Record native CultMesh player boundary

notes/fresh-workspace-handoff.md

@@ -37,15 +37,15 @@ d20 resolution, persistent locations and institutions, multiresolution Gestalt
 agency, offscreen strategic activity, knowledge-filtered news, and actor-filtered
 Eve/CultMesh surfaces.
 
-The immediate engineering gate is completion of the principled world-transition
-migration before adversarial hosted play resumes. Bounded region expansion uses
-the mutation reducer; seed publication is now a bounded creation transaction;
-named-person materialisation/folding is a resolution transaction without
-Gestalt-wide effect authority. The 36-case agency corpus is only a candidate
-seed against a 300-reviewed-case target. Separate-account multiplayer privacy
-and unanimity proof also remains required, but the previously expected D&D test
-group is no longer available; record that gate as unproven rather than silently
-lowering it.
+The immediate gate is direct adversarial play through Ghostlight's native
+CultMesh boundary. The native client performs a one-time Heimdall OAuth grant,
+persists only an opaque Ghostlight app-session bearer, fetches the same
+actor-filtered `ghostlight.play` surface, and submits the same canonical Eve
+invocations as the browser. The remaining first-run gate is human Discord
+approval; after redemption, server-side refresh preserves the grant between
+client launches. The 36-case agency corpus remains only a candidate seed
+against a 300-reviewed-case target. Separate-account multiplayer privacy and
+unanimity proof also remains unproven.
 
 ## Authority map
 
@@ -77,6 +77,10 @@ lowering it.
   state. Sensitive begin, completion, refresh, and logout operations cross its
   private CultNet command plane; the browser retains only an opaque attempt
   handle and Ghostlight retains only its own hashed app session.
+- The loopback `ghostlight.native.player` RUDP boundary is another client of
+  that same app-session and Eve-command authority. It cannot accept browser-
+  supplied actor, member, account, or campaign authority fields, and it does
+  not create a second gameplay API.
 - VoidBot owns Vault retrieval and evidence. Ghostlight stores exact evidence
   receipts, not a rival semantic index.
 - Idunn owns deployment and same-release daemon continuity. Odin owns discovery.
@@ -91,14 +95,17 @@ Yggdrasil is production. The Starfire writer and its old tunnel are stopped.
 Do not start both writers.
 
 - Executable release:
-  `7522ea8405212b344441f83f502993f525276521`
+  `801d4c537ea5713308064de91981a05a40c21993`
 - Executable SHA-256:
-  `1f0c1352aa6778df7f1a501af18ad5f66b34a5c77a34d36ab32ba8c95b14a791`
+  `1657d09131d6b9e94b08851a706f9563acbe59addf2063eba5df84b45257dbb4`
+- Native client SHA-256:
+  `628a0607c6027662353986d01f999525ec552d7229f98c07d984f55ee0c56e79`
 - Artifact SHA-256:
-  `sha256-4ed1fdb9612f159f3b1f5508bca12bbe42a3e233aa477ca2811010abd3434136`
+  `sha256-d09f0246a1b6e8e1be61cec1b0e3cb92f339d6bd59b167818571fa87c2db104e`
 - Eve release: `19c3dcf9173dce848a6253e975324ea239a02d24`
 - Service: `ghostlight-dungeon.service`, running as `ghostlight:ghostlight`
 - Listener: Yggdrasil loopback `127.0.0.1:8831`
+- Native player boundary: loopback RUDP `127.0.0.1:4102`
 - Public route: `https://yggdrasil.gamecult.org/ghostlight/`
 - Vault retrieval: local VoidBot at `127.0.0.1:17875/mcp`
 - Stored state at the last witness: nine campaigns and two Session Zero drafts
@@ -120,7 +127,7 @@ anonymous rejection agree. CultLib
 cross-runtime, dropped/reordered, fragmentation, and schema-discovery lanes.
 Odin `ba76a7239a7bb40aa1774df7d93b9388dc27b222` uses that exact CultLib body,
 serializes provider document persistence, and returns a typed persisted
-Ghostlight advertisement naming source `7522ea8405212b344441f83f502993f525276521`.
+Ghostlight advertisement whose source witness names `801d4c537ea5713308064de91981a05a40c21993`.
 Its persisted `ghostlight.schema_catalog.v1` contains exactly
 `ghostlight.campaign.v1` and `ghostlight.session_zero.v1`. The former
 large-snapshot RUDP discovery defect is closed; preserve the bounded-window,
@@ -158,14 +165,15 @@ messages.
 
 ## Current proof
 
-- Idunn admitted exact release `7522ea8…`; its locked Linux package test and
+- Idunn admitted exact release `801d4c5…`; its locked Linux package test and
   immutable build completed before atomic activation. Idunn's Linux journal
   reports 265 library tests before the remaining package targets in its
   truncated success receipt; the complete package test and release build
   succeeded. Typed health, manifest, embedded source, executable hash, provider
   readiness, nine campaigns, two Session Zero drafts, and zero daemon restarts
-  agree. Odin's raw typed snapshot independently agrees on the exact source
-  commit and two advertised boundary schemas.
+  agree. Odin's raw typed snapshot independently exposes the redacted native
+  boundary. A forged native app session was denied, and a before/after digest
+  over every campaign store remained identical.
 - Foreground, reaction, strategic, wait, travel, population-fission, and bounded
   region-expansion writes now use the typed mutation reducer. Each successful
   batch advances a touched subject version once and persists its authority,
@@ -253,18 +261,22 @@ Operational release and rollback truth remains in `gamecult-ops`.
 
