diff --git a/README.md b/README.md index 69f46f5..0440c49 100644 --- a/README.md +++ b/README.md @@ -16,6 +16,10 @@ multiresolution agency graph for keeping large settings active at finite cost. - `WorldKernel` is the sole owner of committed campaign state and revisions. - Every player command, NPC action, strategic tick, wait, import, and reload enters the same validated campaign mailbox and atomic CultCache commit path. +- Foreground actions, NPC reactions, strategic Gestalt activity, waits, travel, + and population fission lower into one closed semantic world-mutation algebra. + Means and intended effects remain proposals; only an admitted mutation batch + can change canonical components. There is no model-authored JSON Patch path. - Vault evidence grounds world compilation; branch-local invention remains distinct from canon. - Hosted lore Vaults are planned as Git-synchronized, Obsidian-compatible @@ -88,14 +92,18 @@ current acceptance surface covers: - Gestalt materialisation, folding, member deltas, migration, and later rematerialisation of the same person; - atomic rejection of malformed, stale, or semantically invalid model waves; +- one kernel-owned mutation reducer for foreground, reaction, strategic, time, + travel, and population-fission consequences, with exact component versions + and mutation proof receipts; - provider, token, cache, latency, validation, state-version, and build receipts; - exact-build deployment, state migration, public cutover, and restart verification on Yggdrasil. -The remaining forge gate is multi-account human pressure testing of Session -Zero privacy/publication and bounded co-op alongside continued -multiresolution Gestalt agency pressure. The public site is provisional; -checkout is not live. +The remaining forge gates are completion of the mutation migration for bounded +region expansion, expansion and review of the agency corpus beyond its current +candidate seed, multi-account human pressure testing of Session Zero +privacy/publication and bounded co-op, and continued multiresolution Gestalt +agency pressure. The public site is provisional; checkout is not live. ## Bounded Co-op @@ -130,6 +138,7 @@ The shortest reliable re-entry path is: - [`docs/architecture/ghostlight-dungeon-session-zero.md`](docs/architecture/ghostlight-dungeon-session-zero.md): campaign negotiation, privacy, publication, membership, and bounded co-op; - [`docs/architecture/ghostlight-multiresolution-agency.md`](docs/architecture/ghostlight-multiresolution-agency.md): dynamic Gestalt partitioning, cohesive and arena cells, fairness, and atomic strategic waves; - [`docs/architecture/ghostlight-eve-native-interface.md`](docs/architecture/ghostlight-eve-native-interface.md): Eve bindings, the stable provider surface, private Heimdall command plane, app-session custody, and browser cut line; +- [`docs/architecture/ghostlight-transition-algebra.md`](docs/architecture/ghostlight-transition-algebra.md): canonical subjects and components, semantic mutations, admission envelopes, atomic reduction, and the remaining writer migration; - [`notes/ghostlight-current-system-map.md`](notes/ghostlight-current-system-map.md): current implemented pipeline; - [`notes/ghostlight-implementation-plan.md`](notes/ghostlight-implementation-plan.md): live sequence and next pressure tests; - [`state/map.yaml`](state/map.yaml): canonical human-readable project state. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 3802730..9a5e1c4 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -37,9 +37,11 @@ d20 resolution, persistent locations and institutions, multiresolution Gestalt agency, offscreen strategic activity, knowledge-filtered news, and actor-filtered Eve/CultMesh surfaces. -The immediate product gate is continued adversarial play against the hosted -compiler and multiresolution agency loop. Separate-account multiplayer privacy -and unanimity proof remains required, but the previously expected D&D test +The immediate engineering gate is completion of the principled world-transition +migration before adversarial hosted play resumes. Region expansion remains a +named direct writer, and the 36-case agency corpus is only a candidate seed +against a 300-reviewed-case target. Separate-account multiplayer privacy and +unanimity proof also remains required, but the previously expected D&D test group is no longer available; record that gate as unproven rather than silently lowering it. @@ -52,6 +54,11 @@ lowering it. - Each