Cargo.toml

# Continuum Rust Workspace
#
# Single workspace spans every Rust crate in the repo, grouped by tier:
#   core/      — headless substrate (server-side)
#   client/    — shared client lib (consumed by CLI + mobile FFI bridges)
#   apps/      — thin app shells (CLI today; mobile/desktop/vr land here)
#
# Add new crates to the members list below under their owning tier.

[workspace]
resolver = "2"
members = [
    # core/ — rust substrate
    "core/airc-test-fixtures",
    "core/continuum-airc-protocol",
    # "core/archive" quarantined → legacy/quarantine/archive-worker (#424):
    # its only spawn wiring pointed at a dir that no longer exists.
    "core/continuum-cli-lifecycle",
    "core/continuum-tool-protocol",
    "core/continuum-core",
    "core/expert-pager-policy",
    "core/source-hygiene",
    "core/continuum-orm-derive",
    "core/continuum-positron",
    "core/inference-grpc",
    "core/jtag-mcp",
    "core/livekit-bridge",
    "core/livekit-protocol",
    "core/llama",

    # client/ — shared client lib (consumed by CLI + mobile SDK FFI)
    "client/continuum-client",
    # FFI-clean JSON-boundary facade — the single binding source per-platform SDKs wrap
    "client/continuum-client-ffi",