 ## Next action
 
-1. Expand and review the agency corpus from its current 36 candidate cases
-   toward 300 behaviorally distinct cases; do not inflate it with reskins.
-2. Remove the remaining legacy model effect schemas and continue the negative
-   writer audit until aggregate campaign fields are projections only.
-3. Resume adversarial Eve play, then fork or compile a denser 20-plus-power
+1. Complete the one-time Heimdall OAuth grant for the native client, fetch the
+   actor-filtered surface over CultMesh, and resume adversarial play without the
+   browser.
+2. Repair the first compiler, world, action, or agency failure at its owning
+   state/projection seam; do not add output bans around missing context.
+3. Then fork or compile a denser 20-plus-power
    Aetheria skeleton and pressure budgets 1, 4, 8, and 32 with real provider
    output, including nested refugee dispersal and later rematerialization.
-4. Run a two-person Yggdrasil Session Zero and bounded shared-scene canary using
+4. Expand and review the agency corpus from its current 36 candidate cases
+   toward 300 behaviorally distinct cases, and remove remaining legacy model
+   effect schemas.
+5. Run a two-person Yggdrasil Session Zero and bounded shared-scene canary using
    separate Heimdall accounts.
-5. Then run the eight-account roster, privacy, actor-binding, pooled-budget,
+6. Then run the eight-account roster, privacy, actor-binding, pooled-budget,
    unanimous-approval, unanimous-time/travel, stale-command, and restart smoke.
-6. Continue human pressure on multiresolution Gestalt agency: meaningful
+7. Continue human pressure on multiresolution Gestalt agency: meaningful
    background surprises, exact attributed rival activity inside arenas,
    information boundaries, nested fission/folding, migration, and return
    encounters.

notes/ghostlight-current-system-map.md

@@ -643,6 +643,24 @@ membership, actor, account, boundary, or Session Zero state. Authenticated
 surface requests derive account, selected campaign, membership, and exact actor
 from Ghostlight-owned app-session and campaign records before projection.
 
+Native and browser clients share that logical surface and command authority.
+The native path is `ghostlight.native.player` over loopback RUDP
+`127.0.0.1:4102`; it exposes only Heimdall begin/completion, actor-filtered
+surface retrieval, and canonical Eve invocation. Heimdall persists the OAuth
+attempt and single-use completion. Ghostlight redeems the completion into the
+same app-session record used by HTTP, then derives every actor and campaign
+binding server-side. The installed native client stores only the opaque
+Ghostlight bearer in a mode-0600 CultCache file. It never receives a Heimdall
+access or refresh claim and cannot submit actor, member, account, or authority
+identifiers.
+
+Odin advertises the redacted native route and operation names in the provider
+document. It does not proxy native commands or persist session tokens, attempt
+handles, claims, account state, membership, or player surfaces. The boundary is
+loopback-only; remote native use requires a trusted host crossing and still
+passes Heimdall admission. A malformed or forged native request returns a typed
+denial before product projection and cannot enter either kernel mailbox.
+
 Command ingress accepts only `gamecult.eve.command_invocation.v1`. It validates
 provider, logical surface, command boundary, operation schema, source version,
 and idempotency before resolving the caller's authority server-side. Browser

notes/ghostlight-implementation-plan.md

@@ -53,6 +53,13 @@ callbacks, claims, entitlements, and completion redemption through its private
 loopback CultNet command plane. Ghostlight owns hashed local sessions and
 derives campaign authority only from canonical membership. The exact cut is
 `docs/architecture/ghostlight-eve-native-interface.md`.
+The same provider now admits an installed native CultMesh client on Yggdrasil
+loopback. It performs Heimdall begin/completion once, persists only the opaque
+Ghostlight app-session bearer in CultCache, retrieves the actor-filtered Eve
+surface, and invokes the canonical Eve command boundary. Browser and native
+transports have exact route bindings but no separate domain operations or
+kernel paths. Odin publishes only the redacted native endpoint and operation
+set; sensitive authentication and player state remain outside discovery.
 The accepted implementation is hosted natively on Yggdrasil as an immutable
 Idunn release. Exact checkout, embedded commit, release manifest, binary hash,
 systemd process, typed health, CultMesh store, local VoidBot retrieval, public
@@ -129,12 +136,13 @@ pressure. Removal of remaining legacy model effect schemas and the 300-case
 reviewed agency corpus remain the migration frontier. See
 `docs/architecture/ghostlight-transition-algebra.md`.
 
