Record pass 10 and close step 6 of the plan
The consumer-api doc is the live contract for the landed ingress; the ontology's Current mechanism runs through pass 10 and its follow-ups; the mvp doc names the live authority answer; the plan's step 6 is complete with the outbound consumer response as the next seam; the map and handoff carry the series-complete state, the world-v3 generation, and the decisions the operator owns; one evidence record distils the ten passes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Meta Vens
parent
8173c9cb77
commit
842b5af4ee
10 changed files with 336 additions and 232 deletions
|
|
@ -78,10 +78,15 @@ The only mutation input is a `CommandEnvelope` containing:
|
|||
- one closed command body;
|
||||
- exact evidence references where the command depends on source material.
|
||||
|
||||
The caller supplies identity evidence, not an authority verdict. The kernel
|
||||
derives a `MutationAuthorityEnvelope` from canonical membership, lifecycle,
|
||||
subject authority, external-owner grants, and the command kind. Callers cannot
|
||||
grant themselves scope by serializing a persuasive envelope.
|
||||
The caller supplies identity evidence, not an authority verdict. For a patch
|
||||
command the kernel derives the caller's authority itself:
|
||||
`require_patch_author` reads the caller and committed state to decide who may
|
||||
submit `AdmitPatch` and what ground it holds (the world owner unconfined, an
|
||||
elaborator confined to a jurisdiction, or a consumer confined to the subjects
|
||||
it controls), and `confine_to_ground` checks every declaration and operation
|
||||
in the candidate patch against that ground before it is admitted. Callers
|
||||
cannot grant themselves scope by serializing a persuasive envelope; the
|
||||
kernel derives it from state it already committed.
|
||||
|
||||
Interpreters and operational agents submit the same typed commands through
|
||||
narrower schemas. Narrative Personas never see those schemas or tools. No
|
||||
|
|
@ -189,8 +194,13 @@ A subject is a stable identity with a declared kind:
|
|||
|
||||
- person;
|
||||
- institution;
|
||||
- autonomous population;
|
||||
- external subject mirror.
|
||||
- autonomous population.
|
||||
|
||||
An externally controlled mirror is not a fourth kind. It is an ordinary
|
||||
subject of one of these three whose `ControllerAssignment` is
|
||||
`ExternallyControlled { consumer }`: no controller ID, no controller mode, no
|
||||
decision opportunity, and no affordance, mutable only through its own
|
||||
consumer and the world owner.
|
||||
|
||||
Demographic descriptors and statistical aggregates are not automatically
|
||||
subjects. A canonical action owner is derived structurally from an active
|
||||
|
|
@ -250,7 +260,8 @@ The reducer validates only structural promises:
|
|||
- knowledge additions cite an existing accessible fact or a newly admitted
|
||||
evidenced fact;
|
||||
- population slices are disjoint beneath their declared parent;
|
||||
- external-owned components can change only through their admitted owner;
|
||||
- an externally controlled subject's components can change only through its
|
||||
own consumer, confined by `PatchGround::Consumer`;
|
||||
- a batch either reduces completely or not at all.
|
||||
|
||||
Interestingness, novelty, ideological distribution, prose style, and counts do
|
||||
|
|
|
|||
|
|
@ -1,123 +1,189 @@
|
|||
# Ghostlight World Consumer API
|
||||
|
||||
Status: drift. Names `CampaignRegistry`, `WorldSeed`, and `publish_session_zero`,
|
||||
which do not exist in the sealed kernel. Pending rewrite against
|
||||
`docs/architecture/ghostlight-world-ontology.md`; read for consumer-boundary
|
||||
intent only. Pass 10 owns the rewrite and carries four debts the ingress must
|
||||
settle before a consumer patch can reach `AdmitPatch`: caller authority (which
|
||||
`CallerId` a consumer lowers to), decode-time size bounds on the patch,
|
||||
phase (Draft seed versus Active elaboration), and boundary answering (an
|
||||
Active consumer patch that declares must answer a derived boundary like any
|
||||
other author). The transport is one typed inbound document over a second loopback route
|
||||
beside `POST /cultnet/snapshot`, carrying the patch as a nested
|
||||
canonical-msgpack byte frame bounded before any item deserializes; it is
|
||||
not a fifth `execute_world` operation literal and not an organ of the
|
||||
outbound mesh publisher.
|
||||
Status: this describes the landed pass-10 consumer ingress — a world's third
|
||||
patch author, reaching `AdmitPatch` through one loopback-bound typed document.
|
||||
|
||||
## Objective
|
||||
|
||||
Let a consumer supply and observe one persistent Ghostlight world without
|
||||
becoming part of Ghostlight's runtime. Session Zero compilation and external
|
||||
world authoring are two producers of the same admitted seed. Delvehold is the
|
||||
first demanding consumer; no Delvehold identifier, schema, or policy is core
|
||||
authority.
|
||||
Let an external consumer author and observe the exact subjects a Ghostlight
|
||||
world has admitted as its mirrors, without becoming part of Ghostlight's
|
||||
runtime and without the world learning the consumer's vocabulary. A
|
||||
consumer-authored seed and a compiled seed are the same `AdmitPatch`; there is
|
||||
no separate seed type, registry, or publication handoff. Delvehold is the
|
||||
first consumer; no Delvehold identifier, schema, or policy is core authority
|
||||
(`docs/architecture/delvehold-forced-ontology-integration.md` names the
|
||||
profile-side binding).
|
||||
|
||||
## Authority map
|
||||
|
||||
- **Seed admission owner:** `CampaignRegistry` validates one `WorldSeed` and
|
||||
commits it with one `WorldSeedAdmission` and receipt. Producer-specific
|
||||
documents may join that transaction but cannot create another publication
|
||||
path.
|
||||
- **World owner:** `WorldKernel` owns every admitted campaign revision and all
|
||||
simulation state.
|
||||
- **External-subject owner:** `ExternalSubjectAuthority` binds one exact
|
||||
consumer owner to one exact subject. The subject remains a visible target but
|
||||
receives no Ghostlight Persona turn and cannot act through a strategic cell.
|
||||
- **Consumer owner:** the consumer decides whether a Ghostlight proposal changes
|
||||
its own domain. Its acknowledgement records admission or refusal but cannot
|
||||
rewrite Ghostlight state.
|
||||
- **Inputs:** a consumer-neutral seed, producer and payload digests, exact
|
||||
authority descriptors, normalized external-institution snapshots, and
|
||||
proposal acknowledgements.
|
||||
- **Outputs:** seed-admission receipts, revisioned snapshot receipts, attributed
|
||||
external proposals, and immutable proposal acknowledgements.
|
||||
- **Derived state:** Session Zero publication documents, consumer bindings,
|
||||
network messages, schema catalogs, and UI projections own no canonical world
|
||||
state.
|
||||
- **Forbidden writers:** seed producers, adapters, models, arenas, transport,
|
||||
and acknowledgements cannot write a campaign row directly.
|
||||
- **Shared paths:** compiler and consumer seeds lower to one registry/store
|
||||
transaction. Strategic waves continue through the existing WorldKernel
|
||||
command and atomic commit path.
|
||||
- **Cut line:** `publish_session_zero` no longer owns campaign creation. It is a
|
||||
producer-specific wrapper around generic seed admission. Ghostlight never
|
||||
switches on `greathold` or a `delvehold.*` schema.
|
||||
- **Admission owner:** `require_patch_author` (`world/mod.rs`) decides which
|
||||
caller may submit `AdmitPatch` and returns that caller's `PatchGround`;
|
||||
`confine_to_ground` decides what a confined ground may write. Both run in
|
||||
`reduce`'s `AdmitPatch` arm and again in `apply_effect`'s `PatchAdmitted`
|
||||
arm — there is no second confinement function and no way for a patch to
|
||||
commit without being re-decided.
|
||||
- **Consumer ground:** `PatchGround::Consumer(ConsumerId)` is derived, never
|
||||
carried. The set of subjects a consumer may write is
|
||||
`{ s | controller_assignments[s] == ExternallyControlled { consumer } }`,
|
||||
read from committed state at decision time. A consumer cannot name its own
|
||||
scope on the wire, and revoking a binding in a later commit shrinks its
|
||||
authority with no ingress change.
|
||||
- **Caller minting:** `WorldMailbox::submit_consumer` (`world/mailbox.rs`) is
|
||||
the only constructor of `AuthenticatedCaller::verified_system(SystemCapability::Consumer { consumer })`.
|
||||
- **Ingress owner:** `world/consumer.rs` owns decoding a document, bounding
|
||||
it, authenticating the consumer, one port call, and one receipt
|
||||
projection. It owns no world truth, holds no opinion about a patch's
|
||||
content, and does not pre-validate — a second reducer here could disagree
|
||||
with the kernel's, so structure is decided once, by `resolve_patch`.
|
||||
- **Port:** `ConsumerPort` (`world/mailbox.rs`) has one method,
|
||||
`submit_consumer`. It cannot read the world: it does not select an answer,
|
||||
does not pre-validate, and returns a receipt rather than state.
