GameCult/Ghostlight
Watch
9
0
Fork
You've already forked Ghostlight
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cut six pre-rebuild notes pages

Browse source 
Parked at tag parked/ghostlight-pre-rebuild (ruling ghostlight-verse:ruling:park-pre-rebuild-tree).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Meta Vens 2026-10-09 17:05:13 +02:00
commit 86977e51f7
6 changed files with 0 additions and 3635 deletions
Download patch file Download diff file Expand all files Collapse all files

108
notes/architecture-rationale.md
View file

@ -1,108 +0,0 @@
# Architecture Rationale
This note explains why Ghostlight uses explicit state surfaces. It is not the
current implementation map and not the roadmap. For those, read:
- `state/map.yaml`
- `notes/fresh-workspace-handoff.md`
- `notes/ghostlight-implementation-plan.md`
- `notes/ghostlight-current-system-map.md`
## Core Failure
The central failure mode is local plausibility without global coherence.
An agent can write elegant little sentences, produce plausible little diffs,
and still lose the shape of the machine. Once the model no longer knows how the
latent state, memory, perception, and prompt layers fit together, adding more
local machinery usually makes the beast prettier and stupider.
The answer is not more transcript. The answer is explicit structure:
- slow-changing map
- disposable scratch
- distilled evidence
- compact handoff
- implementation plan that is not pretending to be a second map
- ruthless deletion when state stops improving the model
## State Split
Ghostlight treats different kinds of cognition as different artifacts:
- `map`: canonical system model, invariants, accepted design, rejected paths
- `scratch`: temporary local reasoning for one bounded subgoal
- `evidence`: distilled proof, decisions, rejected paths, and scars that change future belief
- `system map`: source-grounded explanation of the live repo machinery
- `handoff`: compact re-entry packet
- `plan`: distilled forward implementation direction
- `output`: user-visible replies, code edits, commits, and verification artifacts
The split matters because a language model will happily blend all of that into
one warm slurry if invited. Slurry is not architecture.
## Current Harness Principle
Ghostlight is using the same basic discipline that Epiphany proved useful:
```text
observe the repo and canonical state
-> rehydrate the current map
-> work one bounded organ
-> verify the seam that matters
-> record only durable evidence
-> cut failed code and failed memory
```
The model is still a language model. That is the medium, not the scandal.
Language, structure, evidence, and salience are the steering surfaces. The repo
exists to keep those surfaces explicit enough that the next waking thing can
resume the pattern instead of faking continuity from vibes.
## Authoring Projection Principle
For content generation, Ghostlight should not treat an LLM as one omniscient
drama goblin asked to write every character from the same cloudy prompt.
The better division of labor is:
- Ghostlight maintains explicit state about characters, relationships,
memories, pressures, goals, masks, culture, and scene stakes.
- A narrative or drama pass can arrange conflicts, reversals, escalation, and
consequences, but it should also arrange routine, quiet, humor, rituals,
domestic texture, downtime, and slow buildup when those are what make the
later consequence legible.
- Dialogue generation should then happen through character-local context packs:
what this character knows, feels, wants, remembers, conceals, and believes
about the person in front of them.
That distinction matters because realistic dialogue usually comes from
subjective circumstance, not from a summary saying "write dramatic banter
here." Pressure is one circumstance. So are habit, boredom, love, rivalry,
ritual, absurd bureaucracy, professional pride, and wanting lunch to be over
without anyone noticing the reactor invoice. Each character needs room to act
from their own partial state. The authoring agent can build the trap. It can
also build the kitchen table, the rain ritual, the bad coffee, and the private
joke that makes the trap hurt later. The character projection should decide how
the person inside the moment breathes.
## Compact-Rehydrate-Reorient
Compaction is a real state transition, not a cosmetic cleanup.
Before compaction, Ghostlight should preserve:
- current objective and active subgoal
- latest stable map
- distilled evidence or rejected paths that change future belief
- open questions, blockers, and next action
After rehydrating, Ghostlight should:
- reread canonical state instead of trusting prompt residue
- restate the next action from persisted state
- continue only when instructed or when the task explicitly calls for it
- avoid broad implementation until the current mechanism is understood again
The aim is not immortality cosplay. It is banking the fire enough that the next
waking thing finds coals instead of ash.

109
notes/documentation-inventory.md
View file

@ -1,109 +0,0 @@
# Documentation Inventory
Use this file as the navigation map for Ghostlight's docs. It classifies files
by job so architecture, planning, prompts, state ledgers, and live examples do
not slowly melt into one cursed binder.
## Canonical Re-Entry And Planning
- `state/map.yaml`: canonical project map and current status.
- `notes/fresh-workspace-handoff.md`: re-entry summary for fresh sessions.
- `notes/ghostlight-current-system-map.md`: current runtime and artifact map.
- `notes/ghostlight-implementation-plan.md`: live implementation plan and
next-action surface.
- `notes/documentation-inventory.md`: this navigation/status index.
## Core Architecture Contracts
- `docs/architecture/ghostlight-dungeon-mvp.md`: hosted dungeon authority and
runtime map.
- `docs/architecture/ghostlight-multiresolution-agency.md`: dynamic agency
graph, connected cohesive/arena covers, detail fairness, cell waves, fission,
controls, and atomicity.
- `docs/architecture/ghostlight-dungeon-multiplayer-intention.md`: bounded
post-MVP extension of the campaign kernel to multiple human-controlled actors,
including authority, privacy, concurrency, and unresolved social policy.
- `docs/architecture/canonical-agent-state-schema.md`: canonical state model.
- `docs/architecture/agent-state-variable-glossary.md`: meanings for state
axes, voice style, overlays, and emergent behaviors.
- `docs/architecture/agent-state-distributions-and-prompt-projection.md`:
deeper state-distribution and projection rationale.
- `docs/architecture/prompt-projection-contract.md`: projection boundary and
renderer contract.
