Steer map and handoff to the live deploy and the fix list

Dungeon is live on Yggdrasil under Idunn v2 (454fc33); the operator ruled
"Stop here, we have shit to fix". Next action is PA.f211-f216 in order,
then the owed Soul pass; legacy-served and deploy-next text retired.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Meta Vens 2026-09-23 22:21:30 +02:00
commit eeb3a68042
2 changed files with 79 additions and 97 deletions

View file

@ -103,14 +103,15 @@ is the witness. What is true of the tree now:
`crates/ghostlight/src/controllers.rs`.
- The Idunn provider side is complete: the runtime validates Expected and
activation, publishes signed Warming until the write lease arrives, and
exposes managed route presence. Production has not cut over.
exposes managed route presence. Idunn v2 serves it on Yggdrasil since
2026-09-23.
- Plan steps 6 and 8 through 14 are landed with their follow-ups: the ten
ontology passes, the seed producer, interruption, witness, and the Claude
SDK inference port. `notes/ghostlight-implementation-plan.md` carries each
step's landed state; the ontology doc carries the mechanism.
Do not start another world acceptance run while Yggdrasil still serves the
legacy executable and state layout.
World acceptance and scale runs stay gated by `state/map.yaml`
`current_status.scale_checkpoint`.
## Immutable failure evidence
@ -130,16 +131,19 @@ measure only.
## Operational boundary
Yggdrasil still serves legacy Ghostlight release `a4080d4` from an enabled
`Restart=always` unit with health v1, campaign/Session Zero state, and no
`world.cc` or `app-sessions-v2.cc` witness. The Connector is also still on its
legacy enabled body. CultNet through CultLib `85f7024` owns generation-bound
Ghostlight Dungeon is live on Yggdrasil under Idunn v2 at
`https://yggdrasil.gamecult.org/ghostlight/` (runtime `ghostlight-yggdrasil`,
state root `/var/lib/gamecult/ghostlight-world-v2`); `/health` names the served
commit. The legacy `ghostlight-dungeon.service` is stopped, its old state
untouched; the v1 actuator, unit, wiring test and that state are retired in
fact and owed deletion. The deploy and play session are recorded in the
play-agent cut map block "The first deploy, 2026-09-23 (PA.f198-PA.f216)".
CultNet through CultLib `85f7024` owns generation-bound
activation, separate lifecycle brakes, process-write leases, observed
capabilities, explicit disagreement, and routed RUDP incarnations. Odin through
pushed `65cf2b2` owns deterministic recipe and binding admission, exact source
freezing, sealed releases, durable deployment transactions, and the narrow
native actuator ports. Current uncommitted Odin integration moves Idunn-owned
projection and multi-session RUDP transport into those live paths.
native actuator ports.
Ghostlight pushed `6a79cb0` with the provider side of this cut. Its recipe
requests Idunn's runtime bundle, candidate bind, protected activation and
@ -147,9 +151,8 @@ provider credentials, process-write-lease path, and admitted state-root
binding. The runtime validates Expected and activation, publishes signed
Warming, waits for the exact process lease before opening state, keeps that
lease current through bind, Active publication, and serving, republishes Warming
until the lease arrives, and exposes its managed route presence. CodexConnector
pushed `ede3c30` with the corresponding stateless provider contract. Neither
service has been admitted through rebuilt Idunn yet.
until the lease arrives, and exposes its managed route presence. Idunn v2 admitted it
on 2026-09-23.
The adopted cut puts a visible recipe with a constrained launch declaration in
each target repo; raw unit or container-runtime templates are rejected. The
@ -257,21 +260,16 @@ acceptance test `real_local_model_cognition_modes_commit_speech` in
`POST /v1/chat/completions` to a loopback endpoint, no credential, inert
tool calls. It opens only when `GHOSTLIGHT_LOCAL_ENDPOINT` is set
(`runtime.rs`), and claims models by the `GHOSTLIGHT_LOCAL_MODEL_PREFIX`
prefix, default `local/`. No model has been run behind it yet.
prefix, default `local/`. Bonsai 2 is the live model behind it.
