Advance rebuild cutover state
This commit is contained in:
Meta Vens
parent
66ed2ec167
commit
f9f019b970
5 changed files with 101 additions and 83 deletions
|
|
@ -32,9 +32,9 @@ ontology reducer, and commits an atomic CultCache revision. Session Zero,
|
|||
autonomous turns, player commands, imports, and administrative changes must
|
||||
enter through the same `CommandEnvelope` path.
|
||||
|
||||
That owner must be sealed before the ontology widens. The public boundary is
|
||||
create/open, immutable snapshot, submit, and typed receipts. Mutable aggregate
|
||||
state, canonical ID issuance, the reducer, and the CultCache journal writer are
|
||||
The replacement owner is sealed. Its runtime boundary remains create/open,
|
||||
immutable snapshot, submit, and typed receipts. Mutable aggregate state,
|
||||
canonical ID issuance, the reducer, and the CultCache journal writer stay
|
||||
private to the kernel. Controller assignment and affordance grants are
|
||||
canonical; current executability and exact revision-bound decision
|
||||
opportunities are derived and revalidated by the kernel.
|
||||
|
|
@ -83,25 +83,27 @@ load or evaluation evidence; none admits ontology or declares a world complete.
|
|||
exposed mutable state and ID issuance, admitted translation-gap evidence into
|
||||
canonical types, allowed no-op commits, and left affordance and opportunity
|
||||
authority undefined. None of it is current authority.
|
||||
- `b53251f` lands the sealed private `foundation.v0` replacement owner. Exact
|
||||
create/open, immutable snapshot, command submit, and typed receipts remain
|
||||
crate-private with mutable aggregate state, ID issuance, authentication
|
||||
construction, reduction, and the CultCache journal. Nine focused tests prove
|
||||
exact idempotent create, immutable genesis, one live owner, sealed auth
|
||||
evidence, replay and digests, persisted rejection and no-op non-commit,
|
||||
store-path identity revocation, and post-durable lost-ack poison followed by
|
||||
explicit reopen and exact retry.
|
||||
- The legacy exported `kernel::WorldKernel` remains the live runtime path. The
|
||||
next implementation adds the minimal Draft-to-Active/player/autonomous
|
||||
reducer plus mailbox, controller, affordance, and opportunity authority
|
||||
behind the private replacement owner.
|
||||
- Legacy `WorldKernel`, `SessionZeroKernel`, aggregate Campaign/component state,
|
||||
alternate ingresses, semantic verifier/reconciliation stages, model-owned
|
||||
scheduling, and checkpoint recovery remain deletion targets.
|
||||
- `12ee9f4` deletes the dead legacy Elaboration and Mutation kernel ingresses
|
||||
and their component-write helpers: 686 lines removed without a replacement
|
||||
compatibility path.
|
||||
- `66ed2ec` completes the sealed private `foundation.v0` authority loop. Draft
|
||||
creation, approval, activation, canonical controller assignments, affordance
|
||||
grants, revision-bound opportunities, and one shared human/autonomous action
|
||||
reducer all commit through one aggregate and journal. One mailbox serializes
|
||||
submission and snapshot access. Eighteen focused tests prove lifecycle,
|
||||
controller and opportunity fail-closed behavior, restart, idempotency,
|
||||
one-owner, authentication, non-commit, mailbox cancellation, lost replies,
|
||||
immutable genesis, and journal forgery rejection.
|
||||
- The replacement remains crate-private. The legacy exported
|
||||
`kernel::WorldKernel`, executable startup, Session Zero, player turn,
|
||||
autonomous scheduling, Campaign/component, verifier/reconciliation, and
|
||||
checkpoint paths remain live deletion targets. The next move exposes and
|
||||
wires only the replacement runtime facade and mailbox, then cuts those owners
|
||||
without dual-write.
|
||||
|
||||
Do not deploy the rebuild branch or start another acceptance run while the
|
||||
replacement owner lacks its lifecycle, controller-scope, affordance,
|
||||
opportunity, privacy, restart, and negative proofs.
|
||||
legacy executable still owns startup, Draft, player, autonomous, or recovery
|
||||
mutation paths.
|
||||
|
||||
## Immutable failure evidence
|
||||
|
||||
|
|
@ -131,20 +133,18 @@ and proposals but cannot commit on their behalf.
|
|||
|
||||
## Next gate
|
||||
|
||||
Add a minimal private reducer behind the sealed `foundation.v0` owner for Draft
|
||||
creation, approval, activation, one player action, and one autonomous action.
|
||||
Give it one mailbox, canonical controller assignments and affordance grants,
|
||||
and kernel-derived revision-bound decision opportunities. A proposal must fail
|
||||
closed when its revision, controller, authority scope, affordance, or current
|
||||
opportunity differs. Translation gaps and scheduler output retain no
|
||||
world-write path.
|
||||
Expose the sealed replacement as the crate and executable runtime identity,
|
||||
with `WorldMailbox` as the only live world command boundary. Bind authenticated
|
||||
runtime identity to its sealed caller evidence, make startup create or open one
|
||||
owner and spawn one mailbox, then route Draft creation, approval, activation,
|
||||
player decisions, and autonomous controller proposals through the existing
|
||||
command path.
