Let the newsroom query the public ledger

This commit is contained in:
Meta Vens 2026-08-29 16:08:46 +02:00
commit c454d13ecd
8 changed files with 931 additions and 834 deletions

View file

@ -870,6 +870,39 @@ pub struct Event {
pub public_channels: Vec<String>,
}
#[derive(
Clone, Copy, Debug, Serialize, Deserialize, JsonSchema, PartialEq, Eq, PartialOrd, Ord,
)]
#[serde(rename_all = "snake_case")]
pub enum PublicEventAssertionStatus {
AttemptCommittedOutcomeUnknown,
CourseCommittedEmbeddedActionsNotCompleted,
PublicDeclaration,
MaterialChangeCommitted,
PublicAccountStatusUnspecified,
}
impl Event {
pub fn public_assertion_status(&self) -> PublicEventAssertionStatus {
match self.kind.as_str() {
"actor_activity" | "gestalt_activity" | "gestalt_member_activity" => {
PublicEventAssertionStatus::AttemptCommittedOutcomeUnknown
}
"institution_action" => {
PublicEventAssertionStatus::CourseCommittedEmbeddedActionsNotCompleted
}
"gestalt_action" | "public_notice" => PublicEventAssertionStatus::PublicDeclaration,
"strategic_activity_outcome"
| "actor_movement"
| "gestalt_migration"
| "gestalt_member_migration"
| "clock_consequence"
| "group_travel" => PublicEventAssertionStatus::MaterialChangeCommitted,
_ => PublicEventAssertionStatus::PublicAccountStatusUnspecified,
}
}
}
#[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)]
pub struct NewsIssue {
pub id: String,

File diff suppressed because it is too large Load diff

View file

@ -684,16 +684,51 @@ mod tests {
struct RejectingRegistryNewspaperModel;
fn first_schema_property_enum<'a>(
schema: &'a serde_json::Value,
property: &str,
) -> Option<&'a str> {
match schema {
serde_json::Value::Object(object) => object
.get("properties")
.and_then(serde_json::Value::as_object)
.and_then(|properties| properties.get(property))
.and_then(|value| value.pointer("/items/enum/0"))
.and_then(serde_json::Value::as_str)
.or_else(|| {
object
.values()
.find_map(|value| first_schema_property_enum(value, property))
}),
serde_json::Value::Array(values) => values
.iter()
.find_map(|value| first_schema_property_enum(value, property)),
_ => None,
}
}
fn registry_newspaper_narrative_response(request: &ModelStageRequest) -> Result<String> {
let citation = request
let schema = request
.output_schema
.as_ref()
.and_then(|schema| {
schema.pointer(
"/properties/command/properties/story_pitches/items/properties/citations/items/enum/0",
)
.ok_or_else(|| anyhow!("newspaper fixture lost its narrative action schema"))?;
if !schema.to_string().contains("submit_agenda") {
return Ok(serde_json::json!({
"command":{
"tool":"query_public_records",
"terms":[],
"match_terms":"all",
"entity_names":[],
"assertion_statuses":[],
"channels":[],
"order":"newest",
"cursor":null,
"limit":24
}
})
.and_then(serde_json::Value::as_str)
.to_string());
}
let citation = first_schema_property_enum(schema, "citations")
.ok_or_else(|| anyhow!("newspaper fixture lost its narrative citation enum"))?;
Ok(serde_json::json!({
"command":{
@ -717,10 +752,7 @@ mod tests {
let citation = request
.output_schema
.as_ref()
.and_then(|schema| {
schema.pointer("/$defs/EditorialArticleDraft/properties/citations/items/enum/0")
})
.and_then(serde_json::Value::as_str)
.and_then(|schema| first_schema_property_enum(schema, "citations"))
.ok_or_else(|| anyhow!("newspaper fixture lost its citation enum"))?;
Ok(serde_json::json!({
"articles":[{
@ -1699,7 +1731,7 @@ mod tests {
else {
panic!("registry must preserve typed pending reconciliation state")
};
assert_eq!(model_receipts.len(), 9);
assert_eq!(model_receipts.len(), 10);
assert_eq!(checkpoint.generation(), 3);
let stored_after_rejection = runtime.store.keys("persona_stage_receipt.v1").unwrap();
let newly_observed_failure_receipts = model_receipts