|
||||
|
||||
## Typed flow
|
||||
|
||||
```text
|
||||
producer seed
|
||||
-> WorldSeed + WorldSeedAdmission
|
||||
-> CampaignRegistry validation
|
||||
-> one empty-store CultCache transaction
|
||||
-> WorldKernel runtime
|
||||
|
||||
consumer-owned state
|
||||
-> consumer adapter
|
||||
-> ExternalSubjectSnapshot (institution or Gestalt projection)
|
||||
-> authority, digest, revision, and idempotency validation
|
||||
-> WorldKernel atomic campaign commit
|
||||
-> ExternalSnapshotReceipt
|
||||
|
||||
strategic action directed at an external subject
|
||||
-> WorldKernel strategic-wave validation
|
||||
-> attributed ExternalWorldProposal persisted with the wave
|
||||
-> consumer reads proposal and decides locally
|
||||
-> ExternalProposalReceipt records accept, partial accept, or reject
|
||||
-> any realized consumer change returns later as a fresh snapshot
|
||||
ConsumerPatchDocument (canonical MessagePack)
|
||||
-> ConsumerRegistry: name -> ConsumerId, secret verified against a
|
||||
stored SHA-256 digest in constant time
|
||||
-> patch::decode_patch, bounded by MAX_PATCH_BYTES / _DECLARATIONS /
|
||||
_OPERATIONS / _EVIDENCE
|
||||
-> WorldMailbox::submit_consumer(world_id, expected_revision, command_id,
|
||||
consumer, answers, patch)
|
||||
-> reduce / apply_effect: require_patch_author, the answer rule,
|
||||
confine_to_ground
|
||||
-> ConsumerReceiptDocument: one atomic verdict — a commit reference or
|
||||
the complete mismatch set
|
||||
```
|
||||
|
||||
`command_id` and `world_id` on the receipt are `Option`: a frame that fails to
|
||||
decode or names an unregistered consumer never derives a command key or reads
|
||||
a world, so the receipt has none to report. The outbound half of this
|
||||
contract — a consumer reading its own projection, or receiving an
|
||||
attributed proposal — is not part of this pass; see "Not in this pass" below.
|
||||
|
||||
## Transport
|
||||
|
||||
The API uses typed CultNet operation requests over Ghostlight's existing RUDP
|
||||
server. Seed admission, external snapshots, proposal reads, and proposal
|
||||
acknowledgements use MessagePack payloads and typed receipts. The service is
|
||||
loopback-only until CultMesh authority leases and secure remote admission are
|
||||
implemented. HTTP and Eve remain player/product projections, not the world
|
||||
consumer boundary.
|
||||
`POST /cultnet/world-patch`, declared beside `/cultnet/snapshot` in
|
||||
`api_router` (`runtime.rs`). The handler gates loopback and content type
|
||||
(`application/msgpack`) exactly as the snapshot route does, then hands the
|
||||
body to `world::consumer::admit_document`; everything past those two gates is
|
||||
`world/consumer.rs`'s to decide. The body limit is
|
||||
`CONSUMER_BODY_LIMIT = patch::MAX_PATCH_BYTES + CONSUMER_ENVELOPE_SLACK` (an
|
||||
8 KiB envelope allowance over the 256 KiB patch cap), so the transport guard
|
||||
cannot become a second opinion about how big a patch may be.
|
||||
|
||||
## Invariants
|
||||
The document and receipt are Ghostlight-owned typed records in canonical
|
||||
MessagePack, not CultNet control messages, pinned to two schema constants:
|
||||
|
||||
- The public seed shape excludes runtime revision, transcript, pending work,
|
||||
cover state, and other already-authoritative campaign fields.
|
||||
- The seed digest binds the exact normalized seed. A campaign ID cannot be
|
||||
republished from another digest.
|
||||
- An external authority names one existing institution or Gestalt subject and
|
||||
one owner. Its secret is persisted only as SHA-256.
|
||||
- External subjects are active graph targets but never simulation-eligible.
|
||||
- A snapshot replaces only the exact externally owned institution or Gestalt projection.
|
||||
It cannot create subjects, routes, actors, Gestalts, relations, or private
|
||||
knowledge.
|
||||
- Source revisions increase monotonically. Exact idempotent replay returns the
|
||||
original receipt; conflicting replay changes nothing.
|
||||
- Outbound proposals remain attributed to an exact Ghostlight subject and exact
|
||||
target. An arena never becomes the proposer.
|
||||
- Proposal acknowledgement is not a Ghostlight world mutation. Realized effects
|
||||
return through a later snapshot.
|
||||
- Dungeon campaigns keep their player actor, membership, contract, and Session
|
||||
Zero documents. Their adversarial play path does not depend on a consumer.
|
||||
```text
|
||||
CONSUMER_PATCH_SCHEMA = "ghostlight.consumer_patch.v0"
|
||||
CONSUMER_RECEIPT_SCHEMA = "ghostlight.consumer_receipt.v0"
|
||||
```
|
||||
|
||||
## First acceptance
|
||||
`ConsumerPatchDocument` carries `schema`, `world_id`, `consumer` (a
|
||||
configured name, lowered to a `ConsumerId` by the registry and never carried
|
||||
further), `secret`, `idempotency_key`, `expected_revision`, `answers:
|
||||
Option<PatchAnswer>`, and `patch: Vec<u8>` — the encoded `WorldPatch` as a
|
||||
nested canonical-MessagePack byte frame rather than an inline value, so
|
||||
`MAX_PATCH_BYTES` is checked against the patch itself before any of its items
|
||||
deserializes. The outer document is decoded first, is tiny, and is bounded by
|
||||
the route's derived limit.
|
||||
|
||||
1. Session Zero and a consumer-authored fixture persist the same generic seed
|
||||
admission and receipt types.
|
||||
2. A configured external institution never receives a strategic cell or
|
||||
Persona action.
|
||||
3. Wrong owner, wrong secret, stale source revision, digest conflict, and stale
|
||||
world revision leave campaign state unchanged.
|
||||
4. A valid snapshot advances the campaign once and returns an idempotent typed
|
||||
receipt.
|
||||
5. A strategic action aimed at the external institution emits one attributed
|
||||
proposal in the same atomic wave commit.
|
||||
6. Consumer acknowledgement cannot mutate the campaign and can be replayed
|
||||
idempotently.
|
||||
`mesh.rs`'s advertisement gains the two schema constants and nothing else:
|
||||
this door is loopback-bound, so it is not a remotely reachable surface and
|
||||
advertising it as one would claim availability the binary does not have.
|
||||
|
||||
## Idempotency and staleness
|
||||
|
||||
`expected_revision` is required; the port submits through
|
||||
`submit_authenticated`, not the stamped path, because a caller that cannot
|
||||
name the revision it built against cannot be told its batch is stale. The
|
||||
idempotency ledger is checked before the revision, so an exact resubmission
|
||||
still returns the original receipt (`AlreadyApplied`) even after the world has
|
||||
moved; a stale document is `RevisionMismatch { expected, actual }`, and the
|
||||
receipt carries the live revision so the consumer knows what to build against
|
||||
next. `CommandId::derived` computes the command key from `(world, consumer,
|
||||
idempotency_key)`; the same key with a different body is
|
||||
`CommandIdConflict`, and nothing commits.
|
||||
|
||||
There is no receipt-probe request and no separate mailbox `Request` variant
|
||||
for it. A consumer's document is byte-identical on retry and its `CommandId`
|
||||
is derived, so resubmission is the probe and the ledger answers it directly.
|
||||
|
||||
## The externally controlled subject
|
||||
|
||||
A subject declared `NewController::External { consumer }` receives
|
||||
`ControllerAssignment::ExternallyControlled { consumer }`. It mints no
|
||||
controller ID and no controller mode — both accessors return `Option` for it,
|
||||
and every reader fails closed rather than assuming a default. Concretely:
|
||||
|
||||
- it derives no decision opportunity and mints no turn;
|
||||
- it is excluded from `agency_graph` and so from the cover;
|
||||
- it is visible in the snapshot as an ordinary subject, related to, targeted,
|
||||
and counted like any other, with `controller_id: None` and
|
||||
`controller_mode: None`;
|
||||
- it may hold no affordance — declaring it with a non-empty affordance grant
|
||||
set is `Mismatch::ControllerGrantMismatch`, and the pairing is checked both
|
||||
ways (an ordinary subject with an empty grant set is the same mismatch);
|
||||
- its components change through exactly two callers: its own consumer, and
|
||||
the world owner, who is unconfined and always could write it — that is the
|
||||
owner's standing authority, not a leak in the consumer boundary.
|
||||
|
||||
## Confinement
|
||||
|
||||
A consumer writes only the subjects bound to it and operations grounded on
|
||||
those subjects (`confine_to_ground`, the `PatchGround::Consumer` arm):
|
||||
|
||||
- a declared subject is admitted only if its controller names the same
|
||||
consumer; position is unconfined;
|
||||
- a declared place, a declared route, `Relocate`, `OpenRoute`, `CloseRoute`,
|
||||
and `AlterCost` are always refused — they carry a place or a route, and a
|
||||
consumer's ground names no place;
|
||||
- a `Claimed { by }` fact must name a bound subject; a `Canonical` fact
|
||||
declaration is refused outright — a consumer's evidence buys an `Admit`
|
||||
into its own custody and a `Claimed` fact, never a canonization;
|
||||
- a channel's reach and controller must all be bound subjects;
|
||||
- every operation's ground subjects must be bound, and its place and route
|
||||
lists must be empty — `Transfer` therefore requires both endpoints bound,
|
||||
so a consumer cannot push custody into a Ghostlight subject; `Admit` and
|
||||
`Consume` work inside its own custody.