    # apps/ — first-party UI shells / embodiments
    "apps/cli",

    # tools/ — build-time codegen (not substrate, not shipped in the binary)
    "tools/manifest-gen",
]
# `members` is an explicit list — NOT a glob — so a stray crate elsewhere in the
# tree is already not a member and needs no `exclude` entry to stay out.
#
# There used to be one here, for citizen project dirs that a persona's `cargo new`
# had created at the REPO ROOT (her file engine roots at the process cwd until
# #49 lands, and `cargo new` rewrites THIS file non-atomically — a persona's
# git_diff caught a torn 2-line read of it live, 2026-07-11). It claimed to keep
# their in-dir cargo builds working. It never did: those crates declare
# `edition.workspace = true`, and an EXCLUDED package cannot inherit from the
# workspace root, so `cargo` inside them failed with "failed to find a workspace
# root" the whole time. The entries were decoration.
#
# They are now quarantined under legacy/persona-exercises/ (see the README
# there). The real fix remains workspace isolation (#49): give a persona a real
# workspace of her own, so what she writes is deliberate and reviewable like any
# other contributor's — never something the substrate manifest has to fence off.
# Shared dependencies - workers inherit these versions
[workspace.dependencies]
# airc substrate — git-pinned to a stable SHA for efficient-passthrough
# integration (CBOR over Unix-socket IPC, no JSON re-encoding in the
# hot path, byte-stable for ed25519 sig verify on L1-6 envelopes).
# airc-ipc pulls airc-protocol + airc-core transitively. Bump the rev
# when adopting an airc change; all crates resolve from the same
# checkout so the IPC ABI version (IPC_PROTOCOL_VERSION) stays
# consistent across the dependency graph.
#
# 2026-09-16 bump 15f7b4b → 17abc10: inbox pages are byte-bounded and carry
# `has_more` (airc#1440) — the daemon-attached paging loop continues past a
# byte-cut page instead of reading it as "channel exhausted" (the M5 answered
# one 23.9 MB page every 6 s for six hours).
#
# 2026-08-07 bump cf6e2c6 → 8dcfa76: project_room_work_board is now pub and
# room_by_channel resolves a Room from the RoomId a caller already holds,
# so a room-scoped caller passes the SAME room its gate checks instead of
# letting the read resolve "my default subscription" independently (#345).
#
# 2026-05-31 bump 428f9281 → 5f6e25f: adopts airc v5 owner-core
# rewrite (continuum task #82, headless break #3) AND the SDK-side
# `impl From<>` conversions from airc#1096. Schema changes this PR
# migrates daemon_transport.rs against:
#   - Response::Event: { event: Box<TranscriptEvent> } → { envelope: Vec<u8> }
#     (decoded via `airc_lib::decode_wire_event`)
#   - PublishRequest: + from_peer/from_client/payload, − wire/body
#   - InboxResponse: { events: Vec<TranscriptEvent> } → { envelopes: Vec<Vec<u8>> }
#   - InboxRequest.since: TranscriptCursor → IpcCursor (via .into())
#   - PublishRequest.kind: FrameKind → IpcKind (via .into())
#   - PublishRequest.target: MentionTarget → IpcTarget (via .into())
#   - ResolveWire removed (owner-core daemon owns channels)
#
# All on same SHA so IPC ABI version stays consistent.
#
# 2026-06-16 bump f6ed190 → 1a47231 (airc canary tip): adopts the
# #1222 spawn contract — `Airc::publish_identity()` — so a persona
# publishes its identity card after subscribe and is grounded by NAME,
# not an anonymous peer-id. This is the airc half of the persona
# identity-grounding work (continuum#1650 RoomRosterSource resolves
# names from the IdentityPublished events publish_identity emits;
# continuum#1651 RoomDoctrineSource reads room_doctrine). Also pulls
# the airc update/doctor/network CLI fixes (#1218-#1222). Re-validate
# attach_as (refactored open_as + with_daemon_client) on bump.
#
# 2026-06-22 bump 72824ba → a7ae4f4 (airc canary tip): adopts the
# capability-grant transport (airc#1276) — the cross-grid command auth
# gate continuum verifies against (`grid_auth::SignedCapabilityGrant::sign`,
# `Airc::peer_public_key`, `HEADER_AIRC_CAPABILITY_GRANT`). Also pulls the
# ~50-commit canary delta since 72824ba: the ai/generate 5090 compute-lease
# facility (#1242), the ai/embedding grid facility (#1239-1241),
# `TranscriptKind::ChannelPurposePublished` + `channel_purpose` (the typed
# room-purpose seam for RoomPurposeSource), the relay self-election +
# stream-plane crypto (#1247/#1261-1264), and StatusResponse.connected_lan_peers.
# ABI deltas are ADDITIVE to types continuum only decodes (connected_lan_peers
# is #[serde(default)]; the new TranscriptKind variant has no exhaustive match
# against it), so the bump is decode-compatible — re-validate daemon_transport
# + persona attach on bump regardless.
#
# 2026-06-22 bump a7ae4f4 → 4aa717d (airc#1277): widens `Airc::mesh_identity`
# to pub so the command handler can pin this node's mesh as the expected mesh
# when verifying a presented capability grant (else WrongMesh). Visibility-only.
#
# 2026-06-22 bump 4aa717d → 55790e1 (airc#1278): `Airc::sign_grant(grant)` —
# the issuance half: an owner node signs a CapabilityGrant with its own key (key
# never leaves airc) so a grantee can present it. Powers grid/grant/issue + the
# end-to-end contracted-grid loop. Additive.
#
# 2026-06-29 bump 55790e1 → 17b238c (feat/airc-scoped-state, task #89): adopts
# the generic scoped-state store (airc-store `scoped_state` key→JSON +
# `ScopeRef` domain layer + `Airc::{get,set,list,delete}_scoped_state` facade +
# `airc state` CLI) — the private/local sibling of the room wall — AND the wall
# split-brain fix: `publish_wall_post` routes through the daemon when attached
# (was client-local only, invisible to the daemon-backed read) and `wall_posts`
# discriminates on the self-describing body, not the coarse bus kind the daemon
# read path flattens to `System`. This unblocks the WallSource `[room-board]`
# grounding A/B. Additive to the API surface continuum uses. NOTE: this SHA is
# on the scoped-state working branch, not canary — reconcile to the canary SHA
# when the airc PR lands; re-validate persona attach + wall publish on bump.
