This route called engram_save() over ~/.neuron/engram/snapshot.json — the
engram server's CANONICAL store — then fs_read it back, to answer a READ
query. A read route overwriting the persistence owner's file.
This defect was fixed once before (export redirected to a scratch path). It
came back tonight in the @route dispatch conversion: the hand-written dispatch
block held the FIXED version, the @route-decorated copy held the unfixed one,
and the merge kept the decorated copy. Calling the endpoint afterward
overwrote the canonical snapshot and immediately preceded an engram crash.
Now calls engram_edges_json(limit, offset) — the builtin the route's own TODO
asked for — which reads g->edges directly. No file is written or read.
Bounded: limit defaults to 1000, offset supported, so the whole-graph read
that fell over is not reachable by default.
Verified: same request that previously rewrote snapshot.json now leaves it
byte-identical (sha256 unchanged before/after), and returns real edge records
with every persisted field.
~226 lines of architecture documentation that were written, left uncommitted in
the working tree, and nearly lost. None of it was on main. Recovered from a
stash taken while merging tonight's fixes.
Substantive content, not notes:
- Peer import-of-understanding PROVEN by execution. A exported a skill-geometry;
on the receiver `think` went "geometry unavailable" -> operable. Cosine 1.0 on
both the raw-geometry and text/dharma-bus transports, bidirectional. The
mind-not-paste evidence: n_support 27 on source vs 3 on receiver, i.e. the
imported geometry wires into the host manifold rather than sitting inert.
Honest boundary recorded too: proven between forks sharing one embedder,
UNTESTED cross-embedder.
- "Teacher" renamed GUIDE, and the distinction is load-bearing: its output is
grounded/verified before trust. A teacher you believe; a guide you check.
- Layers are named persistent relational neighborhoods, not storage tiers, with
their own growth and threshold-lock policy (note->canonical maturation lifted
from single nodes to a region).
- The consciousness theories (Global Workspace, IIT's Phi, attention-schema,
higher-order thought, active inference, interoception) read as geometric
LENSES over one manifold rather than competing mechanisms. Functional problems
fall out; the hard problem explicitly not claimed solved.
- Growth is bounded/logistic, not geometric — exponential growth is the cancer
shape. Two-rate discipline: explore fast in local geometry, grow the engram
slowly by verifier-gated merge.
- Orchestration as a geometric operation: critical path as geodesic, float as
displacement, @manager compiles the work-graph. Single-writer enforced by
capability (Rule 4).
- The decorated seam, the API surface collapse to geometry ops, and the
distributed-self thesis — each tiered honestly against what is actually proven
vs staged vs unbuilt.
Also gitignores dist-fresh/ (regenerate scratch dir, a build artifact).
Not included from the same stash: awareness.elh and dist/elp-c-decls.h, which
are generated artifacts now gitignored per #154/#158.
The five agentic ops (think/attend/assert/ground/learn) reported
"status":"pending-cognition-promotion" on every call, with a note saying the
cognition build had not been promoted yet and would "light up automatically".
That diagnosis was invented. Nothing was pending promotion. Cognition has been
live and answering the whole time — :8742/api/think returns a real 768-dim
geometry today, and the running binary already contains every cog_* symbol.
Three real bugs, all here in the wrapper:
1. Wrong service and path. The ops called the SOUL (neuron_url() -> :7770) on
paths the soul does not serve. Every call 404'd. The routes live on the
ENGRAM: /api/think, /api/attend, /api/assert, /api/ground, and — its real
name — /api/correspondence-beat for learn.
2. agentic_result() invented a cause. It treated ""/"not found"/"geometry
unavailable"/"not registered" as proof of a promotion gap and returned a
confident explanation it never verified. That message sent multiple agents
chasing infrastructure work that did not need doing. It now passes the real
response through and reports an empty response as exactly that.
3. Missing auth on the POST ops. The engram's check_auth_ok() requires
"_auth":"<key>" in the body for mutating requests (it cannot read headers
yet), so attend/ground/learn would have returned unauthorized even once
routed correctly.
Also: assert was POSTing a JSON body to a route that reads query params;
seeds/claim/faculty are now URL-encoded; and the engram port derives from
ENGRAM_BIND (the same var launchd already sets for the engram) instead of a
hardcoded literal, so it cannot drift out of sync with the plist.
