Record deployed durable auth release

notes/fresh-workspace-handoff.md

@@ -49,8 +49,8 @@ foundation checklist below. Existing Ghostlight fixtures remain regression
 evidence.
 
 The active immutable release is
-`73b748e183d4c05e6e0ce5442a860394ab25cd0a`, binary SHA-256
-`48a3ffa00e24cf23ac5c82e23af0c7f5e5b0be37a08de5ccec468a97637587df`.
+`e55984c22703539f72157da652d670c54ff76580`, binary SHA-256
+`22c096f5bbb2f49353be482d3fae017907c30dba247e5bae5c2988a87bb493ee`.
 Manifest, process, typed health, persisted campaign count, CultMesh store,
 DeepSeek startup inference, and VoidBot retrieval agree. Periwinkle proved the
 private-LAN route and unauthenticated 401; Raven and Yggdrasil independently

notes/ghostlight-current-system-map.md

@@ -187,9 +187,9 @@ and operator inspection; the browser cannot reveal them before discovery.
 ## Current acceptance body
 
 Starfire currently serves immutable release
-`73b748e183d4c05e6e0ce5442a860394ab25cd0a`, executable SHA-256
-`48a3ffa00e24cf23ac5c82e23af0c7f5e5b0be37a08de5ccec468a97637587df`,
-with rollback `f7c9db29bea389b49fa6805d1ae6143e95db8b82`.
+`e55984c22703539f72157da652d670c54ff76580`, executable SHA-256
+`22c096f5bbb2f49353be482d3fae017907c30dba247e5bae5c2988a87bb493ee`,
+with rollback `73b748e183d4c05e6e0ce5442a860394ab25cd0a`.
 
 Authenticated acceptance against the exact release has proved generated
 opening/role/approval compilation, a nonliteral canonical player actor ID,

state/evidence.jsonl

@@ -106,4 +106,5 @@
 {"ts":"2026-08-18T19:45:00Z","type":"security","status":"ok","branch":"codex/ghostlight-dungeon-mvp","note":"Established a real operator HTTP boundary: the inspector and provider-parallelism mutation now require an authenticated session from an actual loopback TCP peer supplied by Axum ConnectInfo. LAN and WireGuard peers are denied before private state access; forwarded headers grant nothing. The browser operator panel is hidden unless loaded from loopback, mirroring but not replacing server authority. IPv4/IPv6 loopback and LAN/WireGuard negative unit cases plus the production web build pass."}
 {"ts":"2026-08-18T19:49:00Z","type":"deployment","status":"ok","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable release f7c9db29bea389b49fa6805d1ae6143e95db8b82 with executable SHA-256 38914543bd3d863ce78b410438e5d702c409a5c20c787ede7f602967b6c11a0a and rollback c509d2a95bb7683b10561abad7d4857aeab6277d. Typed health, manifest, active junction, PID 1880, four persisted campaigns, and DeepSeek readiness agree. Live socket proof returned 401 for unauthenticated loopback inspector/control requests and 403 for the same requests through Starfire's 192.168.178.146 listener, proving peer denial precedes session lookup. Publication did not rotate or consume invitations."}
 {"ts":"2026-08-18T19:58:18Z","type":"deployment","status":"ok","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable release 73b748e183d4c05e6e0ce5442a860394ab25cd0a with executable SHA-256 48a3ffa00e24cf23ac5c82e23af0c7f5e5b0be37a08de5ccec468a97637587df and rollback f7c9db29bea389b49fa6805d1ae6143e95db8b82. Typed health, release manifest, executable hash, PID 2728, four persisted campaigns, DeepSeek readiness, and served asset index-DWEg_yl8.js agree. Unauthenticated player and loopback operator surfaces returned 401, LAN operator access returned 403, malformed lifecycle JSON returned 400, and publication neither rotated nor consumed invitations. The release adds truthful ambiguous-transport handling and registry-owned fork/reset name validation; the full workspace passed 135 core and 8 daemon tests before publication."}
+{"ts":"2026-08-18T20:07:03Z","type":"deployment","status":"ok","branch":"codex/ghostlight-dungeon-mvp","note":"Starfire activated immutable release e55984c22703539f72157da652d670c54ff76580 with executable SHA-256 22c096f5bbb2f49353be482d3fae017907c30dba247e5bae5c2988a87bb493ee and rollback 73b748e183d4c05e6e0ce5442a860394ab25cd0a. Typed health, manifest, executable hash, PID 4588, four persisted campaigns, DeepSeek readiness, and served asset index-DWEg_yl8.js agree. Unauthenticated player and loopback operator surfaces returned 401 and LAN operator access returned 403. Auth state now becomes live only after its CultCache compare-and-swap succeeds; a forced stale-row regression proves failure leaves in-memory authority unchanged. Two immediate exports produce distinct readable MessagePack-backed CultCache snapshots. Publication did not rotate or consume invitations; the full workspace passed 135 core and 9 daemon tests."}
 {"ts":"2026-08-18T18:52:00Z","type":"verification","status":"ok","branch":"codex/ghostlight-dungeon-mvp","note":"Exact release 7916ab04936ba962720cfbf4af1b83f9aa8d8b24 made every selected named member exception a mandatory Projector perspective owner, closing the seam where aggregation could erase an actionable individual before Persona choice. The strict provider-backed budget-one golden placed 24 rivals in one arena, attributed migration to member:mira-venn, moved her between depth-two population lineages, produced nine sustained material consequences including seven typed outcomes across six other background subjects, preserved her delta and the player, and automatically promoted the same Mira on return with zero rejected pulses. Witness: F:\\GameCult\\GhostlightDungeon\\acceptance\\gestalt-dynamics-7916ab0-strict\\result.json."}