-Idunn's locked Linux test/build gate admitted this cut as immutable Yggdrasil
-release `7522ea8405212b344441f83f502993f525276521` with Eve
-`19c3dcf9173dce848a6253e975324ea239a02d24`, executable SHA-256
-`1f0c1352aa6778df7f1a501af18ad5f66b34a5c77a34d36ab32ba8c95b14a791`,
-and artifact SHA-256
-`sha256-4ed1fdb9612f159f3b1f5508bca12bbe42a3e233aa477ca2811010abd3434136`.
+Idunn's locked Linux test/build gate admitted the current cut as immutable
+Yggdrasil release `801d4c537ea5713308064de91981a05a40c21993` with Eve
+`19c3dcf9173dce848a6253e975324ea239a02d24`, daemon SHA-256
+`1657d09131d6b9e94b08851a706f9563acbe59addf2063eba5df84b45257dbb4`,
+native-client SHA-256
+`628a0607c6027662353986d01f999525ec552d7229f98c07d984f55ee0c56e79`,
+and artifact `sha256-d09f0246a1b6e8e1be61cec1b0e3cb92f339d6bd59b167818571fa87c2db104e`.
 The locked 265-test package gate, release build, web build, active symlink,
 zero-restart service state, and signed Idunn health agree. CultLib
 `75c180782aeba7cfd22d6412877397708a4ed28f` owns the five-runtime RUDP repair:

state/evidence.jsonl

@@ -126,7 +126,4 @@
 {"branch": "codex/ghostlight-dungeon-mvp", "note": "OpenRouter test profile accepted on Yggdrasil: immutable Ghostlight 4c04c13c144c1f6dce8af47698caafe34d6a6120, binary SHA-256 24b6857c7cec92e213e8638607f90d40a03af6f75f4a4995b25aac6cd23a51f5, passed the hosted 167-test package gate and serves seven campaigns plus one Session Zero draft. Typed health reports provider openrouter, fast/capable physical model stealth/ox-alpha, and a ready startup-inference output hash. The provider port applies low/high reasoning by logical stage class, asks OpenRouter to exclude reasoning, ignores reasoning fields on decode, and receipts the resolved physical provider/model. The key is a root-owned 0600 encrypted systemd credential; source, arguments, environment projections, Eve/CultMesh state, and logs contain no credential. Public /ghostlight/ and the canonical anonymous Eve provider return 200, Idunn receives authenticated health with zero restarts, and its deployment brake is re-engaged.", "status": "accepted", "ts": "2026-08-22T05:38:49Z", "type": "verification"}
 {"branch": "codex/ghostlight-dungeon-mvp", "note": "Adversarial Session Zero play exposed two authority defects and Yggdrasil now serves their exact repair at Ghostlight 257b6429c52c796167125bd81d923a605ac065df with Eve 23eaf32eae76204357c1406b4a7d01bcece6b815, OpenRouter stealth/ox-alpha ready, seven campaigns, one persistent Session Zero, zero daemon restarts, 171 hosted Linux tests, and the Idunn deployment brake re-engaged. A counterproposal can no longer rewrite visible prose while retaining the stale typed bargain: the kernel clears the old payload, durably records the counter in its permitted channel, removes Accept, rejects forged acceptance, and requires a same-epoch fresh decision before atomically retiring the pending counter. Generated opening and role suggestions are non-material and may be ignored for a custom draft; conversely a blank transcript-only contract or character is rejected locally with explicit missing inputs before world compilation. The live browser campaign remains intact, but its local Heimdall claim expired during the next private-message attempt; Discord reauthentication is pending and no claim or credential was bypassed.", "status": "accepted", "ts": "2026-08-22T11:22:30Z", "type": "verification"}
 {"note": "Yggdrasil release 41a1950f1dcb2215b07cee484151ca5f09a59a10 repaired Heimdall continuity: each scheduled refresh uses a fresh encrypted-command identity, refresh verification binds the signed access claim to the exact returned session without requiring the initial-login account summary, and the local wrapped claim rotates by CAS. The 171-test hosted gate passed; live due-session refresh emitted no failure across startup and the next scheduler pulse; the authenticated browser returned to Session Zero revision 18 after daemon replacement; binary SHA-256 b4544027e9ce19e17aae53b27abe146c96006e667c8f7d3d92b45c6545024050, NRestarts=0, brake engaged.", "status": "ok", "ts": "2026-08-22T16:37:44+00:00", "type": "verification"}
-{"branch":"codex/ghostlight-dungeon-mvp","note":"Yggdrasil release a10a0125fc87a1262c50c85a0f1bf52133989feb, Eve e5a81185bb790906bea5eeba40507673b0d9b5bb, executable SHA-256 87ae68139375f507c54456907c687c397f18d7591a6a93d814ba7f4bc0ef3513, and artifact SHA-256 sha256-c0d1ab58fe711ff98502d4fad495c7a4d90e2aa079f08ac43e7981e26056cf92 are active under Idunn with DeepSeek flash/pro ready, nine campaigns, two Session Zero drafts, and NRestarts=0. Campaign 34929b8d-7b04-49af-9936-1c798fd79760 committed return-catch-up revision 12 to 13 through eight stable cells: exact actor/institution cells, two Gestalt cells, and one three-institution arena with no collective actor. Five activities produced five bounded outcomes; Zhestokost's repeated posture became attributed inaction; player and Reed state remained byte-identical; channel-aware remote reports did not enter the player surface. The wave used 34 stage receipts, 35 provider attempts, 83,838 prompt tokens, 64,000 cache-hit tokens, 6,192 completion tokens, and 90,030 total tokens. Strategic commit now owns its derived CultMesh refresh, repairing the early-return path that left the operator projection at revision 12 after canonical revision 13. Retained witness: F:\\Projects\\gamecult-ops\\artifacts\\ghostlight-operator-rev13-20260823.json. Human separate-account co-op and a 20-plus-power live skeleton remain unproven.","status":"accepted","ts":"2026-08-23T08:24:00+00:00","type":"verification"}
-{"branch":"codex/ghostlight-dungeon-mvp","note":"Idunn's bounded Yggdrasil transaction admitted exact Ghostlight release 636828f509e2e3cc82280bc2edf02ba6fcbc4712 with Eve 19c3dcf9173dce848a6253e975324ea239a02d24 after the locked Linux package test and immutable release build succeeded; the receipt exposes 265 library tests before truncated remaining target output. Deployment manifest, embedded health commit, current symlink, executable SHA-256 f0647726fb6e54b8ab0851665edefb94667406466d472bd30d2a8ee4639afd7c, artifact SHA-256 sha256-e5dfeb43f95be622918a9897c854360ddbdfbdb25f33aa8829dd043679c59ed1, active MainPID 3964067, NRestarts=0, nine campaigns, two Session Zero drafts, DeepSeek readiness, provider advertisement, and actor-free anonymous Heimdall gate agree. Bounded region expansion now commits typed place and proposition admission plus exact reciprocal topology through WorldMutationBatch and reconstructs aggregate locations, routes, and facts only from accepted component state. Idunn receives fresh authenticated Ghostlight and Odin health. Odin's persisted Ghostlight provider advertisement remains stale at c7463c050620c69342c0cb84973beaefb09295cb because the previously named large-snapshot RUDP publication defect remains open; discovery is therefore degraded even though local CultMesh, HTTP, service continuity, and campaign authority are healthy.","status":"degraded","ts":"2026-08-23T13:49:37.7455675Z","type":"deployment"}
-{"branch":"codex/ghostlight-dungeon-mvp","note":"Idunn's bounded Yggdrasil transaction admitted exact Ghostlight release 2686f9f2973f6bfdb2c1a7fd7311f32e6a81c192 with Eve 19c3dcf9173dce848a6253e975324ea239a02d24 after its locked Linux package test and immutable release build succeeded; the receipt exposes 265 library tests before truncated remaining package-target output. Deployment manifest, embedded health commit, current symlink, executable SHA-256 f27d7865b9caaa762e1f71d3fe0484f126463f98d744dd3f5dea4ddaaf355731, artifact SHA-256 sha256-24e6d5a812c6c6c531428d329677e99b923c99a6e00a627b9bc8a826e1b8e791, active MainPID 3984476, NRestarts=0, nine campaigns, two Session Zero drafts, DeepSeek readiness, provider advertisement, and actor-free anonymous Heimdall gate agree. Initial seed publication is now classified as a fresh-store creation transaction. Named-person materialisation/folding advances world revision and resolution epoch, invalidates the old cover, preserves exact member deltas, and no longer possesses the deleted GestaltAggregateDelta path that could union individual knowledge, resources, or pressure into the population. Idunn receives fresh authenticated Ghostlight health. Odin's persisted Ghostlight provider advertisement still names c7463c050620c69342c0cb84973beaefb09295cb, so the known large-snapshot RUDP discovery defect remains an explicit degraded surface rather than being hidden by truncating operator truth.","status":"degraded","ts":"2026-08-23T14:04:02.0916328Z","type":"deployment"}
-{"branch":"codex/ghostlight-dungeon-mvp","note":"Fleet RUDP and live discovery repair accepted: CultLib 75c180782aeba7cfd22d6412877397708a4ed28f passed five-runtime local, cross-runtime, dropped/reordered, fragmentation, and schema-discovery CI run 32654257629. Idunn admitted Ghostlight 7522ea8405212b344441f83f502993f525276521 with Eve 19c3dcf9173dce848a6253e975324ea239a02d24, executable SHA-256 1f0c1352aa6778df7f1a501af18ad5f66b34a5c77a34d36ab32ba8c95b14a791, and artifact SHA-256 sha256-4ed1fdb9612f159f3b1f5508bca12bbe42a3e233aa477ca2811010abd3434136 after 265 locked Linux tests plus release and web builds; service and public route are healthy with NRestarts=0. Idunn admitted Odin ba76a7239a7bb40aa1774df7d93b9388dc27b222 with CultLib 75c180782aeba7cfd22d6412877397708a4ed28f and artifact SHA-256 sha256-06929d12aca7b2119d58772531a033a54172554f6c6fde3b5ac1eeb694439baf after 13 tests; its coordinator is healthy and 10.77.0.1:17871/udp is listening. Odin's typed RUDP snapshot independently returns Ghostlight source 7522ea8405212b344441f83f502993f525276521 and ghostlight.schema_catalog.v1 with exactly ghostlight.campaign.v1 and ghostlight.session_zero.v1. Reliable admission is bounded to 32, excess packets remain in session-owned FIFO pressure, cumulative ACKs retire the active horizon, exact ACKs recover older retransmits, and explicit flush waits for queued and in-flight acknowledgement. Odin awaits ordered durable provider writes. The former stale c7463 discovery defect is closed.","status":"accepted","ts":"2026-08-23T17:44:00+00:00","type":"verification"}
+{"ts": "2026-08-23T18:54:53+00:00", "type": "verification", "status": "ok", "note": "Yggdrasil release 801d4c exposes a loopback-only Heimdall-backed native CultMesh player boundary. Odin returned the redacted provider route; a forged app session produced the canonical denial receipt and left every campaign store byte-identical. One human Discord approval remains before actor-filtered direct play."}