- Topology (operator ruling 2026-09-23, "put each of the organs on the right
machine"): the playtest's Dungeon runs on Yggdrasil beside Heimdall,
deployed by Idunn through the `ghostlight` binding (Dungeon unit only) at
ref `codex/ghostlight-dungeon-mvp`. Bonsai 2 stays on Raven's GPU and is
reached at Yggdrasil loopback `127.0.0.1:18080` through a restricted-key
reverse SSH tunnel over the WireGuard mesh, kept up by a Raven scheduled
task. Local inference and Heimdall's private plane stay loopback-only.
The Raven-hosted Dungeon (task `GhostlightDungeon`, `C:\Meta\ghostlight`,
`deployment/raven/start-ghostlight-raven.ps1`) is a detour being retired.
`gamecult-ops` owns the actuator, runbook and link; its
`scripts/deploy-ghostlight-yggdrasil.sh` and
`runbooks/ghostlight-dungeon-yggdrasil.md` are still bound to
CodexConnector, and cutting that binding for the local link is the next
action.
machine"): Dungeon runs on Yggdrasil beside Heimdall under Idunn v2, binding
`ghostlight` (Dungeon unit only), ref `codex/ghostlight-dungeon-mvp`.
Bonsai 2 stays on Raven's GPU and reaches Yggdrasil loopback
`127.0.0.1:18080` through Raven's `BonsaiLink` task. Local inference and
Heimdall's private plane stay loopback-only. Heimdall is discovered through
Odin at use, not an Idunn dependency, until it is a v2 target. The owner
of deploy, link and verification is gamecult-ops
`runbooks/ghostlight-dungeon-yggdrasil.md`.
- CodexConnector is not an option for Dungeon inference (operator,
2026-09-23). It is a deliberately isolated Codex fork so that Epiphany
stops compiling Codex; nothing goes into it, and its `main` stays at
@ -287,11 +285,11 @@ acceptance test `real_local_model_cognition_modes_commit_speech` in
### In order
1. The playtest gate below (operator order 2026-09-15; redirected to the
play agent 2026-09-22).
1. The fix list from the first play session (operator, 2026-09-23: "Stop
here, we have shit to fix"): see "Playtest gate" below.
2. The outbound half of the consumer contract: the response batch with a
non-loopback CultMesh lease.
3. The deployment gate below.
3. Deleting the retired v1 deployment body (see "Deployment" below).
4. Integration of the elaborator swarm's ideas (see "World fixtures and
the elaborator swarm" below).
@ -314,9 +312,14 @@ table owns the turn lifecycle (Cut 8); the Eve play surface replaced
`world.speak` (Cut 9); and the client round trip was exercised for the first
time through a real lowering, which is where the answer path, the question
token and the store migrations came from (Cuts 10 to 14). Soul's verdict after
Cuts 12 and 13 is ready to play with one preflight. The unverified leg is
seeding: `GHOSTLIGHT_SEED_VAULT_ROOT` has not been run end to end and appears
in no runbook.
Cuts 12 and 13 is ready to play with one preflight.
The first play session ran on Yggdrasil on 2026-09-23 and did not pass the
gate. The fix list, in order, is PA.f212, PA.f211, PA.f213, PA.f214,
PA.f215, PA.f216, then one Soul pass over Ghostlight `1fd52b7` onward plus
Heimdall `e8e2832`, Odin `96a55ec` and Idunn `9ede4cd`. Each finding and its
owner is in the cut map block "The first deploy, 2026-09-23
(PA.f198-PA.f216)"; do not restate them here.
Operator rulings, 2026-09-22. One Dungeon-owned operational agent dispatches
and interprets Persona turns, prompts the player, and negotiates results. It
@ -400,31 +403,15 @@ merge. The retired first-generation loop under
is deferred: workers emit imagegen-ready prompts only, and
`scripts/generate_bfl_images.py` has no working default key path.
