Huginn/docs/eureka-substrate-map.md

# Eureka substrate: map

Status: map, Imagination (`imagination-substrate`), 2026-10-01. Campaign
`eureka-substrate` in Eureka's mind. Questions, cut specs and rulings are
typed documents there; this page keeps body facts, the model page and
rationale only. Target: `docs/eureka-substrate-target.md` (`133324a7`).

Revised 2026-10-09 (Modeling). The leaf is now Huginn `crates/eureka-pipeline`
(`afc35f9`, leaf-into-huginn): no Epiphany repo owns or pins it, and
`leaf-key-bound` is in it (see `docs/eureka-body-map.md` F16). The pinned heads,
the Epiphany rows and the `lib.rs` line numbers below are as read on 2026-10-01
and describe the leaf at `epiphany-pipeline/src/lib.rs`.

Pinned heads for every fact below:

| Repo | Ref | Commit |
| --- | --- | --- |
| Huginn | `origin/main` | `133324a7f78047164f0ca02331398066a971ac15` |
| Huginn | `origin/eureka/memory-organ` (deployed release) | `9dd6d8007ab7de84c926a34edd3947ba15d1f01c` |
| Epiphany | `origin/main` | `4d1113ef0a4dbcead2e2c3cdc43aa13ef773dbb8` |
| Epiphany | `origin/codex/eureka-pipeline-state` | `4006b14bf29b49410bd18b43acb4d42c3c4e2443` |
| Epiphany | leaf pinned by Huginn (`crates/huginn-mind/Cargo.toml:22`) | `73edee5cdaddece8bda9c6c3271e8ddd064337f9` |
| CultLib | `cultcache-rs` pinned by both | `8fc74c709444b884a2bd339e0c306bf9484d99d2` |
| gamecult-ops | `main` | `b4eea88d801ad45aad2a49574a9eb2f750c7dd97` |
| Eureka skill | `main` | `094083566e19cccca026de8cbfc24462f1debe93` |

Source reads were made in scratch clones at the pinned commits
(`scratchpad/imagination-substrate/{epiphany,huginn}`); line numbers are
against those commits. `lib.rs` below is `epiphany-pipeline/src/lib.rs`.

## Body facts

### B1. Key grammar (source read, leaf at `73edee5c`)

- `LOCAL_MAX = 64` (`lib.rs:877`) bounds every composed local, whole
  (`local`, `lib.rs:892-901`). It is the only bound on a resolution chain's
  depth (comment `lib.rs:917-922`, test `lib.rs:2105-2150`).
- A resolution's local is `<subject kind>.<subject local>.n<seq>`
  (`lib.rs:923-929`). Overhead over the subject's local: `finding` 11 bytes,
  `follow_up` 13, `question` 12, `ruling` 10, `cut_spec` 12, `stewardship` 15
  at one sequence digit. A withdrawal (resolution of a resolution) adds
  `resolution.` and `.n<seq>`, 14 more.
- So with subjects bounded at 64 and resolutions at 64, a finding local over
  53, a follow-up label over 51, a question label over 52, a ruling label over
  54 or a cut-spec local over 52 admits and can never be resolved. Self's map
  said follow-up labels over 52; it is 51 (`follow_up` is 9 bytes, plus two
  dots and `n1`).
- `pipeline_id` (`lib.rs:798-819`) parses every id's local with `dotted_text`
  (`lib.rs:148-158`), whose 64-byte bound is the same one `Slug` uses
  (`lib.rs:251`). Every `PipelineRef` validation goes through it
  (`validate`, `lib.rs:589`; `validate_ref`, `lib.rs:609`), and so do
  Huginn's view (`query.rs:433`), index (`index.rs:120`) and selection keys and
  cites (`rows.rs:306`, `rows.rs:331`). Raising `LOCAL_MAX` alone therefore
  makes a key that no id parser accepts. The parser bound has to move with it.
- The epoch is `epiphany.pipeline.epoch.v2` (`lib.rs:886`). `value_types!`
  (`lib.rs:400-419`) emits no serde default on any field, so adding a field
  would break the decode of stored documents. No cut in this map added a
  field. `leaf-read-anchors` r2 (admitted 2026-10-09, not yet landed) does add
  fields, through the leaf's `= absent` marker, which defaults on read and omits
  on write when empty, so stored documents still decode and existing golden
  lines do not move.
- The published schemas (`schemas/cultnet/epiphany.pipeline.*.v2.schema.json`)
  carry no key bound. A resolution's `subject.id` is `Short`, 200 bytes. A key
  is not a field, so no published schema changes when a local bound moves.
- Storage: `cultcache-rs` stores rows in redb as
  `TableDefinition<&[u8], &[u8]>` (`CultLib packages/cultcache-rs/src/lib.rs:1023`
  at `8fc74c70`), with no key bound of its own. A Qdrant point id is the
  SHA-256 of the document id (`huginn-daemon/src/index/mod.rs:225-231`), so
  key length does not reach the index.
- Id length ceiling: `<root ≤64>:<kind ≤11>:<local>` must fit `Short` (200)
  wherever an id is cited. That allows a local of up to 123 bytes.