|
||||
|
||||
The vertical-slice suite must preserve the landed one-writer, authentication,
|
||||
idempotency, immutable-genesis, replay/digest, non-commit, path-revocation, and
|
||||
lost-ack invariants while proving lifecycle, controller-scope, affordance,
|
||||
opportunity, privacy, and restart behavior. Cut obsolete writers as Session
|
||||
Zero, resolution, elaboration, persistence, and projection move onto that
|
||||
owner. No live acceptance run precedes this suite.
|
||||
Cut each old startup, Session Zero, player, autonomous, Campaign/component, and
|
||||
recovery writer before enabling its replacement path. Do not dual-write, mirror
|
||||
canonical state, or add a compatibility router. Runtime restart and negative
|
||||
checks must prove the old paths cannot mutate or repair the replacement owner
|
||||
before any live acceptance run.
|
||||
|
||||
## Essential references
|
||||
|
||||
|
|
|
|||
|
|
@ -10,21 +10,22 @@ mode additional authority.
|
|||
|
||||
## Current mechanism
|
||||
|
||||
The repository still contains the pre-rebuild runtime: separate Session Zero
|
||||
and campaign kernels, aggregate Campaign and component representations,
|
||||
multiple mutation ingresses, semantic verifier and reconciliation stages,
|
||||
model-owned scheduling decisions, and persisted recovery/checkpoint paths.
|
||||
These mechanisms are teardown evidence, not foundations that must survive.
|
||||
The executable still starts the pre-rebuild runtime: separate Session Zero and
|
||||
campaign owners, aggregate Campaign and component representations, semantic
|
||||
verifier and reconciliation stages, model-owned scheduling decisions, and
|
||||
persisted recovery/checkpoint paths. Commit `12ee9f4` has removed the dead
|
||||
Elaboration and Mutation ingresses and their component-write helpers; remaining
|
||||
legacy paths are live deletion targets, not foundations that must survive.
|
||||
|
||||
The target map is adopted. The first subtraction removed seven pipeline-smoke
|
||||
binaries and two live-fire scripts. The projection crate now exposes explicit
|
||||
`NarrativePersona` and `OperationalAgent` modes plus a total Interpreter report.
|
||||
An uncommitted broad `world.rs` prototype was rejected and deleted before it
|
||||
became authority. It exposed mutable aggregate state and ID issuance, placed
|
||||
translation-gap evidence inside canonical world types, permitted empty commits,
|
||||
and defined controllers without owning executable affordances or exact decision
|
||||
opportunities. The sealed aggregate boundary is landed. The active bounded move
|
||||
is now the minimal private reducer, not a public ontology inventory.
|
||||
The projection crate exposes explicit `NarrativePersona` and `OperationalAgent`
|
||||
modes plus a total Interpreter report. Commit `66ed2ec` completes the sealed
|
||||
private `foundation.v0` authority loop: Draft creation, approval, activation,
|
||||
canonical controller assignments and affordance grants, revision-bound
|
||||
opportunities, one shared human/autonomous decision reducer, one mailbox, and
|
||||
atomic replay. Eighteen focused world tests pass. That module is not yet the
|
||||
crate or executable runtime identity. The active move is to expose and wire its
|
||||
mailbox boundary, then cut each old startup, Draft, player, autonomous, and
|
||||
recovery owner without dual-write.
|
||||
|
||||
## Authority map
|
||||
|
||||
|
|
@ -123,27 +124,30 @@ and CultCache writes unreachable from outside the owning module. Prove the
|
|||
visibility boundary and the one-writer transaction seam before widening the
|
||||
state vocabulary.
|
||||
|
||||
### 2. Add the minimal private reducer
|
||||
### 2. Add the minimal private reducer — landed
|
||||
|
||||
Behind that boundary, implement only the state and command vocabulary required
|
||||
for Draft creation, approval, activation, one actor action, and one autonomous
|
||||
action. The aggregate owns controller assignments and affordance grants; it
|
||||
derives exact current executability and revision-bound opportunities. Allocate
|
||||
IDs only after a complete candidate validates, reject empty reductions without
|
||||
a commit, and persist accepted state plus commit atomically with expected
|
||||
revision and idempotency. Add places, relations, resources, external ownership,
|
||||
and other ontology components only when the vertical slice reaches their typed
|
||||
causal boundary.
|
||||
`66ed2ec` implements the state and command vocabulary required for Draft
|
||||
creation, approval, activation, one human action, and one autonomous action.
|
||||
The aggregate owns controller assignments and affordance grants and derives
|
||||
exact revision-bound opportunities. IDs issue only after complete seed
|
||||
validation; rejected and empty reductions do not commit. Places, relations,
|
||||
resources, external ownership, and other ontology components wait for a live
|
||||
typed causal boundary.