campaign `WorldKernel` mailbox is the sole owner of canonical world state and revision. Player commands, NPC proposals, ticks, travel, waits, imports, reloads, and contract amendments share its validated atomic commit path. +- Accepted foreground, reaction, strategic, time, travel, and population-fission + outcomes lower into one closed `WorldMutationBatch` vocabulary. Means and + intended effects remain proposals; only the kernel reducer can alter typed + canonical components. Legacy effect enums are model-boundary migration input, + not alternate physical laws. - Ghostlight owns the generalized Projector → Persona → Interpreter membrane. Projectors, Personas, Interpreters, retrieval, narration, dice previews, and browsers may propose or project; none may commit canonical state. @@ -82,12 +89,12 @@ Yggdrasil is production. The Starfire writer and its old tunnel are stopped. Do not start both writers. - Executable release: - `a10a0125fc87a1262c50c85a0f1bf52133989feb` + `c7463c050620c69342c0cb84973beaefb09295cb` - Executable SHA-256: - `87ae68139375f507c54456907c687c397f18d7591a6a93d814ba7f4bc0ef3513` + `7b1aed52797f0845d896e9a1de2aa0b973a837353e8a76087845a50d9a429b06` - Artifact SHA-256: - `sha256-c0d1ab58fe711ff98502d4fad495c7a4d90e2aa079f08ac43e7981e26056cf92` -- Eve release: `e5a81185bb790906bea5eeba40507673b0d9b5bb` + `sha256-d5aa68cc1162f7bf145a5b96b10284842638a8751810cd532a6d7f17ed93610d` +- Eve release: `19c3dcf9173dce848a6253e975324ea239a02d24` - Service: `ghostlight-dungeon.service`, running as `ghostlight:ghostlight` - Listener: Yggdrasil loopback `127.0.0.1:8831` - Public route: `https://yggdrasil.gamecult.org/ghostlight/` @@ -104,8 +111,9 @@ Do not start both writers. and rotates the locally wrapped claim without returning the browser to the access gate. -Manifest, embedded commit, executable hash, typed health, persistent stores, -restart recovery, public crossing, and anonymous rejection agree. +Manifest, embedded commit, executable hash, typed health, `current` symlink, +zero-restart service state, fresh signed Idunn health, fresh Odin catalog +publication, public crossing, and anonymous rejection agree. ## Deployment and discovery truth @@ -139,11 +147,25 @@ messages. ## Current proof -- Idunn admitted exact release `a10a012…`; its locked package test and immutable - build completed before atomic activation. The same source passes 239 library, - 32 daemon, and one build-provenance test locally. Typed health, manifest, +- Idunn admitted exact release `c7463c0…`; its locked Linux package test and + immutable build completed before atomic activation. The same source passes + 263 library, 33 daemon, and one build-provenance test in the local Windows + witness; Idunn's Linux journal reports 262 library tests before the remaining + package targets in its truncated success receipt. Typed health, manifest, embedded source, executable hash, provider readiness, nine campaigns, two Session Zero drafts, and zero daemon restarts agree. +- Foreground, reaction, strategic, wait, travel, and population-fission writes + now use the typed mutation reducer. Each successful batch advances a touched + subject version once and persists its authority, mutations, receipt, causal + receipt, and aggregate projection atomically. Component-only mutation ingress + rejects aggregate campaign rows. +- Population fission cannot copy scarce custody into every child. Approved + fission assigns every parent resource to exactly one child, transfers each + named member exactly once, preserves the shared non-scarce baseline through + lineage, removes the old direct campaign writer, and leaves only derived + agency-profile/cover projection outside the reducer. The nested regression + moves one granary through two successive fissions without duplication while + preserving John's exact identity and delta. - Live refresh pressure reproduced and removed two contract faults: reuse of a private-command idempotency key across separately sealed attempts, and validation of a refresh receipt as if it carried the initial-login account @@ -204,14 +226,20 @@ Operational release and rollback truth remains in `gamecult-ops`. ## Next action -1. Fork or compile a denser 20-plus-power Aetheria agency skeleton and pressure - budgets 1, 4, 8, and 32 with real provider output, including nested refugee - dispersal and later rematerialization. -2. Run a two-person Yggdrasil Session Zero and bounded shared-scene canary using +1. Route bounded region expansion through