Ghostlight/docs/architecture/ghostlight-dungeon-session-zero.md

Ghostlight Dungeon Session Zero and Bounded Co-op

Status

Teardown evidence, not a live authority map. The SessionZeroKernel, the compiler, the preview and contract-review organs described below exist in no committed source. World creation is world.create on the sealed kernel; seed authoring is plan step 8, the seed producer: a Draft-phase authoring session that admits AdmitPatch seeds as the owner for approval before activation (notes/ghostlight-implementation-plan.md). Read this document only for the co-op intent and the rejected compiler shape.

Owners

SessionZeroKernel

SessionZeroKernel owns one persistent draft mailbox and its revisions. Its MessagePack CultCache store contains the roster, single-use invitations, shared/private channels, messages, contract, private character drafts, boundaries, decisions, approvals, DM Persona, evidence coverage, compilation preview, and publication receipt.

The store keeps two deliberately different model-receipt collections. The inference audit contains every committed invocation, including two calls whose semantic receipt hashes match but whose latency or provider-attempt telemetry differs. The active-preview proof set contains only the compiler transaction that produced the currently retained preview. Replacing or retiring a preview clears that proof set without erasing the audit. A campaign publication carries only the active proof set; historical DM turns and superseded compiler runs do not become evidence for a seed they did not produce.

Player messages are durable conversation, not campaign facts. Projector, DM Persona, Interpreter, retrieval, and compilation stages return proposals. Only the kernel may change the draft.

Private DM channels use character-component and channel epochs. Independent private turns can finish in parallel even if an unrelated private component commits first. Shared changes serialize through the shared epoch. No output is rebased.

WorldKernel

WorldKernel receives nothing while Session Zero is drafting. Publication builds a new campaign store in a private staging directory. Campaign seed, membership, contract, governance, DM Persona, approved brief, approval digests, Vault evidence, and model receipts enter one empty CultCache batch. The directory becomes discoverable only after the batch succeeds.

Publication is idempotent by the approved seed digest. Repeating the same publication recovers the campaign. Reusing the campaign ID for a different digest is rejected.

Privacy membrane

Shared DM inference receives the shared contract, aggregate boundary policy, public party cards, shared decisions, evidence coverage, and recent shared messages. It cannot receive raw boundaries, another player's private draft, or private messages.

Private DM inference receives the shared contract, aggregate policy, public party cards, that player's character draft, that player's attributed boundaries, visible decisions, and recent messages from that private channel. It cannot receive another player's private state.

Account hashes and invite-token hashes remain private persistence fields. They are absent from JSON Schemas, browser projections, CultMesh surfaces, and model contexts. Actor-specific campaign surfaces use random campaign member IDs and the exact assigned actor.

The structured Projector and Interpreter receive their exact stable JSON Schema before any dynamic context. OpenAI-compatible JSON-object modes constrain syntax but do not communicate the application schema by themselves. The DM Persona owns the natural utterance. The Interpreter's model-facing schema has no speech field: it emits only new typed proposals and reply affordances, after which the runtime binds the Persona output losslessly into the proposed kernel delta. It cannot rewrite, summarize, or truncate the Persona while extracting state. The kernel still treats the three stages as one atomic proposal; an invalid Interpreter commits neither speech nor state.

The Interpreter receives only the current contract, its channel and member scope, the entitled private character when applicable, unresolved material decisions, and the exact Persona response. Non-material opening and role cards remain renderer-visible suggestions but never enter Projector or Interpreter cognition unless the player explicitly selects or discusses one. Transcript windows, evidence coverage, boundaries, and public-party narrative already served their purpose in the Projector and are not replayed into extraction. It cannot restate existing draft fields or unresolved decisions as new proposals. Stable schema-first prefixes preserve provider cache reuse. Empty, malformed, schema-invalid, or stale outputs cannot change the typed draft. If both same-snapshot attempts fail, the kernel may append a fixed local DM notice to the conversation while leaving contract, characters, decisions, boundaries, approvals, and model receipts unchanged.