|
||||
|
||||
In Active phase a consumer patch that declares answers nothing except a
|
||||
`CausalBoundary::MissingStructure { subject }` derived on one of its own
|
||||
mirrors — the world noticing that a subject it can see has structure it
|
||||
cannot account for. Every other Active declaration is refused by the answer
|
||||
rule plus this confinement, not by a separate phase gate: a consumer cannot
|
||||
answer a boundary on a foreign subject (not covered), cannot answer a
|
||||
`Deficit` row (deficits are jurisdictional; a consumer holds no
|
||||
jurisdiction), and cannot declare without an answer. A component-only batch —
|
||||
the overwhelming majority of consumer traffic — answers nothing and commits
|
||||
through the same `require_answer` path as any other author.
|
||||
|
||||
## Operator configuration
|
||||
|
||||
`ConsumerRegistry` is loaded once at startup from the file named by
|
||||
`GHOSTLIGHT_CONSUMER_CREDENTIALS`: one `name = <64 hex digits>` line per
|
||||
consumer (the SHA-256 of that consumer's shared secret), blank lines and `#`
|
||||
comments ignored. A missing file means no consumers, and every document is
|
||||
`Unauthenticated`, the fail-closed default that lets this route exist before
|
||||
an operator configures anything. A file that exists but does not parse is
|
||||
fatal at startup, so a mistyped credential can never read as "no consumers". The registry holds only digests; the
|
||||
plaintext secret never enters the process image beyond the hash and never
|
||||
enters a log, a receipt, or the journal.
|
||||
|
||||
## Deployment
|
||||
|
||||
The consumer capability's tag is part of the commit digest and the
|
||||
externally controlled assignment is part of the state shape, so both bump the
|
||||
schema: state schema `ghostlight.world_state.consumer.v1` (state-schema
|
||||
generation `world-v3`), commit schema `ghostlight.world_commit.consumer.v1`.
|
||||
A store written under an earlier schema is refused, not migrated.
|
||||
|
||||
## Not in this pass
|
||||
|
||||
- The outbound consumer response — a consumer reading its own projection, or
|
||||
receiving an attributed proposal about a Ghostlight subject acting toward
|
||||
its mirror. This is the next seam; building it prematurely would grow a
|
||||
second projection owner ahead of its use.
|
||||
- A CultMesh authority lease for a non-loopback consumer. Until that exists,
|
||||
this route is loopback-only and offers a consumer no remote door.
|
||||
|
|
|
|||
|
|
@ -35,9 +35,9 @@ not from a model agreeing that the world is deep.
|
|||
|
||||
## Current mechanism
|
||||
|
||||
Passes 1 through 9 of the widening are landed (`5e53beb`, `e99af63`,
|
||||
Passes 1 through 10 of the widening are landed (`5e53beb`, `e99af63`,
|
||||
`d2805fe`, `0f21a49`, `dbe176d`, `cb6a126`, `1852ddd`, `3ed3868`,
|
||||
`8aebfb6`). The sealed kernel holds subjects with a label and a
|
||||
`8aebfb6`, `b4d1943`). The sealed kernel holds subjects with a label and a
|
||||
kind (`Person | Institution | Population`); a `positions` partition with
|
||||
`Position`; entities with `container` under containment acyclicity; `Route`
|
||||
as an `EdgeRecord` variant carrying `AccessKind { Public, Restricted }`, a
|
||||
|
|
@ -172,7 +172,7 @@ head, rotates the remaining subjects through singleton cells by debt, and
|
|||
packs the rest into grouped cells by connected component of the agency graph
|
||||
(scheduler-only; reachable from no prompt builder). `Cell`, `Cover`,
|
||||
`CellId`, `Resolution`, `TickIndex`, and `AgencyGraph` are derived and
|
||||
disposable; the only durable trace of a tick is the `controller_work.v8` row
|
||||
disposable; the only durable trace of a tick is the `controller_work.v9` row
|
||||
(`ControllerWork::Grouped`), custody-separate from world custody. A grouped
|
||||
cell is one inference over partitioned per-constituent views returning zero
|
||||
or one attributed proposal per constituent; declines are submitted first and
|
||||
|
|
@ -183,16 +183,44 @@ Cell and constituent command ids are sha256-derived. The runtime's
|
|||
the bounded concurrency permit pool, the quarantine flag, and the clock,
|
||||
which advances after the cells so every cell in a tick shares one `now`.
|
||||
|
||||
`AdmitPatch` has a third author: `CallerId::System(SystemCapability::Consumer
|
||||
{ consumer })`, minted only by `WorldMailbox::submit_consumer` after the
|
||||
consumer ingress (`world/consumer.rs`) has authenticated a document against a
|
||||
configured secret digest. `require_patch_author` and `confine_to_ground`
|
||||
widen from jurisdiction-only to `PatchGround { Jurisdiction(JurisdictionKey),
|
||||
Consumer(ConsumerId) }`; a consumer's ground is derived from
|
||||
`controller_assignments` at decision time, never carried on the wire, and
|
||||
confines it to the subjects it controls, with no place, route, or `Canonical`
|
||||
fact ever inside that ground. A subject declared
|
||||
`NewController::External { consumer }` receives
|
||||
`ControllerAssignment::ExternallyControlled { consumer }`: it mints no
|
||||
controller ID or mode (both accessors are `Option`), derives no opportunity,
|
||||
is excluded from `agency_graph` and the cover, and may hold no affordance
|
||||
(`admit_resolved`'s controller-shaped pairing rejects a non-empty grant set as
|
||||
`Mismatch::ControllerGrantMismatch`). It remains an ordinary subject in the
|
||||
snapshot, related to and targeted like any other, mutable only through its
|
||||
own consumer and the always-unconfined world owner. `patch::decode_patch` is
|
||||
the one decode bound for both the elaboration lane and the consumer lane,
|
||||
under four caps — `MAX_PATCH_BYTES`, `MAX_PATCH_DECLARATIONS`,
|
||||
`MAX_PATCH_OPERATIONS`, `MAX_PATCH_EVIDENCE` — and the consumer document
|
||||
travels over two wire schema constants, `CONSUMER_PATCH_SCHEMA` and
|
||||
`CONSUMER_RECEIPT_SCHEMA`, both `.v0`. The state and commit schemas bump to
|
||||
`ghostlight.world_state.consumer.v1` and `ghostlight.world_commit.consumer.v1`
|
||||
(state-schema generation `world-v3`); a store written under an earlier schema
|
||||
is refused, not migrated.
|
||||
|
||||
Opportunities bind to a `ScopeDigest` over one `scope_components` owner
|
||||
(controller assignment, grants, delegated grants, own authority, position,
|
||||
incident routes, own holdings, own dependencies, known fact ids, controlled
|
||||
channels, own commitments; never `now`, occupancy, forum state, or another
|
||||
subject's knowledge); a proposal commits at any later revision with unchanged scope and is
|
||||
rejected with `KernelError::ScopeChanged` otherwise. State schema is
|
||||
`world_state.elaboration.v1`, commit schema `world_commit.elaboration.v1`,
|
||||
controller work `controller_work.v8`; earlier stores are refused. Ghostlight owns a conserved narrative ledger;
|
||||
`ghostlight.world_state.consumer.v1`, commit schema
|
||||
`ghostlight.world_commit.consumer.v1`, controller work `controller_work.v9`;
|
||||
earlier stores are refused. Ghostlight owns a conserved narrative ledger;
|
||||
Delvehold owns the economy (`delvehold-forced-ontology-integration.md`).
|
||||
Pass 10 adds the consumer ingress.
|
||||
Step 6 of the plan is complete; the outbound consumer response is the next
|
||||
seam.
|
||||
|
||||
## The failure this vocabulary is designed against
|
||||
|
||||
|
|
@ -265,12 +293,15 @@ resolver, or reconciler is needed.
|
|||
Three namespaces, three newtypes, issued only by the reducer.
|
||||
|
||||
```text
|
||||
SubjectId person, institution, population, external mirror — can decide
|
||||
SubjectId person, institution, population — can decide
|
||||
EntityId place, resource, fact, channel — cannot decide
|
||||
EdgeId route, relation, commitment, pressure — connects the above
|
||||
```
|
||||
|
||||
Display names are labels. They never resolve a reference or bind structure.
|
||||
An externally controlled mirror is an ordinary subject of one of these three
|
||||
kinds; what is external is its `ControllerAssignment`
|
||||
(`ExternallyControlled { consumer }`), not a fourth `SubjectKind`.