state/ghostlight-state.cultcache.jsonl

@@ -127,3 +127,4 @@
 {"key": "2026-08-22T053849Z-0126-524bb9749916", "payload": "eyJicmFuY2giOiAiY29kZXgvZ2hvc3RsaWdodC1kdW5nZW9uLW12cCIsICJub3RlIjogIk9wZW5Sb3V0ZXIgdGVzdCBwcm9maWxlIGFjY2VwdGVkIG9uIFlnZ2RyYXNpbDogaW1tdXRhYmxlIEdob3N0bGlnaHQgNGMwNGMxM2MxNDRjMWY2ZGNlOGFmNDc2OThjYWFmZTM0ZDZhNjEyMCwgYmluYXJ5IFNIQS0yNTYgMjRiNjg1N2M3Y2VjOTJlMjEzZTg2Mzg2MDdmOTBkNDBhMDNhZjZmNzVmNGE0OTk1YjI1YWFjNmNkMjNhNTFmNSwgcGFzc2VkIHRoZSBob3N0ZWQgMTY3LXRlc3QgcGFja2FnZSBnYXRlIGFuZCBzZXJ2ZXMgc2V2ZW4gY2FtcGFpZ25zIHBsdXMgb25lIFNlc3Npb24gWmVybyBkcmFmdC4gVHlwZWQgaGVhbHRoIHJlcG9ydHMgcHJvdmlkZXIgb3BlbnJvdXRlciwgZmFzdC9jYXBhYmxlIHBoeXNpY2FsIG1vZGVsIHN0ZWFsdGgvb3gtYWxwaGEsIGFuZCBhIHJlYWR5IHN0YXJ0dXAtaW5mZXJlbmNlIG91dHB1dCBoYXNoLiBUaGUgcHJvdmlkZXIgcG9ydCBhcHBsaWVzIGxvdy9oaWdoIHJlYXNvbmluZyBieSBsb2dpY2FsIHN0YWdlIGNsYXNzLCBhc2tzIE9wZW5Sb3V0ZXIgdG8gZXhjbHVkZSByZWFzb25pbmcsIGlnbm9yZXMgcmVhc29uaW5nIGZpZWxkcyBvbiBkZWNvZGUsIGFuZCByZWNlaXB0cyB0aGUgcmVzb2x2ZWQgcGh5c2ljYWwgcHJvdmlkZXIvbW9kZWwuIFRoZSBrZXkgaXMgYSByb290LW93bmVkIDA2MDAgZW5jcnlwdGVkIHN5c3RlbWQgY3JlZGVudGlhbDsgc291cmNlLCBhcmd1bWVudHMsIGVudmlyb25tZW50IHByb2plY3Rpb25zLCBFdmUvQ3VsdE1lc2ggc3RhdGUsIGFuZCBsb2dzIGNvbnRhaW4gbm8gY3JlZGVudGlhbC4gUHVibGljIC9naG9zdGxpZ2h0LyBhbmQgdGhlIGNhbm9uaWNhbCBhbm9ueW1vdXMgRXZlIHByb3ZpZGVyIHJldHVybiAyMDAsIElkdW5uIHJlY2VpdmVzIGF1dGhlbnRpY2F0ZWQgaGVhbHRoIHdpdGggemVybyByZXN0YXJ0cywgYW5kIGl0cyBkZXBsb3ltZW50IGJyYWtlIGlzIHJlLWVuZ2FnZWQuIiwgInN0YXR1cyI6ICJhY2NlcHRlZCIsICJ0cyI6ICIyMDI2LTA4LTIyVDA1OjM4OjQ5WiIsICJ0eXBlIjogInZlcmlmaWNhdGlvbiJ9", "stored_at": "2026-08-22T16:38:46.247140+00:00", "type": "ghostlight.evidence_record.v0"}
 {"key": "2026-08-22T112230Z-0127-bcacdd5272c2", "payload": "eyJicmFuY2giOiAiY29kZXgvZ2hvc3RsaWdodC1kdW5nZW9uLW12cCIsICJub3RlIjogIkFkdmVyc2FyaWFsIFNlc3Npb24gWmVybyBwbGF5IGV4cG9zZWQgdHdvIGF1dGhvcml0eSBkZWZlY3RzIGFuZCBZZ2dkcmFzaWwgbm93IHNlcnZlcyB0aGVpciBleGFjdCByZXBhaXIgYXQgR2hvc3RsaWdodCAyNTdiNjQyOWM1MmM3OTYxNjcxMjViZDgxZDkyM2E2MDVhYzA2NWRmIHdpdGggRXZlIDIzZWFmMzJlYWU3NjIwNDM1N2MxNDA2YjRhN2QwMWJjZWNlNmI4MTUsIE9wZW5Sb3V0ZXIgc3RlYWx0aC9veC1hbHBoYSByZWFkeSwgc2V2ZW4gY2FtcGFpZ25zLCBvbmUgcGVyc2lzdGVudCBTZXNzaW9uIFplcm8sIHplcm8gZGFlbW9uIHJlc3RhcnRzLCAxNzEgaG9zdGVkIExpbnV4IHRlc3RzLCBhbmQgdGhlIElkdW5uIGRlcGxveW1lbnQgYnJha2UgcmUtZW5nYWdlZC4gQSBjb3VudGVycHJvcG9zYWwgY2FuIG5vIGxvbmdlciByZXdyaXRlIHZpc2libGUgcHJvc2Ugd2hpbGUgcmV0YWluaW5nIHRoZSBzdGFsZSB0eXBlZCBiYXJnYWluOiB0aGUga2VybmVsIGNsZWFycyB0aGUgb2xkIHBheWxvYWQsIGR1cmFibHkgcmVjb3JkcyB0aGUgY291bnRlciBpbiBpdHMgcGVybWl0dGVkIGNoYW5uZWwsIHJlbW92ZXMgQWNjZXB0LCByZWplY3RzIGZvcmdlZCBhY2NlcHRhbmNlLCBhbmQgcmVxdWlyZXMgYSBzYW1lLWVwb2NoIGZyZXNoIGRlY2lzaW9uIGJlZm9yZSBhdG9taWNhbGx5IHJldGlyaW5nIHRoZSBwZW5kaW5nIGNvdW50ZXIuIEdlbmVyYXRlZCBvcGVuaW5nIGFuZCByb2xlIHN1Z2dlc3Rpb25zIGFyZSBub24tbWF0ZXJpYWwgYW5kIG1heSBiZSBpZ25vcmVkIGZvciBhIGN1c3RvbSBkcmFmdDsgY29udmVyc2VseSBhIGJsYW5rIHRyYW5zY3JpcHQtb25seSBjb250cmFjdCBvciBjaGFyYWN0ZXIgaXMgcmVqZWN0ZWQgbG9jYWxseSB3aXRoIGV4cGxpY2l0IG1pc3NpbmcgaW5wdXRzIGJlZm9yZSB3b3JsZCBjb21waWxhdGlvbi4gVGhlIGxpdmUgYnJvd3NlciBjYW1wYWlnbiByZW1haW5zIGludGFjdCwgYnV0IGl0cyBsb2NhbCBIZWltZGFsbCBjbGFpbSBleHBpcmVkIGR1cmluZyB0aGUgbmV4dCBwcml2YXRlLW1lc3NhZ2UgYXR0ZW1wdDsgRGlzY29yZCByZWF1dGhlbnRpY2F0aW9uIGlzIHBlbmRpbmcgYW5kIG5vIGNsYWltIG9yIGNyZWRlbnRpYWwgd2FzIGJ5cGFzc2VkLiIsICJzdGF0dXMiOiAiYWNjZXB0ZWQiLCAidHMiOiAiMjAyNi0wOC0yMlQxMToyMjozMFoiLCAidHlwZSI6ICJ2ZXJpZmljYXRpb24ifQ==", "stored_at": "2026-08-22T16:38:46.261403+00:00", "type": "ghostlight.evidence_record.v0"}
 {"key": "2026-08-22T163744Z0000-0124-0fd9bbe87b49", "payload": "eyJub3RlIjogIllnZ2RyYXNpbCByZWxlYXNlIDQxYTE5NTBmMWRjYjIyMTViMDdjZWU0ODQxNTFjYTVmMDlhNTlhMTAgcmVwYWlyZWQgSGVpbWRhbGwgY29udGludWl0eTogZWFjaCBzY2hlZHVsZWQgcmVmcmVzaCB1c2VzIGEgZnJlc2ggZW5jcnlwdGVkLWNvbW1hbmQgaWRlbnRpdHksIHJlZnJlc2ggdmVyaWZpY2F0aW9uIGJpbmRzIHRoZSBzaWduZWQgYWNjZXNzIGNsYWltIHRvIHRoZSBleGFjdCByZXR1cm5lZCBzZXNzaW9uIHdpdGhvdXQgcmVxdWlyaW5nIHRoZSBpbml0aWFsLWxvZ2luIGFjY291bnQgc3VtbWFyeSwgYW5kIHRoZSBsb2NhbCB3cmFwcGVkIGNsYWltIHJvdGF0ZXMgYnkgQ0FTLiBUaGUgMTcxLXRlc3QgaG9zdGVkIGdhdGUgcGFzc2VkOyBsaXZlIGR1ZS1zZXNzaW9uIHJlZnJlc2ggZW1pdHRlZCBubyBmYWlsdXJlIGFjcm9zcyBzdGFydHVwIGFuZCB0aGUgbmV4dCBzY2hlZHVsZXIgcHVsc2U7IHRoZSBhdXRoZW50aWNhdGVkIGJyb3dzZXIgcmV0dXJuZWQgdG8gU2Vzc2lvbiBaZXJvIHJldmlzaW9uIDE4IGFmdGVyIGRhZW1vbiByZXBsYWNlbWVudDsgYmluYXJ5IFNIQS0yNTYgYjQ1NDQwMjdlOWNlMTllMTdhYWU1M2IyN2FiZTE0NmM5NjAwNmU2NjdjOGY3ZDNkOTJiNDVjNjU0NTAyNDA1MCwgTlJlc3RhcnRzPTAsIGJyYWtlIGVuZ2FnZWQuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA4LTIyVDE2OjM3OjQ0KzAwOjAwIiwgInR5cGUiOiAidmVyaWZpY2F0aW9uIn0=", "stored_at": "2026-08-22T16:37:44.247751+00:00", "type": "ghostlight.evidence_record.v0"}
+{"key": "2026-08-23T185453Z0000-0128-add35cb85f1d", "payload": "eyJub3RlIjogIllnZ2RyYXNpbCByZWxlYXNlIDgwMWQ0YyBleHBvc2VzIGEgbG9vcGJhY2stb25seSBIZWltZGFsbC1iYWNrZWQgbmF0aXZlIEN1bHRNZXNoIHBsYXllciBib3VuZGFyeS4gT2RpbiByZXR1cm5lZCB0aGUgcmVkYWN0ZWQgcHJvdmlkZXIgcm91dGU7IGEgZm9yZ2VkIGFwcCBzZXNzaW9uIHByb2R1Y2VkIHRoZSBjYW5vbmljYWwgZGVuaWFsIHJlY2VpcHQgYW5kIGxlZnQgZXZlcnkgY2FtcGFpZ24gc3RvcmUgYnl0ZS1pZGVudGljYWwuIE9uZSBodW1hbiBEaXNjb3JkIGFwcHJvdmFsIHJlbWFpbnMgYmVmb3JlIGFjdG9yLWZpbHRlcmVkIGRpcmVjdCBwbGF5LiIsICJzdGF0dXMiOiAib2siLCAidHMiOiAiMjAyNi0wOC0yM1QxODo1NDo1MyswMDowMCIsICJ0eXBlIjogInZlcmlmaWNhdGlvbiJ9", "stored_at": "2026-08-23T18:54:53.555209+00:00", "type": "ghostlight.evidence_record.v0"}