### Deployment gate
### Deployment
Deferred behind the orders above, not cancelled:
Review and subtract the uncommitted Idunn-owned Expected/activation/anchor/lease
projection and bounded multi-session RUDP document transport. Repoint Odin off
its vendored CultNet fork onto CultLib `85f7024` as Ghostlight did, add UDP
route actuation plus an independently persisted post-reload data-plane
observation through the existing proxy, and verify that focused body on
Yggdrasil. Then implement the directly managed Rust Odin that
alone authenticates runtime observation into Present and derives Ready, plus
exact capability dependency closure frozen inside the existing deployment
transaction. Do not add another scheduler, registry, inbox, or shared-file
correlation owner.
Install rebuilt Idunn and admit Odin first through the same
Expected/Present/Ready contract, using its exact candidate only to bootstrap the
evidence transport. Then admit Ghostlight Dungeon; CodexConnector is not its dependency. Same-generation
continuity, route preservation, split-brain fencing, signed health, Odin-outage
freeze, and negative legacy-authority checks must all agree before purge.
Deploy Ghostlight Dungeon through that contract. Runtime restart,
route continuity, signed health, exact receipts, exclusive world-v3 state, and
negative checks must agree before deleting old services, releases, state,
acceptance roots, and local run scaffolding.
Idunn v2 is the only deploy path (`idunn up ghostlight`, per gamecult-ops
`runbooks/ghostlight-dungeon-yggdrasil.md`). Still owed on Ghostlight's side:
deleting the retired v1 actuator, unit, wiring test and legacy
`ghostlight-dungeon.service` state, and subtracting the library's
CodexConnector transport. Idunn, Odin, CultLib and Heimdall follow-ups belong
to those owners and are listed under "Open, other owners" in the cut map
block "The first deploy, 2026-09-23 (PA.f198-PA.f216)".
## Essential references
@ -458,9 +445,9 @@ acceptance roots, and local run scaffolding.
strict struct or fixture. Read the owner's published contract (pinned
schema, owner-emitted samples) and prove each direction against the real
counterpart. PA.f196 and PA.f197 in the play-agent cut map are the cost.
- Do not invoke the current bounded Connector or Ghostlight redeploy helpers;
they fail at the root/Idunn Git boundary and still embody duplicate target
deployment authority.
- Deploy only through Idunn v2. Do not invoke the retired v1 actuator
(gamecult-ops `scripts/deploy-ghostlight-yggdrasil.sh`), its wiring test, or
`ghostlight-dungeon.service`; they are owed deletion, not use.
- Do not prove world-v3 purity with a short deny list. Archive the complete old
state root or validate a complete allowed-path contract.
- Keep this handoff compact. Move chronology to Git, evidence, or the frozen

View file

@ -100,7 +100,7 @@ live_architecture:
- A sealed plan and release produce only Idunn's sanitized Expected incarnation. The service owns its signed runtime presence and health claim. Odin alone authenticates that observation into Present, correlates Expected and Present, and derives Ready. For writable state, Idunn grants the process-bound write lease before the service opens state. Stable route membership may move only after Ready; route membership and the write lease remain separate authorities. Expected, Present, Ready, and any disagreement remain distinct typed facts.
- Typed target, action, exact source, recipe digest, runner binding, and deployment identity replace raw persisted shell-command authority. Source fetch and recipe materialization run as the Idunn identity; a narrow privileged boundary consumes sealed inputs and cannot interpret branch heads or mutable worktrees.
- CultNet through CultLib `85f7024` owns generation-bound dual-proof runtime activation, separate lifecycle brakes, process-write leases, provider-observed capabilities, explicit Expected/observed disagreement, and routed RUDP incarnation admission. Odin through pushed commit `65cf2b2` owns deterministic recipe and binding admission, exact source freezing, sealed releases, durable deployment transactions, and narrow native actuator ports. Its current uncommitted integration is moving Idunn-owned projection and multi-session RUDP transport into those live paths.