|
||||
|
||||
### 3. Exercise one vertical slice
|
||||
### 3. Prove the private authority slice — landed
|
||||
|
||||
Route Draft creation and activation, one player action, and one autonomous
|
||||
action through the aggregate. Derive a subject-private projection and one
|
||||
decision opportunity. Exercise both cognition modes without allowing either
|
||||
to write directly.
|
||||
Eighteen focused tests exercise Draft creation, approval, activation, one human
|
||||
decision, one NarrativePersona-controlled decision, and one
|
||||
OperationalAgent-controlled decision through the same aggregate action command.
|
||||
They cover exact controller scope and affordance matching, revision-bound
|
||||
opportunity rejection, restart, immutable genesis, idempotency, serialized
|
||||
mailbox ownership, cancellation, lost reply semantics, and forged-history
|
||||
rejection. Controller mode changes representation only; it does not create a
|
||||
second reducer path.
|
||||
|
||||
For `NarrativePersona`, the Projector emits prose context, the Persona returns
|
||||
prose only, and the runner first persists an immutable receipt-bound Persona
|
||||
Live `NarrativePersona` integration still requires the Projector to emit prose
|
||||
context, the Persona to return prose only, and the runner first to persist an
|
||||
immutable receipt-bound Persona
|
||||
turn. The Interpreter returns a completed report containing that exact
|
||||
noncanonical source prose, zero or more typed proposals, and zero or more
|
||||
translation gaps. Spoken words require a typed speech proposal. Invalid capture
|
||||
|
|
@ -152,18 +156,30 @@ transport or dispatch fault before explicit finalization discards partial
|
|||
captures and leaves the immutable source pending for a fresh attempt; it does
|
||||
not become semantic interpretation failure.
|
||||
|
||||
For `OperationalAgent`, the controller receives only its permissioned typed
|
||||
Live `OperationalAgent` integration receives only its permissioned typed
|
||||
view and tools. Its proposals enter the same command path as narrative
|
||||
proposals. It does not bypass projection privacy, authority derivation, or the
|
||||
reducer.
|
||||
|
||||
### 4. Migrate and cut
|
||||
### 4. Expose, wire, and cut — active
|
||||
|
||||
Move Session Zero, turn handling, resolution, elaboration, scheduling,
|
||||
persistence, transcript/news projection, and external publication onto the
|
||||
vertical slice. At each move, delete or neuter the old writer first. Retain
|
||||
model transport, Vault retrieval, Heimdall identity, Eve/CultMesh projection,
|
||||
Idunn health, and external adapters only where their ownership remains clean.
|
||||
Expose the replacement facade as the crate's runtime identity while keeping
|
||||
mutable state, ID issuance, reduction, journal access, and authenticated-caller
|
||||
construction sealed. Startup creates or opens one replacement owner and spawns
|
||||
one mailbox; runtime consumers receive only the mailbox-facing command and
|
||||
snapshot surface.
|
||||
|
||||
Route Draft creation, approval, activation, player decisions, and autonomous
|
||||
controller proposals through that boundary. Delete or neuter each old
|
||||
Session Zero, legacy kernel, Campaign/component, scheduler, verifier,
|
||||
reconciliation, and recovery writer before enabling its replacement route. Do
|
||||
not dual-write, mirror canonical state, or add a compatibility router.
|
||||
|
||||
Then move resolution, elaboration, transcript/news projection, and external
|
||||
publication onto typed commands and derived views as their causal boundaries
|
||||
are reached. Retain model transport, Vault retrieval, Heimdall identity,
|
||||
Eve/CultMesh projection, Idunn health, and external adapters only where their
|
||||
ownership remains clean.
|
||||
|
||||
### 5. Contract verification
|
||||
|
||||
|
|
|
|||
|
|