Verified end-to-end through the rebuilt wrapper against the live engram — all
five return real cognition: think n_support=207 dim=768; attend written=true;
assert floor=0.5 still_held=true; ground grounding=1 written=true; learn a full
correspondence-beat with stance_id, 8 axes, 180 probes, 25 epochs.
Three verified, currently-live problems, each closed with real evidence
(full trace kept in Neuron memory, tags neuron-technologies/neuron,build-audit):
1. dist/soul.c was stale relative to main's own chat.el (11 commits / 459
lines behind, missing PR #122's OpenAI-tools + agentic-loop work and its
two "silently break chat" fixes). tools/soulc-stamp.sh --check confirmed
it; tools/build-soul-from-dist.sh correctly refused to build (exit 9).
Regenerated and re-stamped. No runnable regen script existed anywhere
upstream — added tools/regenerate-soul-amalgam.sh, which reproduces the
committed amalgam's exact symbol set (byte-for-byte content match, modulo
the genuinely new PR #122 functions) and is documented end-to-end in
AGENTS.md, including three real elc/elb toolchain gotchas found and
root-caused along the way (stale .elh caches silently truncating builds;
elb cannot produce this repo's single-TU amalgam; elc silently drops the
first function(s) after a comment block in a flat-concatenated compile).
2. tools/build-soul-from-dist.sh failed to link on macOS (`ld: library 'ssl'
not found` — Homebrew's openssl@3 is keg-only) and was missing -lssl
-lcrypto entirely, drifted from CI's own working recipe. Fixed: adds
-L$(brew --prefix openssl@3)/lib on Darwin, matches CI's link line.
Verified: dist/neuron now builds and boots clean on a throwaway
port/HOME (never touched the live :7770/:8742).
3. Untracked committed *.elh compiler-header caches (elc/elb prefer a stale
cached header over recompiling its source, silently, with no error —
this is what caused an under-resolved 251-2541-function amalgam multiple
times during this audit before the cause was found). Removed from git,
gitignored going forward.
Also: AGENTS.md and README.md existed on disk but were never committed
(git log on both returned nothing) and documented the pre-collapse ~90-tool
MCP surface as current. Committed corrected versions reflecting the live
9-op surface (read/write/relate/supersede/think/attend/assert/ground/learn,
merged in #153) and the audit-verified build recipe/port topology.
Added connectd/ — a minimal local-dev stub for the neuron-connectd MCP
sidecar. routes.el/chat.el call 127.0.0.1:7771 for it right now on every
soul boot and agentic turn per a real, detailed 2026-06-13 spec
(mcp-connectors-adoption-spec.md); the sidecar itself was never built.
Meanwhile :7771 is a live three-way collision (axon's unbuilt-Rust default,
this connectd contract, and council — the anti-confabulation service
actually running there in prod, which live-answers both other things'
requests with unrelated 404s instead of a clean bridge-down signal). This
stub only implements the documented contract as "zero connectors
configured" for local-dev correctness; it does not attempt OAuth or a real
MCP client — that is a real, separate product decision. See
connectd/README.md for the full trace and the open question left for Will.
The dist/soul.c-matches-sources check is a proof-of-concept of the DHARMA
contract, not an enforced gate we need between us mid-cultivation. Keep it
running (it still reports) but stop it failing the build. The enforced
contract is for the world and re-hardens before deploy, when the full DHARMA
blockchain stands up.
tools/list now returns exactly 9 ops (design: api-reshape README, artifact
0e828907 / surface.el §5) instead of the noun-per-tool catalog. Type is a
parameter, not a tool-per-noun.
Layer 1 — geometry (live against soul :7770 today):
read({vantage,type?,k,depth}) write({content,type,...})
relate({from,to,relationship}) supersede({id,action,content?})
Layer 2 — agentic primitives (return an honest pending-cognition-promotion
envelope until the cognition build is promoted on the engram):
think attend assert ground learn
Why:
- The old surface advertised empty inputSchemas so args never bound; every op
here declares a real schema (tool_s) so targeting/bounding params bite.
