neuron-technologies/neuron
2
0
Fork 0
Code Issues 22 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Reconcile ship-soul (hotfix) into main + pin CI runtime #97

Open
will.anderson wants to merge 12 commits from reconcile/hotfix-to-main-launch into main
pull from: reconcile/hotfix-to-main-launch
merge into: :main
Conversation 0 Commits 12 Files Changed 16
+13233 -681
will.anderson commented 2026-07-21 20:53:09 +00:00
Owner
Copy Link
Copy Source

Makes main the single authoritative launch branch.

Reconcile (hotfix/elc-source-typos -> main)

Per-file resolution favoring the complete/fixed source:

  • dist/ (soul artifacts): from hotfix — full ship-soul: persona-floor (#93), immutability-on-launch (#94), genesis SIGSEGV fix (#95), safety-contact truncation fix (#96) + awareness self-reviews.
  • ci.yaml + scripts/verify-soul-contract.sh: from main — soul-contract CI gate + -rdynamic handler link, preserved.

Every soul-composing .el source is identical between the merged tree and hotfix (main's immutability was superseded by #94), so hotfix's dist/soul.c is the faithful artifact.

CI pin (2nd commit)

Vendored release runtime v1.0.0-20260501 and pinned the soul build to it. Latest AR runtime no longer defines engram_prune_telemetry (called by the ship-soul), so an unpinned build fails to link. The verify-soul-contract HARD-BLOCK gate already runs before Publish.

Verified locally (built against the vendored runtime)

  • verify-soul-contract: GATE PASS (PRESENCE 27/27 + IMMUTABILITY, no hard-delete)
  • genesis boot: /health 200, no segfault
  • safety-contact: full 218-byte untruncated JSON with set_at
Makes main the single authoritative launch branch. ## Reconcile (hotfix/elc-source-typos -> main) Per-file resolution favoring the complete/fixed source: - **dist/ (soul artifacts): from hotfix** — full ship-soul: persona-floor (#93), immutability-on-launch (#94), genesis SIGSEGV fix (#95), safety-contact truncation fix (#96) + awareness self-reviews. - **ci.yaml + scripts/verify-soul-contract.sh: from main** — soul-contract CI gate + -rdynamic handler link, preserved. Every soul-composing .el source is identical between the merged tree and hotfix (main's immutability was superseded by #94), so hotfix's dist/soul.c is the faithful artifact. ## CI pin (2nd commit) Vendored release runtime v1.0.0-20260501 and pinned the soul build to it. Latest AR runtime no longer defines engram_prune_telemetry (called by the ship-soul), so an unpinned build fails to link. The verify-soul-contract HARD-BLOCK gate already runs before Publish. ## Verified locally (built against the vendored runtime) - verify-soul-contract: GATE PASS (PRESENCE 27/27 + IMMUTABILITY, no hard-delete) - genesis boot: /health 200, no segfault - safety-contact: full 218-byte untruncated JSON with set_at
will.anderson added 12 commits 2026-07-21 20:53:14 +00:00
self-review 2026-07-19: close silent sync-starvation hole + heartbeat deltas 50cf67bd66 
- engram refresh URL now resolves env -> state -> localhost:8742, same
  hardening ise_post got after the boot-4 blackout. Previously a corrupted/
  empty soul_engram_url state key silently disabled sync forever while
  heartbeats kept flowing — WM starves of Knowledge nodes with no outward
  sign.
- heartbeat ISE: node_delta, edge_delta (growth vs stall vs flood is now
  one field, not cross-ISE forensics), sync_age_ms from a new
  soul.last_sync_ok_ts stamp (-1 = never; >> SOUL_REFRESH_MS = refresh
  path broken). Verified live: pulse 1 sync_age_ms=-1, sync fired +1.6s,
  age counts up between syncs.
self-review 2026-07-21: break perceive→respond→store feedback loop in awareness c63e3d1a68 
The soul daemon leaked ~104 orphan in-memory nodes/min (17.6GB RSS,
OOM-killed) because the perceive gate substring-matched 'soul-inbox'
against the loop's own verbatim-copy output, the trigger node was
strengthened but never consumed, and record() persisted a Memory node
per cycle. Fixes: perceive gates and activates only on the dedicated
soul-inbox-pending tag; one_cycle requires the tag on the node's tags
field before attending (makes consumption safe); processed triggers
are consumed via engram_forget; loop outcomes route through ISE
telemetry (48h prune) instead of permanent Memory nodes.