View file

@ -1236,58 +1236,52 @@ hands and court seals, pump failures, legion refusal, and bridge seizure. That
material was outside the selector's desk. Post-copy review is not disproven
forever, but it was premature for run 53 because archive context was missing.
Pushed commit `bd323664b70ba337c313f31e0550989fff8ba26f` owns newsroom
archive-context contract v3. It retains the complete deduplicated public source
archive inside the existing narrative workbench while exposing only the 32
newest dossiers initially. The same
narrative-selection agent may spend bounded semantic steps requesting exact
12-item `preceding_recent` and `foundational` windows before agenda submission.
Deterministic admission permits only citations actually retrieved; editor, copy
desk, and reconciliation receive only the exact selected-source projection. No
new agent or event authority is added. Gates pass 25/25 newspaper tests, 480/480
library tests, and 15/15 strategic-smoke tests. Run 53 and its hashes and review
verdicts remain immutable.
Run 54 is immutable mechanically complete evidence at exact source
`01581b8576774f370884e331558605e7ef5e1b9b`, implementation
`2ac74abf12612b2c38b04acd6fcb604acd1c9d28`, and world revision 27,
with 18/18 waves, 363 events, 853 news rows, and no world or successful
per-wave publication replay. The newspaper passed independent grounding and
failed blind editorial review because administrative conditions, filings,
cordons, and recordkeeping buried conflict and bodily evidence. Its archive is
`F:\GameCult\GhostlightDungeon\acceptance\elven-realms-autonomous-01581b8-54.tar`,
SHA-256
`835F72FCB19C38815C543DC1497977288F2F1442F22FDBD32D1B312490B34808`.
Every manifest row passes and live service identities remained unchanged.
Exact-source run 54 attempt 1 at
`3288d9ef780f5ea0d2ff1f15bc0a1844b5cfe6b3` preserved world revision 27
with 18/18 waves, 363 events, and 853 news rows and performed no simulation
replay. The narrative selector used both bounded archive retrieval steps, then
its first agenda exceeded the deterministic six-citation total news hole. The
three-step budget left no fourth step to correct that rejection. Attempt-1
artifacts and the result root remain failure evidence.
The query-backed newsroom ownership cut is implemented in the current working
tree. Canonical `NewsIssue` plus `Event` rows own public facts and stable
selection IDs. `Event::public_assertion_status` owns factual completion
semantics. The existing generic agent harness now offers bounded deterministic
queries over the full immutable ledger; the selector owns story choice and
framing, and editor, copy desk, audit, and reconciliation dereference the same
selected IDs. Reader-facing numeric citations are assigned only during
lowering. The cut removes `NewsroomSource`, fact-bundle deduplication,
transient ordinal selection IDs, fixed archive windows, citation-count
ceilings, cross-story record uniqueness, and the newspaper-local event-kind
status mapping. Deterministic admission also rejects ambiguous ledger IDs and
repeated IDs inside persisted agenda or draft record groups. Gates pass 28/28
focused newspaper tests, 483/483 library tests, and 15/15 strategic-smoke
tests. No dependency, crate,
binary, daemon, persistent schema, cache, event writer, service, or simulation
pass was added.
Pushed `2ac74abf12612b2c38b04acd6fcb604acd1c9d28` gives the same
narrative-selection agent one
bounded fourth semantic step without changing archive windows, retrieved-only
admission, selected-only downstream projection, or the six-citation news hole.
A regression proves the exact path: two retrievals, one overfull rejection, and
one corrected six-citation agenda. Gates pass 26/26 newspaper tests, 481/481
library tests, and 15/15 strategic-smoke tests. No world, event, review-agent,
or per-wave authority is added.
Run 54 exposed one separate upstream publicity defect: a public strategic
activity propagates its channel to private `MemberMemory` outcomes, which is
how Orin Pell retaining a memory became a public news row. The newsroom should
ignore that bookkeeping, but revision 27 remains immutable. Future kernel work
must require an outcome's own observable or communicated public scope before
materializing a `NewsIssue`.
Pushed `af749de` routes a provider timeout through the shared model transport's
existing one same-request retry and records attempt telemetry. Run 36 crossed
that boundary; timeout retry is not its active blocker.
1. Preserve run-54 attempt-1 artifacts, rebuild exact pushed source
`2ac74abf12612b2c38b04acd6fcb604acd1c9d28`, and
resume the same run-54 result root without world or wave replay.
2. Require final newspaper and archive hashes, exact provenance and manifest,
1. Complete bounded package, strategic-smoke, format, state, and system-map
verification; commit and push the query-backed newsroom cut.
2. Create one new immutable newsroom-only root from run 54's exact revision-27
campaign and accepted per-wave publications. Recompose only the final Canopy
Ledger; preserve resumable selection/editor/reconciliation receipts.
3. Require final newspaper and archive hashes, exact provenance and manifest,
unchanged-service proof, independent grounding, and blind editorial
acceptance before delivery.
3. Defer multiple publication Personas, TeX layout, and engraved cuts until the
single Canopy Ledger copy passes.
4. Have the game-side adapter lower its authored hierarchy into the published
generic schemas; keep projection and economy translation consumer-owned.
5. Prove one consumer-owned effect crosses that public API, changes two foreign
political layers, causes one durable named figure to emerge and later act,
and returns attributed news or intent without mutating Delvehold-owned truth.
6. Measure provider cost and continuity on the existing 200-cell authored-world
path without coupling wave width to the provider concurrency ceiling.
7. Leave the unpublished Mars seed and Kalsa refuge expansion unapproved unless
the operator explicitly admits either; retain Kalsa as regression evidence.
8. Keep `gamecult-ops` synchronized with every executable deployment and model
transport change. Use Idunn on Yggdrasil for all builds and deployments.
acceptance before delivering the actual copy.
4. Defer multiple publication Personas, TeX layout, and engraved cuts until the
single Canopy Ledger passes.
Do not weaken actor custody, private projection, unanimous approval,
knowledge gates, no-puppeting, or atomic-wave invariants to make the smoke pass.