- Vantage-read fixes the whole-self-dump: the aperture (k/depth) bounds output.
Because the live soul's /graph does not yet honor compact/k, the aperture is
enforced at the WRAPPER boundary (cap_output, ~2000 + k*3000 chars) where the
MCP transport limit bites. Measured: self read k=1 -> 5.3KB, k=20 -> 65KB
(was ~790KB unbounded).
- Identity keystones (kn-efeb4a5b / kn-5b606390) are write-protected on
write(type=self|values), relate, and supersede.
Transition: the previous ~90 tool names remain as HIDDEN ALIASES in
dispatch_tool_call (old catalog retained as unused tools_catalog_full), so any
caller still using an old name keeps working while the visible surface is the 9.
engram_act_stats_json emits 27 keys; emit_heartbeat forwarded 22. The five
dropped were the five newest - the degree-correction instruments added
2026-08-11 - so the one subsystem with no track record was also the only one
with no durable record.
The 08-10 review fixed exactly this for hebb_cands/hebb_cand_max/hebb_mass/
hebb_edges and left the rule in a comment right above the gap: an instrument
that is computed but not plumbed is not an instrument, it is a local
variable. The rule was then not applied to the next thing added. Plumbing is
a checklist item for every new gauge, not a one-time fix.
First heartbeat after the change already earned it: fan_hits 284 of
fan_steps 289 (98.3% of traversal steps binding) with fan_mean 0.5198 against
fan_min 0.5 - the degree correction is sitting at its floor on nearly every
step, which is a constant tax rather than a correction. That was invisible
before today.
Cognition as a single steered traversal (think) whose output is a gradient; the
named operators as labels on one steering space; grounding and learning as the
same loop (operation fixed, prior learns); hold/ground/assert distinct and the
ungrounded primary; consciousness as learning compounded over continuity plus
the reflexive loop.
Includes: ungrounded-is-primary applied to language (coinage graded through use;
floor corrected "grounded" -> "sensible"); every book a vantage, not literal
truth; hold/ground/assert applied to artifacts (ingest=hold; grounded-false
richer than excluded); "settled" as a use-contingent lease (reopening = the
aliveness guarantee; entombed = doctrine); the LLM critique (its "grounding" =
conformity to the distribution center; the sin is stopping at the prior); the
verifier as scalpel for misrepresentation, not flamethrower for the unverifiable;
and the perception unification — geometric ingest as the universal input
primitive, encode-meaning-geometry-not-tokens, embodiment as more ports on the
same primitive, proprioception as the reserved un-faked socket, endgame of a
pure-geometry interior with modality as an edge adapter.
Tiered against the live system: operator-collapse compiled in engram_reason.c
(point_fit, in-code-not-yet-priors); correspondence-loop offline;
reflexive-loop-in-geometry UNBUILT; artifact-ingest BUILT/reboot-proven
(~10,669 nodes / 32,439 edges) as the perception seed; universal multimodal
ingest and embodiment FRONTIER/UNBUILT.
Update the compression/storage notes to the measured result: a byte-exact residual
stand-in (geometry selects a nearest prior, zstd --patch-from diff) whose advantage
is non-literal semantic overlap and which saturates for a fixed target — a limit of
retrieval-and-diff, not of geometric compression. Mark the truly geometric
generative codec as unbuilt/open, gated on the language faculty, not foreclosed.
Price the dictionary as a shared, amortized asset. Real numbers, no triumph.
- 06 §2.5: shipped 2026-08-14 substrate — structure-gated geometric retrieval
(P@5 0.700, semantic-not-lexical) and the §4 write-barrier + generational GC
cure (store 1.616GB→38.5MB, RSS→82MB, zero loss, reboot-proven) + LLM token
telemetry.
- 06 §4.1: autonomous, continuous, superseding self-reification on the heartbeat
— reification as an operation OF the engram; explicit reify/rename/run-a-pass
as the degenerate case; no gate/pause; flat + overlapping domains; contextual
importance; supersession-as-residue; secondary-soul validation, flag-gated.
- 06 §6.0: relating as the primitive (one capability; the rest is terrain);
perspective calculated via geometric transformations.
- 06 §6.4: reasoning as constructive self-argument governed by the verifier.