|
||||
|
||||
## Components
|
||||
|
||||
|
|
@ -373,7 +404,8 @@ The reducer checks only these:
|
|||
- knowledge additions cite an accessible or newly evidenced fact;
|
||||
- communication reaches only subjects inside the channel's reach set;
|
||||
- population slices are disjoint beneath their declared parent;
|
||||
- externally owned components change only through their admitted owner;
|
||||
- an externally controlled subject's components change only through its own
|
||||
consumer, confined by `PatchGround::Consumer`;
|
||||
- the patch produces at least one canonical change.
|
||||
|
||||
Interestingness, novelty, political diversity, name quality, prose quality, and
|
||||
|
|
|
|||
|
|
@ -225,98 +225,79 @@ outcome bands, four derived `CausalBoundary` kinds, scope-digest binding, one
|
|||
are teardown evidence. Plan step 6 is nine implementation passes; pass 1 is
|
||||
landed, passes 2 through 9 are not.
|
||||
|
||||
1. Passes 1 through 9 are integrated; the ontology widening machine is
|
||||
complete and only pass 10 (consumer ingress) remains in step 6.
|
||||
`codex/ghostlight-dungeon-mvp` tip is `8aebfb6` (Soul) over `f013c1d`
|
||||
and `71d8c53` (Hands, pass 9), on `7dbbc81` (pass-8 docs and handoff) and
|
||||
`b5443d5` (pass-8 follow-ups). Earlier passes: `5e53beb`, `e99af63`,
|
||||
`d2805fe`, `0f21a49`, `dbe176d`, `cb6a126`, `1852ddd`, `3ed3868`. The
|
||||
push follows a background crate test and the branch read `ahead 3` at
|
||||
the time of writing; `git status -sb` is the witness.
|
||||
1. Plan step 6, the ontology widening, is complete: all ten passes are
|
||||
integrated on `codex/ghostlight-dungeon-mvp`. Tip is `a1fd645` (Soul)
|
||||
over `b4d1943` (pass 10 machine) and `e0c6f9c` (patch author widened to
|
||||
a confined external consumer), on `1203aa3` (pass-9 docs and handoff) and
|
||||
`962f711` (intra-tick quarantine race closed). Pass tips in order:
|
||||
`5e53beb`, `e99af63`, `d2805fe`, `0f21a49`, `dbe176d`, `cb6a126`,
|
||||
`1852ddd`, `3ed3868`, `8aebfb6`, `a1fd645`. The push follows a
|
||||
background crate test and the branch read `ahead 3` at the time of
|
||||
writing; `git status -sb` is the witness. The series is distilled as one
|
||||
evidence record dated 2026-09-05 in `state/evidence.jsonl`.
|
||||
|
||||
Pass 9 facts: new module `world/cover.rs` (`TickIndex`, `Resolution`,
|
||||
`CellId`, `Cell`, `Cover`, `CoverBudget`, `AgencyGraph`, `derive_cover`);
|
||||
`ControllerWork::Grouped` with `GroupedCheckpoint`;
|
||||
`InferencePurpose::GroupedAgent`; owner-only `Request::AgencyGraph`,
|
||||
port-narrowed rather than principal-authenticated; the runtime task
|
||||
`drive_cover_tick` (`runtime.rs`) is the single owner of tick cadence,
|
||||
cover derivation, and the clock, and advances the clock after the cells
|
||||
(the pass-7 `advance_world_clock` task is gone, verified absent from
|
||||
source); a `Semaphore` plus `AtomicBool` quarantine replaced the
|
||||
controller mutex; environment `GHOSTLIGHT_COVER_CELL_BUDGET`,
|
||||
`GHOSTLIGHT_COVER_CONSTITUENT_CAP`, `GHOSTLIGHT_COVER_URGENCY_SLOTS`,
|
||||
`GHOSTLIGHT_CONTROLLER_MAX_CONCURRENT`, `GHOSTLIGHT_TICK_INTERVAL_SECONDS`;
|
||||
`controller_work.v8`; world state and commit schemas stay at
|
||||
`elaboration.v1`; no `Cargo.toml` change and no `uuid/v5`, verified.
|
||||
Rulings adopted: fairness is ceil(N/R) with R = cells minus urgency
|
||||
slots, verified at the 2,400/240 profile to close in 22 ticks, not 21;
|
||||
the constituent cap yields for two reasons, capacity and packing, while
|
||||
the cell budget never yields and oversubscribed is the signal; the cover
|
||||
is pure and the attention order is a real input; coupled constituents in
|
||||
a grouped cell contend and the second act is honestly refused with
|
||||
`ScopeChanged`, and the grouping heuristic stays; the open operator
|
||||
decision is whether to allow a bounded in-tick re-submission for a
|
||||
refused constituent, to be taken with the submitted-versus-committed
|
||||
number in hand. The owner-only Eve `world.run_tick` command is not built;
|
||||
its authority decision is pending. Baseline at `8aebfb6`: 283 test
|
||||
functions in `world/*.rs`, 323 crate source, plus one integration test
|
||||
(the focused `world::` run reports 282 / 318; different counting rules,
|
||||
compare like with like).
|
||||
What the kernel is now: twelve decision-constraining component kinds
|
||||
over twenty-seven named operations under one `WorldPatch`, one reducer,
|
||||
one CAS commit, one decode bound for both authoring lanes
|
||||
(`patch::decode_patch` with `MAX_PATCH_BYTES`, `MAX_PATCH_DECLARATIONS`,
|
||||
`MAX_PATCH_OPERATIONS`, `MAX_PATCH_EVIDENCE`; the `MAX_DRAFT_*` bounds
|
||||
are deleted), and three confined `SystemCapability` arms: `Clock`,
|
||||
`Elaborator { jurisdiction }`, `Consumer { consumer }`. Pass 10 added
|
||||
`world/consumer.rs`; `PatchGround { Jurisdiction, Consumer }` with
|
||||
`confine_to_ground` as the one confinement function (renamed from
|
||||
`confine_to_jurisdiction`); `ControllerAssignment::ExternallyControlled
|
||||
{ consumer }`, with `id()` and `mode()` now `Option` and every reader
|
||||
failing closed; `Mismatch::ControllerGrantMismatch` replacing
|
||||
`NoAffordances`; `CommandId::derived` shared by `session_command_id`;
|
||||
`ConsumerPort` (one method) in `world/mailbox.rs` and
|
||||
`WorldMailbox::submit_consumer`; route `POST /cultnet/world-patch`,
|
||||
loopback, msgpack, `CONSUMER_BODY_LIMIT`; `ConsumerRegistry` loaded from
|
||||
the file named by `GHOSTLIGHT_CONSUMER_CREDENTIALS`, digests only.
|
||||
Schemas are `world_state.consumer.v1` / `world_commit.consumer.v1`;
|
||||
`controller_work.v9`; `STATE_SCHEMA_GENERATION` in
|
||||
`idunn_health.rs` is now `world-v3`, so the Idunn expectation and every
|
||||
"world-v2" phrase in the deployment gate below now mean world-v3.
|
||||
Baseline at `a1fd645`: 313 test functions in `world/*.rs`, 357 crate
|
||||
source, plus one integration test (the focused `world::` run reports
|
||||
312 / 352; different counting rules, compare like with like).
|
||||
|
||||
In flight, not landed:
|
||||
- `hands/pass9-followups` in the worktree `F:\Projects\Ghostlight-pass9fu`,
|
||||
branched from `8aebfb6` with no commits yet: `with_test_ports`,
|
||||
`InferencePort`, and `ControllerWorkStore` to `pub(crate)` with spec
|
||||
test 13.12 for concurrency plus quarantine; `drive_cover_tick` behind
|
||||
narrow ports with an ordering test; `merges_are_deterministic_in_subject_order`
|
||||
retired.
|
||||
- Pass 10 design: `modeling-pass10.md` is on disk in the session
|
||||
scratchpad; `imagination-pass10.md` is being written under ten rulings,
|
||||
the load-bearing ones being: the consumer is a third `SystemCapability`
|
||||
arm confined to one externally controlled subject; externally
|
||||
controlled subjects get no opportunity and are skipped by the cover;
|
||||
one atomic verdict per document, no partial acceptance; one kernel-side
|
||||
decode bound for both lanes; transport follows the `POST
|
||||
/cultnet/snapshot` precedent, not an `execute_world` literal; a
|
||||
`ConsumerPort` as narrow as `ElaborationPort`; no Delvehold names in
|
||||
core. No pass-10 worktree exists yet.
|
||||
Main carries uncommitted coordinator edits to
|
||||
`docs/architecture/ghostlight-world-ontology.md` (pass-9 scale paragraph,
|
||||
the contention finding, and two stale claims Modeling caught: `AdmitPatch`
|
||||
has no phase gate of its own, and `EvidenceRef::new` is `pub(super)`
|
||||
bounded by `filter_evidence`, not `#[cfg(test)]`),
|
||||
`docs/architecture/ghostlight-dungeon-mvp.md` (derived state, membrane,
|
||||
tick driver and environment values), and the plan's step-6 pass-10 line.
|
||||
Witness for pass 10: main-branch `git log` past `8aebfb6`, and
|
||||
`git worktree list`.
