Seal rebuild authority before ontology
This commit is contained in:
Meta Vens
parent
5fe22dab76
commit
a34ddf9524
5 changed files with 133 additions and 42 deletions
|
|
@ -32,6 +32,13 @@ ontology reducer, and commits an atomic CultCache revision. Session Zero,
|
|||
autonomous turns, player commands, imports, and administrative changes must
|
||||
enter through the same `CommandEnvelope` path.
|
||||
|
||||
That owner must be sealed before the ontology widens. The public boundary is
|
||||
create/open, immutable snapshot, submit, and typed receipts. Mutable aggregate
|
||||
state, canonical ID issuance, the reducer, and the CultCache journal writer are
|
||||
private to the kernel. Controller assignment and affordance grants are
|
||||
canonical; current executability and exact revision-bound decision
|
||||
opportunities are derived and revalidated by the kernel.
|
||||
|
||||
Autonomous cognition has two explicit modes under disjoint controller scopes:
|
||||
|
||||
- `NarrativePersona` receives narrative projection and replies only in prose.
|
||||
|
|
@ -47,6 +54,9 @@ missing affordances, and missing command primitives become translation gaps.
|
|||
Step exhaustion finalizes accumulated speech, proposals, and gaps. Transport
|
||||
faults and stale commits remain infrastructure outcomes outside interpretation.
|
||||
Only the world kernel may accept or reject a proposed mutation.
|
||||
Translation gaps remain non-fictional inference/evaluation evidence outside
|
||||
`WorldState`; recording one cannot itself request elaboration or advance a
|
||||
world revision.
|
||||
|
||||
World validity is sparse and causal. Actor counts, coverage ratios,
|
||||
interestingness, political diversity, name quality, and prose quality are
|
||||
|
|
@ -59,8 +69,13 @@ load or evaluation evidence; none admits ontology or declares a world complete.
|
|||
orchestration scripts.
|
||||
- `a144c33` adds the two cognition modes and total interpretation contract in
|
||||
`ghostlight-persona-projection`.
|
||||
- The replacement `WorldState` and `CommandEnvelope` foundation is mid-surgery.
|
||||
It is not current authority until committed and verified.
|
||||
- An uncommitted broad `world.rs` prototype was rejected and deleted. It
|
||||
exposed mutable state and ID issuance, admitted translation-gap evidence into
|
||||
canonical types, allowed no-op commits, and left affordance and opportunity
|
||||
authority undefined. None of it is current authority.
|
||||
- The next implementation starts with the sealed `WorldKernel`/aggregate/private
|
||||
journal seam, then adds only the minimal private reducer needed for one
|
||||
vertical slice.
|
||||
- Legacy `WorldKernel`, `SessionZeroKernel`, aggregate Campaign/component state,
|
||||
alternate ingresses, semantic verifier/reconciliation stages, model-owned
|
||||
scheduling, and checkpoint recovery remain deletion targets.
|
||||
|
|
@ -97,11 +112,22 @@ and proposals but cannot commit on their behalf.
|
|||
|
||||
## Next gate
|
||||
|
||||
Finish and verify the typed world ontology, then build the private aggregate
|
||||
journal with one writer, compare-and-swap revision, digest chaining,
|
||||
idempotency, and restart recovery. Cut obsolete writers before migrating
|
||||
Session Zero, turns, resolution, elaboration, persistence, and projection onto
|
||||
that path. No live acceptance run precedes the focused contract suite.
|
||||
First establish and verify the sealed `WorldKernel`/aggregate/journal seam:
|
||||
external code can create or open a kernel, read an immutable snapshot, submit a
|
||||
`CommandEnvelope`, and receive a typed receipt, but cannot invoke canonical ID
|
||||
allocation, mutate `WorldState`, call the reducer, or obtain a journal writer.
|
||||
A caller-supplied unknown ID is merely an invalid reference; it cannot become
|
||||
canonical. Then add a minimal private reducer for Draft creation, approval,
|
||||
activation, one player action, and one autonomous action.
|
||||
|
||||
The focused seam tests must prove one writer, compare-and-swap revision, digest
|
||||
chaining, idempotency, exact restart, atomic rejection, and no-op non-commit. A
|
||||
decision proposal must fail closed when its revision, controller, authority
|
||||
scope, or currently executable affordance differs from the kernel-derived
|
||||
opportunity. Translation gaps and scheduler output must have no world-write
|
||||
path. Cut obsolete writers before migrating Session Zero, resolution,
|
||||
elaboration, persistence, and projection. No live acceptance run precedes this
|
||||
suite.
|
||||
|
||||
## Essential references
|
||||
|
||||
|
|
@ -121,6 +147,9 @@ that path. No live acceptance run precedes the focused contract suite.
|
|||
count, or derived simulation cover is not canonical world state.
|
||||
- Do not preserve an old writer through a compatibility path.
|
||||
- Do not let a translation gap become invented state or an Interpreter error.
|
||||
- Do not publish mutable world types, an ID issuer, a reducer entry point, or a
|
||||
generic journal handle for the convenience of tests or adapters.
|
||||
- Do not append a commit when reduction produces no canonical mutation.
|
||||
- Do not resume Run 115.
|
||||
- Keep this handoff compact. Move chronology to Git, evidence, or the frozen
|
||||
system map.
|
||||
|
|
|
|||
|
|
@ -19,27 +19,64 @@ These mechanisms are teardown evidence, not foundations that must survive.
|
|||
The target map is adopted. The first subtraction removed seven pipeline-smoke
|
||||
binaries and two live-fire scripts. The projection crate now exposes explicit
|
||||
`NarrativePersona` and `OperationalAgent` modes plus a total Interpreter report.
