From ee8eec41f39fc2ff06f8be667f97cb4d877e0a6b Mon Sep 17 00:00:00 2001 From: Libby Date: Thu, 5 Nov 2026 10:35:43 +0000 Subject: [PATCH] thing2 build spec: reconcile with rulings read from the eureka mind decode-stack-safety is Fixed (CultLib bbb98eaf); contract-ts/cs specs are r3; discovery reads the eve advertisement through a port until its owner lands; O11 tooling wording follows the thing-script-form question. Co-Authored-By: Claude Sonnet 5.5 --- docs/thing2-build-spec.md | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/docs/thing2-build-spec.md b/docs/thing2-build-spec.md index 7e957be..3555d82 100644 --- a/docs/thing2-build-spec.md +++ b/docs/thing2-build-spec.md @@ -94,7 +94,7 @@ in thousand lines of owned code (excluding goldens), pressure not metric. | # | Cut | Waits on | Est. | Parallel with | | --- | --- | --- | --- | --- | -| 1a/1b | contract-ts, contract-cs (specs `thing2:cut_spec:cut-contract-*.r2`) | contract-rs (landed `6ae2da0`) | mapped | each other | +| 1a/1b | contract-ts, contract-cs (specs `thing2:cut_spec:cut-contract-ts.r3`, `-cs.r3`) | contract-rs (landed `6ae2da0`) | mapped | each other | | 1x | cross-store check | 1a, 1b | 0.3 | 2 | | 2 | testkit + ports | contract-rs | 1.2 | 1a, 1b | | 3 | resolve | 2 | 1.8 | - | @@ -208,8 +208,9 @@ smokes, and end-to-end Verse contract runs; every piece below names which layer. clear law: contract round-trip (exists), `resolve` never panics and either returns a tree whose ids are unique or a refusal, `bind` is idempotent for the same state, `frame` with no events and unchanged state returns an equal command - list (stability). Fuzzing the decoder (`cargo-fuzz` [background]) is deferred - until `decode-stack-safety` lands (the decode hazard is CultLib's, map P20). + list (stability). Fuzzing the decoder (`cargo-fuzz` [background]) waits only on Eve taking the + CultLib pin that carries `decode-stack-safety` (Fixed, CultLib `bbb98eaf`, + `cultlib-gaps:resolution:follow_up.decode-stack-safety.n1`; map P20). Prior art: golden command lists are not published by any project read (R-F §2.5: "not found, not searched exhaustively"), so this is the least-supported decision @@ -238,7 +239,7 @@ no caller today): | `f08-embed-viewport` | `Embed` slot as a leaf of given size | - | | `f09-composition-stack` | nested `Use` with typed args and child slots, `thing.std` plus a publisher composition | 5 | | `f10-hostile` | unknown arm, undeclared `CommandRef`, duplicate id after expansion, unresolved `Use`, schema-mismatched `Bind` | 4, 5, 6 | -| `f11-deep` | nesting at the 256 bound (decoded on a large-stack thread until CultLib's fix) | - | +| `f11-deep` | nesting at the 256 bound (decoded on a large-stack thread until Eve's pin of CultLib `bbb98eaf` merges) | - | | `f12-text-edge` | bidi, CJK wide characters, combining marks, emoji ZWJ, long wrap | - | ## 3. The pieces @@ -252,7 +253,7 @@ die under their own mutation"). ### Piece 1: contract (packages for TS and C#, and the store check) Rust (`crates/thing-contract`) landed after two Soul passes; `contract-ts` and -`contract-cs` are mapped (`thing2:cut_spec:cut-contract-ts.r2`, `-cs.r2`) and have +`contract-cs` are mapped (`thing2:cut_spec:cut-contract-ts.r3`, `-cs.r3`) and have branches (`hands/thing2-contract-ts`, `hands/thing2-contract-cs`) not yet merged. This spec adds no contract change. @@ -580,8 +581,10 @@ This spec adds no contract change. §3: #194011, #192466), off by default until an assistive-technology signal or an explicit toggle, as Flutter does. - **11c shell + discovery:** a web app that discovers surfaces through the Verse's - discovery owner (map: discovery is not Thing's, `advertisement-owner`) and mounts - core; reachable by `thing-mesh`'s transport or a gateway (O4). + discovery owner (map: discovery is not Thing's, `advertisement-owner`; until the + owner's typed advertisement lands, `thing2:follow_up:discovery-owner-campaign`, + through one adapter over today's `gamecult.eve.provider_advertisement.v1`, + deleted when it does) and mounts core; reachable by `thing-mesh`'s transport or a gateway (O4). - **Invariants:** M8 (no `taffy`/`parley` in the JS package or the wasm host glue); the JS host calls only `Core::frame`, passes only the closed `InputEvent`s, and draws only the closed commands; the hidden textarea never @@ -605,16 +608,15 @@ This spec adds no contract change. ### Piece 12: thing-mesh (the CultMesh adapters) - **Owner:** `thing-mesh`: `StatePort` and a discovery client over CultMesh/CultNet - and CultCache; the outbound invocation sender; the only crate with a transport + and CultCache (the client is a port: Thing's contract has no advertisement of its own, `advertisement-owner`); the outbound invocation sender; the only crate with a transport dependency. - **Invariants:** a `StatePort` never returns `serde_json::Value` or an untyped blob (P3); decode runs through the contract types and refuses on error (`Change::Refused`), never a silently-dropped update; subscription uses the mesh's own mechanism, never a poll loop (BD9 dies); the sender sets the caller identity - from the transport session and has no API to override it; decode happens on a - thread with the stack CultLib's decode needs until - `cultlib-gaps:follow_up:decode-stack-safety` lands (the hazard is in the - contract crate's docs, P20). + from the transport session and has no API to override it; decode needs no special thread once Eve pins CultLib `bbb98eaf`, which + carries `cultlib-gaps:follow_up:decode-stack-safety` (Fixed); until that pin + merges, decode runs on a thread with the stack it needs (P20). - **Test:** pipeline smoke: a real CultMesh in-process loopback publishes `f01`'s state and a document; core with `thing-mesh` shows it; then a hostile record (unknown arm) yields `Change::Refused`; an invocation sent through the @@ -732,8 +734,9 @@ Each with a recommendation; none blocks cuts 1-8. document is Thing Script's one authority, and a `.thingscript` text syntax comes later, parsed only by core. Text of the ruling as relayed by Meta's Persona; this mind cannot read it. Consequences held in this spec: nothing but the typed - document is authoritative; no language package, host or tool parses a text form - (packages build the typed document and nothing else); when the text form is cut + document is authoritative; no language package or host parses a text form (packages + build the typed document and nothing else; tooling reaches the one parser through core, which + the question's recommendation expects to expose via wasm); when the text form is cut it lands in `thing-core` next to `resolve` and produces a `SurfaceDocument`, so `resolve` still sees only the typed document, and its tests are round-trip (text to document to text) plus the existing `resolve` suite on the parsed