Record native Yggdrasil Ghostlight authority
This commit is contained in:
Meta Vens
parent
10b638e457
commit
91e70d4e40
6 changed files with 84 additions and 54 deletions
|
|
@ -37,8 +37,10 @@ multiresolution agency graph for keeping large settings active at finite cost.
|
|||
|
||||
## Current Status
|
||||
|
||||
Ghostlight Dungeon is implemented and deployed as a Starfire-hosted,
|
||||
Heimdall-gated playtest harness. The current acceptance surface covers:
|
||||
Ghostlight Dungeon is implemented and deployed as a native Yggdrasil,
|
||||
Heimdall-gated playtest harness. Idunn owns daemon continuity, Odin owns Verse
|
||||
discovery, and the application remains the sole owner of campaign truth. The
|
||||
current acceptance surface covers:
|
||||
|
||||
- persistent DM-led Session Zero with shared/private channels, typed contracts,
|
||||
private boundaries, character bargains, digest-bound unanimous approval, and
|
||||
|
|
@ -59,7 +61,8 @@ Heimdall-gated playtest harness. The current acceptance surface covers:
|
|||
rematerialisation of the same person;
|
||||
- atomic rejection of malformed, stale, or semantically invalid model waves;
|
||||
- provider, token, cache, latency, validation, state-version, and build receipts;
|
||||
- exact-build deployment and restart verification on Starfire.
|
||||
- exact-build deployment, state migration, public cutover, and restart
|
||||
verification on Yggdrasil.
|
||||
|
||||
The remaining forge gate is multi-account human pressure testing of Session
|
||||
Zero privacy/publication and bounded co-op alongside continued
|
||||
|
|
|
|||
|
|
@ -8,9 +8,11 @@ geography, bounded knowledge, durable actors and institutions, explicit
|
|||
consequence, and motion beyond the players' attention. Players describe
|
||||
attempts. The world decides what is possible, what is opposed, and what changes.
|
||||
|
||||
The MVP runs as a Rust daemon on Starfire and publishes a private Eve/CultUI
|
||||
surface for two invited testers. Aetheria is the bundled setting adapter. The
|
||||
core world, Persona, and Vault contracts remain setting-neutral.
|
||||
The MVP runs as a native Rust daemon on Yggdrasil and publishes a
|
||||
Heimdall-authenticated Eve/CultUI surface for one to eight campaign members.
|
||||
Idunn owns daemon continuity and Odin owns Verse discovery; neither can mutate
|
||||
campaign state. Aetheria is the bundled setting adapter. The core world,
|
||||
Persona, and Vault contracts remain setting-neutral.
|
||||
|
||||
Ghostlight's existing v0 schemas and Pallas, Lucent, and Corvid fixtures are
|
||||
evidence and regression scenarios. They do not own runtime state or commits.
|
||||
|
|
@ -552,7 +554,7 @@ submits ticks to each campaign's own mailbox.
|
|||
|
||||
`VaultProvider` exposes source search, surrounding context, exact documents,
|
||||
source witnesses, authority lanes, and temporal scope. The Aetheria adapter
|
||||
calls VoidBot's canonical MCP retrieval endpoint at Starfire loopback. It stores
|
||||
calls VoidBot's canonical MCP retrieval endpoint at Yggdrasil loopback. It stores
|
||||
exact evidence receipts used by the campaign, never vectors or a rival index.
|
||||
|
||||
Compilation is staged and approval-gated:
|
||||
|
|
@ -780,18 +782,20 @@ through the same campaign mailbox and atomic commit path. The bounded milestone
|
|||
keeps the party in one scene; the multiplayer-intention document owns the
|
||||
remaining split-party and social-governance work.
|
||||
|
||||
The MVP runs as a normal detached process under the Starfire operator account.
|
||||
The launcher records the PID, exact executable path, release commit, and logs;
|
||||
the stop path refuses an executable mismatch. Runtime ACLs permit the operator,
|
||||
SYSTEM, and administrators. Setup reads the DeepSeek key once and writes a
|
||||
machine-scoped DPAPI secret. The key is absent from source, arguments, logs,
|
||||
environment projections, and exports.
|
||||
The MVP runs as `ghostlight:ghostlight` under native
|
||||
`ghostlight-dungeon.service`. Idunn admits its signed typed health and owns
|
||||
same-release restart continuity; its deployment brake governs mutation of the
|
||||
installed artifact, not ordinary survival. Runtime directories are restricted
|
||||
to the service identity and administrators. Setup installs the DeepSeek key as
|
||||
a systemd encrypted credential bound to the exact credential name. The key is
|
||||
absent from source, arguments, logs, environment projections, and exports.
|
||||
|
||||
Releases are immutable directories built from exact commits. Activation is an
|
||||
atomic pointer switch, recorded in CultCache, and the rollback runbook lives in
|
||||
`gamecult-ops`. The MVP process does not automatically survive logout or reboot.