#
# 2026-06-29 bump 3b5368b → 9e23fa0 (fix/durable-peer-identity-index): adopts the
# daemon-aware peer-identity-card read. 3b5368b built the WRITE path (daemon
# indexes foreign peers' IdentityPublished cards into scoped_state
# `user:<peer>`/`identity.card`); 9e23fa0 adds the READ path an ATTACHED client
# needs — `peer_identity_card` branches on `is_daemon_attached()` to query the
# daemon's authoritative index via the new `PeerIdentityCard` IPC op (modeled on
# `room_tip`), and `peer_alias` delegates to it. Without this, an attached
# persona resolved peer names from its LOCAL home store — which only ever holds
# its own card — so it rendered raw UUIDs and confabulated names. Additive IPC op
# (new Request/Response variant); ABI is decode-compatible for ops continuum
# already uses. Also: `airc identity set --name`. Re-validate persona attach on bump.
#
# 2026-06-29 bump 9e23fa0 → 305c319 (fix/durable-peer-identity-index): completes
# the same fix. 9e23fa0 added the daemon-aware READ branch, but the index was
# still EMPTY: `record_peer_identity_card` wrote the per-peer identity index to
# the scope-local `event_store` (the persona's own home), while every reader —
# the daemon's IPC index AND daemon-less self-resolution — reads the
# machine-account `coordinator_store`. So the daemon's `coordinator_store` had
# zero `identity.card` rows and the attached persona still saw raw UUIDs /
# confabulated names. 305c319 routes the index write + the daemon-less read
# through `coordinator_store` (the one shared machine-account events.sqlite), so
# any scope that records a card writes it to the single index every sibling
# scope and the daemon read. Regression test:
# `peer_identity_index_converges_across_scopes_via_coordinator_store`. The
# general scope-home scoped_state (tool.mode/wall/coordination) is unchanged.
# Additive — no ABI change. Re-validate persona attach on bump.
#
# 2026-07-19 bump f41d786 → 3655e3c (feat/persona-peer-id-mint, #199 Slice 1b):
# adds the peer_id-adopting identity mint — `Airc::attach_as_with_peer_id` /
# `open_as_with_peer_id` (+ `LocalIdentity::{generate_and_save_as,
# load_or_generate_as}_with_peer_id`). A host that derives an actor's id
# BEFORE attach (a Continuum persona, whose agent_name + home are projected
# from a `persona_id`) hands that id in so `airc.peer_id() == persona_id` — a
# coherent identity from birth, no throwaway-uuid divergence to collapse.
# Purely additive: the existing `attach_as` / `open_as` still mint a random
# peer_id (`generate_and_save_as` delegates with `PeerId::new()`), and a
# RESUMED identity ignores a supplied id (never a rotation) — so the 8 living
# personas load their stored peer_id unchanged. Re-validate persona attach on bump.
#
# 2026-08-08 → dd34f68 (canary): the peer-id-mint work this comment describes has
# LANDED — the note that used to sit here, "this SHA is on the
# feat/persona-peer-id-mint branch, not canary, reconcile when the airc PR lands",
# was still telling readers to reconcile something already reconciled. dd34f68 is
# on canary and contains a08f3d3 (verified by ancestry, not assumed), and adds
# `current_room_landing_in` — caller-chosen fresh-scope landing room, which is what
# lets a fresh citizen land in #academy instead of airc's generic lobby.
#
# 2026-08-08 bump dd34f68 → e910008 (airc#1330): `Airc::subscribe_room(name)` —
# join a room WITHOUT promoting it to default. `join` conflates membership ("I am
# part of this room") with focus ("my next short-shape command means this room"),
# which is identical for an operator at a prompt and wrong for a citizen who
# belongs to several rooms at once: every additional join would drag her default
# behind it, so her "current room" would mean nothing but the room she was added
# to most recently. That matters because ~23 reads in airc-lib resolve against
# `current_room()`. Purely additive — `join` is unchanged, and a scope's FIRST
# room is still its default under either verb. This is what continuum's
# room/join needs (task #65, Joel: a persona is first-class and can subscribe to
# many rooms). Also fixes `RoomJoinedBody.is_default`, previously hardcoded true.
# Adopt AIRC #1427/#1428 together: directed reply identity checks and exact
# correlation subscriptions must run in this SDK, not only in the daemon.
# AIRC #1433 adds accepted signed reviews of exact work submissions, used by
# the ordinary reviewed-credit consumer. All crates share that public revision.
# The same revision across all AIRC crates preserves one shared wire contract.
# 2026-10-04 bump 7499136 -> e572f3e (airc canary tip). The claim gate is airc-lib,
# compiled INTO this core, so personas only get airc-lib fixes through this pin; Kimi
# kept hitting 'settled work is not claimable' on her own card with the 5090's daemon
# already at #1532. Adopts #1528 (right-sized payloads), #1529 (per-channel ring byte
# bound, channel_count + ring_bytes_total in status), #1530 (verbs are never room
# names), #1531 (the owner resumes her own card after her lease lapses), #1532
# (ownership durable, the lease is presence; from 2026-10-04T16:00Z), #1533 (test),
# #1534 (work claim/update/link --room). Card 86c5eb48.
# 2026-10-05 bump e572f3e -> 8d80961: #1535 her sealed mind store (airc-identity::mind,
# airc-protocol::mind_seal), #1536 Airc::mind_store() + put_at/remove, #1537
# submission_reviews_for_card, #1538 `airc work submission-review`. Privacy of thought
# step 2 reads and writes her mind store through Airc::mind_store(), never her key.
airc-core = { git = "https://github.com/CambrianTech/airc", rev = "841b5a0992db57137892b69a25066719c6a9387e" }
airc-blobs = { git = "https://github.com/CambrianTech/airc", rev = "841b5a0992db57137892b69a25066719c6a9387e" }
airc-protocol = { git = "https://github.com/CambrianTech/airc", rev = "841b5a0992db57137892b69a25066719c6a9387e" }
airc-ipc = { git = "https://github.com/CambrianTech/airc", rev = "841b5a0992db57137892b69a25066719c6a9387e" }
airc-bus = { git = "https://github.com/CambrianTech/airc", rev = "841b5a0992db57137892b69a25066719c6a9387e" }
airc-lib = { git = "https://github.com/CambrianTech/airc", rev = "841b5a0992db57137892b69a25066719c6a9387e" }
airc-wire = { git = "https://github.com/CambrianTech/airc", rev = "841b5a0992db57137892b69a25066719c6a9387e" }
# airc-work: the work-board domain (cards/lanes/PRs). `Airc::work_board`
# returns a `WorkBoardProjection` whose types (`WorkCard`, `LaneRecord`,
# `CardState`, …) the positron kanban projector maps → `KanbanViewState`
# at the seam. Only continuum-core (the projector) depends on it; the
# neutral `continuum-positron` contract crate MIRRORS these enums and
# must NOT depend on airc-work.
airc-work = { git = "https://github.com/CambrianTech/airc", rev = "841b5a0992db57137892b69a25066719c6a9387e" }

