GameCult/Ghostlight
Watch
9
0
Fork
You've already forked Ghostlight
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compile playable branch truth within canon constraints

Browse source
This commit is contained in:
Meta Vens 2026-08-25 12:11:48 +02:00
commit e89db8bcad
6 changed files with 195 additions and 118 deletions
Download patch file Download diff file Expand all files Collapse all files

239
crates/ghostlight-dungeon/src/compiler.rs
View file

@ -420,7 +420,7 @@ struct StrategicDoctrineCatalog {
#[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)]
struct StrategicDoctrineVerdict {
name: String,
supported: bool,
compatible_with_canon: bool,
rationale: String,
}
@ -787,7 +787,7 @@ impl WorldCompiler {
.transpose()?
.unwrap_or_default();
let base_prompt = format!(
"{shared_prefix}{player_identity_context}{operational_playability_context}Compile a bounded playable region with stable topology, local actors, populations, clocks, and only those remote institutions that have a direct causal relationship to this requested start. SCOPED EVIDENCE contains direct_seed witnesses only. Setting-background and excluded witnesses remain visible in the approval coverage but are deliberately absent here: they cannot donate cast, incidents, clocks, location state, goals, or institutional posture to this branch. When direct evidence cannot ground a requested local detail, keep the local cast sparse, mark reversible texture provisional_local, and list the material gap instead of borrowing a nearby story. Do not eagerly invent remote settlements, routes, or people. Private character history, secrets, relationships, and relationship subjects are deliberately absent and compile in a separate private stage; do not assume or reconstruct them. Emit only supported canon facts. A canon_baseline fact must cite one or more exact receipt_id values printed in SCOPED EVIDENCE whose witnesses directly support the whole statement. Never label an invented proper noun canon. Facts that an actor can uncover through an admitted local observation must exist before play and list the exact discoverable_at_location_ids where that observation is possible. Seed enough branch_local or provisional_local discoverable facts to make the requested opening pressure and immediate goal actionable; at least one such non-canon fact must be discoverable at the player's exact starting location. The later action assessor can reveal an existing fact but cannot invent one. Facts that are private history or not directly observable have an empty discovery-location set. The player location and every actor location must exist. Containment describes nested geometry; it never creates implicit movement. Every supplied location is a playable occupancy node. When the region contains more than one location, explicit route chains must let the player reach every supplied location from the starting location and return. Model inaccessible scenery as a persistent feature instead of an unreachable location. Every route record needs a stable route_id within its origin, an exact supplied destination_id, a distance, and positive travel_minutes. Every fact discovery location must exist, clocks need positive thresholds, and the player id must be unique. Actor relationship records must use subject_id values copied from exact actor, institution, gestalt, or named-member subject IDs declared in this candidate, never display names, roles, undeclared groups, or location IDs. A relationship to a collective population names its exact gestalt; it does not union that population's knowledge or turn the actor into its authority. Represent populations that can act collectively (villages, crews, crowds, departments, corporations) as gestalt Personas. Seed a small roster of plausible durable member identities for people the player may encounter; member deltas contain only departures from their gestalt baseline and begin dematerialized. Do not duplicate a gestalt member in actors. Keep named plot-critical people as ordinary actors. Every gestalt home location and member gestalt reference must exist. Do not emit agency profiles or relations; those are compiled from the exact validated subject roster in the next stage."
"{shared_prefix}{player_identity_context}{operational_playability_context}Compile a bounded playable region with stable topology, local actors, populations, clocks, and only those remote institutions that have a direct causal relationship to this requested start. SCOPED EVIDENCE contains direct_seed witnesses only. Setting-background and excluded witnesses remain visible in the approval coverage but are deliberately absent here: they cannot donate cast, incidents, clocks, location state, goals, or institutional posture to this branch. Use evidence as canon constraints, not as an exhaustive game map. When the Vault omits game-scale geometry, routes, local people, procedures, or daily texture, invent the smallest coherent playable elaboration, mark facts branch_local or provisional_local, and disclose consequential choices in branch_assumptions. An unevidenced route needed to connect the bounded region is branch-local geometry, not an evidence gap. Use a material gap only when no compatible elaboration can preserve the requested premise without choosing between contradictory canon baselines or exceeding an approved capability; never borrow a nearby story to fill it. Do not eagerly materialize remote settlements or people outside the bounded playable region. Private character history, secrets, relationships, and relationship subjects are deliberately absent and compile in a separate private stage; do not assume or reconstruct them. Emit only supported canon facts. A canon_baseline fact must cite one or more exact receipt_id values printed in SCOPED EVIDENCE whose witnesses directly support the whole statement. Never label an invented proper noun canon. Facts that an actor can uncover through an admitted local observation must exist before play and list the exact discoverable_at_location_ids where that observation is possible. Seed enough branch_local or provisional_local discoverable facts to make the requested opening pressure and immediate goal actionable; at least one such non-canon fact must be discoverable at the player's exact starting location. The later action assessor can reveal an existing fact but cannot invent one. Facts that are private history or not directly observable have an empty discovery-location set. The player location and every actor location must exist. Containment describes nested geometry; it never creates implicit movement. Every supplied location is a playable occupancy node. When the region contains more than one location, explicit route chains must let the player reach every supplied location from the starting location and return. Model inaccessible scenery as a persistent feature instead of an unreachable location. Every route record needs a stable route_id within its origin, an exact supplied destination_id, a distance, and positive travel_minutes. Every fact discovery location must exist, clocks need positive thresholds, and the player id must be unique. Actor relationship records must use subject_id values copied from exact actor, institution, gestalt, or named-member subject IDs declared in this candidate, never display names, roles, undeclared groups, or location IDs. A relationship to a collective population names its exact gestalt; it does not union that population's knowledge or turn the actor into its authority. Represent populations that can act collectively (villages, crews, crowds, departments, corporations) as gestalt Personas. Seed a small roster of plausible durable member identities for people the player may encounter; member deltas contain only departures from their gestalt baseline and begin dematerialized. Do not duplicate a gestalt member in actors. Keep named plot-critical people as ordinary actors. Every gestalt home location and member gestalt reference must exist. Do not emit agency profiles or relations; those are compiled from the exact validated subject roster in the next stage."
