GameCult/Ghostlight
Watch
9
0
Fork
You've already forked Ghostlight
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Correct Idunn launch and source authority map

Browse source
This commit is contained in:
Meta Vens 2026-09-02 21:31:52 +02:00
commit 36760710db
6 changed files with 36 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

14
notes/fresh-workspace-handoff.md
View file

@ -136,7 +136,10 @@ releases, and sanitized Expected projections. Idunn's Git, runner, workload,
lease/fencing, route, CultCache/CultMesh, and main-loop actuation remain absent;
the legacy deployment seam is still unsafe to invoke.
The adopted cut puts a visible recipe and unit template in each target repo.
The adopted cut puts a visible recipe with a constrained launch declaration in
each target repo; raw unit or container-runtime templates are rejected. The
operator binding selects the workload driver, which alone lowers that launch
declaration into process-manager configuration.
Idunn operator bindings own the admitted ref, runner/container image and
affordances, host paths, secrets, routing endpoint, rollout, retention, and
desired replica placement. A sealed plan and release publish only Expected.
@ -159,9 +162,12 @@ Integrate the landed recipe, binding, plan, release, Expected, activation,
presence, and write-lease contracts into Idunn's main control plane and narrow
Git, runner, workload, lease/fencing, route, CultCache, and CultMesh drivers.
Keep target semantics in visible Ghostlight and Connector recipes and fleet
affordances in Idunn-owned bindings. Require Expected plus Idunn-observed
activation plus service-signed Present; grant the process lease before writable
state opens; require Odin-correlated Ready before stable route membership moves.
affordances in Idunn-owned bindings. The narrow Idunn source driver must prove
the selected commit, tree, recipe, and Gitlinks; deterministic plan validation
does not establish ancestry, signatures, or object custody. Require Expected
plus Idunn-observed activation plus service-signed Present; grant the process
lease before writable state opens; require Odin-correlated Ready before stable
route membership moves.
Deploy the Connector and then Ghostlight through that contract. Runtime restart,
route continuity, signed health, exact receipts, exclusive world-v2 state, and

27
notes/ghostlight-current-system-map.md
View file

@ -830,13 +830,14 @@ Starfire writer is stopped; its process and tunnel are no longer live
authority. The migration copied campaign and Session Zero stores while
preserving Yggdrasil's native mesh and provider-health identities.
Local CultMesh publication and HTTP readiness do not wait for Odin. Remote
replication is coalesced into one asynchronous RUDP batch. Odin's coordinator
is healthy on Yggdrasil and owns RUDP discovery at `10.77.0.1:17871`; Idunn
admits signed Ghostlight health and owns same-release continuity independently
of its deployment brake. VoidBot's canonical MCP service is local to the host
at `127.0.0.1:17875/mcp`, so live retrieval no longer depends on a Starfire
reverse tunnel.
The pre-rebuild hosted body published local CultMesh and HTTP readiness without
waiting for Odin; that legacy health admission is teardown evidence, not the
new runtime contract. Under the landed contracts, an activation becomes current
only after Idunn's workload driver observes the exact native process and
artifact. Present requires that activation plus service-signed presence health;
Odin alone correlates Ready. Idunn continuity and deployment actuation have not
yet been integrated with this contract. VoidBot's canonical MCP service remains
separately owned and is not a deployment authority.
### Deployment, discovery, and adjacent capacity
@ -846,12 +847,12 @@ either organ a campaign write path. Current release identity for Idunn, Odin,
Heimdall, Bifrost, and Epiphany is operational truth in `gamecult-ops`; do not
copy it here and let it fossilize again.
Release admission is based on the newest executable- or build-affecting commit
reachable from the admitted ref. Documentation, notes, state receipts, and
root Markdown are not executable release selectors. The root actuator proves
that the selected commit is an ancestor of the admitted ref before activation,
then verifies the exact installed witness. Documentation and state-only commits
therefore cannot displace the live executable.
The landed deterministic foundation retains the exact selected commit, source
tree, recipe blob, and Gitlink facts. Shape validation is not proof of Git
ancestry, signatures, or object custody. Those proofs belong to the narrow
Idunn-owned source driver, which must read the canonical ref and exact objects
as the Idunn identity before compiling a consequential plan. That source driver
and Idunn main integration remain absent.
Heimdall publishes four redacted typed discovery records to Odin under globally
unique catalog keys:

7
notes/ghostlight-implementation-plan.md
View file

@ -189,6 +189,13 @@ runtime activation, service-signed Present health, and process-bound write
leases. Idunn main integration and the Git, runner, workload, lease/fencing,
route, CultCache, and CultMesh drivers are not implemented yet.
Targets own constrained launch declarations, never raw unit or container
templates. The operator binding selects the workload driver, which alone lowers
that declaration into process-manager configuration. Likewise, deterministic
plan validation retains exact commit, tree, recipe, and Gitlink facts but proves
neither ancestry, signatures, nor object custody; the narrow Idunn-owned source
driver must establish those facts before actuation.
The integrated path must publish Expected from the sealed plan and release,
record Idunn's observation of the exact runtime activation, and require the
service's signed Present health. A stateful candidate receives its process-bound