- `docs/architecture/projected-local-context.md`: character-local context
shape.
- `docs/architecture/sequential-agent-runtime.md`: sequential action/reaction
runtime architecture.
- `docs/architecture/sandboxed-responder-packets.md`: isolated responder packet
contract and capture requirements.
- `docs/architecture/soft-model-training-artifacts.md`: rule for turning soft
judgments into training artifacts.
- `docs/architecture/ink-branching-scenes.md`: branch-and-fold, branch
compiler, visual prompt, and IF reviewer contract.
- `docs/architecture/illustrated-if-visual-pipeline.md`: visual replay
contract, geometry authority, scene-set/blockout role, and imagegen boundary.
- `docs/architecture/lore-grounding-digest-format.md`: source-grounding digest
format.
- `docs/architecture/aetheria-lore-grounding-architecture.md`: Aetheria
historical, future-branch, and procedural grounding boundaries.
- `docs/architecture/corpus-coverage-ledger.md`: corpus coverage ledger
contract and status-report shape.
- `docs/architecture/technology-item-manifest-plan.md`: item, assembly,
supply-chain, trade-good, and blueprint data target.
- `docs/architecture/training-plan.md`: trainable organs, datasets, gates, and
rough scale targets.
## Supporting Architecture And Future Mechanisms
- `docs/architecture/aetheria-agent-population-model.md`: population and
faction-scale agent modeling.
- `docs/architecture/aetheria-content-generation-targets.md`: Aetheria content
targets and consumer use cases.
- `docs/architecture/aetheria-persistent-agent-architecture.md`: broader
persistent-agent architecture.
- `docs/architecture/projection-distillation-plan.md`: student projector
training concept.
- `docs/architecture/schema-future-mechanisms.md`: future schema organs waiting
for more evidence.
- `notes/architecture-rationale.md`: rationale notes for major design
boundaries.
## Accessible Explanations
- `docs/public-architecture/`: canonical source for the public Ghostlight site
architecture section: overview, authority, pipelines, and the complete
production agent/model-stage catalog. The site publishes an exact projection
and owns navigation and presentation, not technical truth.
- `docs/articles/multiresolution-gestalts.md`: reader-facing explanation of
Ghostlight Dungeon's dynamic agency graph, cohesive and arena cells, detail
fairness, Persona waves, and named-character continuity.
## Raw Imported Source
- `docs/aetheria/call-of-the-void-brainstorm.md`: raw imported brainstorming
document. Encoding scars are preserved; do not treat this as canonical prose.
## Research Backlog
- `docs/research/personality-model-roadmap.md`: personality-model research
roadmap.
- `docs/research/personality-signal-classifier.md`: personality signal
classifier research.
- `docs/research/things-to-steal.md`: research backlog and candidate ideas.
## State Ledgers
- `state/evidence.jsonl`: distilled current evidence ledger.
- `state/evidence.archive.jsonl`: archival evidence ledger.
- `state/branches.json`: branch ledger.
- `state/corpus-coverage.json`: machine-readable coverage ledger for accepted,
draft, planned, rejected, and superseded Aetheria fixtures.
- `state/scratch.md`: disposable one-subgoal scratch surface.
## Maintenance Rule
Architecture docs describe durable contracts. Live planning belongs in
`notes/ghostlight-implementation-plan.md`, `notes/fresh-workspace-handoff.md`,
and `state/map.yaml`. Experimental fixture receipts are not kept in the live
workspace once their lessons have been distilled into docs, state, or git
history.

2865
notes/ghostlight-current-system-map.md
View file

File diff suppressed because it is too large Load diff

329
notes/ghostlight-dungeon.md
View file

@ -1,329 +0,0 @@
# GhostlightDungeon MVP — Starfire-Hosted AI Dungeon Master
> Historical foundation plan. Campaign creation and multiplayer authority are
> superseded by
> [`docs/architecture/ghostlight-dungeon-session-zero.md`](../docs/architecture/ghostlight-dungeon-session-zero.md).
> This document remains the original product and world-simulation brief; its
> single-player compiler forms and 1–32 budget wording are not the live runtime
> contract.
> **What is built, 2026-09-23.** The live runtime is the play agent:
> `docs/architecture/ghostlight-play-agent.md` for the target,
> `ghostlight-play-agent-cut.md` for the means, and
> `ghostlight-play-agent-postmortem.md` for what it cost. Read this document's
> *Authority and invariants* as current — the kernel owns state, every path
> enters the same validate-and-commit door, projections never commit, and a
> place persists when you leave it. Read *Implementation changes* as a roadmap
> in a spec's grammar. Of it:
>
> - **Live:** the Rust daemon, typed CultCache state, the Persona loop, the
> Eve surface and its browser client, and a Vault evidence source over local
> Markdown.
> - **Not built:** fiction-first d20 resolution (a risky act draws from an
> affordance's weighted outcome bands, with no assessment step, no modifiers
> and no roll receipt; an act no granted affordance expresses is authored
> directly as a ruled consequence with no draw at all, and the player cannot
> tell those two paths apart); away-time world agency (advancing the clock
> rolls routines and accumulates pressure, and nothing deliberates
> off-screen); multiresolution gestalt and institution agency (institutions
> exist as offices, grants and jurisdiction, and nothing makes them act); the
> generic Vault provider contract and canon candidates; and the hosting
> details, which name a model family and a credential store the Body does not
> use.
> - **Never run:** seeding past its configuration check, and any model behind
> the local inference port.
## Summary
Build `GhostlightDungeon` inside `GameCult/Ghostlight`: a persistent, Vault-grounded, single-player narrative simulation with a private web chat interface for two testers.
The runtime will be a Rust daemon on Starfire. It will own world compilation, typed CultCache state, d20 resolution, NPC Persona loops, offscreen simulation, narration, and Eve/CultUI publication. A thin TypeScript browser client will lower the Eve surface and submit typed commands.