|
||||
Task Scheduler may be added when tester availability makes that useful; native
|
||||
Windows service machinery is outside the MVP.
|
||||
`gamecult-ops`. Systemd starts the admitted release at boot and restarts that
|
||||
same installed body through Idunn continuity. Changing the artifact,
|
||||
configuration, schema, unit, or authority binding remains a separate
|
||||
deployment operation.
|
||||
|
||||
The binary owns its build provenance. Release tooling injects the clean-tree
|
||||
commit through `GHOSTLIGHT_BUILD_COMMIT`; local builds derive it from Git while
|
||||
|
|
@ -801,10 +805,11 @@ Launchers and manifests may verify it but may not rewrite it. Activation is
|
|||
rejected unless checkout HEAD, embedded commit, immutable manifest, binary
|
||||
hash, and the running health projection agree.
|
||||
|
||||
Live VoidBot integration uses the independently verified Yggdrasil host and the
|
||||
restored Starfire loopback crossing at `127.0.0.1:17875/mcp`. The repaired
|
||||
tunnel task uses the live `F:\Projects` body. Retired local VoidBot/Qdrant
|
||||
writers stay retired.
|
||||
Live VoidBot integration is host-local on Yggdrasil at
|
||||
`127.0.0.1:17875/mcp`. VoidBot remains the Vault retrieval owner; Ghostlight
|
||||
stores exact evidence receipts rather than a rival index. Odin provides
|
||||
discovery at `10.77.0.1:17871`. The old Starfire crossing is no longer a live
|
||||
runtime dependency, and Starfire's retired VoidBot/Qdrant writers stay retired.
|
||||
|
||||
## Public contracts
|
||||
|
||||
|
|
@ -863,10 +868,11 @@ The UI consumes existing `gamecult.eve.surface.v1` and
|
|||
7. Add the VoidBot and DeepSeek production adapters without granting either
|
||||
commit authority.
|
||||
8. Publish the CultMesh/Eve surface and thin authenticated browser host.
|
||||
9. Add detached-process launch/stop, DPAPI setup, release activation, firewall,
|
||||
and rollback tooling under the correct repository owners.
|
||||
9. Add native systemd lifecycle, encrypted-credential setup, release
|
||||
activation, reverse-proxy, and rollback tooling under the correct repository
|
||||
owners.
|
||||
10. Run fixture regressions, invariant fault tests, browser acceptance, and the
|
||||
final Starfire deployment smoke.
|
||||
final native Yggdrasil deployment smoke.
|
||||
|
||||
## Acceptance and negative proof
|
||||
|
||||
|
|
|
|||
|
|
@ -66,7 +66,17 @@ Deployment truth is the immutable release named below. Operational ownership
|
|||
and rollback commands remain in `gamecult-ops`; this handoff records only the
|
||||
application witness needed for re-entry.
|
||||
|
||||
The hosted MVP is implemented and live on Starfire. Ghostlight owns the
|
||||
### 2026-08-21 native Yggdrasil cutover
|
||||
|
||||
Yggdrasil is the current production body. Historical Starfire deployment
|
||||
entries below are acceptance lineage, not live topology. The state migration
|
||||
copied seven campaign stores, one Session Zero store, and service auth while
|
||||
preserving Yggdrasil's native mesh and provider-health identities. Nginx now
|
||||
routes `/ghostlight/` to the native loopback service; the Starfire writer was
|
||||
stopped before exposure. Restore from the old body only through the documented
|
||||
rollback transaction—never by starting both writers.
|
||||
|
||||
The hosted MVP is implemented and live natively on Yggdrasil. Ghostlight owns the
|
||||
generalized projection membrane; Epiphany consumes its pinned crate while
|
||||
retaining her own Mind and consequence authority. The Rust daemon now owns
|
||||
VoidBot-grounded compilation and approval, stable topology, campaign mailboxes,
|
||||
|
|
@ -82,13 +92,15 @@ foundation checklist below. Existing Ghostlight fixtures remain regression
|
|||
evidence.
|
||||
|
||||
The active immutable release is
|
||||
`2b059da2edfec5f8db216ecd92df94687103f1cc`, binary SHA-256
|
||||
`e78a6c3b9520630e3342f93d48ebf9ebdf9497c5556d41859526b71839ab97b2`.
|
||||
Manifest, process, typed health, persisted campaign count, CultMesh store,
|
||||
DeepSeek startup inference, and VoidBot retrieval agree. Periwinkle proved the
|
||||
private-LAN route and unauthenticated 401; Raven and Yggdrasil independently
|
||||
proved WireGuard. Exact firewall and rollback truth remains owned by
|
||||
`gamecult-ops/runbooks/ghostlight-dungeon-starfire.md`.