);
let schema = serde_json::to_value(schema_for!(CompiledSeed))?;
let sources = receipt_ids_for_coverage(&receipts, &evidence_coverage);
@ -859,7 +859,7 @@ impl WorldCompiler {
&campaign_with_private_actors,
required_relationship_actors,
)?;
let (remote_institution_evidence, global_agency_gaps) =
let (remote_institution_evidence, global_agency_gaps, global_agency_assumptions) =
merge_global_agency_catalog(&mut seed, global_catalog)?;
let remote_institution_ids = remote_institution_evidence
.keys()
@ -939,7 +939,11 @@ impl WorldCompiler {
evidence_receipts: all_receipts,
evidence_coverage,
gaps: seed.gaps.into_iter().chain(global_agency_gaps).collect(),
branch_assumptions: seed.branch_assumptions,
branch_assumptions: seed
.branch_assumptions
.into_iter()
.chain(global_agency_assumptions)
.collect(),
requires_approval: true,
},
model_receipts,
@ -1797,7 +1801,7 @@ impl WorldCompiler {
let receipts = canonical_worldbuilding_receipts(receipts);
let schema = serde_json::to_value(schema_for!(ExtractedGlobalAgencyCatalog))?;
let base_prompt = format!(
"OUTPUT JSON SCHEMA (follow exactly):\n{}\n\nExtract evidence for the coarse remote strategic agency catalog at the requested historical horizon. This stage extracts; it does not write simulation doctrine. Include major powers and strategically distinct movements supported by the supplied witnesses. For each candidate, copy its exact displayed name and 1-3 short, contiguous supporting_claims verbatim from institution-specific source prose. Each claim must establish a durable interest, characteristic method, constraint, refusal, or pressure. Do not use mere index links, shared headings, category descriptions, movement lists, or story-specific incidents. Do not infer current posture, territory, capability inventory, or branch facts. Summarize evidence gaps by class. Return no narrative analysis.\nHORIZON:\n{}\nREQUESTED PLACE (relevance only; not local authority):\n{}\nEVIDENCE:\n{}",
"OUTPUT JSON SCHEMA (follow exactly):\n{}\n\nExtract evidence for the coarse remote strategic agency catalog at the requested historical horizon. This stage extracts; it does not write simulation doctrine. Include major powers and strategically distinct movements supported by the supplied witnesses. For each candidate, copy its exact displayed name and 1-3 short, contiguous supporting_claims verbatim from institution-specific source prose. A claim may establish the institution's existence or identity, or an explicit role, interest, method, constraint, refusal, or pressure. Exact institution-specific evidence of existence is enough to admit a major power; missing operational detail will be compiled later as branch-local doctrine. Do not use mere index links, shared headings, category descriptions, movement lists, or story-specific incidents. Do not infer current posture, territory, capability inventory, or branch facts. Report a material evidence gap only when the witnesses cannot anchor the institution or historical horizon at all, not merely because they omit game-scale doctrine, routes, or daily operations. Return no narrative analysis.\nHORIZON:\n{}\nREQUESTED PLACE (relevance only; not local authority):\n{}\nEVIDENCE:\n{}",
serde_json::to_string(&schema)?,
start.when,
start.where_,
@ -1881,7 +1885,7 @@ impl WorldCompiler {
}).collect::<Vec<_>>();
let synthesis_schema = serde_json::to_value(schema_for!(StrategicDoctrineCatalog))?;
let synthesis_prompt = format!(
"Synthesize one concise strategic_doctrine for every supplied institution. Doctrine is durable simulation state, not flavor prose. State only interests, characteristic methods, constraints, or refusals that follow directly from the supplied exact claims. Every clause, qualifier, motive, contrast, negation, and purpose must be entailed by a claim. Omit a dimension when the claims do not establish it. Prefer a narrow faithful paraphrase over a complete-sounding interpretation. Do not quote mechanically, invent current posture, territory, resources, powers, branch events, generic ideological contrasts, or unstated reasons, and do not merge institutions. Return the same names exactly once and no others. Keep each doctrine under 600 characters.\nHORIZON:\n{}\nGROUNDED CLAIMS:\n{}",
"Synthesize one concise strategic_doctrine for every supplied institution. Doctrine is durable branch-local simulation state, not a claim that the Vault exhaustively specified policy. Preserve every canon anchor in the supplied exact claims, then fill missing operational detail with the smallest coherent interests, characteristic methods, constraints, or refusals needed for this institution to make meaningful strategic decisions at the requested horizon. Compatible elaboration is required and may vary between campaigns; absence from the claims is not itself a gap. Do not contradict or erase a supplied claim, merge institutions, borrow story-specific incidents, assert that an invented detail is sourced canon, or grant setting-breaking power without an anchor. Do not invent a current branch event or posture; those belong to later simulation state. Return the same names exactly once and no others. Keep each doctrine under 600 characters.\nHORIZON:\n{}\nCANON ANCHORS:\n{}",
start.when,
serde_json::to_string(&evidence)?