@ -250,4 +250,5 @@
|
|||
{"note": "Mind maintenance falsified stale rebuild steering: the map still claimed subtraction had not begun and the handoff later revived Run 111 as an active continuation. Rebuilt the handoff and implementation plan around the adopted one-WorldState authority, landed cuts 64f50de/a144c33, total interpretation, current deletion line, and focused verification gate; chronology remains in Git, evidence, and the frozen teardown map.", "status": "ok", "ts": "2026-09-01T12:37:47+00:00", "type": "architecture"}
|
||||
{"note": "Rejected and deleted the uncommitted first world.rs foundation after focused tests passed. Review found the public module exposed mutable WorldState and ID issuance, translation-gap inference had become canonical world mutation, empty batches could advance revision, controller commands lacked consumed opportunity/readiness/affordance binding, external ownership was bypassed by world-author authority, command evidence did not bind fact evidence, and batch self-digests were unverifiable. Next cut is private-first: seal WorldKernel/aggregate/journal ownership before reintroducing a minimal reducer behind it.", "status": "rejected", "ts": "2026-09-01T13:03:26+00:00", "type": "architecture"}
|
||||
{"note": "Commit b53251f lands a private provisional foundation.v0 WorldKernel owner: immutable genesis and exact create retry, sealed authentication evidence, one live CultCache owner, canonical WorldId issuance and reduction kept private, digest/replay recovery, persisted no-op and rejection non-commit, path-identity revocation, and poison/reopen after a simulated post-durable lost acknowledgement. Nine focused world tests pass. The legacy exported kernel remains live; this is the sealed foundation, not cutover.", "status": "ok", "ts": "2026-09-01T14:18:40+00:00", "type": "implementation"}
|
||||
{"ts": "2026-09-01T14:37:59+00:00", "type": "implementation", "status": "ok", "note": "Commit d49b907 makes the replacement Persona interpretation contract structurally total. Persona source prose is immutable noncanonical evidence bound to typed world/controller/opportunity/revision and inference receipts; only exact typed captures may propose state, actual quoted dialogue is required for speech, malformed spans or raw tool payloads become exact whole-source translation gaps, normal step exhaustion adds an unresolved-source gap, and infrastructure interruption discards partial captures and returns the source pending. Ten focused projection tests pass. Legacy exported Persona runners still contain terminal failure paths and do not expose record_gap; they remain deletion targets, so totality is not yet a live-runtime claim."}
|
||||
{"note": "Commit d49b907 makes the replacement Persona interpretation contract structurally total. Persona source prose is immutable noncanonical evidence bound to typed world/controller/opportunity/revision and inference receipts; only exact typed captures may propose state, actual quoted dialogue is required for speech, malformed spans or raw tool payloads become exact whole-source translation gaps, normal step exhaustion adds an unresolved-source gap, and infrastructure interruption discards partial captures and returns the source pending. Ten focused projection tests pass. Legacy exported Persona runners still contain terminal failure paths and do not expose record_gap; they remain deletion targets, so totality is not yet a live-runtime claim.", "status": "ok", "ts": "2026-09-01T14:37:59+00:00", "type": "implementation"}
|
||||
