Record Session Zero deployment

README.md

@@ -37,8 +37,8 @@ multiresolution agency graph for keeping large settings active at finite cost.
 
 ## Current Status
 
-Ghostlight Dungeon is implemented and deployed as a private Starfire-hosted
-playtest harness. The current acceptance surface covers:
+Ghostlight Dungeon is implemented and deployed as a Starfire-hosted,
+Heimdall-gated playtest harness. The current acceptance surface covers:
 
 - persistent DM-led Session Zero with shared/private channels, typed contracts,
   private boundaries, character bargains, digest-bound unanimous approval, and
@@ -61,10 +61,10 @@ playtest harness. The current acceptance surface covers:
 - provider, token, cache, latency, validation, state-version, and build receipts;
 - exact-build deployment and restart verification on Starfire.
 
-The immediate forge work is fixture, canary, and human pressure testing of
-Session Zero privacy/publication and bounded co-op alongside the existing
-multiresolution Gestalt agency tests. The public site is provisional; checkout
-is not live.
+The remaining forge gate is multi-account human pressure testing of Session
+Zero privacy/publication and bounded co-op alongside continued
+multiresolution Gestalt agency pressure. The public site is provisional;
+checkout is not live.
 
 ## Bounded Co-op
 

docs/architecture/ghostlight-dungeon-session-zero.md

@@ -55,6 +55,17 @@ are absent from JSON Schemas, browser projections, CultMesh surfaces, and model
 contexts. Actor-specific campaign surfaces use random campaign member IDs and
 the exact assigned actor.
 
+The structured Projector and Interpreter receive their exact stable JSON
+Schema before any dynamic context. DeepSeek's JSON mode constrains syntax but
+does not communicate the application schema by itself. The Interpreter emits
+only new deltas from the current DM response; it cannot restate existing draft
+fields or unresolved decisions as new proposals. Stable schema-first prefixes
+also preserve provider cache reuse. Empty, malformed, schema-invalid, or stale
+outputs cannot change the typed draft. If both same-snapshot attempts fail,
+the kernel may append a fixed local DM notice to the conversation while leaving
+contract, characters, decisions, boundaries, approvals, and model receipts
+unchanged.
+
 ## Approval and publication
 
 The host locks the roster before compilation. Material unresolved decisions

notes/fresh-workspace-handoff.md

@@ -62,10 +62,9 @@ live aggregate policy immediately; relaxation waits for unanimous publication.
 Narration, assessment, resolution demand, cell projection/interpretation, and
 semantic verification now receive the approved contract and aggregate policy.
 
-Do not confuse checkout truth with deployment truth. The immutable release
-listed below remains live until this change passes full tests, is committed,
-pushed, built, and activated through Idunn. Deployment evidence belongs in
-`gamecult-ops` and the state map, not in optimistic prose.
+Deployment truth is the immutable release named below. Operational ownership
+and rollback commands remain in `gamecult-ops`; this handoff records only the
+application witness needed for re-entry.
 
 The hosted MVP is implemented and live on Starfire. Ghostlight owns the
 generalized projection membrane; Epiphany consumes its pinned crate while
@@ -83,14 +82,24 @@ foundation checklist below. Existing Ghostlight fixtures remain regression
 evidence.
 
 The active immutable release is
-`b76bb5a8936624513fd0cd5e46d4d9ab11c3a517`, binary SHA-256
-`41928dbe73bb3e4a75e3a468d8a2c7ce725254621d17faa8a565ea526b2a3296`.
+`2b059da2edfec5f8db216ecd92df94687103f1cc`, binary SHA-256
+`e78a6c3b9520630e3342f93d48ebf9ebdf9497c5556d41859526b71839ab97b2`.
 Manifest, process, typed health, persisted campaign count, CultMesh store,
 DeepSeek startup inference, and VoidBot retrieval agree. Periwinkle proved the
 private-LAN route and unauthenticated 401; Raven and Yggdrasil independently
 proved WireGuard. Exact firewall and rollback truth remains owned by
 `gamecult-ops/runbooks/ghostlight-dungeon-starfire.md`.
 