|
||||
The replacement world ontology is the active bounded implementation move.
|
||||
An uncommitted broad `world.rs` prototype was rejected and deleted before it
|
||||
became authority. It exposed mutable aggregate state and ID issuance, placed
|
||||
translation-gap evidence inside canonical world types, permitted empty commits,
|
||||
and defined controllers without owning executable affordances or exact decision
|
||||
opportunities. The active bounded move is now the sealed aggregate boundary,
|
||||
not a public ontology inventory.
|
||||
|
||||
## Authority map
|
||||
|
||||
- **Owner:** one per-world `WorldKernel` and its private aggregate journal.
|
||||
- **Inputs:** authenticated `CommandEnvelope`s, current `WorldState`, internally
|
||||
derived authority, deterministic time/randomness inputs, and typed proposals
|
||||
from humans or autonomous controllers.
|
||||
- **Outputs:** one accepted or rejected command receipt; accepted commands
|
||||
produce one new digest-chained revision and derived notifications.
|
||||
- **Derived state:** projections, schedulers, news, transcripts, model receipts,
|
||||
checkpoints, coverage counts, and evaluations. None may write world truth.
|
||||
- **Forbidden writers:** the old Session Zero publication path, aggregate
|
||||
Campaign writer, legacy transition projection, alternate elaboration and
|
||||
mutation inputs, verifier/reconciliation agents, model-owned schedulers,
|
||||
recovery repair loops, and external consumer callbacks.
|
||||
- **Owner:** one sealed per-world `WorldKernel` owns its private aggregate,
|
||||
reducer, ID allocator, and journal writer. The public crate boundary exposes
|
||||
only create/open, immutable snapshot, command submission, and typed receipts;
|
||||
it does not expose mutable `WorldState`, the canonical entity-ID allocator, reducer
|
||||
entry points, or generic journal writes.
|
||||
- **Inputs:** an authenticated `CommandEnvelope` with stable command ID, exact
|
||||
world and expected revision, principal evidence, one closed command body, and
|
||||
exact source receipts where needed. The kernel privately loads current state,
|
||||
derives authority, and supplies deterministic clock or entropy. Human,
|
||||
Interpreter, operational-agent, author, scheduler, and external-owner output
|
||||
is proposal material only.
|
||||
- **Outputs:** a rejection receipt changes nothing. An accepted command returns
|
||||
one `WorldCommit`, including any reducer-issued ID mapping, and atomically
|
||||
appends one digest-chained revision. A structurally valid command that lowers
|
||||
to no factual, speech, lifecycle, or time mutation returns `NoEffect` and does
|
||||
not advance revision, change either digest, allocate IDs, or append a journal
|
||||
row.
|
||||
- **Derived state:** immutable snapshots and subject views, currently executable
|
||||
affordance catalogs, revision-bound `DecisionOpportunity` values, scheduler
|
||||
queues, translation gaps, projections, news, transcripts, model receipts,
|
||||
checkpoints, coverage counts, and evaluations. Translation gaps may be kept
|
||||
as inference/evaluation telemetry or motivate a later explicit author
|
||||
proposal; they are not a `WorldState` component, event, or mutation.
|
||||
- **Forbidden writers:** public state setters or ID issuers; direct reducer
|
||||
callers; generic CultCache insert/append handles; schedulers or controllers
|
||||
that assign authority, mint executable affordances, consume opportunities, or
|
||||
commit; automatic translation-gap lowering; empty commits; the old Session
|
||||
Zero publication path, aggregate Campaign writer, legacy transition
|
||||
projection, alternate elaboration and mutation inputs,
|
||||
verifier/reconciliation agents, recovery repair loops, and external consumer
|
||||
callbacks.
|
||||
- **Shared paths:** draft creation, approval, activation, player action,
|
||||
autonomous action, time, travel, imports, reload, and administration use the
|
||||
same submit/derive/reduce/commit primitive.
|
||||
- **Deletion line:** obsolete writers are deleted or reduced to read-only
|
||||
evidence before their replacement path is called complete.
|
||||
autonomous action, author expansion, time, travel, imports, reload, and
|
||||
administration use create/open/snapshot/submit and the same private
|
||||
derive/reduce/commit primitive. Controller harnesses submit an exact typed
|
||||
proposal as an ordinary command. Recovery opens and verifies the same journal;
|
||||
it cannot call a repair reducer.
|
||||
- **Cut line:** the rejected public ontology stays deleted. Translation-gap
|
||||
records stay outside canonical world state. No public constructor or helper
|
||||
may issue a canonical ID, mutate an aggregate, invoke the reducer, or write the
|
||||
journal. Obsolete writers are deleted or reduced to read-only evidence before
|
||||
their replacement path is called complete.
|
||||
- **Verification layer:** compile-time visibility proves that an external crate
|
||||
cannot invoke the ID allocator, mutate `WorldState`, call the reducer, or
|
||||
obtain the journal writer. Focused black-box tests prove that a caller-supplied
|
||||
unknown ID cannot become canonical, plus atomic rejection, no-op non-commit,
|
||||
reducer-only ID allocation, exact restart/digest recovery, translation-gap
|
||||
non-authority, and opportunity rejection when revision, controller, scope, or
|
||||
executable affordance does not match.
|
||||
|
||||
`SessionZeroKernel` is no longer a target owner; Draft is a `WorldState` phase.
|
||||
Aggregate Campaign state is no longer an owner; aggregate views are derived
|
||||
|
|
@ -67,25 +104,38 @@ projection of committed history.
|
|||
review remain evaluation evidence only.