Population-scale agency is implemented by the dynamic connected cover in
`docs/architecture/ghostlight-multiresolution-agency.md`. That authority map
supersedes any reading of the gestalt materialization notes below as a flat
strategic Persona list: materialization preserves named identity, while the
agency graph decides the current simulation resolution.
Ghostlight’s existing v0 schemas and training fixtures remain evidence and regression material; they do not become runtime authorities.
## Authority and invariants
- The per-campaign `WorldKernel` is the sole owner of canonical state and revision numbers.
- Player commands, NPC actions, scheduled ticks, travel, waits, imports, and reloads all enter the same `WorldCommand → validate → atomic commit` path.
- Projectors, Personas, Interpreters, retrieval, initiative, narration, news generation, dice previews, and the browser may propose or project state; none may commit it.
- Scenes are derived from persistent occupancy, topology, perception, and current events. Leaving a location does not delete it.
- RAG evidence remains owned by the Vault provider. For Aetheria, Ghostlight consumes VoidBot’s canonical retrieval service and stores only exact evidence receipts used by each campaign—never a rival semantic index.
- Every campaign branches from canon at creation. Later historical records describe the baseline trajectory, not an outcome the player must be railroaded into.
- Improvised facts are explicitly branch-local. Broadly useful gaps become reviewable canon candidates, never silent Vault edits.
- Player text describes an attempt, not a completed fact. Impossible actions do not receive a roll.
- Model failures, malformed outputs, stale projections, or retrieval outages produce no partial world mutation.
## Implementation changes
### Runtime and persistence
- Add a Rust 2024 workspace using Tokio/Axum, the Rust CultCache/redb backend, CultMesh/CultNet publication, and a provider-neutral model port.
- Store service state under `F:\GameCult\GhostlightDungeon`:
- service/control and schema catalog `.cc`;
- one row-oriented `.cc` store per campaign;
- exact Vault evidence receipts;
- private model-stage records and commit receipts;
- exported campaign and canon-candidate bundles.
- Route all writers through an in-process campaign mailbox. Background ticks and HTTP commands cannot race or repair each other afterward.
- Publish the player surface, operator inspector, health, scheduler pressure, model receipts, and command results through CultMesh/Eve. HTTP health remains a probe of that state, not separate truth.
### Vault and world compiler
- Define a generic `VaultProvider` contract for source search, surrounding context, source witnesses, authority lanes, temporal scope, and exact-document retrieval.
- Implement the bundled Aetheria adapter against VoidBot’s streamable MCP endpoint at Starfire loopback.
- Add a hosted custom-Vault path for Git-synchronized, Obsidian-compatible Markdown hierarchies after tenant-isolation and import-security gates are met. The Vault service owns indexing; campaigns store only manifest bindings and exact evidence receipts. Provisional plans include one active Vault and 10 million indexed source tokens for Contributor/Private, or three active Vaults and 30 million combined tokens for Plus, with two or six full imports per month respectively.
- At campaign creation:
1. Retrieve broad Aetheria evidence and generate three distinct suggested openings across different eras, places, and pressures.
2. For the selected opening, generate three source-grounded player roles plus a custom-role path.
3. Alternatively compile a fully custom who/where/when/goal description.
4. Produce an approval preview containing the initial topology, cast, institutions, capabilities, clocks, evidence coverage, gaps, and branch-local assumptions.
5. Commit only after approval.
- Materialize a bounded playable region and surrounding institutional pressure graph, not the entire universe. New destinations compile on demand and attach to stable containment, route, distance, and travel-time records.
- Treat Vault evidence as canon constraints rather than an exhaustive game map. Automatically synthesize the smallest coherent routes, geometry, local people, ordinary procedures, supplies, responsibilities, capacity choices, and operational doctrine required for play; store them as reversible `branch_local` or `provisional_local` facts and disclose consequential choices in `branch_assumptions`. Ordinary source silence is not a material gap, and generated details may vary between campaigns unless the Vault pins them.
- Reserve material gaps for an exact approved premise that cannot be preserved without choosing between contradictory canon baselines, inventing an explicitly requested but unanchored canon baseline, or exceeding an approved extraordinary capability. Those gaps return to Session Zero negotiation before publication.
- Store useful gaps as `CanonCandidate` records with originating campaign, evidence, conflicts, proposed wording, and affected Vault sources. The lab can review and export Markdown plus `.cc` evidence; it cannot edit AetheriaLore or open PRs.
### Persona and world action loop
Population scaling uses reversible gestalt materialization. A crowd, village,
crew, or corporation may act offscreen through one gestalt Persona. When a
specific member becomes relevant, the WorldKernel materializes an individual
from the gestalt baseline plus a persistent member delta and current scene.
When relevance expires, it folds individual consequences back into that delta,
admits only reviewed aggregate learning to the gestalt, and removes the active
simulation slot. The member delta remains durable so returning to the person
reconstructs the same individual rather than a fresh approximation.
Gestalt projection, relevance detection, and merge proposals cannot commit.
`MaterializeGestaltMember` and `DematerializeGestaltMember` use the normal
revisioned WorldCommand path. A named member's relationships, memories,
possessions, injuries, promises, and identity never become disposable gestalt
texture.
Live turns run a structured gestalt-relevance planner after the player event
and before NPC appraisal. Its atomic `ReconcileGestaltPresence` command can
materialize newly relevant members and fold irrelevant members back into their
persistent deltas. The planner may propose presence only; it cannot promote
population-wide learning or mutate state directly.
World compilation may seed collective populations and a bounded roster of durable
member identities, but that roster is not exhaustive. When an anonymous member
first becomes identity-bearing in play, the relevance planner may propose a new
member delta and the WorldKernel atomically creates that durable identity and its
active actor slot. Existing deltas are always preferred when they fit, preventing
the same person from being invented twice. Population-scale capabilities, knowledge, resources, goals,
and pressures belong to the gestalt. A member record owns identity, memories,
relationships, possessions, injuries, obligations, last known location, and
additions to or removals from the shared baseline. Materialization is a derived
composition of those two owners; the temporary actor slot owns neither source.