### B2. Census of the live mind (probe)

- Command: `query` for every question, ruling, cut_spec, target, stewardship
  and follow_up (119 ids), then every finding and resolution (138 ids), header
  projection. The ids were extracted with Python, and the lengths of each
  depth-one resolution local (`n1`) and depth-two withdrawal local were
  computed.
- Where and when: the eureka-state tools from Starfire, 2026-10-01 about
  08:40 UTC, `as_of` 82, mind status 293 documents, 82 receipts.
- Result (256 resolvable-kind documents): the longest stored local is 64 and
  the longest id is 90.
  - **Six subjects can have no resolution at all** (n1 local over 64). All
    are findings in force under `idunn-watchdog`:
    `cut-bifrost-retire-alarm.s2.verb-default-accepts-malformed` (69),
    `cut-ops-notice-deploy.s2.pinned-bifrost-predates-retry` (65),
    `cut-bifrost-notice-retry.s1.unknown-test-ignores-backoff` (67),
    `cut-bifrost-notice-retry.s2.closed-unknown-retry-unpinned` (68),
    `cut-bifrost-notice-retry.s2.flapping-clock-retries-every-tick` (72), and
    `cut-idunn-topology-lock.s2.boot-reconcile-skipped-on-contention` (74).
    That matches Self's count. The seventh finding in force,
    `cut-idunn-incident.s3.mutants-share-target-dir`, can be resolved (57),
    but its resolution could never be withdrawn (71).
  - **39 stored resolutions can never be withdrawn** (their withdrawal local
    is 65-78). So their subjects can never be reopened, which is a lifecycle
    the matrix allows (`admission.rs:555-560`, Q17 B). Two follow-ups
    (`gap-substrate-followups-campaign-rooted` under both roots, and
    `projection-mode-branch-vs-private-lock`) and about 40 resolved findings
    have the same latent defect one level up.
- Conclusion: an admission guard alone cannot satisfy
  `every-subject-resolvable` for stored documents, because they cannot be
  re-keyed (`stored-documents-valid`). The resolution's local bound has to
  widen.

### B3. Refusal classification (source read, Huginn at `9dd6d80`)

- `Mind::admit` (`huginn-mind/src/admission.rs:73-85`) calls
  `document.validate()` (which returns a typed refusal), then
  `document.prepare(cache)`. `prepare` (`lib.rs:714-721`) runs
  `pipeline_key(self)?` into `anyhow`, and admission maps any `prepare` error
  through `unavailable` (`mind.rs:46-48`) to `MindRefusal::Unavailable`. The
  derived writes take the same path (`admission.rs:136`). A ruling whose
  derived `Answered` resolution cannot be keyed is refused `Unavailable` there.
- The daemon passes the outcome through unchanged
  (`huginn-daemon/src/daemon.rs:143`). So `Refused(Unavailable{..})` reaches
  the client as an admit answer, not as `isError`.
- The later A3 step (`stage` through `validate_pipeline_write_envelope`,
  `lib.rs:1003-1015`) returns typed refusals. Only the prepare path is
  misclassified.
- `Unavailable` is also raised legitimately, for store and decode faults
  (`admission.rs:949`, `admission.rs:2091`, `docs.rs:48`, `mind.rs:140`,
  `receipt.rs:209`). Those stay.