state/map.yaml

@@ -117,6 +117,8 @@ live_architecture:
     - Eve editable bindings are the input model. Operations capture named bindings into `gamecult.eve.command_invocation.v1`; rejected or stale receipts preserve drafts, and accepted receipts may clear exact binding names. HTML forms are lowering detail, not Eve state or payload semantics.
     - Heimdall owns OAuth attempts, Discord callbacks, entitlement evaluation, claims, single-use completion, refresh, and logout. Its required Eve access plugin crosses a private loopback CultNet operation boundary; Ghostlight validates the exact claim and owns only its hashed app session before deriving actor authority from campaign membership.
     - Heimdall access grants and Ghostlight app sessions survive daemon replacement. Each scheduled refresh uses a fresh private-command identity, verifies the signed access claim against the exact returned session without requiring an initial-login account summary, rotates the locally wrapped refresh claim by CAS, and issues a persistent HttpOnly cookie bounded by refresh expiry.
+    - Native players use `ghostlight.native.player` on loopback RUDP `127.0.0.1:4102`. Heimdall owns the one-time OAuth attempt and completion; Ghostlight redeems it into the same app-session authority used by the browser. The native client persists only its opaque Ghostlight bearer in a mode-0600 CultCache store and submits the same canonical Eve invocations to the same kernel mailboxes.
+    - Odin advertises the redacted native boundary and its four operations but receives no bearer, attempt handle, claim, account, member, actor, or campaign state. A forged native session is denied before surface projection or command admission.
     - Public Ghostlight HTTP exposes only the Eve provider, logical surface, command, and invalidation endpoints plus the typed health probe and static assets. Exact private per-member and operator surfaces remain CultMesh documents; Hermodr is an optional generic materializer, not a runtime dependency.
     - Yggdrasil release admission resolves the newest executable- or build-affecting commit from the admitted ref. Later documentation, notes, state receipts, and root Markdown do not become runtime authority or cause a redeploy; Idunn proves the selected commit is an ancestor of the admitted ref and verifies the exact witness after activation.
     - Idunn owns Ghostlight deployment and same-release continuity, Odin owns discovery, Heimdall owns account identity, and VoidBot owns Vault retrieval. None can write campaign state. Epiphany is an adjacent consumer and future swarm-capacity provider, not a Ghostlight runtime dependency or authority.
@@ -304,6 +306,6 @@ data_flow:
   - If state grows faster than understanding, cut it back.
 
