walk_selection is deleted: members is the only place the walk is spelled.
Members carries the number of select pages taken. The page-size test calls
members with caller limit 1 and document projection over 590 questions and
asserts the exact ids and exactly 3 pages. A new test pins that the cites
hop limits members and matched to the cited rows.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Twenty members, top_k 15 and 200: the index limit and the row count are both
asserted. Unverified at this commit: built and tested once at the end of the batch.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
filter and params are asserted by value, so must_not and a top-level exact
fail. live_index_smoke searches a strict subset that leaves out the nearest
point. Unverified at this commit: built and tested once at the end of the batch.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The walk selection is built field by field from the caller's filters, so a
caller's limit, projection, order or cursor cannot reach it (one select per
member at limit 1 measured 300 ms against 14 ms). A test pins it.
Unverified at this commit: built and tested once at the end of the batch.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
cargo-mutants showed deleting it survives: ids come from rows whatever the
projection, so the override decided nothing.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The previous commit wrote raw newlines into the JSON string, which the
published file must not hold.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The first commit's huginn-mind test module did not compile (helper shadowed
by a local binding, and a mechanical rewrite had touched the helper body).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The mind decides membership (Mind::members) before the index is asked; the
index scores exactly the members (Qdrant has_id + exact) and the page carries
one cosine score per row. Deletes OVERSAMPLE_MAX, the x4 oversample, the
unfiltered VectorIndex::search contract and check_semantic.
Not yet compiled when committed: the first Yggdrasil run follows.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Admit deny reaches the model (prefixed "hook error"); SubagentStart context
and the admit hook both reach subagents; PreToolUse updatedInput on Agent
does rewrite the subagent's prompt (GitHub #39814 does not hold here).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Imagination pass for cut recall-admit (session self-2026-10-23-eureka-b):
hook input fields, digest stability, latency, fail-open rationale, and the
re-scoped trigger order with the prompt hook last.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Opens claude only under an open Self run; one pure decide() owns flush, grace, headroom and escalation; process-group signals; ends on child exit or EOF. Soul s3 holds (eureka-body:verdict:cut-mind-self-run.s3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Persona claim-set property drew ids as doc-N and doc; they now come
from the instance-name generator (varied alphabets, both separators, edge
lengths), so a refusal keyed on id text cannot pass. Set shapes and sizes
are unchanged. Follow-up persona-claim-ids-varied.
Not yet built; verified at the head of the cut.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
eureka is held; eureka-two, eureka2 and xeureka are released with a dial and
open. Kills Soul's s-check-wrong-instance-by-prefix mutant. Follow-up
gate-prefix-neighbour-test.
Not yet built; verified at the head of the cut.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
When systemctl stop fails, stop_all asks is-active for each of the two
units and the error names each state (active, inactive, failed, unknown)
beside the exit status; brake hold says the brake is held and the stop
failed, not that the units were not stopped. Exit 2 and the held brake
are unchanged. Follow-up brake-partial-stop-message.
Not yet built; verified at the head of the cut.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Adds the row (heat 0.05, base cooldown u32::MAX, 85,899,345,900 s) to the
wait test so any ceiling on the wait fails, and gives the ignored host test its
command in a crate README (the lane that kills the host() mutants). Tests and
docs only; builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The env test pins the variable's name and that the flag wins over it. The ignored container test seeds a mind, serves it with the real huginn-daemon, writes the brake at its real root and runs the real mind-wake with an empty PATH (so no unit is reached): the run it opens must carry /proc/sys/kernel/hostname as host and mind-wake as agent, which kills the three host() mutants of finding host-survivors-reachable.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Closes the test gaps of findings cadence-clamp-unpinned and codes-and-agent-unpinned: a floor of 1 s or a ceiling of 80000 s on the wait now fails the cadence test, and the receipt's agent and the printed code of every refusal are compared with the spelling, not with the constant that produced them.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
wake::cycle reads the brake and dial through the one derivation behind
read_effective and the unit gate, returns Held before any query, admission or
unit call, finds the newest Persona turn of hers (any status) with one
descending single-row query, and launches through open_and_launch. The
mind-wake binary prints the outcome. control_path no longer echoes the
instance it refuses.
Does not build the public_surface snapshot yet (the next commit updates it).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The writers refuse an out-of-bounds dial, so the DialOutOfBounds reading is
produced through the unchecked store the crate's own tests already use. The
store directory holds a second file besides control.cc, so the no-write test
compares listings rather than counting one.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Exit 0 only when the one derivation reads Released; every other reading
(absent, held, no dial, dial out of bounds, undecodable store) is an error
and exits 2, which systemd's ExecCondition reads as skip. A pure read through
FileSource: no writer, no created file or directory.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
stop_args now builds each name through unit(), the one name path start and
alive use, so the stop argv cannot disagree with the units that run (the
:* glob matched none of them on real systemd). A launch test ties stop_args
to what start passes systemctl for several instances; two binary tests run
mind-control brake hold with a fake systemctl first on PATH, so main's
stopper wiring is pinned.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The previous commit (df21694) builds but fails the public_surface test: it did
not update the committed snapshot.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SystemdLauncher::stop_all runs one synchronous systemctl stop over the
instance's mind-self and mind-persona units (stop_args, built from the same
templates as start and alive). cli::run gains a stop_units parameter that only
brake hold calls, after the write whatever its outcome. The window probe uses
dial set instead of brake hold, since a real hold now runs systemctl.
Builds not yet verified on the stopgap at this commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Per ruling mind-launch-forge-scanner-bound: compile_fail doctests for the
struct literal and each derive-provided path on Grant; forbid(unsafe_code) in
the library; the gate property draws the mind's own instance from the same
slug generator as the Grant's and tests pairs; Persona claim shapes are drawn
and rotated by seed; the path-literal and static-keyword scanners are deleted
from the public-surface test, whose limits are written at its top.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A process-global is the one channel through which an existing public
function's body, whose signature the snapshot does not change, could carry a
root from one call to another. The library has none today; a new one is a
line the snapshot does not have.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The instance gate is checked against names generated from the real one:
every single-character substitution, deletion and insertion, every
transposition and permutation, rotations, prefixes and suffixes, case flips,
NUL and whitespace padding, repetitions, and seeded random names of the same
and other lengths. The Persona refusal is checked at every claim-set size
from one to 300 in four shapes, duplicates included, and for every kind
alone. A compare or bound weaker than equality passes neither.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tests/public_surface.rs reads the library source the way a consumer sees it
and compares every pub item with its signature, pub fields, derives, impl
headers and every path-looking string literal to tests/public_surface.txt.
A new pub static or pub fn under any name, a derive onto Grant, or a root
read from another path fails it. It replaces the three compile_fail
doctests that named with_root, TEST_ROOT and control_root. Dev-dependencies
syn, quote and proc-macro2, already in the graph through serde's derive.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
clippy.toml lists the std::env readers (var, var_os, vars, vars_os,
set_var, remove_var, args, args_os, current_exe, temp_dir, home_dir) and
libc::getenv as disallowed methods, and lib.rs forbids allowing them back.
main.rs and the self-spawning integration test carry the only allows.
The forge probe's environment sweep and its 22 guessed variable names go:
the lint covers a variable of any name, so the list was a second, weaker
path for the same rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cargo unifies features per target, so a target-specific line that restores
eureka-state's default features left a Linux graph clean while a Windows
build compiled the huginn CLI's parser. The test asks cargo tree for
--target all, for the control and for mind-body.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