### B4. Smaller rules (source read, Huginn at `9dd6d80`)

- **Sha identity:** the one place shas are compared is
  `admission.rs:433`, `commit.sha == report.range.head`, a literal string
  equality. `Sha` is 7-40 lowercase hex (`lib.rs:253`). `FullSha` (40) exists
  for `ForeignRef` (`lib.rs:255`, `lib.rs:467`).
- **Deferred:** the matrix (`admission.rs:562-585`) allows
  `(Finding, Deferred { to })` only when `to.kind == FollowUp`
  (`admission.rs:574`). The leaf's `Deferred { to: PipelineRef }` already takes
  any kind, so this is an admission change only.
- **Faculty:** `Faculty` lives in Huginn, not in the leaf
  (`huginn-mind/src/receipt.rs:32-40`, variant `MindSteward`). The selection
  alias domain is a second copy (`rows.rs:42`). The eureka-state client takes
  the type from huginn-mind (`eureka-state/src/main.rs:27`, `main.rs:66`), so
  the client must be rebuilt for a new variant.
- Probe: `query` with `faculty any_of [MindSteward]` matched 0 documents
  (2026-10-01 08:40 UTC). No stored receipt carries the old name.
- **Stewardship:** admission reads stewardship in one live rule. A campaign
  needs a stewardship in force for each repo (`admission.rs:363-366`,
  `RepoNotStewarded`). The hand-off rule (`admission.rs:501`, `NotStewarded`)
  is parked with Cut 12. Six stewardship documents are stored.
- **depends_on:** this is `Vec<Short>[8]` (`lib.rs:525`). Huginn's edge list
  says outright that `depends_on` is a label, not an edge
  (`huginn-mind/src/docs.rs:398-404`). Nothing checks it. The only reader is
  the header projection (`query.rs:121`, `query.rs:173`). The
  `idunn-watchdog` specs stored revision ids in it. That came from the skill's
  habit, not from the code's intent.
- `open_checked` (`mind.rs:180-188`) re-validates epoch, types and identity,
  not keys or bounds, so an opened mind never re-judges a stored key. No
  migration path exists, and none is needed under this map.

### B5. Branches and in-flight work (git, 2026-10-01 ~08:35 UTC)

- Huginn: `memory-organ` is 107 commits ahead of the merge base `91b7fcf`;
  `main` is 1 ahead (`133324a`, docs only). `git merge-tree --write-tree
  origin/main origin/eureka/memory-organ` is clean, tree `993ab1fd`. Its only
  difference from `9dd6d80` is `docs/eureka-substrate-target.md`.
- Epiphany: the branch is 174 ahead of the merge base `b5d9d4ff`; `main` is 1
  ahead (`4d1113ef`, the Ghostlight pin). Merge-tree is clean, tree
  `a75aa388`, and **identical** to the branch tip's tree: the branch already
  carries the same Ghostlight pin and lock. The leaf tree `cf84c032` is
  identical at `73edee5c`, at the branch tip and in the merge.
- Hands worktrees `hands/rs3` (`9673ab8`, idle since 2026-09-29 06:32),
  `hands/cut13a` (`3dc50ee`, 2026-09-30 00:16) and `hands/cut13b` (`cd3dfc0`,
  2026-09-30 04:55) are each 0 commits ahead of `memory-organ`, and clean. RS-3
  and BP-3 have landed (BP-3's deferred bodies are in `huginn-daemon/src/bodies.rs`).
  **Nothing is in flight.** The only other unmerged Huginn branch is
  `codex/windows-atomic-replace-retry` (2026-05-24), which is unrelated.
- No Epiphany branch has unmerged commits under `epiphany-pipeline/`.
- `F:\Projects\Huginn`'s main worktree is checked out on `eureka/memory-organ`,
  so the merge has to run in its own worktree.

