diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 4a76faf..27e5d9e 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -136,7 +136,10 @@ releases, and sanitized Expected projections. Idunn's Git, runner, workload, lease/fencing, route, CultCache/CultMesh, and main-loop actuation remain absent; the legacy deployment seam is still unsafe to invoke. -The adopted cut puts a visible recipe and unit template in each target repo. +The adopted cut puts a visible recipe with a constrained launch declaration in +each target repo; raw unit or container-runtime templates are rejected. The +operator binding selects the workload driver, which alone lowers that launch +declaration into process-manager configuration. Idunn operator bindings own the admitted ref, runner/container image and affordances, host paths, secrets, routing endpoint, rollout, retention, and desired replica placement. A sealed plan and release publish only Expected. @@ -159,9 +162,12 @@ Integrate the landed recipe, binding, plan, release, Expected, activation, presence, and write-lease contracts into Idunn's main control plane and narrow Git, runner, workload, lease/fencing, route, CultCache, and CultMesh drivers. Keep target semantics in visible Ghostlight and Connector recipes and fleet -affordances in Idunn-owned bindings. Require Expected plus Idunn-observed -activation plus service-signed Present; grant the process lease before writable -state opens; require Odin-correlated Ready before stable route membership moves. +affordances in Idunn-owned bindings. The narrow Idunn source driver must prove +the selected commit, tree, recipe, and Gitlinks; deterministic plan validation +does not establish ancestry, signatures, or object custody. Require Expected +plus Idunn-observed activation plus service-signed Present; grant the process +lease before writable state opens; require Odin-correlated Ready before stable +route membership moves. Deploy the Connector and then Ghostlight through that contract. Runtime restart, route continuity, signed health, exact receipts, exclusive world-v2 state, and diff --git a/notes/ghostlight-current-system-map.md b/notes/ghostlight-current-system-map.md index 7cc15c6..392be8f 100644 --- a/notes/ghostlight-current-system-map.md +++ b/notes/ghostlight-current-system-map.md @@ -830,13 +830,14 @@ Starfire writer is stopped; its process and tunnel are no longer live authority. The migration copied campaign and Session Zero stores while preserving Yggdrasil's native mesh and provider-health identities. -Local CultMesh publication and HTTP readiness do not wait for Odin. Remote -replication is coalesced into one asynchronous RUDP batch. Odin's coordinator -is healthy on Yggdrasil and owns RUDP discovery at `10.77.0.1:17871`; Idunn -admits signed Ghostlight health and owns same-release continuity independently -of its deployment brake. VoidBot's canonical MCP service is local to the host -at `127.0.0.1:17875/mcp`, so live retrieval no longer depends on a Starfire -reverse tunnel. +The pre-rebuild hosted body published local CultMesh and HTTP readiness without +waiting for Odin; that legacy health admission is teardown evidence, not the +new runtime contract. Under the landed contracts, an activation becomes current +only after Idunn's workload driver observes the exact native process and +artifact. Present requires that activation plus service-signed presence health; +Odin alone correlates Ready. Idunn continuity and deployment actuation have not +yet been integrated with this contract. VoidBot's canonical MCP service remains +separately owned and is not a deployment