View file

@ -1272,165 +1272,127 @@ may create one consequential named person through the existing Gestalt member
commit primitive; that person enters later covers as the same canonical actor.
Public action channels produce committed `NewsIssue` records. The world-
consumer boundary admits an authority-gated editorial-voice request, then
validates the exact `NewsIssue` to committed-`Event` public-channel chain. The
public-event owner derives each committed event's human-readable account from
its typed effect and canonical subject names; relation coordinates, numerical
deltas, pressure-transition labels, action-selection rationale, and other state
machinery never become the public account. The newsroom does not re-decide
which committed public events count as truth. It merges identical fact bundles
under one opaque per-request citation while retaining every backing news row,
event, channel, and reliability record for later audit. The editor receives
only those citations, human-readable accounts, and canonical names asserted by
those accounts. Event membership metadata does not silently turn an involved
actor, institution, population, or ambiguous multi-place scope into an asserted
fact or dateline; a single event location may supply its canonical dateline,
while a multi-place event must name the place in its public account. News IDs,
event IDs and kinds, channels, reliability, source headlines, and wall-clock
timestamps remain internal. One bounded narrative-selection agent owns the
Canopy Ledger's editorial agenda over that frozen desk: it chooses a dominant
throughline, reader stake, article groupings, and rhetorical angles, then
submits a typed agenda whose story pitches reference only exact newsroom
citations. A deterministic workbench owns the article budget, exact citation
membership, uniqueness, lead selection, and bounded reader-facing framing
fields. The agenda is interpretation and selection, never evidence: it cannot
create an event, person, institution, place, motive, quotation, outcome, or
world mutation. The editor receives the admitted agenda plus a deterministic
projection of only the citations selected by that agenda and may compose only
from those selected citations. It owns headline, deck,
byline class, dateline, and article prose as a proposal; it does not silently
recover citations the narrative owner omitted. Edition chrome is
contract-derived, not model copy. Local validation binds every article to
agenda-selected opaque citations, places supplied by those cited facts, the
front-page budget, and reader-safe presentation labels. Accepted citations are
then lowered once to exact canonical source-news/event IDs and a semantic audit
projection containing the cited accounts, assertion status, named people and
their exhaustive supported identity attributes, institutions, populations,
and places. That projection is derived from the same selected `NewsroomSource`
records; it is not a second fact authority. A separate copy-desk stage may
reject unsupported facts,
unearned attribution, procedural leakage, or mechanical state-ledger copy but
cannot rewrite it. Its desk includes each account's typed assertion status and
the exact supported identity attributes for every named person, including an
explicitly empty set when canon supplies none. A rejected draft enters one
cheap grounding-reconciliation agent over the same frozen page, desk, and
complete typed finding set. The workbench enumerates that set into page-local
typed references and publishes only current references in the action schema.
The agent supplies a reference plus replacement text, or a reference whose
containing article should be deleted; owner code resolves the article, field,
paragraph, exact phrase, and byte span against the frozen draft. Deterministic
verdict validation and transactional edit application share that resolver; the
model cannot author target coordinates or repeat phrase identity. Deterministic
admission requires every current finding reference to be addressed and forbids
duplicate or unknown references, partially overlapping spans, and simultaneous
edit/delete of one article. Findings nested inside a larger exact finding in
the same field are not competing writers: owner code orders outer spans first,
applies the outer replacement once, and treats contained replacements as
covered. Distinct non-overlapping findings are grouped by target and applied
atomically in descending byte position, so replacement length and model
ordering cannot move a later edit. Empty replacement is a first-class deletion:
the workbench owns its text seam and consumes one adjacent ASCII space when the
deleted phrase begins or ends the field, preventing its own operation from
creating malformed leading or trailing whitespace. Citations,
surviving article selection and order, sections, bylines, and all unaffected
text remain frozen. If the lead is deleted, owner code promotes the next article
to the front page. The agent cannot request a new simulation or source packet,
submit a replacement `EditorialPageDraft`, or act as a second editor. The same
copy desk rechecks the complete repaired page.
validates the exact `NewsIssue` to committed-`Event` public-channel chain.
The public-event owner derives each committed event's human-readable account
from its typed effect and canonical subject names. Event semantics own the
assertion-status mapping used by every public consumer. Relation coordinates,
numerical deltas, action-selection rationale, and other state machinery do not
become public facts merely because a newsroom exists.
The newsroom narrative-selection boundary has this authority map:
The query-backed newsroom boundary is live under this authority map:
- **Owner:** the narrative-selection agent plus its deterministic workbench own
the single publication's current editorial agenda. The editor owns prose
proposal, the copy desk owns factual judgment, and `WorldKernel` remains the
only world-event authority.
- **Inputs:** the exact complete deduplicated public-news archive, publication
title and voice, article budget, source receipt ancestry, and the newsroom
contract version. The agent initially sees at most the 32 newest sources.
Through the same workbench it may request `preceding_recent`, the next up to
12 older sources after that initial viewport, or `foundational`, the oldest
up to 12 sources beyond the initial viewport. Each exact window is available
at most once and only while it contains a citation not already visible. The
agent run is bounded to four semantic actions, so spending both retrieval
windows still leaves one agenda submission and one response to an exact
deterministic rejection. The
deterministic workbench derives a total news hole of at most two selected
citations per available article, capped at six citations in any one story.
- **Objective:** one publication investigates the immutable public record,
selects the facts its actual stories require, and constructs a pointed
narrative without inventing world state or paying for a duplicate source