### B6. Deployment (read-only ssh, Yggdrasil, 2026-10-01 08:41 UTC)

- `readlink /opt/gamecult/huginn/current` is
  `releases/9dd6d8007ab7de84c926a34edd3947ba15d1f01c`. The previous release
  `0c4e4107…` is kept. `huginn` is active since 2026-09-30 13:21:08 UTC.
  `ExecStart` is as in the runbook (`--state-root /var/lib/gamecult/huginn
  --instance eureka …`).
- `minds/` holds one mind, `eureka`: `mind.redb` 4,198,400 bytes, mtime
  2026-10-01 08:33, owned `huginn:huginn` 0640. This is the only mind on the
  host.
- The nightly snapshot `/var/backups/gamecult-state/2026-10-01/` holds
  `./var/lib/gamecult/huginn/minds/eureka/mind.redb` (01:59 UTC), recorded
  `stable-double-read` in `consistency.tsv`. It predates receipts 81-82 (this
  campaign's frame), so the deploy cut takes its own cold copy.
- Runbook: `gamecult-ops runbooks/huginn-yggdrasil.md:42-72`. Its release
  section builds at a GitHub commit and keeps the previous release. It has no
  pre-upgrade copy step and no read-back proof.

## Model page

One row per persistent kind or rule that this campaign touches. **Identity**:
what names it. **Lifecycle**: what happens to it over time. **Authority**:
who decides.

| Kind or rule | Identity | Lifecycle | Authority |
| --- | --- | --- | --- |
| Subject keys (`finding`, `follow_up`, `question`, `ruling`, `cut_spec`, `target`, `stewardship`) | `<root>:<kind>:<local>`, with the local bounded at 64 bytes; injective (`composed_keys_cannot_collide`, `lib.rs:1392`). **Unchanged by this campaign**: every stored key stays exactly as it is. | Admitted once; never re-keyed. A revision is a new key. | The leaf derives it (`pipeline_key`); admission refuses a mismatch (A3). Forbidden: any writer composing a key by hand. |
| Resolution keys | `<subject root>:resolution:<subject kind>.<subject local>.n<seq>`, and one nesting for a withdrawal. **Target:** bounded by its own constant, derived from the deepest legal chain over the longest subject local at `u32::MAX` sequences: 10 + 1 + (11 + 1 + 64 + 2 + 10) + 2 + 10 = **111 bytes**. Ids up to 64 + 12 + 111 = 187 bytes, within `Short`. | n1, n2 … per subject; withdrawn by a depth-two resolution; never deeper (Q19 A, admission). Stored resolutions keep their keys and become withdrawable. | The leaf owns the bound and the id parser; admission owns sequence, matrix and depth. The parser bound (`pipeline_id`) is derived from the kind and is no longer `dotted_text`'s 64. |
| Every-subject-resolvable guard | **Empty by design** under Q `key-bound` option A: with subjects at 64 and resolutions at 111, every admissible subject is resolvable to depth two at any sequence, so no guard exists to own. Under option B a guard would be admission's. | | |
| Refusal classes | `MindRefusal::Document(PipelineRefusal)` for shape, bound and key; `Unavailable` only for store, cache and decode faults. | Fixed at admission time per batch. | Huginn admission. The leaf's `prepare` keeps the cache-encode error as `anyhow`. Admission keys the document first, so a key error is typed. Forbidden: `unavailable()` wrapping a leaf refusal. |
| `depends_on` | Free `Short` text today. **Target:** cut labels in the spec's own campaign (Q `depends-on`). | Stored revision-id values stay as they are (they decode, and nothing re-judges them). New batches follow the target rule. | Under A, admission refuses a new spec whose entries are not labels of cuts with a spec in the campaign. Under B, only the skill convention. |
| Sha identity | `Sha` 7-40 hex. **Target:** two shas name the same commit when one is a prefix of the other. | Only judged in a new report's batch. | A leaf method on `Sha` (the type owns its equality semantics); admission calls it at `admission.rs:433`. |
| `Deferred` referent | `PipelineRef`, any kind in the leaf. **Target:** follow_up or cut_spec, for a finding. | When the cited spec is later superseded, the reader follows `superseded_by`; nothing is rewritten. | Huginn's matrix (`admission.rs:574`). |
| Faculty | `receipt.rs` enum plus the `rows.rs:42` alias domain. **Target:** `Life` replaces `MindSteward`, with `#[serde(alias = "MindSteward")]` so any old receipt decodes. 0 stored receipts carry it (B4). | Attribution on the receipt, never re-written. | huginn-mind. The client picks it up only when rebuilt. |
| Stewardship admission rule | Rule `RepoNotStewarded` on campaign repos. | Q `stewardship-rule`. Stored stewardship documents stay; under A they decide nothing until Cut 12 (hand-off and leasing) defines a rule again. | Huginn admission; the operator owns whether the rule exists. |
| The gap home | Root `eureka-substrate`, labels `gap-*` (ruling `gap-home`). | Already moved (19 follow-ups in force here; the 20 `idunn-watchdog` copies resolved). Closed by `Fixed` when a cut lands, by Self after Soul holds. | Self admits; the skill recipe names the root (`campaign-state.md:278-299`, already done at Eureka `0940835`). No code. |
| The six stuck findings | Unchanged keys under `idunn-watchdog`. | They become resolvable when the leaf cut deploys. Self triages them then, like any finding (Deferred or Recorded). This is Self triage, not a fork. | Self. |
| Deployed release | `/opt/gamecult/huginn/releases/<full sha>`, `current` symlink. | Built at a main commit, flipped in, the previous release kept, flipped back on failure. | Operator's deployment authority, exercised by Self or Hands (memory `deploy-instruction-is-authorization`). |