authority. ### Deployment, discovery, and adjacent capacity @@ -846,12 +847,12 @@ either organ a campaign write path. Current release identity for Idunn, Odin, Heimdall, Bifrost, and Epiphany is operational truth in `gamecult-ops`; do not copy it here and let it fossilize again. -Release admission is based on the newest executable- or build-affecting commit -reachable from the admitted ref. Documentation, notes, state receipts, and -root Markdown are not executable release selectors. The root actuator proves -that the selected commit is an ancestor of the admitted ref before activation, -then verifies the exact installed witness. Documentation and state-only commits -therefore cannot displace the live executable. +The landed deterministic foundation retains the exact selected commit, source +tree, recipe blob, and Gitlink facts. Shape validation is not proof of Git +ancestry, signatures, or object custody. Those proofs belong to the narrow +Idunn-owned source driver, which must read the canonical ref and exact objects +as the Idunn identity before compiling a consequential plan. That source driver +and Idunn main integration remain absent. Heimdall publishes four redacted typed discovery records to Odin under globally unique catalog keys: diff --git a/notes/ghostlight-implementation-plan.md b/notes/ghostlight-implementation-plan.md index 9785541..c4a2afd 100644 --- a/notes/ghostlight-implementation-plan.md +++ b/notes/ghostlight-implementation-plan.md @@ -189,6 +189,13 @@ runtime activation, service-signed Present health, and process-bound write leases. Idunn main integration and the Git, runner, workload, lease/fencing, route, CultCache, and CultMesh drivers are not implemented yet. +Targets own constrained launch declarations, never raw unit or container +templates. The operator binding selects the workload driver, which alone lowers +that declaration into process-manager configuration. Likewise, deterministic +plan validation retains exact commit, tree, recipe, and Gitlink facts but proves +neither ancestry, signatures, nor object custody; the narrow Idunn-owned source +driver must establish those facts before actuation. + The integrated path must publish Expected from the sealed plan and release, record Idunn's observation of the exact runtime activation, and require the service's signed Present health. A stateful candidate receives its process-bound diff --git a/state/evidence.jsonl b/state/evidence.jsonl index c1d113d..6571b85 100644 --- a/state/evidence.jsonl +++ b/state/evidence.jsonl @@ -252,4 +252,5 @@ {"note": "Commit b53251f lands a private provisional foundation.v0 WorldKernel owner: immutable genesis and exact create retry, sealed authentication evidence, one live CultCache owner, canonical WorldId issuance and reduction kept private, digest/replay recovery, persisted no-op and rejection non-commit, path-identity revocation, and poison/reopen after a simulated post-durable lost acknowledgement. Nine focused world tests pass. The legacy exported kernel remains live; this is the sealed foundation, not cutover.", "status": "ok", "ts": "2026-09-01T14:18:40+00:00", "type": "implementation"} {"note": "Commit d49b907 makes the replacement Persona interpretation contract structurally total. Persona source prose is immutable noncanonical evidence bound to typed world/controller/opportunity/revision and inference receipts; only exact typed captures may propose state, actual quoted dialogue is required for speech, malformed spans or raw tool payloads become exact whole-source translation gaps, normal step exhaustion adds an unresolved-source gap, and infrastructure