diff --git a/docs/architecture/ghostlight-dungeon-mvp.md b/docs/architecture/ghostlight-dungeon-mvp.md index f395996..5a1bbd0 100644 --- a/docs/architecture/ghostlight-dungeon-mvp.md +++ b/docs/architecture/ghostlight-dungeon-mvp.md @@ -78,10 +78,15 @@ The only mutation input is a `CommandEnvelope` containing: - one closed command body; - exact evidence references where the command depends on source material. -The caller supplies identity evidence, not an authority verdict. The kernel -derives a `MutationAuthorityEnvelope` from canonical membership, lifecycle, -subject authority, external-owner grants, and the command kind. Callers cannot -grant themselves scope by serializing a persuasive envelope. +The caller supplies identity evidence, not an authority verdict. For a patch +command the kernel derives the caller's authority itself: +`require_patch_author` reads the caller and committed state to decide who may +submit `AdmitPatch` and what ground it holds (the world owner unconfined, an +elaborator confined to a jurisdiction, or a consumer confined to the subjects +it controls), and `confine_to_ground` checks every declaration and operation +in the candidate patch against that ground before it is admitted. Callers +cannot grant themselves scope by serializing a persuasive envelope; the +kernel derives it from state it already committed. Interpreters and operational agents submit the same typed commands through narrower schemas. Narrative Personas never see those schemas or tools. No @@ -189,8 +194,13 @@ A subject is a stable identity with a declared kind: - person; - institution; -- autonomous population; -- external subject mirror. +- autonomous population. + +An externally controlled mirror is not a fourth kind. It is an ordinary +subject of one of these three whose `ControllerAssignment` is +`ExternallyControlled { consumer }`: no controller ID, no controller mode, no +decision opportunity, and no affordance, mutable only through its own +consumer and the world owner. Demographic descriptors and statistical aggregates are not automatically subjects. A canonical action owner is derived structurally from an active @@ -250,7 +260,8 @@ The reducer validates only structural promises: - knowledge additions cite an existing accessible fact or a newly admitted evidenced fact; - population slices are disjoint beneath their declared parent; -- external-owned components can change only through their admitted owner; +- an externally controlled subject's components can change only through its + own consumer, confined by `PatchGround::Consumer`; - a batch either reduces completely or not at all. Interestingness, novelty, ideological distribution, prose style, and counts do diff --git a/docs/architecture/ghostlight-world-consumer-api.md b/docs/architecture/ghostlight-world-consumer-api.md index 444a04c..44c5277 100644 --- a/docs/architecture/ghostlight-world-consumer-api.md +++ b/docs/architecture/ghostlight-world-consumer-api.md @@ -1,123 +1,189 @@ # Ghostlight World Consumer API -Status: drift. Names `CampaignRegistry`, `WorldSeed`, and `publish_session_zero`, -which do not exist in the sealed kernel. Pending rewrite against -`docs/architecture/ghostlight-world-ontology.md`; read for consumer-boundary -intent only. Pass 10 owns the rewrite and carries four debts the ingress must -settle before a consumer patch can reach `AdmitPatch`: caller authority (which -`CallerId` a consumer lowers to), decode-time size bounds on the patch, -phase (Draft seed versus Active elaboration), and boundary answering (an -Active consumer patch that declares must answer a derived boundary like any -other author). The transport is one typed inbound document over a second loopback route -beside `POST /cultnet/snapshot`, carrying the patch as a nested -canonical-msgpack byte frame bounded before any item deserializes; it is -not a fifth `execute_world` operation literal and not an organ of the -outbound mesh publisher. +Status: this describes the landed pass-10 consumer ingress — a world's third +patch author, reaching `AdmitPatch` through one loopback-bound typed document. ## Objective -Let a consumer supply and observe one persistent Ghostlight world without -becoming part of Ghostlight's runtime. Session Zero compilation and external -world authoring are two producers of the same admitted seed. Delvehold is the -first demanding consumer; no Delvehold identifier, schema, or policy is core -authority. +Let an external consumer author and observe the exact subjects a Ghostlight +world has admitted as its mirrors, without becoming part of Ghostlight's +runtime and without the world learning the consumer's vocabulary. A +consumer-authored seed and a compiled seed are the same `AdmitPatch`; there is +no separate seed type, registry, or publication handoff. Delvehold is the +first consumer; no Delvehold identifier, schema, or policy is core authority +(`docs/architecture/delvehold-forced-ontology-integration.md` names the +profile-side binding). ## Authority map -- **Seed admission owner:** `CampaignRegistry` validates one `WorldSeed` and - commits it with one `WorldSeedAdmission` and receipt. Producer-specific - documents may join that transaction but cannot create another publication - path. -- **World owner:** `WorldKernel` owns every admitted campaign revision and all - simulation state. -- **External-subject owner:** `ExternalSubjectAuthority` binds one exact - consumer owner to one exact subject. The subject remains a visible target but - receives no Ghostlight Persona turn and cannot act through a strategic cell. -- **Consumer owner:** the consumer decides whether a Ghostlight proposal changes - its own domain. Its acknowledgement records admission or refusal but cannot - rewrite Ghostlight state. -- **Inputs:** a consumer-neutral seed, producer and payload digests, exact - authority descriptors, normalized external-institution snapshots, and - proposal acknowledgements. -- **Outputs:** seed-admission receipts, revisioned snapshot receipts, attributed - external proposals, and immutable proposal acknowledgements. -- **Derived state:** Session Zero publication documents, consumer bindings, - network messages, schema catalogs, and UI projections own no canonical world - state. -- **Forbidden writers:** seed producers, adapters, models, arenas, transport, - and acknowledgements cannot write a campaign row directly. -- **Shared paths:** compiler and consumer seeds lower to one registry/store - transaction. Strategic waves continue through the existing WorldKernel - command and atomic commit path. -- **Cut line:** `publish_session_zero` no longer owns campaign creation. It is a - producer-specific wrapper around generic seed admission. Ghostlight never - switches on `greathold` or a `delvehold.*` schema. +- **Admission owner:** `require_patch_author` (`world/mod.rs`) decides which + caller may submit `AdmitPatch` and returns that caller's `PatchGround`; + `confine_to_ground` decides what a confined ground may write. Both run in + `reduce`'s `AdmitPatch` arm and again in `apply_effect`'s `PatchAdmitted` + arm — there is no second confinement function and no way for a patch to + commit without being re-decided. +- **Consumer ground:** `PatchGround::Consumer(ConsumerId)` is derived, never + carried. The set of subjects a consumer may write is + `{ s | controller_assignments[s] == ExternallyControlled { consumer } }`, + read from committed state at decision time. A consumer cannot name its own + scope on the wire, and revoking a binding in a later commit shrinks its + authority with no ingress change. +- **Caller minting:** `WorldMailbox::submit_consumer` (`world/mailbox.rs`) is + the only constructor of `AuthenticatedCaller::verified_system(SystemCapability::Consumer { consumer })`. +- **Ingress owner:** `world/consumer.rs` owns decoding a document, bounding + it, authenticating the consumer, one port call, and one receipt + projection. It owns no world truth, holds no opinion about a patch's + content, and does not pre-validate — a second reducer here could disagree + with the kernel's, so structure is decided once, by `resolve_patch`. +- **Port:** `ConsumerPort` (`world/mailbox.rs`) has one method, + `submit_consumer`. It cannot read the world: it does not select an answer, + does not pre-validate, and returns a receipt rather than state. ## Typed flow ```text -producer seed - -> WorldSeed + WorldSeedAdmission - -> CampaignRegistry validation - -> one empty-store CultCache transaction - -> WorldKernel runtime - -consumer-owned state - -> consumer adapter - -> ExternalSubjectSnapshot (institution or Gestalt projection) - -> authority, digest, revision, and idempotency validation - -> WorldKernel atomic campaign commit - -> ExternalSnapshotReceipt - -strategic action directed at an external subject - -> WorldKernel strategic-wave validation - -> attributed ExternalWorldProposal persisted with the wave - -> consumer reads proposal and decides locally - -> ExternalProposalReceipt records accept, partial accept, or reject - -> any realized consumer change returns later as a fresh snapshot +ConsumerPatchDocument (canonical MessagePack) + -> ConsumerRegistry: name -> ConsumerId, secret verified against a + stored SHA-256 digest in constant time + -> patch::decode_patch, bounded by MAX_PATCH_BYTES / _DECLARATIONS / + _OPERATIONS / _EVIDENCE + -> WorldMailbox::submit_consumer(world_id, expected_revision, command_id, + consumer, answers, patch) + -> reduce / apply_effect: require_patch_author, the answer rule, + confine_to_ground + -> ConsumerReceiptDocument: one atomic verdict — a commit reference or + the complete mismatch set ``` +`command_id` and `world_id` on the receipt are `Option`: a frame that fails to +decode or names an unregistered consumer never derives a command key or reads +a world, so the receipt has none to report. The outbound half of this +contract — a consumer reading its own projection, or receiving an +attributed proposal — is not part of this pass; see "Not in this pass" below. + ## Transport -The API uses typed CultNet operation requests over Ghostlight's existing RUDP -server. Seed admission, external snapshots, proposal reads, and proposal -acknowledgements use MessagePack payloads and typed receipts. The service is -loopback-only until CultMesh authority leases and secure remote admission are -implemented. HTTP and Eve remain player/product projections, not