{"ts": "2026-09-01T17:40:32+00:00", "type": "implementation", "status": "ok", "note": "Commits 12ee9f4 and 66ed2ec advance the authority rebuild past the private reducer phase. The first removes 686 lines of dead legacy Elaboration and Mutation ingress without a compatibility writer. The second completes the sealed Draft-to-Active authority loop with canonical controller assignments and affordance grants, revision-bound opportunities, one shared human and autonomous ExerciseDecision reducer, one serialized mailbox, atomic replay, and exact rejection and lost-ack behavior; eighteen focused world tests pass. This is not runtime cutover: the legacy exported kernel and startup, Session Zero, player, autonomous, and recovery paths remain live owners. The next move exposes and wires the replacement runtime identity and mailbox, deleting each old owner without dual-write."}
|
||||
|
|
|
|||
|
|
@ -252,3 +252,4 @@
|
|||
{"key": "2026-09-01T130326Z0000-0250-72c176f77744", "payload": "eyJub3RlIjogIlJlamVjdGVkIGFuZCBkZWxldGVkIHRoZSB1bmNvbW1pdHRlZCBmaXJzdCB3b3JsZC5ycyBmb3VuZGF0aW9uIGFmdGVyIGZvY3VzZWQgdGVzdHMgcGFzc2VkLiBSZXZpZXcgZm91bmQgdGhlIHB1YmxpYyBtb2R1bGUgZXhwb3NlZCBtdXRhYmxlIFdvcmxkU3RhdGUgYW5kIElEIGlzc3VhbmNlLCB0cmFuc2xhdGlvbi1nYXAgaW5mZXJlbmNlIGhhZCBiZWNvbWUgY2Fub25pY2FsIHdvcmxkIG11dGF0aW9uLCBlbXB0eSBiYXRjaGVzIGNvdWxkIGFkdmFuY2UgcmV2aXNpb24sIGNvbnRyb2xsZXIgY29tbWFuZHMgbGFja2VkIGNvbnN1bWVkIG9wcG9ydHVuaXR5L3JlYWRpbmVzcy9hZmZvcmRhbmNlIGJpbmRpbmcsIGV4dGVybmFsIG93bmVyc2hpcCB3YXMgYnlwYXNzZWQgYnkgd29ybGQtYXV0aG9yIGF1dGhvcml0eSwgY29tbWFuZCBldmlkZW5jZSBkaWQgbm90IGJpbmQgZmFjdCBldmlkZW5jZSwgYW5kIGJhdGNoIHNlbGYtZGlnZXN0cyB3ZXJlIHVudmVyaWZpYWJsZS4gTmV4dCBjdXQgaXMgcHJpdmF0ZS1maXJzdDogc2VhbCBXb3JsZEtlcm5lbC9hZ2dyZWdhdGUvam91cm5hbCBvd25lcnNoaXAgYmVmb3JlIHJlaW50cm9kdWNpbmcgYSBtaW5pbWFsIHJlZHVjZXIgYmVoaW5kIGl0LiIsICJzdGF0dXMiOiAicmVqZWN0ZWQiLCAidHMiOiAiMjAyNi0wOS0wMVQxMzowMzoyNiswMDowMCIsICJ0eXBlIjogImFyY2hpdGVjdHVyZSJ9", "stored_at": "2026-09-01T13:03:26.351584+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
{"key": "2026-09-01T141840Z0000-0251-0503ba842a66", "payload": "eyJub3RlIjogIkNvbW1pdCBiNTMyNTFmIGxhbmRzIGEgcHJpdmF0ZSBwcm92aXNpb25hbCBmb3VuZGF0aW9uLnYwIFdvcmxkS2VybmVsIG93bmVyOiBpbW11dGFibGUgZ2VuZXNpcyBhbmQgZXhhY3QgY3JlYXRlIHJldHJ5LCBzZWFsZWQgYXV0aGVudGljYXRpb24gZXZpZGVuY2UsIG9uZSBsaXZlIEN1bHRDYWNoZSBvd25lciwgY2Fub25pY2FsIFdvcmxkSWQgaXNzdWFuY2UgYW5kIHJlZHVjdGlvbiBrZXB0IHByaXZhdGUsIGRpZ2VzdC9yZXBsYXkgcmVjb3ZlcnksIHBlcnNpc3RlZCBuby1vcCBhbmQgcmVqZWN0aW9uIG5vbi1jb21taXQsIHBhdGgtaWRlbnRpdHkgcmV2b2NhdGlvbiwgYW5kIHBvaXNvbi9yZW9wZW4gYWZ0ZXIgYSBzaW11bGF0ZWQgcG9zdC1kdXJhYmxlIGxvc3QgYWNrbm93bGVkZ2VtZW50LiBOaW5lIGZvY3VzZWQgd29ybGQgdGVzdHMgcGFzcy4gVGhlIGxlZ2FjeSBleHBvcnRlZCBrZXJuZWwgcmVtYWlucyBsaXZlOyB0aGlzIGlzIHRoZSBzZWFsZWQgZm91bmRhdGlvbiwgbm90IGN1dG92ZXIuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA5LTAxVDE0OjE4OjQwKzAwOjAwIiwgInR5cGUiOiAiaW1wbGVtZW50YXRpb24ifQ==", "stored_at": "2026-09-01T14:18:40.242605+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
{"key": "2026-09-01T143759Z0000-0252-5215bd873810", "payload": "eyJub3RlIjogIkNvbW1pdCBkNDliOTA3IG1ha2VzIHRoZSByZXBsYWNlbWVudCBQZXJzb25hIGludGVycHJldGF0aW9uIGNvbnRyYWN0IHN0cnVjdHVyYWxseSB0b3RhbC4gUGVyc29uYSBzb3VyY2UgcHJvc2UgaXMgaW1tdXRhYmxlIG5vbmNhbm9uaWNhbCBldmlkZW5jZSBib3VuZCB0byB0eXBlZCB3b3JsZC9jb250cm9sbGVyL29wcG9ydHVuaXR5L3JldmlzaW9uIGFuZCBpbmZlcmVuY2UgcmVjZWlwdHM7IG9ubHkgZXhhY3QgdHlwZWQgY2FwdHVyZXMgbWF5IHByb3Bvc2Ugc3RhdGUsIGFjdHVhbCBxdW90ZWQgZGlhbG9ndWUgaXMgcmVxdWlyZWQgZm9yIHNwZWVjaCwgbWFsZm9ybWVkIHNwYW5zIG9yIHJhdyB0b29sIHBheWxvYWRzIGJlY29tZSBleGFjdCB3aG9sZS1zb3VyY2UgdHJhbnNsYXRpb24gZ2Fwcywgbm9ybWFsIHN0ZXAgZXhoYXVzdGlvbiBhZGRzIGFuIHVucmVzb2x2ZWQtc291cmNlIGdhcCwgYW5kIGluZnJhc3RydWN0dXJlIGludGVycnVwdGlvbiBkaXNjYXJkcyBwYXJ0aWFsIGNhcHR1cmVzIGFuZCByZXR1cm5zIHRoZSBzb3VyY2UgcGVuZGluZy4gVGVuIGZvY3VzZWQgcHJvamVjdGlvbiB0ZXN0cyBwYXNzLiBMZWdhY3kgZXhwb3J0ZWQgUGVyc29uYSBydW5uZXJzIHN0aWxsIGNvbnRhaW4gdGVybWluYWwgZmFpbHVyZSBwYXRocyBhbmQgZG8gbm90IGV4cG9zZSByZWNvcmRfZ2FwOyB0aGV5IHJlbWFpbiBkZWxldGlvbiB0YXJnZXRzLCBzbyB0b3RhbGl0eSBpcyBub3QgeWV0IGEgbGl2ZS1ydW50aW1lIGNsYWltLiIsICJzdGF0dXMiOiAib2siLCAidHMiOiAiMjAyNi0wOS0wMVQxNDozNzo1OSswMDowMCIsICJ0eXBlIjogImltcGxlbWVudGF0aW9uIn0=", "stored_at": "2026-09-01T14:37:59.318539+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