interruption discards partial captures and returns the source pending. Ten focused projection tests pass. Legacy exported Persona runners still contain terminal failure paths and do not expose record_gap; they remain deletion targets, so totality is not yet a live-runtime claim.", "status": "ok", "ts": "2026-09-01T14:37:59+00:00", "type": "implementation"} {"note": "Commits 12ee9f4 and 66ed2ec advance the authority rebuild past the private reducer phase. The first removes 686 lines of dead legacy Elaboration and Mutation ingress without a compatibility writer. The second completes the sealed Draft-to-Active authority loop with canonical controller assignments and affordance grants, revision-bound opportunities, one shared human and autonomous ExerciseDecision reducer, one serialized mailbox, atomic replay, and exact rejection and lost-ack behavior; eighteen focused world tests pass. This is not runtime cutover: the legacy exported kernel and startup, Session Zero, player, autonomous, and recovery paths remain live owners. The next move exposes and wires the replacement runtime identity and mailbox, deleting each old owner without dual-write.", "status": "ok", "ts": "2026-09-01T17:40:32+00:00", "type": "implementation"} -{"ts": "2026-09-02T14:10:03+00:00", "type": "research", "status": "ok", "note": "Pushed Ghostlight 13d5136 has no legacy runtime modules and one CultCache owner, but Yggdrasil still runs legacy a4080d4. Read-only cutover audit proved the current Idunn path structurally unfit: source/ref/floor policy is duplicated across compiled Rust, raw executable command records, a privileged shell dispatcher, and large gamecult-ops target programs; root Git cannot inspect correctly idunn-owned mirrors; Ghostlight world-v2 purity checks ignore most legacy state; and fixed-port activation stops the incumbent before the candidate is green. Adopted cut: visible target-owned recipes and unit templates, Idunn-configured refs/runner containers/affordances/host bindings, Git and recipe materialization as idunn, narrow sealed privileged consequences, candidate staged health behind a stable router, process/write-lease handoff, atomic route change, and separate deployment versus continuity authority. Do not issue the current Connector or Ghostlight redeploy requests."} +{"note": "Pushed Ghostlight 13d5136 has no legacy runtime modules and one CultCache owner, but Yggdrasil still runs legacy a4080d4. Read-only cutover audit proved the current Idunn path structurally unfit: source/ref/floor policy is duplicated across compiled Rust, raw executable command records, a privileged shell dispatcher, and large gamecult-ops target programs; root Git cannot inspect correctly idunn-owned mirrors; Ghostlight world-v2 purity checks ignore most legacy state; and fixed-port activation stops the incumbent before the candidate is green. Adopted cut: visible target-owned recipes and unit templates, Idunn-configured refs/runner containers/affordances/host bindings, Git and recipe materialization as idunn, narrow sealed privileged consequences, candidate staged health behind a stable router, process/write-lease handoff, atomic route change, and separate deployment versus continuity authority. Do not issue the current Connector or Ghostlight redeploy requests.", "status": "ok", "ts": "2026-09-02T14:10:03+00:00", "type": "research"} +{"ts": "2026-09-02T19:30:00+00:00", "type": "research", "status": "ok", "note": "Supersedes the 2026-09-02T14:10:03+00:00 Idunn cutover design receipt where it named target-owned unit templates, an executable-affecting-commit selector, and staged