Verified post-restart: node_delta 104→~0, curiosity scans resumed,
WM average unfrozen (0.120833→0.0676), RSS 17.6GB→184MB.
Add non-overridable bounded-persona floor to customer chat c2a45df286 
A customer DMG install ships the full graph but presents a named, bounded
assistant that must never claim the imprint's human past. The neuron-ui
retrieval fence keeps the imprint's biography out of the ENGRAM CONTEXT; this
is the second half - it stops confabulation ("tell me about your childhood")
from inventing a human life or naming Will, even if biography leaks into context.

bounded_persona_floor() gates on SOUL_PERSONA_NAME: the customer DMG sets it,
owner (Will's) builds leave it unset so the real self is completely unchanged.
Applied at every generation path - chat, agentic (tools), vision, plan, soul,
dharma - so no path can leak.

Verified against claude-sonnet-4-5: with the floor on and Will's biography
deliberately leaked into the identity context, all probes (childhood / creator /
family) return the bounded-entity answer and explicitly refuse to claim the
leaked life; with the floor off the same context is fully confabulated as its own.

NOTE: dist/soul.c must be regenerated on a build host - local link is blocked by
a pre-existing el_runtime mismatch (engram_prune_telemetry), unrelated to this change.
Merge pull request 'Bounded-persona floor for customer chat (identity wall, part 2)' (#93) from feat/bounded-persona-floor into hotfix/elc-source-typos 1442ce21a6
Make engram deletes/updates/forgets immutable on the launch branch 6527988eb9 
The ship-soul builds from this branch, which has the bounded-persona floor
(#93) but never received the tombstone/supersede immutability fix (that
went to main; hotfix diverged before it). So the launch soul failed
verify-soul-contract IMMUTABILITY on the delete/update/forget routes —
they hard-removed engram nodes via engram_forget/mem_forget.

Apply the same fix, mirroring the knowledge routes' supersede pattern:
- node/update -> create new node + "supersedes" edge to the original, KEEP
  the original (no engram_forget).
- node/delete, memory/delete, memory/forget, cultivate forget, and the
  autonomous awareness forget -> TOMBSTONE via the canonical mem_tombstone
  (memory.el): keep the node + its edges, record a Tombstone marker, hide
  from default bounded list reads (?include_deleted recovers). Never
  engram_forget. The MCP forget tool now routes to the tombstoning delete
  instead of faking a delete.
Internal GC that genuinely removes transient nodes (awareness inbox-trigger
consume, consolidation dedup, session-summary replace, telemetry pruning)
still calls engram_forget directly and is unchanged.

Regenerated dist/soul.c (single-TU) + per-module dist/{memory,awareness,
neuron-api}.c from THIS branch's sources under a 3GB physical-RSS watchdog
(peak ~32MB), built against the release el_runtime (v1.0.0-20260501). The
bounded-persona floor is preserved — verified in the emitted C and the
linked binary (BOUNDED PERSONA / SOUL_PERSONA_NAME strings present).

verify-soul-contract.sh: GATE PASS — PRESENCE all 27 routes, IMMUTABILITY
5/5 KEPT (memory-update, memory-delete, node-update, node-delete,
memory-forget).
Merge pull request 'Immutability fix (tombstone/supersede) on the launch branch' (#94) from fix/immutable-on-hotfix into hotfix/elc-source-typos 9a491a8e6d
Fix issue #150: fresh-install genesis boot SIGSEGV in mem_save 091cc1fc0e 
A fresh-install (SOUL_CGI_ID=ntn-genesis) boot crashed with
"Segmentation fault: 11" right after the http server came up — a real
customer's very first boot. Backtrace:

  strcmp(0x1) <- str_eq (el_runtime.c:219) <- mem_save <- awareness_run

Root cause: the el runtime's engram_save returns an Int (1 = ok, 0 =
failure), but mem_save did `str_eq(engram_save(path), "")`, treating the
return as a String. str_eq runs EL_CSTR on it, which is a raw cast:
EL_CSTR(1) = (char*)0x1. On a SUCCESSFUL save (return 1) strcmp then
dereferences 0x1 and segfaults. Genesis is the first path that both seeds
the brain AND saves it successfully on the very first awareness pass, so it
crashes there; non-genesis boots (contract gate, refusal test) don't hit a
successful early mem_save, which is why they passed. handle_api_consolidate
had the identical latent bug.

Fix: read engram_save's Int result and compare `== 0` instead of str_eq'ing
it — in mem_save (memory.el) and handle_api_consolidate (neuron-api.el).

Regression: pre-existing, NOT introduced by the immutability/floor rebuild.
The pre-immutability build (1442ce2) genesis-crashes identically in the same
unchanged mem_save; #159 never actually fixed #150 for a release-runtime
build.