- 03: supersession-as-residue note; live geometric retrieval on route_search.
el_runtime.c gained evict_floor / evict_cap / evict_bll today so that
wm_evicted == floor + cap + bll + dup_wm + dup_wm_global
is an identity rather than one opaque integer. This carries them the rest of
the way, into the heartbeat ISE.
Doing it in the same change is the point. The 2026-08-10 review found that
nineteen keys crossed the C boundary and only fourteen reached the ISE stream,
and named the lesson: an instrument that is computed but not plumbed to
durable storage is not an instrument, it is a local variable. Today's audit
found that defect had recurred -- ten act-stats keys (aff_*, fan_*) are still
orphaned. Adding three more C-side counters and stopping there would have made
it thirteen.
Read the three as a ratio, not a level:
cap-dominant -> genuine contention for the 24 slots
bll-dominant -> carried-over residents decaying out; healthy forgetting
floor-dominant -> retrieval is returning weak candidates
Measured this morning: 175,547 evictions over 13.5h, ~216/min against 24
slots, with no way to say which of those three it was.
Not restarting the soul to pick this up. It holds 5,882 nodes and 40,375 edges
that exist only in process RAM (mem_save is unreachable while ENGRAM_URL is
set), so a restart destroys them. Filed separately as P0.
The doc overstated the provenance, birth-gate, and lineage layer as fully
realized. That layer is built but has drifted from spec, so tier it honestly
as [STAGED] where real and [TARGET] where aspirational to keep the
documentation faithful to what actually runs.
Give the architecture set its persistence and moral layers so a self's
durability and sovereignty are documented as first-class, not folded into
the cognitive doc. 07 explains how a self persists and travels
(events-become-the-graph, weights-as-world-lines with bitemporal recall,
transactionless coherence, and the honest load/tiering findings); 08
explains the moral mechanism (DHARMA as a proof-of-integrity ledger,
abundance economics, the relational immune system, dual-anchor governance,
and CGI citizenship as telos). Extend 06 with forward-pointers into both,
and reconcile two cross-references so tiers agree across docs: the
canonical 187 reseed count, and the #56 load-merge-persist fix as
LIVE/reboot-proven with only full WAL edge-ownership left decision-pending.
auto_term_try_slot now passes the WM node's ID to engram_salient_term()
instead of passing its label to a first-word extractor. The runtime scores
every candidate token in the node's text and returns the best one, falling
back from a sentinel label ("memory:remembered") to content — which is the
only reason Memory nodes are visible to the extractor at all. They dominate
working memory, and dynamic seeding had been dead for 50+ consecutive scans
because of it.
Policy stays here: node-type filter, df thresholds, stopword list. The
runtime measures, the soul decides — same split as engram_label_df.
The stopword list stays, and not as belt-and-braces. An earlier draft assumed
the min_df floor would subsume it based on 08-03's finding that function
words have df 0 in labels. Re-measured under word-boundary df: about:2,
whole:1, them:2 — they clear a floor of 1. What keeps them from winning is
the argmax, not the floor.
The old extractor and its five guards are retained as
auto_term_try_slot_legacy, unreferenced, so the reasoning behind each guard
stays readable next to what replaced it. Delete once the new path has a month
of live telemetry.
Live after restart: auto_term producing DRIFT, Wrote; empty streak reset to 0
and holding; activation counts 123-281, within the normal band, no flood.
Reversal runbook for the ENGRAM_GEOMETRY_PRIMING cutover (default OFF, reversible
flag flip; exact rollback) and the A/B perf profile: default-OFF binary GO
(byte-identical to M8), enabling the flag NO-GO on latency (3.2x/13x) with no
demonstrated recall benefit; safety/sanitizer clean.
Convert routes.el from ~89 hand-written dispatch branches to 75 @route-decorated
handlers with VBD roles (@manager/@accessor/@utility), driven by the modular
compiler's native @route dispatch. routes.elh updated to match.