health. Odin cebe425 rejects raw repository unit/container templates: targets own constrained launch declarations and the operator-selected workload driver lowers them. Deterministic plan validation retains commit, tree, recipe, and Gitlink facts but does not prove ancestry, signatures, or object custody; a future narrow Idunn source driver must. CultNet 87d0b0f and Odin cebe425 establish Expected, Idunn-observed activation, service-signed Present, process lease before writable state, Odin Ready, and route membership only after Ready. Actuation and Idunn main integration remain absent."} diff --git a/state/ghostlight-state.cultcache.jsonl b/state/ghostlight-state.cultcache.jsonl index 0281de3..35c4084 100644 --- a/state/ghostlight-state.cultcache.jsonl +++ b/state/ghostlight-state.cultcache.jsonl @@ -254,3 +254,4 @@ {"key": "2026-09-01T143759Z0000-0252-5215bd873810", "payload": "eyJub3RlIjogIkNvbW1pdCBkNDliOTA3IG1ha2VzIHRoZSByZXBsYWNlbWVudCBQZXJzb25hIGludGVycHJldGF0aW9uIGNvbnRyYWN0IHN0cnVjdHVyYWxseSB0b3RhbC4gUGVyc29uYSBzb3VyY2UgcHJvc2UgaXMgaW1tdXRhYmxlIG5vbmNhbm9uaWNhbCBldmlkZW5jZSBib3VuZCB0byB0eXBlZCB3b3JsZC9jb250cm9sbGVyL29wcG9ydHVuaXR5L3JldmlzaW9uIGFuZCBpbmZlcmVuY2UgcmVjZWlwdHM7IG9ubHkgZXhhY3QgdHlwZWQgY2FwdHVyZXMgbWF5IHByb3Bvc2Ugc3RhdGUsIGFjdHVhbCBxdW90ZWQgZGlhbG9ndWUgaXMgcmVxdWlyZWQgZm9yIHNwZWVjaCwgbWFsZm9ybWVkIHNwYW5zIG9yIHJhdyB0b29sIHBheWxvYWRzIGJlY29tZSBleGFjdCB3aG9sZS1zb3VyY2UgdHJhbnNsYXRpb24gZ2Fwcywgbm9ybWFsIHN0ZXAgZXhoYXVzdGlvbiBhZGRzIGFuIHVucmVzb2x2ZWQtc291cmNlIGdhcCwgYW5kIGluZnJhc3RydWN0dXJlIGludGVycnVwdGlvbiBkaXNjYXJkcyBwYXJ0aWFsIGNhcHR1cmVzIGFuZCByZXR1cm5zIHRoZSBzb3VyY2UgcGVuZGluZy4gVGVuIGZvY3VzZWQgcHJvamVjdGlvbiB0ZXN0cyBwYXNzLiBMZWdhY3kgZXhwb3J0ZWQgUGVyc29uYSBydW5uZXJzIHN0aWxsIGNvbnRhaW4gdGVybWluYWwgZmFpbHVyZSBwYXRocyBhbmQgZG8gbm90IGV4cG9zZSByZWNvcmRfZ2FwOyB0aGV5IHJlbWFpbiBkZWxldGlvbiB0YXJnZXRzLCBzbyB0b3RhbGl0eSBpcyBub3QgeWV0IGEgbGl2ZS1ydW50aW1lIGNsYWltLiIsICJzdGF0dXMiOiAib2siLCAidHMiOiAiMjAyNi0wOS0wMVQxNDozNzo1OSswMDowMCIsICJ0eXBlIjogImltcGxlbWVudGF0aW9uIn0=", "stored_at": "2026-09-01T14:37:59.318539+00:00", "type": "ghostlight.evidence_record.v0"} {"key": "2026-09-01T174032Z0000-0253-0d12cf9f16ae", "payload": "eyJub3RlIjogIkNvbW1pdHMgMTJlZTlmNCBhbmQgNjZlZDJlYyBhZHZhbmNlIHRoZSBhdXRob3JpdHkgcmVidWlsZCBwYXN0IHRoZSBwcml2YXRlIHJlZHVjZXIgcGhhc2UuIFRoZSBmaXJzdCByZW1vdmVzIDY4NiBsaW5lcyBvZiBkZWFkIGxlZ2FjeSBFbGFib3JhdGlvbiBhbmQgTXV0YXRpb24gaW5ncmVzcyB3aXRob3V0IGEgY29tcGF0aWJpbGl0eSB3cml0ZXIuIFRoZSBzZWNvbmQgY29tcGxldGVzIHRoZSBzZWFsZWQgRHJhZnQtdG8tQWN0aXZlIGF1dGhvcml0eSBsb29wIHdpdGggY2Fub25pY2FsIGNvbnRyb2xsZXIgYXNzaWdubWVudHMgYW5kIGFmZm9yZGFuY2UgZ3JhbnRzLCByZXZpc2lvbi1ib3VuZCBvcHBvcnR1bml0aWVzLCBvbmUgc2hhcmVkIGh1bWFuIGFuZCBhdXRvbm9tb3VzIEV4ZXJjaXNlRGVjaXNpb24gcmVkdWNlciwgb25lIHNlcmlhbGl6ZWQgbWFpbGJveCwgYXRvbWljIHJlcGxheSwgYW5kIGV4YWN0IHJlamVjdGlvbiBhbmQgbG9zdC1hY2sgYmVoYXZpb3I7IGVpZ2h0ZWVuIGZvY3VzZWQgd29ybGQgdGVzdHMgcGFzcy4gVGhpcyBpcyBub3QgcnVudGltZSBjdXRvdmVyOiB0aGUgbGVnYWN5IGV4cG9ydGVkIGtlcm5lbCBhbmQgc3RhcnR1cCwgU2Vzc2lvbiBaZXJvLCBwbGF5ZXIsIGF1dG9ub21vdXMsIGFuZCByZWNvdmVyeSBwYXRocyByZW1haW4gbGl2ZSBvd25lcnMuIFRoZSBuZXh0IG1vdmUgZXhwb3NlcyBhbmQgd2lyZXMgdGhlIHJlcGxhY2VtZW50IHJ1bnRpbWUgaWRlbnRpdHkgYW5kIG1haWxib3gsIGRlbGV0aW5nIGVhY2ggb2xkIG93bmVyIHdpdGhvdXQgZHVhbC13cml0ZS4iLCAic3RhdHVzIjogIm9rIiwgInRzIjogIjIwMjYtMDktMDFUMTc6NDA6MzIrMDA6MDAiLCAidHlwZSI6ICJpbXBsZW1lbnRhdGlvbiJ9", "stored_at": "2026-09-01T17:40:32.825638+00:00", "type": "ghostlight.evidence_record.v0"} {"key": "2026-09-02T141003Z0000-0254-040b0bdbc683", "payload": "eyJub3RlIjogIlB1c2hlZCBHaG9zdGxpZ2h0IDEzZDUxMzYgaGFzIG5vIGxlZ2FjeSBydW50aW1lIG1vZHVsZXMgYW5kIG9uZSBDdWx0Q2FjaGUgb3duZXIsIGJ1dCBZZ2dkcmFzaWwgc3RpbGwgcnVucyBsZWdhY3kgYTQwODBkNC4gUmVhZC1vbmx5IGN1dG92ZXIgYXVkaXQgcHJvdmVkIHRoZSBjdXJyZW50IElkdW5uIHBhdGggc3RydWN0dXJhbGx5IHVuZml0OiBzb3VyY2UvcmVmL2Zsb29yIHBvbGljeSBpcyBkdXBsaWNhdGVkIGFjcm9zcyBjb21waWxlZCBSdXN0LCByYXcgZXhlY3V0YWJsZSBjb21tYW5kIHJlY29yZHMsIGEgcHJpdmlsZWdlZCBzaGVsbCBkaXNwYXRjaGVyLCBhbmQgbGFyZ2UgZ2FtZWN1bHQtb3BzIHRhcmdldCBwcm9ncmFtczsgcm9vdCBHaXQgY2Fubm90IGluc3BlY3QgY29ycmVjdGx5IGlkdW5uLW93bmVkIG1pcnJvcnM7IEdob3N0bGlnaHQgd29ybGQtdjIgcHVyaXR5IGNoZWNrcyBpZ25vcmUgbW9zdCBsZWdhY3kgc3RhdGU7IGFuZCBmaXhlZC1wb3J0IGFjdGl2YXRpb24gc3RvcHMgdGhlIGluY3VtYmVudCBiZWZvcmUgdGhlIGNhbmRpZGF0ZSBpcyBncmVlbi4gQWRvcHRlZCBjdXQ6IHZpc2libGUgdGFyZ2V0LW93bmVkIHJlY2lwZXMgYW5kIHVuaXQgdGVtcGxhdGVzLCBJZHVubi1jb25maWd1cmVkIHJlZnMvcnVubmVyIGNvbnRhaW5lcnMvYWZmb3JkYW5jZXMvaG9zdCBiaW5kaW5ncywgR2l0IGFuZCByZWNpcGUgbWF0ZXJpYWxpemF0aW9uIGFzIGlkdW5uLCBuYXJyb3cgc2VhbGVkIHByaXZpbGVnZWQgY29uc2VxdWVuY2VzLCBjYW5kaWRhdGUgc3RhZ2VkIGhlYWx0aCBiZWhpbmQgYSBzdGFibGUgcm91dGVyLCBwcm9jZXNzL3dyaXRlLWxlYXNlIGhhbmRvZmYsIGF0b21pYyByb3V0ZSBjaGFuZ2UsIGFuZCBzZXBhcmF0ZSBkZXBsb3ltZW50IHZlcnN1cyBjb250aW51aXR5IGF1dGhvcml0eS4gRG8gbm90IGlzc3VlIHRoZSBjdXJyZW50IENvbm5lY3RvciBvciBHaG9zdGxpZ2h0IHJlZGVwbG95IHJlcXVlc3RzLiIsICJzdGF0dXMiOiAib2siLCAidHMiOiAiMjAyNi0wOS0wMlQxNDoxMDowMyswMDowMCIsICJ0eXBlIjogInJlc2VhcmNoIn0=", "stored_at": "2026-09-02T14:10:03.672658+00:00", "type": "ghostlight.evidence_record.v0"} +{"key": "2026-09-02T193000Z0000-0255-cf239716f068", "payload": "eyJub3RlIjogIlN1cGVyc2VkZXMgdGhlIDIwMjYtMDktMDJUMTQ6MTA6MDMrMDA6MDAgSWR1bm4gY3V0b3ZlciBkZXNpZ24gcmVjZWlwdCB3aGVyZSBpdCBuYW1lZCB0YXJnZXQtb3duZWQgdW5pdCB0ZW1wbGF0ZXMsIGFuIGV4ZWN1dGFibGUtYWZmZWN0aW5nLWNvbW1pdCBzZWxlY3RvciwgYW5kIHN0YWdlZCBoZWFsdGguIE9kaW4gY2ViZTQyNSByZWplY3RzIHJhdyByZXBvc2l0b3J5IHVuaXQvY29udGFpbmVyIHRlbXBsYXRlczogdGFyZ2V0cyBvd24gY29uc3RyYWluZWQgbGF1bmNoIGRlY2xhcmF0aW9ucyBhbmQgdGhlIG9wZXJhdG9yLXNlbGVjdGVkIHdvcmtsb2FkIGRyaXZlciBsb3dlcnMgdGhlbS4gRGV0ZXJtaW5pc3RpYyBwbGFuIHZhbGlkYXRpb24gcmV0YWlucyBjb21taXQsIHRyZWUsIHJlY2lwZSwgYW5kIEdpdGxpbmsgZmFjdHMgYnV0IGRvZXMgbm90IHByb3ZlIGFuY2VzdHJ5LCBzaWduYXR1cmVzLCBvciBvYmplY3QgY3VzdG9keTsgYSBmdXR1cmUgbmFycm93IElkdW5uIHNvdXJjZSBkcml2ZXIgbXVzdC4gQ3VsdE5ldCA4N2QwYjBmIGFuZCBPZGluIGNlYmU0MjUgZXN0YWJsaXNoIEV4cGVjdGVkLCBJZHVubi1vYnNlcnZlZCBhY3RpdmF0aW9uLCBzZXJ2aWNlLXNpZ25lZCBQcmVzZW50LCBwcm9jZXNzIGxlYXNlIGJlZm9yZSB3cml0YWJsZSBzdGF0ZSwgT2RpbiBSZWFkeSwgYW5kIHJvdXRlIG1lbWJlcnNoaXAgb25seSBhZnRlciBSZWFkeS4gQWN0dWF0aW9uIGFuZCBJZHVubiBtYWluIGludGVncmF0aW9uIHJlbWFpbiBhYnNlbnQuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA5LTAyVDE5OjMwOjAwKzAwOjAwIiwgInR5cGUiOiAicmVzZWFyY2gifQ==", "stored_at": "2026-09-02T19:30:00.871222+00:00", "type": "ghostlight.evidence_record.v0"} diff --git a/state/map.yaml b/state/map.yaml index a9cf155..a40c86c 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -92,7 +92,7 @@ live_architecture: - Expansion occurs at a typed causal boundary and uses the same mutation vocabulary as seed creation, action, import, individuation, and time. A sparse structurally closed horizon is valid. - Pre-rebuild stores and acceptance roots remain immutable evidence. They do not enter the new runtime through a live compatibility writer. deployment_authority: - - Each target repository owns a visible versioned deployment recipe: build, test, package, artifact map, unit template, health contract, state semantics, and requested runner profiles. A target may request an affordance; it cannot grant itself host authority. + - Each target repository owns a visible versioned deployment recipe: build, test, package, artifact map, constrained launch declaration, health contract, state semantics, and requested