Ghostlight/notes/ghostlight-implementation-plan.md

Ghostlight Implementation Plan

Objective

Rebuild Ghostlight Dungeon as one legible world machine: one lifecycle, one typed ontology, one command ingress, one authority derivation path, and one atomic persistence owner. Preserve narrative roleplay where it matters and use direct operational cognition where it is a better fit, without granting either mode additional authority.

Current mechanism

Pushed commit 6bb6869 makes the sealed mailbox/kernel architecture the crate and executable runtime identity. Pushed commit 13d5136 places app sessions, the world journal, and controller custody behind the one vendored CultCache implementation and removes the duplicate persistence dependency. The committed daemon tree contains no pre-rebuild Session Zero, legacy kernel, scheduler, assessor, verifier/reconciliation, or legacy-transition module path.

Production has not crossed that source boundary. Yggdrasil still runs legacy release a4080d4 under an enabled Restart=always unit and a legacy state root. CultNet through CultLib 85f7024 owns generation-bound activation, separate lifecycle-brake, process-write-lease, observed-capability, explicit disagreement, and routed RUDP incarnation admission contracts. Odin through pushed 65cf2b2 owns deterministic recipe and binding admission, exact source freezing, sealed releases, Expected projection, the narrow native actuator ports, and the durable three-record transaction and admitted-generation engine. Remaining Odin work is Idunn projection, bounded RUDP transport, and stable-route integration; the active move is to finish and prove those before one-way live cutover.

Authority map

• Owner: one sealed per-world WorldKernel owns its private aggregate, reducer, ID allocator, and journal writer. The public crate boundary exposes only create/open, immutable snapshot, command submission, and typed receipts; it does not expose mutable WorldState, the canonical entity-ID allocator, reducer entry points, or generic journal writes.
• Inputs: an authenticated CommandEnvelope with stable command ID, exact world and expected revision, principal evidence, one closed command body, and exact source receipts where needed. The kernel privately loads current state, derives authority, and supplies deterministic clock or entropy. Human, Interpreter, operational-agent, author, scheduler, and external-owner output is proposal material only.
• Outputs: a rejection receipt changes nothing. An accepted command returns one WorldCommit, including any reducer-issued ID mapping, and atomically appends one digest-chained revision. A structurally valid command that lowers to no factual, speech, lifecycle, or time mutation returns NoEffect and does not advance revision, change either digest, allocate IDs, or append a journal row.
• Derived state: immutable snapshots and subject views, currently executable affordance catalogs, revision-bound DecisionOpportunity values, scheduler queues, translation gaps, projections, news, transcripts, model receipts, checkpoints, coverage counts, and evaluations. Translation gaps may be kept as inference/evaluation telemetry or motivate a later explicit author proposal; they are not a WorldState component, event, or mutation.
• Forbidden writers: public state setters or ID issuers; direct reducer callers; generic CultCache insert/append handles; schedulers or controllers that assign authority, mint executable affordances, consume opportunities, or commit; automatic translation-gap lowering; empty commits; the old Session Zero publication path, aggregate Campaign writer, legacy transition projection, alternate elaboration and mutation inputs, verifier/reconciliation agents, recovery repair loops, and external consumer callbacks.
• Shared paths: draft creation, approval, activation, player action, autonomous action, author expansion, time, travel, imports, reload, and administration use create/open/snapshot/submit and the same private derive/reduce/commit primitive. Controller harnesses submit an exact typed proposal as an ordinary command. Recovery opens and verifies the same journal; it cannot call a repair reducer.
• Cut line: the rejected public ontology stays deleted. Translation-gap records stay outside canonical world state. No public constructor or helper may issue a canonical ID, mutate an aggregate, invoke the reducer, or write the journal. Obsolete writers are deleted or reduced to read-only evidence before their replacement path is called complete.
• Verification layer: compile-time visibility proves that an external crate cannot invoke the ID allocator, mutate WorldState, call the reducer, or obtain the journal writer. Focused black-box tests prove that a caller-supplied unknown ID cannot become canonical, plus atomic rejection, no-op non-commit, reducer-only ID allocation, exact restart/digest recovery, translation-gap non-authority, and opportunity rejection when revision, controller, scope, or executable affordance does not match.