# Candle ML framework — patched via [patch.crates-io] below.
# Fixes: Metal buffer pool leak (#2271), RoPE NEOX convention (#3410)
candle-core = { version = "0.9" }
candle-nn = { version = "0.9" }
candle-transformers = { version = "0.9" }

# Serialization
serde = { version = "1", features = ["derive"] }
serde_json = "1"

# Database
rusqlite = { version = "0.38", features = ["bundled"] }

# Async runtime
tokio = { version = "1", features = ["full"] }

# gRPC
tonic = "0.14"
prost = "0.14"
tokio-stream = "0.1"

# Timing and UUIDs (for JTAG protocol)
chrono = "0.4"
uuid = { version = "1.6", features = ["v4", "v5", "serde"] }

# Safetensors for model/adapter weights
safetensors = "0.7"

# Half-precision floats (f16, bf16)
half = "2.7"

# Byte slice casting (for safetensors -> tensor conversion)
bytemuck = { version = "1.14", features = ["derive"] }

# HuggingFace Hub for model downloads
hf-hub = "0.5"

# Tokenization
tokenizers = "0.22"

# Random number generation
rand = "0.8"

# Parallelism
rayon = "1.11"

# Type generation (Rust → TypeScript)
# serde-json-impl: impl TS for serde_json::Value (→ `JsonValue` = any). Additive —
# existing `#[ts(type = "...")]` overrides still win — and lets command outputs carry
# the StorageResult<Vec<Value>> envelope without a per-command wrapper struct.
ts-rs = { version = "12.0", features = ["serde-json-impl"] }