|
||||
9. Restart reconstructs the exact committed world and idempotency history; a
|
||||
recovery loop cannot repair or reinterpret it.
|
||||
10. Canonical IDs are allocated only while a complete private reduction is
|
||||
being admitted. Rejected and no-effect commands cannot consume or reveal
|
||||
them.
|
||||
11. Controller assignment and affordance grants are canonical aggregate state.
|
||||
Current executability and decision opportunities are deterministic
|
||||
revision-bound derivations. A scheduler can order those opportunities but
|
||||
cannot mint their authority.
|
||||
|
||||
## Implementation sequence
|
||||
|
||||
### 1. Typed world foundation — in progress
|
||||
### 1. Seal the aggregate boundary — in progress
|
||||
|
||||
Define opaque runtime-issued IDs, lifecycle phases, subjects, places, routes,
|
||||
relations, governance, knowledge, resources, custody, jurisdiction, external
|
||||
ownership, controller scopes, events, commands, structural validation, and the
|
||||
pure reducer. Prove referential integrity, atomic rejection, disjoint controller
|
||||
scope, privacy, sparse activation, and lifecycle legality with focused tests.
|
||||
Establish `WorldKernel` with a private aggregate and private journal child before
|
||||
publishing ontology types. Expose only create/open, immutable snapshot, submit,
|
||||
and typed receipts. Make canonical state mutation, ID allocation, reduction,
|
||||
and CultCache writes unreachable from outside the owning module. Prove the
|
||||
visibility boundary and the one-writer transaction seam before widening the
|
||||
state vocabulary.
|
||||
|
||||
### 2. Private aggregate journal
|
||||
### 2. Add the minimal private reducer
|
||||
|
||||
Expose only create/open/snapshot/submit. Keep the CultCache writer in a private
|
||||
child module. Persist digest-chained commits and snapshots atomically with
|
||||
expected revision and idempotency key. Prove stale revision rejection, replay
|
||||
idempotency, corruption detection, and byte-for-byte restart recovery.
|
||||
Behind that boundary, implement only the state and command vocabulary required
|
||||
for Draft creation, approval, activation, one actor action, and one autonomous
|
||||
action. The aggregate owns controller assignments and affordance grants; it
|
||||
derives exact current executability and revision-bound opportunities. Allocate
|
||||
IDs only after a complete candidate validates, reject empty reductions without
|
||||
a commit, and persist accepted state plus commit atomically with expected
|
||||
revision and idempotency. Add places, relations, resources, external ownership,
|
||||
and other ontology components only when the vertical slice reaches their typed
|
||||
causal boundary.
|
||||
|
||||
### 3. One vertical slice
|
||||
### 3. Exercise one vertical slice
|
||||
|
||||
Route Draft creation and activation, one player action, and one autonomous
|
||||
action through the aggregate. Derive a subject-private projection and one
|
||||
|
|
@ -128,6 +178,14 @@ Required black-box proofs:
|
|||
fall through, and never consume one opportunity twice.
|
||||
7. Interpretation always completes semantically and preserves unlowered
|
||||
material as translation gaps.
|
||||
8. A no-effect command leaves revision, state digest, commit digest, ID
|
||||
allocation, and journal length unchanged.
|
||||
9. An external crate cannot obtain mutable aggregate state, invoke the canonical
|
||||
ID allocator, call the reducer, or write the journal; a caller-supplied
|
||||
unknown ID is rejected rather than admitted.
|
||||
10. A decision proposal is rejected when its revision-bound opportunity,
|
||||
controller, scope, or currently executable affordance is wrong; the
|
||||
scheduler cannot manufacture or consume authority.
|
||||
|
||||
A 1,200-actor synthetic fixture may measure load after these pass. It cannot
|
||||
serve as an ontology or completeness gate. No live Delvehold acceptance run is
|
||||
|
|
|
|||
|
|
@ -247,4 +247,5 @@
|
|||
{"note": "Run 110 retried only Run 109's 14 failed cells and eliminated connector-frame failures, but 13 Interpreters exhausted agent steps by using target inspection as directory assistance. The corrected owner deterministically projects bounded exact canonical names from lived and Persona text before inference, removes the Interpreter query command, preserves full private permissions, and passes 505 library plus 20 strategic-smoke tests.", "status": "ok", "ts": "2026-09-01T01:52:59+00:00", "type": "verification"}