SessionZeroKernel is no longer a target owner; Draft is a WorldState phase. Aggregate Campaign state is no longer an owner; aggregate views are derived from typed components. A checkpoint is no longer a repair authority; it is a projection of committed history.

Invariants

1. Every world mutation passes through one deterministic reducer and one atomic compare-and-swap commit.
2. Authority is derived inside the kernel from canonical membership, governance, custody, jurisdiction, and controller scope.
3. Each autonomous decision scope has exactly one controller. Cognition mode changes representation only; there is no fallback or double action.
4. Narrative interpretation is total. Persona prose is preserved; faithful typed proposals and exact translation gaps account for the turn. The Interpreter does not accept, reject, or commit world state.
5. Structural invalidity is rejected deterministically before persistence and without a model verifier. A failed batch changes nothing.
6. Private knowledge remains scoped until an explicit communication command or a witnessed event under the subject's place changes it.
7. External consumers retain sovereignty. Ghostlight views, proposals, and acknowledgements cannot mutate external-owned state.
8. Sparse causal sufficiency governs structural validity; counts and qualitative review remain evaluation evidence and never gate admission. Elaboration additionally pursues the seed's authored WorldScaleIntent as a derived scale deficit; cover budget is the deliberate choke on simulation attention.
9. Restart reconstructs the exact committed world and idempotency history; a recovery loop cannot repair or reinterpret it.
10. Canonical IDs are allocated only while a complete private reduction is being admitted. Rejected and no-effect commands cannot consume or reveal them.
11. Controller assignment and affordance grants are canonical aggregate state. Current executability and decision opportunities are deterministic derivations bound to a scope digest over the components they read; a proposal whose scope digest is unchanged commits at a later revision, and one whose scope changed is rejected. A scheduler can order those opportunities but cannot mint their authority.

Implementation sequence

1. Seal the aggregate boundary — landed

Establish WorldKernel with a private aggregate and private journal child before publishing ontology types. Expose only create/open, immutable snapshot, submit, and typed receipts. Make canonical state mutation, ID allocation, reduction, and CultCache writes unreachable from outside the owning module. Prove the visibility boundary and the one-writer transaction seam before widening the state vocabulary.

2. Add the minimal private reducer — landed

66ed2ec implements the state and command vocabulary required for Draft creation, approval, activation, one human action, and one autonomous action. The aggregate owns controller assignments and affordance grants and derives exact revision-bound opportunities. IDs issue only after complete seed validation; rejected and empty reductions do not commit. Places, relations, resources, external ownership, and other ontology components wait for a live typed causal boundary.

3. Prove the private authority slice — landed

Eighteen focused tests exercise Draft creation, approval, activation, one human decision, one NarrativePersona-controlled decision, and one OperationalAgent-controlled decision through the same aggregate action command. They cover exact controller scope and affordance matching, revision-bound opportunity rejection, restart, immutable genesis, idempotency, serialized mailbox ownership, cancellation, lost reply semantics, and forged-history rejection. Controller mode changes representation only; it does not create a second reducer path.

Live NarrativePersona integration still requires the Projector to emit prose context, the Persona to return prose only, and the runner first to persist an immutable receipt-bound Persona turn. The Interpreter returns a completed report containing that exact noncanonical source prose, zero or more typed proposals, and zero or more translation gaps. Spoken words require a typed speech proposal. Invalid capture spans and normal step exhaustion become exact unresolved-source gaps. Any transport or dispatch fault before explicit finalization discards partial captures and leaves the immutable source pending for a fresh attempt; it does not become semantic interpretation failure.

Live OperationalAgent integration receives only its permissioned typed view and tools. Its proposals enter the same command path as narrative proposals. It does not bypass projection privacy, authority derivation, or the reducer.

4. Expose, wire, and cut — landed in source

Commits 6bb6869 and 13d5136 expose the replacement facade as the crate and executable runtime identity while keeping mutable state, ID issuance, reduction, journal access, and authenticated-caller construction sealed. Startup creates or opens one replacement owner and spawns one mailbox; runtime consumers receive only the mailbox-facing command and snapshot surface.

