feat(engine): structural audit stage one — the runtime-vs-owner divergence check #142

2026-08-08T00:29:50Z

tim.lingo commented

2026-08-08 00:29:50 +00:00

Stage one of the structural audit route. The graph-integrity check (runStructuralAudit) is currently a stub that returns nothing real — inventory row H-14.

Includes the runtime-versus-owner divergence check, whose absence let a ~24,000-node loss run for weeks with every boot reporting green (row G-17: read-back was confirming working memory, never the store that survives a restart).

Filed so it is reviewable rather than sitting on an unpushed branch. Not merged, not deployed.

🤖 Generated with Claude Code

Stage one of the structural audit route. The graph-integrity check (`runStructuralAudit`) is currently a stub that returns nothing real — inventory row H-14. Includes the runtime-versus-owner divergence check, whose absence let a ~24,000-node loss run for weeks with every boot reporting green (row G-17: read-back was confirming working memory, never the store that survives a restart). Filed so it is reviewable rather than sitting on an unpushed branch. Not merged, not deployed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tim.lingo added 1 commit 2026-08-08 00:29:52 +00:00

feat(soul): Stage 1 structural audit as a real route — an annotated characterization, not a score (#91 )

Neuron Soul CI / build (pull_request) Has been cancelled

Details

Neuron Soul CI / deploy (pull_request) Has been cancelled

Details

bef36a5e3a

`runStructuralAudit` has been an advertised MCP tool with nothing behind it: the
dispatcher GET'd /session/begin and returned that unrelated session digest under
an audit tool's name. Meanwhile the failure the audit would have caught ran
silently for about three weeks — the soul reporting 103,089 nodes while the
engram, which OWNS persistence, held ~79,900, a crash discarding the difference,
and every boot reporting green throughout, because nothing in the system ever
compared the two sides.

WHAT THE PATENT SPECIFIES, AND HOW IT SHAPED THIS
  CGI provisional, 05-detailed-description.md, "Stage 1: Structural audit 430".
  Two clauses did the design work. First the four things the module evaluates:
  the density and typed distribution of causal edges; value/execution-record
  consistency; the richness and connectivity of the self-model; and wonder-
  manifest authenticity. Second, and decisively: it "produces a coherence
  assessment 432 — NOT A BINARY SCORE but an annotated characterization of the
  graph's structural properties."

  So every finding carries its numbers AND a plain-language note saying what
  they mean and how they were obtained. There is no pass/fail and no composite
  health figure, and `"score":null` is emitted explicitly so a reader cannot
  mistake its absence for an omission.

WHAT IS IN STAGE 1 (four findings)
  owner_runtime_divergence   — the motivating case. Runtime counts vs the owner's
      own GET /api/stats, the delta, and the trend against the previous audit, so
      a second call answers "is the gap growing?" rather than restating it.
  self_model_connectivity    — the three identity pillars plus the self root:
      present, content length, one-hop degree. This RETIRES the Claude-side vitals
      identity block, which lived outside the system it was checking and went on
      reporting green while the memory-philosophy pillar was absent from the live
      graph. Asking the running soul is the designed mechanism; a shell probe was
      the fourth patch on the same hole.
  typed_edge_distribution    — exact counts against the claim-10 vocabulary, plus
      density, plus a separate count of LOWERCASE near-misses ("causes" vs
      "Causes"): "the vocabulary is unused" and "the vocabulary is misspelled by
      the write paths" are different defects with different fixes.
  orphans_and_dangling_edges — the tool's own long-standing promise.

WHAT IS DEFERRED, AND WHY IT IS DATA RATHER THAN A COMMENT
  Value/execution-record consistency and wonder-manifest authenticity ship as a
  `deferred` array that MEASURES the populations they would need (Prediction and
  WonderQuestion nodes) and reports those counts as the reason. Both are ~0 today
  — WonderQuestion because of a known write/read node-type mismatch. Asserting
  value coherence or a pull-weight correlation on an empty population would be a
  fabricated result, which is worse than a stated gap.

MEASUREMENT HONESTY: EXACT WHERE CHEAP, SAMPLED WHERE NOT, ALWAYS LABELLED
  Counts, edge typing and self-model connectivity are exact. Orphan and dangling
  rates are sampled, because engram_find_node_index is a linear scan — an
  exhaustive dangling check is O(nodes x edges), ~2.2e9 string compares at today's
  scale. Samples are UNIFORM across the whole population (str_index_of_all gives
  every edge offset in one pass, so any index is O(1); json_array_get would have
  been O(n^2)), never head-of-list, and each figure ships with its own sampled /
  population / exhaustive fields. ?edge_sample= and ?node_sample= at population
  size run either check exhaustively. The real fix is an id index in the runtime.

