Land immutability arc + CI soul-contract gate on main #83
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: neuron-technologies/neuron#83
Reference in New Issue
Block a user
Delete Branch "feat/immutable-engram-deletes"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
What
Land the complete fixed soul on
main: all of the Julyhotfix/elc-source-typoswork (soul.c regen, route/safety fixes) plus the full immutability arc, and gate the Linux soul in CI so a stale/destructive soul can never publish again.main(42bbadc, June 22) is a clean ancestor of this branch — conflict-free.Included
1011d8e): correcteddist/soul.c, route/safety fixes, Track B.d337fcb,f3034d2,40d8001):updatesupersedes-with-edge;delete/forgettombstone (keep node + edges, hide from default reads, recoverable via?include_deleted=1) — acrossmemory/delete,node/delete,node/update, the generic/memory/forget, the cultivateforgetop, the autonomous awareness forget action, and the MCPforgettool. No forget path callsengram_forgetanymore. Both ship paths regenerated:dist/soul.c(single-TU) + per-moduledist/{memory,awareness,neuron-api}.c.290a637):ci.yamlnow runsscripts/verify-soul-contract.shagainstdist/neuronas a hard block between the build and Publish — PRESENCE (every app route answered) + IMMUTABILITY (no hard-delete). Non-zero fails the build, soneuron-soulcan't publish tofoundation-prodor blue-green deploy to GKE with a broken soul.Verified
macOS build of this exact soul.c passes the gate: PRESENCE all 27, IMMUTABILITY 5/5 KEPT (memory-update, memory-delete, node-update, node-delete, memory-forget). The Linux gate will run in this PR's CI.
Merging triggers the Linux soul rebuild + GKE blue-green redeploy of neuron-mcp (expected/approved). Touches only the neuron-mcp path — not the marketing/download site (separate Cloud Run).
Phase 1 tombstoned memory/delete + node/delete, but the generic forget path was still destructive. This routes every forget through the same tombstone semantics so nothing in the daemon can hard-delete an engram node anymore. Canonical helper: mem_tombstone (memory.el, imported first so every module can call it) — keep the node + its edges, record a Tombstone marker, never engram_forget. neuron-api's tombstone_node now delegates to it (single source of truth). Per-path before -> after: - memory.el `mem_forget` hard delete (engram_forget) -> tombstone. This alone fixes both callers: the /api/neuron/memory/forget route (handle_api_forget) and the cultivate op=="forget". - awareness.el autonomous `forget` action engram_forget -> mem_tombstone. The soul can no longer autonomously hard-delete a memory. - mcp-wrapper tool_forget was a FAKE no-op that returned {"ok","deleted"} without deleting OR tombstoning -> now routes to the soul's tombstoning /api/neuron/memory/delete; tool description fixed to say it supersedes/tombstones (recoverable), not "Remove a node". Left intentionally as hard deletes (internal GC / lifecycle, not user memory, all call engram_forget directly): session-summary replace (chat.el), mem_consolidate dedup (memory.el), session-start telemetry pruning (soul.el), session lifecycle (sessions.el). Regenerated both ship paths under a 3GB physical-RSS watchdog (peak ~32MB): dist/soul.c (single-TU amalgamation, macOS/Linux) and the per-module dist/{memory,awareness,neuron-api}.c (Windows/Linux build). Verified: no forget handler calls engram_forget; a forget leaves the node present + tombstone marker. Gate (neuron-ui verify-soul-contract.sh, new memory-forget row): PRESENCE + IMMUTABILITY PASS.