ontology.
- **Owner:** canonical `NewsIssue` plus `Event` rows own public provenance
and facts. `Event::public_assertion_status` owns attempt, declaration,
committed-course, material-outcome, and unspecified-account semantics. The
narrative-selection agent owns story choice, order, focal record, and
framing. The editor owns prose proposal. The copy desk owns factual judgment.
`WorldKernel` remains the only world-event writer. A query result owns
nothing.
- **Inputs:** one exact campaign revision, publication title and voice, article
budget, source-receipt ancestry, and newsroom contract version. Through the
existing generic agent harness, the selector issues deterministic bounded
queries over stable `NewsIssue` IDs using literal terms, exact asserted
public entity names, assertion statuses, channels, newest/oldest ordering,
and an already-inspected cursor. An empty query browses. Each response returns
at most 24 exact projections and the agent has at most eight semantic steps;
the complete immutable ledger remains queryable rather than being split into
privileged recent and foundational windows.
- **Outputs:** one typed agenda with a dominant throughline, reader stake, and
one or more ordered story pitches. Each pitch declares whether it is the lead,
names exact citation IDs, chooses one of them as its focal citation, and
supplies bounded narrative claim, tension, and public-question fields. The
editor schema and prompt expose only the union of citations selected by the
agenda; deterministic post-inference alignment, not the schema alone,
requires each article to use exactly its corresponding pitch's citation set.
The copy desk and grounding reconciler receive the same exact selected-source
projection, and lowering resolves only the article citations against the
complete archive. Valid but omitted archive notes remain true and unreported
rather than being forced into the issue.
- **Derived state:** salience, juxtaposition, pitch order, rhetorical
interpretation, and insinuation are editorial framing. They are not committed
events or source evidence. Semantic audit rows are a deterministic projection
of the selected frozen sources and do not become another desk. Archive-window
observations change only the agent's private visible citation set; they do
not publish, mutate, or summarize new world facts.
- **Forbidden writers:** the narrative agent cannot write campaign state,
events, `NewsIssue`, copy-desk verdicts, copy, checkpoints, or accepted
compositions. The editor owns prose only: it cannot choose or widen the
admitted citations, change their pitch grouping or order, replace the focal
citation, or replace the narrative claim. Renderers cannot infer missing
provenance or change assertion status. Neither the selector nor its archive
workbench may read private events, model memories, or unpublished world state.
- **Shared paths:** fresh composition runs narrative selection once, then editor
and copy desk over the selected-source projection. A rejected page persists
the admitted agenda and complete receipt ancestry before reconciliation.
Resume deterministically reconstructs that same projection from the
checkpointed agenda and complete bound archive; it never reruns narrative
selection or the editor. Accepted-composition idempotence returns the exact
stored issue.
- **Persistence and ancestry:** reconciliation checkpoint v2 binds the admitted
agenda, draft, rejected verdict, task and exact desk bindings, immutable
receipt IDs, receipt-chain digest, generation, and parent. Resume reloads the
typed receipts, validates narrative/editor/copy-desk stage order, exact
checkpoint identity, agenda admission and editor alignment, and strict receipt
prefix growth before inference. Fresh-path and resume tests separately prove
that the editor consumes the narrative receipt and resumed reconciliation
consumes the complete earlier receipt set plus checkpoint ID. The common
legacy-import validator does not independently reconstruct every historical
`source_receipt_ids` edge; that older chain remains bounded by the explicit
typed import witness rather than being generalized as current newsroom state.
- **Schema/version cut:** `canopy-ledger-narrative-selection.v3` participates in
publication-task and exact editorial bindings plus article and empty-issue
identity, while the exact editorial binding covers the complete deduplicated
archive and its provenance rather than only the initial or selected viewport.
New issues and CultMesh/native publication use
`ghostlight.world_newspaper_issue.v3`; resumable state uses
`ghostlight.world_newspaper_reconciliation_checkpoint.v2`. The accepted
composition envelope remains v1 but its contract-versioned key and editorial
binding prevent a pre-cut composition from winning current idempotence.
Checkpoint v1 is not a live resume source; the explicit typed legacy import is
the only admitted bridge for the named pre-cut run.
- **Historical compatibility seam:** `angle` is a read-only serde alias for
`narrative_claim`, and the default empty `focus_citation` exists only so old
agenda rows can be deserialized. Neither compatibility value appears as an
alternative in the current action schema: a current agenda must provide both
`narrative_claim` and a focal citation drawn from its exact story dossier, and
must pass v3 agenda validation and binding. Historical decoding therefore
cannot authorize a fresh v3 selection or composition.
- **Cut line:** the global 32-source truncation is deleted. Thirty-two is now a
bounded initial-view limit, not an archive-deletion rule; the complete archive
remains prepared and bound. The existing selection workbench owns exact archive
window retrieval, visible-citation admission, the news hole, and focal-source
constraints; the selector owns which visible facts become stories and the
editor owns only prose. No post-copy quality agent, multi-publication Persona,
publication memory, layout engine, new service, second event authority, or
alternate audit store is added in this cut.
- **Verification and build budget:** 26 focused `ghostlight-dungeon` newspaper
tests prove deterministic agenda admission, citation restriction,
receipt/checkpoint ancestry, semantic audit projection, and existing
reconciliation resume; the complete library gate is 481/481. The 15/15
strategic-smoke binary tests prove that its bounded recovery and checkpoint
helpers remain compatible, not the newsroom semantics themselves. The cut
adds no dependency, crate, binary, daemon, target platform, code-generation
path, or world-simulation pass.
ordered story pitches. Every pitch names stable public-record IDs, chooses one
focus record, and supplies bounded narrative claim, tension, and public
question. Article count plus bounded paragraphs and output tokens define page
space. There is no citation-count page budget. A foundational record may
support several continuing stories when each pitch uses it for a distinct
throughline.
- **Derived state:** public-record projections contain their stable ID,