Cells that could not be filled are stated in the rows above: the guard row
is empty by design if `key-bound` A is ruled, and the `depends_on` and
stewardship authorities wait on their questions.

## Rationale

**Why a per-kind bound and not a bigger `LOCAL_MAX`.** If one number bounds
every local, then widening it widens the subjects too, and the gap comes back
one level up: a 100-byte finding label has a 111-byte resolution. Keeping
subject locals at 64 and deriving the resolution bound from the deepest legal
chain makes resolvability a property of the grammar, with no admission guard
to drift. It also re-keys nothing: every stored key was at most 64 and stays
valid. A guard alone (keeping 64 everywhere) would refuse future offenders.
It would leave the six stuck findings and the 39 unwithdrawable resolutions
permanently broken, which violates the target for stored documents.

**Why the parser bound moves with it.** Every reader validates ids through
`pipeline_id`. A resolution key the leaf can derive but `view`, `keys` or
`cites` refuses would turn an unresolvable subject into an unreadable
resolution.

**Cut order.** The merges come first (ruling `merge-to-main-first`). Then the
leaf, because Huginn pins it. Then Huginn admission, which bumps the pin. Then
the client rebuild, because the new `Life` variant crosses the wire in
receipts. Then the deploy, which proves the read-back. The skill cut goes
last, because it must not tell agents to admit as `Life` before the client
and daemon understand it. In cut labels: `merge-epiphany-main`, then
`merge-huginn-main`, then `leaf-key-bound`, then `huginn-pin-and-refusals`,
then `huginn-admission-rules`, then `ops-mind-upgrade`, then `skill-recipes`.
The client rebuild is a step inside `ops-mind-upgrade`. It produces no repo
commit, and a `cut_report` needs one (`gap-fork-before-commit`). The new
daemon's added refusal variants and `Life` must not reach an old client for
long, so the client swap sits next to the daemon flip.

**Why Cut 0 does not bump the leaf pin.** After the Epiphany merge, `73edee5c`
is an ancestor of Epiphany `main`, and the leaf tree is byte-identical. So the
daemon built from Huginn `main` is built from main code
(`code-from-main`), with an unchanged `Cargo.lock`, and the deployed release
stays as it is. The pin later moved to Epiphany `ef956865` (F1 of the body map);
`leaf-into-huginn` then removed it, since the leaf lives in Huginn.

**Proof of `stored-documents-valid`.** Each code cut runs one read-back test
over a real copy of the mind. Every envelope decodes; `pipeline_key` of the
decoded document equals the stored key; `validate()` passes; and for every
resolvable subject the n1 resolution key and its withdrawal key derive and
parse back. The test reads the path from `HUGINN_MIND_SNAPSHOT` and is
`#[ignore]` by default, so CI never needs the file. Before code cuts, the
copy is the 2026-10-01 nightly snapshot. The deploy takes a cold copy with the
unit stopped.

