Ten sha256-pinned external inputs, unpack-blender and unpack-blender-libs steps, the blender artifact (blender 0555),
VILI_BLENDER for test_bvh_to_fbx.py, jobs slot schema motion_job.v1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fbx and clipName on /motion/generate; scripts/bvh-to-fbx.py converts one BVH (SOMA77 names, standard T-pose,
metres, travel on Hips) with a fixed hash seed and time so one BVH on one host body gives one set of bytes. The
daemon runs it per listed BVH (regular file inside the job's artifact directory only), in its own process group,
killed with the worker on lease loss and stopped on SIGTERM. The seed is minted when absent and every job records
motion_job.v1 (seed, file sha256, export). GET /motion/artifacts and POST /motion/rest-fbx. The duplicated
bvh/bvhStandardTpose derivations are one plan. The entry points the daemon at the release's blender.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Red on the daemon at c5cf445: fbx jobs, the refusal ladder, export containment, kill on lease loss and SIGTERM,
the minted seed, motion_job.v1, the artifact read route and rest-fbx. test_bvh_to_fbx.py runs the converter in
real Blender (VILI_BLENDER). This commit does not pass its own tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Imagination pass for motion-pipeline:cut_spec:cut-vili-fbx-export.r3 at base
c5cf445: Blender is not yet in the release and needs nine bundled Debian
libraries; export runs in the daemon under the write gate; the FBX is
byte-identical on one machine with a fixed hash seed and header time; root
travel stays on Hips, so Unity can use root motion or in-place.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
motion-pipeline:cut_spec:cut-vili-admission.r1 under the operator's ruling
vili-moves-to-yggdrasil-now. Idunn's process write lease is the one writer
authority (hand-run: one abstract-socket bind per real root); the release carries
the pinned python-build-standalone tree and hash-locked packages; admitted live
under Idunn 804ed75 with end to end, continuity restart and rollout verified.
Follow-up: vili-worker-intake-local-callers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Idunn passes a runner only the environment a step lists in required_environment. The binding's PATH (the release
python tree first) was never listed, so python3.12 was not found in the first Idunn run (exit 127).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- tick: the lease is asked every WATCH_MS (250 ms); a loss SIGKILLs the worker group at once (the bound is about a second, not the 5 s service-document tick)
- mayWrite() = not stopping and held(); guard() and the worker-output sink both read it
- shutdown: stopping first, listener closed, then the worker tree is stopped, then exit 0
- canonicalPath(): args.stateRoot is realpath'd once; lock name, reclaim marker and the worker environment derive from it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Red at 658de07 for the lease-loss bound, SIGTERM and spelling tests; the leaderless-group and later-line tests pin behaviour that already holds, for mutants.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The stub marks its first healthy answer; the stdout line it prints before ready
had been taking the lease through the log-sink gate first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The fake Idunn signer takes the lease the moment a named path exists under the
state root. Each gate in generate and startWorker now has a case that only that
gate stops, and a lease lost while the state root opens leaves the daemon up.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The startup persist now sits behind the same gate as every other write; its
LeaseLost ended serve() as an unhandled rejection. onLost has already run, so
serve returns without reporting active.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The fake Idunn signer can lose the lease once a job's meta.json exists, which
pins the guards in startWorker (no logs or embeddings directory, no worker).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The hand-run lock is a bind in the abstract socket namespace named by the state
root: atomic, exclusive, gone with its owner, so the probe, the unlink and the
takeover race are deleted. Every write to the state root and every spawn calls
guard(), which asks held() at that moment; Idunn's held() reads the lease each
time and reports a loss through the handler the daemon registered, so a request
admitted before the loss stops at its next write and a respawn cannot outlive it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Red at 4fd3f60 for stale-lock-takeover-race, fence-admits-in-flight-request and
bind-port-65536-accepted; green guards for reclaim-root-unpinned and the SIGTERM
property. The daemon's stop() no longer leaves a daemon holding the run open.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