- Ghostlight pushed commit `6a79cb0` implements its provider side: the recipe requests Idunn's runtime bundle, candidate bind, protected activation and provider credentials, process-write-lease path, and admitted state-root binding; the runtime validates Expected and activation, publishes signed Warming, waits for the exact process lease before opening state, and keeps that lease current through bind, Active publication, and serving. It republishes signed Warming for as long as the lease is outstanding and exposes its managed route presence for correlation. CodexConnector pushed commit `ede3c30` implements the corresponding stateless provider contract. Neither service has been admitted through the rebuilt live Idunn body yet.
- Ghostlight pushed commit `6a79cb0` implements its provider side: the recipe requests Idunn's runtime bundle, candidate bind, protected activation and provider credentials, process-write-lease path, and admitted state-root binding; the runtime validates Expected and activation, publishes signed Warming, waits for the exact process lease before opening state, and keeps that lease current through bind, Active publication, and serving. It republishes signed Warming for as long as the lease is outstanding and exposes its managed route presence for correlation. CodexConnector pushed commit `ede3c30` implements the corresponding stateless provider contract. Idunn v2 admitted Ghostlight Dungeon on 2026-09-23; CodexConnector is not a Dungeon dependency.
- The control plane has exactly three durable record classes: an operator command with one frozen dependency order and exact recipe/source inputs, a crash-resumable transaction, and one CAS-owned admitted generation per target. Transactions persist Sealing, Starting, Warming, Fencing, Leasing, AwaitingReady, Routing, Committing, and Complete before their effects. Stateless targets skip only fencing and leasing. Deployment authorization is consumed once at Sealing to Starting. Continuity uses its lifecycle brake and CAS-updates the physical incarnation and monotonic continuity epoch inside the same generation; it does not perform semantic admission.
- Idunn bootstraps and recovers from its own durable admitted state. Odin is the first managed daemon and the root of the managed semantic graph, never an Idunn startup prerequisite. First-Odin admission still publishes Expected and requires the same signed Present and Ready facts; only the evidence transport is bootstrapped by querying that exact candidate directly. Every other candidate is correlated through the already-admitted Odin stable route.
- Current Nginx route observation is control-plane evidence only: it binds the rendered membership digest to the on-disk fragment and a post-reload `nginx -T` parse. It does not prove that live workers adopted the generation or that packets reach the exact candidate. Fence clearance and incumbent drain therefore require a separately persisted data-plane observation bound to the route, runtime instance, candidate endpoint, and membership digest.
@ -226,7 +226,7 @@ pre_rebuild_architecture:
- Institution, faction, and consumer decision models
active_subgoals:
- Finish and verify the smallest Idunn-owned Expected/activation/anchor/lease projection and shared bounded RUDP document transport, then land a directly managed Rust Odin that owns signed runtime observation and Expected/Present/Ready correlation. Resolve exact capability dependency closure inside the existing deployment transaction, add UDP stable-route actuation plus independently persisted post-reload data-plane observation through the existing proxy, and preserve same-generation physical continuity without granting Idunn semantic Present/Ready authority. Verify on Yggdrasil, admit Odin first, then Ghostlight Dungeon (CodexConnector is not a Dungeon dependency, operator 2026-09-23), prove outage/fencing/routing/legacy-negative invariants, and purge every old executable authority.
- Idunn v2 admits and serves Ghostlight Dungeon on Yggdrasil. Remaining deployment work belongs to its owners (Idunn, Odin, CultLib, Heimdall, gamecult-ops) and is listed under "Open, other owners" in the cut map block "The first deploy, 2026-09-23 (PA.f198-PA.f216)"; Ghostlight's own share is deleting the retired v1 actuator, unit, wiring test and legacy state once gamecult-ops agrees, and subtracting the library's CodexConnector transport.
- Build the outbound half of the consumer contract (the consumer's read of its own projection and attributed intents toward its subject as a typed response document) and a non-loopback CultMesh authority lease, then connect a Delvehold-owned adapter to the landed inbound ingress (POST /cultnet/world-patch, ConsumerPort, PatchGround::Consumer) without consumer-specific IDs or schemas in Ghostlight.
- Extend strategic/offscreen named-person individuation beyond the proven emerge-then-act path so people plot across sustained political waves, acquire relationships, fold, and return without granting a cell, arena, or model commit authority.