ONE BUG THIS FOUND IN ITSELF, CAUGHT IN TEST
  http_get does not return "" when the owner is unreachable — it returns a JSON
  error object. Testing only for "" made a DEAD owner read as reachable with
  node_count 0, so the audit reported 100% divergence and named it data loss.
  Reachability is now proved by the presence of the node_count field, and the
  owner's raw reply is attached. A confident wrong answer is exactly what this
  route exists to stop.

  Edge findings need relation labels and the runtime has no edge-enumeration
  builtin, so they use the same scratch export GET /api/graph/edges already uses
  (engram_save to TMPDIR, never the owner's canonical file — #117). That is a
  large write on a large graph, so this is a manual route, not a timer; ?edges=0
  skips it.

  neuron-api.el:900-1273  handler + helpers
  routes.el:567,752       GET and POST /api/neuron/audit/structural
  mcp-wrapper/src/main.el:113,682  tool description + dispatch off /session/begin
  dist/soul.c             regenerated (1255 bodies)

Rung: E2E-VERIFIED. Soul built from this branch (gen-soul-amalgam + cc-brain,
921,192 bytes, 16 warnings, 0 errors), booted on throwaway ports 7893/7896/7897
with throwaway HOMEs against a stub owner on 7894. Three scenarios pass: owner
reachable (runtime 62 vs owner 42, delta 20 / 32.2%, trend flat on the second
call; 12/20 edges claim-10 typed, 3 lowercase near-misses; 50/62 orphans, 3/20
dangling — every figure matches the fixture by construction), owner unreachable
(reported as a finding with the raw reply, not a crash), and file mode (owner
"none", divergence undefined). Reached end-to-end through the MCP tool via a
locally built wrapper. verify-soul-contract.sh: GATE PASS, 27/27 routes +
immutability. No process left running; live :7770 and :8742 untouched (GET only).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tim.lingo commented

2026-08-09 17:01:43 +00:00

Rebased onto main (post-bf52197) as rebase/structural-audit-onto-main — 27 commits of drift resolved.

The rebase merged cleanly at source level, and that was misleading: dist/soul.c ended up holding one side's code and not the other. The stamp gate added in 9fd8c11 caught it on its first real use:

FAIL: dist/soul.c is STALE. It does not match the current .el sources.
Sources that changed: neuron-api.el, routes.el

Without it this branch would have looked clean and shipped an engine containing the structural audit but none of the 2026-08-09 engine work, or the reverse — which is #133 exactly, the defect that once hid five merged fixes including a P0.

Regenerated and verified:

stamp OK — dist/soul.c matches the sources (1,204,442 bytes, 1,259 inlined bodies)
builds from its own committed input (920,776 bytes)
interface 108 → 110 routes, nothing removed, adding /api/neuron/audit/structural
the route answers: stage 1, assessment_kind: annotated_characterization, score: null by design per the spec, with findings

Rung: E2E-VERIFIED in an isolated lab. Not deployed.

Worth landing on merit — this is the runtime-vs-owner divergence check whose absence let a ~24,000-node loss run for weeks with every boot reporting green.

Rebased onto `main` (post-`bf52197`) as `rebase/structural-audit-onto-main` — 27 commits of drift resolved. The rebase merged cleanly at source level, and that was misleading: `dist/soul.c` ended up holding one side's code and not the other. The stamp gate added in `9fd8c11` caught it on its first real use: ``` FAIL: dist/soul.c is STALE. It does not match the current .el sources. Sources that changed: neuron-api.el, routes.el ``` Without it this branch would have looked clean and shipped an engine containing the structural audit but none of the 2026-08-09 engine work, or the reverse — which is #133 exactly, the defect that once hid five merged fixes including a P0. Regenerated and verified: - stamp OK — `dist/soul.c` matches the sources (1,204,442 bytes, 1,259 inlined bodies) - builds from its own committed input (920,776 bytes) - interface **108 → 110 routes, nothing removed**, adding `/api/neuron/audit/structural` - **the route answers**: stage 1, `assessment_kind: annotated_characterization`, `score: null` by design per the spec, with findings Rung: E2E-VERIFIED in an isolated lab. Not deployed. Worth landing on merit — this is the runtime-vs-owner divergence check whose absence let a ~24,000-node loss run for weeks with every boot reporting green.

tim.lingo referenced this issue from a commit

2026-08-09 17:08:25 +00:00

merge: Stage 1 structural audit as a real route (#142/#91)

tim.lingo closed this pull request

2026-08-09 17:08:30 +00:00

tim.lingo referenced this pull request

2026-08-09 17:13:28 +00:00

Tools + agentic loop on the OpenAI wire — plus two pre-existing bugs that silently break chat #122