GameCult/Huginn
Watch
9
0
Fork
You've already forked Huginn
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin CultLib 75188fde (stamp hardening #175) #66

Merged
eureka merged 3 commits from hands/cultlib-pin-75188fde into main 2026-11-14 09:35:42 +00:00
Conversation 0 Commits 3 Files changed 9 +99 -149
eureka commented 2026-11-14 09:14:54 +00:00
Owner
Copy link

Huginn's own pin is exactly 75188fde; the kit pin (a4eae905 via model-connector) stays transitive. It bumps Huginn's one CultLib pin to CultLib main 75188fdefa0b4baf131dbfd94e77d06a965f0cc6 (stamp hardening #175, which includes #171 cultcache-rs afab2d5a, #172 cultcache-py c77d734d, #174 cultmesh-py raw-put c88b939e). No other Huginn-owned revision is used. Base: db9605fb.

Pin

Huginn pins CultLib in one place: Cargo.toml [workspace.dependencies] (cultcache-rs, cultnet-rs, rev 8fc74c70 -> 75188fde). Cargo.lock regenerated by cargo fetch only (no cargo update): cultcache-rs 0.2.0 -> 0.3.1, cultnet-rs 0.1.0 -> 0.3.0; the lock drops 11 crates the old revision alone needed (ahash 0.7, hashbrown 0.12, lru, reed-solomon-erasure, ...) adds no crates. Lock changes: cultcache-rs 0.2.0 -> 0.3.1, cultcache-rs-derive 0.1.0 -> 0.2.0, cultnet-rs 0.1.0 -> 0.3.0, 11 crates removed. The old pin appears nowhere else as live state; the remaining 8fc74c7 mentions are dated snapshots in docs/ (maps, cut records) and are left as history.

The kit pin is separate and unchanged: ModelConnector/Ghostlight still pull CultLib a4eae905 transitively (cultcache-rs 0.3.1 + cultnet-rs 0.2.0), so the graph still holds two CultLib revisions. That is the existing two-pin state (crates/mind-body/Cargo.toml comment), not new, and it is not fixable from this repo.

Raw-put audit (nothing here sends a raw put without storedAt)

Huginn is Rust-only. It has no cultmesh-py/ts client, no document_put_raw sender other than the chat client, and no cultcache-ts/cultmesh dependency anywhere (find for package.json/pyproject: only two probe .py test drivers under crates/mind-body/src/self_run/probe/).

site path storedAt
crates/mind-body/src/chat_rudp.rs:134-140 CultNetMessage::DocumentPutRaw to Bifrost's mouth (the only peer raw put; used by the Persona organ's chat send) sets stored_at: Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true) (2026-..T..:..:..sssZ, a valid stamp shape)
crates/mind-body/tests/chat_rudp.rs:67-73 test peer put "2026-10-29T00:00:00.000Z"
crates/mind-body/src/control.rs:217, :472 and heartbeat.rs:359 cache.put_raw_envelope(...) replaying the envelopes of a store file pulled read-only not a send; the envelopes come from stores this repo's own put wrote (cache stamps now_utc_second) or the install script's brake hold; a non-stamp now refuses (new)
huginn-mind admission/persona put, eureka-state and the huginn CLI incl. persona put CultCache::prepare_entry -> compare_and_swap_batch stamp minted by the cache; these speak the daemon's door, not DocumentPutRaw

Range check

Huginn declares no cultcache-ts / cultmesh-ts / py range (no JS or Python runtime dependency; git revs for the Rust crates). Rust crates declare CultLib only by git rev in the workspace table; the declared crate versions at the new rev are cultcache-rs 0.3.1 and cultnet-rs 0.3.0. Note: the cultcache-rs CHANGELOG at this rev lists an "Unreleased" block marked Breaking (0.3.x -> 0.4.0) while Cargo.toml still says 0.3.1; the adaptations below are that block biting.

