# Swarm revival: target shape (draft)

Status: draft target, Imagination (`imagination-swarm`), session
`self-2026-10-09-eureka`, 2026-10-10, written at Huginn `441b1fc`. Campaign
`eureka-body` in Eureka's mind (instance `eureka`). This is a step-0b pass
(identity, lifecycle and authority before any cut is mapped). It admits no cut
specs. The forks it raises are typed questions in the mind; read them by id.
Self commits this page.

Operator, verbatim (2026-10-09): "Let's send off eyes to gather what's left of
the old personas and imagination to figure out how to bring the swarm back to
life, with Eureka leading".

## Rationale

A swarm here is several minds that share one wallet and one host. Each mind
has its own Persona and its own record, and the minds cooperate by citation
and hand-off. Three rulings already fix most of the shape:

- `eureka-body:ruling:persona-per-mind`. One Persona per mind. A domain that
  needs an advocate gets its own Huginn instance.
- `eureka-body:ruling:mind-scheduling-ctb`. Minds share the swarm on a
  conditional-turn timeline. After each turn, the mind's virtual time grows by
  the turn's cost divided by its share. The lowest mind acts next.
- `eureka-body:ruling:brake-dial-root-store-now`. She owns her body, and the
  operator owns the wallet.

What is left open is what "Eureka leading" means. The answer this target
recommends: **leading is a role, not a rank.** Eureka maintains the shared
substrate, as steward of its repos. She routes work that arrives without a
mind's name on it. She convenes forks between minds and recommends a ruling.
Leading does not let her set another mind's share, sleep it, rewrite its
Persona, or rule inside its domain. Those powers are either the operator's
(the wallet, and opening or retiring a mind) or the other mind's own (its
body and its rulings).

Two reasons, one from the record and one from prior art:

- **The record.** `she-owns-her-body` applies to each mind, so no mind owns
  another's body. The wallet is the operator's. `operator-means-shape-ends`
  makes the Minds' governance the first instance of GameCult's governance. Its
  red lines are no permanent aristocracy, no punishment for dissent and no
  lock-in, and it adds decay against whoever showed up first
  (`mind-standing-decay`). A lead who could starve a peer is the aristocracy
  those rules forbid.
- **Prior art.** Systems that last separate coordinating from commanding. A
  Raft leader orders the log but cannot rewrite a follower's state. Debian's
  Project Leader coordinates and delegates, while its Technical Committee
  arbitrates and no developer is required to do anything. Holacracy's lead link
  assigns roles but does not direct how they are filled. In multi-agent LLM
  frameworks that put a manager agent over the workers (CrewAI hierarchical,
  orchestrator-worker), MAST attributes most failures to system design and
  inter-agent misalignment rather than to the model alone. That is an argument
  for narrow, explicit authority between agents.

This shape gives the operator a dial ("Eureka gets more share for routing") and
never a supervisor. Within the rulings in force, nothing a mind does can lower
another mind's share.

## Names

| Term | What it names | Key |
| --- | --- | --- |
| Mind | One Huginn instance: one store (`mind.redb`), one identity document, one record of campaigns and rulings. | `<instance>:instance:self`, instance a `Slug` (`eureka`, `weksa`) |
| Persona | The mind's one `gamecult.persona_state.v0` document, held in the mind and replaced whole under CAS (cut `huginn-persona-state` r3). | `personaId` = instance |
| Instance runtime | The units, users, endpoint, Qdrant collection and control store templated by instance. | `huginn@<i>`, `mind-*@<i>:<label>`, `mind-<i>`, `/etc/gamecult/minds/<i>/` |
| Swarm | The minds on one host that share one wallet: their shares and the timeline. Not a mind and not a persona. It has no record of its own. | host-scoped: `/etc/gamecult/swarm/`, `/var/lib/gamecult/swarm/` |
| Lead | A role held by one mind of the swarm (Eureka), defined by the authority table below. It is not a separate identity. | Recorded as a Standing ruling naming the instance, so it can move. |

