feat(runtime): read-only accessors for the compiled identity, and use one #148

2026-08-09T18:49:59Z

tim.lingo commented

2026-08-09 18:49:59 +00:00

el_cgi_init loads the declared identity into runtime globals at startup and prints it. Nothing read it back out. No accessor existed, and it writes no state — so every consumer still read identity from the mutable state store.

studio.el's dharma_registry read state_get("soul_principal") — a key with no producer anywhere in the tree — and reported an empty principal under a heading reading "Principal Covenant v1". The #132 state-key gate flagged it as a dead read within an hour of being rebased.

What this adds

cgi_name / cgi_dharma_id / cgi_principal / cgi_network / cgi_engram, and dharma_registry now reads the compiled constant.

Read-only on purpose. There is deliberately no setter. Publishing these into the state store would have been one line, would have passed the same test, and would have recreated exactly the runtime-mutable copy IDPROTO claims 1-2 forbid — "not modifiable by any runtime mechanism including environment variables, configuration files, or API calls." A mutable copy holding the right value satisfies a demo, not the claim.

cgi_id keeps its state read deliberately: the runtime instance id is a different fact from the compiled dharma_id, and conflating them would hide a binary running under an id its own declaration never claimed. The lab output shows that gap in the open — cgi=ntn-lab-7846 beside principal=william-christopher-anderson.

Measured — same corpus, binary the only variable

	result
deployed engine	`"principal":""`
this branch	`"principal":"william-christopher-anderson"`
interface gate	110 routes in, 110 out, nothing removed

Dependency

Requires neuron-technologies/el PR (branch fix/cgi-identity-emission-clean). Without that codegen fix the declaration is never compiled in and these accessors correctly return empty. Landing this alone is harmless but inert.

No compiler change was needed for the accessors themselves: builtin_arity returns a -1 sentinel for unknown names meaning "no check", so the call is emitted as-is and the linker resolves it.

Rung: E2E-VERIFIED in an isolated lab — the value crosses from a source declaration to an HTTP response. Not deployed.

`el_cgi_init` loads the declared identity into runtime globals at startup and prints it. **Nothing read it back out.** No accessor existed, and it writes no state — so every consumer still read identity from the mutable state store. `studio.el`'s `dharma_registry` read `state_get("soul_principal")` — a key with **no producer anywhere in the tree** — and reported an empty principal under a heading reading `"Principal Covenant v1"`. The #132 state-key gate flagged it as a dead read within an hour of being rebased. ## What this adds `cgi_name` / `cgi_dharma_id` / `cgi_principal` / `cgi_network` / `cgi_engram`, and `dharma_registry` now reads the compiled constant. **Read-only on purpose. There is deliberately no setter.** Publishing these into the state store would have been one line, would have passed the same test, and would have recreated exactly the runtime-mutable copy IDPROTO claims 1-2 forbid — *"not modifiable by any runtime mechanism including environment variables, configuration files, or API calls."* A mutable copy holding the right value satisfies a demo, not the claim. `cgi_id` keeps its state read **deliberately**: the runtime instance id is a different fact from the compiled `dharma_id`, and conflating them would hide a binary running under an id its own declaration never claimed. The lab output shows that gap in the open — `cgi=ntn-lab-7846` beside `principal=william-christopher-anderson`. ## Measured — same corpus, binary the only variable | | result | |---|---| | deployed engine | `"principal":""` | | this branch | `"principal":"william-christopher-anderson"` | | interface gate | 110 routes in, 110 out, nothing removed | ## Dependency Requires `neuron-technologies/el` PR (branch `fix/cgi-identity-emission-clean`). Without that codegen fix the declaration is never compiled in and these accessors correctly return empty. **Landing this alone is harmless but inert.** No compiler change was needed for the accessors themselves: `builtin_arity` returns a `-1` sentinel for unknown names meaning "no check", so the call is emitted as-is and the linker resolves it. Rung: E2E-VERIFIED in an isolated lab — the value crosses from a source declaration to an HTTP response. Not deployed.

tim.lingo added 1 commit 2026-08-09 18:50:01 +00:00

feat(runtime): read-only accessors for the compiled identity, and use one

Neuron Soul CI / build (pull_request) Failing after 13m17s

Details

Neuron Soul CI / deploy (pull_request) Failing after 14m38s

Details

b9e609ee39

el_cgi_init loaded the declared identity into runtime globals and printed it, and
nothing read it back out. No accessor existed and it writes no state, so every
consumer still read identity from the mutable state store. studio.el's registry
read state_get("soul_principal") — a key with no producer anywhere — and reported
an empty principal under a heading reading 'Principal Covenant v1'.

Adds cgi_name/cgi_dharma_id/cgi_principal/cgi_network/cgi_engram. READ-ONLY on
purpose: there is deliberately no setter. Publishing these into the state store
would have been one line and would have recreated exactly the runtime-mutable copy
IDPROTO claims 1-2 forbid ('not modifiable by any runtime mechanism including
environment variables, configuration files, or API calls').

dharma_registry now reads the compiled constant. cgi_id keeps its state read
deliberately — the runtime instance id is a different fact from the compiled
dharma_id, and conflating them would hide a binary running under an id its own
declaration never claimed.

Measured, same corpus, binary the only variable:
  deployed engine  -> "principal":""
  accessor build   -> "principal":"william-christopher-anderson"
  interface: 110 routes in, 110 out, nothing removed

Requires the codegen fix in el (fix/cgi-identity-emission); without it the
declaration is never compiled in and the accessors return empty.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tim.lingo referenced this issue from a commit

2026-08-09 19:17:10 +00:00

merge: read-only accessors for the compiled identity, and use one (#148)

tim.lingo referenced this issue from a commit

2026-08-09 19:17:12 +00:00

chore: regenerate dist/soul.c after merging the identity accessors (#148)

tim.lingo closed this pull request

2026-08-09 19:17:57 +00:00