{"key": "2026-09-01T174032Z0000-0253-0d12cf9f16ae", "payload": "eyJub3RlIjogIkNvbW1pdHMgMTJlZTlmNCBhbmQgNjZlZDJlYyBhZHZhbmNlIHRoZSBhdXRob3JpdHkgcmVidWlsZCBwYXN0IHRoZSBwcml2YXRlIHJlZHVjZXIgcGhhc2UuIFRoZSBmaXJzdCByZW1vdmVzIDY4NiBsaW5lcyBvZiBkZWFkIGxlZ2FjeSBFbGFib3JhdGlvbiBhbmQgTXV0YXRpb24gaW5ncmVzcyB3aXRob3V0IGEgY29tcGF0aWJpbGl0eSB3cml0ZXIuIFRoZSBzZWNvbmQgY29tcGxldGVzIHRoZSBzZWFsZWQgRHJhZnQtdG8tQWN0aXZlIGF1dGhvcml0eSBsb29wIHdpdGggY2Fub25pY2FsIGNvbnRyb2xsZXIgYXNzaWdubWVudHMgYW5kIGFmZm9yZGFuY2UgZ3JhbnRzLCByZXZpc2lvbi1ib3VuZCBvcHBvcnR1bml0aWVzLCBvbmUgc2hhcmVkIGh1bWFuIGFuZCBhdXRvbm9tb3VzIEV4ZXJjaXNlRGVjaXNpb24gcmVkdWNlciwgb25lIHNlcmlhbGl6ZWQgbWFpbGJveCwgYXRvbWljIHJlcGxheSwgYW5kIGV4YWN0IHJlamVjdGlvbiBhbmQgbG9zdC1hY2sgYmVoYXZpb3I7IGVpZ2h0ZWVuIGZvY3VzZWQgd29ybGQgdGVzdHMgcGFzcy4gVGhpcyBpcyBub3QgcnVudGltZSBjdXRvdmVyOiB0aGUgbGVnYWN5IGV4cG9ydGVkIGtlcm5lbCBhbmQgc3RhcnR1cCwgU2Vzc2lvbiBaZXJvLCBwbGF5ZXIsIGF1dG9ub21vdXMsIGFuZCByZWNvdmVyeSBwYXRocyByZW1haW4gbGl2ZSBvd25lcnMuIFRoZSBuZXh0IG1vdmUgZXhwb3NlcyBhbmQgd2lyZXMgdGhlIHJlcGxhY2VtZW50IHJ1bnRpbWUgaWRlbnRpdHkgYW5kIG1haWxib3gsIGRlbGV0aW5nIGVhY2ggb2xkIG93bmVyIHdpdGhvdXQgZHVhbC13cml0ZS4iLCAic3RhdHVzIjogIm9rIiwgInRzIjogIjIwMjYtMDktMDFUMTc6NDA6MzIrMDA6MDAiLCAidHlwZSI6ICJpbXBsZW1lbnRhdGlvbiJ9", "stored_at": "2026-09-01T17:40:32.825638+00:00", "type": "ghostlight.evidence_record.v0"}
|
||||
|
|
|
|||
|
|
@ -212,7 +212,7 @@ pre_rebuild_architecture:
|
|||
- Institution, faction, and consumer decision models
|
||||
|
||||
active_subgoals:
|
||||
- Extend the sealed `foundation.v0` replacement owner with the minimal Draft-to-Active, player-action, and autonomous-action reducer plus mailbox, canonical controller assignments, affordance grants, and kernel-derived revision-bound opportunities. Preserve its private aggregate and journal boundary, exact idempotency, immutable genesis, one-live-owner lease, sealed authentication, replay and digest checks, durable non-commit evidence, path-identity revocation, and lost-ack poison/reopen behavior. Cut the split Session Zero/Campaign/component writers, model verifiers and reconcilers, model-owned scheduling, checkpoint recovery, and special elaboration commit paths as the vertical slice replaces them. Do not launch another scale run until lifecycle, controller-scope, affordance, opportunity, privacy, restart, and negative tests pass.
|
||||
- Expose the sealed replacement as Ghostlight Dungeon's runtime identity and wire one mailbox per world into startup. Route Draft creation, approval, activation, player decisions, and autonomous controller proposals through that owner, deleting or neutering each old Session Zero, legacy kernel, Campaign/component, scheduler, and recovery writer before its replacement path becomes live. Do not dual-write, mirror canonical state, or preserve a compatibility owner. Preserve the complete private authority loop and eighteen focused tests landed in `66ed2ec`, plus the dead-ingress subtraction in `12ee9f4`. Do not launch another scale run before runtime cutover and negative proof that the old owners can no longer mutate world state.
|
||||
- Connect a Delvehold-owned adapter to the admitted generic consumer contract: shared compiler/consumer WorldSeed admission, externally authoritative institution-or-Gestalt snapshots, attributed proposal acknowledgement, and committed-event newspaper composition over typed CultNet, without consumer-specific IDs or schemas in Ghostlight.
|
||||
- Extend strategic/offscreen named-person individuation beyond the proven emerge-then-act path so people plot across sustained political waves, acquire relationships, fold, and return without granting a cell, arena, or model commit authority.
|
||||
- Finish the semantic mutation migration: delete or demote remaining legacy model effect schemas and move aggregate campaign fields toward projection-only state. Seed publication and named-person presence now have explicit non-effect authority classifications.