);
@ -1909,7 +1913,7 @@ impl WorldCompiler {
stage_receipts.push(synthesis_receipt);
if attempt == 0 {
correction = format!(
"\n\nLOCAL VALIDATOR REJECTED THE PREVIOUS DOCTRINE CATALOG: {error}\nReturn one corrected complete catalog against the same GROUNDED CLAIMS."
"\n\nLOCAL VALIDATOR REJECTED THE PREVIOUS DOCTRINE CATALOG: {error}\nReturn one corrected complete catalog against the same CANON ANCHORS."
);
continue;
}
@ -1920,7 +1924,8 @@ impl WorldCompiler {
stage_receipts.push(synthesis_receipt);
let verification_prompt = format!(
"Verify every strategic doctrine strictly against its exact supporting claims. supported is true only when every clause, qualifier, motive, contrast, negation, purpose, interest, method, constraint, and refusal follows from those claims. Reject invented current posture, territory, resources, capabilities, branch events, ideological contrasts, and unstated reasons. Return one verdict for each name exactly once.\nCLAIMS:\n{}\nDOCTRINES:\n{}",
"Verify each strategic doctrine as canon-constrained branch elaboration. compatible_with_canon is true when the doctrine preserves every supplied canon anchor, does not contradict or erase one, does not merge institutions or borrow a story-specific incident, and remains a plausible bounded policy at the requested horizon. The doctrine is intentionally allowed to invent missing operational interests, methods, constraints, refusals, and reasons as branch-local state. Do not reject a clause merely because the anchors are silent about it, and do not pretend an elaboration was stated by the source. Reject actual contradiction, canon erasure, identity conflation, an invented current branch event, or unanchored setting-breaking power. Return one verdict for each name exactly once.\nHORIZON:\n{}\nCANON ANCHORS:\n{}\nBRANCH DOCTRINES:\n{}",
start.when,
serde_json::to_string(&evidence)?,
serde_json::to_string(&synthesized)?
);
@ -1935,33 +1940,33 @@ impl WorldCompiler {
.await?;
let verification: StrategicDoctrineVerification = serde_json::from_value(value)?;
match validate_doctrine_verification(&grounded.institutions, &verification) {
Ok(rejected) if rejected.is_empty() || attempt == 1 => {
if rejected.is_empty() {
stage_receipts.push(verification_receipt);
} else {
let error = doctrine_rejection_error(&rejected);
verification_receipt.validation_result = "valid_with_grounding_gaps".into();
verification_receipt.local_validation_error =
Some(error.to_string().chars().take(1_000).collect());
stage_receipts.push(verification_receipt);
}
let catalog = lower_verified_doctrine_catalog(grounded, synthesized, &rejected);
Ok(incompatible) if incompatible.is_empty() => {
stage_receipts.push(verification_receipt);
let catalog = lower_compatible_doctrine_catalog(grounded, synthesized);
return Ok((catalog, stage_receipts));
}
Ok(rejected) => {
let error = doctrine_rejection_error(&rejected);
Ok(incompatible) if attempt == 0 => {
let error = doctrine_incompatibility_error(&incompatible);
mark_semantic_invalid(&mut verification_receipt, &error);
stage_receipts.push(verification_receipt);
correction = format!(
"\n\nTHE STRICT VERIFIER REJECTED THE PREVIOUS DOCTRINES: {error}\nRewrite the complete catalog against the same GROUNDED CLAIMS. Remove every unsupported clause, qualifier, motive, contrast, negation, purpose, or label identified by the verifier. Do not defend or reinterpret the rejected wording. Prefer the narrowest evidence-entailing paraphrase.\nPREVIOUS DOCTRINES:\n{}",
"\n\nTHE COMPATIBILITY VERIFIER REJECTED THE PREVIOUS BRANCH DOCTRINES: {error}\nRewrite the complete catalog against the same CANON ANCHORS. Remove the contradiction, canon erasure, identity conflation, branch event, or unanchored setting-breaking power identified by the verifier while retaining useful compatible branch elaboration. Do not collapse back to quotation when a playable doctrine can be generated.\nPREVIOUS DOCTRINES:\n{}",
serde_json::to_string(&synthesized)?
);
}
Ok(incompatible) => {
let error = doctrine_incompatibility_error(&incompatible);
mark_semantic_invalid(&mut verification_receipt, &error);
stage_receipts.push(verification_receipt);
return Err(anyhow!(
"strategic doctrine contradicted canon after one correction: {error}"
));
}
Err(error) if attempt == 0 => {
mark_semantic_invalid(&mut verification_receipt, &error);
stage_receipts.push(verification_receipt);
correction = format!(
"\n\nLOCAL VALIDATOR REJECTED THE PREVIOUS DOCTRINE VERIFICATION: {error}\nReturn one corrected verdict for every grounded institution exactly once against the same CLAIMS and DOCTRINES."
"\n\nLOCAL VALIDATOR REJECTED THE PREVIOUS DOCTRINE VERIFICATION: {error}\nReturn one corrected verdict for every grounded institution exactly once against the same CANON ANCHORS and BRANCH DOCTRINES."