timestamp, channel, headline, reliability, exact committed accounts,
assertion statuses, committed event IDs, and only those people,
institutions, populations, places, and identity attributes asserted by the
account. Query pages and late reader-facing citation numbers are transparent
views. They are not persisted newsroom subjects, fact bundles, relevance
authorities, or event writers.
- **Editorial path:** the selector must inspect a record before citing it. It
can search backward from routine updates to the original rupture and can
acknowledge that later handling is an installment in a continuing story.
The editor dereferences exactly the agenda-selected IDs, centers each article
on its focus record's consequential fact, and may not widen or regroup the
selection. Record bookkeeping, memory retention, maintained warnings, and
procedure are not automatically the lede merely because they are recent.
The copy desk and grounding reconciler see the same selected-record
projection.
- **Grounding path:** accepted stable IDs lower once into the existing
self-contained semantic audit with source news IDs, channels, reliability,
exact account text, assertion status, event IDs, supported identity
attributes, institutions, populations, and places. Reader-facing numeric
labels are assigned only during lowering. A rejected draft enters the
existing cheap grounding-reconciliation agent over the frozen page, selected
records, and complete exact finding set. Its deterministic workbench owns
phrase targets, transactional edits, deletion, and revalidation. Selection,
unaffected copy, and simulation remain frozen.
- **Invariants:** private events do not enter the query surface; every selected
stable ID resolves at the bound revision; article facts remain constrained to
selected records; story order and focus remain agenda-owned; omitted public
facts remain true; query, editing, copy review, and repair cannot mutate the
world; resume does not rerun selection or editing.
- **Forbidden writers:** the selector and query workbench cannot create,
mutate, deduplicate, summarize into, or reclassify `NewsIssue` or `Event`
state. The editor cannot widen the admitted record set. The copy desk cannot
rewrite prose. Caches and renderers cannot decide record equivalence,
assertion status, story relevance, or fact completion. The newspaper module
has no second event-kind status switch.
- **Shared paths:** fresh composition queries and selects stable records once,
then editor, copy desk, lowering, audit, and grounding reconciliation all
dereference those same IDs. Resume reconstructs the selected projection from
the checkpointed agenda and bound ledger without replaying the selector or
editor. Accepted-composition idempotence returns the stored issue.
- **Persistence and compatibility:** reconciliation checkpoint v2 binds the
agenda, draft, verdict, task and exact editorial bindings, immutable receipt
chain, generation, and parent. The internal contract is
`canopy-ledger-public-ledger-query.v4`; it prevents pre-cut compositions
from winning current idempotence. Public issue schema v3 and the accepted
composition envelope remain structurally unchanged. The read-only
`angle` alias and empty legacy `focus_citation` default can decode
historical rows but cannot authorize a fresh v4 compose.
- **Cut line:** `NewsroomSource`, transient ordinal selection IDs, fact-bundle
deduplication, fixed newest-32/preceding-12/foundational-12 windows,
per-story and total citation ceilings, global record uniqueness across
articles, and the newspaper-local event-kind status mapping are removed.
Query projection reuses existing accepted issue/audit types and the generic
agent harness. No dependency, crate, binary, daemon, persistent schema,
service, cache, event writer, target platform, code-generation path, or
world-simulation pass was added.
- **Verification and build budget:** 28 focused newspaper tests cover query
admission, stable-record selection, foundational retrieval, reuse across
stories, absence of a fixed source-count ceiling, common
editor/copy/audit/reconciliation dereferencing, receipt ancestry, and resume.
The bounded package, strategic-smoke, formatting, state, and system-map gates
remain required before deployment.
Run 54 is immutable mechanically complete evidence at exact source
`01581b8576774f370884e331558605e7ef5e1b9b`, implementation
`2ac74abf12612b2c38b04acd6fcb604acd1c9d28`, and world revision 27.
Its newspaper passed independent grounding and failed independent blind
editorial review because administrative conditions, filings, cordons, and
recordkeeping buried conflict and bodily evidence. The archive is
`F:\GameCult\GhostlightDungeon\acceptance\elven-realms-autonomous-01581b8-54.tar`
with SHA-256
`835F72FCB19C38815C543DC1497977288F2F1442F22FDBD32D1B312490B34808`.
No next run may replay world mechanics or per-wave publications.
Run 54 also exposed a separate upstream publicity defect. A public strategic
activity currently propagates its channel to every materialized outcome,
including a private `MemberMemory` consequence; that is how a public news row
about Orin Pell retaining a memory entered the frozen ledger. The newsroom must
not turn that bookkeeping into a story, but it cannot repair world-event
authority. The future kernel cut is: parent activity publicity does not imply
that every internal consequence is public; an outcome needs its own observable
or communicated public scope before `NewsIssue` materialization. Revision 27
remains immutable evidence and is not rewritten for this newsroom-only
acceptance.
The resumable reconciliation boundary is now live:
@ -1442,7 +1404,8 @@ The resumable reconciliation boundary is now live:
- **Inputs:** one exact `Campaign` snapshot, title, editorial voice, article
budget, model port, and `CampaignStore`. A publication-task binding covers
campaign id and revision plus title, voice, and budget. The editorial binding
additionally covers the exact derived newsroom source desk and provenance.
additionally covers the exact ordered public-record projections derived from
the bound `NewsIssue` and `Event` ledger.
This lets the owner find the task's checkpoint chain while still rejecting
same-task source drift before inference.
- **Outputs:** acceptance is one immutable persisted composition. A still
@ -1508,7 +1471,7 @@ The resumable reconciliation boundary is now live:
copy-desk ancestry, accepted-composition idempotence without inference,
same-task source-drift rejection and fork rejection before inference, typed
legacy import through the common validator, and Registry preservation of
pending state. The current verified gates are 478/478 library tests and 13/13
pending state. The current verified gates are 483/483 library tests and 15/15
strategic-smoke binary tests. Same-task source-drift and fork rejection before
inference are library proofs; the binary tests cover the acceptance driver's
recovery/checkpoint helpers. Provider runs 47 through 49 prove exact-chain