## huginn CLI replaces the eureka-state MCP server (Imagination, 2026-10-10)

Follow-up `eureka-substrate:follow_up:huginn-cli-replaces-mcp`. Bases: Huginn
180b08a, Eureka 278b881, gamecult-ops 1e95674. Live daemon 107552dc.

### Body facts (probes, 2026-10-10, Starfire)

- `~/.claude.json` top-level `mcpServers.eureka-state`: stdio,
  `C:\Users\Meta\.eureka\bin\eureka-state.exe`, env `EUREKA_INSTANCE=eureka`,
  `HUGINN_ENDPOINT=rudp://10.77.0.1:17872`. No `mcp__eureka-state` entries in
  `~/.claude/settings.json` permissions. That file has an `env` block holding
  one key (`CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL`).
- `~/.cargo/bin` and `~/.local/bin` are on the Bash tool's PATH.
  `~/.eureka/bin` is not.
- `py -3` is 3.13.15 on Starfire and `python3` is 3.13.5 on Yggdrasil.
- Yggdrasil has no eureka-state or huginn client binary installed. The daemon is
  `/opt/gamecult/huginn/current/huginn-daemon`.
- Huginn: `crates/eureka-state` is `lib.rs` (HuginnClient, 210 lines, transport
  only) plus `main.rs` (the MCP server, 349 lines) and tests (`client.rs` 511,
  `mcp.rs` 564, `common` 185). At main, nothing else in the workspace depends on
  the crate. `eureka-body/mind-launch` (3b15c39) adds
  `eureka-state = { path = "../eureka-state" }` to mind-body and calls
  `HuginnClient` in-process.
- Eureka: `tools/context-pack.py:115-201` hand-rolls an MCP stdio client that
  reads the binding from `~/.claude.json`. `tools/test-tools.sh:346-381,509-513`
  test it with `fixtures/context-pack/fake-eureka-state.py`. `agents/life.md:4`
  is the only charter whose tool list names `mcp__eureka-state__*`.
- Wire: `huginn-mind` encodes requests and answers with
  `rmp_serde::to_vec_named` (named maps), so an added field is skipped by an old
  reader. The leaf has no `deny_unknown_fields`.
  `107552dc..main` adds the read anchors (an additive field), `RulingAuthority::Mind`
  (an added variant) and the run kind.

### Model page: the CLI (step 0b)

| Question | Answer | Why |
|---|---|---|
| Binary | `huginn` | It is the mind's door, named for the organ. No name clash: the daemon's binary is `huginn-daemon` and the operator CLI is `mind-control`. |
| Crate | `crates/eureka-state`, bin `src/bin/huginn.rs`. The crate is not renamed. | mind-launch already depends on the package by name. A rename is pure churn across two campaigns and protects no invariant. |
| Library | `HuginnClient` (`lib.rs`) stays the one client and stays transport-only. | The CLI and mind-launch are its two consumers. Env parsing lives in the CLI, not the lib, because mind-launch builds clients from its own config. |
| Install, Starfire | `C:\Users\Meta\.local\bin\huginn.exe` (already on PATH), with `.next` and `.prev` beside it per the runbook. Built at the merged sha with `HUGINN_BUILD_SHA` set. | No PATH or system edit is needed. |
| Install, Yggdrasil | None until the first Claude session runs there (the Self-run unit). Then it goes in the release dir beside the daemon, linked from `current`, so it flips with the daemon. | Nothing on the host calls the mind through a shell yet. mind-launch links the lib. Follow-up `huginn-cli-on-yggdrasil`. |
| Finding the mind | `EUREKA_INSTANCE` and `HUGINN_ENDPOINT` from the environment, exactly as the MCP server read them. On Starfire they are set in the `env` block of `~/.claude/settings.json`, which is operator-visible. On Yggdrasil they will go in the unit's `Environment=`. No `--instance` flag and no config file. | This keeps the MCP rule that the instance is the session's configuration, not a call argument. Env is how a systemd unit and a Claude session both configure a child. |
| Version | `huginn --version` prints the crate version and the build sha. `whoami` prints `client <sha>`. | Lets an operator see skew. It is display-only. |
| Lifecycle | Each call is a new process. Swapping the exe takes effect on the next call, with no session restart. | This removes runbook step 8's restart-every-session. |
| Skew rule | After every Committed or AlreadyAdmitted batch, the CLI reads the batch back with one `keys` query (projection document) and compares each stored document with what it sent. A difference exits 5 and names the ids and field paths. No version negotiation is added. | This is the end-to-end argument (Saltzer, Reed and Clark 1984): only the end check covers every intermediate drop, whether it came from an old leaf at the CultNet door, a serde default or a future skew. A whoami version field would need a daemon deploy (blocked on the upgrade rerun), would cover only the skew it was taught, and would leave 107552dc unprotected. Cost: one extra call per admit. Limit: the document is already committed, so the agent supersedes it. That is loud, not silent. |
| Authority | The CLI owns no state. It parses arguments, strictly decodes agent-written input into leaf types, names the recipe selections, renders text and derives the exit code. Admission and status stay Huginn's, and the transport stays HuginnClient's. | This is Brokkr's brokkr-command shape (A3, b451cdd): a caller whose exit code is derived from the answer and never from "the send succeeded". |
| Input door | Agent-written JSON (question `huginn-cli-document-format`), decoded strictly. A key path that is present with a non-empty value and absent from the typed re-serialisation is refused as exit 2, naming paths, never values. | Closes `gap-admit-drops-unknown-keys` at the door. The store decode stays lenient for rollback (map B15). |
| Recipes | Named subcommands in the CLI, each the exact selection campaign-state.md defines at Eureka 278b881. After cut skill-huginn-cli, the page names them and `--help` prints each selection. | One copy of the progress view, in code an agent runs, not JSON an agent retypes. |
| Exit codes | 0 answered. 1 the mind said no (Refused, Conflict, view absent). 2 the call is wrong (usage, InvalidInput, TooLarge, Misconfigured). 3 Unavailable (retry once). 4 no answer and a retry cannot help (Rejected, Unencodable, Internal). 5 committed but the read-back differs. | These map one to one onto the skill's organ rule. |