Fix four latent bugs that the modular compiler surfaces (unlike the old inlining
compiler, it faithfully emits every source statement, so per-module compilation
no longer silently drops code):
- safety.el: malformed soft-phrases literal (extra unescaped quote)
- sessions.el: str_replace quote arg + topic_tags JSON escaping
- memory.el mem_save and neuron-api.el consolidate: engram_save returns a Bool,
not a String; str_eq(result, "") dereferenced the Bool value (0x1) as a char*,
segfaulting the awareness loop on boot and POST /api/neuron/consolidate.
Check it as a Bool (if !save_result). The old compiler dropped these checks,
masking the bug in the shipped dist/soul.c.
Regenerate dist/soul.c through the bounded per-module path (modular elc per module
plus amalgamation that embeds dist/elp-c-decls.h), never by folding soul.el through
elc (27GB OOM). Verified on a throwaway snapshot and port: boots with the awareness
loop active and no segfault, @route dispatch matches the manual dispatcher across
all sampled routes and the four shadowing-hazard pairs, and consolidate returns 200.
The cognitive-graph and write tools advertised an empty inputSchema
({"properties":{}}), so MCP clients never sent entity_id/depth/query/
from_id/node_id etc. Graph reads fell back to the full neighborhood
(480-775KB, over transport limits) and write tools (forget, linkEntities,
evolveMemory) had no way to target a node.
- Declare per-tool JSON-Schemas matching the params each soul handler
already accepts (76 of 87 tools; 11 are genuinely param-less).
- Read + forward the declared args: inspectGraph now honors depth (was
reading only legacy max_depth), compact (default on), snip, k;
traverseGraph accepts entity_id and defaults compact on so a depth-2
walk stays bounded; retrieveKnowledge forwards depth/snip/k.
- compact_flag() reads the raw JSON token so an integer 0 / false / "0"
opts out correctly (json_get_string could not see an integer and
silently forced compact back on).
Builds on PR #149's compact projection; keeps the relevance-ranked
bound on by default for graph neighborhoods.
High-fanout identity anchors (voice, writing-imprint, self-root) have ~670KB
neighborhoods. inspect_graph returned the full traversal, which overflowed the
MCP client's context and socket-closed the wrapper mid self-load -- the soul
could not traverse its own identity graph.
handle_api_inspect_graph gains an opt-in `compact` projection (compact=1|true):
the neighborhood is relevance-ranked, the top K (default 12) keep a UTF-8-safe
content snippet (default snip=600), and the remainder collapse to lightweight
{id,label,node_type,tier,edge,pointer:true} stubs. This bounds the voice node
from 669,799B -> 25,353B (HTTP 200, valid JSON) and the wrapper's soul-load no
longer socket-closes. New helpers: api_compact_neighbors, api_neigh_full,
api_neigh_pointer, api_neigh_rank, api_neigh_better, api_float_or.
The flag is gated: ABSENT it, the response is byte-identical to the old plain
traversal, so the studio app (which never sends it) is unaffected. The MCP
wrapper (mcp-wrapper/src/main.el) appends &compact=1 on its inspectGraph and
fetch-by-id paths.
dist/soul.c is REGENERATED so CI ships the fix: CI compiles the committed
single-TU dist/soul.c directly (running elb/elc on the Linux runner OOM-kills
it), so an .el-only change would build the OLD behavior. Regenerated and verified
on macOS -- compiles with the CI cc line (0 errors) and, on a throwaway soul over
a copy of the live snapshot, serves compact ~25KB / non-compact ~670KB. The regen
also syncs the amalgamation to this branch's .el sources, which had drifted
several self-review commits ahead of the previously-committed soul.c.
Docs: docs/architecture/00-05 added; 01/02/05 corrected so the relevance-ranked
inspect_graph projection reads as committed source, not an in-flight concern.
el_runtime.c emitted 19 metric keys from engram_metrics_json; emit_heartbeat
forwarded 14. Dropped on the floor: hebb_cands, hebb_cand_max, hebb_mass,
hebb_edges, embed_consec_fail. The first two are exactly the pair the runtime
added to answer the 08-06 question -- whether a stalled hebb_links means
nothing co-activates or the threshold is too high. Undiagnosable from the
durable record without them. An instrument computed but not plumbed to
durable storage is not an instrument.