Retry decision (#171 update-with-retry)

No hand-rolled retry to replace. Huginn commits through compare_and_swap_batch (multi-document, strong-read-versioned) and returns a typed Conflict on a lost race (receipt.rs:261-311, admission.rs:232,312); no loop. update's single-record read-modify-write has different semantics from a multi-document receipt-bound commit, so nothing is cut. The CLI/daemon docs state callers retry Unavailable once; that is the caller's rule, not code here.

Adaptations forced by the new cultcache-rs (in the one commit)

  • CacheBackingStore::push/push_all now return the stamps written: the five test stores follow (huginn-mind store.rs, receipt.rs, read_tests.rs). Production uses the CultLib stores, so no production code changed for this.
  • A pull now carries a record no registered type claims instead of refusing it. This silently broke a contract: the heartbeat writer (FileStore::open) no longer failed closed on an old initiative store (test an_old_heartbeat_store_fails_closed_... failed). open() now refuses when foreign_records() is non-empty. ControlWriter::open now carries the same guard (commit 0c2d1e2, with a test that plants a foreign record, expects the open to refuse and asserts the file bytes unchanged; red without the guard, green with it). SwarmWriter::open carries the same guard and a matching test (red without the guard, green with it). FileTrace::record (persona.rs:676) has the same pull-then-write shape and is NOT changed (benign: a trace store); huginn-mind refuses foreign types explicitly (refuse_foreign_types), and eureka-state has no pull-then-write of this shape.
  • A cache refuses writes until it has pulled; a zero-byte file is not a store. Two test fixtures changed (control/tests.rs pulls first; tests/control.rs plants a real store via ControlWriter, not b""). Production always pulls first and the install script writes a real store (brake hold).

Tests (consumer side)

cargo test --workspace --no-fail-fast, CARGO_TARGET_DIR=/var/lib/mind-eureka-self/target-huginn-pin, host Linux x86_64 as non-root uid 985 (Yggdrasil mind account). Many tests require a root-owned dir and fail here on base too.

  • Pin, plain: 1749 passed, 301 failed. Pin failure set is a subset of base db9605fb (same commands in target-huginn-pin-base): base-only failures were selection_schema_matches_cultlib (offline fetch), and two flaky self_run process tests; pin-only: none.
  • To see past the root-only failures, unshare -r cargo test -p mind-body -p eureka-state: huginn-mind lib and mind-body lib all pass; remaining failures are userns artefacts (a_directory_not_owned_by_root_is_refused, a_non_root_user_cannot_write..., no_non_root_open..., persona_bin env tests) plus the_librarys_public_surface_is_the_committed_one (surface drift in chat_client::Basis, fails identically on base). Those are the same on base.
  • Not proven here: the root-only tests as true root, and the daemon/desk-door tests under root (they fail in a userns for unrelated uid reasons; plain run passes them).

Footprint: pin target dir 21 GiB, base target dir 8.9 GiB (to be deleted after review); disk 559 GiB free.

Deploy gates

The pin crosses 1,712 CultLib commits with breaking changes the compiler and tests cannot see: pull refuses a store holding two types at one key (redb), a payload tail, read-only on unread slots, and duplicate unique-index values; cultnet-rs 0.3.0 changes the wire. Before the Huginn deploy:

  1. Run the new build's open over a COPY of the live huginn.cc.
  2. Run the new chat client against the deployed Bifrost mouth.

The bump is not deployed and rides the next Huginn deploy (a separate decision).

Not deployed: Huginn#63 db9605f is also undeployed; this bump rides the next Huginn deploy, which is a separate decision.