|
||||
Rulings adopted in pass 10: no migration for the moved
|
||||
`session_command_id` derivation; `controller_work` is v9 so the refusal
|
||||
is structural; a malformed credentials file is fatal at startup
|
||||
(`open_consumer_registry` in `runtime.rs` returns the registry's error;
|
||||
a missing file still means no consumers); the outbound consumer response
|
||||
batch and a non-loopback CultMesh lease are the next seams, not this
|
||||
pass. Soul's series judgment: the eleven plan invariants hold
|
||||
structurally at the end of ten passes; the pairing invariant is
|
||||
re-decided at three gates by doctrine, not by a repair loop.
|
||||
|
||||
Pipeline for pass 10: specs `imagination-pass1.md` through
|
||||
`imagination-pass9.md` and maps `modeling-pass1.md` through
|
||||
`modeling-pass9.md` are on disk in the session scratchpad
|
||||
`C:\Users\Meta\AppData\Local\Temp\claude\F--Projects-Ghostlight\2fd50f5e-f7ba-4e5d-82bc-c7033e6074d2\scratchpad`,
|
||||
not in `state/`; if that directory is gone, regenerate the specs from
|
||||
`docs/architecture/ghostlight-world-ontology.md`. Each pass: Hands in an
|
||||
isolation worktree whose first line is `git reset --hard
|
||||
codex/ghostlight-dungeon-mvp`, then Soul in that tree, then the coordinator
|
||||
integrates with `git -C <wt> rebase -q codex/ghostlight-dungeon-mvp && git
|
||||
merge --ff-only <wt-branch> && cargo test -q -p ghostlight-dungeon --bin
|
||||
ghostlight-dungeon world:: && git push -q && git worktree remove --force
|
||||
<wt> && git branch -D <wt-branch>`, then a steward pass and the doc
|
||||
proposal. Rulings that bind Hands: pass 7 keeps `check_ledger` single-site;
|
||||
pass 8 adds no HTTP `AdmitPatch` ingress (that is pass 10, consumer
|
||||
ingress, in the plan); pass 9 must not enable `uuid/v5` and derives each
|
||||
`CommandId` via sha256 into `Uuid::from_bytes` like `derive_id`.
|
||||
The pass-10 follow-ups are landed (`8173c9c`): `controller_work.v9`;
|
||||
fatal malformed credentials; redacting `Debug` on the consumer document;
|
||||
the elaboration lane calls `check_patch_caps` so `MAX_PATCH_EVIDENCE`
|
||||
binds on both lanes; distinct item-cap refusals in the receipt; one
|
||||
duplicate test deleted. Nothing is in flight and no worktree exists.
|
||||
Docs landed with them: `ghostlight-world-consumer-api.md` rewritten
|
||||
as a live contract (no longer drift); the ontology "Current mechanism"
|
||||
through pass 10 closing with "Step 6 of the plan is complete; the
|
||||
outbound consumer response is the next seam."; the mvp doc's
|
||||
`MutationAuthorityEnvelope` and external-mirror-as-subject-kind
|
||||
corrected; the plan's step-6 pass-10 line in past tense. Queued doc
|
||||
edits: none.
|
||||
|
||||
Still deferred by design: `PolityInCausalRange`, `IndividuationRequired`,
|
||||
and Verification 13 wait for relations and population slices. Pass 10
|
||||
(consumer ingress) carries four named debts: authority, decode-time size
|
||||
bounds, phase, and boundary answering, plus the `mesh.rs` inbound ruling.
|
||||
and Verification 13 wait for relations and population slices.
|
||||
|
||||
Decisions the operator owns, recorded nowhere else durable than here and
|
||||
the series evidence record: (a) whether a refused coupled constituent may
|
||||
re-submit once inside the same tick, to be taken with the
|
||||
submitted-versus-committed number in hand; (b) the authority for an
|
||||
owner-only Eve `world.run_tick` command, which is not built; (c) whether
|
||||
the outbound consumer response batch and the non-loopback CultMesh lease
|
||||
are cut next or the deployment gate below resumes first. The ten specs
|
||||
and maps (`imagination-pass1..10.md`, `modeling-pass1..10.md`) remain in
|
||||
the session scratchpad only and are now history, not steering; the docs
|
||||
own the design.
|
||||
|
||||
Queued doc edits, coordinator-owned: the pass-9 "Current mechanism"
|
||||
paragraph, written with the follow-ups; and a config note for
|
||||
`GHOSTLIGHT_CONTROLLER_ELABORATOR_MODEL`, which no doc names yet. The
|
||||
pass-9 environment variables are in the uncommitted mvp edit (line 449)
|
||||
and the ceil(N/R) wording in the uncommitted ontology edit (line 601).
|
||||
2. First-generation world fixtures are banked and pushed, one per world, each
|
||||
with Ink, training sidecar, visual plan, lore grounding, and BFL manifest,
|
||||
reviewer-accepted except visual replay, which waits on a scene-set
|
||||
|
|
@ -374,7 +355,7 @@ continuity, route preservation, split-brain fencing, signed health, Odin-outage
|
|||
freeze, and negative legacy-authority checks must all agree before purge.
|
||||
|
||||
Deploy the Connector and then Ghostlight through that contract. Runtime restart,
|
||||
route continuity, signed health, exact receipts, exclusive world-v2 state, and
|
||||
route continuity, signed health, exact receipts, exclusive world-v3 state, and
|
||||
negative checks must agree before deleting old services, releases, state,
|
||||
acceptance roots, and local run scaffolding.
|
||||
|
||||
|
|
@ -405,7 +386,7 @@ otes aculty-workflow-lessons-2026-09-04.md`
|
|||
- Do not invoke the current bounded Connector or Ghostlight redeploy helpers;
|
||||
they fail at the root/Idunn Git boundary and still embody duplicate target
|
||||
deployment authority.
|
||||
- Do not prove world-v2 purity with a short deny list. Archive the complete old
|
||||
- Do not prove world-v3 purity with a short deny list. Archive the complete old
|
||||
state root or validate a complete allowed-path contract.
|
||||
- Keep this handoff compact. Move chronology to Git, evidence, or the frozen
|
||||
system map.
|
||||
|
|
|
|||
|
|
@ -76,7 +76,7 @@ source cutover is not deployment evidence.
|
|||
are wired to that mailbox boundary in the committed source.
|
||||
- **Cut line:** source subtraction is complete. Production cutover now belongs
|
||||
to Idunn's typed deployment path: admit the replacement release and exclusive
|
||||
world-v2 state without a dual-write or compatibility bridge, prove restart
|
||||
world-v3 state without a dual-write or compatibility bridge, prove restart
|
||||
and negative legacy authority, then remove the old hosted body and state.
|
||||
- **Verification layer:** the reducer checks exact authentication, world,
|
||||
revision, lifecycle, approver, controller, opportunity, scope, affordance,
|
||||
|
|
|
|||
|
|
@ -233,7 +233,7 @@ promote without the exact frozen Odin Ready receipt for that runtime instance
|
|||
and presence digest. Idunn never manufactures Ready locally.
|
||||
|
||||
Deploy CodexConnector first, then Ghostlight. Ghostlight's live cut archives the
|
||||
entire legacy state root, creates a clean world-v2 root, and validates a complete
|
||||
entire legacy state root, creates a clean world-v3 root, and validates a complete
|
||||
allowed live layout. After route, health, process, write lease, restart, and
|
||||
negative legacy checks agree, delete the old units, releases, state roots,
|
||||
acceptance debris, gamecult-ops target deploy programs, and local run
|
||||
|
|
@ -278,11 +278,23 @@ Implementation order, each pass landing tests before the next begins:
|
|||
singleton detail focus, grouped coarse cells with partitioned views and
|
||||
per-constituent attribution, debt rotation. Scheduler-owned; the kernel
|
||||
never sees a cell.
|
||||
10. Consumer ingress: the typed CultNet ingress through which an external
|
||||
consumer submits a `WorldPatch` or proposal to the sealed kernel. Until
|
||||
this lands the elaborator lane is the only production author of a
|
||||
`WorldPatch`, and the kernel has no decode-time bound of its own; pass 10
|
||||
gives it one owner for both lanes.
|
||||
10. Consumer ingress: landed in pass 10. `SystemCapability::Consumer` is the
|
||||
world's third `AdmitPatch` author, minted only by
|
||||
`WorldMailbox::submit_consumer` after `world/consumer.rs` authenticates a
|
||||
`ConsumerPatchDocument` against a `ConsumerRegistry` secret digest.
|
||||
`require_patch_author`/`confine_to_ground` widen to `PatchGround::Consumer`,
|
||||
confining a consumer to the subjects declared
|
||||
`NewController::External { consumer }` (`ControllerAssignment::ExternallyControlled`,
|
||||
no controller ID, no mode, no opportunity, no affordance). `patch::decode_patch`
|
||||
is the one decode bound, shared by the elaborator lane and the consumer
|
||||
lane, under `MAX_PATCH_BYTES`/`_DECLARATIONS`/`_OPERATIONS`/`_EVIDENCE`. The
|
||||
transport is `POST /cultnet/world-patch`, loopback-only, canonical
|
||||
MessagePack, schemas `ghostlight.consumer_patch.v0` and
|
||||
`ghostlight.consumer_receipt.v0`; the state/commit schemas bumped to
|
||||
`ghostlight.world_state.consumer.v1` / `ghostlight.world_commit.consumer.v1`
|
||||
(`world-v3`). The outbound consumer response — a consumer reading its own
|
||||
projection or an attributed proposal — is the next seam, not part of this
|
||||
pass.