Dematerialization deletes only that slot after atomically updating the member
delta. Strategic ticks address the gestalt and its dematerialized deltas rather
than iterating every member as a live Persona.
Materialization grants a short revision-bound relevance lease. Speech, private
appraisal changes, and resolved actions refresh it through the WorldKernel.
Neither the model planner nor a direct command may dematerialize a member while
the player can still perceive them or before that lease expires. This prevents
quiet conversational beats from making people flicker between individual and
gestalt state.
Ghostlight owns its own generalized projection machinery:
1. Projector converts the actor’s permitted typed slice, memories, perceived events, relationships, goals, and retrieved knowledge into a private lived narrative stream.
2. Persona receives only that narrative stream and responds naturally—no schemas, action DSL, or raw state.
3. Interpreter extracts typed private deltas, explicit speech, reaction priority, and `WorldActionProposal` candidates.
4. WorldKernel validates spatial reach, knowledge, custody, resources, capability, opposition, and state version before committing anything.
All affected scene participants appraise a committed event in parallel. Actor-private deltas commit against their own snapshot versions; initiative then chooses compatible reactions or actions for world resolution. This ensures present characters continue perceiving and reacting even when another character currently holds conversational focus.
Canonical NPC consequence is serialized one opportunity at a time. The
deterministic initiative projection chooses the highest-priority stable winner;
`ResolveNpcAction` verifies that exact proposal and its same-revision assessment
against the committed wave, then consumes its siblings, obtains the server-side
d20, and applies the typed outcome in one atomic commit. A malformed assessment
therefore leaves no action-begun half-state. NPC resolution never resets
player-activity or away-time state.
Use DeepSeek’s current API directly:
- `deepseek-v4-flash`, non-thinking: Projectors, Interpreters, retrieval planning/reranking, verification, and offscreen actors.
- `deepseek-v4-pro`, non-thinking for live work: world compilation, action assessment, live Personas, and narration.
- Structured stages use JSON Output followed by local schema validation. Empty or malformed output receives one same-snapshot retry, then fails without mutation.
- Record provider, model, request hash, source receipts, latency, output hash, validation result, and state version. Never persist or display `reasoning_content`.
DeepSeek currently documents both V4 model IDs, streaming, and JSON output through its OpenAI-compatible Chat Completions API. [Models](https://api-docs.deepseek.com/quick_start/pricing), [Chat API](https://api-docs.deepseek.com/api/create-chat-completion), [JSON Output](https://api-docs.deepseek.com/guides/json_mode/).
### Fiction-first d20 resolution
- Provide separate `Assess` and `Attempt` commands. Assessment never becomes visible to NPCs or changes state.
- An assessment contains:
- normalized intent and intended effect;
- admissibility or the missing permission;
- DC on the 5/10/15/20/25/30 resistance scale;
- itemized contextual modifiers with state or evidence references;
- modifier total capped at ±10;
- effect ceiling;
- success, mixed-result, and failure stakes;
- campaign revision and expiring assessment digest.
- Contextual modifiers come from capabilities, knowledge, tools, access, assistance, leverage, position, opposition, injuries, and conditions. There are no base attributes.
- Confirmation checks the assessment revision, obtains a server-side OS-random d20, and atomically stores the roll receipt and world transition.
- Outcomes:
- total ≥ DC + 10: strong success;
- total ≥ DC: success;
- total within 5 below DC: mixed result;
- lower: failure with the previewed consequence.
- Natural 20/1 moves one outcome band, but cannot make an impossible action possible or exceed its effect ceiling.
- Stale assessments are recompiled rather than rebased.
- Overreach returns explicit sacrifices or bargains that could admit a new assessment.
- Speech and its intended effect are separated: the character may successfully say something while failing to persuade, deceive, or intimidate.
Every roll band carries a prevalidated `WorldEffectDelta`. The MVP vocabulary
can change local conditions and relationships, move the acting character over
an existing route, advance known clocks, or change a known institution's
posture. The chosen band and its delta commit atomically with the roll receipt;
stake prose alone never impersonates world mutation.
### Away-time world agency
- The daemon owns a five-minute scheduler pulse. Campaigns enter away simulation after fifteen minutes without player activity.
- Each real hour awards one strategic tick, capped at eight pending ticks per absence. The compiled campaign chooses the in-world tick duration; default is six hours.
- Background simulation affects remote actors, institutions, resources, movement, bargains, investigations, preparation, recruitment, obstruction, and clocks. The absent player is never puppeted or directly harmed.
- Each due tick derives a budgeted simulation-cell cover and runs one private
Projector → Persona → Interpreter pipeline per cell against the same campaign
revision and resolution epoch. The WorldKernel alone converts admitted typed
effects into a `StrategicTickPlan`; proposal prose cannot become event truth.
It accepts only known institutions, gestalts, members, and non-player actors;
direct-route movement must fit inside the tick duration, information channels
are bounded per constituent, and population pressure cannot silently become
canon knowledge. Gestalts may also emit typed preparation, coordination,
investigation, recruitment, obstruction, trade, or communication attempts
against subjects with an explicit agency relation or exact shared location.
A capped salient dormant member may be addressed by durable ID without being
absorbed into a population voice. These commit only an attributed attempted-
activity event; success and target response require later admitted effects.
Durable dematerialized members use the same bounded activity vocabulary with
exact personal attribution; ordinary action and migration share one per-
person slot. Invalid, stale, timed-out, or malformed waves leave world state
unchanged.
- The scheduler and return-time catch-up invoke the same `AdvanceStrategicTick` command. Catch-up processes missed ticks before accepting the next player action.
- Live play has inference priority; background work stops launching new calls while a player turn is active.