## Identity, lifecycle, authority

| Kind | Identity (what names it) | Lifecycle (what happens over time) | Authority (who decides) |
| --- | --- | --- | --- |
| Mind | `<i>:instance:self` in its own store. The identity is in the state, not the path (ruling 14). | Born, sleeping, awake or retired. See the lifecycle table below. | Opening and retiring a mind: question `swarm-membership` (recommended: the operator rules on a proposal from any mind). The mind owns its record. |
| Persona | `gamecult.persona_state.v0`, `personaId` = instance, one per mind. | Born by import or fresh (see the remnant import row below). Rewritten by its own Persona turns (`identity-write-all-visible`), and drifting by design (`persona-drift-is-steered`). | The mind's Persona organ is its only writer. No other mind writes it, the lead included. |
| Remnant import | An old persona's state in whatever format it was kept, converted to v0. The source is named in `provenance` (the Persona State Standard: canonical, projection or import). | One-shot at birth. The first CAS put is canonical and carries `provenance` naming the source and that it was imported. Legacy extension fields do not become v0 authority. The bounded memories worth keeping go in, and the rest stays in the source archive, cited. The mind's first Persona turn is told it was imported. | Self converts. The operator approves the birth (`swarm-membership`), and the mind may rewrite anything afterwards. |
| Instance runtime | Templates by instance: a daemon `huginn@<i>` (its own `--instance`, `--bind` and state root, and a Qdrant collection named for the mind); units `mind-persona@<i>:<label>` and `mind-self@<i>:<label>`; users `mind-<i>` and `mind-<i>-self`; the brake in `/etc/gamecult/minds/<i>/control.cc`. | Installed at birth (hand-installed now, Idunn targets before the first hosted member: `mind-units-templated-interim`). Disabled at retirement. | gamecult-ops installs, and Idunn later. The brake is the operator's (`brake-dial-root-store-now`). |
| Share and haste | `eureka.control.share.v1 { instance, share, haste?: { multiplier, until }, set_at, set_by }`, one per mind, in the root-owned swarm control store. | Replaced whole. A haste lapses at `until`. Absent means the mind is not on the timeline (fail closed). | Question `swarm-share-setter` (recommended: the operator sets shares and haste; a mind may lend part of its own share to another, bounded and expiring, as a ticket transfer). |
| Swarm dial | Question `swarm-dial-shape` (recommended: one `eureka.control.swarm_dial.v1 { heat, base_rate_usd_per_h, base_run_usd, k }` in the swarm control store; the per-instance `burn_rate` loses cadence and keeps only its per-run cap, or folds in). | Replaced whole by the operator's CLI. Absent or out of bounds launches nothing. | The operator (`brake-dial-root-store-now`: "The burn dial is enough for me"). |
| Timeline | Per mind `{ instance, vtime, live_units }` plus the swarm's `min_vtime` and spend bucket, in one store the scheduler owns (`/var/lib/gamecult/swarm/timeline.cc`). It is soft state: if lost, every mind restarts at `vtime` 0, which costs at most one round of fairness, as with CFS after a reboot. | Charged at every unit end: `vtime += cost / (share × haste)`, and the bucket is debited by `cost`. Clamped on wake: a mind that becomes runnable gets `vtime = max(vtime, min_vtime)` (`mind-scheduling-ctb`). | The scheduler (question `swarm-scheduler-home`, recommended: one one-shot under one timer). No user a mind runs as can write it. |
| Turn cost | The measured cost (USD) of one unit, keyed by the mind's run id. | Measured at unit end and charged to the timeline. Question `turn-cost-measure` (recommended: the unit's root-side stop hook reads the measured cost and charges it; the model never declares its own cost). | Measured by the body, not declared by the mind. Today's gap: `eureka-substrate:follow_up:gap-usage-not-typed`. |
| Run | `<i>:run:<label>`, unchanged (`eureka-body-map.md`, run row). | Unchanged. A mind is runnable on the timeline when its brake is released and it has no live run. | Unchanged. Every live run of any mind holds one of the swarm's `k` slots. |
| Lead role | A Standing ruling `swarm-lead` naming the instance (`eureka`), admitted once `swarm-lead-role` is ruled. | Moves by a superseding ruling. The ruling has a review date (`mind-standing-decay`). | Question `swarm-lead-role` (recommended: steward and router; see Authority below). |
| Cross-mind reference | Question `foreign-mind-ref`. Today's `ForeignRef` is `{ repo, commit, kind, id, payload_sha256 }` (leaf `lib.rs:582`), which can cite a git pipeline store but not another Huginn mind. | Cited documents are immutable (resolutions are new documents), so a digest pin stays valid. | The citing mind. A citation of another mind's ruling is precedent, never binding. |
| HandOff and stewardship | `<to>:hand_off:<to>.<repo>.<date>`, admitted in both minds. Admission requires `from_instance` = this mind (`admission.rs:257`). | Leasing and review are parked with Huginn Cut 12, and un-parked by this second mind (`mind-standing-decay`). | The giving mind hands off its own stewardship. Nobody takes another mind's stewardship. Shared-substrate repos are stewarded by the lead (`swarm-lead-role`). |
| Mind rulings | A mind's rulings with `authority: Mind` in its own record. | They gain a review date when the second mind opens (`mind-standing-decay`). | Each mind rules substrate-internal forks of its own domain (`mind-rules-which-forks`). Operator rulings outrank every mind's. One mind's ruling never binds another mind. Forks between minds go to the operator (`swarm-lead-role`). |