View file

@ -225,4 +225,5 @@
{"note": "Run 53 is immutable and mechanically complete at d42caca with exact live services unchanged; independent grounding passed and blind editorial review failed because one conduit dossier lacked cause, responsibility, opposition, lived consequence, and a next-issue hook. Source inspection falsified post-copy self-review as the next owner: newsroom_sources silently deleted every unique public fact dossier beyond the newest 32 although the frozen campaign retained the original strategic_pressure crisis.", "status": "ok", "ts": "2026-08-29T11:56:19+00:00", "type": "verification"}
{"note": "Newsroom contract v3 retains the complete deduplicated public archive, shows the selector only 32 newest dossiers initially, permits exact bounded retrieval of 12 preceding-recent or 12 foundational dossiers, admits only visible citations, and projects only the selected dossier union to editor, copy desk, and reconciliation. No new agent or event authority. Verification passes 25/25 newspaper, 480/480 library, and 15/15 strategic-smoke tests.", "status": "ok", "ts": "2026-08-29T11:56:19+00:00", "type": "implementation"}
{"note": "Run 54 at source 3288d9e resumed revision 27 with 18/18 waves, 363 events, and 853 news without simulation replay, then exhausted narrative selection after both exact archive retrievals and an overfull agenda rejection. The three-step budget left no action in which the same agent could obey the deterministic six-citation news-hole finding.", "status": "blocked", "ts": "2026-08-29T12:18:17+00:00", "type": "verification"}
{"ts": "2026-08-29T12:18:18+00:00", "type": "implementation", "status": "ok", "note": "The existing newsroom selector now has one bounded corrective action after spending both archive retrievals; the six-citation news hole is unchanged. A regression proves preceding_recent retrieval, foundational retrieval, rejected eight-citation agenda, and corrected six-citation agenda in one agent run. Gates pass 26/26 newspaper, 481/481 library, and 15/15 strategic-smoke tests."}
{"note": "The existing newsroom selector now has one bounded corrective action after spending both archive retrievals; the six-citation news hole is unchanged. A regression proves preceding_recent retrieval, foundational retrieval, rejected eight-citation agenda, and corrected six-citation agenda in one agent run. Gates pass 26/26 newspaper, 481/481 library, and 15/15 strategic-smoke tests.", "status": "ok", "ts": "2026-08-29T12:18:18+00:00", "type": "implementation"}
{"ts": "2026-08-29T14:06:49+00:00", "type": "implementation", "status": "ok", "note": "Query-backed Canopy Ledger newsroom cut: canonical NewsIssue plus Event rows now own public facts and stable record IDs; the generic agent harness provides bounded deterministic ledger queries; selector, editor, copy desk, audit, and reconciliation share those stable IDs; numeric citations are late display labels. Removed NewsroomSource packet authority, fact-bundle deduplication, fixed archive windows, citation-count ceilings, cross-story record uniqueness, and the newspaper-local event-kind status switch. Deterministic admission rejects ambiguous ledger IDs and duplicate IDs within persisted agenda or draft groups. Verified 28/28 focused newspaper, 483/483 library, and 15/15 strategic-smoke tests before final formatting pass. Independent Modeling review confirmed the cut and isolated the remaining MemberMemory publicity defect to the kernel; revision 27 and run 54 remain immutable."}