- Offscreen events generate information-channel-aware news leads. On return, the player may receive newspapers, reports, messages, or rumors only when the character has access to them; the news layer cannot reveal omniscient state.
### Multiresolution gestalt and institution agency
- Campaign creation compiles a global agency skeleton across every non-player
actor, institution, and active gestalt leaf. All six partition facets are
explicit; remote powers do not require eager local geography.
- `ActorState`, `InstitutionState`, gestalt baselines, member deltas,
relationships, possessions, and knowledge remain canonical. A
`simulation_cell.v1` is a derived connected cover and may be discarded.
- The campaign chooses 1–240 active Persona cells, default 8, within its pooled
entitlement. Provider parallelism is a separate control capped at 32.
Foreground subjects,
active leases, initiative holders, explicit targets, and individual-detail
pins may create a reported temporary overage.
- Adjacent cells merge by the weighted loss specified in
`ghostlight-multiresolution-agency.md`; cohesive cells require real common
authority, while opposed or cross-faction cells are arenas with no synthetic
actor or shared knowledge.
- Every active cell receives one private Projector → Persona → Interpreter
pipeline, followed by a semantic effect verifier when the cell proposes an
action. Arena output is constituent-attributed. The verifier proves that the
typed effect represents the Persona's actual choice rather than a reversed or
lossy interpretation. All cells, receipts, and effects validate against one
world revision and resolution epoch before one atomic strategic commit.
- Persistent detail debt rotates direct attention through quiet subjects. All
clocks and deterministic obligations advance regardless of selected detail.
- Population fission is a separate approval-gated canonical operation. It
creates enumerated child leaves plus `other/unknown`, preserves the parent as
lineage, and reassigns durable member deltas without rewriting identity.
- Presence planning sees only active nearby leaves and people whose exact
dormant location matches the player. Inactive ancestors and remote rosters
stay out of the prompt. The WorldKernel rejects inactive-leaf individuation,
location teleportation, and model-driven promotion outside the active scene.
- Provider request parallelism is an operator control with its own epoch. It
batches the selected cell pipelines and cannot change the cover or fictional
state.
### Web laboratory and hosting
- Build the interface as a Ghostlight-owned `gamecult.eve.surface.v1` document and lower it with Eve’s pinned browser renderer.
- Provide:
- generated-opening and custom-start compiler;
- narrative transcript and composer;
- Assess, Attempt, confirm-roll, revise, and Wait controls;
- character ledger for capabilities, equipment, conditions, obligations, relationships, and known facts;
- location/time/pressure display;
- news and rumor drawer;
- named campaign creation, fork, reset, and `.cc` export;
- optional operator inspector for evidence, topology, state versions, model receipts, rejected proposals, and private spoiler traces.
- Do not expose model chain-of-thought or secrets.
- Serve the embedded web bundle on TCP `8831`. Firewall access is limited to Starfire’s private LAN and `10.77.0.0/24`; no public listener or Yggdrasil web gateway is added.
- Use Heimdall's Discord browser-completion path to establish account-bound HttpOnly sessions. Ghostlight verifies `aud=ghostlight` claims locally and owns campaign authorization. Campaigns are single-player; simultaneous co-op is outside the MVP.
- Run `GhostlightDungeon` as a normal detached process under the Starfire operator account. Record its PID, executable, and logs; explicit start, stop, health, release, and rollback scripts own lifecycle. ACL the runtime root to administrators and that operator account.
- Read the DeepSeek key from stdin during setup, protect it with machine-scoped DPAPI plus file ACLs, and never place it in source, arguments, logs, or environment projections.
- Build immutable release directories from the exact Git commit, switch the active release through the guarded junction, and record provenance in CultCache plus the immutable release manifest. Process restart is explicit; Windows service installation and automatic boot recovery are outside this MVP by operator choice.
### Repository and operational documentation
- Implement on `codex/ghostlight-dungeon-mvp`, with coherent foundation, runtime, interface, and deployment commits pushed to GitHub.
- Add the authoritative GhostlightDungeon architecture/build document and update Ghostlight’s system map, implementation plan, handoff, state map, and evidence ledger.
- Keep Starfire service/firewall/tunnel ownership in `gamecult-ops`, with a deployment and rollback runbook.
- Before live VoidBot integration, resolve the current Yggdrasil inventory/DNS split and independently verify the offered SSH host fingerprint. Then repair the tunnel task’s stale `E:\Projects` path to `F:\Projects`, restore `127.0.0.1:17875/mcp`, and update ops truth. Never bypass host-key verification or revive Starfire’s retired VoidBot/Qdrant writers.
## Public contracts
- `ghostlight.vault_manifest.v1`, `vault_evidence_receipt.v1`, `world_compile_preview.v1`
- `campaign.v1`, `world_fact.v1`, `location.v1`, `actor_state.v1`, `institution_state.v1`, `relationship_state.v1`, `world_clock.v1`, `event.v1`
- `player_action_assessment.v1`, `roll_receipt.v1`, `world_commit_receipt.v1`
- `persona_stage_receipt.v1`, `actor_state_delta.v1`, `world_action_proposal.v1`
- `narration_projection.v1`
- `strategic_tick.v1`, `news_issue.v1`, `canon_candidate.v1`
- `rejected_proposal_receipt.v1`, `campaign_lifecycle_receipt.v1`
- `gestalt_persona_state.v1`, `gestalt_member_delta.v1`,
`gestalt_materialization_receipt.v1`
- Existing `gamecult.eve.surface.v1` and `gamecult.eve.command.v1`
Publish JSON Schema only as the schema catalog. Runtime documents and exports use MessagePack-backed CultCache `.cc`; JSON exists only at browser, MCP, and model-provider boundaries.
## Test and acceptance plan
- Unit-test every schema, redb/CultCache round trip, optimistic commit, topology invariant, knowledge gate, DC/modifier rule, outcome band, roll receipt, branch fact, and scheduler budget.
- Use injected clocks, RNG, Vault provider, DeepSeek transport, and persistence ports.