### Cut order

huginn-cli (after clippy-pin) -> skill-huginn-cli, context-pack-huginn-cli,
ops-huginn-cli (in parallel) -> delete-eureka-state-mcp.

The deletion comes last, and it is the only cut that removes a door. Sessions
in flight hold MCP server processes, and both doors reach one daemon, so the
order lets every consumer move before the old door goes.

Life's no-admit rule loses its tool-list guard, because Life keeps Bash. Its
`mcp__eureka-state__*` read-only tool list was already soft: Bash could drive
the stdio server, as context-pack.py does. That fork is question
`life-mind-write-guard`.

Rejected: renaming the crate to `huginn-client`, for the churn above. A whoami
version field, for the reasons in the skew rule row. A config file for the
endpoint, because env already serves both hosts. TOML or YAML as the input
door: see the question.

## A campaign's repo set changes by target revision (Imagination, 2026-10-10)

Felt gap: `eureka-body:follow_up:body-campaign-repos`. eureka-body must change
GameCult/Idunn and the connector kit repo (ruling
`eureka-body:ruling:connector-kit-home`, not yet created), but `repos` lives on
`<c>:campaign:self`, a fixed key with no revision and no resolution, and
admission refuses a cut_spec whose repo is outside it (`admission.rs:405-415`,
`RepoNotInCampaign`). The only workarounds were a sibling campaign (done once:
`eureka-substrate:follow_up:epiphany-cuts-need-a-campaign`, closed by opening
eureka-body) or a cross-campaign `first` line. Pinned at Huginn a7cc2ff.