the world -consumer boundary. +`POST /cultnet/world-patch`, declared beside `/cultnet/snapshot` in +`api_router` (`runtime.rs`). The handler gates loopback and content type +(`application/msgpack`) exactly as the snapshot route does, then hands the +body to `world::consumer::admit_document`; everything past those two gates is +`world/consumer.rs`'s to decide. The body limit is +`CONSUMER_BODY_LIMIT = patch::MAX_PATCH_BYTES + CONSUMER_ENVELOPE_SLACK` (an +8 KiB envelope allowance over the 256 KiB patch cap), so the transport guard +cannot become a second opinion about how big a patch may be. -## Invariants +The document and receipt are Ghostlight-owned typed records in canonical +MessagePack, not CultNet control messages, pinned to two schema constants: -- The public seed shape excludes runtime revision, transcript, pending work, - cover state, and other already-authoritative campaign fields. -- The seed digest binds the exact normalized seed. A campaign ID cannot be - republished from another digest. -- An external authority names one existing institution or Gestalt subject and - one owner. Its secret is persisted only as SHA-256. -- External subjects are active graph targets but never simulation-eligible. -- A snapshot replaces only the exact externally owned institution or Gestalt projection. - It cannot create subjects, routes, actors, Gestalts, relations, or private - knowledge. -- Source revisions increase monotonically. Exact idempotent replay returns the - original receipt; conflicting replay changes nothing. -- Outbound proposals remain attributed to an exact Ghostlight subject and exact - target. An arena never becomes the proposer. -- Proposal acknowledgement is not a Ghostlight world mutation. Realized effects - return through a later snapshot. -- Dungeon campaigns keep their player actor, membership, contract, and Session - Zero documents. Their adversarial play path does not depend on a consumer. +```text +CONSUMER_PATCH_SCHEMA = "ghostlight.consumer_patch.v0" +CONSUMER_RECEIPT_SCHEMA = "ghostlight.consumer_receipt.v0" +``` -## First acceptance +`ConsumerPatchDocument` carries `schema`, `world_id`, `consumer` (a +configured name, lowered to a `ConsumerId` by the registry and never carried +further), `secret`, `idempotency_key`, `expected_revision`, `answers: +Option`, and `patch: Vec` — the encoded `WorldPatch` as a +nested canonical-MessagePack byte frame rather than an inline value, so +`MAX_PATCH_BYTES` is checked against the patch itself before any of its items +deserializes. The outer document is decoded first, is tiny, and is bounded by +the route's derived limit. -1. Session Zero and a consumer-authored fixture persist the same generic seed - admission and receipt types. -2. A configured external institution never receives a strategic cell or - Persona action. -3. Wrong owner, wrong secret, stale source revision, digest conflict, and stale - world revision leave campaign state unchanged. -4. A valid snapshot advances the campaign once and returns an idempotent typed - receipt. -5. A strategic action aimed at the external institution emits one attributed - proposal in the same atomic wave commit. -6. Consumer acknowledgement cannot mutate the campaign and can be replayed - idempotently. +`mesh.rs`'s advertisement gains the two schema constants and nothing else: +this door is loopback-bound, so it is not a remotely reachable surface and +advertising it as one would claim availability the binary does not have. + +## Idempotency and staleness + +`expected_revision` is required; the port submits through +`submit_authenticated`, not the stamped path, because a caller that cannot +name the revision it built against cannot be told its batch is stale. The +idempotency ledger is checked before the revision, so an exact resubmission +still returns the original receipt (`AlreadyApplied`) even after the world has +moved; a stale document is `RevisionMismatch { expected, actual }`, and the +receipt carries the live revision so the consumer knows what to build against +next. `CommandId::derived` computes the command key from `(world, consumer, +idempotency_key)`; the same key with a different body is +`CommandIdConflict`, and nothing commits. + +There is no receipt-probe request and no separate mailbox `Request` variant +for it. A consumer's document is byte-identical on retry and its `CommandId` +is derived, so resubmission is the probe and the ledger answers it directly. + +## The externally controlled subject + +A subject declared `NewController::External { consumer }` receives +`ControllerAssignment::ExternallyControlled { consumer }`. It mints no +controller ID and no controller mode — both accessors return `Option` for it, +and every reader fails closed rather than assuming a default. Concretely: + +- it derives no decision opportunity and mints no turn; +- it is excluded from `agency_graph` and so from the cover; +- it is visible in the snapshot as an ordinary subject, related to, targeted, + and counted like any other, with `controller_id: None` and + `controller_mode: None`; +- it may hold no affordance — declaring it with a non-empty affordance grant + set is `Mismatch::ControllerGrantMismatch`, and the pairing is checked both + ways (an ordinary subject with an empty grant set is the same mismatch); +- its components change through exactly two callers: its own consumer, and + the world owner, who is unconfined and always could write it — that is the + owner's standing authority, not a leak in the consumer boundary. + +## Confinement + +A consumer writes only the subjects bound to it and operations grounded on +those subjects (`confine_to_ground`, the `PatchGround::Consumer` arm): + +- a declared subject is admitted only if its controller names the same + consumer; position is unconfined; +- a declared place, a declared route, `Relocate`, `OpenRoute`, `CloseRoute`, + and `AlterCost` are always refused — they carry a place or a route, and a + consumer's ground names no place; +- a `Claimed { by }` fact must name a bound subject; a `Canonical` fact + declaration is refused outright — a consumer's evidence buys an `Admit` + into its own custody and a `Claimed` fact, never a canonization; +- a channel's reach and controller must all be bound subjects; +- every operation's ground subjects must be bound, and its place and route + lists must be empty — `Transfer` therefore requires both endpoints bound, + so a consumer cannot push custody into a Ghostlight subject; `Admit` and + `Consume` work inside its own custody. + +In Active phase a consumer patch that declares answers nothing except a +`CausalBoundary::MissingStructure { subject }` derived on one of its own +mirrors — the world noticing that a subject it can see has structure it +cannot account for. Every other Active declaration is refused by the answer +rule plus this confinement, not by a separate phase gate: a consumer cannot +answer a boundary on a foreign subject (not covered), cannot answer a +`Deficit` row (deficits are jurisdictional; a consumer holds no +jurisdiction), and cannot declare without an answer. A component-only batch — +the overwhelming majority of consumer traffic — answers nothing and commits +through the same `require_answer` path as any other author. + +## Operator configuration + +`ConsumerRegistry` is loaded once at startup from the file named by +`GHOSTLIGHT_CONSUMER_CREDENTIALS`: one `name = <64 hex digits>` line per +consumer (the SHA-256 of that consumer's shared secret), blank lines and `#` +comments ignored. A missing file means no consumers, and every document is +`Unauthenticated`, the fail-closed default that lets this route exist before +an operator configures anything. A file that exists but does not parse is +fatal at startup, so a mistyped credential can never read as "no consumers". The registry holds only digests; the +plaintext secret never enters the process image beyond the hash and never +enters a log, a receipt, or the journal. + +## Deployment + +The consumer capability's tag is part of the commit digest and the +externally controlled assignment is part of the state shape, so both bump the +schema: state schema `ghostlight.world_state.consumer.v1` (state-schema +generation `world-v3`), commit schema `ghostlight.world_commit.consumer.v1`. +A store written under an earlier schema is refused, not migrated. + +## Not in this pass + +- The outbound consumer response — a consumer reading its own projection, or + receiving an attributed proposal about a Ghostlight subject acting toward + its mirror. This is the next seam; building it prematurely would grow a + second projection owner ahead of its use. +- A CultMesh authority lease for a non-loopback consumer. Until that exists, + this route is loopback-only and offers a consumer no remote door. diff --git a/docs/architecture/ghostlight-world-ontology.md b/docs/architecture/ghostlight-world-ontology.md index 9732e0e..c0e30ea 100644 --- a/docs/architecture/ghostlight-world-ontology.md +++ b/docs/architecture/ghostlight-world-ontology.md @@ -35,9 +35,9 @@ not from a model agreeing that the world is deep. ## Current mechanism -Passes 1 through 9 of the widening are landed (`5e53beb`, `e99af63`, +Passes 1 through 10 of the widening are landed (`5e53beb`, `e99af63`, `d2805fe`, `0f21a49`, `dbe176d`, `cb6a126`, `1852ddd`, `3ed3868`, -`8aebfb6`). The sealed kernel holds subjects with a label and a +`8aebfb6`, `b4d1943`). The sealed kernel holds subjects with a label and a kind (`Person | Institution | Population`); a `positions` partition with `Position`; entities with `container` under containment acyclicity; `Route` as an `EdgeRecord` variant carrying `AccessKind { Public, Restricted }`, a @@ -172,7 +172,7 @@ head, rotates the remaining subjects through singleton cells by debt, and packs the rest into grouped cells by connected component of the agency graph (scheduler-only; reachable from no prompt builder). `Cell`, `Cover`, `CellId`, `Resolution`, `TickIndex`, and `AgencyGraph` are derived and -disposable; the only durable trace of a tick is the `controller_work.v8` row +disposable; the only durable trace of a tick is the `controller_work.v9` row (`ControllerWork::Grouped`), custody-separate from world custody. A grouped cell is one inference over partitioned per-constituent views returning zero or one attributed proposal per constituent; declines are submitted first and @@ -183,16 +183,44 @@ Cell and constituent command ids are sha256-derived. The runtime's the bounded concurrency permit pool, the quarantine flag, and the clock, which advances after the cells so every cell in a tick shares one `now`. +`AdmitPatch` has a third author: `CallerId::System(SystemCapability::Consumer +{ consumer })`, minted only by `WorldMailbox::submit_consumer` after the +consumer ingress (`world/consumer.rs`) has authenticated a document against a +configured secret digest. `require_patch_author` and `confine_to_ground` +widen from jurisdiction-only to `PatchGround { Jurisdiction(JurisdictionKey), +Consumer(ConsumerId) }`; a consumer's ground is derived from +`controller_assignments` at decision time, never carried on the wire, and +confines it to the subjects it controls, with no place, route, or `Canonical` +fact ever inside that ground. A subject declared +`NewController::External { consumer }` receives +`ControllerAssignment::ExternallyControlled { consumer }`: it mints no +controller ID or mode (both accessors are `Option`), derives no opportunity, +is excluded from `agency_graph` and the cover, and may hold no affordance +(`admit_resolved`'s controller-shaped pairing rejects a non-empty grant set as +`Mismatch::ControllerGrantMismatch`). It remains an ordinary subject in the +snapshot, related to and targeted like any other, mutable only through its +own consumer and the always-unconfined world owner. `patch::decode_patch` is +the one decode bound for both the elaboration lane and the consumer lane, +under four caps — `MAX_PATCH_BYTES`, `MAX_PATCH_DECLARATIONS`, +`MAX_PATCH_OPERATIONS`, `MAX_PATCH_EVIDENCE` — and the consumer document +travels over two wire schema constants, `CONSUMER_PATCH_SCHEMA` and +`CONSUMER_RECEIPT_SCHEMA`, both `.v0`. The state and commit schemas bump to +`ghostlight.world_state.consumer.v1` and `ghostlight.world_commit.consumer.v1` +(state-schema generation `world-v3`); a store written under an earlier schema +is refused, not migrated. + Opportunities bind to a `ScopeDigest` over one `scope_components` owner (controller assignment, grants, delegated grants, own authority, position, incident routes, own holdings, own dependencies, known fact ids, controlled channels, own commitments; never `now`, occupancy, forum state, or another subject's knowledge); a proposal commits at any later revision with unchanged scope and is rejected with `KernelError::ScopeChanged` otherwise. State schema is -`world_state.elaboration.v1`, commit schema `world_commit.elaboration.v1`, -controller work `controller_work.v8`; earlier stores are refused. Ghostlight owns a conserved narrative ledger; +`ghostlight.world_state.consumer.v1`, commit schema +`ghostlight.world_commit.consumer.v1`, controller work `controller_work.v9`; +earlier stores are refused. Ghostlight owns a conserved narrative ledger; Delvehold owns the economy (`delvehold-forced-ontology-integration.md`). -Pass 10 adds the consumer ingress. +Step 6 of the plan is complete; the outbound consumer response is the next +seam. ## The failure this vocabulary is designed against @@ -265,12 +293,15 @@ resolver, or reconciler is needed. Three namespaces, three newtypes, issued only by the reducer. ```text -SubjectId person, institution, population, external mirror — can decide +SubjectId person, institution, population — can decide EntityId place, resource, fact, channel — cannot decide EdgeId route, relation, commitment, pressure — connects the above ``` Display names are labels. They never resolve a reference or bind structure. +An externally controlled mirror is an ordinary subject of one of these three +kinds; what is external is its `ControllerAssignment` +(`ExternallyControlled { consumer }`), not a fourth `SubjectKind`. ## Components @@ -373,7 +404,8 @@ The reducer checks only these: - knowledge additions cite an accessible or newly evidenced fact; - communication reaches only subjects inside the channel's reach set; - population slices are disjoint beneath their declared parent; -- externally owned components change only through their admitted owner; +- an externally controlled subject's components change only through its own + consumer, confined by `PatchGround::Consumer`; - the patch produces at least one canonical change. Interestingness, novelty, political diversity, name quality, prose quality, and diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 7373a47..18c92ed 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -225,98 +225,79 @@ outcome bands, four derived `CausalBoundary` kinds, scope-digest binding, one are teardown evidence. Plan step 6 is nine implementation passes; pass 1 is landed, passes 2 through 9 are not. -1. Passes 1 through 9 are integrated; the ontology widening machine is - complete and only pass 10 (consumer ingress) remains in step 6. - `codex/ghostlight-dungeon-mvp` tip is `8aebfb6` (Soul) over `f013c1d` - and `71d8c53` (Hands, pass 9), on `7dbbc81` (pass-8 docs and handoff) and - `b5443d5` (pass-8 follow-ups). Earlier passes: `5e53beb`, `e99af63`, - `d2805fe`, `0f21a49`, `dbe176d`, `cb6a126`, `1852ddd`, `3ed3868`. The - push follows a background crate test and the branch read `ahead 3` at - the time of writing; `git status -sb` is the witness. +1. Plan step 6, the ontology widening, is complete: all ten passes are + integrated on `codex/ghostlight-dungeon-mvp`. Tip is `a1fd645` (Soul) + over `b4d1943` (pass 10 machine) and `e0c6f9c` (patch author widened to + a confined external consumer), on `1203aa3` (pass-9 docs and handoff) and + `962f711` (intra-tick quarantine race closed). Pass tips in order: + `5e53beb`, `e99af63`, `d2805fe`, `0f21a49`, `dbe176d`, `cb6a126`, + `1852ddd`, `3ed3868`, `8aebfb6`, `a1fd645`. The push follows a + background crate test and the branch read `ahead 3` at the time of + writing; `git status -sb` is the witness. The series is distilled as one + evidence record dated 2026-09-05 in `state/evidence.jsonl`. - Pass 9 facts: new module `world/cover.rs` (`TickIndex`, `Resolution`, - `CellId`, `Cell`, `Cover`, `CoverBudget`, `AgencyGraph`, `derive_cover`); - `ControllerWork::Grouped` with `GroupedCheckpoint`; - `InferencePurpose::GroupedAgent`; owner-only `Request::AgencyGraph`, - port-narrowed rather than principal-authenticated; the runtime task - `drive_cover_tick` (`runtime.rs`) is the single owner of tick cadence, - cover derivation, and the clock, and advances the clock after the cells - (the pass-7 `advance_world_clock` task is gone, verified absent from - source); a `Semaphore` plus `AtomicBool` quarantine replaced the - controller mutex; environment `GHOSTLIGHT_COVER_CELL_BUDGET`, - `GHOSTLIGHT_COVER_CONSTITUENT_CAP`, `GHOSTLIGHT_COVER_URGENCY_SLOTS`, - `GHOSTLIGHT_CONTROLLER_MAX_CONCURRENT`, `GHOSTLIGHT_TICK_INTERVAL_SECONDS`; - `controller_work.v8`; world state and commit schemas stay at - `elaboration.v1`; no `Cargo.toml` change and no `uuid/v5`, verified. - Rulings adopted: fairness is ceil(N/R) with R = cells minus urgency - slots, verified at the 2,400/240 profile to close in 22 ticks, not 21; - the constituent cap yields for two reasons, capacity and packing, while - the cell budget never yields and oversubscribed is the signal; the cover - is pure and the attention order is a real input; coupled constituents in - a grouped cell contend and the second act is honestly refused with - `ScopeChanged`, and the grouping heuristic stays; the open operator - decision is whether to allow a bounded in-tick re-submission for a - refused constituent, to be taken with the submitted-versus-committed - number in hand. The owner-only Eve `world.run_tick` command is not built; - its authority decision is pending. Baseline at `8aebfb6`: 283 test - functions in `world/*.rs`, 323 crate source, plus one integration test - (the focused `world::` run reports 282 / 318; different counting rules, - compare like with like). + What the kernel is now: twelve decision-constraining component kinds + over twenty-seven named operations under one `WorldPatch`, one reducer, + one CAS commit, one decode bound for both authoring lanes + (`patch::decode_patch` with `MAX_PATCH_BYTES`, `MAX_PATCH_DECLARATIONS`, + `MAX_PATCH_OPERATIONS`, `MAX_PATCH_EVIDENCE`; the `MAX_DRAFT_*` bounds + are deleted), and three confined `SystemCapability` arms: `Clock`, + `Elaborator { jurisdiction }`, `Consumer { consumer }`. Pass 10 added + `world/consumer.rs`; `PatchGround { Jurisdiction, Consumer }` with + `confine_to_ground` as the one confinement function (renamed from + `confine_to_jurisdiction`); `ControllerAssignment::ExternallyControlled + { consumer }`, with `id()` and `mode()` now `Option` and every reader + failing closed; `Mismatch::ControllerGrantMismatch` replacing + `NoAffordances`; `CommandId::derived` shared by `session_command_id`; + `ConsumerPort` (one method) in `world/mailbox.rs` and + `WorldMailbox::submit_consumer`; route `POST /cultnet/world-patch`, + loopback, msgpack, `CONSUMER_BODY_LIMIT`; `ConsumerRegistry` loaded from + the file named by `GHOSTLIGHT_CONSUMER_CREDENTIALS`, digests only. + Schemas are `world_state.consumer.v1` / `world_commit.consumer.v1`; + `controller_work.v9`; `STATE_SCHEMA_GENERATION` in + `idunn_health.rs` is now `world-v3`, so the Idunn expectation and every + "world-v2" phrase in the deployment gate below now mean world-v3. + Baseline at `a1fd645`: 313 test functions in `world/*.rs`, 357 crate + source, plus one integration test (the focused `world::` run reports + 312 / 352; different counting rules, compare like with like). - In flight, not landed: - - `hands/pass9-followups` in the worktree `F:\Projects\Ghostlight-pass9fu`, - branched from `8aebfb6` with no commits yet: `with_test_ports`, - `InferencePort`, and `ControllerWorkStore` to `pub(crate)` with spec - test 13.12 for concurrency plus quarantine; `drive_cover_tick` behind - narrow ports with an ordering test; `merges_are_deterministic_in_subject_order` - retired. - - Pass 10 design: `modeling-pass10.md` is on disk in the session - scratchpad; `imagination-pass10.md` is being written under ten rulings, - the load-bearing ones being: the consumer is a third `SystemCapability` - arm confined to one externally controlled subject; externally - controlled subjects get no opportunity and are skipped by the cover; - one atomic verdict per document, no partial acceptance; one kernel-side - decode bound for both lanes; transport follows the `POST - /cultnet/snapshot` precedent, not an `execute_world` literal; a - `ConsumerPort` as narrow as `ElaborationPort`; no Delvehold names in - core. No pass-10 worktree exists yet. - Main carries uncommitted coordinator edits to - `docs/architecture/ghostlight-world-ontology.md` (pass-9 scale paragraph, - the contention finding, and two stale claims Modeling caught: `AdmitPatch` - has no phase gate of its own, and `EvidenceRef::new` is `pub(super)` - bounded by `filter_evidence`, not `#[cfg(test)]`), - `docs/architecture/ghostlight-dungeon-mvp.md` (derived state, membrane, - tick driver and environment values), and the plan's step-6 pass-10 line. - Witness for pass 10: main-branch `git log` past `8aebfb6`, and - `git worktree list`. + Rulings adopted in pass 10: no migration for the moved + `session_command_id` derivation; `controller_work` is v9 so the refusal + is structural; a malformed credentials file is fatal at startup + (`open_consumer_registry` in `runtime.rs` returns the registry's error; + a missing file still means no consumers); the outbound consumer response + batch and a non-loopback CultMesh lease are the next seams, not this + pass. Soul's series judgment: the eleven plan invariants hold + structurally at the end of ten passes; the pairing invariant is + re-decided at three gates by doctrine, not by a repair loop. - Pipeline for pass 10: specs `imagination-pass1.md` through - `imagination-pass9.md` and maps `modeling-pass1.md` through - `modeling-pass9.md` are on disk in the session scratchpad - `C:\Users\Meta\AppData\Local\Temp\claude\F--Projects-Ghostlight\2fd50f5e-f7ba-4e5d-82bc-c7033e6074d2\scratchpad`, - not in `state/`; if that directory is gone, regenerate the specs from - `docs/architecture/ghostlight-world-ontology.md`. Each pass: Hands in an - isolation worktree whose first line is `git reset --hard - codex/ghostlight-dungeon-mvp`, then Soul in that tree, then the coordinator - integrates with `git -C rebase -q codex/ghostlight-dungeon-mvp && git - merge --ff-only && cargo test -q -p ghostlight-dungeon --bin - ghostlight-dungeon world:: && git push -q && git worktree remove --force - && git branch -D `, then a steward pass and the doc - proposal. Rulings that bind Hands: pass 7 keeps `check_ledger` single-site; - pass 8 adds no HTTP `AdmitPatch` ingress (that is pass 10, consumer - ingress, in the plan); pass 9 must not enable `uuid/v5` and derives each - `CommandId` via sha256 into `Uuid::from_bytes` like `derive_id`. + The pass-10 follow-ups are landed (`8173c9c`): `controller_work.v9`; + fatal malformed credentials; redacting `Debug` on the consumer document; + the elaboration lane calls `check_patch_caps` so `MAX_PATCH_EVIDENCE` + binds on both lanes; distinct item-cap refusals in the receipt; one + duplicate test deleted. Nothing is in flight and no worktree exists. + Docs landed with them: `ghostlight-world-consumer-api.md` rewritten + as a live contract (no longer drift); the ontology "Current mechanism" + through pass 10 closing with "Step 6 of the plan is complete; the + outbound consumer response is the next seam."; the mvp doc's + `MutationAuthorityEnvelope` and external-mirror-as-subject-kind + corrected; the plan's step-6 pass-10 line in past tense. Queued doc + edits: none. Still deferred by design: `PolityInCausalRange`, `IndividuationRequired`, - and Verification 13 wait for relations and population slices. Pass 10 - (consumer ingress) carries four named debts: authority, decode-time size - bounds, phase, and boundary answering, plus the `mesh.rs` inbound ruling. + and Verification 13 wait for relations and population slices. + + Decisions the operator owns, recorded nowhere else durable than here and + the series evidence record: (a) whether a refused coupled constituent may + re-submit once inside the same tick, to be taken with the + submitted-versus-committed number in hand; (b) the authority for an + owner-only Eve `world.run_tick` command, which is not built; (c) whether + the outbound consumer response batch and the non-loopback CultMesh lease + are cut next or the deployment gate below resumes first. The ten specs + and maps (`imagination-pass1..10.md`, `modeling-pass1..10.md`) remain in + the session scratchpad only and are now history, not steering; the docs + own the design. - Queued doc edits, coordinator-owned: the pass-9 "Current mechanism" - paragraph, written with the follow-ups; and a config note for - `GHOSTLIGHT_CONTROLLER_ELABORATOR_MODEL`, which no doc names yet. The - pass-9 environment variables are in the uncommitted mvp edit (line 449) - and the ceil(N/R) wording in the uncommitted ontology edit (line 601). 2. First-generation world fixtures are banked and pushed, one per world, each with Ink, training sidecar, visual plan, lore grounding, and BFL manifest, reviewer-accepted except visual replay, which waits on a scene-set @@ -374,7 +355,7 @@ continuity, route preservation, split-brain fencing, signed health, Odin-outage freeze, and negative legacy-authority checks must all agree before purge. Deploy the Connector and then Ghostlight through that contract. Runtime restart, -route continuity, signed health, exact receipts, exclusive world-v2 state, and +route continuity, signed health, exact receipts, exclusive world-v3 state, and negative checks must agree before deleting old services, releases, state, acceptance roots, and local run scaffolding. @@ -405,7 +386,7 @@ otes aculty-workflow-lessons-2026-09-04.md` - Do not invoke the current bounded Connector or Ghostlight redeploy helpers; they fail at the root/Idunn Git boundary and still embody duplicate target deployment authority. -- Do not prove world-v2 purity with a short deny list. Archive the complete old +- Do not prove world-v3 purity with a short deny list. Archive the complete old state root or validate a complete allowed-path contract. - Keep this handoff compact. Move chronology to Git, evidence, or the frozen system map. diff --git a/notes/ghostlight-current-system-map.md b/notes/ghostlight-current-system-map.md index ad0ab0a..f0b3002 100644 --- a/notes/ghostlight-current-system-map.md +++ b/notes/ghostlight-current-system-map.md @@ -76,7 +76,7 @@ source cutover is not deployment evidence. are wired to that mailbox boundary in the committed source. - **Cut line:** source subtraction is complete. Production cutover now belongs to Idunn's typed deployment path: admit the replacement release and exclusive - world-v2 state without a dual-write or compatibility bridge, prove restart + world-v3 state without a dual-write or compatibility bridge, prove restart and negative legacy authority, then remove the old hosted body and state. - **Verification layer:** the reducer checks exact authentication, world, revision, lifecycle, approver, controller, opportunity, scope, affordance, diff --git a/notes/ghostlight-implementation-plan.md b/notes/ghostlight-implementation-plan.md index 013ecc3..d613291 100644 --- a/notes/ghostlight-implementation-plan.md +++ b/notes/ghostlight-implementation-plan.md @@ -233,7 +233,7 @@ promote without the exact frozen Odin Ready receipt for that runtime instance and presence digest. Idunn never manufactures Ready locally. Deploy CodexConnector first, then Ghostlight. Ghostlight's live cut archives the -entire legacy state root, creates a clean world-v2 root, and validates a complete +entire legacy state root, creates a clean world-v3 root, and validates a complete allowed live layout. After route, health, process, write lease, restart, and negative legacy checks agree, delete the old units, releases, state roots, acceptance debris, gamecult-ops target deploy programs, and local run @@ -278,11 +278,23 @@ Implementation order, each pass landing tests before the next begins: singleton detail focus, grouped coarse cells with partitioned views and per-constituent attribution, debt rotation. Scheduler-owned; the kernel never sees a cell. -10. Consumer ingress: the typed CultNet ingress through which an external - consumer submits a `WorldPatch` or proposal to the sealed kernel. Until - this lands the elaborator lane is the only production author of a - `WorldPatch`, and the kernel has no decode-time bound of its own; pass 10 - gives it one owner for both lanes. +10. Consumer ingress: landed in pass 10. `SystemCapability::Consumer` is the + world's third `AdmitPatch` author, minted only by + `WorldMailbox::submit_consumer` after `world/consumer.rs` authenticates a + `ConsumerPatchDocument` against a `ConsumerRegistry` secret digest. + `require_patch_author`/`confine_to_ground` widen to `PatchGround::Consumer`, + confining a consumer to the subjects declared + `NewController::External { consumer }` (`ControllerAssignment::ExternallyControlled`, + no controller ID, no mode, no opportunity, no affordance). `patch::decode_patch` + is the one decode bound, shared by the elaborator lane and the consumer + lane, under `MAX_PATCH_BYTES`/`_DECLARATIONS`/`_OPERATIONS`/`_EVIDENCE`. The + transport is `POST /cultnet/world-patch`, loopback-only, canonical + MessagePack, schemas `ghostlight.consumer_patch.v0` and + `ghostlight.consumer_receipt.v0`; the state/commit schemas bumped to + `ghostlight.world_state.consumer.v1` / `ghostlight.world_commit.consumer.v1` + (`world-v3`). The outbound consumer response — a consumer reading its own + projection or an attributed proposal — is the next seam, not part of this + pass. The deployment cutover (step 5) is deferred behind this stage, not cancelled. No world acceptance run may start while Yggdrasil serves the legacy body. diff --git a/state/evidence.jsonl b/state/evidence.jsonl index 5b89a5b..4d30420 100644 --- a/state/evidence.jsonl +++ b/state/evidence.jsonl @@ -36,4 +36,5 @@ {"note": "Ontology v2 unifies elaboration and character action under one WorldPatch and one deterministic verifier. Three decisions change future belief: (1) affordances are world-authored data (preconditions, effect slots, weighted outcome bands) over a closed 29-operation kernel set, so genre lives in the seed and the kernel never learns one; (2) uncertainty is resolved by kernel entropy seeded from world/revision/command, so no model ever chooses success, which deletes the legacy wave-level outcome resolver; (3) proposals bind to a scope digest of the components their verification reads rather than the whole state digest, so eight elaborator loops and many subjects do not serialize on one revision, replacing