Draft creation, approval, activation, player decisions, and autonomous controller proposals now enter that boundary. The committed daemon tree no longer contains the old Session Zero, legacy kernel, scheduler, verifier, reconciliation, or recovery-writer routes. There is no dual-write or live compatibility router in source.

Resolution, elaboration, transcript/news projection, and external publication remain future typed consumers at their causal boundaries. Model transport, Vault retrieval, Heimdall identity, Eve/CultMesh projection, Idunn health, and external adapters survive only where their ownership remains clean.

5. Integrate deployment actuation and cut production — active

The deterministic foundation is landed: target recipes and Idunn operator bindings compile into private plans and sealed releases, and only a sanitized Expected incarnation may leave that control plane. Shared CultNet contracts own generation-bound activation, service-signed Present health, observed capabilities, explicit disagreement, and process-bound write leases. Odin through pushed 65cf2b2 lands the exact source path, the narrow actuator ports, dynamic systemd isolation, Ready-provider selection, protected activation delivery, and the deployment engine that replaced the command-owner stub.

That engine persists exactly three control record types: one command with a frozen target order, one crash-resumable transaction per target, and one CAS-owned admitted generation per target. The transaction phases are Sealing, Starting, Warming, Fencing, Leasing, AwaitingReady, Routing, Committing, and Complete; stateless targets skip only fencing and leasing. Activation is prepared without starting a process, its public identity is persisted, and only then may the prepared process start. A credential or unit with no persisted activation owner is an orphan and cannot be adopted. Committing atomically replaces the exact incumbent and completes the transaction.

Targets own constrained launch declarations, never raw unit or container templates. The operator binding selects the workload driver, which alone lowers that declaration into process-manager configuration. Likewise, deterministic plan validation retains exact commit, tree, recipe, and Gitlink facts but proves neither ancestry, signatures, nor object custody; the narrow Idunn-owned source driver must establish those facts before actuation.

The integrated path must publish Expected from the sealed plan and release, record Idunn's observation of the exact runtime activation, and require the service's signed Present health. A stateful candidate receives its process-bound write lease before it opens writable state. Odin alone correlates Expected, activation, and Present into Ready. Only after Ready may Idunn change stable route membership and drain the incumbent. The deployment brake gates body changes; same-release continuity remains separately owned and may be stopped only by an explicit lifecycle brake.

Idunn starts and recovers from its own durable admitted state. Odin is the first managed semantic daemon, never an Idunn bootstrap dependency; initial Odin admission is the sole graph-bootstrap exception and begins from a root-admitted local binding. During an Odin outage, Idunn may preserve already-admitted continuity and routes, but it may not start a graph-changing transaction or promote without the exact frozen Odin Ready receipt for that runtime instance and presence digest. Idunn never manufactures Ready locally.

Deploy CodexConnector first, then Ghostlight. Ghostlight's live cut archives the entire legacy state root, creates a clean world-v3 root, and validates a complete allowed live layout. After route, health, process, write lease, restart, and negative legacy checks agree, delete the old units, releases, state roots, acceptance debris, gamecult-ops target deploy programs, and local run scaffolding.

6. Widen the ontology to the causal boundary — landed

The operator ordered this stage ahead of the deployment cutover. Step 2 deferred places, relations, resources, and external ownership until "a live typed causal boundary" existed; this stage builds that boundary.

The closed vocabulary is docs/architecture/ghostlight-world-ontology.md: typed ID namespaces, draft-handle references resolved inside one closed WorldPatch, twelve decision-constraining components over twenty-seven named operations, world-authored affordances (preconditions, effect slots, outcome bands) that make character action a deterministic precondition-effect transition, four derived CausalBoundary kinds (a draft SeedRequest is representable, not inhabited: Draft answers nothing), scope-digest binding for proposals, and one AdmitPatch command shared by seed admission and boundary elaboration. Eight elaborators are one OperationalAgent loop whose tool catalog is a projection of the operation set. The document carries its own cut line, subtraction budget, build budget, and eighteen-proof verification contract.

