systemd refuses to start a unit whose ReadWritePaths names a missing path,
and none of Vili's three roots exist on Yggdrasil yet. Idunn's startup must
not depend on a managed target, so the Vili line takes the "-" prefix.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
motion-pipeline:follow_up:idunn-unit-vili-roots: Vili's admission
(motion-pipeline:cut_spec:cut-vili-admission.r1) needs its three roots
writable under ProtectSystem=full, beside StreamPixels'. Lands before the
d3222e5 install, which restarts idunn-yggdrasil anyway.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cut idunn-deploy-provenance:cut_spec:cut-tree-executable-members.r2, reports
h1-h3, Soul s1-s3. Members sealed 0555, the rest 0444; link containment
decided once in the digest walk (leading dotdot within depth, no absolute);
one seal step for collect and host. Real PBS CPython+torch and Blender trees
seal with all 1128 links kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Closes the live-target bypass: a judge guarded by exists() or is_dir() passed every dangling fixture.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
collect_artifact and host.rs materialize both call seal_artifact. digest_tree
judges every link with check_release_link (relative, `..` only first, climbs no
higher than the link's depth); validate_release_symlink and harden's link
judgement are gone. hash_file_exact owns the streamed-length check. A file
directly under a tree's top is pinned 0444.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Imagination r2 for cut tree-executable-members after Soul s1: link census of
the real PBS and Blender trees, why lexical normalisation does not prove
containment, the leading-dotdot-within-depth rule and its prior art, members
on host targets carried not applied, one seal step for collect and host.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ArtifactOutput and ArtifactReceipt gain executable_members (the receipt field is
skipped when empty, so existing sealed release ids are unchanged).
check_artifact_modes is the one seal-time owner of mode declarations and runs
from both collect_artifact and the host materializer. harden_installed_release
drains the declared set and fails when a declared path was never sealed. Digests
stream through one hash_file_streamed helper; the encoding is unchanged.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Imagination pass for cut tree-executable-members (session
self-2026-10-23-eureka-b): seal, digest and receipt facts, symlink rule,
live binary and install path, disk sizing for the acceptance job.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reading the clock after the cached result still left the answer to ordering; the
one place freshness is decided is the age subtraction, and monotonic time cannot
run backwards, so a result stamped after the reading is fresher than it and ages
zero. The bound test names 86400 and 86401 so raising the constant is caught.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The test clock's wall now starts a Unix-epoch away from the monotonic clock, so a
deadline or schedule that reads the wrong source fails. serving_state reads the
cached probe before the clock (a stamp is taken before it is stored, so the later
reading is never behind it) and ages with saturating_sub; the test that pinned the
old wrong answer is replaced by a deterministic descheduled-reader test. The
lease-wait, startup and heartbeat seconds are bounded to one day at parse with a
refusal that names the flag and not the value, and every deadline is computed by
one saturating helper.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clock gains monotonic_millis; the cached health result's age, the freshness
decision, the probe schedule, heartbeat and lease/startup deadlines all read it.
Wall time stays on the signed record only. A result stamped after now is not
evidence. Tests step the wall clock both ways, pin the warming-proof cap, and
bound the lease-timeout join.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PresenceAcceptor serves one connection at a time within a 1 s deadline and never ends on an accept error; a dead presence thread fails the unit. Builds.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The member candidate port is derived from the candidate port; both stable sockets get firewall rules; native targets render the same bytes as before. Builds.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Soul s1 fixes. Credential placeholders resolve files under
$CREDENTIALS_DIRECTORY only, never an environment variable. The route
acceptor has a first-byte deadline, a total challenge deadline and a
connection cap with unspawned refusal; a dead acceptor degrades presence.
The shared lease lock is a plain descriptor the child inherits, so the lock
lives as long as any writer. Tests pin a late-healthy child and a hung probe.
One commit: the spawner and lease trait signatures change together with
their fakes. Builds.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Does not build-verified yet; tests follow. drivers.rs: holder-side lease read, one lease-binding rule shared with grant.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Cuts c2-phase-split, c2b-owner-deadlines, c2c-post-fence-forward, c2d-continuity-yields with their Soul passes; installed on Yggdrasil 2026-10-20 00:34 UTC.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
If the boot lift returned Err, boot logged and served with nothing held, so
every pending continuity abort ran and stopped a running candidate. Boot now
sets lift_unsettled; retry_held_lift runs the lift for each continuity abort
until one succeeds, and no abort step runs before. Boot's call moves into
Engine::boot_lift so the failure is testable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The lift kept an abort running for any awaits_handover Deploy, so a braked
Deploy released a held record to an abort that stopped the only copy of the
body. One predicate, deploy_the_continuity_yields_to (candidate unproven, a
waiting Deploy that deploy_can_move), is now what both the deadline's yield
and the lift ask (rulings c2d-yield-only-unproven-to-movable,
c2c-lift-defers-on-observe-error).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two tests, from Soul's h2 attacks: a running candidate at boot beside a braked
stop-then-start Deploy at its Sealing tail, and a held (unobservable)
candidate when such a Deploy appears. Both must leave the candidate unstopped.
They fail here: the lift treats any awaits_handover Deploy as a reason to keep
aborting.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
serving_proven (Committing, or routing evidence recorded) ends the yield:
yields_to_a_deploy replaces retries_forward, and wait_for_owner reads it, so
a Deploy no longer waits on an owner that will keep serving. deploy_can_move
asks the deployment brake live for a Deploy at its Sealing tail, so a braked
Deploy draws no yield and the yield happens once the brake releases. The
tests of 04389e6 are repaired to reach their worlds (the failures they
showed at 1beca61 were the right ones). Rulings
c2d-yield-only-unproven-to-movable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fail at 1beca61 (the c2d logic is 81bfb03's): a Committing continuity past
its deadline yields to a waiting Deploy and stops serving; a stop-then-start
Deploy at its Sealing tail with the deployment brake unreleased draws the
yield. The second test releases the brake and pins that the yield then
happens and closes the continuity's operator-required incident Recovered.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An abort over a candidate the boot lift could not observe is held in
process memory: resume_candidate runs no step of it and retries the lift
each pass (retry_held_lift) until observation answers Ok (lifted) or the
driver proves the candidate dead (the abort proceeds). The predicate and
write move into consider_lifting_continuity_abort, which boot and the
retry share. Ruling c2c-lift-defers-on-observe-error.
The page and the expire refusal name the manual exit from the plan's
workload binding: a unit to stop for systemd, a process to kill for a
host actuator.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fails at 81bfb03: an observe error leaves the abort running and its first
step stops the candidate. Also pins the lease_withdrawal==Complete conjunct
(case LeaseWithdrawalRecordedComplete) and makes the refusal table's
dead-candidate case provably dead (SwitchWorkload::bury).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