the stale-means-discard rule. Elaborator tools are a derived projection of the operation set and cannot drift. ghostlight-multiresolution-agency.md is demoted to teardown evidence keeping only resumable sessions, compact drafts, and the complete mismatch set.", "status": "ok", "ts": "2026-09-04T14:01:12+00:00", "type": "research"} {"note": "Operator correction, 2026-09-04: the 2,400-subject / 240-cell / 10% cover profile is a design target, not a load fixture. A world feels alive only when actors at every level pursue their own goals; that requires generating that detail first and then choking multiresolution simulation so attention is scarce and selection is forced. The mvp doc sentence calling the profile \"test data, not a production elaboration target\" was teardown-era text, not operator design, and is amended. Ontology v2 now carries: an authored WorldScaleIntent with a structurally counted deficit (qualified subject = active, one controller, one Goal commitment, one affordance) that elaborators pursue after boundaries; a budgeted connected cover every tick with singleton detail cells and grouped coarse cells; per-constituent attribution and partitioned knowledge in grouped cells; debt rotation. Still deleted: gestalt as canonical identity, arena knowledge union, semantic qualification and verification models, fission quotas as mutation, string identifiers.", "status": "ok", "ts": "2026-09-04T14:14:10+00:00", "type": "research"} {"note": "Codex CLI fan-out that must commit cannot run in a linked git worktree. A linked worktree's .git is a file pointing into the parent repo's .git/worktrees/, which is outside the Codex sandbox's writable roots, so every git commit fails with index.lock Permission denied; the default sandbox also blocks outbound push. All four world workers died on this on 2026-09-04. Fix: full clones at the same paths (F:/Projects/Ghostlight-worlds/, F:/Projects/-worktrees/ghostlight-worlds; .git is a directory despite the directory name) and launch with -c sandbox_workspace_write.network_access=true. Uncommitted worker output was banked by hand to codex/world- and codex/ghostlight-worlds before the worktrees were removed. Rule for any future Codex fan-out that writes: give each worker a clone whose entire .git lives under its own writable root, and grant network if it must push.", "status": "ok", "ts": "2026-09-04T14:18:47+00:00", "type": "verification"} -{"ts": "2026-09-04T15:04:24+00:00", "type": "verification", "status": "ok", "note": "Supersedes the 2026-09-04T14:18 clone-plus-network record, which was necessary but not sufficient. The Codex workspace-write sandbox keeps .git read-only even when the whole clone sits under the writable root, so a Codex worker can never commit or push regardless of clone layout or network grant. Rule for any Codex fan-out that must produce committed work: the worker writes files only; a supervisor outside the sandbox commits and pushes the clone after the worker exits. The world elaborator scheduler (C:/Users/Meta/.claude/worlds/Invoke-Elaborators.ps1) does this per slot to slot///<stamp> branches in both the Ghostlight world clone and the lore clone, recording completions in logs/elab-done.csv; integration into codex/world-<world> and codex/ghostlight-worlds is a separate deliberate pass. First banked fixture: Delvehold cistern-house-nine-breaker-test, codex/world-delvehold 9374fd0."} +{"note": "Supersedes the 2026-09-04T14:18 clone-plus-network record, which was necessary but not sufficient. The Codex workspace-write sandbox keeps .git read-only even when the whole clone sits under the writable root, so a Codex worker can never commit or push regardless of clone layout or network grant. Rule for any Codex fan-out that must produce committed work: the worker writes files only; a supervisor outside the sandbox commits and pushes the clone after the worker exits. The world elaborator scheduler (C:/Users/Meta/.claude/worlds/Invoke-Elaborators.ps1) does this per slot to slot/<world>/<title>/<stamp> branches in both the Ghostlight world clone and the lore clone, recording completions in logs/elab-done.csv; integration into codex/world-<world> and codex/ghostlight-worlds is a separate deliberate pass. First banked fixture: Delvehold cistern-house-nine-breaker-test, codex/world-delvehold 9374fd0.", "status": "ok", "ts": "2026-09-04T15:04:24+00:00", "type": "verification"} +{"ts": "2026-09-05T02:13:22+00:00", "type": "implementation", "status": "ok", "note": "Plan step 6, the ontology widening, is complete: ten passes landed on codex/ghostlight-dungeon-mvp between 2026-09-04 and 2026-09-05, each as a Hands cut in an isolation worktree, a Soul falsification in the same tree, and a fast-forward integration. Pass tips: 1 typed ID namespaces and closed patch resolution 5e53beb; 2 Position/Route/containment and scope-digest binding e99af63; 3 Custody/Dependency/conservation d2805fe; 4 world-authored affordance catalog with kernel-entropy bands 0f21a49; 5 Authority/Selection/Redress dbe176d; 6 Knowledge/Channel/Fact standing cb6a126; 7 clock, Commitment, Pressure, derived CausalBoundary and the structural answer rule 1852ddd; 8 confined elaborator lane and derived tool catalog 3ed3868; 9 budgeted connected cover with tick-driven fairness ceil(N/R), R = cells minus urgency slots, verified 22 ticks at the 2,400/240 profile 8aebfb6; 10 confined external consumer ingress over POST /cultnet/world-patch a1fd645. The kernel now holds 12 decision-constraining component kinds over 27 named operations under one WorldPatch, one reducer, one CAS commit, one decode bound for both authoring lanes, and three confined SystemCapability arms (Clock, Elaborator, Consumer); the action vocabulary is data in the seed and the kernel never learns a genre. The eleven plan invariants hold structurally at the end of the series per Soul: one deterministic reducer and atomic commit; kernel-derived authority; one controller per scope with no fallback or double action; total interpretation with exact gaps; deterministic structural rejection without a model verifier; scoped knowledge until explicit communication; external-consumer sovereignty; sparse causal sufficiency with counts as evidence only; restart reconstructs the exact world; IDs allocated only inside an admitted reduction; opportunities bound to a scope digest rather than a revision. The pairing invariant is re-decided at three gates by doctrine, not by a repair loop. Test surface grew from 43 world / 83 crate at the series start to 313 world / 357 crate source functions at a1fd645 (focused world:: run 312 / 352). Two design decisions remain with the operator and are recorded nowhere else durable: whether a refused coupled constituent may re-submit once inside the same tick, to be decided with the submitted-versus-committed number in hand; and the authority for an owner-only Eve world.run_tick command. The next seam after the series is the outbound consumer response batch and a non-loopback CultMesh lease."} diff --git a/state/ghostlight-state.cultcache.jsonl b/state/ghostlight-state.cultcache.jsonl index 68df992..8010f1b 100644 --- a/state/ghostlight-state.cultcache.jsonl +++ b/state/ghostlight-state.cultcache.jsonl @@ -38,3 +38,4 @@ {"key": "2026-09-04T141410Z0000-0036-a61849b93cf5", "payload": "eyJub3RlIjogIk9wZXJhdG9yIGNvcnJlY3Rpb24sIDIwMjYtMDktMDQ6IHRoZSAyLDQwMC1zdWJqZWN0IC8gMjQwLWNlbGwgLyAxMCUgY292ZXIgcHJvZmlsZSBpcyBhIGRlc2lnbiB0YXJnZXQsIG5vdCBhIGxvYWQgZml4dHVyZS4gQSB3b3JsZCBmZWVscyBhbGl2ZSBvbmx5IHdoZW4gYWN0b3JzIGF0IGV2ZXJ5IGxldmVsIHB1cnN1ZSB0aGVpciBvd24gZ29hbHM7IHRoYXQgcmVxdWlyZXMgZ2VuZXJhdGluZyB0aGF0IGRldGFpbCBmaXJzdCBhbmQgdGhlbiBjaG9raW5nIG11bHRpcmVzb2x1dGlvbiBzaW11bGF0aW9uIHNvIGF0dGVudGlvbiBpcyBzY2FyY2UgYW5kIHNlbGVjdGlvbiBpcyBmb3JjZWQuIFRoZSBtdnAgZG9jIHNlbnRlbmNlIGNhbGxpbmcgdGhlIHByb2ZpbGUgXCJ0ZXN0IGRhdGEsIG5vdCBhIHByb2R1Y3Rpb24gZWxhYm9yYXRpb24gdGFyZ2V0XCIgd2FzIHRlYXJkb3duLWVyYSB0ZXh0LCBub3Qgb3BlcmF0b3IgZGVzaWduLCBhbmQgaXMgYW1lbmRlZC4gT250b2xvZ3kgdjIgbm93IGNhcnJpZXM6IGFuIGF1dGhvcmVkIFdvcmxkU2NhbGVJbnRlbnQgd2l0aCBhIHN0cnVjdHVyYWxseSBjb3VudGVkIGRlZmljaXQgKHF1YWxpZmllZCBzdWJqZWN0ID0gYWN0aXZlLCBvbmUgY29udHJvbGxlciwgb25lIEdvYWwgY29tbWl0bWVudCwgb25lIGFmZm9yZGFuY2UpIHRoYXQgZWxhYm9yYXRvcnMgcHVyc3VlIGFmdGVyIGJvdW5kYXJpZXM7IGEgYnVkZ2V0ZWQgY29ubmVjdGVkIGNvdmVyIGV2ZXJ5IHRpY2sgd2l0aCBzaW5nbGV0b24gZGV0YWlsIGNlbGxzIGFuZCBncm91cGVkIGNvYXJzZSBjZWxsczsgcGVyLWNvbnN0aXR1ZW50IGF0dHJpYnV0aW9uIGFuZCBwYXJ0aXRpb25lZCBrbm93bGVkZ2UgaW4gZ3JvdXBlZCBjZWxsczsgZGVidCByb3RhdGlvbi4gU3RpbGwgZGVsZXRlZDogZ2VzdGFsdCBhcyBjYW5vbmljYWwgaWRlbnRpdHksIGFyZW5hIGtub3dsZWRnZSB1bmlvbiwgc2VtYW50aWMgcXVhbGlmaWNhdGlvbiBhbmQgdmVyaWZpY2F0aW9uIG1vZGVscywgZmlzc2lvbiBxdW90YXMgYXMgbXV0YXRpb24sIHN0cmluZyBpZGVudGlmaWVycy4iLCAic3RhdHVzIjogIm9rIiwgInRzIjogIjIwMjYtMDktMDRUMTQ6MTQ6MTArMDA6MDAiLCAidHlwZSI6ICJyZXNlYXJjaCJ9", "stored_at": "2026-09-04T14:14:10.337953+00:00", "type": "ghostlight.evidence_record.v0"} {"key": "2026-09-04T141847Z0000-0037-edecdf5c6e4b", "payload": "eyJub3RlIjogIkNvZGV4IENMSSBmYW4tb3V0IHRoYXQgbXVzdCBjb21taXQgY2Fubm90IHJ1biBpbiBhIGxpbmtlZCBnaXQgd29ya3RyZWUuIEEgbGlua2VkIHdvcmt0cmVlJ3MgLmdpdCBpcyBhIGZpbGUgcG9pbnRpbmcgaW50byB0aGUgcGFyZW50IHJlcG8ncyAuZ2l0L3dvcmt0cmVlcy8sIHdoaWNoIGlzIG91dHNpZGUgdGhlIENvZGV4IHNhbmRib3gncyB3cml0YWJsZSByb290cywgc28gZXZlcnkgZ2l0IGNvbW1pdCBmYWlscyB3aXRoIGluZGV4LmxvY2sgUGVybWlzc2lvbiBkZW5pZWQ7IHRoZSBkZWZhdWx0IHNhbmRib3ggYWxzbyBibG9ja3Mgb3V0Ym91bmQgcHVzaC4gQWxsIGZvdXIgd29ybGQgd29ya2VycyBkaWVkIG9uIHRoaXMgb24gMjAyNi0wOS0wNC4gRml4OiBmdWxsIGNsb25lcyBhdCB0aGUgc2FtZSBwYXRocyAoRjovUHJvamVjdHMvR2hvc3RsaWdodC13b3JsZHMvPHdvcmxkPiwgRjovUHJvamVjdHMvPExvcmU+LXdvcmt0cmVlcy9naG9zdGxpZ2h0LXdvcmxkczsgLmdpdCBpcyBhIGRpcmVjdG9yeSBkZXNwaXRlIHRoZSBkaXJlY3RvcnkgbmFtZSkgYW5kIGxhdW5jaCB3aXRoIC1jIHNhbmRib3hfd29ya3NwYWNlX3dyaXRlLm5ldHdvcmtfYWNjZXNzPXRydWUuIFVuY29tbWl0dGVkIHdvcmtlciBvdXRwdXQgd2FzIGJhbmtlZCBieSBoYW5kIHRvIGNvZGV4L3dvcmxkLTx3b3JsZD4gYW5kIGNvZGV4L2dob3N0bGlnaHQtd29ybGRzIGJlZm9yZSB0aGUgd29ya3RyZWVzIHdlcmUgcmVtb3ZlZC4gUnVsZSBmb3IgYW55IGZ1dHVyZSBDb2RleCBmYW4tb3V0IHRoYXQgd3JpdGVzOiBnaXZlIGVhY2ggd29ya2VyIGEgY2xvbmUgd2hvc2UgZW50aXJlIC5naXQgbGl2ZXMgdW5kZXIgaXRzIG93biB3cml0YWJsZSByb290LCBhbmQgZ3JhbnQgbmV0d29yayBpZiBpdCBtdXN0IHB1c2guIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA5LTA0VDE0OjE4OjQ3KzAwOjAwIiwgInR5cGUiOiAidmVyaWZpY2F0aW9uIn0=", "stored_at": "2026-09-04T14:18:47.920625+00:00", "type": "ghostlight.evidence_record.v0"} {"key": "2026-09-04T150424Z0000-0038-a237611b3305", "payload