);
}
Err(error) => {
@ -2602,18 +2607,25 @@ fn validate_doctrine_verification(
"strategic doctrine verification must cover every grounded institution exactly once"
));
}
if verification.verdicts.iter().any(|verdict| {
verdict.rationale.trim().is_empty() || verdict.rationale.chars().count() > 500
}) {
return Err(anyhow!(
"strategic doctrine verification rationale must contain 1 to 500 characters"
));
}
Ok(verification
.verdicts
.iter()
.filter(|v| !v.supported)
.filter(|v| !v.compatible_with_canon)
.cloned()
.collect())
}
fn doctrine_rejection_error(rejected: &[StrategicDoctrineVerdict]) -> anyhow::Error {
fn doctrine_incompatibility_error(incompatible: &[StrategicDoctrineVerdict]) -> anyhow::Error {
anyhow!(
"strategic doctrine exceeded its evidence: {}",
rejected
"strategic doctrine contradicted its canon anchors: {}",
incompatible
.iter()
.map(|verdict| format!("{}: {}", verdict.name, verdict.rationale))
.collect::<Vec<_>>()
@ -2621,15 +2633,10 @@ fn doctrine_rejection_error(rejected: &[StrategicDoctrineVerdict]) -> anyhow::Er
)
}
fn lower_verified_doctrine_catalog(
mut grounded: GroundedGlobalAgencyCatalog,
fn lower_compatible_doctrine_catalog(
grounded: GroundedGlobalAgencyCatalog,
synthesized: StrategicDoctrineCatalog,
rejected: &[StrategicDoctrineVerdict],
) -> CompiledGlobalAgencyCatalog {
let rejected_names = rejected
.iter()
.map(|verdict| verdict.name.as_str())
.collect::<BTreeSet<_>>();
let doctrines = synthesized
.institutions
.into_iter()
@ -2638,19 +2645,12 @@ fn lower_verified_doctrine_catalog(
let institutions = grounded
.institutions
.into_iter()
.filter(|institution| !rejected_names.contains(institution.name.as_str()))
.map(|institution| CompiledRemoteInstitution {
strategic_doctrine: doctrines[&institution.name].clone(),
name: institution.name,
evidence_receipt_ids: institution.evidence_receipt_ids,
})
.collect();
grounded.gaps.extend(rejected.iter().map(|verdict| {
format!(
"{} was omitted from remote simulation because its strategic doctrine could not be strictly supported after one correction; exact rejection details remain in the private model-stage receipt.",
verdict.name
)
}));
CompiledGlobalAgencyCatalog {
institutions,
gaps: grounded.gaps,
@ -2660,7 +2660,7 @@ fn lower_verified_doctrine_catalog(
fn merge_global_agency_catalog(
seed: &mut CompiledSeed,
catalog: CompiledGlobalAgencyCatalog,
) -> Result<(BTreeMap<String, Vec<String>>, Vec<String>)> {
) -> Result<(BTreeMap<String, Vec<String>>, Vec<String>, Vec<String>)> {
let mut known_names = seed
.institutions
.iter()
@ -2672,6 +2672,7 @@ fn merge_global_agency_catalog(
.map(|institution| institution.id.clone())
.collect::<BTreeSet<_>>();
let mut remote_evidence = BTreeMap::new();
let mut branch_assumptions = Vec::new();
for institution in catalog.institutions {
if !known_names.insert(institution.name.to_lowercase()) {
continue;
@ -2681,6 +2682,10 @@ fn merge_global_agency_catalog(
if !known_ids.insert(id.clone()) {
return Err(anyhow!("global agency institution ID collision"));
}
branch_assumptions.push(format!(
"Campaign-local operational doctrine for {}: {}",
institution.name, institution.strategic_doctrine
));
seed.institutions.push(InstitutionState {
id: id.clone(),
name: institution.name,
@ -2695,7 +2700,7 @@ fn merge_global_agency_catalog(
.into_iter()
.map(|gap| format!("Global agency evidence gap: {gap}"))
.collect();
Ok((remote_evidence, gaps))
Ok((remote_evidence, gaps, branch_assumptions))
}
fn apply_coarse_remote_agency_profiles(
@ -4064,8 +4069,9 @@ mod tests {
struct CorrectionAwareDoctrineModel {
synthesis_calls: AtomicUsize,
saw_entailment_boundary: AtomicBool,
saw_branch_elaboration_boundary: AtomicBool,
saw_verifier_correction: AtomicBool,
stay_incompatible: bool,
}
struct PrivateBoundaryCompilerModel {
@ -4309,44 +4315,48 @@ mod tests {
async fn run(&self, request: &ModelStageRequest) -> Result<String> {
match request.stage.as_str() {
"global_agency_doctrine_synthesis" => {
self.saw_entailment_boundary.store(
request
.lived_stream
.contains("Every clause, qualifier, motive, contrast, negation, and purpose must be entailed"),
self.saw_branch_elaboration_boundary.store(
request.lived_stream.contains(
"Compatible elaboration is required and may vary between campaigns",
),
Ordering::SeqCst,
);
let call = self.synthesis_calls.fetch_add(1, Ordering::SeqCst);
if call == 0 {
return Ok(serde_json::json!({"institutions":[{
"name":"Fixture Council",
"strategic_doctrine":"Maintain the shared route as a civic duty rather than private profit."
"strategic_doctrine":"Abandon the shared route and destroy every crossing."
}]}).to_string());
}
self.saw_verifier_correction.store(
request
.lived_stream
.contains("THE STRICT VERIFIER REJECTED THE PREVIOUS DOCTRINES")
&& request.lived_stream.contains("rather than private profit")
request.lived_stream.contains(
"THE COMPATIBILITY VERIFIER REJECTED THE PREVIOUS BRANCH DOCTRINES",
) && request.lived_stream.contains("Abandon the shared route")
&& request
.lived_stream
.contains("Remove every unsupported clause"),
.contains("retaining useful compatible branch elaboration"),
Ordering::SeqCst,
);
let doctrine = if self.stay_incompatible {
"Abandon the shared route and destroy every crossing."