View file

@ -227,3 +227,4 @@
{"key": "2026-08-29T115619Z0000-0225-b7b26f978200", "payload": "eyJub3RlIjogIk5ld3Nyb29tIGNvbnRyYWN0IHYzIHJldGFpbnMgdGhlIGNvbXBsZXRlIGRlZHVwbGljYXRlZCBwdWJsaWMgYXJjaGl2ZSwgc2hvd3MgdGhlIHNlbGVjdG9yIG9ubHkgMzIgbmV3ZXN0IGRvc3NpZXJzIGluaXRpYWxseSwgcGVybWl0cyBleGFjdCBib3VuZGVkIHJldHJpZXZhbCBvZiAxMiBwcmVjZWRpbmctcmVjZW50IG9yIDEyIGZvdW5kYXRpb25hbCBkb3NzaWVycywgYWRtaXRzIG9ubHkgdmlzaWJsZSBjaXRhdGlvbnMsIGFuZCBwcm9qZWN0cyBvbmx5IHRoZSBzZWxlY3RlZCBkb3NzaWVyIHVuaW9uIHRvIGVkaXRvciwgY29weSBkZXNrLCBhbmQgcmVjb25jaWxpYXRpb24uIE5vIG5ldyBhZ2VudCBvciBldmVudCBhdXRob3JpdHkuIFZlcmlmaWNhdGlvbiBwYXNzZXMgMjUvMjUgbmV3c3BhcGVyLCA0ODAvNDgwIGxpYnJhcnksIGFuZCAxNS8xNSBzdHJhdGVnaWMtc21va2UgdGVzdHMuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA4LTI5VDExOjU2OjE5KzAwOjAwIiwgInR5cGUiOiAiaW1wbGVtZW50YXRpb24ifQ==", "stored_at": "2026-08-29T11:56:19.307114+00:00", "type": "ghostlight.evidence_record.v0"}
{"key": "2026-08-29T121817Z0000-0226-694c687c5f5c", "payload": "eyJub3RlIjogIlJ1biA1NCBhdCBzb3VyY2UgMzI4OGQ5ZSByZXN1bWVkIHJldmlzaW9uIDI3IHdpdGggMTgvMTggd2F2ZXMsIDM2MyBldmVudHMsIGFuZCA4NTMgbmV3cyB3aXRob3V0IHNpbXVsYXRpb24gcmVwbGF5LCB0aGVuIGV4aGF1c3RlZCBuYXJyYXRpdmUgc2VsZWN0aW9uIGFmdGVyIGJvdGggZXhhY3QgYXJjaGl2ZSByZXRyaWV2YWxzIGFuZCBhbiBvdmVyZnVsbCBhZ2VuZGEgcmVqZWN0aW9uLiBUaGUgdGhyZWUtc3RlcCBidWRnZXQgbGVmdCBubyBhY3Rpb24gaW4gd2hpY2ggdGhlIHNhbWUgYWdlbnQgY291bGQgb2JleSB0aGUgZGV0ZXJtaW5pc3RpYyBzaXgtY2l0YXRpb24gbmV3cy1ob2xlIGZpbmRpbmcuIiwgInN0YXR1cyI6ICJibG9ja2VkIiwgInRzIjogIjIwMjYtMDgtMjlUMTI6MTg6MTcrMDA6MDAiLCAidHlwZSI6ICJ2ZXJpZmljYXRpb24ifQ==", "stored_at": "2026-08-29T12:18:17.999516+00:00", "type": "ghostlight.evidence_record.v0"}
{"key": "2026-08-29T121818Z0000-0227-a3775f328e5e", "payload": "eyJub3RlIjogIlRoZSBleGlzdGluZyBuZXdzcm9vbSBzZWxlY3RvciBub3cgaGFzIG9uZSBib3VuZGVkIGNvcnJlY3RpdmUgYWN0aW9uIGFmdGVyIHNwZW5kaW5nIGJvdGggYXJjaGl2ZSByZXRyaWV2YWxzOyB0aGUgc2l4LWNpdGF0aW9uIG5ld3MgaG9sZSBpcyB1bmNoYW5nZWQuIEEgcmVncmVzc2lvbiBwcm92ZXMgcHJlY2VkaW5nX3JlY2VudCByZXRyaWV2YWwsIGZvdW5kYXRpb25hbCByZXRyaWV2YWwsIHJlamVjdGVkIGVpZ2h0LWNpdGF0aW9uIGFnZW5kYSwgYW5kIGNvcnJlY3RlZCBzaXgtY2l0YXRpb24gYWdlbmRhIGluIG9uZSBhZ2VudCBydW4uIEdhdGVzIHBhc3MgMjYvMjYgbmV3c3BhcGVyLCA0ODEvNDgxIGxpYnJhcnksIGFuZCAxNS8xNSBzdHJhdGVnaWMtc21va2UgdGVzdHMuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA4LTI5VDEyOjE4OjE4KzAwOjAwIiwgInR5cGUiOiAiaW1wbGVtZW50YXRpb24ifQ==", "stored_at": "2026-08-29T12:18:18.186973+00:00", "type": "ghostlight.evidence_record.v0"}
{"key": "2026-08-29T140649Z0000-0228-6bbe5165609b", "payload": "eyJub3RlIjogIlF1ZXJ5LWJhY2tlZCBDYW5vcHkgTGVkZ2VyIG5ld3Nyb29tIGN1dDogY2Fub25pY2FsIE5ld3NJc3N1ZSBwbHVzIEV2ZW50IHJvd3Mgbm93IG93biBwdWJsaWMgZmFjdHMgYW5kIHN0YWJsZSByZWNvcmQgSURzOyB0aGUgZ2VuZXJpYyBhZ2VudCBoYXJuZXNzIHByb3ZpZGVzIGJvdW5kZWQgZGV0ZXJtaW5pc3RpYyBsZWRnZXIgcXVlcmllczsgc2VsZWN0b3IsIGVkaXRvciwgY29weSBkZXNrLCBhdWRpdCwgYW5kIHJlY29uY2lsaWF0aW9uIHNoYXJlIHRob3NlIHN0YWJsZSBJRHM7IG51bWVyaWMgY2l0YXRpb25zIGFyZSBsYXRlIGRpc3BsYXkgbGFiZWxzLiBSZW1vdmVkIE5ld3Nyb29tU291cmNlIHBhY2tldCBhdXRob3JpdHksIGZhY3QtYnVuZGxlIGRlZHVwbGljYXRpb24sIGZpeGVkIGFyY2hpdmUgd2luZG93cywgY2l0YXRpb24tY291bnQgY2VpbGluZ3MsIGNyb3NzLXN0b3J5IHJlY29yZCB1bmlxdWVuZXNzLCBhbmQgdGhlIG5ld3NwYXBlci1sb2NhbCBldmVudC1raW5kIHN0YXR1cyBzd2l0Y2guIERldGVybWluaXN0aWMgYWRtaXNzaW9uIHJlamVjdHMgYW1iaWd1b3VzIGxlZGdlciBJRHMgYW5kIGR1cGxpY2F0ZSBJRHMgd2l0aGluIHBlcnNpc3RlZCBhZ2VuZGEgb3IgZHJhZnQgZ3JvdXBzLiBWZXJpZmllZCAyOC8yOCBmb2N1c2VkIG5ld3NwYXBlciwgNDgzLzQ4MyBsaWJyYXJ5LCBhbmQgMTUvMTUgc3RyYXRlZ2ljLXNtb2tlIHRlc3RzIGJlZm9yZSBmaW5hbCBmb3JtYXR0aW5nIHBhc3MuIEluZGVwZW5kZW50IE1vZGVsaW5nIHJldmlldyBjb25maXJtZWQgdGhlIGN1dCBhbmQgaXNvbGF0ZWQgdGhlIHJlbWFpbmluZyBNZW1iZXJNZW1vcnkgcHVibGljaXR5IGRlZmVjdCB0byB0aGUga2VybmVsOyByZXZpc2lvbiAyNyBhbmQgcnVuIDU0IHJlbWFpbiBpbW11dGFibGUuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA4LTI5VDE0OjA2OjQ5KzAwOjAwIiwgInR5cGUiOiAiaW1wbGVtZW50YXRpb24ifQ==", "stored_at": "2026-08-29T14:06:49.453283+00:00", "type": "ghostlight.evidence_record.v0"}