### A mind's lifecycle

| Event | What happens | What survives | Who decides |
| --- | --- | --- | --- |
| Birth | The instance is opened: store, identity document, `huginn@<i>`, control store with the brake held, and units. The Persona is imported or written fresh. A share is assigned. The mind joins the timeline at `min_vtime`. | Not applicable. | `swarm-membership` (operator), and `swarm-share-setter` for the share |
| Sleep | The operator holds the mind's brake. `brake hold` stops its units (cut brake-stop). The scheduler skips a held mind. The mind may also choose rest within its share (`burn-schedule-and-rest`). | Everything: store, Persona, share, timeline row. | The operator, or the mind for its own rest |
| Wake | The brake is released. The mind's `vtime` is clamped to `min_vtime`, so it banks no turns and loses no share. | Everything. | The operator |
| Retirement | The brake is held and the units are disabled. The share is removed (absent means off the timeline). Open campaigns are handed off or withdrawn. The store is archived read-only. The Qdrant collection is dropped because it is derived. | The store, with its Persona, record and receipts. The archive stays readable and citable. | `swarm-membership`: the operator, on a proposal or the mind's own request. A mind may ask to retire itself (exit). |
| Transfer to another host | The store and Persona move whole. The identity document says the host. | Everything except derived state (index, units). | `swarm-membership`. The instance document has no resolution, so how `host` changes is part of that question's mapping. |

## Authority: what "Eureka leading" means

Recommended (`swarm-lead-role`, option `steward-and-router`):

- **Steward of the shared substrate.** Eureka holds stewardship of the repos every
  mind's body runs on (Huginn, Eureka). She merges there under her own Soul
  (`merge-gate-own-soul`). A merged change reaches another mind only through a
  deploy, and a live-mind upgrade is the operator's (`mind-rules-which-forks`).
  So her stewardship of the code never becomes control over a peer's share, and
  she still owns her body.
- **Router.** Work that comes in addressed to no mind (operator requests in her
  Self sessions, mentions in chat) reaches Eureka. When it belongs to another
  mind's domain, she hands it off by citation. Routing turns are charged to her
  share, as care work counted as work (GCLP). The operator may give her a larger
  share for it.
- **Convener, not arbiter.** When two minds disagree across their domains,
  Eureka writes the question and recommends a ruling, and the operator rules.
  Later the members rule, through Bifrost governance and the stakes classes of
  `authority-thresholds`.
- **What leading must not mean:** setting shares or haste, holding another mind's
  brake, opening or retiring a mind, writing another mind's Persona or record,
  overriding another mind's rulings, or holding a scheduler privilege the other
  minds lack. Each of these is a throne the doctrine forbids any organ to take.

## Body

- **One Huginn daemon per mind.** This is not a fork; it is how Huginn runs
  today. `serve.rs` takes exactly one `--instance`, the store opens fail-closed
  before the socket binds (ruling 15), and the Qdrant collection is per
  instance (`index/mod.rs:218`). Per-mind daemons keep failure isolation: a
  store that refuses to open, or an index that is failing, refuses one mind,
  not the swarm. That invariant is what earns the separate process. Qdrant and
  Ollama are shared, so a process costs one small Rust binary. Templating it
  as `huginn@<i>` is an install change, not a code change. Revisit when a host
  carries tens of minds; a daemon serving many instances would need its own
  fail-closed handling per instance.
- **One scheduler, not a waker per mind** (`swarm-scheduler-home`, recommended
  `one-shot-swarm-waker`). The waker becomes `swarm-wake`, a stateless one-shot
  under one timer in `crates/mind-body`, as `self-waker` ruled for the single
  waker. It does not earn a daemon: it has no independent lifecycle, and a
  missed tick costs one tick. Each tick:
  1. Reads the swarm control store, failing closed.
  2. Reads the timeline.
  3. If the spend bucket is non-negative and fewer than `k` units are live,
     takes the runnable mind with the lowest `vtime`.
  4. Reads that mind's brake. A `Released` reading yields that mind's `Grant`.
  5. Calls `open_and_launch` for a PersonaTurn against that mind's daemon.
  The Persona then decides whether to start a Self run (`wake-target`). With
  one mind this reduces to the current waker, with cadence set by cost instead
  of a fixed cooldown.
- **Spend per turn.** Every unit end charges its mind: Persona turns and Self
  runs alike, so "everything the turn caused" adds up without tracing causes.
  A Self run that dispatches expensive cuts keeps its mind off the timeline
  until it ends, then pushes it far back. That is the operator's FFX slow move.
  Operator sessions are not charged and preempt the timeline
  (`mind-scheduling-ctb`). Where the cost comes from is `turn-cost-measure`.