+The full workspace passes 161 core and 15 daemon tests plus strict TypeScript
+and Vite release builds. The public crossing returns 200, unauthenticated state
+returns 401, and a real Heimdall/KLTST Discord flow reaches the authenticated
+Session Zero entry. One persistent canary generated three Vault-grounded
+opening decisions, survived release restarts, exposed malformed Interpreter
+JSON without draft mutation, displayed the fixed local failure notice, and
+then completed a schema-aware DM turn about a Mars/Zhestokost political
+campaign. Multi-account two-player and eight-player human smokes remain; do not
+claim those were performed by one authenticated browser.
+
 The accepted runtime lineage passes the authenticated generated-start and committed
 player journey: canonical nonliteral player identity, private assessment,
 confirmed d20 roll, wait, restart, fork, export, original re-selection, and
@@ -99,9 +108,10 @@ The strict nested refugee golden now passes without a retry: Mira retains an
 individual perspective inside a budget-one rival arena, migrates across two
 depth-two population lineages, survives three further background waves with
 her exact delta intact, and is automatically promoted as the same person when
-the player later returns. The remaining human-test gate is rendered browser
-inspection using a temporary invite, which requires explicit approval to send
-that credential through the in-app browser; rotate invitations afterward.
+the player later returns. The remaining human-test gate is separate
+authenticated people joining one draft and then one bounded shared-scene
+campaign. Session Zero invitation links are seven-day, single-use admission
+only; Heimdall still owns account identity.
 
 The multiresolution authority map is
 `docs/architecture/ghostlight-multiresolution-agency.md`. Canonical people and

notes/ghostlight-current-system-map.md

@@ -209,15 +209,26 @@ and operator inspection; the browser cannot reveal them before discovery.
 ## Current acceptance body
 
 Starfire currently serves immutable release
-`b76bb5a8936624513fd0cd5e46d4d9ab11c3a517`, executable SHA-256
-`41928dbe73bb3e4a75e3a468d8a2c7ce725254621d17faa8a565ea526b2a3296`,
-with rollback `12a704a508f2be1f4eee96acd46fe0dd9369b81c`.
+`2b059da2edfec5f8db216ecd92df94687103f1cc`, executable SHA-256
+`e78a6c3b9520630e3342f93d48ebf9ebdf9497c5556d41859526b71839ab97b2`,
+with rollback `531d4d44bb749201b668ea06a27eef2ee7cdda12`.
 
 Local CultMesh publication and HTTP readiness do not wait for Odin. Remote
-replication is coalesced into one asynchronous RUDP batch. On 2026-08-18 the
-canonical Yggdrasil endpoint `10.77.0.1:17871` had no listener; the live daemon
-became healthy in 2.803 seconds and then emitted one acknowledged-failure
-warning for its 19-document batch without losing local state or liveness.
+replication is coalesced into one asynchronous RUDP batch. On 2026-08-21 the
+WireGuard route to `10.77.0.1` was healthy, but port `17871` was Idunn's
+loopback-only provider-query socket rather than a network Odin RUDP listener.
+Ghostlight therefore retains its canonical local CultMesh/Eve projection and
+emits one bounded publication warning without losing local state or liveness.
+
+The deployed Session Zero canary survived two exact-build restarts with its
+private store intact. Heimdall completed a real KLTST Discord round trip and
+adopted one HttpOnly Ghostlight session. Aetheria retrieval produced three
+grounded opening decisions. Live DM inference initially exposed that JSON mode
+had not been given the Interpreter's application schema; the repaired release
+places exact stable schemas before dynamic context, emits only new deltas, and
+produced a coherent Mars/Zhestokost follow-up without borrowing First Exodus
+state. A forced malformed-output path displayed a local retry notice while the
+typed contract remained unchanged.
 
 Authenticated acceptance against the exact release has proved generated
 opening/role/approval compilation, a nonliteral canonical player actor ID,

notes/ghostlight-implementation-plan.md

@@ -32,7 +32,7 @@ a separate operator provider-concurrency limit. The
 specific authority map is
 `docs/architecture/ghostlight-multiresolution-agency.md`.
 The accepted implementation is hosted on Starfire as immutable release
-`7916ab04936ba962720cfbf4af1b83f9aa8d8b24`. Exact checkout, embedded commit,
+`2b059da2edfec5f8db216ecd92df94687103f1cc`. Exact checkout, embedded commit,
 release manifest, binary hash, process, typed health, CultMesh store, persisted
 campaign, DeepSeek startup inference, VoidBot retrieval, private-LAN access,
 WireGuard access, and unauthenticated rejection agree. This pass makes model
@@ -91,8 +91,9 @@ inert outcome resolver.
 