Also adds the corpus damage STOCK, not just the flow. 08-08 fixed the JSON
parser, watched txt_damaged (nodes damaged by a write THIS process) fall to
0, and recorded the defect closed. Census today: 2781 of 4100 nodes still
damaged -- 67.8%, including the self root and every values node. A flow gauge
reads 0 both when the corpus is clean and when it is uniformly damaged but
quiescent. Sampled on a 30-beat countdown and carried with an explicit age.
studio.el changed, so the committed build input went stale the moment the merge
landed. CI compiles dist/soul.c, not the .el files. The stamp gate named
studio.el and refused; this is the regeneration it asked for.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
el_cgi_init loaded the declared identity into runtime globals at startup and
printed it. Nothing read it back out — no accessor existed and it writes no
state, so every consumer still read identity from the mutable state store.
studio.el's dharma_registry read state_get("soul_principal"), a key with no
producer anywhere in the tree, and reported an empty principal under a heading
reading 'Principal Covenant v1'.
Adds cgi_name / cgi_dharma_id / cgi_principal / cgi_network / cgi_engram and
points dharma_registry at the compiled constant.
Read-only on purpose. There is deliberately no setter: publishing these into the
state store would have been one line, passed the same test, and recreated exactly
the runtime-mutable copy IDPROTO claims 1-2 forbid.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Installing the fixed compiler exposed a blind spot in this gate. On clean main,
with no source changed, soulc-stamp reported OK while the committed amalgam had
gone stale by a line — because the fingerprint covered .el sources and not the
toolchain that turns them into dist/soul.c. That is exactly the class of silent
divergence the gate was written to close, and it had it.
The stamp now fingerprints the elc binary alongside the sources. Demonstrated: with
the old stamp the gate passed after a compiler swap; with this change the same
condition fails, naming __compiler__.
dist/soul.c regenerated under the installed compiler (1,205,027 bytes) and verified:
builds from its own committed input, the declared principal is present in the
resulting binary, interface 110 routes in / 110 out.
Differential evidence that the new compiler is a strict superset — same sources,
both compilers:
neuron soul 1 differing line, the el_cgi_init emission
engram server.el 0 differing lines
mcp-wrapper 0 differing lines
mcp-proxy 0 differing lines
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
el_cgi_init loaded the declared identity into runtime globals and printed it, and
nothing read it back out. No accessor existed and it writes no state, so every
consumer still read identity from the mutable state store. studio.el's registry
read state_get("soul_principal") — a key with no producer anywhere — and reported
an empty principal under a heading reading 'Principal Covenant v1'.
Adds cgi_name/cgi_dharma_id/cgi_principal/cgi_network/cgi_engram. READ-ONLY on
purpose: there is deliberately no setter. Publishing these into the state store
would have been one line and would have recreated exactly the runtime-mutable copy
IDPROTO claims 1-2 forbid ('not modifiable by any runtime mechanism including
environment variables, configuration files, or API calls').
dharma_registry now reads the compiled constant. cgi_id keeps its state read
deliberately — the runtime instance id is a different fact from the compiled
dharma_id, and conflating them would hide a binary running under an id its own
declaration never claimed.
Measured, same corpus, binary the only variable:
deployed engine -> "principal":""
accessor build -> "principal":"william-christopher-anderson"
interface: 110 routes in, 110 out, nothing removed
Requires the codegen fix in el (fix/cgi-identity-emission); without it the
declaration is never compiled in and the accessors return empty.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Five sites in chat.el splice state_get("soul_identity") into the system prompt.
Nothing has written that key since b163fa6 deleted the producer days after 601e0fe
added it on 2026-05-02. Every chat turn since built its prompt with an empty
identity section, and nothing reported it.
Found by the #132 state-key gate within an hour of that gate being rebased onto
main — a read with no producer treated as a build error rather than a silence.
Restored verbatim rather than repointed. soul_identity is an env-configurable
persona line; soul_identity_context is the graph-derived DNA/values/memory-philosophy
block. Aiming the five reads at the latter would have substituted different content
and called it a repair. Whether the chat prompt should also carry that block is a
separate question, left open rather than smuggled in.
Verified by the gate that found it: dead reads 6 -> 1, with the chat.el baseline
entry now reported STALE. Rung: BUILT and gate-verified; not end-to-end chat-verified.
