Document DELVE/HOLD forced ontology boundary

docs/architecture/delvehold-forced-ontology-integration.md

@@ -0,0 +1,57 @@
+# DELVE/HOLD Forced-Ontology Integration
+
+## Status
+
+This document is the admitted consumer contract for the DELVE/HOLD persistent-world experiment. It specifies ownership and document flow. Runtime schemas and adapter code are not implemented by this documentation pass.
+
+## Objective
+
+Use Ghostlight's live external-world simulation without making it the owner of DELVE/HOLD players, workshops, dungeons, civic state, or quantitative economy. DELVE/HOLD provides an authored ontology and fixed seed for one canonical outside world. This bypasses Session Zero world generation, not `WorldKernel`, typed validation, the mutation algebra, or atomic CultCache commits.
+
+## Authority map
+
+- **Delvehold owner:** Greathold players, workshops, parties, civic seals, graph, dungeon ecology, quantitative resources, custody, recipes, facilities, capacity, inventories, orders, prices, contracts, expeditions, and local consequences.
+- **Ghostlight owner:** external regions, actors, institutions, Gestalts, their knowledge, relationships, goals, posture, pressures, strategic choices, external events, and news.
+- **Derived boundary target:** one Ghostlight institution with stable ID `greathold`, rebuilt from accepted Delvehold boundary documents once the external-control seam is implemented.
+- **Transport:** CultMesh carries state, effects, intents, and receipts. It owns no decision.
+- **Forbidden writers:** Ghostlight Personas and strategic cells cannot mutate `greathold`; Delvehold cannot mutate foreign private state; the adapter cannot repair either owner after rejection.
+
+Ghostlight's current string resource handles are sufficient for strategic narrative context. They are not a quantitative economy. Prices, quantities, production, capacity, orders, contracts, and conservation remain Delvehold-owned unless a future deliberate Ghostlight economic algebra is designed and admitted.
+
+## Greathold boundary subject
+
+`greathold` is externally controlled. It is not a person, sovereign government, averaged population will, or alternate player-state store.
+
+- It receives no Persona turn or autonomous institution effect.
+- Only an accepted `delvehold.greathold_boundary_state.v0` or `delvehold.greathold_effect_batch.v0` command may update its projected condition after the external-control policy exists.
+- External subjects may observe it, relate to it, and direct attributed actions toward it.
+- Any proposed change to Greathold-owned truth exits as `ghostlight.external_response_batch.v0` and remains pending until Delvehold returns `delvehold.boundary_receipt.v0`.
+
+The projection excludes player identities, private workshop state, pending votes, unaccepted contracts, private communications, and inferred collective desire. It reports committed macro effects and authorized institutional acts.
+
+## Adapter flow
+
+```text
+Delvehold commit
+  -> boundary projection or realized-effect batch
+  -> Ghostlight typed command
+  -> WorldKernel validation and atomic commit
+  -> strategic resolution over external subjects
+  -> external response batch
+  -> Delvehold validation and atomic commit
+  -> admission receipt
+```
+
+Each document carries world ID, UTC epoch ID, source revision, effective time, causal refs, provenance, payload digest, and idempotency key. `delvehold.boundary_receipt.v0` is direction-neutral: the receiving domain returns it to the sender with sender and recipient IDs, per-item results, reason codes, resulting local revision, and committed event refs. Revisions remain local. The source may retry; the recipient must return the same receipt for the same key and digest.
+
+Malformed envelopes, stale revisions, digest conflicts, and invalid causal structure reject the whole document without mutation. After envelope validation, semantically independent items may resolve to an explicit accepted subset, but that subset commits atomically or not at all. The receipt records every item result.
+
+`greathold_boundary_state.v0` is an absolute replacement of its declared projection fields at a Delvehold source-revision watermark. `greathold_effect_batch.v0` carries deltas over explicit preceding and resulting revisions. A snapshot supersedes deltas at or below its watermark; delayed deltas below either accepted watermark are stale. Greathold ingress access and capacity are Delvehold-owned. External route topology and status remain Ghostlight-owned even when Delvehold mirrors their IDs in local admitted state.
+
+Major committed events cross promptly. Ordinary material flow closes hourly. Recovery replays at most eight missed epochs and represents older time as one explicitly coarse horizon. A summarized horizon may reduce detail; it cannot invent player action or hide an unprocessed interval.
+
+## Required Ghostlight implementation seam
+
+The eventual adapter needs an authored-seed publication path and an external-control admission policy for one institution. Both must delegate to existing WorldKernel command validation and atomic persistence. No second kernel, economy store, Session Zero compatibility fiction, or direct campaign-row writer is admitted.
+
+Acceptance requires negative proof that ordinary strategic waves cannot select `greathold` as an acting subject, malformed or stale batches commit nothing, and foreign effects become local consequences only after a Delvehold receipt.