### Model page: the repo set (step 0b)

| Question | Answer | Why |
|---|---|---|
| What names it | `target.repos: Vec<OrgRepo>[16] = absent` on `<c>:target:r<n>`. Empty means "no target in this chain has named repos": the campaign's own `repos` stands. Non-empty means this revision's list is the whole set. | Reuses the one revisable campaign-scoped record. The target already carries scope (`not_in_scope`, `canonical_implementations`); which repos a campaign may cut is scope. No new kind, key grammar, alias or refusal variant. |
| Who owns it | The in-force target when it names repos; otherwise the campaign document. `campaign.repos` is demoted to the opening set: it decides only until the first target revision that names repos. | One owner at any moment, derived in one function (`Docs::repos_in_force`), read by the one rule that consumes it. |
| Add or remove | Self admits target `r<n+1>` with the new whole list and the `Superseded` resolution of `r<n>`, in one batch (the existing revision rule). The target doc cited by `doc` says why. | Whole-list replacement, as Kubernetes replaces a whole spec per generation; no per-member add/remove events to fold. |
| Silent revert | A target revision with empty `repos` whose predecessor named repos is refused `EmptyRepos { campaign: <target id> }`. | Otherwise omitting the field on an unrelated invariant edit would revert to the opening set. Reuses the existing variant: an empty repo set where one is required. |
| Bound | 16 on the target; the campaign's 8 is unchanged. | eureka-body reaches 8 with the two repos it needs. 16 matches `canonical_implementations`. The campaign bound need not widen, since later sets live on targets. |
| Specs on a removed repo | Membership is checked when a cut_spec (new or a revision) is admitted, against the set in force then. A spec already in force stays in force; its reports admit (they check the spec, not the campaign); it can be Withdrawn or Superseded as before. A new revision on the removed repo is refused `RepoNotInCampaign`. | Admission rules apply to new batches only (target invariant `stored-documents-valid`). Refusing the removal while specs name the repo would need a landed/open distinction the mind does not have (`gap-landing-untyped`), and would force withdrawing landed specs, which misstates them. Question `campaign-repo-removal`. |
| Rename or transfer | A new `Org/Repo` spelling is a new repo: Self revises the target replacing the name. Old specs keep the old name as history; a spec revision may name the new repo (the revision rule does not compare `repo`). Case changes are no-ops (`OrgRepo` equality is by identity). The host (forge or GitHub, `body-repos-on-forge`) is not in `OrgRepo` and stays out of scope. | |
| Who decides | Self admits targets. Admission checks the revision rule, distinctness by identity (the campaign's hook, shared), the bound, and the revert rule. It checks no stewardship (ruling `stewardship-rule`). | |
| Epoch | Stays `epiphany.pipeline.epoch.v2`. The field is `= absent`: stored targets decode with it empty and re-encode byte for byte; one golden line is appended. | Precedent: cut leaf-read-anchors (`reads`, `symbol`). An old daemon reading a target that names repos drops them (serde ignores unknown keys), so after a repo revision is admitted a rollback narrows the set to the opening one; it does not fail to read. This lands with the upgrade rerun waiting on `snapshot-test-stale-and-quadratic`, daemon-first (`huginn-upgrade-daemon-first`). |

### Authority map

- Owner: Huginn admission (`check`, CutSpec arm) through `Docs::repos_in_force`.
- Inputs: the campaign document; the campaign's targets and their resolutions (image and batch).
- Outputs: `RepoNotInCampaign` or acceptance for a cut_spec; `EmptyRepos` for a reverting target.
- Derived state: `campaign.repos` after a repo-naming target is display-only history (the campaign header's `repos` fact and its `repo` alias answer "opened with"). The skill's recipe reads the set in force from the target.
- Forbidden writers: any second membership check (a `campaign.repos.contains` outside `repos_in_force`); editing or re-admitting `campaign:self`.
- Shared paths: MCP admit, the CultNet wire and the stored payload decode `repos` through the same derived impls.
- Deletion line: the direct `campaign.repos.contains(&spec.repo)` at `admission.rs:413`.

### Rejected

- A per-repo record kind (`<c>:campaign_repo:<repo>.n<seq>`, Withdrawn to remove), the stewardship pattern: a new kind, schema, key grammar, alias and refusals, and its key would inherit the opaque repo encoding of `gap-stewardship-id-opaque`.
- A campaign revision (`<c>:campaign:r<n>`): re-keys every stored campaign or adds a second key grammar for one kind, and every `source` citing `<c>:campaign:self` would have to follow it.
- Status quo (sibling campaigns): splits one target's work across two targets and two invariant sets.

### Cut order

campaign-repos (Huginn; independent of clippy-pin; textual overlaps with
mind-launch in admission.rs, docs.rs and the response schema, so whichever
merges second rebases and regenerates the schema) -> skill-campaign-repos
(Eureka campaign-state.md). huginn-cli's campaigns recipe, if it prints repos,
prints the opening set until it reads the target too.