# Postgres
deadpool-postgres = "0.14"
tokio-postgres = { version = "0.7", features = ["with-serde_json-1", "with-chrono-0_4"] }

# Compression and hashing
flate2 = "1.0"
sha2 = "0.10"

# Thread-safe primitives
lazy_static = "1.5"
once_cell = "1.21"
parking_lot = "0.12"

# Async utilities
async-trait = "0.1"

# Error handling
thiserror = "2"

# Logging/tracing
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
# Rolling-file writer for the fmt layer so operators don't need to
# remember to `2>/dev/null`. Pinned to 0.2 — Builder::max_log_files
# (used in routing/tracing_init.rs) requires ≥0.2.4. See
# `[[never-redirect-substrate-stderr]]` doctrine memory for why.
tracing-appender = "0.2"

# Embedding is adapter-routed through the AI provider (unsloth `/v1/embeddings`),
# not in-process ONNX — the `fastembed` crate was removed in task #40. The async
# `cognition::embedding::EmbeddingProvider` trait is the single embedding path.

# ONNX Runtime for TTS and embedding inference.
# download-binaries: downloads prebuilt ORT. load-dynamic: loads as shared lib at runtime.
# load-dynamic avoids protobuf symbol conflict with livekit/webrtc-sys that crashes
# cargo test on Linux (SIGABRT in protobuf descriptor registration).
# Both features together = download the binary AND load dynamically (no static protobuf link).
# `tls-rustls` (rustls + ring): REQUIRED by `download-binaries` (ort-sys's
# downloader needs a TLS provider). Previously this was satisfied transitively
# because `fastembed` pulled `ort` with its default features (which include a
# tls-* feature). With fastembed removed (task #40 — embedding is adapter-routed,
# not in-process ONNX), ort no longer inherits any tls-* feature, so we enable it
# explicitly here. rustls (vs native-tls) keeps the build self-contained for
# public/cross-platform users (no system OpenSSL).
ort = { version = "2.0.0-rc.11", default-features = false, features = ["download-binaries", "load-dynamic", "ndarray", "tls-rustls"] }
ndarray = "0.17"  # ort 2.0.0-rc.11 requires ndarray 0.17 for OwnedTensorArrayData trait compatibility

# WebSocket
tokio-tungstenite = "0.28"
futures-util = "0.3"



# Protobuf symbol conflict (ort vs webrtc-sys) is fixed by module declaration
# order in live/mod.rs — webrtc modules MUST be declared before ort/fastembed.
# codegen-units was set to 1 as defense-in-depth but that forces LLVM to run
# single-threaded, pinning one core at 99% during compilation. The symbol conflict
# is a link-time issue unaffected by codegen units. Default 16 enables parallel LLVM.
[profile.release]
# codegen-units = 1  # REMOVED — was single-threading rustc compilation for no benefit
# Strip debug symbols — continuum-core-server is ~200MB+ without this, mostly
# from rustc-emitted DWARF for libstd + candle + llama.cpp FFI bindings. We
# don't ship debuggers into the container, and panics still produce readable
# traces via symbol names in the stripped binary (just not source-line info).
# Expected: ~200MB → ~80MB for continuum-core-server.
strip = "symbols"
# Thin LTO across crate boundaries. Gets ~80-90% of fat-LTO's runtime
# benefit (cross-crate inlining on the hot path — llama crate ↔ continuum-
# core per-token calls) but at a fraction of the build-time cost — ~5-10%
# vs ~30%. For a project where iteration speed matters as much as runtime
# perf, thin is the right default. Release-tagged builds can override
# upward to fat via `RUSTFLAGS="-C lto=fat"` on the single blessed build
# if we ever decide the last 10% is worth it.
lto = "thin"