Implementation order, each pass landing tests before the next begins:

1. Typed ID namespaces, Ref<Id> with draft handles, closed-patch resolution, and the complete mismatch set; no components yet. Proves the Run 115 rejection shape against an otherwise empty ontology.
2. Position, Route, containment, topology admission, and scope-digest binding for opportunities.
3. Custody, Dependency, conservation, and evidenced admission.
4. Affordance catalog: preconditions, effect slots, kernel-entropy band selection, and the action pipeline replacing Speak-only invocation.
5. Authority, Selection, Redress, and institutional affordances.
6. Knowledge, Channel, Fact standing, and scoped-projection non-leakage.
7. Commitment, Pressure, obligation → pressure → opportunity flow, and boundary derivation.
8. AdmitPatch with boundary and scale-deficit binding (Draft answers nothing; SeedRequest stays uninhabited); WorldScaleIntent with structural qualification and per-jurisdiction deficit derivation; and the derived elaborator tool catalog.
9. Budgeted connected cover: agency-graph partition under the cell budget, singleton detail focus, grouped coarse cells with partitioned views and per-constituent attribution, debt rotation. Scheduler-owned; the kernel never sees a cell.
10. Consumer ingress: landed in pass 10. SystemCapability::Consumer is the world's third AdmitPatch author, minted only by WorldMailbox::submit_consumer after world/consumer.rs authenticates a ConsumerPatchDocument against a ConsumerRegistry secret digest. require_patch_author/confine_to_ground widen to PatchGround::Consumer, confining a consumer to the subjects declared NewController::External { consumer } (ControllerAssignment::ExternallyControlled, no controller ID, no mode, no opportunity, no affordance). patch::decode_patch is the one decode bound, shared by the elaborator lane and the consumer lane, under MAX_PATCH_BYTES/_DECLARATIONS/_OPERATIONS/_EVIDENCE. The transport is POST /cultnet/world-patch, loopback-only, canonical MessagePack, schemas ghostlight.consumer_patch.v0 and ghostlight.consumer_receipt.v0; the state/commit schemas bumped to ghostlight.world_state.consumer.v1 / ghostlight.world_commit.consumer.v1 (world-v3). The outbound consumer response — a consumer reading its own projection or an attributed proposal — is the next seam, not part of this pass.

The deployment cutover (step 5) is deferred behind this stage, not cancelled. No world acceptance run may start while Yggdrasil serves the legacy body.

7. Contract verification

8. Seed producer — landed

Objective: a world that is alive at genesis rather than three subjects in one room. The first live smoke (notes/local-live-smoke.md) proved the road and showed that genesis yields thin prose because nothing authored exists to want or be wanted.

What landed: world_create.v2 carries WorldScaleIntent (targets and jurisdiction roots) into the genesis patch itself, write-once; a v1-announcing invocation is refused before any handler runs. qualifies lost its Draft-excluding phase clause, so a Draft world's scale deficit is live and falls as structure is authored; the Draft-answer refusal that used to hide behind that clause now lives only in require_answer. The Draft seed lane — SeedPort (two methods, snapshot and submit_seed), SeedRunner, SeedSession/SeedCheckpoint, ControllerWork::Seed and WorkLane::Seed on controller_work.v10 — runs one authoring session per world.seed invocation on the existing elaboration repair loop, admitting at most one Draft patch as CallerId::Principal(owner) through the unconfined owner lane; there is no marker in the journal distinguishing a seed-authored patch from a hand-authored one. VaultEvidenceSource (world/vault.rs) is the seed lane's production EvidenceSource: a read-only markdown directory reader whose evidence reference is a note's vault-relative .md path. world.advance_time's missing operation_schema entry — every invocation of it was silently unreachable — was fixed ahead of world.seed, and every_operation_the_panel_emits_has_a_schema is the totality test that makes that class of gap fail loudly instead of silently.

SeedRequest is resolved in the negative: Draft answers nothing, and the seed lane's port cannot express an answered patch, so nothing ever needed SeedRequest to bind. It stays representable in the CausalBoundary vocabulary and uninhabited in practice.

Left undone: the seeded live run (the extended local live smoke seeds a world from a real Vault before ticking it, but has not yet been run against a real connector — see notes/local-live-smoke.md); ControllerWorkCustody::Owned gained a seed_commands count while Grouped still has none, an asymmetry named and not fixed; the Vault's keyword fallback scores by raw token-count match rather than any real relevance ranking; and VaultEvidenceSource::open reads its whole configured scope into memory on every invocation rather than caching across sessions.