 Release truth, authenticated compiler/player HTTP journeys, restart continuity,
 and the strict multiresolution refugee-return golden now pass against immutable
-builds. The next gate is visual browser inspection through Heimdall's KLTST
-Discord-role admission, followed by supervised human play. The browser never
+builds. Visual browser inspection and a real Heimdall KLTST Discord admission
+now pass. The next gate is separate-account two-player and eight-player
+Session Zero/shared-scene pressure, followed by supervised human play. The browser never
 receives the Heimdall access token; it adopts a server-verified login attempt
 into an HttpOnly Ghostlight session. Treat player confusion, dramatic flatness, composite consequences,
 and token-heavy low-consequence stages as evidence about missing context or
@@ -106,8 +107,9 @@ population-owned resource moved to one exact colocated recipient only after a
 separate Flash verdict accepted the causal match; the source campaign snapshot
 remained unchanged during resolution. The witness also removed one avoidable
 provider retry by making the `resource_recipient_ids` input to
-`other_subject_id` output mapping explicit. The remaining release gate is the
-authenticated browser journey after rebuilding and deploying this exact commit.
+`other_subject_id` output mapping explicit. The remaining rollout gate is
+multi-account co-op pressure; one browser cannot prove cross-account privacy
+or unanimity.
 
 The live scheduler audit also removed an empty-agency failure loop. A campaign
 with clocks but no simulatable NPC, institution, or population now advances

state/evidence.jsonl

@@ -118,3 +118,4 @@
 {"ts":"2026-08-18T21:43:19Z","type":"deployment","status":"degraded","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable release 53f3f0cc3165bef6d68a6edc4d4ffbbc16dc7fd8 with executable SHA-256 a4bbc699bcb120b3e2d546ee3f60491b36ecbb30013f60af58216ad2043426dc. Typed health, executable hash, PID 7868, four recovered campaign directories, zero .creating-* directories, and DeepSeek readiness agree. Fork and reset lifecycle receipts now enter their staging stores before atomic publication, and a deliberate receipt collision proves failure leaves no filesystem or registry residue. Campaign selection reloads stale canonical auth state once and preserves concurrent session changes. The full workspace passed 141 core and 16 daemon tests. A fresh four-actor live Persona wave completed in 10.39 seconds, produced three appraisals and nine validated stage receipts, and atomically committed revision 1. The unauthenticated rendered page loaded without console errors; malformed anonymous JSON returned 401. Invitations were neither rotated nor consumed. One credentialed rendered journey remains pending. Remote Odin replication remains degraded because Yggdrasil has no UDP 17871 listener; canonical local CultMesh and HTTP remain healthy."}
 {"ts":"2026-08-18T21:56:28Z","type":"deployment","status":"degraded","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable release 9f991e4ce6ee7ca6c33cfc97f86dda4c05992caa with executable SHA-256 b4e8a68006a46d32c712c4ebc21ec19d7de2a73165ea62645e87cb76e731c68a. The first credentialed rendered-browser journey exposed and then verified the repair of a registry-normalization mismatch in campaign approval recovery. The fixed journey compiled and approved a grounded preview, refused impossible teleportation and nonexistent-equipment claims without mutation, previewed and atomically resolved a server-side d20 attempt from revision 0 to 1, published fork and reset branches exactly once, and preserved session selection and all three owned campaigns across daemon restart. The release recovered seven total campaign directories with zero .creating-* directories, DeepSeek ready, PID 5368, and no browser console warnings. The refused-approval test store was moved intact outside the campaign namespace into acceptance/quarantine. One invite was consumed for this acceptance journey; the second remains unused and the invite blob was not rotated. Remote Odin replication remains degraded because Yggdrasil has no UDP 17871 listener; canonical local CultMesh and HTTP remain healthy."}
 {"ts":"2026-08-20T19:01:36Z","type":"deployment","status":"ok","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable release 7b58e3eaa24f30f0be9d226380d45c2601ecdea0 with executable SHA-256 9d33e9242505e18f0fff85b5083caf29ee8fc092495d347244b1aa7e2d9ffb43. Heimdall admits only the exact Yggdrasil Ghostlight backend callback and evaluates Discord guild 113786069023064068 role 861962027550244914. Ghostlight owns short-lived login attempts, verifies signed aud=ghostlight claims server-side, discards the provider token, and mints one HttpOnly session alias. Retired invite paths return 404 without a cookie, unauthenticated campaign state returns 401, the public start crossing returns 200, and rendered-browser acceptance reached Discord authorization through a same-tab handoff that survives navigation. Human Discord authorization remains the final account-specific acceptance step."}
+{"ts":"2026-08-21T15:38:00Z","type":"deployment","status":"degraded","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable Session Zero/co-op release 2b059da2edfec5f8db216ecd92df94687103f1cc with executable SHA-256 e78a6c3b9520630e3342f93d48ebf9ebdf9497c5556d41859526b71839ab97b2 and rollback 531d4d44bb749201b668ea06a27eef2ee7cdda12. Typed health, exact release witness, seven existing campaigns, one persistent Session Zero store, DeepSeek readiness, supervised SSH reverse crossing, public HTTP 200, and unauthenticated HTTP 401 agree. A real Heimdall/KLTST Discord round trip adopted an HttpOnly Ghostlight session. The canary produced three Vault-grounded opening decisions and survived two exact-build restarts. Two observed malformed Interpreter runs changed no typed draft; the repaired body now publishes a local retry notice and supplies stable exact JSON Schemas before dynamic Projector/Interpreter context. A subsequent live Mars/Zhestokost turn produced coherent DM speech, no duplicated decisions, and no unaccepted contract mutation. The full workspace passed 161 core and 15 daemon tests plus strict TypeScript/Vite release builds. Remote Odin RUDP publication is degraded: WireGuard is healthy, but 10.77.0.1:17871 is not a network Odin listener; canonical local CultMesh/Eve and HTTP remain healthy."}