Every player-triggered Session Zero model task enters the same live-inference priority gate as campaign play. This includes opening and role suggestions, DM turns, counter replacements, and world compilation. Entering the gate cancels an in-flight strategic model wave before it can commit and prevents new background inference from launching until the interactive task leaves. A quiet campaign cannot consume provider concurrency while a player is waiting at the table.

One Interpreter turn has one owner per typed lane. A shared turn may directly edit the draft contract or offer a contract decision, never both; a private turn may directly edit the ordinary character draft or offer a character-patch decision, never both. An extraordinary-permission bargain is a separate consent lane, so it may accompany a direct mundane character patch without being silently granted. The model-facing schema requests a same-snapshot correction for a split-lane output, and the kernel repeats the invariant before mutation.

Decision metadata is not part of the general Interpreter's ontology. Its schema carries only the prompt, proposed resolution, and one or more typed semantic payloads. The Director assigns a fresh durable decision ID, exact private-channel owner (or shared ownership), material status, and clean lifecycle state. Extraordinary-permission proposals similarly contain terms only; Ghostlight assigns the permission ID and binds the exact entitled actor. Model output cannot reuse a decision ID, target another actor, replace an existing permission by guessing its ID, or claim evidence custody. Focused counter replacement preserves the already committed permission identity while allowing only its negotiated terms to change.

Generated opening and role suggestions are non-material decisions: the player may accept, counter, discuss, or ignore them without blocking a fully custom draft. They are UI affordances, not implicit DM memory. On daemon load, the registry demotes pre-cut payloadless questions and generated opening records whose old material flags would otherwise veto a custom draft. A payloadless question cannot own compilation readiness because it has no typed change to accept. This migration uses an exact CultCache replacement and does not advance the Session Zero revision or shared epoch. Material decisions preserve the distinction between discussion and consent. Every acceptable decision carries at least one non-empty typed contract, character, or extraordinary-permission payload. A question or a prose promise without an exact state change remains DM speech or a suggested reply; it cannot render an Accept control, advance the draft through acceptance, or claim that the promised materialization occurred. The Interpreter schema enforces the payload before correction/retry, and the kernel rejects any legacy payloadless decision that reaches acceptance. The actor-filtered Eve projection shows that exact payload beside the DM's explanation before exposing Accept. Its private character ledger projects every player-entitled draft field, including history, secrets, knowledge, equipment, relationships, goals, and the complete terms of extraordinary permissions. Prose explains a bargain; the visible typed payload is the state the player is actually consenting to. Character patches are reversible during negotiation. Every list supports exact removals before additions, and relationship keys support exact removal before a replacement is installed. This permits spelling, identity, and mistaken-ledger corrections without duplicate private subjects or transcript replay. Accept applies only the exact typed payload currently stored in the decision. Counter preserves that payload as an inert, visible audit and replacement basis, records the player's text in the decision's durable channel, marks the unresolved decision as awaiting a DM replacement, and invalidates the affected projection epoch. pending_counter removes the Accept surface and makes the retired payload uncommittable. The DM response must produce a fresh material decision against that same channel and component epoch; installing it and retiring the pending counter is one kernel commit. Until then the old decision has no Accept surface and forged acceptance fails. Inference failure, an irrelevant response, or a stale response leaves the counter unresolved and compilation blocked. Retry relaunches the membrane from that already persisted counter and unchanged Session Zero snapshot. It does not ask the player to retype the counter, append a duplicate message, or advance revision merely to try inference again; only a later kernel-validated replacement changes state. The countered decision ID is also part of the model snapshot binding and permitted turn context. A deterministic Ghostlight Projector renders that one pending decision, its retired typed payload, exact counter, and aggregate safety policy into the Persona's narrative stream. This exact projection needs no model call or model receipt; the focused turn records only Persona and Interpreter inference. The Interpreter separately receives the same bounded typed basis. When the retired proposal still has one exact typed lane, the Interpreter emits only that replacement payload: character patch, contract patch, or permission terms. Ghostlight binds the fresh decision ID, owner, materiality, evidence, prompt, and persisted counter locally. Permission IDs, actor bindings, and evidence receipts are preserved from the retired proposal and are absent from the model's output authority. The larger union Interpreter remains only for ordinary conversation and pre-cut payloadless migration. Conversation history, party cards, the contract, unrelated decisions, and unrelated private character state are not part of the focused retry. Pre-cut decisions whose typed payload was erased receive one bounded current-state basis for migration only. The kernel accepts exactly one same-lane replacement with stable extraordinary-permission identity; direct patches or unrelated decisions cannot retire the counter.