🤖 Generated with Claude Code

Huginn's own pin is exactly 75188fde; the kit pin (a4eae905 via model-connector) stays transitive. It bumps Huginn's one CultLib pin to CultLib main `75188fdefa0b4baf131dbfd94e77d06a965f0cc6` (stamp hardening #175, which includes #171 cultcache-rs `afab2d5a`, #172 cultcache-py `c77d734d`, #174 cultmesh-py raw-put `c88b939e`). No other Huginn-owned revision is used. Base: `db9605fb`. ## Pin Huginn pins CultLib in one place: `Cargo.toml` `[workspace.dependencies]` (`cultcache-rs`, `cultnet-rs`, rev `8fc74c70` -> `75188fde`). `Cargo.lock` regenerated by `cargo fetch` only (no `cargo update`): cultcache-rs 0.2.0 -> 0.3.1, cultnet-rs 0.1.0 -> 0.3.0; the lock drops 11 crates the old revision alone needed (ahash 0.7, hashbrown 0.12, lru, reed-solomon-erasure, ...) adds no crates. Lock changes: cultcache-rs 0.2.0 -> 0.3.1, cultcache-rs-derive 0.1.0 -> 0.2.0, cultnet-rs 0.1.0 -> 0.3.0, 11 crates removed. The old pin appears nowhere else as live state; the remaining `8fc74c7` mentions are dated snapshots in `docs/` (maps, cut records) and are left as history. The kit pin is separate and unchanged: ModelConnector/Ghostlight still pull CultLib `a4eae905` transitively (cultcache-rs 0.3.1 + cultnet-rs 0.2.0), so the graph still holds two CultLib revisions. That is the existing two-pin state (`crates/mind-body/Cargo.toml` comment), not new, and it is not fixable from this repo. ## Raw-put audit (nothing here sends a raw put without storedAt) Huginn is Rust-only. It has no cultmesh-py/ts client, no `document_put_raw` sender other than the chat client, and no `cultcache-ts`/`cultmesh` dependency anywhere (`find` for package.json/pyproject: only two probe `.py` test drivers under `crates/mind-body/src/self_run/probe/`). | site | path | storedAt | |---|---|---| | `crates/mind-body/src/chat_rudp.rs:134-140` | `CultNetMessage::DocumentPutRaw` to Bifrost's mouth (the only peer raw put; used by the Persona organ's chat send) | sets `stored_at: Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true)` (`2026-..T..:..:..sssZ`, a valid stamp shape) | | `crates/mind-body/tests/chat_rudp.rs:67-73` | test peer put | `"2026-10-29T00:00:00.000Z"` | | `crates/mind-body/src/control.rs:217`, `:472` and `heartbeat.rs:359` | `cache.put_raw_envelope(...)` replaying the envelopes of a store file pulled read-only | not a send; the envelopes come from stores this repo's own `put` wrote (cache stamps `now_utc_second`) or the install script's `brake hold`; a non-stamp now refuses (new) | | `huginn-mind` admission/persona put, `eureka-state` and the `huginn` CLI incl. `persona put` | `CultCache::prepare_entry` -> `compare_and_swap_batch` | stamp minted by the cache; these speak the daemon's door, not `DocumentPutRaw` | ## Range check Huginn declares no cultcache-ts / cultmesh-ts / py range (no JS or Python runtime dependency; git revs for the Rust crates). Rust crates declare CultLib only by git rev in the workspace table; the declared crate versions at the new rev are `cultcache-rs 0.3.1` and `cultnet-rs 0.3.0`. Note: the cultcache-rs CHANGELOG at this rev lists an "Unreleased" block marked Breaking (0.3.x -> 0.4.0) while Cargo.toml still says 0.3.1; the adaptations below are that block biting. ## Retry decision (#171 update-with-retry) No hand-rolled retry to replace. Huginn commits through `compare_and_swap_batch` (multi-document, strong-read-versioned) and returns a typed `Conflict` on a lost race (`receipt.rs:261-311`, `admission.rs:232,312`); no loop. `update`'s single-record read-modify-write has different semantics from a multi-document receipt-bound commit, so nothing is cut. The CLI/daemon docs state callers retry `Unavailable` once; that is the caller's rule, not code here. ## Adaptations forced by the new cultcache-rs (in the one commit) - `CacheBackingStore::push`/`push_all` now return the stamps written: the five test stores follow (`huginn-mind` store.rs, receipt.rs, read_tests.rs). Production uses the CultLib stores, so no production code changed for this. - A pull now carries a record no registered type claims instead of refusing it. This silently broke a contract: the heartbeat writer (`FileStore::open`) no longer failed closed on an old initiative store (test `an_old_heartbeat_store_fails_closed_...