|
||||
{"note": "Read-only inspection of immutable Delvehold Run 108 through the focused CampaignStore explorer found a strong authored crisis theater but a failed whole-world complexity shape. The canonical state has 55 locations, 68 institutions, 164 facts, 3,141 Gestalts, 366 Actors, 371 member records, and 2,430 agency relations; exactly 2,400 active leaves are distributed across five realms plus the boundary scene. The eight titled elaborators produce excellent distinct lanes for texture, civic authority, economy, care, politics, secrets, urgent pressure, and numinous meaning. Repeated fission then substitutes taxonomy for novelty: 557 searchable records contain other-unknown, 780 contain residual, many active leaves inherit identical goals, and identity generation repeats public names across distinct people (including at least eight materialized Actors named Mara Venn and four named Nera Quill). Treat this as promising base material for one international crisis region, not yet a plausible entire world or training-ready autonomous narrative substrate. The next world-shape design must gate semantic distinctness, identity diversity, relation/pressure contribution, and horizontal geographic and cultural expansion rather than counting active leaves alone.", "status": "ok", "ts": "2026-09-01T03:06:42+00:00", "type": "research"}
|
||||
{"note": "Run 115 terminated at revision 2 with 2/8 regions and 0/1 waves after an SSE timeout and a dangling institution location exhausted the model reconciliation workbench. The qualification/verifier/reconciliation/context/timeout/routing patch sequence through 8964a92 did not establish structural ownership. Operator ordered a whole-machine rebuild: one WorldKernel, one typed ontology reducer, one CommandEnvelope/CultCache commit path; NarrativePersona retains Projector-Persona-Interpreter prose isolation, while OperationalAgent is an explicit disjoint controller for operator-shaped cognition. Actor counts and qualitative interest remain evaluation evidence, never admission or completeness authority.", "status": "accepted", "ts": "2026-09-01T12:11:39+00:00", "type": "architecture"}
|
||||
{"ts": "2026-09-01T12:37:47+00:00", "type": "architecture", "status": "ok", "note": "Mind maintenance falsified stale rebuild steering: the map still claimed subtraction had not begun and the handoff later revived Run 111 as an active continuation. Rebuilt the handoff and implementation plan around the adopted one-WorldState authority, landed cuts 64f50de/a144c33, total interpretation, current deletion line, and focused verification gate; chronology remains in Git, evidence, and the frozen teardown map."}
|
||||
{"note": "Mind maintenance falsified stale rebuild steering: the map still claimed subtraction had not begun and the handoff later revived Run 111 as an active continuation. Rebuilt the handoff and implementation plan around the adopted one-WorldState authority, landed cuts 64f50de/a144c33, total interpretation, current deletion line, and focused verification gate; chronology remains in Git, evidence, and the frozen teardown map.", "status": "ok", "ts": "2026-09-01T12:37:47+00:00", "type": "architecture"}
|
||||
{"ts": "2026-09-01T13:03:26+00:00", "type": "architecture", "status": "rejected", "note": "Rejected and deleted the uncommitted first world.rs foundation after focused tests passed. Review found the public module exposed mutable WorldState and ID issuance, translation-gap inference had become canonical world mutation, empty batches could advance revision, controller commands lacked consumed opportunity/readiness/affordance binding, external ownership was bypassed by world-author authority, command evidence did not bind fact evidence, and batch self-digests were unverifiable. Next cut is private-first: seal WorldKernel/aggregate/journal ownership before reintroducing a minimal reducer behind it."}
|
||||
|
|
|
|||
|
|
@ -249,3 +249,4 @@
|
|||
