Idunn's daemon, at the continuity decision site, writes one
idunn.operator_incident.v1 record per exhaustion into its own published
incidents.cc (--incident-store), never control.cc. The record opens once per
(target, condition), closes on an observed running workload (recovered) or on
the target leaving the admitted set, and retires to incident-history.cc seven
days after closing. A store failure is traced once and never returned into the
tick. idunn status prints each target's incidents. ReportOnce is demoted to a
stderr trace.
Does not build the fixture test until tests/fixtures/idunn.operator_incident.v1.cc
lands in the next commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Imagination step 0b for campaign idunn-watchdog. Forks are admitted in the
mind as questions delivery-crossing, paging-conditions, closure-notice.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
First typed Eureka campaign (idunn-watchdog). The typed target and rulings
live in Eureka's mind; this doc holds the rationale and design truths.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Operator: "do map the cut that'll ensure it doesn't happen again". Q3 A is
ruled (rotate before prod); Q1 A and Q2 A are Self defaults.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Continuity restarts are Survival; Survival counting is best-effort when
the ledger cannot record it, Forward stays fail-closed (2026-09-30).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cargo-mutants-style probe C26 (the resume backoff read without its longest
wait) survived: the clock-step test called is_waiting directly, not the resume
site. An Engine-level test now sets a real half-minute backoff, which holds,
and a day-ahead one, which is attempted.
docs/host-actuator.md said continuity gives up after three attempts; it is six
restarts inside an hour.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The retired --idunn-rudp-health family is rejected by the binary; Raven is
liveness by runtime presence, Starfire and Nightwing by witness scripts.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Records Q-O1 (Idunn proves; supersedes Q1 (b)), Q-O2, Q-O4, Q-O5 and the struck
Q-B4 held clause; Q-O3 open. Adds the audit site table and target authority
map (section 5), cuts X1, A1, B4prime, A2, A3, O-R, L-R, marks R1 superseded by
A1, records Odin's temporary fatal rule and the Soul open items, and updates the
Cut status block.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Splice the B2 rework map (owner map, per-file cut, verification, live
relevance, subtraction estimate) under B2; add cuts D1, T1, T2, W1 and R1;
record Q-B2-1 (a), Q-B2-2 (fail at once), Q-R1 (a) and Q-B4 (routed by
Idunn's route proof, unrouted by admission plus workload; the Odin non-Ready
veto clause held open). B4 is blocked on the Odin-lifecycle authority audit.
B2, D1, R1 ready for Hands; W1, T1, T2 in progress on hands/idunn-w1-t1-t2.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A continuity abort demotes the shared key to Expected-only with its own
exact activation, and never withdraws the Expected. a148802 is reverted.
Pre-B1 terminal continuity aborts keep their phase under a
LegacySkippedBeforeB1 marker that only the lift can construct. Boot
reconciliation is the single owner of legacy residue and demotes only by
exact identity. Supervision records a failed pre-restart demotion and
defers instead of minting a continuity. Scheduler faults are isolated per
transaction and backed off, reported once and kept in the record. Queued
commands freeze every tick, so one wedged target cannot starve the
others. An unreadable history fails closed for freezing. boot is a
separate, tested step.
Soul made four passes. The first found boot-wedging on legacy records.
The second traced it to Self's ruling to reopen terminal records, which
was replaced with one owner for the cleanup. Pass three found
cross-target starvation, and pass four found fault re-arming. 241 tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul found B1's rule sound and its transition unsafe. This makes the rule's
old inputs impossible to reintroduce a stuck state from.
- The control store's legacy lift owns the transition. A pre-B1 continuity
abort that issued an activation lifts with topology_reconciliation Pending,
so the one resolution demotes its own activation. A record already terminal
under the old rule is reopened at Starting, since a terminal record cannot
owe work. History lifts records as written. Before this, one resident
record of that shape failed validation and ControlSnapshot::read refused the
whole store, so Idunn could not boot.
- Supervision owns the Expected-only precondition. When its pre-restart
demotion fails it mints no continuity and writes next_restart_at_unix_millis
on the generation's ContinuityBackoff (attempts and window untouched), so it
neither restarts over an undemotable projection nor retries every tick.
- Boot reconciles once: a projected activation that exactly matches the
activation a failed continuity in history (or a resident terminal record)
issued is demoted. Nothing is adopted; an activation no admitted generation,
live transaction or failed issuer accounts for is reported and left alone.
New read-only CultCacheTopologyDriver::projected_activation.
- Unreadable history.cc fails closed. The continuity restart ceiling and the
consumed-command check no longer read an empty history; they stop, and the
fault is reported once while it lasts (ReportOnce). The undecodable-record
report is a pure function, pinned.
- docs/deployment-authority.md no longer says the projection never drifts.
Tests: legacy fixtures written by the 9001b58 encoder for the three abort
shapes (a second throwaway generator, see the fixtures README), driven through
the Engine; the seeded-transaction helper now takes a command kind and an
incumbent, and a Deploy carries a frozen-source receipt and a signed brake
release, so Deploy commit, Deploy pre- and post-fence aborts and a continuity
abort over an incumbent run through the real phase machine.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A continuity candidate shares the admitted Expected key. Both abort intents
marked its topology reconciliation Skipped, so a failed continuity left its
candidate activation projected under the admitted key while the admitted
receipt named the older one, and a later deploy's post-fence demotion refused
as substituted.