state/map.yaml

@@ -273,6 +273,6 @@ data_flow:
   - If state grows faster than understanding, cut it back.
 
 current_status:
-  summary: The current checkout replaces direct campaign compilation with persistent DM-led Session Zero, private character and boundary channels, inline Vault-grounded opening/role decisions, unanimous digest approval, atomic campaign publication, actor-bound campaign membership, actor-filtered Eve/CultMesh surfaces, pooled entitlement budgets, unanimous time/travel/budget governance, and revision-bound Contract Review. Human actors cannot enter Persona or scheduler control; PvP, split movement, unilateral group time, stale actions, and group lifecycle operations are rejected at authoritative boundaries. Approved contract and anonymous aggregate safety policy now reach narration, assessment, demand projection, cell projection/interpretation, and verification. The previous Starfire release remains deployment truth until this checkout passes full tests, is committed, built immutably, and activated through Idunn.
-  next_action: Finish the full workspace and web verification, commit and push the exact source, then use Idunn/gamecult-ops to deploy a two-player Starfire canary followed by an eight-account Session Zero/shared-scene smoke. Record exact build provenance and any rollout failure without weakening admission invariants.
+  summary: Starfire serves immutable release 2b059da2edfec5f8db216ecd92df94687103f1cc with persistent DM-led Session Zero, private character and boundary channels, inline Vault-grounded opening/role decisions, unanimous digest approval, atomic campaign publication, actor-bound campaign membership, actor-filtered Eve/CultMesh surfaces, pooled entitlement budgets, unanimous time/travel/budget governance, and revision-bound Contract Review. The full workspace passes 161 core and 15 daemon tests. A real Heimdall/KLTST browser canary generated grounded openings, survived release restarts, proved malformed DM output cannot mutate the draft, and completed a schema-aware Mars/Zhestokost DM turn. Local CultMesh/Eve state is healthy; outbound Odin RUDP rendezvous remains degraded because 10.77.0.1:17871 is not a network Odin listener.
+  next_action: Run a two-person Starfire Session Zero and bounded shared-scene canary using separate Heimdall accounts, then an eight-account roster/privacy/unanimity smoke. Continue pressuring multiresolution Gestalt agency under human play; do not weaken actor, privacy, approval, or no-puppeting invariants to make the smoke pass.
   gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.