- Keep the selectable Kalsa Vault's Public player-safe and Spoilers GM-only evidence lanes intact through Git/Obsidian sync, retrieval, exact receipts, and player projection. Do not import it into the read-only Aetheria recovery index or create a rival Ghostlight semantic index.
@ -355,9 +355,9 @@ data_flow:
- If state grows faster than understanding, cut it back.
current_status:
summary: Ghostlight's source teardown is complete and its Idunn provider side is landed at pushed commit `6a79cb0`: executable startup enters the replacement runtime, the legacy scheduler/kernel/Session Zero pipeline modules are absent, one CultCache implementation owns persistent state, and the runtime publishes signed Warming, republishes it while the write lease is outstanding, and exposes managed route presence. Production has not cut over: Yggdrasil still runs legacy release `a4080d4` under an enabled `Restart=always` unit with health v1 and legacy state. The attempted deployment exposed duplicate authority across hard-coded Idunn policy, raw shell commands, the privileged dispatcher, and target-specific gamecult-ops programs, plus a root-versus-Idunn Git ownership failure and stop-old-before-candidate routing. The adopted deployment rebuild uses target-owned visible recipes, Idunn-configured runner and host bindings, candidate readiness behind a stable route, process/write-lease handoff, and separate deployment versus continuity authority. No deployment or acceptance run is active.
summary: Ghostlight's source teardown is complete and its Idunn provider side is landed at pushed commit `6a79cb0`: executable startup enters the replacement runtime, the legacy scheduler/kernel/Session Zero pipeline modules are absent, one CultCache implementation owns persistent state, and the runtime publishes signed Warming, republishes it while the write lease is outstanding, and exposes managed route presence. Production is cut over: Ghostlight Dungeon is live under Idunn v2 at `https://yggdrasil.gamecult.org/ghostlight/` (runtime `ghostlight-yggdrasil`, state root `/var/lib/gamecult/ghostlight-world-v2`; `/health` names the served commit); the legacy `ghostlight-dungeon.service` is stopped with its old state untouched, and the v1 actuator, unit, wiring test and that state are retired in fact and owed deletion. The first attempted deployment exposed duplicate authority across hard-coded Idunn policy, raw shell commands, the privileged dispatcher, and target-specific gamecult-ops programs, plus a root-versus-Idunn Git ownership failure and stop-old-before-candidate routing. The adopted deployment rebuild uses target-owned visible recipes, Idunn-configured runner and host bindings, candidate readiness behind a stable route, process/write-lease handoff, and separate deployment versus continuity authority. First deploy and play session: the cut map block "The first deploy, 2026-09-23 (PA.f198-PA.f216)" in `docs/architecture/ghostlight-play-agent-cut.md`.
provider_acceptance_checkpoint: Exact pushed commit `139b8a6` completed Run 60 under `character-newsroom.v10` without world or per-wave replay. Its acceptance witness and terminal status bind the completed page and exact resume lineage. The independently dispatched blind reviewer, shown only the reader-facing fantasy newspaper, read it as a real left-populist civic broadsheet and did not immediately identify procedural generation, so the narrative reverse-Turing criterion passes. The review's substantive criticism is that the three stories feel like three rewrites of one briefing; accepted Run 60 remains immutable. The run used 96,902 prompt tokens and reported zero cache hits. Its delivered typeset artifact is `output/pdf/canopy-ledger-run-60-front-page.pdf`; frozen-source and visual verification remain accepted. Exact pushed `bc2ca39` then produced frozen-fact newsroom-only Run 61 Issues 13, 15, 16, 17, and 18 without world or wave model replay. Provider output proves `special_issue` convergence in Issues 13 and 15, independent `general_issue` beats in Issues 16 through 18, and assignment-selector cache hits. Blind review of Issues 13, 15, 16, and 17 passes both distinct recurring voices and issue-shape diversity, recognizing Ossan, Mera, Corin, and Lysa's biases plus modest cross-issue evolution. Run 62 exercised v12 without world or wave replay and failed only because two lead articles proposed invalid datelines; recurring reporter calls still recorded zero cache hits. Run 63 used exact pushed v13 `a52d57b`; Issues 17 and 18 completed before root stopped the final weekly recomposition, both repeated bylines again recorded zero cache hits, and live services remained unchanged. Preserve Runs 61 through 63 as stopped or completed immutable evidence. Copy defects remain later deadline-correction work rather than a reason to reopen accepted issue artifacts.