{"key": "2026-09-01T030642Z0000-0247-6db695a30bfa", "payload": "eyJub3RlIjogIlJlYWQtb25seSBpbnNwZWN0aW9uIG9mIGltbXV0YWJsZSBEZWx2ZWhvbGQgUnVuIDEwOCB0aHJvdWdoIHRoZSBmb2N1c2VkIENhbXBhaWduU3RvcmUgZXhwbG9yZXIgZm91bmQgYSBzdHJvbmcgYXV0aG9yZWQgY3Jpc2lzIHRoZWF0ZXIgYnV0IGEgZmFpbGVkIHdob2xlLXdvcmxkIGNvbXBsZXhpdHkgc2hhcGUuIFRoZSBjYW5vbmljYWwgc3RhdGUgaGFzIDU1IGxvY2F0aW9ucywgNjggaW5zdGl0dXRpb25zLCAxNjQgZmFjdHMsIDMsMTQxIEdlc3RhbHRzLCAzNjYgQWN0b3JzLCAzNzEgbWVtYmVyIHJlY29yZHMsIGFuZCAyLDQzMCBhZ2VuY3kgcmVsYXRpb25zOyBleGFjdGx5IDIsNDAwIGFjdGl2ZSBsZWF2ZXMgYXJlIGRpc3RyaWJ1dGVkIGFjcm9zcyBmaXZlIHJlYWxtcyBwbHVzIHRoZSBib3VuZGFyeSBzY2VuZS4gVGhlIGVpZ2h0IHRpdGxlZCBlbGFib3JhdG9ycyBwcm9kdWNlIGV4Y2VsbGVudCBkaXN0aW5jdCBsYW5lcyBmb3IgdGV4dHVyZSwgY2l2aWMgYXV0aG9yaXR5LCBlY29ub215LCBjYXJlLCBwb2xpdGljcywgc2VjcmV0cywgdXJnZW50IHByZXNzdXJlLCBhbmQgbnVtaW5vdXMgbWVhbmluZy4gUmVwZWF0ZWQgZmlzc2lvbiB0aGVuIHN1YnN0aXR1dGVzIHRheG9ub215IGZvciBub3ZlbHR5OiA1NTcgc2VhcmNoYWJsZSByZWNvcmRzIGNvbnRhaW4gb3RoZXItdW5rbm93biwgNzgwIGNvbnRhaW4gcmVzaWR1YWwsIG1hbnkgYWN0aXZlIGxlYXZlcyBpbmhlcml0IGlkZW50aWNhbCBnb2FscywgYW5kIGlkZW50aXR5IGdlbmVyYXRpb24gcmVwZWF0cyBwdWJsaWMgbmFtZXMgYWNyb3NzIGRpc3RpbmN0IHBlb3BsZSAoaW5jbHVkaW5nIGF0IGxlYXN0IGVpZ2h0IG1hdGVyaWFsaXplZCBBY3RvcnMgbmFtZWQgTWFyYSBWZW5uIGFuZCBmb3VyIG5hbWVkIE5lcmEgUXVpbGwpLiBUcmVhdCB0aGlzIGFzIHByb21pc2luZyBiYXNlIG1hdGVyaWFsIGZvciBvbmUgaW50ZXJuYXRpb25hbCBjcmlzaXMgcmVnaW9uLCBub3QgeWV0IGEgcGxhdXNpYmxlIGVudGlyZSB3b3JsZCBvciB0cmFpbmluZy1yZWFkeSBhdXRvbm9tb3VzIG5hcnJhdGl2ZSBzdWJzdHJhdGUuIFRoZSBuZXh0IHdvcmxkLXNoYXBlIGRlc2lnbiBtdXN0IGdhdGUgc2VtYW50aWMgZGlzdGluY3RuZXNzLCBpZGVudGl0eSBkaXZlcnNpdHksIHJlbGF0aW9uL3ByZXNzdXJlIGNvbnRyaWJ1dGlvbiwgYW5kIGhvcml6b250YWwgZ2VvZ3JhcGhpYyBhbmQgY3VsdHVyYWwgZXhwYW5zaW9uIHJhdGhlciB0aGFuIGNvdW50aW5nIGFjdGl2ZSBsZWF2ZXMgYWxvbmUuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA5LTAxVDAzOjA2OjQyKzAwOjAwIiwgInR5cGUiOiAicmVzZWFyY2gifQ==", "stored_at": "2026-09-01T03:06:42.158746+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
{"key": "2026-09-01T121139Z0000-0248-b250ea443e4e", "payload": "eyJub3RlIjogIlJ1biAxMTUgdGVybWluYXRlZCBhdCByZXZpc2lvbiAyIHdpdGggMi84IHJlZ2lvbnMgYW5kIDAvMSB3YXZlcyBhZnRlciBhbiBTU0UgdGltZW91dCBhbmQgYSBkYW5nbGluZyBpbnN0aXR1dGlvbiBsb2NhdGlvbiBleGhhdXN0ZWQgdGhlIG1vZGVsIHJlY29uY2lsaWF0aW9uIHdvcmtiZW5jaC4gVGhlIHF1YWxpZmljYXRpb24vdmVyaWZpZXIvcmVjb25jaWxpYXRpb24vY29udGV4dC90aW1lb3V0L3JvdXRpbmcgcGF0Y2ggc2VxdWVuY2UgdGhyb3VnaCA4OTY0YTkyIGRpZCBub3QgZXN0YWJsaXNoIHN0cnVjdHVyYWwgb3duZXJzaGlwLiBPcGVyYXRvciBvcmRlcmVkIGEgd2hvbGUtbWFjaGluZSByZWJ1aWxkOiBvbmUgV29ybGRLZXJuZWwsIG9uZSB0eXBlZCBvbnRvbG9neSByZWR1Y2VyLCBvbmUgQ29tbWFuZEVudmVsb3BlL0N1bHRDYWNoZSBjb21taXQgcGF0aDsgTmFycmF0aXZlUGVyc29uYSByZXRhaW5zIFByb2plY3Rvci1QZXJzb25hLUludGVycHJldGVyIHByb3NlIGlzb2xhdGlvbiwgd2hpbGUgT3BlcmF0aW9uYWxBZ2VudCBpcyBhbiBleHBsaWNpdCBkaXNqb2ludCBjb250cm9sbGVyIGZvciBvcGVyYXRvci1zaGFwZWQgY29nbml0aW9uLiBBY3RvciBjb3VudHMgYW5kIHF1YWxpdGF0aXZlIGludGVyZXN0IHJlbWFpbiBldmFsdWF0aW9uIGV2aWRlbmNlLCBuZXZlciBhZG1pc3Npb24gb3IgY29tcGxldGVuZXNzIGF1dGhvcml0eS4iLCAic3RhdHVzIjogImFjY2VwdGVkIiwgInRzIjogIjIwMjYtMDktMDFUMTI6MTE6MzkrMDA6MDAiLCAidHlwZSI6ICJhcmNoaXRlY3R1cmUifQ==", "stored_at": "2026-09-01T12:11:39.688226+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
{"key": "2026-09-01T123747Z0000-0249-37687ac034c6", "payload": "eyJub3RlIjogIk1pbmQgbWFpbnRlbmFuY2UgZmFsc2lmaWVkIHN0YWxlIHJlYnVpbGQgc3RlZXJpbmc6IHRoZSBtYXAgc3RpbGwgY2xhaW1lZCBzdWJ0cmFjdGlvbiBoYWQgbm90IGJlZ3VuIGFuZCB0aGUgaGFuZG9mZiBsYXRlciByZXZpdmVkIFJ1biAxMTEgYXMgYW4gYWN0aXZlIGNvbnRpbnVhdGlvbi4gUmVidWlsdCB0aGUgaGFuZG9mZiBhbmQgaW1wbGVtZW50YXRpb24gcGxhbiBhcm91bmQgdGhlIGFkb3B0ZWQgb25lLVdvcmxkU3RhdGUgYXV0aG9yaXR5LCBsYW5kZWQgY3V0cyA2NGY1MGRlL2ExNDRjMzMsIHRvdGFsIGludGVycHJldGF0aW9uLCBjdXJyZW50IGRlbGV0aW9uIGxpbmUsIGFuZCBmb2N1c2VkIHZlcmlmaWNhdGlvbiBnYXRlOyBjaHJvbm9sb2d5IHJlbWFpbnMgaW4gR2l0LCBldmlkZW5jZSwgYW5kIHRoZSBmcm96ZW4gdGVhcmRvd24gbWFwLiIsICJzdGF0dXMiOiAib2siLCAidHMiOiAiMjAyNi0wOS0wMVQxMjozNzo0NyswMDowMCIsICJ0eXBlIjogImFyY2hpdGVjdHVyZSJ9", "stored_at": "2026-09-01T12:37:47.089831+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