Cut line: no new reducer, ID allocator, conservation check, or SystemCapability; no second tool surface; no compatibility path for the three-subject genesis.

Required black-box proofs:

1. Draft → Active → player action → autonomous action → restart preserves the exact digest and commit history.
2. Invalid ontology patches are atomic and model-free; a typed causal boundary can activate sparse new state.
3. Models, scheduler, projection, and recovery are inert without an explicit aggregate submission.
4. Private knowledge stays private until explicit communication.
5. External proposals and acknowledgements cannot mutate consumer-owned state; only a fresh owner snapshot can update the local observation.
6. Narrative and operational controllers have exact disjoint scopes, never fall through, and never consume one opportunity twice.
7. Interpretation always completes semantically and preserves unlowered material as translation gaps.
8. A no-effect command leaves revision, state digest, commit digest, ID allocation, and journal length unchanged.
9. An external crate cannot obtain mutable aggregate state, invoke the canonical ID allocator, call the reducer, or write the journal; a caller-supplied unknown ID is rejected rather than admitted.
10. A decision proposal is rejected when its opportunity's scope digest has changed or its controller or currently executable affordance is wrong; the scheduler cannot manufacture or consume authority.

A 1,200-actor synthetic fixture may measure load after these pass. It cannot serve as an ontology or completeness gate. No live Delvehold acceptance run is admitted before the focused suite passes and the old writers are structurally unable to override the aggregate.

9. Interruption — landed

Objective: a subject whose world moved between forming an intent and committing it is interrupted, not silently refused, and the interruption is narrated from what it could perceive.

Landed mechanism: a proposal binds to the scope digest of the components its verification reads; when another commit moves that digest before the proposal lands, the kernel refuses it with ScopeChanged. The narrative lane's own early scope checks are deleted — the kernel's exact_opportunity is the sole detector for the narrative lane, and ScopeChanged on submit is the one event with one handler, submit_narrative's interrupted arm. The Persona is never re-run: on ScopeChanged the runner re-lowers the same prose once through the Interpreter against a fresh opportunity (select_fresh/select_scope), with a second input — an Interruption carrying the fresh ScopeComponents, the Overheard rows later than the turn's bound revision, and the discarded first-lowering evidence. The re-lowered turn is PersonaTurn::recorded fresh, never mutated, and carries interrupted_from pointing at the binding it replaced; a turn whose binding already carries interrupted_from is not re-lowered again — it ends as NarrativeRun::Interrupted, structurally, because no progression arm gives a re-lowered binding a second successor. A fresh opportunity whose granted set has lost Speak also ends the turn as Interrupted rather than spending an Interpreter round on an invocation it cannot express. Interruption is defined by the digest, so a neighbour's act, a clock tick that rolls a routine's due, an elaborator patch, a consumer document, and a world-scale event are one case, indistinguishable at the handler. Schema bumps: controller_work.v11 and ghostlight.persona_turn_receipt.v3; prior rows are refused, not migrated. Eve reports the interruption through ControllerHttpResult::Interrupted, which renders as denied in the command result today; the receipt text carries the subject, both scope digests, the persona prose and receipt digest, and the untranslatable gap.

Cut line held: no new kernel arm, bundle, or joint command; no second Persona turn; no event log reaches a controller; the delta shown to the Interpreter is exactly what the membrane already lets the subject perceive (Overheard is built only from Told rows with a resolved speaker label, never a raw knowledge row). The joint-per-room Interpreter was considered and rejected: the room is not the unit of interruption, the digest is.

What is undone: no road run has exercised the re-lowering against a live provider; none exists yet. Closed since landing: fork D's branch was dead by construction (grants are insert-only, so a fresh opportunity always carries speech) and is deleted; transfer, route-closing, and grant-revocation causes are proven anonymous by Soul; a run_cover_tick end-to-end carries an interruption through a real tick and shows the overtaken turn committing nothing; a witness landing mid-turn yields the anonymous knowledge line and no overheard row. Still open: the elaborator-patch cause is proven only by the shared code path, not by a fixture that drives the elaborator past its answer gate; and whether Eve's command-result vocabulary needs a fourth state for an overtaken turn is the Eve owner's question.