implementation_checkpoint: Pushed commit `6bb6869` makes the replacement mailbox/kernel architecture the crate and executable runtime identity and removes the legacy runtime owner. Pushed commit `13d5136` unifies app sessions, world journal, and controller custody under one CultCache implementation (now consumed from CultLib `85f7024`) and deletes the duplicate legacy CultCache dependency. The committed daemon tree has no old Session Zero, legacy kernel, scheduler, assessor, verifier/reconciliation, or legacy-transition module path. CultNet in CultLib `85f7024` owns the current activation, brake, lease, observed-capability, disagreement, and RUDP-route contracts. Odin `65cf2b2` owns exact source/release actuation and the durable three-record, nine-phase transaction body. Ghostlight `d0510ac` consumes CultCache, CultNet and CultMesh from CultLib `85f7024` instead of vendoring its own generation of them, deleting 19,604 lines of forked substrate; Ghostlight `751b5c4` stops naming its own runtime id, bind, and state root and takes all three from Idunn, which the recipe's required `state_root` argument binding makes mandatory rather than cosmetic; Ghostlight `6a79cb0` and CodexConnector `ede3c30` own their respective provider contracts; `9256648` exposes managed Ghostlight route presence and `6a79cb0` republishes Warming while awaiting the write lease. The remaining uncommitted Odin work is Idunn projection, bounded RUDP transport, and stable-route integration; the directly managed Rust Odin correlation daemon and exact dependency closure are not yet implemented. The worktree is clean: no Ghostlight drift remains between the committed tree and the deployment gate. This proves source and contract foundations, not live deployment: Yggdrasil remains on the legacy bodies until Idunn performs the one-way cut.
implementation_checkpoint: Pushed commit `6bb6869` makes the replacement mailbox/kernel architecture the crate and executable runtime identity and removes the legacy runtime owner. Pushed commit `13d5136` unifies app sessions, world journal, and controller custody under one CultCache implementation (now consumed from CultLib `85f7024`) and deletes the duplicate legacy CultCache dependency. The committed daemon tree has no old Session Zero, legacy kernel, scheduler, assessor, verifier/reconciliation, or legacy-transition module path. CultNet in CultLib `85f7024` owns the current activation, brake, lease, observed-capability, disagreement, and RUDP-route contracts. Odin `65cf2b2` owns exact source/release actuation and the durable three-record, nine-phase transaction body. Ghostlight `d0510ac` consumes CultCache, CultNet and CultMesh from CultLib `85f7024` instead of vendoring its own generation of them, deleting 19,604 lines of forked substrate; Ghostlight `751b5c4` stops naming its own runtime id, bind, and state root and takes all three from Idunn, which the recipe's required `state_root` argument binding makes mandatory rather than cosmetic; Ghostlight `6a79cb0` and CodexConnector `ede3c30` own their respective provider contracts; `9256648` exposes managed Ghostlight route presence and `6a79cb0` republishes Warming while awaiting the write lease. Live deployment status is in `summary`.
full_world_acceptance_checkpoint: Run 115 is terminal failed at `/var/lib/gamecult/ghostlight-dungeon/acceptance/full-world-delvehold-0a83034-115`, semantic revision 2, regions 2/8, waves 0/1. Resume2 ended on provider SSE timeout. Resume3 exhausted four reconciliation steps after `inst:kharad-road-keepers` referenced unknown `loc:kharad-rhythm-road`. Preserve the root, receipts, service invocation `d9254cd9b77946aebcf7a7fdae821402`, and failed patch sequence through 8964a92 as immutable evidence. Do not resume it.