DeploymentTransaction::abort_topology_reconciliation is now the one rule for
both intents and pre-fence validation: a deployment owes the projection when it
published its Expected, a continuity owes it when it issued an activation.
reconcile_failed_candidate_projection is the one resolution for both abort
paths: a deployment withdraws its own key, a continuity demotes the shared key
to Expected-only with its own exact activation and never withdraws the
Expected. The post-fence incumbent demotion stays deployment-only and exact.
Tests read the persisted topology store after the production
publish/demote sequence.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This reverts commit a148802cb6.
Rollback after fencing adopted whatever activation was projected under the
shared Expected key, so a continuity abort's leftover activation could be
demoted by a later deploy. The drift is closed at its source by the next
commit: a continuity abort demotes its own exact activation. Rollback demotes
the admitted generation's exact activation again.
The doc paragraph is dropped; the 9f00e7a paragraph above it stays until B4.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
All six were ruled as recommended, one at a time, on 2026-09-29. Q6 adds
a Soul pass on the weekend CultLib branch before it merges. The campaign
moved to the Eureka session "Codebase audit".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Body facts, identity/lifecycle/authority table, six operator questions and a
draft cut list (S1, B1, F0, B2-B5, S2, C1, S3/C2) for the route-continuity
target. Campaign handed to the "Codebase audit" Self session; operator forks
are ruled there.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Eureka target for the route-continuity rebuild after the 2026-09-28 StreamPixels
deployment failure: observation never actuates routing, failure never
accelerates actuation, web apps prove over their own HTTP route, every
post-fencing phase ends.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The version tag could not be recorded where the ruling said, because the
stored value is validated to a bare sha256 shape by a pinned dependency in
another repository. Hands implemented an equivalent implicit version read,
flagged the divergence, and asked whether proceeding was right. It was: the
ruling named a mechanism, the hazard was live, and halting would have left the
fleet exposed.
Five tests prove it by failing without the fallback, which is the point, since
the whole finding was that nothing had ever exercised the stored path.
The frozen-source digest turned out to have the same exposure through a
narrower window, and this cut's own sixth and seventh batches crossed it
twice. Same answer applied, with the prior shapes reproduced from git history
rather than from memory.
Hands also spotted a third instance and declined to chase it: the systemd
actuator compares a raw content-only digest read through procfs against a
stored value now carrying mode, gid and xattr terms. Two different algorithms
compared to each other, which is the same defect a third time. Flagged for its
own look rather than guessed at.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The bypass is a compile error now, proven by builds that fail on Soul's exact
spellings rather than by reading the lint config. The repository had no CI
surface at all before this, so there was nothing for "denied in CI" to attach
to until now.
Hands flagged that the single-file artifact digest format changed and reasoned
nothing compares against literals. That holds for fixtures and not for
receipts: two call sites in host.rs compare a freshly computed digest against
a stored value. So the first upgrade past this commit makes every already
installed workload fail "installed executable differs from Expected", and
every running one fail "the installed executable changed under the running
process". Idunn is the deployment and daemon-survival authority, and this
would land silently at restart across the fleet.
The ruling versions the digest and verifies in the version the receipt names,
rather than re-sealing admitted state to make new code agree with itself. It
is not closed until a test seals under the old format and verifies under the
new, because the whole finding is that nothing exercised the stored path.
Two bugs in this batch were found by running the suite rather than trusting
it, including a test that set an attribute on a root whose own metadata is
never hashed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The port can be walked around. Two spellings of the original bug restore it
with all 193 tests green, and the proof it leaks is already in the file: one
function still calls fs::read_link directly, and a probe measured sixteen
counted calls beside three uncounted syscalls. My record claimed the count was
total rather than conventional. It is still conventional; the convention moved
from remembering the counter to remembering the port. That is the second time
this record has overclaimed what a pin does.
The artifact digest's single-file path never got the ruling, and it is the
path the installed executable actually takes. Setuid, mode and a file
capability are all invisible there, immediately before launch. Every test for
it wraps the file in a directory so the other path runs, and one of their doc
comments claims to pin exactly the scenario it does not reach.
The xattr framing is sound and nothing proves it. The suite stays green with
values dropped entirely, so a capability edited from cap_setuid to
cap_sys_admin is covered by no test.
Soul named one cause with three faces: every pin here is a convention a later
edit steps around, and the fixtures use the convenient shape rather than the
one production uses. So the eighth batch makes the bypass a compile error and
moves the tests onto the production shape, instead of adding a ninth round of
point fixes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
193 tests, and the mutation that passed in 0.39 seconds on pass 7 now fails.
Putting canonicalize and symlink_metadata behind a port that charges the
counter inside the same method as the syscall is what turned an honour system
into a measurement; the hand-placed call sites are gone.
The validator mask tests are precise rather than merely red: narrowing the
file mask fails exactly the setgid test and narrowing the directory mask fails
exactly the setuid one, with the other five staying green. That is the
evidence they pin single bits.
The unreachable test is deleted rather than repaired, with a note saying why
the defence it claimed never existed. The xattr tests close Soul's file
capability finding and state in their own doc comments that the probe runs as
root and proves nothing about an unprivileged attacker.
Hands shipped a compile bug in the first commit and its own Yggdrasil run
caught it before the report. That is the order these should happen in.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