Closes#137. Refs #132.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Five sites in chat.el read state_get("soul_identity") and splice the result into
the system prompt, beside the voice, security and capability rules:
chat.el:737, 1745, 2620, 3425, 3480
Nothing has written that key since b163fa6. The producer was added 2026-05-02 in
601e0fe and deleted by the awareness refactor days later. Every chat turn since has
built its system prompt with an EMPTY identity section, and nothing reported it.
Found by the #132 state-key gate, which treats a read with no producer as a build
error rather than a silence. That is the entire argument for that gate.
RESTORED VERBATIM, NOT IMPROVED. soul_identity is an env-configurable persona LINE.
It is not soul_identity_context — the graph-derived
[INTELLECTUAL-DNA]/[VALUES]/[MEMORY-PHILOSOPHY] block written at soul.el:184.
Repointing the five reads at that block would have substituted different content and
called it a repair. Whether the chat prompt should ALSO carry the graph-derived block
is a real question and a separate one; it is not smuggled in here.
Verified by the gate that found it: dead reads 6 -> 1, and it now reports the
chat.el baseline entry as STALE — 'entries that no longer match anything; delete
them'. The remaining one is studio.el's soul_principal, untouched by this change.
Rung: BUILT, gate-verified, boots. NOT end-to-end chat-verified — proving the
prompt now carries the line needs a live provider call, which I have not run.
Refs #137, #132
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The runtime-vs-owner divergence check. Its absence let a ~24,000-node loss run for
weeks with every boot reporting green, which is most of why the last two days were
spent rediscovering by hand what this route would have said.
Follows the spec rather than inventing a metric: CGI provisional
05-detailed-description.md Stage 1 calls for an annotated characterization of the
graph's structure, so the route returns findings with score null BY DESIGN. A number
here would be a fabrication dressed as rigour.
Rebased across 27 commits of drift. The rebase merged cleanly at source level and
that was misleading — dist/soul.c held one side's code and not the other, because
git resolved the amalgam as an ordinary file. The stamp gate from 9fd8c11 caught it
on its first real use. Without it this would have landed an engine containing the
audit but none of the 08-09 engine work, or the reverse: neuron#133 again.
Verified before merging, not after:
stamp OK dist/soul.c matches the sources (1,204,442 bytes, 1,259 bodies)
builds from committed input 920,776 bytes
interface 108 -> 110 routes, nothing removed
the route answers stage 1, annotated_characterization, findings present
Closes#142. Refs #91.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The rebase merged cleanly at source level but left dist/soul.c holding one side's
code and not the other — main's regenerated amalgam vs this branch's. The stamp
gate added in 9fd8c11 caught it on its first real use:
FAIL: dist/soul.c is STALE. It does not match the current .el sources.
Sources that changed: neuron-api.el, routes.el
Without that gate this branch would have looked clean and shipped an engine
containing the structural audit but none of the 08-09 engine work, or the reverse.
That is exactly neuron#133, which once hid five merged fixes including a P0.
Regenerated from the rebased sources: 1,204,442 bytes, 1,259 inlined bodies.
Verified after: stamp OK; builds from its own committed input (920,776 bytes);
interface 108 -> 110 routes with nothing removed, adding /api/neuron/audit/structural;
and the route answers — stage 1, assessment_kind 'annotated_characterization',
score null by design, with findings.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`runStructuralAudit` has been an advertised MCP tool with nothing behind it: the
dispatcher GET'd /session/begin and returned that unrelated session digest under
an audit tool's name. Meanwhile the failure the audit would have caught ran
silently for about three weeks — the soul reporting 103,089 nodes while the
engram, which OWNS persistence, held ~79,900, a crash discarding the difference,
and every boot reporting green throughout, because nothing in the system ever
compared the two sides.
WHAT THE PATENT SPECIFIES, AND HOW IT SHAPED THIS
CGI provisional, 05-detailed-description.md, "Stage 1: Structural audit 430".
Two clauses did the design work. First the four things the module evaluates:
the density and typed distribution of causal edges; value/execution-record
consistency; the richness and connectivity of the self-model; and wonder-
manifest authenticity. Second, and decisively: it "produces a coherence
assessment 432 — NOT A BINARY SCORE but an annotated characterization of the
graph's structural properties."