the admitted mutation batch and prove + that no production direct writer can bypass the reducer. Classify initial + compiler publication and materialisation/dematerialisation explicitly rather + than quietly treating their current aggregate writes as equivalent. +2. Expand and review the agency corpus from its current 36 candidate cases + toward 300 behaviorally distinct cases; do not inflate it with reskins. +3. Resume adversarial Eve play, then fork or compile a denser 20-plus-power + Aetheria skeleton and pressure budgets 1, 4, 8, and 32 with real provider + output, including nested refugee dispersal and later rematerialization. +4. Run a two-person Yggdrasil Session Zero and bounded shared-scene canary using separate Heimdall accounts. -3. Then run the eight-account roster, privacy, actor-binding, pooled-budget, +5. Then run the eight-account roster, privacy, actor-binding, pooled-budget, unanimous-approval, unanimous-time/travel, stale-command, and restart smoke. -4. Continue human pressure on multiresolution Gestalt agency: meaningful +6. Continue human pressure on multiresolution Gestalt agency: meaningful background surprises, exact attributed rival activity inside arenas, information boundaries, nested fission/folding, migration, and return encounters. @@ -226,6 +254,7 @@ capacity. - MVP authority: `docs/architecture/ghostlight-dungeon-mvp.md` - Interface authority: `docs/architecture/ghostlight-eve-native-interface.md` - Gestalt authority: `docs/architecture/ghostlight-multiresolution-agency.md` +- Transition authority: `docs/architecture/ghostlight-transition-algebra.md` - Live system map: `notes/ghostlight-current-system-map.md` - Implementation program: `notes/ghostlight-implementation-plan.md` - Human-readable state: `state/map.yaml` diff --git a/notes/ghostlight-current-system-map.md b/notes/ghostlight-current-system-map.md index c5bf410..a9a4469 100644 --- a/notes/ghostlight-current-system-map.md +++ b/notes/ghostlight-current-system-map.md @@ -853,7 +853,12 @@ The player surface also projects the canonical current location ID. The destination compiler binds that value into a read-only origin field and shows the proposed locations, containment, routes, persistent features, and material gaps before approval. Population fission approval similarly shows each named -child leaf, partition value (including `other/unknown`), and home location. +child leaf, partition value (including `other/unknown`), home location, and the +exact child receiving each parent-owned resource. Shared capabilities, +knowledge, goals, pressures, and relationships inherit through population +lineage; custody does not. Each scarce resource crosses exactly one typed +custody transfer, so a fission cannot copy one granary, vehicle, or medicine lot +into every child. Fission admission runs before parent lookup, retrieval planning, or inference: one request may contain at most 16 distinct cuts of at most 160 readable characters and one 500-character reason. The browser mirrors these bounds. @@ -867,6 +872,39 @@ only missing or undecodable responses receive the ambiguous-transport warning that a commit may have preceded the lost response. The production web build runs strict TypeScript checking before Vite emits assets. +## World Transition Authority + +`WorldKernel` owns one closed semantic `WorldMutationBatch` reducer. Foreground +attempts, NPC reaction waves, strategic actor/institution/Gestalt outcomes, +waits, group travel, and approval-gated population fission all lower their +accepted outcomes into that vocabulary before canonical state changes. +`ActionMeans` records what an actor did, and the intended effect records what +they hoped to change; neither is a committed fact. The mutation batch contains +only exact component changes admitted by a state-derived authority envelope. + +The reducer validates the complete batch on an isolated component overlay, +advances each touched subject version once, and persists component state, +mutation authority envelope, mutation batch, mutation receipt, causal command +receipt, events, and aggregate compatibility projection atomically. The +aggregate campaign row is rejected as a component-only mutation target. +`WorldEffectDelta`, `ActorStateDelta`, and strategic effect variants are model +boundary migration inputs, not writers or independent physical ontologies. + +Population fission now composes admitted child entities, stable child +identities, one lineage split, exact resource custody