runner profiles. A target may request an affordance; it cannot grant itself host authority. The operator binding selects the workload driver, and that driver alone lowers the launch declaration into process-manager configuration; raw repository-owned unit or container-runtime text is rejected. - Idunn operator bindings own admitted source origins and refs, minimum revisions, exact release selection, container images and runner kinds, network, mounts, secrets, identities, capabilities, resources, routing endpoints, rollout policy, retention, and desired replica placement. `gamecult-ops` owns those fleet bindings and substrate provisioning, not target deployment programs. - Idunn has two present authorities: deployment control changes an admitted body; continuity supervision keeps that same admitted body alive from signed health. The deployment brake gates only the first. A separately named lifecycle brake may suspend the second. - A sealed plan and release produce only Idunn's sanitized Expected incarnation. Idunn observes one exact runtime activation; the service signs its own Present health. For writable state, Idunn grants the process-bound write lease before the service opens state. Odin alone correlates Expected, activation, and Present into Ready. Stable route membership may move only after Ready; route membership and the write lease remain separate authorities. @@ -159,7 +159,7 @@ pre_rebuild_architecture: - Native players use `ghostlight.native.player` on loopback RUDP `127.0.0.1:4102`. Heimdall owns the one-time OAuth attempt and completion; Ghostlight redeems it into the same app-session authority used by the browser. The native client persists only its opaque Ghostlight bearer in a mode-0600 CultCache store, submits the same canonical Eve invocations to the same kernel mailboxes, and sends bounded five-second RUDP keepalives while a long model-backed command remains pending. - Odin advertises the redacted native boundary and its four operations but receives no bearer, attempt handle, claim, account, member, actor, or campaign state. A forged native session is denied before surface projection or command admission. - Public Ghostlight HTTP exposes only the Eve provider, logical surface, command, and invalidation endpoints plus the typed health probe and static assets. Exact private per-member and operator surfaces remain CultMesh documents; Hermodr is an optional generic materializer, not a runtime dependency. - - Yggdrasil release admission resolves the newest executable- or build-affecting commit from the admitted ref. Later documentation, notes, state receipts, and root Markdown do not become runtime authority or cause a redeploy; Idunn proves the selected commit is an ancestor of the admitted ref and verifies the exact witness after activation. + - The landed Idunn foundation records an exact selected commit, tree, recipe blob, and Gitlink facts but does not prove Git ancestry, signatures, or object custody. A narrow Idunn-owned source driver must fetch and prove those objects as the Idunn identity before a plan or release can gain runtime consequence; that source driver and main integration are not implemented yet. - Idunn owns Ghostlight deployment and same-release continuity, Odin owns discovery, Heimdall owns account identity, and VoidBot owns Vault retrieval. None can write campaign state. Epiphany is an adjacent consumer and future swarm-capacity provider, not a Ghostlight runtime dependency or authority. persistence_spine: - The hosted runtime uses Rust CultCache/redb `.cc` stores: one store per campaign plus service auth and CultMesh stores.