} else {
"Maintain the shared route through rotating repair crews, convoy permits, and temporary rationing during breakdowns."
};
Ok(serde_json::json!({"institutions":[{
"name":"Fixture Council",
"strategic_doctrine":"Maintain the shared route."
"strategic_doctrine":doctrine
}]})
.to_string())
}
"global_agency_doctrine_verification" => {
let rejected = request.lived_stream.contains("rather than private profit");
let rejected = request.lived_stream.contains("Abandon the shared route");
Ok(serde_json::json!({"verdicts":[{
"name":"Fixture Council",
"supported":!rejected,
"compatible_with_canon":!rejected,
"rationale":if rejected {
"The private-profit contrast is absent from the exact claim."
"Abandoning the route contradicts the supplied maintenance anchor."
} else {
"Every clause follows from the exact claim."
"The route remains maintained; operational methods are compatible branch elaboration."
}
}]})
.to_string())
@ -4453,8 +4463,8 @@ mod tests {
"global_agency_doctrine_verification" => serde_json::json!({
"verdicts":[{
"name":"Fixture Council",
"supported":true,
"rationale":"The doctrine restates the exact maintenance claim without adding posture or capability."
"compatible_with_canon":true,
"rationale":"The doctrine preserves the maintenance anchor."
}]
}).to_string(),
"world_openings" => serde_json::json!({"openings":[
@ -5100,11 +5110,12 @@ mod tests {
}
#[tokio::test]
async fn doctrine_stage_rewrites_unsupported_interpretation_once() {
async fn doctrine_stage_rewrites_canon_contradiction_but_keeps_branch_elaboration() {
let model = Arc::new(CorrectionAwareDoctrineModel {
synthesis_calls: AtomicUsize::new(0),
saw_entailment_boundary: AtomicBool::new(false),
saw_branch_elaboration_boundary: AtomicBool::new(false),
saw_verifier_correction: AtomicBool::new(false),
stay_incompatible: false,
});
let compiler = WorldCompiler::new(vault(), model.clone(), "flash", "pro");
let start = CustomStart {
@ -5131,7 +5142,7 @@ mod tests {
assert_eq!(catalog.institutions.len(), 1);
assert_eq!(
catalog.institutions[0].strategic_doctrine,
"Maintain the shared route."
"Maintain the shared route through rotating repair crews, convoy permits, and temporary rationing during breakdowns."
);
assert_eq!(
receipts
@ -5147,10 +5158,46 @@ mod tests {
);
assert!(receipts[1].local_validation_error.is_some());
assert!(receipts[3].local_validation_error.is_none());
assert!(model.saw_entailment_boundary.load(Ordering::SeqCst));
assert!(model.saw_branch_elaboration_boundary.load(Ordering::SeqCst));
assert!(model.saw_verifier_correction.load(Ordering::SeqCst));
}
#[tokio::test]
async fn doctrine_stage_aborts_instead_of_omitting_an_incompatible_institution() {
let model = Arc::new(CorrectionAwareDoctrineModel {
synthesis_calls: AtomicUsize::new(0),
saw_branch_elaboration_boundary: AtomicBool::new(false),
saw_verifier_correction: AtomicBool::new(false),
stay_incompatible: true,
});
let compiler = WorldCompiler::new(vault(), model, "flash", "pro");
let start = CustomStart {
campaign_name: "Doctrine refusal".into(),
who: "worker".into(),
where_: "yard".into(),
when: "fixture".into(),
goal: "keep the route open".into(),
};
let grounded = GroundedGlobalAgencyCatalog {
institutions: vec![GroundedRemoteInstitution {
name: "Fixture Council".into(),
supporting_claims: vec!["The Fixture Council maintains the shared route.".into()],
evidence_receipt_ids: vec!["receipt:fixture".into()],
}],
gaps: vec![],
};
let error = compiler
.synthesize_global_agency_doctrine(&start, grounded)
.await
.unwrap_err();
assert!(
error
.to_string()
.contains("contradicted canon after one correction")
);
}
#[tokio::test]
async fn retrieval_planner_refuses_provider_oversized_queries() {
let compiler = WorldCompiler::new(vault(), Arc::new(OversizedQueryModel), "flash", "pro");
@ -5554,7 +5601,7 @@ mod tests {
}
#[test]
fn strategic_doctrine_requires_exact_coverage_and_surfaces_semantic_rejections() {
fn strategic_doctrine_requires_exact_coverage_and_classifies_canon_compatibility() {
let grounded = vec![GroundedRemoteInstitution {
name: "Fixture Council".into(),
supporting_claims: vec!["The Fixture Council maintains the route.".into()],
@ -5567,20 +5614,33 @@ mod tests {
}],
};
validate_doctrine_catalog(&grounded, &doctrine).unwrap();
let rejected = StrategicDoctrineVerification {
let incompatible = StrategicDoctrineVerification {
verdicts: vec![StrategicDoctrineVerdict {
name: "Fixture Council".into(),
supported: false,
rationale: "The doctrine invented territorial control.".into(),
compatible_with_canon: false,
rationale: "Abandoning the route contradicts its maintenance anchor.".into(),
}],
};
let rejected = validate_doctrine_verification(&grounded, &rejected).unwrap();
assert_eq!(rejected.len(), 1);
assert_eq!(rejected[0].name, "Fixture Council");
let incompatible = validate_doctrine_verification(&grounded, &incompatible).unwrap();
assert_eq!(incompatible.len(), 1);
assert_eq!(incompatible[0].name, "Fixture Council");
let compatible = StrategicDoctrineVerification {
verdicts: vec![StrategicDoctrineVerdict {
name: "Fixture Council".into(),
compatible_with_canon: true,
rationale: "Convoy permits are compatible branch-local operating detail.".into(),
}],
};
assert!(
validate_doctrine_verification(&grounded, &compatible)
.unwrap()
.is_empty()
);
}
#[test]
fn rejected_remote_doctrine_becomes_a_gap_without_admitting_the_institution() {