transfers, and exact +named-member membership transfers. The old fission function that directly +wrote campaign state has been removed. Its surviving projector updates only +agency profiles, facets, cover invalidation, and `resolution_epoch` after the +canonical mutation batch succeeds. + +The runtime migration is not yet complete. Bounded region expansion still +inserts compiled locations and facts directly, and initial compiler publication +remains a separate seed authority. Materialisation and dematerialisation are +resolution changes over one persistent person and require an explicit review +of why they currently advance aggregate world revision. These are named writer +frontiers, not silently equivalent paths. See +`docs/architecture/ghostlight-transition-algebra.md`. + Relationship documents in the schema catalog are revision-bound projections of actor-owned relationship maps; they are not a second relationship writer. Vault manifests summarize the exact provider/source/authority/temporal lanes diff --git a/notes/ghostlight-implementation-plan.md b/notes/ghostlight-implementation-plan.md index 227226f..cc68276 100644 --- a/notes/ghostlight-implementation-plan.md +++ b/notes/ghostlight-implementation-plan.md @@ -122,6 +122,14 @@ Region expansion, initial compiler publication, removal of legacy model effect schemas, and the 300-case reviewed agency corpus remain the explicit migration frontier. See `docs/architecture/ghostlight-transition-algebra.md`. +Idunn's locked Linux test/build gate admitted this cut as immutable Yggdrasil +release `c7463c050620c69342c0cb84973beaefb09295cb` with Eve +`19c3dcf9173dce848a6253e975324ea239a02d24`. Live health, the release symlink, +deployment witness, binary hash, zero-restart service state, signed Idunn +health, and fresh Odin catalog publication agree. The local Windows witness is +263 library, 33 daemon, and one provenance test; the Idunn Linux success receipt +reports 262 library tests before its truncated remaining package-target output. + Live local evidence now covers grounded VoidBot compilation, a four-actor wave, impossible and receipted d20 actions, grounded narration, strategic cells, and a 24-faction budget-4 wave. The first scale baseline used 37,327 prompt tokens and @@ -156,11 +164,15 @@ leak. It used 90,030 tokens at a 76.3% prompt-cache-hit ratio; the retained invalid receipts expose one repeated institution posture and one repeated pressure without letting either mutate the world. -The next simulation gate is a 20-plus-power live Aetheria skeleton across -budgets `1`, `4`, `8`, and `32`, including nested refugee dispersal and later -rematerialization. Separate-account two-player and eight-player Session Zero -and shared-scene pressure remains an independent unproven gate; no human cohort -is currently waiting. The browser never +The next engineering gate is lowering bounded region expansion through the +mutation reducer, explicitly classifying seed publication and +materialisation/dematerialisation, and growing the agency corpus beyond its 36 +candidate cases without cosmetic reskins. After that cut, resume the +20-plus-power live Aetheria skeleton across budgets `1`, `4`, `8`, and `32`, +including nested refugee dispersal and later rematerialization. +Separate-account two-player and eight-player Session Zero and shared-scene +pressure remains an independent unproven gate; no human cohort is currently +waiting. The browser never receives the Heimdall access token; it adopts a server-verified login attempt into an HttpOnly Ghostlight session. Treat player confusion, dramatic flatness, composite consequences, and token-heavy low-consequence stages as evidence about missing context or diff --git a/state/map.yaml b/state/map.yaml index b58ad99..4482ca5 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -22,8 +22,10 @@ mission: social consequences, and eventually storylines, consumer behavior, faction decisions, and technology/item manifests for Aetheria. near_term: > - Pressure the hosted Session Zero, world compiler, fiction-first action - resolution, and multiresolution Gestalt loop through adversarial play. + Finish routing canonical world changes through the closed semantic mutation + algebra, then resume adversarial pressure on hosted Session Zero, world + compilation, fiction-first action resolution, and multiresolution Gestalt + agency. Expand the agency corpus with behaviorally distinct reviewed cases. Preserve atomicity, actor custody, private