scale_checkpoint: Runs 108 through 115 prove load and failure properties of the pre-rebuild body, not world completeness. Operator directive 2026-09-04: the 2,400-subject / 240-cell / 10% cover profile is deliberate design, not a load fixture; a world feels alive only when actors at every level pursue their own goals, so that detail is generated first and multiresolution simulation is then choked so attention is scarce. The seed carries a `WorldScaleIntent`, the elaborators pursue its derived scale deficit, and cover budget is the choke. The 1,200-actor fixture is a load measure only. Structural admission still cannot require interest, diversity, name uniqueness, or an actor count; validity never waits on a count, liveness is authored. The committed replacement authority suite passes, but no further scale run is admitted until Yggdrasil serves the exact world-v3 release through the rebuilt Idunn recipe/binding/router seam, the live state root satisfies the complete world-v3 allowed-path contract, restart preserves exact journal and digest identity, and no old service, state path, process grant, or route can regain write authority.
presentation_checkpoint: The historical press-layout and seed-ownership split are complete. `notes/historical-newspaper-layout-grammar.md` remains the durable grammar. Manifest v2 at `output/tex/canopy-ledger-run-61-style-1847-flow-723.manifest.toml` independently binds `style_seed=1847`, `flow_seed=723`, frozen source SHA-256 `8f195140f52a40ba705d6a66987146a1500ae89668e5d82b01d1792eb3afb882`, and the final artifact `output/pdf/canopy-ledger-run-61-style-1847-flow-723.pdf`, SHA-256 `a457f4b1702a7a52480e42fce0039f0dbe677ff32958e98f1c412b346237190c`. An identical seed pair produces byte-identical TeX and PDF; changing only flow preserves the exact style section while materially changing a plausible layout, and changing only style preserves flow topology. Cut-first and cut-midstory templates pass visual inspection; the failed split-card template is deleted. Frozen copy/assets, actual PDF `/BM /Multiply`, and economic-layer advertising authority remain invariant.
@ -376,35 +376,30 @@ current_status:
one play table owns the turn lifecycle with one open turn per world; and
the Eve client round trip is exercised end to end for the first time,
which is where the answer path, the opaque per-question token (Cut 13,
PA.f170) and the play-store migrations came from. Soul's verdict after
Cuts 12 and 13 is ready to play with one preflight, and its closing pass
on Cut 17 judged the bar met: nothing left that would stop or mislead a
player. The close-out is done — the postmortem is
`docs/architecture/ghostlight-play-agent-postmortem.md`, and the target
and `notes/ghostlight-dungeon.md` now name their own gaps. Topology
PA.f170) and the play-store migrations came from. Soul judged the
bar met after Cut 17 without a whole-path run; the first deploy then
found PA.f198-PA.f216, each by a person or a live counterpart, never a
test (lesson: Eureka changelog, 2026-09-23). The postmortem is
`docs/architecture/ghostlight-play-agent-postmortem.md`. Live topology
(operator ruling 2026-09-23, "put each of the organs on the right
machine"): the playtest runs on Yggdrasil. Ghostlight Dungeon runs there
beside Heimdall, deployed by Idunn through the binding named `ghostlight`
(the Dungeon unit only; Ghostlight is the library provider, Dungeon its
consumer) at admitted ref `codex/ghostlight-dungeon-mvp`. Bonsai 2 stays
on Raven's GPU; a Raven scheduled task holds a restricted-key reverse SSH
tunnel over the WireGuard mesh (Raven 10.77.0.4, Yggdrasil 10.77.0.1) so
the local lane's endpoint is Yggdrasil loopback `127.0.0.1:18080`.