Approval and publication

The host locks the roster before compilation. Material unresolved decisions block compilation. The kernel also refuses a conversation-only draft: the typed contract must identify premise, canon horizon, start, pressure, goal, tone, pacing, consequences, narrative focus, and DM style; every active character must have a public premise, capability, goal, and at least one obligation or vulnerability. Group drafts additionally require a party bond. The compiler receives an approved_campaign_brief.v1, not the transcript. Private character history and secrets are withheld from world generation; after the grounded seed validates, Ghostlight locally replaces the provisional compiler player with the exact approved actors at one shared start. Approved relationships cross that membrane by identity, not by free-form map key. A relationship naming another approved player resolves to that player's exact actor ID. An otherwise unresolved named person receives a stable, server-generated relationship-anchor actor ID; the compiler must materialize that exact actor and name in the seed, but it never receives the private relationship description and may not reveal the anchor in opening narration merely because the private ledger requires their existence. The owning player sees the compiled subject, placement, and relationship during private review. Their final approval therefore covers the compiler's placement without exposing it to the table. Actors may also hold directional relationships to an exact institution, Gestalt, or named Gestalt member. Such a relationship grants no knowledge, resource, membership, or collective authority. If compilation fails before a preview is installed, the roster remains locked and the typed brief remains authoritative. A host whose current brief still passes the readiness gate receives the Compile action again; retrying uses the new revision and never replays or accepts transcript prose.

Evidence gaps return the draft to conversation with explicit questions. A gap-bearing compiler result is retained as an exact non-canonical preview while the session remains in drafting. The host may move that exact digest into review, or the table may revise typed state and retire it before another compile. Moving it to review is not approval. Every active player must approve the current shared digest, their current private character digest, and the exact world-preview digest containing topology, cast, institutions, populations, clocks, evidence lanes, gaps, and branch-local assumptions. Publication persists the approved preview digest and exact accepted gap and assumption lists beside the campaign seed. Substituting any preview makes every prior approval stale. Relevant edits retire the preview and invalidate the affected approvals. The host has no override.

Pre-cut Session Zero stores used one receipt list for both meanings. Registry load migrates that list without advancing Session Zero revision or fictional time: all entries become audit history, while an extant world-seed preview receives the bounded final compiler transaction from its last custom_retrieval_plan through agency_compile as its exact proof set. Later conversation receipts and Contract Review previews are excluded. The migration is an atomic CultCache replacement and is idempotent on restart.

Accepted extraordinary bargains become typed permissions. Later assessment receives their exact scope, prerequisites, costs, limits, exposure, evidence, and effect ceiling.

Bounded co-op

campaign_membership.v1 binds authenticated account hashes to random member IDs and exact actor IDs. HTTP admission derives the acting actor from this record. Assessment confirmation includes that actor ID and cannot consume another actor's assessment.

The first co-op mode deliberately permits one shared scene and sequential public actions. It rejects player-versus-player state mutation, movement that would split the party, raw unilateral waits, and unilateral resolution-budget changes. Time, group travel, and pooled Persona-cell budget changes use revision-bound proposals; the final approval and campaign transition commit atomically. Group travel revalidates the shared origin and exact route, moves every assigned actor, and advances time in one world commit.