` failed). `open()` now refuses when `foreign_records()` is non-empty. `ControlWriter::open` now carries the same guard (commit 0c2d1e2, with a test that plants a foreign record, expects the open to refuse and asserts the file bytes unchanged; red without the guard, green with it). `SwarmWriter::open` carries the same guard and a matching test (red without the guard, green with it). `FileTrace::record` (persona.rs:676) has the same pull-then-write shape and is NOT changed (benign: a trace store); huginn-mind refuses foreign types explicitly (`refuse_foreign_types`), and eureka-state has no pull-then-write of this shape. - A cache refuses writes until it has pulled; a zero-byte file is not a store. Two test fixtures changed (`control/tests.rs` pulls first; `tests/control.rs` plants a real store via `ControlWriter`, not `b""`). Production always pulls first and the install script writes a real store (`brake hold`). ## Tests (consumer side) `cargo test --workspace --no-fail-fast`, `CARGO_TARGET_DIR=/var/lib/mind-eureka-self/target-huginn-pin`, host Linux x86_64 as non-root uid 985 (Yggdrasil mind account). Many tests require a root-owned dir and fail here on base too. - Pin, plain: 1749 passed, 301 failed. Pin failure set is a subset of base `db9605fb` (same commands in `target-huginn-pin-base`): base-only failures were `selection_schema_matches_cultlib` (offline fetch), and two flaky self_run process tests; pin-only: none. - To see past the root-only failures, `unshare -r cargo test -p mind-body -p eureka-state`: huginn-mind lib and mind-body lib all pass; remaining failures are userns artefacts (`a_directory_not_owned_by_root_is_refused`, `a_non_root_user_cannot_write...`, `no_non_root_open...`, persona_bin env tests) plus `the_librarys_public_surface_is_the_committed_one` (surface drift in `chat_client::Basis`, fails identically on base). Those are the same on base. - Not proven here: the root-only tests as true root, and the daemon/desk-door tests under root (they fail in a userns for unrelated uid reasons; plain run passes them). Footprint: pin target dir 21 GiB, base target dir 8.9 GiB (to be deleted after review); disk 559 GiB free. ## Deploy gates The pin crosses 1,712 CultLib commits with breaking changes the compiler and tests cannot see: pull refuses a store holding two types at one key (redb), a payload tail, read-only on unread slots, and duplicate unique-index values; cultnet-rs 0.3.0 changes the wire. Before the Huginn deploy: 1. Run the new build's open over a COPY of the live `huginn.cc`. 2. Run the new chat client against the deployed Bifrost mouth. The bump is not deployed and rides the next Huginn deploy (a separate decision). Not deployed: Huginn#63 db9605f is also undeployed; this bump rides the next Huginn deploy, which is a separate decision. 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
The workspace's one CultLib pin moves 8fc74c70 -> 75188fdefa0b4baf131dbfd94e77d06a965f0cc6
(cultcache-rs 0.2.0 -> 0.3.1, cultnet-rs 0.1.0 -> 0.3.0 in the lock; the lock drops
the crates the old revision alone needed and gains sha2/stacker for the new one).

Adaptations the new cultcache-rs forces:
- CacheBackingStore::push/push_all return the stamps written; the five test
  stores follow (store.rs, receipt.rs, read_tests.rs).
- A pull now carries a record no registered type claims instead of refusing it,
  so the heartbeat writer's open() checks foreign_records() and keeps its
  fail-closed refusal of an old initiative store.
- A cache refuses writes until it has pulled, and a zero-byte file is not a
  store: two test fixtures pull first / plant a real store.

Not deployed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The CultLib pin makes a pull carry unregistered records instead of refusing; the writer guards like the heartbeat store does.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
eureka merged commit 64e88966ad into main 2026-11-14 09:35:42 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
GameCult/Huginn!66
No description provided.