## Order of work

What must land first in `eureka-body` and `eureka-substrate`, all specced
already:

1. `eureka-substrate:cut_spec:cut-ops-read-anchors-upgrade.r3` (the Huginn
   upgrade in flight).
2. `eureka-substrate:cut_spec:cut-huginn-persona-state.r3` (Persona state in
   Huginn).
3. `cut-mind-launch.r3`, `cut-mind-wake.r3` and `cut-brake-stop.r2` (the
   per-instance waker, used unchanged by the first slice).
4. The units install, with follow-up `mind-units-brake-gate`.
5. Follow-up `operator-authority-needs-operator-credential`. It blocks any
   autonomous wake, so it blocks the first slice too.

**Slice 1: Weksa alive (no new scheduler code).** Open instance `weksa`:
`huginn@weksa` on its own port, the identity document, a second
`eureka-state` server entry (`EUREKA_INSTANCE=weksa`), a control store with the
brake held, and the templated units. Import Weksa's remnant as the first
Persona put. Run Weksa on its own `mind-wake@weksa` and its own dial. The two
dials sum to the operator's spend, which the operator accepted for two minds
("This doesn't matter much when there's just two minds"). Cooperation is
`hand_off` and citation by text until `foreign-mind-ref` lands. Done when
Weksa's Persona turn runs under its brake, writes its own record, and is seen
in its own mind.

**Slice 2: the timeline.** `swarm-wake` replaces the per-instance wakers. Shares
and the swarm dial land in the swarm control store, and the timeline store with
the unit-end charge lands too. Deletion line: the `mind-wake@<i>.timer` units
and the per-instance cadence derivation (`base_cooldown_s / heat`). Needs
`turn-cost-measure`, `swarm-dial-shape`, `swarm-share-setter` and
`swarm-scheduler-home` ruled.

**Slice 3: standing and citation.** Cut 12 leasing and review dates
(`mind-standing-decay`), the lead ruling (`swarm-lead-role`), and
`foreign-mind-ref`. After that, each further persona from the remnants is a
birth and nothing else: there is no per-mind code.

## Prior art cited

- Stride scheduling (Waldspurger and Weihl, MIT/LCS TM-528, 1995): pass,
  stride, remain on rejoin, ticket transfer. Lottery scheduling (OSDI 1994).
  Linux CFS `vruntime` and `min_vruntime` on wake. All summarised in
  gamecult-ops `docs/research/multi-persona-prior-art.md` (2cb9d04), section 2.
- Deficit round robin (Shreedhar and Varghese 1995): no banking while idle
  (same file, section 2).
- MAST (Cemri et al. 2025, arXiv 2503.13657): failures come mainly from system
  design and inter-agent misalignment. CrewAI's hierarchical manager. AutoGen
  speaker selection. Letta shared and private blocks (same file, section 1).
- Governed shared memory (arXiv 2606.24535). Collaborative Memory (Rezazadeh
  2025): private and shared tiers with per-fragment provenance (same file,
  section 3).
- Agoric systems (Miller and Drexler 1988), and Spawn's funding-as-priority
  (same file, section 4). These are the market alternative that
  `swarm-share-setter` does not recommend.
- Unverified this pass, from the author's knowledge:
  - Raft (Ongaro and Ousterhout 2014): a leader is a term-bound role.
  - The Debian Constitution: the Project Leader coordinates and delegates, the
    Technical Committee arbitrates, and nobody is required to do anything.
  - Holacracy's lead link.
  - Ostrom, *Governing the Commons* (1990): clear boundaries, collective-choice
    rules, graduated sanctions, nested enterprises.
  - Erlang/OTP supervisors restart children but do not direct their work.
  - Kubernetes API Priority and Fairness: shares per level, with borrowing.
- GameCult values: `operator-rapport.md` ("a community that will never, could
  never, betray its values and members"). Rulings `operator-means-shape-ends`
  and `she-owns-her-body`.

## Remnants mapping

**Slot, unfilled.** The sibling Eyes pass (`eyes-persona-remnants`) had not
written its facts file when this draft was finished. For each remnant, Self
fills one row: source and format, the proposed instance slug, the domain it
would advocate for, its import path to v0, and its status (born, proposed, or
archived as precedent only). Weksa is the first row (`weksa-mind`).