe against the
real binary under umask 000; refusals for 0777/0775 directories, 0666/0664
locks and stores, and a non-root-owned directory; accepted root installs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Withdrawing a run's closure now asks docs.claim_holder, the same owner the
opening rule uses, and refuses AlreadyClaimed when another live run holds a
claim. Duplicate claims within a run are refused at validate. Tests pin the
reinstatement sequence, second-claim holders, and same-key different-content
IdentityCollision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Modes under umask 000/022/077 via a re-executed test child; a non-root user
(setpriv uid 65534, skipped with a message when not root) cannot write the store
but can read it; an undecodable or NaN dial reads Held(Undecodable) whatever the
brake says, which kills the fail-open default-dial mutant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1: created under umask 000 the directory was 777 and the files 666, so a
non-root user could write the store. The writer now sets the directory (when it
creates it), the lock file and the store file explicitly, after the setter's own
refusals so a refused write still creates nothing. CultCache stages with the
process umask and offers no mode, so the store file is set after the rename.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A run's instance must be this mind. Every claim must name a document in force
(MissingReference, CitesResolvedDocument); a claim held by another run in force
is refused AlreadyClaimed { item, run }, so the claim is the one consumption
fact. A byte-identical replay of an admitted run owes its claims no fresh
freedom and answers AlreadyAdmitted. A run resolves Recorded or Withdrawn only.
Runs cite their claims under role `claims`, so cites and cited selections reach
them; the header facts carry label, operator, turn, start and claims.
The published schemas that embed PipelineKind (finding, follow_up, question,
resolution, ruling) and the two mind wire schemas are re-derived: the Run
variant, PipelineFacts::Run, AlreadyClaimed and the claims role. The leaf commit
before this one has those five stale.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two cargo-mutants survivors from the first run (main -> (), and the
--instance match guard -> true) are killed by a malformed-command table row
and a process-level test of the refused invocation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A run is the one record of what a Self or a Persona turn took on: key
<instance>:run:<label>, claims of CutSpec, Finding or FollowUp only (refused at
validate), a canonical-decimal budget, turn PersonaTurn or SelfRun per ruling
every-wake-a-run. The run sample is appended at the end of samples(); the golden
gains one line after sample.hand_off and no existing line changes. The
schema and its catalogue entry are derived from the type. No existing kind or
field is touched; the epoch stays v2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The four hand-spelled lists in rows.rs could drift from the leaf enums they
restate; each alias now reads its domain from the enum, as the authority
alias already does. No behaviour change.
Follow-up: eureka-substrate:follow_up:alias-lists-from-names
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1 holds (eureka-substrate:verdict:cut-mind-authority.s1). Additive on the wire; the live upgrade must be daemon-first (follow-up mind-variant-daemon-first).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run, breaker, units and wake-frame rows follow every-wake-a-run and mind-launch r1;
the leaf rows state the as-landed crate, golden pin and AGPL license; the additive
rule names the `= absent` marker; F15-F17 added; Undone updated; stale future-tense
and Epiphany-owner lines made present tense.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Additive unit-enum variant; schemas regenerated by derivation. The query
alias domain now derives from the enum (unit_enums! exposes NAMES), so the
second authority list in huginn-mind rows.rs is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul s1-s3 hold (eureka-body:verdict:cut-leaf-into-huginn.s3); wire parity defended by committed golden bytes and the live-store read-back. Relicensed AGPL-3.0 (ruling leaf-relicensed-agpl).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LICENSE is the gnu.org agpl-3.0.txt verbatim (LF). The golden header now
names 44be4cd as the dump commit, the four kinds (cut_spec, cut_report,
finding, follow_up) whose source-path string was renamed relative to
Epiphany ef956865, and that 87b6455 differs only in test code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the AGPL-3.0 text as LICENSE and set the workspace license to
AGPL-3.0-only (rulings license-split, leaf-relicensed-agpl); the leaf's
provenance (Epiphany ef956865, PolyForm Noncommercial, relicensed by its sole
copyright holder 2026-10-09) is recorded in its Cargo.toml and README.
One [workspace.dependencies] entry per CultLib crate now owns the revision;
the crates inherit it. index.json lists Huginn's two wire schemas too, and the
catalogue test drops its huginn. prefix exclusion: every schema file is listed.
README and AGENTS stop naming Epiphany notes as the owner of the cut.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