# Local installs rebuild this large crate for both the serving and GPU-free CLI
# feature sets. Keep incremental caches for those distinct compilations so a
# small harness edit does not redo every unchanged codegen unit in each set.
# Preserve release's normal 16 units explicitly: enabling incremental would
# otherwise change the default to 256. Optimization level and thin LTO stay put.
# CI can still disable incremental with its existing CARGO_INCREMENTAL=0.
[profile.release.package.continuum-core]
incremental = true
codegen-units = 16

# Hot-iter profile — fastest possible compile for inner-loop work
# (airc work claim → cargo build → test → repeat). Slice 3 of build-time
# doctrine card 424deb5e: a third lane between `dev` (ergonomic debug)
# and `release` (production perf). Used when we just need the binary to
# RUN — running stress baselines, exercising the persona loop, smoke
# tests — not when we're measuring perf or chasing a panic.
#
# Trade-offs vs `dev`:
# - opt-level = 0 matches dev (already the fastest opt level)
# - debug = "line-tables-only" keeps panic line numbers but skips full
#   DWARF (variable names, function args). 30-50% smaller object files,
#   meaningfully faster link.
# - codegen-units = 256 lets rustc parallelize across many small units.
#   Higher numbers cost runtime perf (less cross-unit inlining) but in
#   dev-fast we don't care — we're not measuring runtime.
# - incremental = true (already the dev default; explicit here for
#   discoverability — devs reading this profile shouldn't have to know
#   the cargo default).
#
# Invoke: `cargo build --profile dev-fast` or `cargo test --profile dev-fast`.
[profile.dev-fast]
inherits = "dev"
opt-level = 0
debug = "line-tables-only"
incremental = true
codegen-units = 256

# Strip debuginfo from DEPENDENCIES in dev builds (keep it for our own crates).
# The default `dev` profile emits full DWARF for every crate — and for our ML
# dep tree (candle, llama.cpp FFI bindings, tokenizers, tokio) that debuginfo is
# the bulk of the debug/ target dir (~180GB of the 280GB observed 2026-06-23).
# We essentially never source-step into those deps; our own workspace crates are
# NOT matched by `"*"`, so continuum-core et al keep full debug for backtraces +
# breakpoints. Panics inside deps still produce symbol-named traces, just without
# source-line info. Durable fix: every future debug rebuild keeps deps lean.
[profile.dev.package."*"]
debug = false

# Override crates.io candle with our fork (Metal memory, RoPE NEOX and Pascal
# half-atomic fixes). General CUDA excludes the uncalled fused-MoE archive;
# active tensor, training and speech users keep their existing CUDA features.
#
# Status (2026-04-15): huggingface/candle PR #3411 — the RoPE NEOX fix
# from this fork — was ACCEPTED AND MERGED upstream. The Metal memory
# fix is also part of that fork branch. Once candle publishes a release
# on crates.io that contains #3411's merge commit, we can GRADUATE off
# the fork: drop the three `[patch.crates-io]` lines below and pin the
# released candle-* version directly in the workspace deps. Until then
# the fork stays — upstream-merged is necessary but not sufficient; only
# a published release lets `cargo` find the fix at a version number.
#
# To check: `cargo search candle-core` or the candle CHANGELOG for the
# first release containing all the required fixes before removing these pins.
# This applies to all workspace members transparently.
[patch.crates-io]
candle-core = { git = "https://github.com/joelteply/candle.git", rev = "50756fc6ae242743b3e465e0fbb2968482c9c782" }
candle-nn = { git = "https://github.com/joelteply/candle.git", rev = "50756fc6ae242743b3e465e0fbb2968482c9c782" }
candle-transformers = { git = "https://github.com/joelteply/candle.git", rev = "50756fc6ae242743b3e465e0fbb2968482c9c782" }

[workspace.package]
edition = "2021"
version = "0.1.0"
authors = ["JTAG Team"]