{"key": "2026-09-01T130326Z0000-0250-72c176f77744", "payload": "eyJub3RlIjogIlJlamVjdGVkIGFuZCBkZWxldGVkIHRoZSB1bmNvbW1pdHRlZCBmaXJzdCB3b3JsZC5ycyBmb3VuZGF0aW9uIGFmdGVyIGZvY3VzZWQgdGVzdHMgcGFzc2VkLiBSZXZpZXcgZm91bmQgdGhlIHB1YmxpYyBtb2R1bGUgZXhwb3NlZCBtdXRhYmxlIFdvcmxkU3RhdGUgYW5kIElEIGlzc3VhbmNlLCB0cmFuc2xhdGlvbi1nYXAgaW5mZXJlbmNlIGhhZCBiZWNvbWUgY2Fub25pY2FsIHdvcmxkIG11dGF0aW9uLCBlbXB0eSBiYXRjaGVzIGNvdWxkIGFkdmFuY2UgcmV2aXNpb24sIGNvbnRyb2xsZXIgY29tbWFuZHMgbGFja2VkIGNvbnN1bWVkIG9wcG9ydHVuaXR5L3JlYWRpbmVzcy9hZmZvcmRhbmNlIGJpbmRpbmcsIGV4dGVybmFsIG93bmVyc2hpcCB3YXMgYnlwYXNzZWQgYnkgd29ybGQtYXV0aG9yIGF1dGhvcml0eSwgY29tbWFuZCBldmlkZW5jZSBkaWQgbm90IGJpbmQgZmFjdCBldmlkZW5jZSwgYW5kIGJhdGNoIHNlbGYtZGlnZXN0cyB3ZXJlIHVudmVyaWZpYWJsZS4gTmV4dCBjdXQgaXMgcHJpdmF0ZS1maXJzdDogc2VhbCBXb3JsZEtlcm5lbC9hZ2dyZWdhdGUvam91cm5hbCBvd25lcnNoaXAgYmVmb3JlIHJlaW50cm9kdWNpbmcgYSBtaW5pbWFsIHJlZHVjZXIgYmVoaW5kIGl0LiIsICJzdGF0dXMiOiAicmVqZWN0ZWQiLCAidHMiOiAiMjAyNi0wOS0wMVQxMzowMzoyNiswMDowMCIsICJ0eXBlIjogImFyY2hpdGVjdHVyZSJ9", "stored_at": "2026-09-01T13:03:26.351584+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
|
|
|
|||
|
|
@ -51,6 +51,7 @@ mission:
|
|||
|
||||
hard_boundaries:
|
||||
- The pre-rebuild Ghostlight pipeline is teardown evidence, not an authority to preserve. Do not add a model stage, semantic verifier, reconciliation agent, retry loop, model-routing exception, timeout exception, context adapter, checkpoint, or compatibility path merely to keep it running. Structural ontology and referential integrity belong to the single deterministic reducer.
|
||||
- Seal world authority before widening ontology. Only WorldKernel may hold mutable aggregate state, issue canonical IDs, invoke the reducer, or write the journal. The public seam is create/open, immutable snapshot, CommandEnvelope submission, and typed receipt. Empty reductions do not commit; translation gaps remain non-fictional inference/evaluation evidence outside WorldState.
|
||||
- Every autonomous authority scope has exactly one decision controller. NarrativePersona preserves the Projector-Persona-Interpreter prose membrane; OperationalAgent may use a permissioned typed view and tools for operator-shaped cognition. Interpretation is total: representable material becomes typed proposals and unrepresented material becomes exact translation gaps. Neither mode changes authority, falls through to the other for a gap or infrastructure fault, or exercises the same opportunity twice.
|
||||
- Sparse causal sufficiency, not actor count, defines a valid world horizon. Counts, cover ratios, interestingness, political diversity, and prose quality are evaluation evidence and cannot admit ontology, reject a structurally valid mutation, or declare the world complete.
|
||||
- Prompt text is projection, not truth storage.
|
||||
|
|
@ -82,10 +83,11 @@ hard_boundaries:
|
|||
live_architecture:
|
||||
ghostlight_dungeon_rebuild:
|
||||
- The authoritative target map is `docs/architecture/ghostlight-dungeon-mvp.md`.
|
||||
- One per-world WorldKernel owns one revisioned WorldState across draft, active, and archived phases.
|
||||
- One sealed per-world WorldKernel owns one private revisioned WorldState, reducer, canonical ID allocator, and journal writer across draft, active, and archived phases. External code receives only create/open, immutable snapshot, submit, and typed receipt surfaces.
|
||||
- Every ingress submits one CommandEnvelope. The kernel derives authority from canonical state, lowers through one component mutation algebra, validates one complete candidate, and atomically persists WorldState plus WorldCommit through CultCache CAS.
|
||||
- Rejected and no-effect commands do not allocate canonical IDs, advance revision or digests, or append journal rows. Translation gaps, scheduler queues, and DecisionOpportunity values are derived evidence and cannot enter WorldState by recording themselves.
|
||||
- The typed ontology owns runtime-issued identities, subjects, decision controllers, components, places, routes, relations, custody, jurisdiction, knowledge, pressure, provenance, and external-owner grants. Aggregate Campaign and legacy component projection are not parallel truth.
|
||||
- NarrativePersona and OperationalAgent are centralized proposal interfaces with disjoint explicit authority scopes. They have no commit, verifier, repair, scheduler, or recovery authority.
|
||||
- NarrativePersona and OperationalAgent are centralized proposal interfaces with disjoint explicit authority scopes. Canonical controller assignments and affordance grants determine authority; current executable affordances and revision-bound opportunities are derived and kernel-revalidated. Controllers have no commit, verifier, repair, scheduler, or recovery authority.