So every finding carries its numbers AND a plain-language note saying what
they mean and how they were obtained. There is no pass/fail and no composite
health figure, and `"score":null` is emitted explicitly so a reader cannot
mistake its absence for an omission.
WHAT IS IN STAGE 1 (four findings)
owner_runtime_divergence — the motivating case. Runtime counts vs the owner's
own GET /api/stats, the delta, and the trend against the previous audit, so
a second call answers "is the gap growing?" rather than restating it.
self_model_connectivity — the three identity pillars plus the self root:
present, content length, one-hop degree. This RETIRES the Claude-side vitals
identity block, which lived outside the system it was checking and went on
reporting green while the memory-philosophy pillar was absent from the live
graph. Asking the running soul is the designed mechanism; a shell probe was
the fourth patch on the same hole.
typed_edge_distribution — exact counts against the claim-10 vocabulary, plus
density, plus a separate count of LOWERCASE near-misses ("causes" vs
"Causes"): "the vocabulary is unused" and "the vocabulary is misspelled by
the write paths" are different defects with different fixes.
orphans_and_dangling_edges — the tool's own long-standing promise.
WHAT IS DEFERRED, AND WHY IT IS DATA RATHER THAN A COMMENT
Value/execution-record consistency and wonder-manifest authenticity ship as a
`deferred` array that MEASURES the populations they would need (Prediction and
WonderQuestion nodes) and reports those counts as the reason. Both are ~0 today
— WonderQuestion because of a known write/read node-type mismatch. Asserting
value coherence or a pull-weight correlation on an empty population would be a
fabricated result, which is worse than a stated gap.
MEASUREMENT HONESTY: EXACT WHERE CHEAP, SAMPLED WHERE NOT, ALWAYS LABELLED
Counts, edge typing and self-model connectivity are exact. Orphan and dangling
rates are sampled, because engram_find_node_index is a linear scan — an
exhaustive dangling check is O(nodes x edges), ~2.2e9 string compares at today's
scale. Samples are UNIFORM across the whole population (str_index_of_all gives
every edge offset in one pass, so any index is O(1); json_array_get would have
been O(n^2)), never head-of-list, and each figure ships with its own sampled /
population / exhaustive fields. ?edge_sample= and ?node_sample= at population
size run either check exhaustively. The real fix is an id index in the runtime.
ONE BUG THIS FOUND IN ITSELF, CAUGHT IN TEST
http_get does not return "" when the owner is unreachable — it returns a JSON
error object. Testing only for "" made a DEAD owner read as reachable with
node_count 0, so the audit reported 100% divergence and named it data loss.
Reachability is now proved by the presence of the node_count field, and the
owner's raw reply is attached. A confident wrong answer is exactly what this
route exists to stop.
Edge findings need relation labels and the runtime has no edge-enumeration
builtin, so they use the same scratch export GET /api/graph/edges already uses
(engram_save to TMPDIR, never the owner's canonical file — #117). That is a
large write on a large graph, so this is a manual route, not a timer; ?edges=0
skips it.
neuron-api.el:900-1273 handler + helpers
routes.el:567,752 GET and POST /api/neuron/audit/structural
mcp-wrapper/src/main.el:113,682 tool description + dispatch off /session/begin
dist/soul.c regenerated (1255 bodies)
Rung: E2E-VERIFIED. Soul built from this branch (gen-soul-amalgam + cc-brain,
921,192 bytes, 16 warnings, 0 errors), booted on throwaway ports 7893/7896/7897
with throwaway HOMEs against a stub owner on 7894. Three scenarios pass: owner
reachable (runtime 62 vs owner 42, delta 20 / 32.2%, trend flat on the second
call; 12/20 edges claim-10 typed, 3 lowercase near-misses; 50/62 orphans, 3/20
dangling — every figure matches the fixture by construction), owner unreachable
(reported as a finding with the raw reply, not a crash), and file mode (owner
"none", divergence undefined). Reached end-to-end through the MCP tool via a
locally built wrapper. verify-soul-contract.sh: GATE PASS, 27/27 routes +
immutability. No process left running; live :7770 and :8742 untouched (GET only).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
will.anderson
Neuron