fn compatible_remote_doctrines_retain_every_institution_and_surface_branch_assumptions() {
let grounded = GroundedGlobalAgencyCatalog {
institutions: vec![
GroundedRemoteInstitution {
@ -5600,7 +5660,8 @@ mod tests {
institutions: vec![
SynthesizedRemoteInstitution {
name: "Fixture Council".into(),
strategic_doctrine: "Control all roads through military force.".into(),
strategic_doctrine:
"Maintain the route through repair crews and convoy permits.".into(),
},
SynthesizedRemoteInstitution {
name: "Witness Guild".into(),
@ -5608,23 +5669,27 @@ mod tests {
},
],
};
let rejected = vec![StrategicDoctrineVerdict {
name: "Fixture Council".into(),
supported: false,
rationale: "The claim does not establish military force.".into(),
}];
let compiled = lower_verified_doctrine_catalog(grounded, synthesized, &rejected);
assert_eq!(compiled.institutions.len(), 1);
assert_eq!(compiled.institutions[0].name, "Witness Guild");
let compiled = lower_compatible_doctrine_catalog(grounded, synthesized);
assert_eq!(compiled.institutions.len(), 2);
assert_eq!(compiled.institutions[0].name, "Fixture Council");
assert_eq!(
compiled.institutions[0].evidence_receipt_ids,
vec!["vault:guild"]
vec!["vault:council"]
);
assert!(compiled.gaps.iter().any(|gap| {
gap.contains("Fixture Council was omitted")
&& gap.contains("private model-stage receipt")
let mut seed = private_actor_test_seed();
let (evidence, gaps, assumptions) =
merge_global_agency_catalog(&mut seed, compiled).unwrap();
assert_eq!(evidence.len(), 2);
assert_eq!(
gaps,
vec!["Global agency evidence gap: The exact horizon remains uncertain."]
);
assert_eq!(assumptions.len(), 2);
assert!(assumptions.iter().any(|assumption| {
assumption.contains("Campaign-local operational doctrine for Fixture Council")
&& assumption.contains("convoy permits")
}));
assert_eq!(seed.institutions.len(), 2);
}
#[test]

15
docs/architecture/ghostlight-dungeon-mvp.md
View file

@ -35,7 +35,8 @@ The Rust runtime contains a Session Zero-owned world-compiler seam:
- a separate Flash-model lane uses two stable broad retrieval queries to
extract witnessed remote institutions in parallel with local evidence
classification. A Pro synthesis stage turns exact supporting claims into a
concise strategic doctrine; local verification rejects unsupported doctrine;
concise branch-local strategic doctrine; local verification rejects canon
contradiction while allowing compatible operational elaboration;
- remote institutions begin with deterministic six-axis profiles: their own
authority boundary and explicit unknown geography, ideology, economic role,
body, and information scope. Fine resources, channels, relations, and current
@ -596,10 +597,14 @@ fictional causality.
The remote catalog is not a back door into the local seed. Extraction proposes
named institutions plus exact supporting claims. Synthesis writes one concise
strategic doctrine from those claims, and a separate verifier must accept it.
Unsupported or oversized entries become approval-preview gaps rather than
institutions. This lets the campaign represent distant powers without importing
another story's current cast, incident, or arbitrary excerpt as behavior.
branch-local strategic doctrine constrained by those claims, and a separate
verifier must accept its compatibility with canon. Missing policy detail is not
a gap: the campaign needs operational state even when the Vault is silent.
Contradiction receives one correction and then aborts without mutation; it does
not erase an anchored institution. Generated doctrines are approval-visible
branch assumptions. Oversized catalog entries remain on-demand coverage gaps.
This lets the campaign represent distant powers without importing another
story's current cast, incident, or arbitrary excerpt as behavior.
The coarse profile is intentionally sparse. Asking the Pro agency compiler to
repeat six semantic axes for every remote power exhausted output tokens while

17
notes/fresh-workspace-handoff.md
View file

@ -373,14 +373,15 @@ movement authority. CodexConnector change
`80de3acc18e058f649c3b25ce617f8869f038670`, also gives streamed responses the
full body deadline instead of accidentally capping them at the header timeout.
The first repaired-topology retry reached remote-agency doctrine verification.
One Cognitum summary still overclaimed its exact source after correction, and
the old path aborted the entire seed. That contradicted catalog authority:
remote candidates are optional bounded strategic coverage, not local-world
admission owners. A well-formed final semantic rejection now omits only that
institution, emits an explicit evidence gap, and retains the exact rationale
privately. Malformed or incomplete verifier output still aborts without
mutation.
The retained preview exposed an over-constrained remote-doctrine cut: it treated
the Vault as an exhaustive specification and omitted Pan-Solar Consortium when
its playable policy could not be textually entailed. The compiler now treats
exact institution evidence as canon anchors and synthesizes compatible
campaign-local doctrine around them. The verifier rejects contradiction,
identity conflation, story borrowing, and unanchored setting-breaking power;
mere source silence is not a rejection. Every anchored institution survives,
its generated doctrine appears as an approval-visible branch assumption, and a
second contradictory result aborts the whole compile without mutation.