|
||||
`10b638e45756e5210aaee1efb5dcf74dbebf83c0`, binary SHA-256
|
||||
`327c93b0cddd6b344f85e14e24be51688d74a58e1ea22dd42393b81b07f48f7a`,
|
||||
with Eve release `076d2124ed476cdaeff540c9d24c2d4fb57d04cf`. Manifest, embedded
|
||||
commit, systemd process, typed health, seven migrated campaigns, one Session
|
||||
Zero draft, CultMesh store, DeepSeek startup inference, local VoidBot retrieval,
|
||||
and restart recovery agree. Yggdrasil nginx serves `/ghostlight/`; anonymous
|
||||
campaign access returns 401. The Starfire writer is stopped. Idunn owns native
|
||||
continuity and Odin owns RUDP discovery. Exact firewall, deployment, migration,
|
||||
and rollback truth remains owned by `gamecult-ops`.
|
||||
|
||||
The full workspace passes 161 core and 15 daemon tests plus strict TypeScript
|
||||
and Vite release builds. The public crossing returns 200, unauthenticated state
|
||||
|
|
|
|||
|
|
@ -2,9 +2,10 @@
|
|||
|
||||
GhostlightDungeon is the active hosted runtime. Its authority map is
|
||||
`docs/architecture/ghostlight-dungeon-mvp.md`. The implemented Rust daemon,
|
||||
CultCache campaign stores, CultMesh/Eve surfaces, browser lowerer, and Starfire
|
||||
process/release scripts are the live machine; the older validated artifact
|
||||
seams remain regression evidence only.
|
||||
CultCache campaign stores, CultMesh/Eve surfaces, browser lowerer, native
|
||||
Yggdrasil systemd body, Idunn continuity target, and Odin discovery crossing
|
||||
are the live machine; the older validated artifact seams remain regression
|
||||
evidence only.
|
||||
|
||||
## GhostlightDungeon target flow
|
||||
|
||||
|
|
@ -208,21 +209,27 @@ and operator inspection; the browser cannot reveal them before discovery.
|
|||
|
||||
## Current acceptance body
|
||||
|
||||
Starfire currently serves immutable release
|
||||
`2b059da2edfec5f8db216ecd92df94687103f1cc`, executable SHA-256
|
||||
`e78a6c3b9520630e3342f93d48ebf9ebdf9497c5556d41859526b71839ab97b2`,
|
||||
with rollback `531d4d44bb749201b668ea06a27eef2ee7cdda12`.
|
||||
Yggdrasil currently serves native immutable release
|
||||
`10b638e45756e5210aaee1efb5dcf74dbebf83c0`, executable SHA-256
|
||||
`327c93b0cddd6b344f85e14e24be51688d74a58e1ea22dd42393b81b07f48f7a`,
|
||||
with Eve release `076d2124ed476cdaeff540c9d24c2d4fb57d04cf`. The service runs as
|
||||
`ghostlight:ghostlight` under `ghostlight-dungeon.service`; typed health,
|
||||
manifest, embedded commit, executable hash, seven imported campaigns, one
|
||||
Session Zero draft, DeepSeek readiness, and restart recovery agree.
|
||||
|
||||
The public `/ghostlight/` path terminates on Yggdrasil nginx and proxies the
|
||||
native loopback listener at `127.0.0.1:8831`. Anonymous campaign access returns
|
||||
401. The previous Starfire writer is stopped; its process and tunnel are no
|
||||
longer live authority. The migration copied campaign, Session Zero, and auth
|
||||
stores while preserving Yggdrasil's native mesh and provider-health identities.
|
||||
|
||||
Local CultMesh publication and HTTP readiness do not wait for Odin. Remote
|
||||
replication is coalesced into one asynchronous RUDP batch. Netcup's Vienna
|
||||
network incident explains the transient Yggdrasil reachability loss observed
|
||||
on 2026-08-21; Netcup reported full recovery at 17:37 CEST while continuing to
|
||||
observe the site. After network recovery, SSH, WireGuard, the supervised tunnel,
|
||||
and public Ghostlight health were reachable. The separate Odin continuity fault
|
||||
remains: `odin-coordinator-1` and its `10.77.0.1:17871` listener are absent,
|
||||
while Idunn's unrelated provider-query socket remains loopback-only. Ghostlight
|
||||
therefore retains its canonical local CultMesh/Eve projection and emits one
|
||||
bounded publication warning without losing local state or liveness.
|
||||
replication is coalesced into one asynchronous RUDP batch. Odin's coordinator
|
||||
is healthy on Yggdrasil and owns RUDP discovery at `10.77.0.1:17871`; Idunn
|
||||
admits signed Ghostlight health and owns same-release continuity independently
|
||||
of its deployment brake. VoidBot's canonical MCP service is local to the host
|
||||
at `127.0.0.1:17875/mcp`, so live retrieval no longer depends on a Starfire
|
||||
reverse tunnel.