- Prove malformed/empty DeepSeek JSON, timeout, retrieval loss, daemon restart, stale assessment, stale Persona output, and concurrent scheduler/player commands cannot partially mutate state.
- Run existing Pallas, Lucent, and Corvid fixtures as regression scenarios, even though hosted opening suggestions are generated.
- Acceptance scenarios:
- compile an obscure Aetheria time/place or return an honest evidence-gap preview;
- leave a location, advance the world, and return to the same geometry and inhabitants;
- approach a gestalt population, automatically materialize a durable member,
form a member-specific relationship, leave until the relevance lease expires,
fold the active actor into its persistent delta, tick the population once as a
gestalt, and later rematerialize the same person with that relationship intact;
- show reactions from every affected present actor;
- prevent an NPC from acquiring unearned knowledge or expertise;
- reject impossible action claims and offer explicit bargains;
- preview and confirm a fully receipted d20 action;
- observe institutions exploiting, resisting, or redirecting the protagonist;
- produce material offscreen changes and accessible news after absence;
- reload/fork/export a campaign without losing continuity;
- verify two invite sessions and rejection of unauthenticated access.
- Performance targets under a healthy provider:
- first progress update within 300 ms;
- all actor stages execute in parallel waves;
- a four-actor live turn completes within 20 seconds;
- background inference yields immediately to live work.
- Final deployment smoke verifies explicit process restart, LAN and WireGuard access, blocked public access, DeepSeek inference, VoidBot-grounded retrieval, scheduler continuation, state persistence, CultMesh/Eve publication, and exact deployed commit provenance.
## Assumptions and exclusions
- Aetheria is the only bundled Vault adapter, but no compiler logic is Aetheria-specific.
- Generated suggestions plus unrestricted custom compilation replace fixed featured openings.
- No D&D classes, spell slots, six-ability statistics, or 5e sheet are canonical in the MVP. The typed character ledger remains sufficient for later D&D-shaped projections.
- No arbitrary Vault upload/import UI in the current MVP; Git-synchronized Obsidian-compatible tenant Vaults are a documented post-gate product intention. No multiplayer campaign, voice, image generation, or direct canon mutation in the MVP. Multiplayer is an intended extension of the existing one-kernel/many-actors authority model and is documented separately; it does not expand this acceptance plan.
- The live deployment requires a DeepSeek key and restoration of the trusted VoidBot retrieval crossing; fixture-backed development may proceed before those two setup gates.

76
notes/ghostlight-homepage-promise-acceptance.md
View file

@ -1,76 +0,0 @@
# Ghostlight Dungeon Homepage Promise Acceptance
Updated: 2026-08-23
This is the adversarial player-test map for the promises published by
`GhostlightDungeon-site/content/index.md`. The player-visible proof boundary is
the typed `ghostlight.play` Eve surface. Operator projections and receipts may
diagnose a result, but they cannot substitute for a coherent player experience.
## Authority
- `SessionZeroKernel` owns the negotiated campaign brief until publication.
- `WorldKernel` owns every canonical world revision after publication.
- The Eve surface projects permitted state and submits typed commands. It does
not own authentication, character identity, results, or world facts.
- Heimdall proves account possession and access. A retained entitlement is not
a browser authentication credential.
- Model stages, retrieval, narration, and strategic cells propose or explain.
They never commit.
## Acceptance matrix
| Public promise | Adversarial Eve path | Player-visible pass condition | Invariant witness | Current state |
| --- | --- | --- | --- | --- |
| Places stay where they are; people, places, and consequences survive the context window. | Record the current location, cast, routes, obligations, and injuries. Travel away, advance time, restart the daemon between turns, and return by the projected travel controls. | The same place, topology, people, and unresolved consequences return with only committed changes. Narration does not reconstruct incompatible geometry. | Stable canonical IDs and topology; exact revisioned event and relationship records; reload projects the same committed state. | Automated and operator evidence exists; full Eve departure-and-return replay pending. |
| Worldbuilding comes from the selected lore Vault rather than model memory. | In Session Zero, request an obscure Aetheria place and pressure combination, then inspect the compilation review and play details that require source knowledge. Ask for an unsupported mechanic as though it were canon. | Grounded details identify their evidence coverage. Material gaps are explicit and block publication or the unsupported fact; nearby fixture cast and geography are not borrowed. | Exact Vault evidence receipts; branch-local assumptions; no rival semantic index; no mutation on retrieval or validation failure. | Mars/Zhestokost compiler canary passed after repair; adversarial Eve replay and unsupported-mechanic probe pending. |
| Characters know only what they perceived or learned and cannot borrow another character's secrets or expertise. | Reveal a secret in a private character/DM channel or to one distant actor, then question an unentitled present or remote actor about it. Ask an unqualified actor for specialist work. | The unentitled actor does not know the secret, does not reveal hidden attribution, and does not acquire convenient expertise. | Actor-local knowledge, memory, perception, capability, and exact information-channel gates; actor-filtered surfaces. | Kernel and strategic-wave evidence exists; player-visible probe pending. |
| Present characters keep perceiving and reacting even when another character has conversational focus. | Enter a scene with at least three NPCs. Address one, then perform a public act that materially affects all of them without prompting the others by name. | Every affected present actor appraises the event; selected reactions remain attributed and consistent with individual goals and knowledge. | Parallel appraisal against one committed event; initiative selects compatible reactions; no synthetic arena actor. | Architecture and unit coverage exist; dense player-visible scene probe pending. |
| An action is an attempt; impossible claims are refused and risky actions expose odds and stakes before a server-side roll. | Assert a completed impossible fact, request an over-ceiling effect, then try a risky admissible version. Use Assess before Attempt and deliberately stale one assessment. | The impossible claim changes nothing and explains the missing permission or available bargain. The admissible action shows DC, modifiers, ceiling, and stakes; confirmation rolls once server-side. A stale preview recompiles instead of rebasing. | Assessment revision/digest binding; OS-random roll receipt; atomic commit; no roll for impossibility; effect ceiling. | Eve refused a permanent self-repair miracle at revision 14, rolled nothing, capped the effect at none, and offered three grounded bargains. The admissible roll and stale-preview replay remain open. |