|
||||
|
|
@ -343,10 +343,10 @@ data_flow:
|
|||
current_status:
|
||||
summary: Ghostlight is in whole-machine teardown. Run 115 is terminal failed at world revision 2 with two of eight regions admitted and no strategic wave. Provider timeouts and a dangling institution location survived the qualification, verifier, reconciliation, context, timeout, and model-routing patches through commit 8964a92, proving that the pipeline lacks a single structural owner. The adopted rebuild retains NarrativePersona for embodied roleplay and admits OperationalAgent for operator-shaped cognition, both under explicit disjoint controller scopes. One WorldKernel, one typed ontology reducer, one CommandEnvelope ingress, and one atomic CultCache commit path own the target architecture. No acceptance run is active.
|
||||
provider_acceptance_checkpoint: Exact pushed commit `139b8a6` completed Run 60 under `character-newsroom.v10` without world or per-wave replay. Its acceptance witness and terminal status bind the completed page and exact resume lineage. The independently dispatched blind reviewer, shown only the reader-facing fantasy newspaper, read it as a real left-populist civic broadsheet and did not immediately identify procedural generation, so the narrative reverse-Turing criterion passes. The review's substantive criticism is that the three stories feel like three rewrites of one briefing; accepted Run 60 remains immutable. The run used 96,902 prompt tokens and reported zero cache hits. Its delivered typeset artifact is `output/pdf/canopy-ledger-run-60-front-page.pdf`; frozen-source and visual verification remain accepted. Exact pushed `bc2ca39` then produced frozen-fact newsroom-only Run 61 Issues 13, 15, 16, 17, and 18 without world or wave model replay. Provider output proves `special_issue` convergence in Issues 13 and 15, independent `general_issue` beats in Issues 16 through 18, and assignment-selector cache hits. Blind review of Issues 13, 15, 16, and 17 passes both distinct recurring voices and issue-shape diversity, recognizing Ossan, Mera, Corin, and Lysa's biases plus modest cross-issue evolution. Run 62 exercised v12 without world or wave replay and failed only because two lead articles proposed invalid datelines; recurring reporter calls still recorded zero cache hits. Run 63 used exact pushed v13 `a52d57b`; Issues 17 and 18 completed before root stopped the final weekly recomposition, both repeated bylines again recorded zero cache hits, and live services remained unchanged. Preserve Runs 61 through 63 as stopped or completed immutable evidence. Copy defects remain later deadline-correction work rather than a reason to reopen accepted issue artifacts.
|
||||
implementation_checkpoint: Pushed commit `b53251f` lands the sealed private replacement owner as `foundation.v0`; the legacy exported `kernel::WorldKernel` remains the live runtime path. The private seam exposes only exact create/open, immutable snapshot, command submit, and typed receipts inside the crate while keeping mutable state, ID issuance, reduction, authentication construction, and the CultCache journal private. Nine focused tests prove exact idempotent create, immutable canonical genesis, one live owner, sealed authentication evidence, replay and digest recovery, persisted rejection and no-op non-commit, store-path identity revocation, and post-durable lost-ack poison followed by explicit reopen and exact retry. The target authority map remains `docs/architecture/ghostlight-dungeon-mvp.md`; `a144c33` established explicit disjoint `NarrativePersona` and `OperationalAgent` interfaces, and `d49b907` refines total Persona interpretation with receipt-bound noncanonical source prose, exact typed captures, whole-source gap fallback for malformed spans, raw decode failure, and normal exhaustion, pending source on infrastructure interruption, typed speech only for actually spoken words, and translation gaps outside `WorldState`. That contract is not wired into the live legacy Persona runners; they still terminalize and remain deletion targets. Legacy `WorldKernel`, `SessionZeroKernel`, aggregate Campaign/component state, alternate ingress, verifier and reconciliation stages, and persisted recovery remain in the Body. The next cut adds the minimal private lifecycle and action reducer plus mailbox, controller, affordance, and opportunity authority behind the sealed owner.
|
||||
implementation_checkpoint: Pushed commit `12ee9f4` removes the dead legacy Elaboration and Mutation kernel ingresses and their component-write helpers, subtracting 686 lines without adding a compatibility path. Pushed commit `66ed2ec` completes the sealed private `foundation.v0` authority loop: Draft creation, approval, activation, canonical controller assignments and affordance grants, revision-bound opportunities, one shared human/autonomous decision reducer, one serialized mailbox, atomic journal replay, and exact rejection and lost-ack behavior. Eighteen focused world tests pass, including lifecycle, controller and opportunity fail-closed checks, restart, idempotency, one-owner, mailbox serialization and cancellation, authentication, immutable genesis, non-commit, and journal forgery rejection. The target authority map remains `docs/architecture/ghostlight-dungeon-mvp.md`; `d49b907` owns the total Persona interpretation contract. The replacement is still a private module rather than the crate and executable runtime identity: the legacy exported `kernel::WorldKernel`, startup, Session Zero, player turn, autonomous scheduling, Campaign/component, verifier/reconciliation, and checkpoint paths remain live deletion targets. The next cut exposes and wires only the replacement mailbox boundary, then removes those old owners without dual-write.