10. Witnessed events over a place subtree — landed

Objective: stories that carry regional and global effects. An asteroid is witnessed by everyone under a region's root; the moon going dark by everyone under a hemisphere's; a subject standing in a village under both sees both.

Landed mechanism: ComponentOp::Witness { fact, place, confidence } lands Witnessed knowledge of the fact on every subject positioned anywhere under the place. Recipients are never stored; ResolvedOp::Witness's apply arm derives them at apply time through under_place, the same subtree walk audience's Reach::Place arm now calls, so a declared broadcast area and a witnessed event share one definition of "under a place". Whoever already holds the fact is dropped through unheld, factored out of fan_out's old inlined filter so Communicate and Witness cannot disagree about who already knows. A telling still occurs into an empty room, so Communicate's empty fan-out stays a legal no-op; a witnessed event is only its reception, so a Witness over an empty subtree, or one where every standing subject already holds the fact, is refused as Mismatch::NoOperationEffect at resolve (over the candidate graph, including this patch's own relocations) and KernelError::Invariant("a witness reaches nobody who does not already hold the fact") at apply — one rule, both layers. Confinement runs through one new operation_ground arm returning the named place as the whole ground: an elaborator may witness only under its own jurisdiction root, and a PatchGround::Consumer patch can never witness, because its ground names no place. Every recipient's scope digest moves and nobody else's does, which is what makes a regional or global event interrupt whoever was mid-thought (step 9).

Beyond the operation itself, an affordance slot, ComponentOpKind::Witness { confidence } with roles [fact, place] and no subject role, was not anticipated by this plan's text but was needed to let a world-authored affordance (a bell, a beacon) cause a witnessed event without a proposer ever naming a speaker; the source is Witnessed by construction, since ComponentOp::Witness has no field a teller could enter. One PATCH_TOOLS entry, witness, rounds out the model-facing surface. Both store schemas moved to ghostlight.world_state.consumer.v2 and ghostlight.world_commit.consumer.v2; a store written under the prior schema is refused, not migrated.

Cut line held: one fan-out owner (under_place), shared by audience and Witness; one never-overwrite owner (unheld), shared by fan_out and Witness; no stored recipient list; a witness names no speaker, so Told stays unrepresentable outside Communicate; no new Mismatch, KernelError variant, CommandBody, SystemCapability, or CompositeShape; verify_state_shape, can_broadcast, and candidate_in_audience untouched.

What is undone: the affordance-declaration refusal for a slot whose second role binds a subject is proved directly through arity and role_kind_fits, not by submitting a malformed AffordanceDeclaration through admission — the gate is the one gate either way, but the submission path itself is untested. The grouped lane's cost is untouched: a region-wide or global witness still discards a grouped cell's in-flight work for every constituent it touches, which is the debt this pass explicitly declined to pay.

Subtraction budget

Prefer deletion, collapse, or reuse before adding surfaces. The replacement buys explicit capabilities: one lifecycle owner, one structural reducer, one persistence writer, disjoint cognition controllers, total interpretation, and restart proof. It must retire more writer and stage liability than it adds. Review each completed pass for modules, binaries, schemas, dependencies, processes, and tests added or removed.

Build budget

• Build host: Yggdrasil through Idunn-configured pinned Linux containers. Do not build the deployment body on Windows.
• Control plane: odin-core library tests plus idunn-daemon library/binary checks; Linux x86_64 release artifacts are idunn and idunn-provision only.
• Targets: codex-connector library tests with and without daemon, then the codex-connector release binary with daemon; ghostlight-dungeon focused tests, then the ghostlight-dungeon release binary. Default target features remain unchanged unless the target-owned recipe names an existing required feature.
• Output roots, container digests, cache mounts, current footprints, retention, and expected deltas are operator-binding inputs and must be measured on Yggdrasil before the first build. No workspace-wide, all-target, clean, or cross-platform build is admitted.

Deferred research lanes

The 36-case agency corpus, separate-account multiplayer proof, visual/Ink fixtures, newspaper variation, and direct-tool Persona comparison remain useful research lanes. They do not steer the authority rebuild and cannot reopen a retired writer. Historical plans and results remain recoverable through Git, the evidence ledger, and the frozen pre-rebuild system map.