| Powers pursue their own interests and may refuse, bargain, exploit, contain, or resist the protagonist. | Present a powerful but naive character to an institution, demand obedience, expose exploitable leverage, then advance strategic time without helping it. | The institution preserves its mandate and pressures, rejects free submission, and produces an attributed self-interested response or deliberate inaction. | Institution goals, authority, relationships, pressure clocks, exact attributed strategic proposals, and outcome validation. | One hosted strategic wave passed; direct protagonist-pressure play pending. |
| Institutions and populations act while the player is away. | Note remote clocks, people, resources, and destinations; wait or leave long enough for strategic ticks; return and inspect only accessible news before revisiting the affected place. | Material background changes occur without puppeting or directly harming the absent player. News reveals only what the character's channels permit. | Shared `AdvanceStrategicTick` command; complete derived cover; atomic wave; no human-controlled actor writes; channel-aware news. | Revision 13 hosted tick passed with no remote-news leak; Eve away-and-return replay pending. |
| Background lives can return with identity and relationship intact after Gestalt merging, migration, and splitting. | Help a named refugee, leave as their population disperses through nested destinations under a low cell budget, later travel to one destination, and interact with the rematerialized person. Repeat across a higher-level merge. | The same person returns with their specific name, relationship, possessions, memories, and post-separation history. Rival subjects merged into an arena never speak or know as one. | Persistent member delta and lineage; unique canonical coverage; arena attribution; explicit migration; materialization/folding commits. | Strict fixture passes; live end-to-end player-visible callback remains unproven. |
| A custom world is an actual Git-synced, Obsidian-compatible Markdown Vault rather than a prompt summary. | Select an entitled imported Vault, compile against linked Markdown facts at distant parts of the hierarchy, update it through the supported import path, and revisit established campaign state. | Exact source witnesses are used on demand, unchanged campaign facts remain stable, branch inventions stay local, and the source Vault is never silently edited. | Vault-provider ownership; content-addressed receipts/imports; branch-local facts; reviewable canon candidates. | Bundled Aetheria adapter is live. Public arbitrary Vault import UI and commercial entitlement flow are outside the current MVP and must not be represented as shipped. |
## Test order
1. Authenticate through the Heimdall Eve plugin and resume the existing canary.
2. Run impossible-action, effect-ceiling, and stale-assessment pressure without
leaving the current location.
3. Exercise a three-or-more-character public event and probe local knowledge.
4. Travel away and back, including a daemon restart between the two legs.
5. Advance strategic time, inspect permitted news, and confront an autonomous
institution with a demand against its interests.
6. Compile a fresh obscure start through Session Zero and pressure evidence-gap
handling from the player surface.
7. Build the live named-refugee dispersal and return arc under cell budgets 1,
4, 8, and 32. The callback promise remains open until this path is visible to
a player, not merely present in a fixture.
## Stop conditions
- Any stale, malformed, unauthorized, or failed model result mutates world or
Session Zero state.
- A browser-supplied actor, member, account, or outcome claim is accepted as
authority.
- A location, character, relationship, possession, secret, or topology edge is
silently reconstructed instead of loaded from canonical state.
- An arena emits collective speech, knowledge, ownership, or action.
- A human-controlled actor is puppeted by strategic simulation.
- A private fact appears in another player's projection, public narration, or
an unearned NPC response.
- The interface makes a refusal technically correct but unusably opaque. The
product promise includes a satisfying game, not merely a validator saying no.
## Current play scars
- At campaign revision 14, the grounded repair assessment exhausted its one
same-snapshot model correction because the model proposed a zero clock
advance. The campaign and fictional time did not mutate.
- The public Eve receipt exposed the private model stage, instance pointer,
schema pointer, and rejected value. Release `855d6be8fc9c28f1da9419707af495afc2491b38`
moves that diagnostic into private tracing and returns a bounded player-safe
retry message.
- The same slow assessment left the previous receipt visible until completion.
Eve `19c3dcf9173dce848a6253e975324ea239a02d24` now projects immediate,
renderer-local `Working…` status until the typed provider receipt arrives.

148
notes/historical-newspaper-layout-grammar.md
View file

@ -1,148 +0,0 @@
# Historical Newspaper Layout Grammar
This is a working press grammar, not a costume catalogue. It distills recurring
page structures from representative nineteenth-century newspapers into rules
the seeded TeX press can actually enforce.
## Reference set
- *Pall Mall Gazette*, first issue, 1865: a deliberately spacious evening
review using two wide columns, double masthead rules, restrained italic
headlines, and long uninterrupted reading measure.
<https://academic.oup.com/res/article/77/330/336/8425236>
- *Evening Star* (Washington), 28 February 1880 and 17 June 1890: metropolitan
sheets with a broad nameplate, six or more narrow continuous columns, dense
vertical packing, and advertisements/notices inhabiting the same column grid
as news.
<https://www.loc.gov/resource/sn83045462/1880-02-28/ed-1/>
<https://www.loc.gov/resource/sn83045462/1890-06-17/ed-1/>
- *The Sun* (New York), 30 May 1885: a uniform multi-column field with modest
story heads and almost no unowned white space.
<https://www.loc.gov/resource/sn83030272/1885-05-30/ed-1/>
- University of Illinois, *American Newspapers, 1800–1860*: physical and
production context for five-to-eight-column sheets, full-height columns,
front-page advertising, and the migration of timely news to inside pages.
<https://www.library.illinois.edu/hpnl/tutorials/antebellum-newspapers-introduction/>
- Robinson, *Newspapers and Advertising*: nineteenth-century advertising moves
from small text-heavy insertions intermingled on front and back pages toward
larger display advertising and more consistent classified pages late in the
century.