Dungeon's local inference and Heimdall's private plane both stay
loopback-only. The Raven-hosted Dungeon (scheduled task
`GhostlightDungeon`, `C:\Meta\ghostlight`,
`deployment/raven/start-ghostlight-raven.ps1`) is a detour being retired,
not the playtest path. Next action: cut the CodexConnector binding out of
the Yggdrasil deploy actuator (`gamecult-ops`
`scripts/deploy-ghostlight-yggdrasil.sh`: connector readiness gate, key,
and acceptance test
`controllers::tests::real_local_model_cognition_modes_commit_speech`)
and its runbook, and bind the local-model link in its place; gamecult-ops
owns the actuator, runbook and link. Then, on Yggdrasil, check `/health`
for `playStatus` first; the unverified leg is seeding, which needs
`GHOSTLIGHT_SEED_VAULT_ROOT`, appears in no runbook, and has never run
past its configuration check, so attempt it alone before the play legs.
Two capabilities the Dungeon brief promises are not built, and the
machine"): Ghostlight Dungeon runs on Yggdrasil beside Heimdall under
Idunn v2, binding `ghostlight` (Dungeon unit only), ref
`codex/ghostlight-dungeon-mvp`, at
`https://yggdrasil.gamecult.org/ghostlight/`; Bonsai 2 stays on Raven's
GPU and reaches Yggdrasil loopback `127.0.0.1:18080` through Raven's
`BonsaiLink` task. Heimdall is discovered through Odin at use, not an
Idunn dependency, until Heimdall is a v2 target. gamecult-ops
`runbooks/ghostlight-dungeon-yggdrasil.md` owns deploy, link and
verification. Sign-in works end to end and the operator created a world
and submitted a turn. Next action (operator, 2026-09-23: "Stop here, we
have shit to fix"): the fix list in the cut map block "The first deploy, 2026-09-23 (PA.f198-PA.f216)", in order: PA.f212
(failed turns are not surfaced), PA.f211 (Raven's rss-watchdog restarts
Bonsai mid-turn; owner gamecult-ops/Raven), PA.f213 (no
`GHOSTLIGHT_SEED_VAULT_ROOT` on Yggdrasil: configure a vault or stop
offering seeding), PA.f214, PA.f215, PA.f216; then one Soul pass over
Ghostlight `1fd52b7` onward plus Heimdall `e8e2832`, Odin `96a55ec` and
Idunn `9ede4cd`, none of which Soul has reviewed. Other owners'
follow-ups are listed in that block, not here. Two capabilities the Dungeon brief promises are not built, and the
operator has named them as gating any wider share: fiction-first risk
resolution (the kernel draws an affordance's weighted outcome bands with
no assessment step or modifiers, the play agent cannot author
@ -418,9 +413,9 @@ current_status:
shaped as Njordr's signal surface (custody, pressure and dependency,
route, event deltas; spec owned by GameCult/Njordr
`docs/architecture/njordr.md`, Ghostlight's obligations in the pointer
docs/architecture/gamecult-economy-daemon.md); (c) the rebuilt-Idunn
deployment gate (world-v3, Odin-first admission, as recorded in the
handoff); (d) the decision on an
docs/architecture/gamecult-economy-daemon.md); (c) the deletion of
the retired v1 deployment body and legacy state (see the handoff's
deployment section); (d) the decision on an
Eve `world.run_tick` authority and the Eve owner's fourth command-result
state for an overtaken turn. Inference constraints: lanes route by model
name (`RoutedInferencePort`, crates/ghostlight/src/sdk_inference.rs), and
@ -434,9 +429,9 @@ current_status:
one POST /v1/chat/completions, no credential, inert tool calls), opened
only when GHOSTLIGHT_LOCAL_ENDPOINT is set and claiming the
GHOSTLIGHT_LOCAL_MODEL_PREFIX prefix, default `local/`. The local lane
(Bonsai 2 on Raven, reached at Yggdrasil `127.0.0.1:18080`) is the
playtest's inference and has never carried a turn. Only the sidecar has
been proven live, on the workstation, where it inherits the operator's
(Bonsai 2 on Raven, reached at Yggdrasil `127.0.0.1:18080`) is the live
Dungeon's inference; its reliability is PA.f211 and PA.f215. The sidecar
was proven only on the workstation, where it inherits the operator's
ambient Claude login; whether it has any role on Yggdrasil is undecided,
and deleting it is decided after the gate. There is no Codex subscription
and no API budget; CodexConnector stays isolated at main `6519289` and is