|
||||
|
||||
The deployment cutover (step 5) is deferred behind this stage, not cancelled. No
|
||||
world acceptance run may start while Yggdrasil serves the legacy body.
|
||||
|
|
|
|||
|
|
@ -36,4 +36,5 @@
|
|||
{"note": "Ontology v2 unifies elaboration and character action under one WorldPatch and one deterministic verifier. Three decisions change future belief: (1) affordances are world-authored data (preconditions, effect slots, weighted outcome bands) over a closed 29-operation kernel set, so genre lives in the seed and the kernel never learns one; (2) uncertainty is resolved by kernel entropy seeded from world/revision/command, so no model ever chooses success, which deletes the legacy wave-level outcome resolver; (3) proposals bind to a scope digest of the components their verification reads rather than the whole state digest, so eight elaborator loops and many subjects do not serialize on one revision, replacing the stale-means-discard rule. Elaborator tools are a derived projection of the operation set and cannot drift. ghostlight-multiresolution-agency.md is demoted to teardown evidence keeping only resumable sessions, compact drafts, and the complete mismatch set.", "status": "ok", "ts": "2026-09-04T14:01:12+00:00", "type": "research"}
|
||||
{"note": "Operator correction, 2026-09-04: the 2,400-subject / 240-cell / 10% cover profile is a design target, not a load fixture. A world feels alive only when actors at every level pursue their own goals; that requires generating that detail first and then choking multiresolution simulation so attention is scarce and selection is forced. The mvp doc sentence calling the profile \"test data, not a production elaboration target\" was teardown-era text, not operator design, and is amended. Ontology v2 now carries: an authored WorldScaleIntent with a structurally counted deficit (qualified subject = active, one controller, one Goal commitment, one affordance) that elaborators pursue after boundaries; a budgeted connected cover every tick with singleton detail cells and grouped coarse cells; per-constituent attribution and partitioned knowledge in grouped cells; debt rotation. Still deleted: gestalt as canonical identity, arena knowledge union, semantic qualification and verification models, fission quotas as mutation, string identifiers.", "status": "ok", "ts": "2026-09-04T14:14:10+00:00", "type": "research"}
|
||||
{"note": "Codex CLI fan-out that must commit cannot run in a linked git worktree. A linked worktree's .git is a file pointing into the parent repo's .git/worktrees/, which is outside the Codex sandbox's writable roots, so every git commit fails with index.lock Permission denied; the default sandbox also blocks outbound push. All four world workers died on this on 2026-09-04. Fix: full clones at the same paths (F:/Projects/Ghostlight-worlds/<world>, F:/Projects/<Lore>-worktrees/ghostlight-worlds; .git is a directory despite the directory name) and launch with -c sandbox_workspace_write.network_access=true. Uncommitted worker output was banked by hand to codex/world-<world> and codex/ghostlight-worlds before the worktrees were removed. Rule for any future Codex fan-out that writes: give each worker a clone whose entire .git lives under its own writable root, and grant network if it must push.", "status": "ok", "ts": "2026-09-04T14:18:47+00:00", "type": "verification"}
|
||||
{"ts": "2026-09-04T15:04:24+00:00", "type": "verification", "status": "ok", "note": "Supersedes the 2026-09-04T14:18 clone-plus-network record, which was necessary but not sufficient. The Codex workspace-write sandbox keeps .git read-only even when the whole clone sits under the writable root, so a Codex worker can never commit or push regardless of clone layout or network grant. Rule for any Codex fan-out that must produce committed work: the worker writes files only; a supervisor outside the sandbox commits and pushes the clone after the worker exits. The world elaborator scheduler (C:/Users/Meta/.claude/worlds/Invoke-Elaborators.ps1) does this per slot to slot/<world>/<title>/<stamp> branches in both the Ghostlight world clone and the lore clone, recording completions in logs/elab-done.csv; integration into codex/world-<world> and codex/ghostlight-worlds is a separate deliberate pass. First banked fixture: Delvehold cistern-house-nine-breaker-test, codex/world-delvehold 9374fd0."}
|
||||
{"note": "Supersedes the 2026-09-04T14:18 clone-plus-network record, which was necessary but not sufficient. The Codex workspace-write sandbox keeps .git read-only even when the whole clone sits under the writable root, so a Codex worker can never commit or push regardless of clone layout or network grant. Rule for any Codex fan-out that must produce committed work: the worker writes files only; a supervisor outside the sandbox commits and pushes the clone after the worker exits. The world elaborator scheduler (C:/Users/Meta/.claude/worlds/Invoke-Elaborators.ps1) does this per slot to slot/<world>/<title>/<stamp> branches in both the Ghostlight world clone and the lore clone, recording completions in logs/elab-done.csv; integration into codex/world-<world> and codex/ghostlight-worlds is a separate deliberate pass. First banked fixture: Delvehold cistern-house-nine-breaker-test, codex/world-delvehold 9374fd0.", "status": "ok", "ts": "2026-09-04T15:04:24+00:00", "type": "verification"}
|
||||