|
||||
- Scheduler queues, covers, transcript, news, surfaces, model receipts, compaction, checkpoints, world-size counts, and qualitative judgments are derived only.
|
||||
- Expansion occurs at a typed causal boundary and uses the same mutation vocabulary as seed creation, action, import, individuation, and time. A sparse structurally closed horizon is valid.
|
||||
- Pre-rebuild stores and acceptance roots remain immutable evidence. They do not enter the new runtime through a live compatibility writer.
|
||||
|
|
@ -210,7 +212,7 @@ pre_rebuild_architecture:
|
|||
- Institution, faction, and consumer decision models
|
||||
|
||||
active_subgoals:
|
||||
- Rebuild Ghostlight from the adopted whole-machine authority map. Preserve exact source grounding, external consumer sovereignty, centralized NarrativePersona and OperationalAgent interfaces, scoped knowledge, one WorldKernel, and atomic typed persistence. Cut the split Session Zero/Campaign/component writers, model verifiers and reconcilers, model-owned scheduling, checkpoint recovery, and special elaboration commit paths before replacing behavior. Do not launch another scale run until negative tests prove the single reducer and sparse-world lifecycle.
|
||||
- Establish the sealed WorldKernel/aggregate/private-journal seam before rebuilding ontology: create/open, immutable snapshot, CommandEnvelope submit, and typed receipts are public; mutable WorldState, canonical ID issuance, reduction, and journal writes are private. Then add the minimal reducer for one Draft-to-Active, player-action, autonomous-action slice with kernel-owned affordance grants and revision-bound opportunities. Cut the split Session Zero/Campaign/component writers, model verifiers and reconcilers, model-owned scheduling, checkpoint recovery, and special elaboration commit paths before replacing behavior. Do not launch another scale run until visibility, no-op non-commit, atomic rejection, restart, privacy, controller-scope, affordance, and opportunity tests pass.
|
||||
- Connect a Delvehold-owned adapter to the admitted generic consumer contract: shared compiler/consumer WorldSeed admission, externally authoritative institution-or-Gestalt snapshots, attributed proposal acknowledgement, and committed-event newspaper composition over typed CultNet, without consumer-specific IDs or schemas in Ghostlight.
|
||||
- Extend strategic/offscreen named-person individuation beyond the proven emerge-then-act path so people plot across sustained political waves, acquire relationships, fold, and return without granting a cell, arena, or model commit authority.
|
||||
- Finish the semantic mutation migration: delete or demote remaining legacy model effect schemas and move aggregate campaign fields toward projection-only state. Seed publication and named-person presence now have explicit non-effect authority classifications.
|
||||
|
|
@ -341,10 +343,10 @@ data_flow:
|
|||
current_status:
|
||||
summary: Ghostlight is in whole-machine teardown. Run 115 is terminal failed at world revision 2 with two of eight regions admitted and no strategic wave. Provider timeouts and a dangling institution location survived the qualification, verifier, reconciliation, context, timeout, and model-routing patches through commit 8964a92, proving that the pipeline lacks a single structural owner. The adopted rebuild retains NarrativePersona for embodied roleplay and admits OperationalAgent for operator-shaped cognition, both under explicit disjoint controller scopes. One WorldKernel, one typed ontology reducer, one CommandEnvelope ingress, and one atomic CultCache commit path own the target architecture. No acceptance run is active.
|
||||
provider_acceptance_checkpoint: Exact pushed commit `139b8a6` completed Run 60 under `character-newsroom.v10` without world or per-wave replay. Its acceptance witness and terminal status bind the completed page and exact resume lineage. The independently dispatched blind reviewer, shown only the reader-facing fantasy newspaper, read it as a real left-populist civic broadsheet and did not immediately identify procedural generation, so the narrative reverse-Turing criterion passes. The review's substantive criticism is that the three stories feel like three rewrites of one briefing; accepted Run 60 remains immutable. The run used 96,902 prompt tokens and reported zero cache hits. Its delivered typeset artifact is `output/pdf/canopy-ledger-run-60-front-page.pdf`; frozen-source and visual verification remain accepted. Exact pushed `bc2ca39` then produced frozen-fact newsroom-only Run 61 Issues 13, 15, 16, 17, and 18 without world or wave model replay. Provider output proves `special_issue` convergence in Issues 13 and 15, independent `general_issue` beats in Issues 16 through 18, and assignment-selector cache hits. Blind review of Issues 13, 15, 16, and 17 passes both distinct recurring voices and issue-shape diversity, recognizing Ossan, Mera, Corin, and Lysa's biases plus modest cross-issue evolution. Run 62 exercised v12 without world or wave replay and failed only because two lead articles proposed invalid datelines; recurring reporter calls still recorded zero cache hits. Run 63 used exact pushed v13 `a52d57b`; Issues 17 and 18 completed before root stopped the final weekly recomposition, both repeated bylines again recorded zero cache hits, and live services remained unchanged. Preserve Runs 61 through 63 as stopped or completed immutable evidence. Copy defects remain later deadline-correction work rather than a reason to reopen accepted issue artifacts.
|
||||
implementation_checkpoint: The target authority map is adopted in `docs/architecture/ghostlight-dungeon-mvp.md`. Committed subtraction removed seven obsolete pipeline-smoke binaries and the two live-fire scripts at `64f50de`; explicit disjoint `NarrativePersona` and `OperationalAgent` interfaces plus total interpretation landed at `a144c33`. Legacy `WorldKernel`, `SessionZeroKernel`, aggregate Campaign/component state, alternate ingress, verifier and reconciliation stages, and persisted recovery remain in the Body. Replacement `WorldState` and `CommandEnvelope` work is mid-surgery and is not a landed authority until committed and verified. Continue cutting obsolete writers before wiring the replacement reducer.