View file

@ -326,7 +326,7 @@ data_flow:
current_status:
summary: Ghostlight's generic consumer boundary admits sparse WorldSeeds, runs the hundreds-class parallel cell machinery used by Dungeon, and projects grounded newspapers from committed public events. Local acceptance proves 1,000 subjects across 200 cells and two-wave durable named-person emergence. Exact-source provider run 38 at `596e50679244b5d42b4cfdf70d723f815751b8ff` resumed the preserved world at revision 8 without replaying compilation or four committed locality elaborations, recovered 51 of 52 strategic-wave cells on pulse three and the final cell on pulse four, then committed all six waves through revision 14. Pushed commit `3a69306f3004e4af2cd57bba612a6ad8d1b8132f` implements the mapped clock-consequence owner and is verified locally: world clocks own declared consequence text and exact observable scope; a bounded agent may propose legacy scope binding, while `WorldKernel` alone admits it and materializes stable threshold-crossing events and public news through the common mutation path. Binding, emitted-event ancestry, mutation receipts, and the next newspaper boundary persist atomically. Exact-source run 39 resumed run 38 without replaying its six committed waves, bound clock consequences, committed six new waves through revision 21, and emitted Issues 7 through 12 plus a final digest. This completes the mechanical provider acceptance path; all inherited wave 1-6 checkpoint hashes match run 38 exactly and live services were unchanged. Independent blind editorial review returns FAIL: only Issue 7 approaches spicy, while Issues 8-12 are dominated by plans, filings, inspections, warnings, and abstract relationship deltas without betrayal, scandal, public reaction, sustained reversal, or material lived cost. That run-39 diagnosis is superseded for the current phase: run 51 closes the world and reconciliation mechanics, and the active defect belongs to newsroom narrative selection and self-contained semantic provenance over immutable facts. Independent grounding review also returns FAIL: Issue 9 inflates a planned expedited agenda into completion, while Issue 8 assigns unsupported feminine pronouns to Sela Venn and Eryn Tal. Other grounding mechanics pass: 208/208 citations resolve, no future events appear, no replay occurred, the player remained unchanged, all 116/116 manifest entries verify, the archive is exact, and root independently confirmed the live service PIDs and invocation IDs remained unchanged. Editorial and grounding acceptance are terminally failed for run 39. Eight titled elaborators use the generic agent harness under deterministic weighted scheduling, bounded parallelism, and Luna/Terra/Sol routing. Workers remain proposal-only; deterministic admission binds exact frozen schedules, dispatch, receipts, conflicts, and semantic verification, and `WorldKernel` alone owns atomic CultCache persistence. Destination reconciliation is a private transactional workbench, provider schema compatibility is lowered once at the shared model-connector boundary, and durable elaboration and strategic-pulse checkpoints bind to their canonical mutation proofs. The generic ModelAgent harness remains consumer-neutral transport. Provider run 23 remains stopped; earlier failed runs and checkpoint archives remain immutable provenance. The live daemons remain outside the acceptance body. Dungeon play remains regression pressure, the Delvehold game-side adapter remains unimplemented, and unpublished Mars and Kalsa destination previews remain unapproved.
provider_acceptance_checkpoint: Exact-source run 54 attempt 1 at `3288d9ef780f5ea0d2ff1f15bc0a1844b5cfe6b3` preserved world revision 27 with 18/18 waves, 363 events, and 853 news rows and performed no simulation replay. The narrative selector used both bounded archive retrieval steps, then its first agenda exceeded the deterministic six-citation total news hole. The three-step agent budget left no fourth step to correct that rejection. Attempt-1 artifacts and result root must remain preserved.
implementation_checkpoint: Pushed `bd32366` owns newsroom archive-context contract v3. Pushed `2ac74abf12612b2c38b04acd6fcb604acd1c9d28` gives the same narrative-selection agent one bounded fourth semantic step without changing the archive windows, retrieved-only admission, selected-only downstream projection, or six-citation news hole. A regression proves the exact mixed path: two retrievals, one overfull agenda rejection, then one corrected six-citation agenda. Gates pass 26/26 newspaper tests, 481/481 library tests, and 15/15 strategic-smoke tests. No world, event, review-agent, or per-wave authority is added. Run 53 remains immutable and run 54 attempt 1 remains failure evidence.
next_action: Preserve run-54 attempt-1 artifacts, rebuild exact pushed source `2ac74abf12612b2c38b04acd6fcb604acd1c9d28`, and resume the same run-54 result root without world or wave replay. Require final newspaper, audit, result, and archive hashes, complete manifest, exact-service proof, independent grounding, and blind editorial acceptance before delivery. Preserve runs 51 through 53 and defer multiple publication Personas, TeX layout, and engraved cuts until this single publication passes.
provider_acceptance_checkpoint: Exact-source run 54 at `01581b8576774f370884e331558605e7ef5e1b9b`, using implementation `2ac74abf12612b2c38b04acd6fcb604acd1c9d28`, is mechanically complete at world revision 27 with 18/18 waves, 363 events, and 853 news rows and no world or per-wave replay. Newspaper SHA-256 is `0df4871f26fa2236522fc9ccec462f0f075ecf059d8f6faf7bbd0125c94f0b3e`; audit is `8fcb121feb27a0b5ab86dbe4b43d7c45145cd6191b3ece1590f9b6b2d34f278f`; result is `cce0965c06067f7be92be4abe485bdd2d701e8aa97e9df9ee34280266a243a77`; immutable local archive `F:\GameCult\GhostlightDungeon\acceptance\elven-realms-autonomous-01581b8-54.tar` is `835F72FCB19C38815C543DC1497977288F2F1442F22FDBD32D1B312490B34808`. Every `SHA256SUMS` entry passes and the live Codex Connector and Ghostlight Dungeon PID/invocation identities are unchanged. Independent grounding review passes. Independent blind editorial review fails: the result is an administrative digest without a lived actor, responsibility, countermove, or next-issue hook. Run-54 attempt-1 artifacts remain failure provenance.
implementation_checkpoint: The query-backed newsroom cut is implemented in the working tree over pushed base `01581b8576774f370884e331558605e7ef5e1b9b`. Canonical `NewsIssue` plus `Event` rows own public facts and stable selection IDs; `Event::public_assertion_status` owns completion semantics; the existing agent harness exposes bounded deterministic ledger queries; narrative selection owns record choice and framing; editor, copy desk, audit, and reconciliation dereference the same selected IDs; and reader-facing citation labels are assigned only during lowering. `NewsroomSource`, fact-bundle deduplication, transient ordinal selection IDs, fixed archive windows, citation-count ceilings, cross-story record uniqueness, and the newspaper-local event-kind status switch are removed. Deterministic admission rejects ambiguous ledger IDs and repeated IDs inside any persisted agenda or draft record group. Verification passes 28/28 focused newspaper tests, 483/483 library tests, and 15/15 strategic-smoke tests. Run 54 remains immutable failure evidence. A separate kernel publicity defect remains recorded: a public parent activity currently makes private `MemberMemory` outcomes public, which produced Orin Pell's retained-memory news row; this newsroom-only cut does not rewrite revision 27.
next_action: Complete bounded package, strategic-smoke, format, state, and system-map verification; commit and push the query-backed newsroom cut. Then create one new immutable newsroom-only run root from run 54's exact revision-27 campaign and accepted per-wave publications, compose only the final Canopy Ledger, preserve resumable selection/editor/reconciliation receipts, verify exact provenance, archive hashes, and unchanged live-service identities, and obtain independent blind editorial and grounding acceptance. Do not replay any world mechanic or per-wave publication. Deliver the actual accepted copy before removing the heartbeat; defer multi-publication Personas, TeX layout, and engraved cuts.
gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Materialisation/folding changes only representation and the exact member delta, advances resolution epoch, and retires the old cover; it has no Gestalt-wide effect authority. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.