Every human-controlled actor has a non-simulatable agency profile. Live NPC appraisal, multiresolution cells, strategic outcomes, migration, scheduler ticks, and away-time work all exclude those actors from Persona control and direct mutation. Disconnection grants no proxy authority.

Each active member contributes their entitlement-provided cell allowance. Test accounts currently contribute eight. The campaign starts at the pooled total, capped at 240; physical provider concurrency remains independent.

Realtime and interface

Ghostlight publishes an actor-filtered Eve surface for each Session Zero member and campaign member. Server-sent events contain revision notifications only. The browser refetches the authoritative Eve document after a notice; the transport owns no messages, drafts, ledgers, approvals, or world state.

The browser exposes keyboard-operable shared/private channel tabs, live status, public party cards, private ledgers and boundaries, unresolved decisions, roster readiness, and explicit compile/review/approve/publish actions. The Eve review tree visibly renders topology, non-private cast, institutions without private goals or resources, populations, clocks, evidence-use rationales, gaps, and branch assumptions. Relationship-anchor people remain absent from the shared cast and appear only in their owner's private relationship card. Privacy is labeled in text and never conveyed only by color. The host may discard any non-canonical preview through a typed Session Zero command and continue drafting without changing the contract, characters, or fictional time. A retained preview never traps the table into reviewing it.

Session Zero also remains the sole owner of every human-controlled character. The shared compiler may use player-approved public names and premises as world context, but those names are reserved: neither ordinary cast nor Gestalt member output may materialize them. Its singular player document is only a provisional starting-position marker. After compilation, Ghostlight removes that marker and installs the approved typed characters. A candidate that duplicates a reserved player identity is corrected against the same snapshot or rejected atomically.

An approved unresolved relationship person crosses world compilation as a server-owned identity anchor. The shared world compiler never receives that person's name, identity handle, or relationship. After the public topology is validated, a separate private stage receives the approved name and exact available locations and must synthesize exactly one ordinary actor candidate. It remains responsible for that person's location, capabilities, knowledge, equipment, obligations, and goals, but cannot emit IDs, relationships, narration, facts, gaps, assumptions, or public-world changes. The compiler then attaches the opaque canonical ID locally and the approved relationship is added only to its owner's actor. Omission, ambiguity, unknown placement, or ID collision rejects the whole candidate. Shared output cannot leak private input that its owning model never received.

Inline grounded suggestions

Opening and role generation is no longer a browser-owned creation flow. On a new draft, the compiler retrieves three distinct Vault-grounded opening suggestions and installs them as shared typed decisions. Accepting one amends the draft for further discussion; it does not publish a world. Ghostlight then retrieves three grounded role suggestions and installs separate typed decisions in each player's private channel. A custom premise uses the same conversation, draft, approval, and compiler path.

Contract Review

A launched campaign can enter a focused Contract Review backed by the same Session Zero kernel and privacy projections. The review is bound to the exact world revision at which it began. Any intervening world commit makes it stale. Every active member approves the revised shared digest and their own character digest before the host can publish.

Publication updates the existing campaign, contract, membership permissions, DM Persona, approved brief, governance epoch, actors' approved forward-looking ledger fields, event, and receipt in one CultCache batch. It cannot change membership custody, locations, topology, knowledge, memories, historical events, Vault, canon horizon, or established starting geometry. Tightened private boundaries publish immediately as an anonymous strictest campaign policy; relaxation waits for unanimous review publication. Narration, action assessment, resolution demand, cell Projectors, Interpreters, and semantic verification receive the approved contract and aggregate policy. Actor Personas still receive only lived narrative, not policy schemas or attributed safety records.

Deferred governance

Split parties, private in-play actions, simultaneous declarations, PvP, delegation, late joining, permanent post-publication departure, group fork/reset/export, and voice remain unsupported.