|
||||
implementation_checkpoint: The target authority map is adopted in `docs/architecture/ghostlight-dungeon-mvp.md`. Committed subtraction removed seven obsolete pipeline-smoke binaries and the two live-fire scripts at `64f50de`; explicit disjoint `NarrativePersona` and `OperationalAgent` interfaces plus total interpretation landed at `a144c33`. An uncommitted broad public `world.rs` prototype was rejected and deleted because it exposed mutable state and ID issuance, made translation-gap evidence canonical, allowed no-op commits, and omitted exact affordance/opportunity authority. Legacy `WorldKernel`, `SessionZeroKernel`, aggregate Campaign/component state, alternate ingress, verifier and reconciliation stages, and persisted recovery remain in the Body. No replacement world authority is currently landed. The next cut establishes a sealed WorldKernel/aggregate/private-journal seam, then a minimal private reducer behind it.
|
||||
full_world_acceptance_checkpoint: Run 115 is terminal failed at `/var/lib/gamecult/ghostlight-dungeon/acceptance/full-world-delvehold-0a83034-115`, semantic revision 2, regions 2/8, waves 0/1. Resume2 ended on provider SSE timeout. Resume3 exhausted four reconciliation steps after `inst:kharad-road-keepers` referenced unknown `loc:kharad-rhythm-road`. Preserve the root, receipts, service invocation `d9254cd9b77946aebcf7a7fdae821402`, and failed patch sequence through 8964a92 as immutable evidence. Do not resume it.
|
||||
scale_checkpoint: Runs 108 through 115 prove load and failure properties of the pre-rebuild body, not world completeness. The 1,200 and 2,400 actor figures are synthetic evaluation profiles only. Production expansion is sparse and causal; structural admission cannot require interest, diversity, name uniqueness, or an actor count. No further scale run is admitted until the replacement single-owner lifecycle, reducer, decision-controller boundaries, recovery path, and negative invariants pass focused tests.
|
||||
presentation_checkpoint: The historical press-layout and seed-ownership split are complete. `notes/historical-newspaper-layout-grammar.md` remains the durable grammar. Manifest v2 at `output/tex/canopy-ledger-run-61-style-1847-flow-723.manifest.toml` independently binds `style_seed=1847`, `flow_seed=723`, frozen source SHA-256 `8f195140f52a40ba705d6a66987146a1500ae89668e5d82b01d1792eb3afb882`, and the final artifact `output/pdf/canopy-ledger-run-61-style-1847-flow-723.pdf`, SHA-256 `a457f4b1702a7a52480e42fce0039f0dbe677ff32958e98f1c412b346237190c`. An identical seed pair produces byte-identical TeX and PDF; changing only flow preserves the exact style section while materially changing a plausible layout, and changing only style preserves flow topology. Cut-first and cut-midstory templates pass visual inspection; the failed split-card template is deleted. Frozen copy/assets, actual PDF `/BM /Multiply`, and economic-layer advertising authority remain invariant.
|
||||
public_reference_checkpoint: Public architecture reference is complete. Canonical Ghostlight commit `15ea0f0` owns five pages under `docs/public-architecture` covering overview, authority, pipelines, 43 named production stages, and eight titled elaborators. Site commit `ea0b026` publishes exact projections under `F:\Projects\GhostlightDungeon-site\content\Documentation`, adds the sync/check script, explorer and table-of-contents navigation, scoped documentation layout, and homepage Architecture link. Local Quartz build and visual browser QA pass. GitHub Pages workflow `33408004480` succeeded. `https://ghostlight.gamecult.org/Documentation/` and the extensionless `Documentation/Agents-and-model-stages` route are live; the stage page exposes seven tables and 51 rows. Ghostlight remains technical authority; the site repository owns public composition and deployment.
|
||||
next_action: Cut obsolete authorities before building replacements. Remove the separate SessionZeroKernel and publication handoff, aggregate Campaign writer, legacy transition projection, alternate elaboration and mutation inputs, model verifier and reconciliation stages, model-owned scheduling, and checkpoint recovery. Then implement one WorldState lifecycle, private journal writer, CommandEnvelope ingress, internally derived authority, shared component reducer, centralized NarrativePersona and OperationalAgent controllers, derived scheduler and surfaces, and focused negative plus restart tests. Preserve Run 115 unchanged and do not launch another live acceptance run.
|
||||
next_action: Establish the sealed WorldKernel/aggregate/private-journal boundary first. Expose only create/open, immutable snapshot, CommandEnvelope submit, and typed receipts; keep mutable WorldState, canonical ID allocation, reducer entry, and CultCache writer private. Prove the visibility boundary, one writer, CAS/digest restart, atomic rejection, and no-op non-commit. Then add the smallest private reducer for Draft creation, approval, activation, one player action, and one autonomous action, with canonical controller assignments and affordance grants plus kernel-derived revision-bound opportunities. Continue cutting the separate SessionZeroKernel/publication handoff, Campaign writer, legacy transition projection, alternate ingresses, verifier/reconciliation stages, model-owned scheduling, and checkpoint recovery as the vertical slice replaces them. Preserve Run 115 unchanged and do not launch another live acceptance run.
|
||||
gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Materialisation/folding changes only representation and the exact member delta, advances resolution epoch, and retires the old cover; it has no Gestalt-wide effect authority. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.
|
||||
|
|
|
|||
Loading…
Reference in a new issue