`F:\Projects\Kalsa` is a purpose-built fantasy Vault candidate with player-safe
`Public` lore and GM-only `Spoilers`. It is not indexed or selectable yet. The

20
notes/ghostlight-current-system-map.md
View file

@ -794,16 +794,18 @@ queries run alongside local retrieval, and a Flash extraction stage proposes a
bounded pool of remote institution names with one to three exact supporting
claims each. Local code binds every retained claim to an institution-specific
witness. Only the grounded candidates, capped at 32, enter a separate Flash
synthesis stage. It writes concise strategic doctrine from those claims; an
independent verifier rejects unsupported doctrine.
Unsupported entries become summarized approval gaps and private receipt detail;
they do not become canonical institutions or canon-candidate records.
synthesis stage. It preserves those canon anchors while generating the smallest
useful campaign-local doctrine needed for strategic action. An independent
verifier checks compatibility rather than textual entailment: source silence is
allowed, while contradiction, canon erasure, identity conflation, story-specific
borrowing, current branch events, and unanchored setting-breaking power are not.
Verification must still cover every grounded institution exactly once; a
malformed or incomplete verdict retries once and then aborts. After one faithful
synthesis correction, an individually rejected doctrine removes only that
remote institution, adds a player-reviewable coverage gap, and retains the
semantic rationale in the private stage receipt. Admitted remote institutions
receive deterministic coarse profiles with distinct
synthesis correction, a still-incompatible doctrine aborts compilation rather
than deleting an anchored power. Compatible doctrine becomes campaign state and
an approval-visible branch assumption. Exact receipts anchor the institution and
its canon constraints; they do not falsely certify the generated policy as
Vault text. Admitted remote institutions receive deterministic coarse profiles with distinct
authority and explicit unknown facets. The Pro agency stage profiles only local
actors, populations, and institutions where semantic subdivision is useful.
The model schema permits a bounded pool of 64 candidates so provider overage
@ -815,7 +817,7 @@ world compile. A supporting claim is institution-specific only when its quotatio
exactly that candidate or comes from the candidate's dedicated source document;
shared index headings, category descriptions, cross-faction lists, and orphaned
sentence fragments are rejected. Exact claims and receipts remain evidence;
synthesized strategic doctrine alone becomes coarse simulation goals.
synthesized strategic doctrine becomes branch-local coarse simulation goals.
The Aetheria Vault adapter derives document authority from the exact source
path before any model sees a witness. `Worldbuilding` is reusable canon;

15
notes/ghostlight-implementation-plan.md
View file

@ -84,12 +84,15 @@ separate stages; Projectors receive situation state while Interpreters receive
exact permissions; deterministic cell bindings are attached by the runtime.
Remote agency compilation is a separate non-causal Flash pipeline: extraction
proposes exact institution-specific claims, local code binds them to witnesses,
and only grounded candidates receive synthesized strategic doctrine. A separate
semantic verifier must accept each doctrine against those claims before it can
become a coarse goal. Structurally malformed verification still aborts after
one correction. A well-formed semantic rejection receives one synthesis retry;
if the same institution remains unsupported, only that candidate becomes an
explicit coverage gap while the rest of the grounded catalog proceeds.
and only grounded candidates receive synthesized strategic doctrine. Exact
claims constrain canon; they do not have to exhaustively specify playable
policy. A separate semantic verifier accepts compatible branch elaboration and
rejects contradiction, canon erasure, identity conflation, story borrowing,
current branch events, or unanchored setting-breaking power. Structurally
malformed verification still aborts after one correction. A semantic rejection
receives one synthesis retry; a second rejection aborts the compile without
omitting the anchored institution. Compatible doctrine becomes a coarse goal
and an approval-visible branch assumption.
Deterministic remote profiles keep unknown facets unknown. The Pro
agency stage no longer spends output tokens restating remote profiles.

7
state/map.yaml
View file

@ -102,7 +102,8 @@ live_architecture:
- Structured validation failures retain stage name plus exact instance and schema JSON pointers in private diagnostics. Public strategic refusals remain spoiler-free; model output and chain-of-thought do not become logs or state authority.
- A structured same-snapshot retry receives only the nearest rejected containing object beside the exact schema pointer, not the full rejected response. Parallel strategic failures retain the exact simulation cell, constituent IDs, and bounded causal chain in operator-only diagnostics while public receipts remain spoiler-free.
- Cell Projector perspective ownership is schema-bound to exact constituents and selected member exceptions. Ghostlight lowers unique subject-keyed segments into name/location prose and requires the debt-selected focus before the Persona sees the stream.
- Local world compilation sees direct-seed evidence only. A separate Flash lane extracts exact supporting claims for coarse remote institutions; Pro synthesizes concise strategic doctrine and a semantic verifier rejects unsupported doctrine into non-canonical approval gaps.
- Local world compilation treats direct-seed evidence as canon constraints rather than an exhaustive game map. Missing room-scale geometry, routes, people, procedures, and operational doctrine become explicit branch-local elaboration; only contradiction, an unanchored requested baseline, or a premise-changing ambiguity becomes a material gap.
- A separate Flash lane extracts exact institution anchors for coarse remote powers. Pro synthesizes playable branch-local strategic doctrine; an independent verifier accepts compatible elaboration, rejects actual canon contradiction, and can never delete an anchored institution into a gap. Every admitted remote doctrine is disclosed in the approval preview as a branch assumption.
- Strict provider schemas never receive canonical dynamic route, relationship, facet, assignment, or demand-weight maps. Model-facing records carry explicit semantic IDs or fixed axis fields; local validation rejects duplicates and lowers once into the canonical maps. This prevents strict-schema projection from silently turning open maps into empty closed objects.