": "eyJub3RlIjogIlN1cGVyc2VkZXMgdGhlIDIwMjYtMDktMDRUMTQ6MTggY2xvbmUtcGx1cy1uZXR3b3JrIHJlY29yZCwgd2hpY2ggd2FzIG5lY2Vzc2FyeSBidXQgbm90IHN1ZmZpY2llbnQuIFRoZSBDb2RleCB3b3Jrc3BhY2Utd3JpdGUgc2FuZGJveCBrZWVwcyAuZ2l0IHJlYWQtb25seSBldmVuIHdoZW4gdGhlIHdob2xlIGNsb25lIHNpdHMgdW5kZXIgdGhlIHdyaXRhYmxlIHJvb3QsIHNvIGEgQ29kZXggd29ya2VyIGNhbiBuZXZlciBjb21taXQgb3IgcHVzaCByZWdhcmRsZXNzIG9mIGNsb25lIGxheW91dCBvciBuZXR3b3JrIGdyYW50LiBSdWxlIGZvciBhbnkgQ29kZXggZmFuLW91dCB0aGF0IG11c3QgcHJvZHVjZSBjb21taXR0ZWQgd29yazogdGhlIHdvcmtlciB3cml0ZXMgZmlsZXMgb25seTsgYSBzdXBlcnZpc29yIG91dHNpZGUgdGhlIHNhbmRib3ggY29tbWl0cyBhbmQgcHVzaGVzIHRoZSBjbG9uZSBhZnRlciB0aGUgd29ya2VyIGV4aXRzLiBUaGUgd29ybGQgZWxhYm9yYXRvciBzY2hlZHVsZXIgKEM6L1VzZXJzL01ldGEvLmNsYXVkZS93b3JsZHMvSW52b2tlLUVsYWJvcmF0b3JzLnBzMSkgZG9lcyB0aGlzIHBlciBzbG90IHRvIHNsb3QvPHdvcmxkPi88dGl0bGU+LzxzdGFtcD4gYnJhbmNoZXMgaW4gYm90aCB0aGUgR2hvc3RsaWdodCB3b3JsZCBjbG9uZSBhbmQgdGhlIGxvcmUgY2xvbmUsIHJlY29yZGluZyBjb21wbGV0aW9ucyBpbiBsb2dzL2VsYWItZG9uZS5jc3Y7IGludGVncmF0aW9uIGludG8gY29kZXgvd29ybGQtPHdvcmxkPiBhbmQgY29kZXgvZ2hvc3RsaWdodC13b3JsZHMgaXMgYSBzZXBhcmF0ZSBkZWxpYmVyYXRlIHBhc3MuIEZpcnN0IGJhbmtlZCBmaXh0dXJlOiBEZWx2ZWhvbGQgY2lzdGVybi1ob3VzZS1uaW5lLWJyZWFrZXItdGVzdCwgY29kZXgvd29ybGQtZGVsdmVob2xkIDkzNzRmZDAuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA5LTA0VDE1OjA0OjI0KzAwOjAwIiwgInR5cGUiOiAidmVyaWZpY2F0aW9uIn0=", "stored_at": "2026-09-04T15:04:24.134358+00:00", "type": "ghostlight.evidence_record.v0"} +{"key": "2026-09-05T021322Z0000-0039-8fe6fe49acb8", "payload": "eyJub3RlIjogIlBsYW4gc3RlcCA2LCB0aGUgb250b2xvZ3kgd2lkZW5pbmcsIGlzIGNvbXBsZXRlOiB0ZW4gcGFzc2VzIGxhbmRlZCBvbiBjb2RleC9naG9zdGxpZ2h0LWR1bmdlb24tbXZwIGJldHdlZW4gMjAyNi0wOS0wNCBhbmQgMjAyNi0wOS0wNSwgZWFjaCBhcyBhIEhhbmRzIGN1dCBpbiBhbiBpc29sYXRpb24gd29ya3RyZWUsIGEgU291bCBmYWxzaWZpY2F0aW9uIGluIHRoZSBzYW1lIHRyZWUsIGFuZCBhIGZhc3QtZm9yd2FyZCBpbnRlZ3JhdGlvbi4gUGFzcyB0aXBzOiAxIHR5cGVkIElEIG5hbWVzcGFjZXMgYW5kIGNsb3NlZCBwYXRjaCByZXNvbHV0aW9uIDVlNTNiZWI7IDIgUG9zaXRpb24vUm91dGUvY29udGFpbm1lbnQgYW5kIHNjb3BlLWRpZ2VzdCBiaW5kaW5nIGU5OWFmNjM7IDMgQ3VzdG9keS9EZXBlbmRlbmN5L2NvbnNlcnZhdGlvbiBkMjgwNWZlOyA0IHdvcmxkLWF1dGhvcmVkIGFmZm9yZGFuY2UgY2F0YWxvZyB3aXRoIGtlcm5lbC1lbnRyb3B5IGJhbmRzIDBmMjFhNDk7IDUgQXV0aG9yaXR5L1NlbGVjdGlvbi9SZWRyZXNzIGRiZTE3NmQ7IDYgS25vd2xlZGdlL0NoYW5uZWwvRmFjdCBzdGFuZGluZyBjYjZhMTI2OyA3IGNsb2NrLCBDb21taXRtZW50LCBQcmVzc3VyZSwgZGVyaXZlZCBDYXVzYWxCb3VuZGFyeSBhbmQgdGhlIHN0cnVjdHVyYWwgYW5zd2VyIHJ1bGUgMTg1MmRkZDsgOCBjb25maW5lZCBlbGFib3JhdG9yIGxhbmUgYW5kIGRlcml2ZWQgdG9vbCBjYXRhbG9nIDNlZDM4Njg7IDkgYnVkZ2V0ZWQgY29ubmVjdGVkIGNvdmVyIHdpdGggdGljay1kcml2ZW4gZmFpcm5lc3MgY2VpbChOL1IpLCBSID0gY2VsbHMgbWludXMgdXJnZW5jeSBzbG90cywgdmVyaWZpZWQgMjIgdGlja3MgYXQgdGhlIDIsNDAwLzI0MCBwcm9maWxlIDhhZWJmYjY7IDEwIGNvbmZpbmVkIGV4dGVybmFsIGNvbnN1bWVyIGluZ3Jlc3Mgb3ZlciBQT1NUIC9jdWx0bmV0L3dvcmxkLXBhdGNoIGExZmQ2NDUuIFRoZSBrZXJuZWwgbm93IGhvbGRzIDEyIGRlY2lzaW9uLWNvbnN0cmFpbmluZyBjb21wb25lbnQga2luZHMgb3ZlciAyNyBuYW1lZCBvcGVyYXRpb25zIHVuZGVyIG9uZSBXb3JsZFBhdGNoLCBvbmUgcmVkdWNlciwgb25lIENBUyBjb21taXQsIG9uZSBkZWNvZGUgYm91bmQgZm9yIGJvdGggYXV0aG9yaW5nIGxhbmVzLCBhbmQgdGhyZWUgY29uZmluZWQgU3lzdGVtQ2FwYWJpbGl0eSBhcm1zIChDbG9jaywgRWxhYm9yYXRvciwgQ29uc3VtZXIpOyB0aGUgYWN0aW9uIHZvY2FidWxhcnkgaXMgZGF0YSBpbiB0aGUgc2VlZCBhbmQgdGhlIGtlcm5lbCBuZXZlciBsZWFybnMgYSBnZW5yZS4gVGhlIGVsZXZlbiBwbGFuIGludmFyaWFudHMgaG9sZCBzdHJ1Y3R1cmFsbHkgYXQgdGhlIGVuZCBvZiB0aGUgc2VyaWVzIHBlciBTb3VsOiBvbmUgZGV0ZXJtaW5pc3RpYyByZWR1Y2VyIGFuZCBhdG9taWMgY29tbWl0OyBrZXJuZWwtZGVyaXZlZCBhdXRob3JpdHk7IG9uZSBjb250cm9sbGVyIHBlciBzY29wZSB3aXRoIG5vIGZhbGxiYWNrIG9yIGRvdWJsZSBhY3Rpb247IHRvdGFsIGludGVycHJldGF0aW9uIHdpdGggZXhhY3QgZ2FwczsgZGV0ZXJtaW5pc3RpYyBzdHJ1Y3R1cmFsIHJlamVjdGlvbiB3aXRob3V0IGEgbW9kZWwgdmVyaWZpZXI7IHNjb3BlZCBrbm93bGVkZ2UgdW50aWwgZXhwbGljaXQgY29tbXVuaWNhdGlvbjsgZXh0ZXJuYWwtY29uc3VtZXIgc292ZXJlaWdudHk7IHNwYXJzZSBjYXVzYWwgc3VmZmljaWVuY3kgd2l0aCBjb3VudHMgYXMgZXZpZGVuY2Ugb25seTsgcmVzdGFydCByZWNvbnN0cnVjdHMgdGhlIGV4YWN0IHdvcmxkOyBJRHMgYWxsb2NhdGVkIG9ubHkgaW5zaWRlIGFuIGFkbWl0dGVkIHJlZHVjdGlvbjsgb3Bwb3J0dW5pdGllcyBib3VuZCB0byBhIHNjb3BlIGRpZ2VzdCByYXRoZXIgdGhhbiBhIHJldmlzaW9uLiBUaGUgcGFpcmluZyBpbnZhcmlhbnQgaXMgcmUtZGVjaWRlZCBhdCB0aHJlZSBnYXRlcyBieSBkb2N0cmluZSwgbm90IGJ5IGEgcmVwYWlyIGxvb3AuIFRlc3Qgc3VyZmFjZSBncmV3IGZyb20gNDMgd29ybGQgLyA4MyBjcmF0ZSBhdCB0aGUgc2VyaWVzIHN0YXJ0IHRvIDMxMyB3b3JsZCAvIDM1NyBjcmF0ZSBzb3VyY2UgZnVuY3Rpb25zIGF0IGExZmQ2NDUgKGZvY3VzZWQgd29ybGQ6OiBydW4gMzEyIC8gMzUyKS4gVHdvIGRlc2lnbiBkZWNpc2lvbnMgcmVtYWluIHdpdGggdGhlIG9wZXJhdG9yIGFuZCBhcmUgcmVjb3JkZWQgbm93aGVyZSBlbHNlIGR1cmFibGU6IHdoZXRoZXIgYSByZWZ1c2VkIGNvdXBsZWQgY29uc3RpdHVlbnQgbWF5IHJlLXN1Ym1pdCBvbmNlIGluc2lkZSB0aGUgc2FtZSB0aWNrLCB0byBiZSBkZWNpZGVkIHdpdGggdGhlIHN1Ym1pdHRlZC12ZXJzdXMtY29tbWl0dGVkIG51bWJlciBpbiBoYW5kOyBhbmQgdGhlIGF1dGhvcml0eSBmb3IgYW4gb3duZXItb25seSBFdmUgd29ybGQucnVuX3RpY2sgY29tbWFuZC4gVGhlIG5leHQgc2VhbSBhZnRlciB0aGUgc2VyaWVzIGlzIHRoZSBvdXRib3VuZCBjb25zdW1lciByZXNwb25zZSBiYXRjaCBhbmQgYSBub24tbG9vcGJhY2sgQ3VsdE1lc2ggbGVhc2UuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA5LTA1VDAyOjEzOjIyKzAwOjAwIiwgInR5cGUiOiAiaW1wbGVtZW50YXRpb24ifQ==", "stored_at": "2026-09-05T02:13:22.785718+00:00", "type": "ghostlight.evidence_record.v0"} diff --git a/state/map.yaml b/state/map.yaml index fdbc313..df53625 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -226,9 +226,8 @@ pre_rebuild_architecture: active_subgoals: - Finish and verify the smallest Idunn-owned Expected/activation/anchor/lease projection and shared bounded RUDP document transport, then land a directly managed Rust Odin that owns signed runtime observation and Expected/Present/Ready correlation. Resolve exact capability dependency closure inside the existing deployment transaction, add UDP stable-route actuation plus independently persisted post-reload data-plane observation through the existing proxy, and preserve same-generation physical continuity without granting Idunn semantic Present/Ready authority. Verify on Yggdrasil, admit Odin first, then CodexConnector and Ghostlight, prove outage/fencing/routing/legacy-negative invariants, and purge every old executable authority. - - Connect a Delvehold-owned adapter to the admitted generic consumer contract: shared compiler/consumer WorldSeed admission, externally authoritative institution-or-Gestalt snapshots, attributed proposal acknowledgement, and committed-event newspaper composition over typed CultNet, without consumer-specific IDs or schemas in Ghostlight. + - Build the outbound half of the consumer contract (the consumer's read of its own projection and attributed intents toward its subject as a typed response document) and a non-loopback CultMesh authority lease, then connect a Delvehold-owned adapter to the landed inbound ingress (POST /cultnet/world-patch, ConsumerPort, PatchGround::Consumer) without consumer-specific IDs or schemas in Ghostlight. - Extend strategic/offscreen named-person individuation beyond the proven emerge-then-act path so people plot across sustained political waves, acquire relationships, fold, and return without granting a cell, arena, or model commit authority. - - Finish the semantic mutation migration: delete or demote remaining legacy model effect schemas and move aggregate campaign fields toward projection-only state. Seed publication and named-person presence now have explicit non-effect authority classifications. - Keep the selectable Kalsa Vault's Public player-safe and Spoilers GM-only evidence lanes intact through Git/Obsidian sync, retrieval, exact receipts, and player projection. Do not import it into the read-only Aetheria recovery index or create a rival Ghostlight semantic index. - Grow the 36-case candidate agency corpus toward 300 reviewed, behaviorally distinct attempts that either compose from existing primitives, produce an explicit bargain, or falsify the algebra. - Pressure live campaign compilation and play from exact Vault evidence; reject honest gaps instead of borrowing a nearby fixture, cast, or geography. @@ -358,8 +357,8 @@ current_status: provider_acceptance_checkpoint: Exact pushed commit `139b8a6` completed Run 60 under `character-newsroom.v10` without world or per-wave replay. Its acceptance witness and terminal status bind the completed page and exact resume lineage. The independently dispatched blind reviewer, shown only the reader-facing fantasy newspaper, read it as a real left-populist civic broadsheet and did not immediately identify procedural generation, so the narrative reverse-Turing criterion passes. The review's substantive criticism is that the three stories feel like three rewrites of one briefing; accepted Run 60 remains immutable. The run used 96,902 prompt tokens and reported zero cache hits. Its delivered typeset artifact is `output/pdf/canopy-ledger-run-60-front-page.pdf`; frozen-source and visual verification remain accepted. Exact pushed `bc2ca39` then produced frozen-fact newsroom-only Run 61 Issues 13, 15, 16, 17, and 18 without world or wave model replay. Provider output proves `special_issue` convergence in Issues 13 and 15, independent `general_issue` beats in Issues 16 through 18, and assignment-selector cache hits. Blind review of Issues 13, 15, 16, and 17 passes both distinct recurring voices and issue-shape diversity, recognizing Ossan, Mera, Corin, and Lysa's biases plus modest cross-issue evolution. Run 62 exercised v12 without world or wave replay and failed only because two lead articles proposed invalid datelines; recurring reporter calls still recorded zero cache hits. Run 63 used exact pushed v13 `a52d57b`; Issues 17 and 18 completed before root stopped the final weekly recomposition, both repeated bylines again recorded zero cache hits, and live services remained unchanged. Preserve Runs 61 through 63 as stopped or completed immutable evidence. Copy defects remain later deadline-correction work rather than a reason to reopen accepted issue artifacts. implementation_checkpoint: Pushed commit `6bb6869` makes the replacement mailbox/kernel architecture the crate and executable runtime identity and removes the legacy runtime owner. Pushed commit `13d5136` unifies app sessions, world journal, and controller custody under the vendored CultCache implementation and deletes the duplicate legacy CultCache dependency. The committed daemon tree has no old Session Zero, legacy kernel, scheduler, assessor, verifier/reconciliation, or legacy-transition module path. CultNet in CultLib `85f7024` owns the current activation, brake, lease, observed-capability, disagreement, and RUDP-route