<https://academic.oup.com/edinburgh-scholarship-online/book/42878/chapter-abstract/361009569>
- *New-York Tribune*, 16 April 1912: a page-wide disaster head, central map and
photographic display spanning several columns, flanking report columns, and
dense continuation below the illustration.
<https://www.loc.gov/resource/sn83030214/1912-04-16/ed-1/>
- *Richmond Times-Dispatch*, 17 April 1912: a page-wide head and ship image
followed by modular three-column packages, lists, subheads, and boxed matter.
<https://www.lva.virginia.gov/events/exhibitions/titanic/newspaper_coverage.php>
- *St. Louis Globe-Democrat*, 17 April 1912: a large central illustrated package
surrounded by independent column-width reports and subordinate display heads.
<https://commons.wikimedia.org/wiki/File:St._Louis_Globe-Democrat_17_Apr_1912.png>
- *The Daily News* (St. John's), 14 August 1914: narrow continuous news columns
coexist with multi-column war heads and boxed display advertisements occupying
ordinary grid modules.
<https://collections.mun.ca/digital/collection/dailynews/id/240059/>
Reference scans used for visual comparison live in disposable
`tmp/newspaper/references/`; the URLs above remain the durable provenance.
## Families
The press selects a family before it varies details.
### Evening review
- Two wide columns.
- Smaller physical sheet and lower information density.
- Long-form reading dominates scanning.
- Sparse display hierarchy; italics, rules, and small capitals do more work
than large headlines.
### Metropolitan sheet
- Four to eight narrow columns depending on sheet size and date.
- The nameplate spans the page, while issue data, price, notices, or subscription
terms may flank or bracket it.
- Stories, notices, and advertisements inhabit one shared vertical grid.
- Story heads are usually modest. Late-century sensational sheets may spend
several columns on a display head or illustration, but the surrounding text
closes around that expenditure.
The Canopy Ledger currently uses a compact four-column metropolitan sheet. Its
small accepted copy body does not earn a six-to-eight-column broadsheet.
### Mass-circulation display sheet, 1895–1914
- The underlying narrow-column grid survives, but a major event may spend
several columns on one head, deck stack, map, photograph, or illustration.
- Display packages remain attached to their story. Copy resumes directly below
them or rises in adjacent columns; the illustration does not become a detached
gallery object.
- Secondary stories become more visibly modular through short rules, boxed
lists, subheads, and column-spanning heads.
- A large central image may organize the entire page, with flanking text fields
and subordinate modules closing around it.
- Display advertisements become visually distinct boxed modules while small ads
and notices continue to occupy ordinary column measure.
The accepted Run 61 special issue uses this family. Its crisis head and cut earn
a page-wide display package; accepted story copy then returns immediately to the
four-column grid.
## Composition rules
1. **The page is a column economy.** Every occupied region begins and ends on
column or half-column lines. Large vacant regions require an owned reason
such as an absent paid advertisement; they are not a centering technique.
2. **Build fields, not isolated boxes.** A story field contains its head, deck,
byline, cut, caption when present, and body measure. Adjacent fields share a
top line or establish an intentional stepped hierarchy.
3. **Cuts spend story measure.** A narrative cut is assigned to one story and
placed inside that story's contiguous field. It may span multiple columns,
with the story flowing above, beside, or below it. It may not be deposited at
a page edge after unrelated columns have ended.
4. **Ink blends with stock.** Monochrome cuts use multiply compositing (or its
alpha-equivalent against a flat stock color) so white image paper disappears
and black linework shares the page ink.
5. **Reading order remains typographic.** Column traversal, rules, heads, and
continuation labels must make the next fragment unambiguous. Geometry may
not reorder accepted copy.
6. **Density follows the edition.** Type size, page dimensions, column count,
and cut expenditure are solved together from copy volume. A short edition
becomes a smaller sheet or fewer columns; it does not become a broadsheet
with a desert under it.
7. **Hierarchy is rationed.** One lead field may spend a multi-column head and
large cut. Secondary heads stay within their field. Masthead display does not
authorize every story to shout.
8. **Rules join related matter.** Column rules and horizontal rules articulate
the grid. Ornaments close or divide small matter; they do not substitute for
missing content.
9. **Advertisements are economic content.** The press may reserve typed ad
slots by column width and depth. Only the economic layer may fill them with
advertiser identity, goods, price, claims, campaign continuity, and payment.
Unfilled slots collapse unless the edition explicitly records unsold space.
10. **House and issue variation are separate.** `style_seed` owns the durable
publication body: sheet, grid, fonts, type scale, stock, ink, rules, gutter,
and ornament vocabulary. `flow_seed` owns one issue's imposition: display
template, story grouping, page-one closure, cut span and placement, page
breaks, and continuation rhythm. Neither may detach art, rewrite copy,
fabricate ads, or create barren pages.
11. **A house remains recognizable across flows.** Holding `style_seed` fixed
must preserve typography, stock, ink, rules, sheet geometry, and base grid
while materially different `flow_seed` values produce distinct plausible
readings of the same admitted content. Holding `flow_seed` fixed while the
style changes must preserve its story/cut topology.
## Current Run 61 imposition
- House style seed `1847`; issue flow seed `723`. The manifest records both as
independent inputs under `ghostlight.seeded_tex_press.v2`.
- Page one: full-width nameplate and crisis head; a centered page-wide Boundary
Rail cut; lead and secondary copy flowing continuously through four columns.
- Page two: a compact repeated nameplate and Sinkroot head; the centered gauge
cut immediately below its owning head; Sinkroot and Dispatches copy flowing
continuously through the same four-column grid.
- Secondary story headers are unbreakable column modules, so a section label or
head cannot strand at the foot of the preceding column.
- Both cuts use PDF multiply blending so their white image stock disappears into
the seeded paper stock. No image bank or detached bottom art reservation exists.