notes/ghostlight-current-system-map.md

@@ -96,6 +96,31 @@ Vault evidence receipts + typed campaign snapshot
 Ghostlight owns the generalized projection organ. Epiphany and other consumers
 own their canonical Persona state and consequence commits.
 
+## DELVE/HOLD admitted target contract
+
+DELVE/HOLD is admitted as a consumer of the live Ghostlight runtime for one
+canonical world outside the Greathold. Its target contract supplies an authored
+ontology and fixed seed rather than invoking Session Zero world generation.
+That bypass ends at generation: publication and every later transition must
+still enter `WorldKernel` through typed validation and atomic CultCache commit.
+
+Delvehold owns players, workshops, dungeons, civic state, contracts, and its
+quantitative economy. Ghostlight owns external actors, institutions, Gestalts,
+relationships, knowledge, pressures, and strategic decisions. The admitted
+target is one externally controlled `greathold` institution projecting only
+committed macro effects into Ghostlight and receiving no Persona or strategic
+turn. The current runtime does not yet implement that external-control policy
+or authored-seed admission seam; ordinary institution selection must not be
+mistaken for enforcement. External consequences will return as intents for
+Delvehold admission, not direct mutations.
+
+The current `InstitutionState` and strategic resource vocabulary use named
+resource handles. They do not model quantities, prices, recipes, facilities,
+capacity, inventories, orders, contracts, or conservation. Those remain
+consumer-owned unless Ghostlight later admits a deliberate economic component
+and mutation algebra. The complete contract is
+`docs/architecture/delvehold-forced-ontology-integration.md`.
+
 The current checkout admits one to eight campaign members into one shared
 scene. `campaign_membership.v1` maps each authenticated account to one exact
 actor; HTTP, Eve, assessment confirmation, and CultMesh publication derive from

state/evidence.jsonl

@@ -134,3 +134,4 @@
 {"note": "Fresh native Session Zero e7f2f947-25fa-4e1b-82e3-4a3e07dc4497 reached revision 36 with its exact Mars/Zhestokost contract and private Corvid character intact. Idunn deployed Ghostlight 44eec9d654ffbcea253b69ebfd2a0421d7614b66 after 306 tests. With Nightwing/VoidBot retrieval unavailable, compilation produced one stable typed material blocker, no preview, world digest, branch assumption, or campaign; the player message did not expose backend details.", "status": "ok", "ts": "2026-08-25T00:26:15+00:00", "type": "acceptance"}
 {"ts": "2026-08-25T03:34:25+00:00", "type": "live_acceptance", "status": "ok", "note": "Idunn deployed exact Ghostlight bd4758894c1f81df13a048fa82ca4511fe6d4245 after 312 locked Linux tests; daemon and native-client hashes are 0fb4e27c56a1d331d77335ce959ed5937040636da081e4c016602bc073a8c3de and 13ddda694161be9a81b914421b54a3405027f6c389f34080dee95f1acbf1b07d. Nightwing/VoidBot retrieval was live. Session Zero e7f2f947-25fa-4e1b-82e3-4a3e07dc4497 reached revision 55 and retained approval preview sha256:01f07d0f5bc453151743dab77821d64a28d0505e82bd905aa335d45525e51d83: four strongly connected locations, no First Exodus/Blackbox/Kesh/Maela borrowing, nine unique active receipts, valid world and agency stages, and an unsupported Pan-Solar doctrine isolated as an evidence gap. No campaign was approved or published.", "branch": "codex/ghostlight-dungeon-mvp"}
 {"ts":"2026-08-25T10:37:43+00:00","type":"live_acceptance","status":"ok","note":"Idunn deployed exact Ghostlight e89db8bcadcd6e32af8b0349a99f45777c031536 after 313 locked Linux tests; daemon and native-client hashes are eb79caa884ac324a5ac784fd872f785debe6c44cacea361539f0d8307a2bc29f and 8be63daa65683e01561963d18a3303b998913b1c4b98b53fea31c9b4c663288b. Session Zero e7f2f947-25fa-4e1b-82e3-4a3e07dc4497 discarded the superseded entailment-era preview through SessionZeroKernel and reached revision 60 with replacement digest sha256:6c79562d9a1399a3c9f63940c1c1968caa3a0d3644fe453aac6ab18babceb41c. The preview has four locations with explicit complete directed routes, three fresh actors, one Gestalt, three clocks, twelve institutions including Pan-Solar Consortium, nine approval-visible synthesized remote doctrines, branch-local geometry, and no First Exodus/Blackbox/Kesh/Maela borrowing. The first world_compile attempt timed out safely at 120 seconds with 26,796 input characters; the same-snapshot retry succeeded. No player approved the digest and no campaign was published.","branch":"codex/ghostlight-dungeon-mvp"}
+{"note": "DELVE/HOLD boundary: live Ghostlight WorldKernel, multiresolution agency, typed transitions, persistence, and receipts are reusable, but current InstitutionState and strategic resource handles do not implement HOLD quantities, prices, recipes, capacity, inventories, orders, contracts, or conservation. Delvehold therefore retains quantitative economy authority; a forced ontology may bypass world generation but never WorldKernel validation. Owner witnesses: crates/ghostlight-dungeon/src/domain.rs and F:\\Projects\\Delvehold\\Delvehold\\Game Design\\Shared World\\World State Model.md.", "status": "ok", "ts": "2026-08-26T00:50:11+00:00", "type": "architecture"}