|
||||
full_world_acceptance_checkpoint: Run 115 is terminal failed at `/var/lib/gamecult/ghostlight-dungeon/acceptance/full-world-delvehold-0a83034-115`, semantic revision 2, regions 2/8, waves 0/1. Resume2 ended on provider SSE timeout. Resume3 exhausted four reconciliation steps after `inst:kharad-road-keepers` referenced unknown `loc:kharad-rhythm-road`. Preserve the root, receipts, service invocation `d9254cd9b77946aebcf7a7fdae821402`, and failed patch sequence through 8964a92 as immutable evidence. Do not resume it.
|
||||
scale_checkpoint: Runs 108 through 115 prove load and failure properties of the pre-rebuild body, not world completeness. The 1,200 and 2,400 actor figures are synthetic evaluation profiles only. Production expansion is sparse and causal; structural admission cannot require interest, diversity, name uniqueness, or an actor count. No further scale run is admitted until the replacement single-owner lifecycle, reducer, decision-controller boundaries, recovery path, and negative invariants pass focused tests.
|
||||
scale_checkpoint: Runs 108 through 115 prove load and failure properties of the pre-rebuild body, not world completeness. The 1,200 and 2,400 actor figures are synthetic evaluation profiles only. Production expansion is sparse and causal; structural admission cannot require interest, diversity, name uniqueness, or an actor count. The private replacement authority suite now passes, but no further scale run is admitted until the executable starts and serves that owner through its mailbox, the old startup, Draft, player, autonomous, and recovery writers are structurally unable to mutate world state, and runtime restart and negative checks pass.
|
||||
presentation_checkpoint: The historical press-layout and seed-ownership split are complete. `notes/historical-newspaper-layout-grammar.md` remains the durable grammar. Manifest v2 at `output/tex/canopy-ledger-run-61-style-1847-flow-723.manifest.toml` independently binds `style_seed=1847`, `flow_seed=723`, frozen source SHA-256 `8f195140f52a40ba705d6a66987146a1500ae89668e5d82b01d1792eb3afb882`, and the final artifact `output/pdf/canopy-ledger-run-61-style-1847-flow-723.pdf`, SHA-256 `a457f4b1702a7a52480e42fce0039f0dbe677ff32958e98f1c412b346237190c`. An identical seed pair produces byte-identical TeX and PDF; changing only flow preserves the exact style section while materially changing a plausible layout, and changing only style preserves flow topology. Cut-first and cut-midstory templates pass visual inspection; the failed split-card template is deleted. Frozen copy/assets, actual PDF `/BM /Multiply`, and economic-layer advertising authority remain invariant.
|
||||
public_reference_checkpoint: The published public architecture is immutable pre-rebuild history, not current rebuild authority. Canonical Ghostlight commit `15ea0f0` owns five archived pages covering the former overview, authority, pipelines, 43 named production stages, and eight titled elaborators. Site commit `2035e799c2cf7470b2bfc70d5a878d5d3be5e90f` publishes a shared mobile Home/Blog/Docs masthead, visibly marks every Docs page as a teardown archive, and publishes the postmortem `The World Counter Lied` at `https://ghostlight.gamecult.org/Blog/the-world-counter-lied`; live HTTP inspection returned 200 for the postmortem and Docs index and found the masthead and archive banner. Do not use the archived pages to steer the whole-machine rebuild. `docs/architecture/ghostlight-dungeon-mvp.md` owns the adopted target; publish replacement architecture only after the replacement body is implemented and verified. The site repository owns public composition and deployment.
|
||||
next_action: Add the smallest private reducer behind the sealed `foundation.v0` owner for Draft creation, approval, activation, one player action, and one autonomous action. Give the replacement kernel one mailbox, canonical controller assignments and affordance grants, and kernel-derived revision-bound decision opportunities; proposals must fail closed when revision, controller, authority scope, affordance, or opportunity differs. Preserve the landed private aggregate, journal, identity, authentication, idempotency, replay, non-commit, path-revocation, and lost-ack invariants. Continue cutting the separate SessionZeroKernel/publication handoff, Campaign writer, legacy transition projection, alternate ingresses, verifier/reconciliation stages, model-owned scheduling, and checkpoint recovery as the vertical slice replaces them. Preserve Run 115 unchanged and do not launch another live acceptance run.
|
||||
next_action: Expose the sealed replacement as the crate's runtime identity and make its `WorldMailbox` the only live world command boundary. Wire startup and authenticated identity to create or open one replacement owner, then route Draft creation, approval, activation, player decisions, and autonomous controller proposals through its existing command path. Delete or neuter each old owner before enabling the corresponding replacement path; do not dual-write, mirror Campaign state, or add a compatibility router. Preserve the eighteen-test private authority loop, Run 115 unchanged, and the ban on live acceptance until runtime restart and old-writer negative proofs pass.
|
||||
gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Materialisation/folding changes only representation and the exact member delta, advances resolution epoch, and retires the old cover; it has no Gestalt-wide effect authority. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.
|
||||
|
|
|
|||
Loading…
Reference in a new issue