knowledge, stable topology, persistent identity, and offscreen agency while reducing provider retries and token-heavy prompts that do little useful cognitive work. @@ -70,6 +72,9 @@ live_architecture: - The authoritative ownership and build map is `docs/architecture/ghostlight-dungeon-mvp.md`. - One per-campaign WorldKernel mailbox owns canonical state and revision numbers. - Every player, NPC, institution, scheduler, import, and reload transition uses the same typed WorldCommand validation and atomic CultCache commit path. + - Foreground attempts, NPC reactions, strategic cell outcomes, waits, travel, and approval-gated population fission lower into one closed semantic WorldMutationBatch vocabulary. Means and intended effects remain proposals; only the WorldKernel reducer can change canonical components. + - The mutation reducer validates a complete batch against an exact authority envelope on an isolated component overlay, advances each touched subject version once, and persists component state, authority, batch, mutation receipt, causal receipt, events, and aggregate compatibility projection atomically. Aggregate campaign rows are rejected by component-only mutation ingress. + - WorldEffectDelta, ActorStateDelta, and StrategicOutcomeEffect are model-boundary migration inputs, not independent writers. Region expansion remains the named production direct-writer frontier; initial publication and materialisation/dematerialisation require explicit authority classification. - Ghostlight owns generalized Projector to Persona to Interpreter machinery; consuming Personas retain their own canonical minds and commit authority. - Epiphany consumes the extracted Ghostlight projection crate at an exact Git revision while retaining her canonical Mind, effect admission, and consequence authority. - Gestalt Personas own shared population state; first-relevance individuation and later folding are revisioned WorldKernel commits, and durable member deltas preserve specific people between appearances. @@ -97,7 +102,7 @@ live_architecture: - Remote institutions receive deterministic six-axis coarse profiles with distinct self-authority and explicit unknown facets. The Pro agency compiler profiles only locally materialized subjects; finer remote state compiles on demand. - Model-stage receipts expose per-attempt provider identity, latency, validation errors, and prompt/completion/cache token usage without storing reasoning content. - Budget and pins own `resolution_epoch`; provider concurrency owns a separate configuration epoch and cannot repartition or advance fiction. - - Approval-gated gestalt fission creates explicit child leaves plus `other/unknown`, preserves inactive parent lineage, and never erases member deltas. + - Approval-gated gestalt fission creates explicit child leaves plus `other/unknown`, preserves inactive parent lineage and member deltas, assigns every scarce parent resource to exactly one child, transfers every named member exactly once, and projects only derived agency profiles and cover state outside the mutation reducer. - Existing v0 training fixtures are regression evidence and have no runtime write authority. - SessionZeroKernel is the sole pre-world owner of persistent shared/private negotiation, typed contracts, character drafts, boundaries, decisions, invitations, and approvals. The WorldKernel receives only an unanimously approved brief at atomic publication. - SessionZeroKernel keeps append-only model-invocation audit history separate from the active preview's exact compiler proof set. Repeated calls with one semantic receipt hash remain distinct audit entries; preview retirement clears only the proof set, and campaign publication receives only the receipts that produced the approved preview. Legacy conflated stores migrate atomically on registry load without changing revision, epochs, or fictional time. @@ -173,6 +178,8 @@ live_architecture: - Institution, faction, and consumer decision models active_subgoals: + - Finish the semantic mutation migration: route bounded region expansion through WorldMutationBatch, classify seed publication and materialisation/dematerialisation, and delete or demote every remaining canonical direct writer. + - Grow the 36-case candidate agency corpus toward 300 reviewed, behaviorally distinct attempts that either compose from existing primitives, produce an explicit bargain, or falsify the algebra. - Pressure live campaign compilation and play from exact Vault evidence; reject