state/map.yaml

@@ -270,6 +270,6 @@ data_flow:
   - If state grows faster than understanding, cut it back.
 
 current_status:
-  summary: Starfire serves immutable release 73b748e183d4c05e6e0ce5442a860394ab25cd0a with matching typed health, manifest, executable hash 48a3ffa00e24cf23ac5c82e23af0c7f5e5b0be37a08de5ccec468a97637587df, DeepSeek readiness, four persisted campaigns, spoiler-safe player projection, loopback-only operator HTTP, resilient browser failure handling, registry-owned lifecycle-name validation, full public approval previews, canonical destination origin binding, and rollback f7c9db2. The accepted runtime lineage passes generated opening/role/approval compilation, canonical nonliteral player identity, private assessment, confirmed d20, wait, restart continuity, fork, export, re-selection, and reset. The 24-subject cover passes budgets 1/4/8/32, including a corrected budget-8/provider-8 wave in 18.35 seconds. The strict budget-one rival-arena refugee golden migrates Mira across nested populations, preserves her exact delta and the player through sustained material background activity, and promotes the same person on return.
+  summary: Starfire serves immutable release e55984c22703539f72157da652d670c54ff76580 with matching typed health, manifest, executable hash 22c096f5bbb2f49353be482d3fae017907c30dba247e5bae5c2988a87bb493ee, DeepSeek readiness, four persisted campaigns, spoiler-safe player projection, loopback-only operator HTTP, resilient browser failure handling, durable-before-live auth transitions, collision-proof campaign exports, registry-owned lifecycle-name validation, full public approval previews, canonical destination origin binding, and rollback 73b748e. The accepted runtime lineage passes generated opening/role/approval compilation, canonical nonliteral player identity, private assessment, confirmed d20, wait, restart continuity, fork, export, re-selection, and reset. The 24-subject cover passes budgets 1/4/8/32, including a corrected budget-8/provider-8 wave in 18.35 seconds. The strict budget-one rival-arena refugee golden migrates Mira across nested populations, preserves her exact delta and the player through sustained material background activity, and promotes the same person on return.
   next_action: With explicit approval to transmit one temporary invite credential to the local in-app browser, complete the visual authenticated journey and inspect the compiler, assessment, roll, wait, campaign lifecycle, and resolution controls; rotate two fresh invitations afterward. Then begin supervised human playtesting and treat confusion, composite consequences, latency, or low dramatic yield as evidence without weakening state admission.
   gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.