- Remote institutions receive deterministic six-axis coarse profiles with distinct self-authority and explicit unknown facets. The Pro agency compiler profiles only locally materialized subjects; finer remote state compiles on demand.
- Model-stage receipts expose per-attempt provider identity, latency, validation errors, and prompt/completion/cache token usage without storing reasoning content.
@ -312,6 +313,6 @@ data_flow:
- If state grows faster than understanding, cut it back.
current_status:
summary: Yggdrasil serves immutable Ghostlight release bd4758894c1f81df13a048fa82ca4511fe6d4245 with Eve 19c3dcf9173dce848a6253e975324ea239a02d24, daemon SHA-256 0fb4e27c56a1d331d77335ce959ed5937040636da081e4c016602bc073a8c3de, native-client SHA-256 13ddda694161be9a81b914421b54a3405027f6c389f34080dee95f1acbf1b07d, artifact sha256-84893208abc846ece10f1fb2c4748a0d1ce60b77e4951c30cffb544825193466, and independent CodexConnector release 80de3acc18e058f649c3b25ce617f8869f038670. Idunn passed 312 tests, built the locked Linux release, selected it atomically, and left both zero-restart services healthy. Nightwing again serves qwen3-embedding:0.6b over WireGuard and the real VoidBot MCP returns grounded Aetheria witnesses. Native Session Zero e7f2f947-25fa-4e1b-82e3-4a3e07dc4497 is unpublished at revision 55 with its exact Mars/Zhestokost contract, poem-length Corvid identity, private state, and bounded extraordinary permission intact. Retained preview digest sha256:01f07d0f5bc453151743dab77821d64a28d0505e82bd905aa335d45525e51d83 has four strongly connected locations, three actors, one Gestalt, two clocks, explicit evidence gaps, and no First Exodus cast or geometry. The active nine-stage receipt set has no duplicate keys; world_compile and agency_compile validated, and a final unsupported Pan-Solar doctrine became a gap rather than canonical state or a whole-seed failure. No campaign has been published. Existing mutation, Gestalt, topology, knowledge, privacy, approval, no-puppeting, and atomicity invariants remain authoritative. Starfire remains retired as a writer and build host.
next_action: The host must review the exact revision-55 Mars preview and decide whether its branch-local hub, date, local cast, and incident assumptions are acceptable; do not approve or publish the retained digest automatically. After explicit approval and publication, inspect the canonical six-axis agency profiles and first resolution cover, then pressure foreground resolution, away-time news, a 20-plus-power Aetheria skeleton, and nested refugee continuity across budgets 1, 4, 8, and 32. Admit Kalsa only through a selectable typed Vault manifest preserving Public and Spoilers lanes. Continue expanding the 36-case agency corpus toward 300 reviewed cases and run multi-account co-op proof. Preserve actor, privacy, approval, atomicity, topology, knowledge, and no-puppeting invariants; use Idunn on Yggdrasil for every package build and deployment.
summary: Yggdrasil serves immutable Ghostlight release bd4758894c1f81df13a048fa82ca4511fe6d4245 with Eve 19c3dcf9173dce848a6253e975324ea239a02d24, daemon SHA-256 0fb4e27c56a1d331d77335ce959ed5937040636da081e4c016602bc073a8c3de, native-client SHA-256 13ddda694161be9a81b914421b54a3405027f6c389f34080dee95f1acbf1b07d, artifact sha256-84893208abc846ece10f1fb2c4748a0d1ce60b77e4951c30cffb544825193466, and independent CodexConnector release 80de3acc18e058f649c3b25ce617f8869f038670. Idunn passed 312 tests, built the locked Linux release, selected it atomically, and left both zero-restart services healthy. Nightwing again serves qwen3-embedding:0.6b over WireGuard and the real VoidBot MCP returns grounded Aetheria witnesses. Native Session Zero e7f2f947-25fa-4e1b-82e3-4a3e07dc4497 is unpublished at revision 55 with its exact Mars/Zhestokost contract, poem-length Corvid identity, private state, and bounded extraordinary permission intact. Retained preview digest sha256:01f07d0f5bc453151743dab77821d64a28d0505e82bd905aa335d45525e51d83 has four strongly connected locations, three actors, one Gestalt, two clocks, explicit evidence gaps, and no First Exodus cast or geometry. That preview was compiled by the superseded entailment rule and omitted Pan-Solar Consortium; it is retained as evidence but must not be approved or published. No campaign has been published. Existing mutation, Gestalt, topology, knowledge, privacy, approval, no-puppeting, and atomicity invariants remain authoritative. Starfire remains retired as a writer and build host.
next_action: Finish, test, and deploy the canon-constrained branch-elaboration compiler through Idunn on Yggdrasil, then retire and recompile the exact revision-55 Mars preview before player review. The replacement must preserve anchored powers including Pan-Solar Consortium, expose generated operational doctrines as branch assumptions, keep routes and playable local detail as stable branch truth, and still reject actual canon contradiction without partial mutation. After explicit approval and publication, inspect the canonical six-axis agency profiles and first resolution cover, then pressure foreground resolution, away-time news, a 20-plus-power Aetheria skeleton, and nested refugee continuity across budgets 1, 4, 8, and 32. Admit Kalsa only through a selectable typed Vault manifest preserving Public and Spoilers lanes. Continue expanding the 36-case agency corpus toward 300 reviewed cases and run multi-account co-op proof. Preserve actor, privacy, approval, atomicity, topology, knowledge, and no-puppeting invariants; use Idunn on Yggdrasil for every package build and deployment.
gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Materialisation/folding changes only representation and the exact member delta, advances resolution epoch, and retires the old cover; it has no Gestalt-wide effect authority. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.