Regenerated dist/soul.c + per-module dist/{memory,neuron-api}.c (3GB RSS
watchdog, built against release el_runtime v1.0.0-20260501). Verified:
genesis boot survives (/health 200, no segfault), verify-soul-contract.sh
GATE PASS (PRESENCE + IMMUTABILITY), and the bounded-persona floor is still
compiled in (BOUNDED PERSONA / SOUL_PERSONA_NAME strings present).
Merge pull request 'Fix #150: fresh-install genesis boot SIGSEGV in mem_save' (#95) from fix/genesis-boot-crash into hotfix/elc-source-typos 9387c57c3b
Fix truncated POST/GET /api/safety-contact response a45a3ca379 
Saving the 988 crisis-line contact returned truncated, unparseable JSON —
cut mid-"set_at" at the file's byte length (e.g. 178 of a 218-byte
response). The contact written to disk was complete; only the HTTP response
was clipped, so a real customer's crisis-contact save came back corrupt.

Root cause is in the el runtime's response writer, not a handler buffer:
fs_read stores the file's byte count in a thread-local (_tl_fs_read_len)
for binary-safe file serving, and the response writer uses that length when
non-zero instead of strlen(body) (el_runtime.c:1409). Both safety-contact
handlers call fs_read (the POST read-back verify; the GET file read) and
then return a LONGER wrapped JSON string, so the response is capped to the
file size.

Soul-source fix (no runtime change needed):
- POST: verify persistence via fs_write's return (1 = all bytes written)
  instead of an fs_read read-back — removes the fs_read, so nothing caps the
  response.
- GET: fs_read is required, so reset the thread-local after it with a no-op
  fs_read("") (fs_read zeroes the length before it opens a path) so the
  wrapped response is sent in full.

Verified: POST (crisis-line + custom) and GET now return complete, valid
JSON (parses cleanly, full contact incl. set_at). Regenerated dist/soul.c +
dist/safety.c (3GB RSS watchdog, release el_runtime v1.0.0-20260501).
Full suite still green: verify-soul-contract GATE PASS (PRESENCE +
IMMUTABILITY), genesis boot survives (/health 200, no segfault), bounded-
persona floor still compiled in.

NOTE: the underlying runtime leak (any handler that fs_reads then returns a
longer string) is worth a proper fix in el_runtime.c (use the max of
strlen and _tl_fs_read_len) so this class can't recur.
Merge pull request 'Fix truncated /api/safety-contact response (988 crisis-line)' (#96) from fix/safety-contact-truncation into hotfix/elc-source-typos b784750f69
Reconcile hotfix/elc-source-typos into main: complete ship-soul + CI gate 13c35bacd7 
Merge the launch branch's complete ship-soul into main so main is the single
authoritative branch. Resolution favors the complete/fixed source per file:

- dist/ (all generated soul artifacts): from hotfix — the full ship-soul:
  bounded-persona floor (#93), immutability on launch (#94), genesis-boot
  SIGSEGV fix (#95), safety-contact truncation fix (#96), plus the awareness
  self-reviews (sync-starvation + heartbeat deltas).
- .gitea/workflows/ci.yaml + scripts/verify-soul-contract.sh: from main —
  the soul-contract CI gate and the -rdynamic handler link. Both preserved.

Every soul-composing .el source is identical between the merged tree and
hotfix (main's immutability lineage was superseded by #94), so hotfix's
dist/soul.c is the faithful compiled artifact of the merged sources.

Verified on the merged soul (built against release el_runtime v1.0.0-20260501):
- verify-soul-contract: GATE PASS (PRESENCE 27/27 + IMMUTABILITY, no hard-delete)
- genesis boot survives: SOUL_CGI_ID=ntn-genesis -> /health 200, no segfault
- safety-contact: full 218-byte untruncated response, valid JSON with set_at
ci: pin soul build to vendored release runtime v1.0.0-20260501
Neuron Soul CI / build (pull_request) Failing after 13m56s
Details
Neuron Soul CI / deploy (pull_request) Has been skipped
Details
a23757d545 
The soul build downloaded el-runtime-c 'latest' from Artifact Registry. The
merged ship-soul calls engram_prune_telemetry, which the latest published
runtime no longer defines, so an unpinned build fails to link — the failure
mode that let a broken/handlerless soul reach prod.

Vendor the release runtime v1.0.0-20260501 (el_runtime.c/.h) into the repo and
compile the soul against it. This is the exact runtime the merged soul was
verified against (verify-soul-contract GATE PASS, genesis boot survives, full
safety-contact response), making the build reproducible and independent of a
moving AR 'latest'.

The verify-soul-contract.sh HARD-BLOCK gate already runs before Publish (from
the CI-hardening arc on main), so a destructive or stale soul can never
publish/deploy again.
Some required checks failed
Neuron Soul CI / build (pull_request) Failing after 13m56s
Details
Neuron Soul CI / deploy (pull_request) Has been skipped
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin reconcile/hotfix-to-main-launch:reconcile/hotfix-to-main-launch
git checkout reconcile/hotfix-to-main-launch
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
tim.lingo (Tim Lingo) will.anderson (Will Anderson)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: neuron-technologies/neuron#97
Delete Branch "reconcile/hotfix-to-main-launch"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?