{"ts": "2026-09-05T02:13:22+00:00", "type": "implementation", "status": "ok", "note": "Plan step 6, the ontology widening, is complete: ten passes landed on codex/ghostlight-dungeon-mvp between 2026-09-04 and 2026-09-05, each as a Hands cut in an isolation worktree, a Soul falsification in the same tree, and a fast-forward integration. Pass tips: 1 typed ID namespaces and closed patch resolution 5e53beb; 2 Position/Route/containment and scope-digest binding e99af63; 3 Custody/Dependency/conservation d2805fe; 4 world-authored affordance catalog with kernel-entropy bands 0f21a49; 5 Authority/Selection/Redress dbe176d; 6 Knowledge/Channel/Fact standing cb6a126; 7 clock, Commitment, Pressure, derived CausalBoundary and the structural answer rule 1852ddd; 8 confined elaborator lane and derived tool catalog 3ed3868; 9 budgeted connected cover with tick-driven fairness ceil(N/R), R = cells minus urgency slots, verified 22 ticks at the 2,400/240 profile 8aebfb6; 10 confined external consumer ingress over POST /cultnet/world-patch a1fd645. The kernel now holds 12 decision-constraining component kinds over 27 named operations under one WorldPatch, one reducer, one CAS commit, one decode bound for both authoring lanes, and three confined SystemCapability arms (Clock, Elaborator, Consumer); the action vocabulary is data in the seed and the kernel never learns a genre. The eleven plan invariants hold structurally at the end of the series per Soul: one deterministic reducer and atomic commit; kernel-derived authority; one controller per scope with no fallback or double action; total interpretation with exact gaps; deterministic structural rejection without a model verifier; scoped knowledge until explicit communication; external-consumer sovereignty; sparse causal sufficiency with counts as evidence only; restart reconstructs the exact world; IDs allocated only inside an admitted reduction; opportunities bound to a scope digest rather than a revision. The pairing invariant is re-decided at three gates by doctrine, not by a repair loop. Test surface grew from 43 world / 83 crate at the series start to 313 world / 357 crate source functions at a1fd645 (focused world:: run 312 / 352). Two design decisions remain with the operator and are recorded nowhere else durable: whether a refused coupled constituent may re-submit once inside the same tick, to be decided with the submitted-versus-committed number in hand; and the authority for an owner-only Eve world.run_tick command. The next seam after the series is the outbound consumer response batch and a non-loopback CultMesh lease."}
|
||||
|
|
|
|||
|
|
@ -38,3 +38,4 @@
|
|||
{"key": "2026-09-04T141410Z0000-0036-a61849b93cf5", "payload": "eyJub3RlIjogIk9wZXJhdG9yIGNvcnJlY3Rpb24sIDIwMjYtMDktMDQ6IHRoZSAyLDQwMC1zdWJqZWN0IC8gMjQwLWNlbGwgLyAxMCUgY292ZXIgcHJvZmlsZSBpcyBhIGRlc2lnbiB0YXJnZXQsIG5vdCBhIGxvYWQgZml4dHVyZS4gQSB3b3JsZCBmZWVscyBhbGl2ZSBvbmx5IHdoZW4gYWN0b3JzIGF0IGV2ZXJ5IGxldmVsIHB1cnN1ZSB0aGVpciBvd24gZ29hbHM7IHRoYXQgcmVxdWlyZXMgZ2VuZXJhdGluZyB0aGF0IGRldGFpbCBmaXJzdCBhbmQgdGhlbiBjaG9raW5nIG11bHRpcmVzb2x1dGlvbiBzaW11bGF0aW9uIHNvIGF0dGVudGlvbiBpcyBzY2FyY2UgYW5kIHNlbGVjdGlvbiBpcyBmb3JjZWQuIFRoZSBtdnAgZG9jIHNlbnRlbmNlIGNhbGxpbmcgdGhlIHByb2ZpbGUgXCJ0ZXN0IGRhdGEsIG5vdCBhIHByb2R1Y3Rpb24gZWxhYm9yYXRpb24gdGFyZ2V0XCIgd2FzIHRlYXJkb3duLWVyYSB0ZXh0LCBub3Qgb3BlcmF0b3IgZGVzaWduLCBhbmQgaXMgYW1lbmRlZC4gT250b2xvZ3kgdjIgbm93IGNhcnJpZXM6IGFuIGF1dGhvcmVkIFdvcmxkU2NhbGVJbnRlbnQgd2l0aCBhIHN0cnVjdHVyYWxseSBjb3VudGVkIGRlZmljaXQgKHF1YWxpZmllZCBzdWJqZWN0ID0gYWN0aXZlLCBvbmUgY29udHJvbGxlciwgb25lIEdvYWwgY29tbWl0bWVudCwgb25lIGFmZm9yZGFuY2UpIHRoYXQgZWxhYm9yYXRvcnMgcHVyc3VlIGFmdGVyIGJvdW5kYXJpZXM7IGEgYnVkZ2V0ZWQgY29ubmVjdGVkIGNvdmVyIGV2ZXJ5IHRpY2sgd2l0aCBzaW5nbGV0b24gZGV0YWlsIGNlbGxzIGFuZCBncm91cGVkIGNvYXJzZSBjZWxsczsgcGVyLWNvbnN0aXR1ZW50IGF0dHJpYnV0aW9uIGFuZCBwYXJ0aXRpb25lZCBrbm93bGVkZ2UgaW4gZ3JvdXBlZCBjZWxsczsgZGVidCByb3RhdGlvbi4gU3RpbGwgZGVsZXRlZDogZ2VzdGFsdCBhcyBjYW5vbmljYWwgaWRlbnRpdHksIGFyZW5hIGtub3dsZWRnZSB1bmlvbiwgc2VtYW50aWMgcXVhbGlmaWNhdGlvbiBhbmQgdmVyaWZpY2F0aW9uIG1vZGVscywgZmlzc2lvbiBxdW90YXMgYXMgbXV0YXRpb24sIHN0cmluZyBpZGVudGlmaWVycy4iLCAic3RhdHVzIjogIm9rIiwgInRzIjogIjIwMjYtMDktMDRUMTQ6MTQ6MTArMDA6MDAiLCAidHlwZSI6ICJyZXNlYXJjaCJ9", "stored_at": "2026-09-04T14:14:10.337953+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
{"key": "2026-09-04T141847Z0000-0037-edecdf5c6e4b", "payload": "eyJub3RlIjogIkNvZGV4IENMSSBmYW4tb3V0IHRoYXQgbXVzdCBjb21taXQgY2Fubm90IHJ1biBpbiBhIGxpbmtlZCBnaXQgd29ya3RyZWUuIEEgbGlua2VkIHdvcmt0cmVlJ3MgLmdpdCBpcyBhIGZpbGUgcG9pbnRpbmcgaW50byB0aGUgcGFyZW50IHJlcG8ncyAuZ2l0L3dvcmt0cmVlcy8sIHdoaWNoIGlzIG91dHNpZGUgdGhlIENvZGV4IHNhbmRib3gncyB3cml0YWJsZSByb290cywgc28gZXZlcnkgZ2l0IGNvbW1pdCBmYWlscyB3aXRoIGluZGV4LmxvY2sgUGVybWlzc2lvbiBkZW5pZWQ7IHRoZSBkZWZhdWx0IHNhbmRib3ggYWxzbyBibG9ja3Mgb3V0Ym91bmQgcHVzaC4gQWxsIGZvdXIgd29ybGQgd29ya2VycyBkaWVkIG9uIHRoaXMgb24gMjAyNi0wOS0wNC4gRml4OiBmdWxsIGNsb25lcyBhdCB0aGUgc2FtZSBwYXRocyAoRjovUHJvamVjdHMvR2hvc3RsaWdodC13b3JsZHMvPHdvcmxkPiwgRjovUHJvamVjdHMvPExvcmU+LXdvcmt0cmVlcy9naG9zdGxpZ2h0LXdvcmxkczsgLmdpdCBpcyBhIGRpcmVjdG9yeSBkZXNwaXRlIHRoZSBkaXJlY3RvcnkgbmFtZSkgYW5kIGxhdW5jaCB3aXRoIC1jIHNhbmRib3hfd29ya3NwYWNlX3dyaXRlLm5ldHdvcmtfYWNjZXNzPXRydWUuIFVuY29tbWl0dGVkIHdvcmtlciBvdXRwdXQgd2FzIGJhbmtlZCBieSBoYW5kIHRvIGNvZGV4L3dvcmxkLTx3b3JsZD4gYW5kIGNvZGV4L2dob3N0bGlnaHQtd29ybGRzIGJlZm9yZSB0aGUgd29ya3RyZWVzIHdlcmUgcmVtb3ZlZC4gUnVsZSBmb3IgYW55IGZ1dHVyZSBDb2RleCBmYW4tb3V0IHRoYXQgd3JpdGVzOiBnaXZlIGVhY2ggd29ya2VyIGEgY2xvbmUgd2hvc2UgZW50aXJlIC5naXQgbGl2ZXMgdW5kZXIgaXRzIG93biB3cml0YWJsZSByb290LCBhbmQgZ3JhbnQgbmV0d29yayBpZiBpdCBtdXN0IHB1c2guIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA5LTA0VDE0OjE4OjQ3KzAwOjAwIiwgInR5cGUiOiAidmVyaWZpY2F0aW9uIn0=", "stored_at": "2026-09-04T14:18:47.920625+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