state/ghostlight-state.cultcache.jsonl

@@ -134,3 +134,4 @@
 {"key": "2026-08-25T002615Z0000-0132-60dc23f05c30", "payload": "eyJub3RlIjogIkNvZGV4Q29ubmVjdG9yIGlzIGluZGVwZW5kZW50bHkgZGVwbG95ZWQgb24gWWdnZHJhc2lsIGFzIGNvZGV4LWNvbm5lY3Rvci5zZXJ2aWNlIGF0IGY5Y2ZhMzU1MDUxZWY5MWQwZTdmMDk1YjJkZjJhNjlmZTc5ZjhhN2MuIEdob3N0bGlnaHQgaGFzIG9ubHkgYSBzb2Z0IG9yZGVyaW5nIGVkZ2UgYW5kIGNhbm5vdCBtdXRhdGUgaXRzIHJlbGVhc2U7IEVwaXBoYW55IGlzIGFub3RoZXIgY29uc3VtZXIsIG5vdCBhbiBvd25lci4gRHVyaW5nIEdob3N0bGlnaHQgZGVwbG95bWVudCB0aGUgY29ubmVjdG9yIHJlbWFpbmVkIGFjdGl2ZSwgYXV0aGVudGljYXRlZCwgemVyby1yZXN0YXJ0LCBhbmQgdW5jaGFuZ2VkLiIsICJzdGF0dXMiOiAib2siLCAidHMiOiAiMjAyNi0wOC0yNVQwMDoyNjoxNSswMDowMCIsICJ0eXBlIjogImltcGxlbWVudGF0aW9uIn0=", "stored_at": "2026-08-25T00:26:15.022248+00:00", "type": "ghostlight.evidence_record.v0"}
 {"key": "2026-08-25T002615Z0000-0133-658086958803", "payload": "eyJub3RlIjogIkZyZXNoIG5hdGl2ZSBTZXNzaW9uIFplcm8gZTdmMmY5NDctMjVmYS00ZTFiLTgyZTMtNGEzZTA3ZGM0NDk3IHJlYWNoZWQgcmV2aXNpb24gMzYgd2l0aCBpdHMgZXhhY3QgTWFycy9aaGVzdG9rb3N0IGNvbnRyYWN0IGFuZCBwcml2YXRlIENvcnZpZCBjaGFyYWN0ZXIgaW50YWN0LiBJZHVubiBkZXBsb3llZCBHaG9zdGxpZ2h0IDQ0ZWVjOWQ2NTRmZmJjZWEyNTNiNjllYmZkMmEwNDIxZDc2MTRiNjYgYWZ0ZXIgMzA2IHRlc3RzLiBXaXRoIE5pZ2h0d2luZy9Wb2lkQm90IHJldHJpZXZhbCB1bmF2YWlsYWJsZSwgY29tcGlsYXRpb24gcHJvZHVjZWQgb25lIHN0YWJsZSB0eXBlZCBtYXRlcmlhbCBibG9ja2VyLCBubyBwcmV2aWV3LCB3b3JsZCBkaWdlc3QsIGJyYW5jaCBhc3N1bXB0aW9uLCBvciBjYW1wYWlnbjsgdGhlIHBsYXllciBtZXNzYWdlIGRpZCBub3QgZXhwb3NlIGJhY2tlbmQgZGV0YWlscy4iLCAic3RhdHVzIjogIm9rIiwgInRzIjogIjIwMjYtMDgtMjVUMDA6MjY6MTUrMDA6MDAiLCAidHlwZSI6ICJhY2NlcHRhbmNlIn0=", "stored_at": "2026-08-25T00:26:15.195101+00:00", "type": "ghostlight.evidence_record.v0"}
 {"key": "2026-08-25T033425Z0000-0134-c4fa7b69f63a", "payload": "eyJicmFuY2giOiAiY29kZXgvZ2hvc3RsaWdodC1kdW5nZW9uLW12cCIsICJub3RlIjogIklkdW5uIGRlcGxveWVkIGV4YWN0IEdob3N0bGlnaHQgYmQ0NzU4ODk0YzFmODFkZjEzYTA0OGZhODJjYTQ1MTFmZTZkNDI0NSBhZnRlciAzMTIgbG9ja2VkIExpbnV4IHRlc3RzOyBkYWVtb24gYW5kIG5hdGl2ZS1jbGllbnQgaGFzaGVzIGFyZSAwZmI0ZTI3YzU2YTFkMzMxZDc3MzM1Y2U5NTllZDU5MzcwNDA2MzZkYTA4MWU0YzAxNjYwMmJjMDczYThjM2RlIGFuZCAxM2RkZGE2OTQxNjFiZTlhODFiOTE0NDIxYjU0YTM0MDUwMjdmNmMzODlmMzQwODBkZWU5NWYxYWNiZjFiMDdkLiBOaWdodHdpbmcvVm9pZEJvdCByZXRyaWV2YWwgd2FzIGxpdmUuIFNlc3Npb24gWmVybyBlN2YyZjk0Ny0yNWZhLTRlMWItODJlMy00YTNlMDdkYzQ0OTcgcmVhY2hlZCByZXZpc2lvbiA1NSBhbmQgcmV0YWluZWQgYXBwcm92YWwgcHJldmlldyBzaGEyNTY6MDFmMDdkMGY1YmM0NTMxNTE3NDNkYWI3NzgyMWQ2NGEyOGQwNTA1ZTgyYmQ5MDVhYTMzNWQ0NTUyNWU1MWQ4MzogZm91ciBzdHJvbmdseSBjb25uZWN0ZWQgbG9jYXRpb25zLCBubyBGaXJzdCBFeG9kdXMvQmxhY2tib3gvS2VzaC9NYWVsYSBib3Jyb3dpbmcsIG5pbmUgdW5pcXVlIGFjdGl2ZSByZWNlaXB0cywgdmFsaWQgd29ybGQgYW5kIGFnZW5jeSBzdGFnZXMsIGFuZCBhbiB1bnN1cHBvcnRlZCBQYW4tU29sYXIgZG9jdHJpbmUgaXNvbGF0ZWQgYXMgYW4gZXZpZGVuY2UgZ2FwLiBObyBjYW1wYWlnbiB3YXMgYXBwcm92ZWQgb3IgcHVibGlzaGVkLiIsICJzdGF0dXMiOiAib2siLCAidHMiOiAiMjAyNi0wOC0yNVQwMzozNDoyNSswMDowMCIsICJ0eXBlIjogImxpdmVfYWNjZXB0YW5jZSJ9", "stored_at": "2026-08-25T03:34:25.391512+00:00", "type": "ghostlight.evidence_record.v0"}
+{"key": "2026-08-26T005011Z0000-0135-2d1c23496415", "payload": "eyJub3RlIjogIkRFTFZFL0hPTEQgYm91bmRhcnk6IGxpdmUgR2hvc3RsaWdodCBXb3JsZEtlcm5lbCwgbXVsdGlyZXNvbHV0aW9uIGFnZW5jeSwgdHlwZWQgdHJhbnNpdGlvbnMsIHBlcnNpc3RlbmNlLCBhbmQgcmVjZWlwdHMgYXJlIHJldXNhYmxlLCBidXQgY3VycmVudCBJbnN0aXR1dGlvblN0YXRlIGFuZCBzdHJhdGVnaWMgcmVzb3VyY2UgaGFuZGxlcyBkbyBub3QgaW1wbGVtZW50IEhPTEQgcXVhbnRpdGllcywgcHJpY2VzLCByZWNpcGVzLCBjYXBhY2l0eSwgaW52ZW50b3JpZXMsIG9yZGVycywgY29udHJhY3RzLCBvciBjb25zZXJ2YXRpb24uIERlbHZlaG9sZCB0aGVyZWZvcmUgcmV0YWlucyBxdWFudGl0YXRpdmUgZWNvbm9teSBhdXRob3JpdHk7IGEgZm9yY2VkIG9udG9sb2d5IG1heSBieXBhc3Mgd29ybGQgZ2VuZXJhdGlvbiBidXQgbmV2ZXIgV29ybGRLZXJuZWwgdmFsaWRhdGlvbi4gT3duZXIgd2l0bmVzc2VzOiBjcmF0ZXMvZ2hvc3RsaWdodC1kdW5nZW9uL3NyYy9kb21haW4ucnMgYW5kIEY6XFxQcm9qZWN0c1xcRGVsdmVob2xkXFxEZWx2ZWhvbGRcXEdhbWUgRGVzaWduXFxTaGFyZWQgV29ybGRcXFdvcmxkIFN0YXRlIE1vZGVsLm1kLiIsICJzdGF0dXMiOiAib2siLCAidHMiOiAiMjAyNi0wOC0yNlQwMDo1MDoxMSswMDowMCIsICJ0eXBlIjogImFyY2hpdGVjdHVyZSJ9", "stored_at": "2026-08-26T00:50:11.582781+00:00", "type": "ghostlight.evidence_record.v0"}