honest gaps instead of borrowing a nearby fixture, cast, or geography. - Make strategic cells produce meaningful attributed activity while rivals in arenas retain separate knowledge, speech, resources, and authority. - Preserve named-person continuity through materialization, folding, migration, nested Gestalt lineage, and later return encounters. @@ -297,6 +304,6 @@ data_flow: - If state grows faster than understanding, cut it back. current_status: - summary: Yggdrasil serves immutable Ghostlight release a10a0125fc87a1262c50c85a0f1bf52133989feb with Eve e5a81185bb790906bea5eeba40507673b0d9b5bb, executable SHA-256 87ae68139375f507c54456907c687c397f18d7591a6a93d814ba7f4bc0ef3513, and artifact SHA-256 sha256-c0d1ab58fe711ff98502d4fad495c7a4d90e2aa079f08ac43e7981e26056cf92. Typed health reports nine campaigns, two Session Zero drafts, DeepSeek flash/pro ready, and zero daemon restarts. The exact source passes 239 library, 32 daemon, and one provenance test. Hosted campaign 34929b8d-7b04-49af-9936-1c798fd79760 committed an eight-cell return-catch-up wave from revision 12 to 13 with five bounded material outcomes, exact actor and member attribution, player/Reed byte continuity, no arena collective actor, no knowledge-channel overlap, and no player-visible remote news. Its 34 stages and 35 provider attempts used 90,030 tokens with a 76.3% prompt cache-hit ratio. The shared strategic commit path now refreshes its derived CultMesh projection, closing an early-return path that could leave operator state one revision stale. The browser app session survived release replacement. Starfire remains retired as a writer. Idunn owns deployment and continuity, Odin owns discovery, Heimdall owns identity, and none owns campaign mutation. Epiphany is adjacent capacity rather than a dependency. - next_action: Pressure a denser 20-plus-power Aetheria skeleton at budgets 1, 4, 8, and 32 with real provider output, including nested refugee dispersal and later rematerialization. Separately close the unproven two-account and eight-account privacy, actor-binding, unanimity, and restart gates. Preserve the revision-12 Mira movement scar as history; do not repair it out of band or weaken actor, privacy, approval, atomicity, or no-puppeting invariants. + summary: Yggdrasil serves immutable Ghostlight release c7463c050620c69342c0cb84973beaefb09295cb with Eve 19c3dcf9173dce848a6253e975324ea239a02d24, executable SHA-256 7b1aed52797f0845d896e9a1de2aa0b973a837353e8a76087845a50d9a429b06, and artifact SHA-256 sha256-d5aa68cc1162f7bf145a5b96b10284842638a8751810cd532a6d7f17ed93610d. Typed health reports nine campaigns, two Session Zero drafts, DeepSeek flash/pro ready, and zero daemon restarts. Idunn's locked Linux package test passed before atomic activation; the same source has a local Windows witness of 263 library, 33 daemon, and one provenance test. Fresh signed Ghostlight health and Odin catalog publications are active. Foreground, reaction, strategic, wait, travel, and population-fission outcomes now use one semantic mutation reducer with exact authority and proof receipts. Fission transfers each scarce resource and named member exactly once while preserving non-scarce lineage baselines and individual deltas. Hosted campaign 34929b8d-7b04-49af-9936-1c798fd79760 retains its earlier eight-cell return-catch-up witness with five bounded material outcomes, exact actor/member attribution, player/Reed byte continuity, no arena collective actor, no knowledge-channel overlap, and no player-visible remote news. Starfire remains retired as a writer. Idunn owns deployment and continuity, Odin owns discovery, Heimdall owns identity, and none owns campaign mutation. Epiphany is adjacent capacity rather than a dependency. + next_action: Route bounded region expansion through the admitted mutation batch and prove the remaining writer frontier. Explicitly classify initial compiler publication and materialisation/dematerialisation. Expand the 36 candidate agency cases toward 300 behaviorally distinct reviewed cases before claiming algebraic completeness. Then resume adversarial Eve play and the denser 20-plus-power Aetheria budget pressure. Separately close the unproven two-account and eight-account privacy, actor-binding, unanimity, and restart gates. Preserve the revision-12 Mira movement scar as history; do not repair it out of band or weaken actor, privacy, approval, atomicity, or no-puppeting invariants. gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.