contracts. Odin `65cf2b2` owns exact source/release actuation and the durable three-record, nine-phase transaction body. Ghostlight `d0510ac` consumes CultCache, CultNet and CultMesh from CultLib `85f7024` instead of vendoring its own generation of them, deleting 19,604 lines of forked substrate; Ghostlight `751b5c4` stops naming its own runtime id, bind, and state root and takes all three from Idunn, which the recipe's required `state_root` argument binding makes mandatory rather than cosmetic; Ghostlight `6a79cb0` and CodexConnector `ede3c30` own their respective provider contracts; `9256648` exposes managed Ghostlight route presence and `6a79cb0` republishes Warming while awaiting the write lease. The remaining uncommitted Odin work is Idunn projection, bounded RUDP transport, and stable-route integration; the directly managed Rust Odin correlation daemon and exact dependency closure are not yet implemented. The worktree is clean: no Ghostlight drift remains between the committed tree and the deployment gate. This proves source and contract foundations, not live deployment: Yggdrasil remains on the legacy bodies until Idunn performs the one-way cut. full_world_acceptance_checkpoint: Run 115 is terminal failed at `/var/lib/gamecult/ghostlight-dungeon/acceptance/full-world-delvehold-0a83034-115`, semantic revision 2, regions 2/8, waves 0/1. Resume2 ended on provider SSE timeout. Resume3 exhausted four reconciliation steps after `inst:kharad-road-keepers` referenced unknown `loc:kharad-rhythm-road`. Preserve the root, receipts, service invocation `d9254cd9b77946aebcf7a7fdae821402`, and failed patch sequence through 8964a92 as immutable evidence. Do not resume it. - scale_checkpoint: Runs 108 through 115 prove load and failure properties of the pre-rebuild body, not world completeness. Operator directive 2026-09-04: the 2,400-subject / 240-cell / 10% cover profile is deliberate design, not a load fixture; a world feels alive only when actors at every level pursue their own goals, so that detail is generated first and multiresolution simulation is then choked so attention is scarce. The seed carries a `WorldScaleIntent`, the elaborators pursue its derived scale deficit, and cover budget is the choke. The 1,200-actor fixture is a load measure only. Structural admission still cannot require interest, diversity, name uniqueness, or an actor count; validity never waits on a count, liveness is authored. The committed replacement authority suite passes, but no further scale run is admitted until Yggdrasil serves the exact world-v2 release through the rebuilt Idunn recipe/binding/router seam, the live state root satisfies the complete world-v2 allowed-path contract, restart preserves exact journal and digest identity, and no old service, state path, process grant, or route can regain write authority. + scale_checkpoint: Runs 108 through 115 prove load and failure properties of the pre-rebuild body, not world completeness. Operator directive 2026-09-04: the 2,400-subject / 240-cell / 10% cover profile is deliberate design, not a load fixture; a world feels alive only when actors at every level pursue their own goals, so that detail is generated first and multiresolution simulation is then choked so attention is scarce. The seed carries a `WorldScaleIntent`, the elaborators pursue its derived scale deficit, and cover budget is the choke. The 1,200-actor fixture is a load measure only. Structural admission still cannot require interest, diversity, name uniqueness, or an actor count; validity never waits on a count, liveness is authored. The committed replacement authority suite passes, but no further scale run is admitted until Yggdrasil serves the exact world-v3 release through the rebuilt Idunn recipe/binding/router seam, the live state root satisfies the complete world-v3 allowed-path contract, restart preserves exact journal and digest identity, and no old service, state path, process grant, or route can regain write authority. presentation_checkpoint: The historical press-layout and seed-ownership split are complete. `notes/historical-newspaper-layout-grammar.md` remains the durable grammar. Manifest v2 at `output/tex/canopy-ledger-run-61-style-1847-flow-723.manifest.toml` independently binds `style_seed=1847`, `flow_seed=723`, frozen source SHA-256 `8f195140f52a40ba705d6a66987146a1500ae89668e5d82b01d1792eb3afb882`, and the final artifact `output/pdf/canopy-ledger-run-61-style-1847-flow-723.pdf`, SHA-256 `a457f4b1702a7a52480e42fce0039f0dbe677ff32958e98f1c412b346237190c`. An identical seed pair produces byte-identical TeX and PDF; changing only flow preserves the exact style section while materially changing a plausible layout, and changing only style preserves flow topology. Cut-first and cut-midstory templates pass visual inspection; the failed split-card template is deleted. Frozen copy/assets, actual PDF `/BM /Multiply`, and economic-layer advertising authority remain invariant. public_reference_checkpoint: The published public architecture is immutable pre-rebuild history, not current rebuild authority. Canonical Ghostlight commit `15ea0f0` owns five archived pages covering the former overview, authority, pipelines, 43 named production stages, and eight titled elaborators. Site commit `2035e799c2cf7470b2bfc70d5a878d5d3be5e90f` publishes a shared mobile Home/Blog/Docs masthead, visibly marks every Docs page as a teardown archive, and publishes the postmortem `The World Counter Lied` at `https://ghostlight.gamecult.org/Blog/the-world-counter-lied`; live HTTP inspection returned 200 for the postmortem and Docs index and found the masthead and archive banner. Do not use the archived pages to steer the whole-machine rebuild. `docs/architecture/ghostlight-dungeon-mvp.md` owns the adopted target; publish replacement architecture only after the replacement body is implemented and verified. The site repository owns public composition and deployment. - next_action: Ontology v2 is adopted (`docs/architecture/ghostlight-world-ontology.md`; `ghostlight-transition-algebra.md` and `ghostlight-multiresolution-agency.md` are teardown evidence); plan step 6 is nine passes. (1) Passes 1-9 integrated; only pass 10 (consumer ingress) remains in step 6. Tip `8aebfb6` (Soul) over `f013c1d`/`71d8c53` (Hands pass 9), on `7dbbc81`/`b5443d5`; push follows a background crate test, `git status -sb` is the witness. Pass 9: `world/cover.rs` (`TickIndex`, `Resolution`, `CellId`, `Cell`, `Cover`, `CoverBudget`, `AgencyGraph`, `derive_cover`); `ControllerWork::Grouped`/`GroupedCheckpoint`; `InferencePurpose::GroupedAgent`; owner-only port-narrowed `Request::AgencyGraph`; runtime `drive_cover_tick` is the single owner of tick cadence, cover derivation, and the clock (clock advances after the cells; `advance_world_clock` gone); `Semaphore` + `AtomicBool` quarantine replace the controller mutex; env `GHOSTLIGHT_COVER_CELL_BUDGET`/`_CONSTITUENT_CAP`/`_URGENCY_SLOTS`, `GHOSTLIGHT_CONTROLLER_MAX_CONCURRENT`, `GHOSTLIGHT_TICK_INTERVAL_SECONDS`; `controller_work.v8`; world schemas stay `elaboration.v1`; no `Cargo.toml` change, no `uuid/v5`. Rulings: fairness ceil(N/R) with R = cells - urgency slots (2,400/240 closes in 22 ticks); constituent cap yields for capacity and packing, cell budget never yields, oversubscribed is the signal; cover is pure, attention order is a real input; coupled constituents in a grouped cell contend and the second act is refused `ScopeChanged`, heuristic stays; open operator decision: bounded in-tick re-submission for a refused constituent, decided with the submitted-vs-committed number. Eve `world.run_tick` not built, authority pending. Baseline 283 tests in `world/`, 323 crate source (focused `world::` run 282/318). In flight: `hands/pass9-followups` in `F:\Projects\Ghostlight-pass9fu` from `8aebfb6`, no commits yet (`with_test_ports`/`InferencePort`/`ControllerWorkStore` to `pub(crate)` with spec test 13.12; `drive_cover_tick` behind narrow ports with an ordering test; retire `merges_are_deterministic_in_subject_order`). Pass 10 design: `modeling-pass10.md` on disk, `imagination-pass10.md` being written under ten rulings (consumer is a third `SystemCapability` arm confined to one externally controlled subject; such subjects get no opportunity and are skipped by the cover; one atomic verdict per document; one kernel-side decode bound for both lanes; transport per the `POST /cultnet/snapshot` precedent; `ConsumerPort` as narrow as `ElaborationPort`; no Delvehold names in core); no pass-10 worktree yet. Uncommitted coordinator edits on main: ontology (pass-9 scale, contention finding, `AdmitPatch` has no own phase gate, `EvidenceRef::new` is `pub(super)` bounded by `filter_evidence`), mvp (derived state, membrane, tick driver + env), plan step-6 pass-10 line. Specs/maps 1-9 plus `modeling-pass10.md` in the session scratchpad, not `state/`; the handoff carries the integration recipe (unchanged), the pass-10 debts (authority, decode-time size bounds, phase, boundary answering, `mesh.rs` inbound ruling), and the queued doc edits (pass-9 Current mechanism; a config note for `GHOSTLIGHT_CONTROLLER_ELABORATOR_MODEL`, named in no doc yet; the pass-9 env variables are in the uncommitted mvp edit). (2) First-generation world fixtures banked and pushed, reviewer-accepted except visual replay pending a scene-set blockout: Delvehold `cistern-house-nine-breaker-test` `codex/world-delvehold` @ `9374fd0`; Aetheria `navigator-berth-hearing-v0` `codex/world-aetheria` @ `fe679f4` (fixture `8860c47`, lore `ba5c2ce`); Zyphos `eclipse-nursery-handover` `codex/world-zyphos` @ `055e6ee` (lore `2fef909`); Kalsa `stormshield-handoff-v0` `codex/world-kalsa` @ `489c541` (lore `c9f4c5c`). The elaborator swarm is drained and handed off; this session does not own it: stop flag set 2026-09-04 20:10, drained 21:10 with 98 finished passes in `logs\elab-done.csv`, ledgers republished, successor handoff finalized at `C:\Users\Meta\.claude\worlds\README.md`. Resume waits on operator adjustments and belongs to the successor. Owed and deliberately deferred: integration of `slot/<world>/<title>/<stamp>` branches into the vaults (`codex/ghostlight-worlds`) and `codex/world-<world>`. Idea index: the four `experiments/elaboration/<world>/ledger/` directories on `codex/world-<world>`. Substrate lessons stay in `state/evidence.jsonl`; `Invoke-Worlds.ps1` is retired under `worlds\retired`. Clones at `F:\Projects\Ghostlight-worlds\<world>` and `F:\Projects\<Lore>-worktrees\ghostlight-worlds`; image rendering deferred, prompts only. Deferred behind both orders, not cancelled: review and subtract the uncommitted Idunn projection and bounded RUDP transport, add UDP route actuation plus an independently persisted post-reload data-plane observation, and verify that focused pass on Yggdrasil. Then implement the directly managed Rust Odin observation/correlation daemon and exact transaction-frozen capability dependency closure. Install rebuilt Idunn, admit Odin first, then CodexConnector and Ghostlight; prove same-generation continuity, fencing, signed health, route cutover, Odin-outage freeze, and negative legacy authority before purging old units, releases, state roots, and the remote acceptance debris. `GameCult/cultcache-rs` and `GameCult/cultnet-rs` now have no readers anywhere: Epiphany `68939b2c` and CodexConnector `6519289` consume CultLib and carry no submodules at all, and Odin `27cc815` does the same. Both repos are retirable now: that work landed on CultLib main by fast-forward at `8cb3b72`, so every pinned revision -- Ghostlight `85f7024`, Epiphany and CodexConnector `e171eca`, Odin `cbde940` -- is an ancestor of main and resolves from a fresh clone. Still vendored are `VoidBot/vendor/cultcache-ts`, `Ghostlight/vendor/cultcache-py` and `Odin/vendor/cultmesh-rs`. The first two vendored because npm and pip cannot take a package from a subdirectory of a git repo the way cargo can, so there was nothing to depend on. CultLib `8cb3b72` adds a publish workflow: tagging `cultcache-ts-v*` or `cultcache-py-v*` ships `@gamecult/cultcache-ts` to npm and `cultcache-py` to PyPI, refusing any tag whose version disagrees with the manifest. Both repoints wait on the first publish, which needs an `NPM_TOKEN` secret and a PyPI trusted publisher. Ghostlight's is not a bare dependency swap: `tools/ghostlight_state_store.py` puts `vendor/cultcache-py/src` on `sys.path` so the state tooling works from a clone with no install step, and session bootstrap depends on that. Detail on the Odin repoint: Odin's vendored CultNet submodule and CultCache copy are gone from its worktree and both come from CultLib, with only `vendor/cultmesh-rs` still vendored and itself consuming CultLib. Odin's commit had to carry the in-flight CultMesh RUDP document server with it: the previously committed CultMesh calls `assume_connected()`, a CultNet method the fork had and CultLib does not, so the old code cannot build against CultLib at all. It depends on CultLib branch `claude/cultnet-reliable-expiry` at `cbde940`, which must reach main by merge rather than squash or the pinned rev is orphaned. Live citations name CultLib `85f7024`, a permanent ancestor of main; evidence records keep their pre-consolidation SHAs as dated history. Local run scaffolding, downloaded acceptance copies, and redundant Git bundles are already purged, and `.gitignore` now refuses them. + next_action: Plan step 6, the ontology widening, is complete: ten passes integrated on `codex/ghostlight-dungeon-mvp`, tip `a1fd645` (pass tips `5e53beb`, `e99af63`, `d2805fe`, `0f21a49`, `dbe176d`, `cb6a126`, `1852ddd`, `3ed3868`, `8aebfb6`, `a1fd645`); `git status -sb` is the push witness; the series evidence record is dated 2026-09-05. The kernel holds 12 component kinds over 27 operations under one `WorldPatch`, one reducer, one CAS commit, one decode bound (`patch::decode_patch`, `MAX_PATCH_*`), three confined `SystemCapability` arms (`Clock`, `Elaborator`, `Consumer`); pass 10 added `world/consumer.rs`, `PatchGround`, `confine_to_ground`, `ControllerAssignment::ExternallyControlled`, `ConsumerPort`/`submit_consumer`, `POST /cultnet/world-patch` (loopback, msgpack, `CONSUMER_BODY_LIMIT`), `ConsumerRegistry` from `GHOSTLIGHT_CONSUMER_CREDENTIALS`; schemas `world_state.consumer.v1`/`world_commit.consumer.v1`, `STATE_SCHEMA_GENERATION` world-v3 (Idunn expectation changes; every world-v2 phrase below now means world-v3). Baseline 313 tests in `world/`, 357 crate source (focused run 312/352). In flight: `hands/pass10-followups` in `F:\Projects\Ghostlight-pass10fu` from `a1fd645`, no commits yet (`controller_work.v9`, fatal malformed credentials, redacting `Debug`, elaboration lane `check_patch_caps`, distinct item-cap refusals); uncommitted docs-worker edits on main (consumer-api as live contract, ontology Current mechanism through pass 10, mvp envelope fix, plan pass-10 past tense). Next action is the operator's: (a) bounded in-tick re-submission for a refused coupled constituent, decided with the submitted-vs-committed number; (b) authority for owner-only Eve `world.run_tick`; (c) whether the outbound consumer response batch and non-loopback CultMesh lease are cut before the deployment gate resumes. Until decided, close out the pass-10 follow-ups and commit the docs. (2) First-generation world fixtures banked and pushed, reviewer-accepted except visual replay pending a scene-set blockout: Delvehold `cistern-house-nine-breaker-test` `codex/world-delvehold` @ `9374fd0`; Aetheria `navigator-berth-hearing-v0` `codex/world-aetheria` @ `fe679f4` (fixture `8860c47`, lore `ba5c2ce`); Zyphos `eclipse-nursery-handover` `codex/world-zyphos` @ `055e6ee` (lore `2fef909`); Kalsa `stormshield-handoff-v0` `codex/world-kalsa` @ `489c541` (lore `c9f4c5c`). The elaborator swarm is drained and handed off; this session does not own it: stop flag set 2026-09-04 20:10, drained 21:10 with 98 finished passes in `logs\elab-done.csv`, ledgers republished, successor handoff finalized at `C:\Users\Meta\.claude\worlds\README.md`. Resume waits on operator adjustments and belongs to the successor. Owed and deliberately deferred: integration of `slot/<world>/<title>/<stamp>` branches into the vaults (`codex/ghostlight-worlds`) and `codex/world-<world>`. Idea index: the four `experiments/elaboration/<world>/ledger/` directories on `codex/world-<world>`. Substrate lessons stay in `state/evidence.jsonl`; `Invoke-Worlds.ps1` is retired under `worlds\retired`. Clones at `F:\Projects\Ghostlight-worlds\<world>` and `F:\Projects\<Lore>-worktrees\ghostlight-worlds`; image rendering deferred, prompts only. Deployment gate, deferred behind the operator decisions, not cancelled: review and subtract the uncommitted Idunn projection and bounded RUDP transport, add UDP route actuation plus an independently persisted post-reload data-plane observation, and verify that focused pass on Yggdrasil. Then implement the directly managed Rust Odin observation/correlation daemon and exact transaction-frozen capability dependency closure. Install rebuilt Idunn, admit Odin first, then CodexConnector and Ghostlight; prove same-generation continuity, fencing, signed health, route cutover, Odin-outage freeze, and negative legacy authority before purging old units, releases, state roots, and the remote acceptance debris. `GameCult/cultcache-rs` and `GameCult/cultnet-rs` now have no readers anywhere: Epiphany `68939b2c` and CodexConnector `6519289` consume CultLib and carry no submodules at all, and Odin `27cc815` does the same. Both repos are retirable now: that work landed on CultLib main by fast-forward at `8cb3b72`, so every pinned revision -- Ghostlight `85f7024`, Epiphany and CodexConnector `e171eca`, Odin `cbde940` -- is an ancestor of main and resolves from a fresh clone. Still vendored are `VoidBot/vendor/cultcache-ts`, `Ghostlight/vendor/cultcache-py` and `Odin/vendor/cultmesh-rs`. The first two vendored because npm and pip cannot take a package from a subdirectory of a git repo the way cargo can, so there was nothing to depend on. CultLib `8cb3b72` adds a publish workflow: tagging `cultcache-ts-v*` or `cultcache-py-v*` ships `@gamecult/cultcache-ts` to npm and `cultcache-py` to PyPI, refusing any tag whose version disagrees with the manifest. Both repoints wait on the first publish, which needs an `NPM_TOKEN` secret and a PyPI trusted publisher. Ghostlight's is not a bare dependency swap: `tools/ghostlight_state_store.py` puts `vendor/cultcache-py/src` on `sys.path` so the state tooling works from a clone with no install step, and session bootstrap depends on that. Detail on the Odin repoint: Odin's vendored CultNet submodule and CultCache copy are gone from its worktree and both come from CultLib, with only `vendor/cultmesh-rs` still vendored and itself consuming CultLib. Odin's commit had to carry the in-flight CultMesh RUDP document server with it: the previously committed CultMesh calls `assume_connected()`, a CultNet method the fork had and CultLib does not, so the old code cannot build against CultLib at all. It depends on CultLib branch `claude/cultnet-reliable-expiry` at `cbde940`, which must reach main by merge rather than squash or the pinned rev is orphaned. Live citations name CultLib `85f7024`, a permanent ancestor of main; evidence records keep their pre-consolidation SHAs as dated history. Local run scaffolding, downloaded acceptance copies, and redundant Git bundles are already purged, and `.gitignore` now refuses them. gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Materialisation/folding changes only representation and the exact member delta, advances resolution epoch, and retires the old cover; it has no Gestalt-wide effect authority. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only. diff --git a/state/scratch.md b/state/scratch.md index e05f325..402b211 100644 --- a/state/scratch.md +++ b/state/scratch.md @@ -2,12 +2,13 @@ ## Current Subgoal -Pass-9 follow-ups with Hands in `F:\Projects\Ghostlight-pass9fu` on -`hands/pass9-followups` from `8aebfb6`, and pass 10 (consumer ingress) design: -`modeling-pass10.md` on disk, `imagination-pass10.md` in progress under the -ten rulings. Main tip `8aebfb6`, passes 1-9 integrated. Open operator -decisions: bounded in-tick re-submission for a refused constituent; Eve -`world.run_tick` authority. +Pass-10 follow-ups with Hands in `F:\Projects\Ghostlight-pass10fu` on +`hands/pass10-followups` from `a1fd645` (`controller_work.v9`, fatal malformed +credentials, redacting `Debug`, `check_patch_caps` in the elaboration lane), +then series close-out: commit the docs-worker edits, integrate, remove the +worktree. Main tip `a1fd645`; step 6 complete. Then the operator decides: +in-tick re-submission, Eve `world.run_tick` authority, outbound consumer +response versus the deployment gate. ## Working Notes