state/map.yaml

@@ -46,6 +46,8 @@ mission:
 
 hard_boundaries:
   - Prompt text is projection, not truth storage.
+  - A consumer-supplied ontology or fixed seed may bypass Session Zero world generation; it may never bypass WorldKernel validation, closed mutation authority, or atomic CultCache commit.
+  - Delvehold retains quantitative economy authority. Ghostlight string resource handles and strategic resource effects must not impersonate quantities, prices, recipes, production capacity, inventories, orders, contracts, or conservation semantics.
   - Canonical agent state and per-agent perceived state must remain distinct.
   - Characters act from local knowledge, local perception, local pressure, and bounded affordances.
   - Aetheria prose must support tonal range and ordinary life, not only crisis pressure. Wit, warmth, domesticity, ritual, boredom, wonder, and quiet dread are valid state-grounded modes when they fit the scene.
@@ -186,6 +188,7 @@ live_architecture:
     - Institution, faction, and consumer decision models
 
 active_subgoals:
+  - Admit DELVE/HOLD through the forced-ontology boundary in `docs/architecture/delvehold-forced-ontology-integration.md`: one externally controlled `greathold` institution, consumer-owned quantitative economy, typed CultMesh exchange, and no compiler-bypass path around WorldKernel.
   - Finish the semantic mutation migration: delete or demote remaining legacy model effect schemas and move aggregate campaign fields toward projection-only state. Seed publication and named-person presence now have explicit non-effect authority classifications.
   - Admit Kalsa through a selectable typed Vault manifest with Public player-safe and Spoilers GM-only evidence lanes, Git/Obsidian sync provenance, and exact receipt filtering. Do not import it into the read-only Aetheria recovery index or create a rival Ghostlight semantic index.
   - Grow the 36-case candidate agency corpus toward 300 reviewed, behaviorally distinct attempts that either compose from existing primitives, produce an explicit bargain, or falsify the algebra.
@@ -211,6 +214,7 @@ coverage_targets:
 
 current_artifacts:
   canonical_docs:
+    - docs/architecture/delvehold-forced-ontology-integration.md
     - notes/documentation-inventory.md
     - docs/architecture/corpus-coverage-ledger.md
     - docs/architecture/prompt-projection-contract.md