 current_status:
-  summary: Yggdrasil serves immutable Ghostlight release 7522ea8405212b344441f83f502993f525276521 with Eve 19c3dcf9173dce848a6253e975324ea239a02d24, executable SHA-256 1f0c1352aa6778df7f1a501af18ad5f66b34a5c77a34d36ab32ba8c95b14a791, and artifact SHA-256 sha256-4ed1fdb9612f159f3b1f5508bca12bbe42a3e233aa477ca2811010abd3434136. Idunn's locked 265-test Linux package gate, release build, web build, active service, and NRestarts=0 agree; typed health reports nine campaigns, two Session Zero drafts, and DeepSeek flash/pro ready. CultLib 75c180782aeba7cfd22d6412877397708a4ed28f owns the five-runtime bounded-window, hybrid-ACK, explicit-flush RUDP repair, proved by CI run 32654257629. Odin ba76a7239a7bb40aa1774df7d93b9388dc27b222 uses the same CultLib commit, awaits ordered durable provider writes, and returns a typed RUDP snapshot containing exact Ghostlight source 7522ea8405212b344441f83f502993f525276521 plus exactly ghostlight.campaign.v1 and ghostlight.session_zero.v1. The former stale-discovery defect is closed. Foreground, reaction, strategic, wait, travel, population-fission, and bounded region-expansion outcomes use one semantic mutation reducer with exact authority and proof receipts. Initial campaign publication is a bounded fresh-store creation transaction, not a runtime effect. Named-person materialisation/folding preserves the individual delta, advances world revision and resolution epoch, clears the old cover, and cannot rewrite Gestalt-wide knowledge, resources, pressure, or fictional time; the old GestaltAggregateDelta writer is gone. Region expansion admits typed places and propositions, validates evidence and containment, and requires reciprocal topology before rebuilding aggregate rows. Fission transfers each scarce resource and named member exactly once while preserving non-scarce lineage baselines and individual deltas. Hosted campaign 34929b8d-7b04-49af-9936-1c798fd79760 retains its eight-cell return-catch-up witness with five bounded material outcomes, exact actor/member attribution, player/Reed byte continuity, no arena collective actor, no knowledge-channel overlap, and no player-visible remote news. Starfire remains retired as a writer. Idunn owns deployment and continuity, Odin owns discovery, Heimdall owns identity, and none owns campaign mutation. Epiphany is adjacent capacity rather than a dependency.
-  next_action: Expand the 36 candidate agency cases toward 300 behaviorally distinct reviewed cases before claiming algebraic completeness, remove remaining legacy model effect schemas, and continue the negative writer audit. Resume adversarial Eve play and the denser 20-plus-power Aetheria budget pressure. Separately close the unproven two-account and eight-account privacy, actor-binding, unanimity, and restart gates. Preserve the revision-12 Mira movement scar as history; do not repair it out of band or weaken actor, privacy, approval, atomicity, or no-puppeting invariants.
+  summary: Yggdrasil serves immutable Ghostlight release 801d4c537ea5713308064de91981a05a40c21993 with Eve 19c3dcf9173dce848a6253e975324ea239a02d24, daemon SHA-256 1657d09131d6b9e94b08851a706f9563acbe59addf2063eba5df84b45257dbb4, native-client SHA-256 628a0607c6027662353986d01f999525ec552d7229f98c07d984f55ee0c56e79, and artifact sha256-d09f0246a1b6e8e1be61cec1b0e3cb92f339d6bd59b167818571fa87c2db104e. Idunn's locked Linux tests, release and web builds, active symlink, signed health, zero-restart daemon, DeepSeek readiness, HTTP listener, and loopback-only native RUDP listener agree. Odin returns the provider advertisement with the redacted `ghostlight.native.player` boundary; its smoke must dial Odin at 10.77.0.1:17871 because 127.0.0.1:17871 is Idunn. A forged native session returned the canonical denial receipt while every campaign-store digest remained unchanged. Heimdall begin and completion use existing persisted OAuth authority; after one Discord approval, the native client keeps only the resulting Ghostlight app-session bearer in a private CultCache store and server-side refresh preserves the grant between launches. The first native authorization is currently unredeemed. Existing mutation, Gestalt, topology, knowledge, privacy, no-puppeting, and atomicity invariants remain authoritative. Starfire remains retired as a writer.
+  next_action: Complete one Heimdall OAuth grant for the native client, fetch the actor-filtered `ghostlight.play` surface directly over CultMesh, and resume adversarial homepage-promise play through canonical Eve invocations without the browser. Repair the first world/compiler/agency invariant failure at its owning kernel or projection seam. Then pressure the 20-plus-power Aetheria skeleton and nested refugee continuity across budgets 1, 4, 8, and 32. Separately grow the 36-case agency corpus toward 300 reviewed cases and close multi-account co-op proof. Preserve the revision-12 Mira movement scar as history; do not weaken actor, privacy, approval, atomicity, or no-puppeting invariants.
   gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Materialisation/folding changes only representation and the exact member delta, advances resolution epoch, and retires the old cover; it has no Gestalt-wide effect authority. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.