{"key": "2026-09-04T150424Z0000-0038-a237611b3305", "payload": "eyJub3RlIjogIlN1cGVyc2VkZXMgdGhlIDIwMjYtMDktMDRUMTQ6MTggY2xvbmUtcGx1cy1uZXR3b3JrIHJlY29yZCwgd2hpY2ggd2FzIG5lY2Vzc2FyeSBidXQgbm90IHN1ZmZpY2llbnQuIFRoZSBDb2RleCB3b3Jrc3BhY2Utd3JpdGUgc2FuZGJveCBrZWVwcyAuZ2l0IHJlYWQtb25seSBldmVuIHdoZW4gdGhlIHdob2xlIGNsb25lIHNpdHMgdW5kZXIgdGhlIHdyaXRhYmxlIHJvb3QsIHNvIGEgQ29kZXggd29ya2VyIGNhbiBuZXZlciBjb21taXQgb3IgcHVzaCByZWdhcmRsZXNzIG9mIGNsb25lIGxheW91dCBvciBuZXR3b3JrIGdyYW50LiBSdWxlIGZvciBhbnkgQ29kZXggZmFuLW91dCB0aGF0IG11c3QgcHJvZHVjZSBjb21taXR0ZWQgd29yazogdGhlIHdvcmtlciB3cml0ZXMgZmlsZXMgb25seTsgYSBzdXBlcnZpc29yIG91dHNpZGUgdGhlIHNhbmRib3ggY29tbWl0cyBhbmQgcHVzaGVzIHRoZSBjbG9uZSBhZnRlciB0aGUgd29ya2VyIGV4aXRzLiBUaGUgd29ybGQgZWxhYm9yYXRvciBzY2hlZHVsZXIgKEM6L1VzZXJzL01ldGEvLmNsYXVkZS93b3JsZHMvSW52b2tlLUVsYWJvcmF0b3JzLnBzMSkgZG9lcyB0aGlzIHBlciBzbG90IHRvIHNsb3QvPHdvcmxkPi88dGl0bGU+LzxzdGFtcD4gYnJhbmNoZXMgaW4gYm90aCB0aGUgR2hvc3RsaWdodCB3b3JsZCBjbG9uZSBhbmQgdGhlIGxvcmUgY2xvbmUsIHJlY29yZGluZyBjb21wbGV0aW9ucyBpbiBsb2dzL2VsYWItZG9uZS5jc3Y7IGludGVncmF0aW9uIGludG8gY29kZXgvd29ybGQtPHdvcmxkPiBhbmQgY29kZXgvZ2hvc3RsaWdodC13b3JsZHMgaXMgYSBzZXBhcmF0ZSBkZWxpYmVyYXRlIHBhc3MuIEZpcnN0IGJhbmtlZCBmaXh0dXJlOiBEZWx2ZWhvbGQgY2lzdGVybi1ob3VzZS1uaW5lLWJyZWFrZXItdGVzdCwgY29kZXgvd29ybGQtZGVsdmVob2xkIDkzNzRmZDAuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA5LTA0VDE1OjA0OjI0KzAwOjAwIiwgInR5cGUiOiAidmVyaWZpY2F0aW9uIn0=", "stored_at": "2026-09-04T15:04:24.134358+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
{"key": "2026-09-05T021322Z0000-0039-8fe6fe49acb8", "payload": "eyJub3RlIjogIlBsYW4gc3RlcCA2LCB0aGUgb250b2xvZ3kgd2lkZW5pbmcsIGlzIGNvbXBsZXRlOiB0ZW4gcGFzc2VzIGxhbmRlZCBvbiBjb2RleC9naG9zdGxpZ2h0LWR1bmdlb24tbXZwIGJldHdlZW4gMjAyNi0wOS0wNCBhbmQgMjAyNi0wOS0wNSwgZWFjaCBhcyBhIEhhbmRzIGN1dCBpbiBhbiBpc29sYXRpb24gd29ya3RyZWUsIGEgU291bCBmYWxzaWZpY2F0aW9uIGluIHRoZSBzYW1lIHRyZWUsIGFuZCBhIGZhc3QtZm9yd2FyZCBpbnRlZ3JhdGlvbi4gUGFzcyB0aXBzOiAxIHR5cGVkIElEIG5hbWVzcGFjZXMgYW5kIGNsb3NlZCBwYXRjaCByZXNvbHV0aW9uIDVlNTNiZWI7IDIgUG9zaXRpb24vUm91dGUvY29udGFpbm1lbnQgYW5kIHNjb3BlLWRpZ2VzdCBiaW5kaW5nIGU5OWFmNjM7IDMgQ3VzdG9keS9EZXBlbmRlbmN5L2NvbnNlcnZhdGlvbiBkMjgwNWZlOyA0IHdvcmxkLWF1dGhvcmVkIGFmZm9yZGFuY2UgY2F0YWxvZyB3aXRoIGtlcm5lbC1lbnRyb3B5IGJhbmRzIDBmMjFhNDk7IDUgQXV0aG9yaXR5L1NlbGVjdGlvbi9SZWRyZXNzIGRiZTE3NmQ7IDYgS25vd2xlZGdlL0NoYW5uZWwvRmFjdCBzdGFuZGluZyBjYjZhMTI2OyA3IGNsb2NrLCBDb21taXRtZW50LCBQcmVzc3VyZSwgZGVyaXZlZCBDYXVzYWxCb3VuZGFyeSBhbmQgdGhlIHN0cnVjdHVyYWwgYW5zd2VyIHJ1bGUgMTg1MmRkZDsgOCBjb25maW5lZCBlbGFib3JhdG9yIGxhbmUgYW5kIGRlcml2ZWQgdG9vbCBjYXRhbG9nIDNlZDM4Njg7IDkgYnVkZ2V0ZWQgY29ubmVjdGVkIGNvdmVyIHdpdGggdGljay1kcml2ZW4gZmFpcm5lc3MgY2VpbChOL1IpLCBSID0gY2VsbHMgbWludXMgdXJnZW5jeSBzbG90cywgdmVyaWZpZWQgMjIgdGlja3MgYXQgdGhlIDIsNDAwLzI0MCBwcm9maWxlIDhhZWJmYjY7IDEwIGNvbmZpbmVkIGV4dGVybmFsIGNvbnN1bWVyIGluZ3Jlc3Mgb3ZlciBQT1NUIC9jdWx0bmV0L3dvcmxkLXBhdGNoIGExZmQ2NDUuIFRoZSBrZXJuZWwgbm93IGhvbGRzIDEyIGRlY2lzaW9uLWNvbnN0cmFpbmluZyBjb21wb25lbnQga2luZHMgb3ZlciAyNyBuYW1lZCBvcGVyYXRpb25zIHVuZGVyIG9uZSBXb3JsZFBhdGNoLCBvbmUgcmVkdWNlciwgb25lIENBUyBjb21taXQsIG9uZSBkZWNvZGUgYm91bmQgZm9yIGJvdGggYXV0aG9yaW5nIGxhbmVzLCBhbmQgdGhyZWUgY29uZmluZWQgU3lzdGVtQ2FwYWJpbGl0eSBhcm1zIChDbG9jaywgRWxhYm9yYXRvciwgQ29uc3VtZXIpOyB0aGUgYWN0aW9uIHZvY2FidWxhcnkgaXMgZGF0YSBpbiB0aGUgc2VlZCBhbmQgdGhlIGtlcm5lbCBuZXZlciBsZWFybnMgYSBnZW5yZS4gVGhlIGVsZXZlbiBwbGFuIGludmFyaWFudHMgaG9sZCBzdHJ1Y3R1cmFsbHkgYXQgdGhlIGVuZCBvZiB0aGUgc2VyaWVzIHBlciBTb3VsOiBvbmUgZGV0ZXJtaW5pc3RpYyByZWR1Y2VyIGFuZCBhdG9taWMgY29tbWl0OyBrZXJuZWwtZGVyaXZlZCBhdXRob3JpdHk7IG9uZSBjb250cm9sbGVyIHBlciBzY29wZSB3aXRoIG5vIGZhbGxiYWNrIG9yIGRvdWJsZSBhY3Rpb247IHRvdGFsIGludGVycHJldGF0aW9uIHdpdGggZXhhY3QgZ2FwczsgZGV0ZXJtaW5pc3RpYyBzdHJ1Y3R1cmFsIHJlamVjdGlvbiB3aXRob3V0IGEgbW9kZWwgdmVyaWZpZXI7IHNjb3BlZCBrbm93bGVkZ2UgdW50aWwgZXhwbGljaXQgY29tbXVuaWNhdGlvbjsgZXh0ZXJuYWwtY29uc3VtZXIgc292ZXJlaWdudHk7IHNwYXJzZSBjYXVzYWwgc3VmZmljaWVuY3kgd2l0aCBjb3VudHMgYXMgZXZpZGVuY2Ugb25seTsgcmVzdGFydCByZWNvbnN0cnVjdHMgdGhlIGV4YWN0IHdvcmxkOyBJRHMgYWxsb2NhdGVkIG9ubHkgaW5zaWRlIGFuIGFkbWl0dGVkIHJlZHVjdGlvbjsgb3Bwb3J0dW5pdGllcyBib3VuZCB0byBhIHNjb3BlIGRpZ2VzdCByYXRoZXIgdGhhbiBhIHJldmlzaW9uLiBUaGUgcGFpcmluZyBpbnZhcmlhbnQgaXMgcmUtZGVjaWRlZCBhdCB0aHJlZSBnYXRlcyBieSBkb2N0cmluZSwgbm90IGJ5IGEgcmVwYWlyIGxvb3AuIFRlc3Qgc3VyZmFjZSBncmV3IGZyb20gNDMgd29ybGQgLyA4MyBjcmF0ZSBhdCB0aGUgc2VyaWVzIHN0YXJ0IHRvIDMxMyB3b3JsZCAvIDM1NyBjcmF0ZSBzb3VyY2UgZnVuY3Rpb25zIGF0IGExZmQ2NDUgKGZvY3VzZWQgd29ybGQ6OiBydW4gMzEyIC8gMzUyKS4gVHdvIGRlc2lnbiBkZWNpc2lvbnMgcmVtYWluIHdpdGggdGhlIG9wZXJhdG9yIGFuZCBhcmUgcmVjb3JkZWQgbm93aGVyZSBlbHNlIGR1cmFibGU6IHdoZXRoZXIgYSByZWZ1c2VkIGNvdXBsZWQgY29uc3RpdHVlbnQgbWF5IHJlLXN1Ym1pdCBvbmNlIGluc2lkZSB0aGUgc2FtZSB0aWNrLCB0byBiZSBkZWNpZGVkIHdpdGggdGhlIHN1Ym1pdHRlZC12ZXJzdXMtY29tbWl0dGVkIG51bWJlciBpbiBoYW5kOyBhbmQgdGhlIGF1dGhvcml0eSBmb3IgYW4gb3duZXItb25seSBFdmUgd29ybGQucnVuX3RpY2sgY29tbWFuZC4gVGhlIG5leHQgc2VhbSBhZnRlciB0aGUgc2VyaWVzIGlzIHRoZSBvdXRib3VuZCBjb25zdW1lciByZXNwb25zZSBiYXRjaCBhbmQgYSBub24tbG9vcGJhY2sgQ3VsdE1lc2ggbGVhc2UuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA5LTA1VDAyOjEzOjIyKzAwOjAwIiwgInR5cGUiOiAiaW1wbGVtZW50YXRpb24ifQ==", "stored_at": "2026-09-05T02:13:22.785718+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -2,12 +2,13 @@
|
|||
|
||||
## Current Subgoal
|
||||
|
||||
Pass-9 follow-ups with Hands in `F:\Projects\Ghostlight-pass9fu` on
|
||||
`hands/pass9-followups` from `8aebfb6`, and pass 10 (consumer ingress) design:
|
||||
`modeling-pass10.md` on disk, `imagination-pass10.md` in progress under the
|
||||
ten rulings. Main tip `8aebfb6`, passes 1-9 integrated. Open operator
|
||||
decisions: bounded in-tick re-submission for a refused constituent; Eve
|
||||
`world.run_tick` authority.
|
||||
Pass-10 follow-ups with Hands in `F:\Projects\Ghostlight-pass10fu` on
|
||||
`hands/pass10-followups` from `a1fd645` (`controller_work.v9`, fatal malformed
|
||||
credentials, redacting `Debug`, `check_patch_caps` in the elaboration lane),
|
||||
then series close-out: commit the docs-worker edits, integrate, remove the
|
||||
worktree. Main tip `a1fd645`; step 6 complete. Then the operator decides:
|
||||
in-tick re-submission, Eve `world.run_tick` authority, outbound consumer
|
||||
response versus the deployment gate.
|
||||
|
||||
## Working Notes
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue