Reconcile: main = union of all ship-critical soul fixes (beta-gating) #104
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: neuron-technologies/neuron#104
Reference in New Issue
Block a user
Delete Branch "reconcile/soul-union-main"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Makes
mainthe single authoritative source carrying the union of every ship-critical soul fix, so the Mac beta DMG builds from it.What this merges
main(b75d5c8) already had: honest receipts (#100/#101), the immutability arc + #199 by-id gate (#83), Track B threat routing (#76), bounded beginSession/compileCtx (#103), CI hardening (#85/#86), the elc typo hotfix (#77), and neuron-dev-setup (#84).This brings Will's self-review WIP (
456267a, preserved onreconcile/neuron-wip-to-main) on top of it:mem_save/handle_api_consolidatewere callingstr_eqonengram_save's Int return, dereferencing(char*)0x1and crashing on a successful save — exactly what a freshSOUL_CGI_ID=ntn-genesisboot does first. Now checks the Int.set_atbecause the runtime's binary-safe send length capped the response to the file size. Response now sent in full.api_query_paramnowurl_decode()s the extracted value, soq=foo%20bar/q=foo+bartokenize as two words instead of one un-splittable literal (single-word queries were the only ones that worked before).Conflict resolution (toward the correct end state)
neuron-api.elpayload-bound comments → main's #103 wording (identical code; kept a singlelet stats).mcp-wrapper/src/main.eltool_forget→ kept main's #101 read-back honest-receipt verification (gate-required), plus WIP's improved tool description.dist/*.care generated — taken from main during the merge, thendist/soul.cregenerated fresh (1.15MB amalgamation, hide-.elh+elc --target=c) so the translation unit CI compiles carries every fix.Contract-gate hardening (
scripts/verify-soul-contract.sh)Two false-negative fixes — both spuriously failed a correct soul; neither relaxes what fails a defective one:
/api/neuron/graph?id=<id>&depth=1(a compact neighborhood) instead of greppingengram_scan_nodes_json(9999,0), a multi-MB, salience-ordered, 9999-capped whole-graph dump in which the salience-0.01 tombstone marker sorted past the cap and vanished.SOUL_ISE_URLto the dead axon port. UnsettingENGRAM_URLalone was not enough: the periodic engram sync defaults its source to the live engram (http://localhost:8742), so the "isolated" gate was pulling the operator's real 12k-node brain (56 → 12k nodes in seconds), breaking Section B determinism and reading live state.Verification (throwaway port/HOME — live
:7770/:8742/~/.neuronnever touched)set_atand988.%20and+two-word queries return ranked hits; an all-gibberish control returns 0; single-word works.self_neighbors:[]shape.ok:true.ntn-genesiscomes up clean and healthy, survivesmem_save/consolidate through fast ticks with no SIGSEGV.Supersedes
Closes out
hotfix/elc-source-typos(now an ancestor of this branch — fully subsumed) and supersedes PR #97, which reconciled only the hotfix line and shipped its compiledsoul.cwholesale rather than a fresh regen off the union.A customer DMG install ships the full graph but presents a named, bounded assistant that must never claim the imprint's human past. The neuron-ui retrieval fence keeps the imprint's biography out of the ENGRAM CONTEXT; this is the second half - it stops confabulation ("tell me about your childhood") from inventing a human life or naming Will, even if biography leaks into context. bounded_persona_floor() gates on SOUL_PERSONA_NAME: the customer DMG sets it, owner (Will's) builds leave it unset so the real self is completely unchanged. Applied at every generation path - chat, agentic (tools), vision, plan, soul, dharma - so no path can leak. Verified against claude-sonnet-4-5: with the floor on and Will's biography deliberately leaked into the identity context, all probes (childhood / creator / family) return the bounded-entity answer and explicitly refuse to claim the leaked life; with the floor off the same context is fully confabulated as its own. NOTE: dist/soul.c must be regenerated on a build host - local link is blocked by a pre-existing el_runtime mismatch (engram_prune_telemetry), unrelated to this change.Saving the 988 crisis-line contact returned truncated, unparseable JSON — cut mid-"set_at" at the file's byte length (e.g. 178 of a 218-byte response). The contact written to disk was complete; only the HTTP response was clipped, so a real customer's crisis-contact save came back corrupt. Root cause is in the el runtime's response writer, not a handler buffer: fs_read stores the file's byte count in a thread-local (_tl_fs_read_len) for binary-safe file serving, and the response writer uses that length when non-zero instead of strlen(body) (el_runtime.c:1409). Both safety-contact handlers call fs_read (the POST read-back verify; the GET file read) and then return a LONGER wrapped JSON string, so the response is capped to the file size. Soul-source fix (no runtime change needed): - POST: verify persistence via fs_write's return (1 = all bytes written) instead of an fs_read read-back — removes the fs_read, so nothing caps the response. - GET: fs_read is required, so reset the thread-local after it with a no-op fs_read("") (fs_read zeroes the length before it opens a path) so the wrapped response is sent in full. Verified: POST (crisis-line + custom) and GET now return complete, valid JSON (parses cleanly, full contact incl. set_at). Regenerated dist/soul.c + dist/safety.c (3GB RSS watchdog, release el_runtime v1.0.0-20260501). Full suite still green: verify-soul-contract GATE PASS (PRESENCE + IMMUTABILITY), genesis boot survives (/health 200, no segfault), bounded- persona floor still compiled in. NOTE: the underlying runtime leak (any handler that fs_reads then returns a longer string) is worth a proper fix in el_runtime.c (use the max of strlen and _tl_fs_read_len) so this class can't recur.proactive_curiosity strengthened its top result unconditionally every scan — a positive-feedback fixed point that pinned auto_term on the same node's first word for hours ('Fast-slow' era). Strengthen now fires only when the top node changed since the last scan, and a 4-deep finst-style tabu ring (ACT-R declarative finsts) hard-excludes recently used auto terms (~2 min at the 30s cadence). Quoted-title guard stops '"The' leaking through the >3-char stopword check and seeding lexical floods. Heartbeat now pumps /api/embed-backfill?n=32 on the authoritative store (its lazy backfill had no production trigger; coverage stalled at 93/12175) and emits wm_saturated, wm_top0_streak, embed_backfilled, embed_count. Curiosity ISE emits auto_term_streak. The stuck-WM failure mode is now a one-glance signal instead of manual ISE cross-referencing.The session-init endpoints concatenated unbounded engram activate/scan results as FULL node objects (content up to ~90KB per node), producing a ~900KB response. After the MCP wrapper re-escapes that into a stringified text block the client dropped the socket ('connection closed unexpectedly') on every beginSession call. Cap each list (8-10 activated, 10-20 recent) and project every node to a light identity plus a bounded, UTF-8-safe content snippet. Response drops from ~900KB to ~12KB; full content stays available on demand via recall/fetch/inspectGraph.456267a) into main 8ba35a0d56