|
||||
|
||||
The deployed Session Zero canary survived two exact-build restarts with its
|
||||
private store intact. Heimdall completed a real KLTST Discord round trip and
|
||||
|
|
|
|||
|
|
@ -31,11 +31,13 @@ persistent pins, approval-gated gestalt fission, graph and cover receipts, and
|
|||
a separate operator provider-concurrency limit. The
|
||||
specific authority map is
|
||||
`docs/architecture/ghostlight-multiresolution-agency.md`.
|
||||
The accepted implementation is hosted on Starfire as immutable release
|
||||
`2b059da2edfec5f8db216ecd92df94687103f1cc`. Exact checkout, embedded commit,
|
||||
release manifest, binary hash, process, typed health, CultMesh store, persisted
|
||||
campaign, DeepSeek startup inference, VoidBot retrieval, private-LAN access,
|
||||
WireGuard access, and unauthenticated rejection agree. This pass makes model
|
||||
The accepted implementation is hosted natively on Yggdrasil as immutable
|
||||
release `10b638e45756e5210aaee1efb5dcf74dbebf83c0`. Exact checkout,
|
||||
embedded commit, release manifest, binary hash, systemd process, typed health,
|
||||
CultMesh store, seven migrated campaigns, one Session Zero draft, DeepSeek
|
||||
startup inference, local VoidBot retrieval, public Heimdall path, restart
|
||||
recovery, and unauthenticated rejection agree. Idunn owns continuity and Odin
|
||||
owns discovery; neither owns campaign mutation. This pass makes model
|
||||
work inspectable and cheaper:
|
||||
provider attempts expose prompt/completion/cache usage and exact local failures;
|
||||
stable prefixes precede dynamic context; world and agency compilation are
|
||||
|
|
|
|||
|
|
@ -273,6 +273,6 @@ data_flow:
|
|||
- If state grows faster than understanding, cut it back.
|
||||
|
||||
current_status:
|
||||
summary: Starfire serves immutable release 2b059da2edfec5f8db216ecd92df94687103f1cc with persistent DM-led Session Zero, private character and boundary channels, inline Vault-grounded opening/role decisions, unanimous digest approval, atomic campaign publication, actor-bound campaign membership, actor-filtered Eve/CultMesh surfaces, pooled entitlement budgets, unanimous time/travel/budget governance, and revision-bound Contract Review. The full workspace passes 161 core and 15 daemon tests. A real Heimdall/KLTST browser canary generated grounded openings, survived release restarts, proved malformed DM output cannot mutate the draft, and completed a schema-aware Mars/Zhestokost DM turn. Netcup's 2026-08-21 Vienna incident explained the transient Yggdrasil reachability loss; public Ghostlight, SSH, WireGuard, and its tunnel recovered. Local CultMesh/Eve state is healthy, while outbound Odin RUDP rendezvous remains separately degraded because the Odin coordinator did not return with the host runtime.
|
||||
next_action: Restore the admitted Yggdrasil Odin runtime through Idunn-owned continuity before claiming remote Verse publication healthy. Then run a two-person Starfire Session Zero and bounded shared-scene canary using separate Heimdall accounts, followed by an eight-account roster/privacy/unanimity smoke. Continue pressuring multiresolution Gestalt agency under human play; do not weaken actor, privacy, approval, or no-puppeting invariants to make the smoke pass.
|
||||
summary: Yggdrasil serves native immutable release 10b638e45756e5210aaee1efb5dcf74dbebf83c0 with persistent DM-led Session Zero, private character and boundary channels, inline Vault-grounded opening/role decisions, unanimous digest approval, atomic campaign publication, actor-bound campaign membership, actor-filtered Eve/CultMesh surfaces, pooled entitlement budgets, unanimous time/travel/budget governance, and revision-bound Contract Review. Exact manifest, embedded commit, binary SHA-256 327c93b0cddd6b344f85e14e24be51688d74a58e1ea22dd42393b81b07f48f7a, systemd health, seven migrated campaigns, one Session Zero draft, DeepSeek readiness, local VoidBot retrieval, restart recovery, public /ghostlight/ access, and anonymous rejection agree. The Starfire writer is stopped. Idunn owns signed-health continuity and Odin provides Yggdrasil discovery without acquiring campaign authority.
|
||||
next_action: Run a two-person Yggdrasil Session Zero and bounded shared-scene canary using separate Heimdall accounts, followed by an eight-account roster/privacy/unanimity smoke. Continue pressuring multiresolution Gestalt agency under human play; do not weaken actor, privacy, approval, or no-puppeting invariants to make the smoke pass.
|
||||
gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.
|
||||
|
|
|
|||
Loading…
Reference in a new issue