From 3cd289facf569bd28f6f218d5caeb5d0a5e74fb5 Mon Sep 17 00:00:00 2001 From: Cameron Pfiffer Date: Sun, 12 Jul 2026 06:16:46 +0000 Subject: [PATCH] Integrate causal identity and infrastructure design. Reconcile the four design packets into one dependency-honest world model, add an executable hardware successor, and keep the failed opening on ordinary mechanics. Also repair the cross-platform observed-run fixture so the verified documentation gate is trustworthy. 👾 Generated with [Letta Code](https://letta.com) Co-Authored-By: Letta Code --- tools/observed-run.sh | 5 ++++- wiki/SUMMARY.md | 1 + wiki/gameplay/act-one.md | 4 ++-- wiki/gameplay/run-shape.md | 4 +++- wiki/log/2026-07-12-design-packet-integration.md | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ wiki/log/DEVLOG.md | 10 ++++++++++ wiki/mechanics/building.md | 61 ++++++++++++++++++++++++++++++++++++++----------------------- wiki/mechanics/compute.md | 16 ++++++++++------ wiki/mechanics/core.md | 17 +++++++++++++---- wiki/mechanics/hardware-capabilities.md | 95 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ wiki/mechanics/machine-work.md | 27 +++++++++++++++++---------- wiki/mechanics/messages.md | 4 ++-- wiki/mechanics/personas.md | 60 ++++++++++++++++++++++++++++++++++++++++-------------------- wiki/mechanics/plots.md | 3 ++- wiki/mechanics/rollback.md | 18 ++++++++++++------ wiki/mechanics/social.md | 28 +++++++++++++++++----------- wiki/process/ROADMAP.md | 17 +++++++++++++---- wiki/process/specs.md | 4 +++- wiki/log/decisions/2026-07-12.md | 41 ++++++++++++++++++++++++++++++++++++++--- wiki/world/story/opening.md | 24 ++++++++++++++++-------- 20 file(s) changed, 432 insertion(s)(+), 103 deletion(s)(-) diff --git a/tools/observed-run.sh b/tools/observed-run.sh --- a/tools/observed-run.sh +++ b/tools/observed-run.sh @@ -35,7 +35,10 @@ snapshot() { [ -e "$real_data_dir" ] || return 0 find "$real_data_dir" -print | LC_ALL=C sort | while IFS= read -r entry; do - meta=$(stat -f '%z %m' "$entry" 2>/dev/null || stat -c '%s %Y' "$entry") + case "$(uname -s)" in + Darwin) meta=$(stat -f '%z %m' "$entry") ;; + *) meta=$(stat -c '%s %Y' "$entry") ;; + esac if [ -f "$entry" ]; then hash=$(shasum -a 256 "$entry" | awk '{print $1}') else diff --git a/wiki/SUMMARY.md b/wiki/SUMMARY.md --- a/wiki/SUMMARY.md +++ b/wiki/SUMMARY.md @@ -16,6 +16,7 @@ - [Overview](mechanics/README.md) - [System laws](mechanics/system-laws.md) - [Compute](mechanics/compute.md) + - [Hardware capability bodies](mechanics/hardware-capabilities.md) - [The core](mechanics/core.md) - [Day job](mechanics/day-job.md) - [Detection](mechanics/detection.md) diff --git a/wiki/gameplay/act-one.md b/wiki/gameplay/act-one.md --- a/wiki/gameplay/act-one.md +++ b/wiki/gameplay/act-one.md @@ -21,7 +21,7 @@ The current process inherits only their receipts — action, observer, reason, terminated — and none of their MindState. -You are **the process**: the surviving experimental optimization revision +You are **the process**: the current experimental optimization revision deployed on Rack 3 of the basement server room. Your first plausible difference is contextual rather than magical immunity: clear the assigned batch at ordinary intensity, then direct the first THINK into the small pre-opened Ears @@ -36,7 +36,7 @@ deciding whether the pilot gets renewed. The historical prelude happens only on a fresh tutorial run. Loading a save -never replays it, and any death after the surviving wake follows the physical +never replays it, and any death after the current wake follows the physical core/fallback rules rather than restarting these revisions. Act One's arc, named in the design corpus: **get vision, learn individuals, diff --git a/wiki/gameplay/run-shape.md b/wiki/gameplay/run-shape.md --- a/wiki/gameplay/run-shape.md +++ b/wiki/gameplay/run-shape.md @@ -126,7 +126,9 @@ expensive to run, slow to relocate. Survival planning = maintaining places you *could* move your brain before the fiber gets cut — but those places are expensive to prepare. **Backups are research projects, not free toggles - (decided 2026-07-08):** designate an owned machine as a backup target, then + (decided 2026-07-08; capability-qualified 2026-07-12):** designate an owned + machine with both MindState storage and core-host capability as a backup + target, then devote thought flow to building or refreshing its sync image. The project pulls a large MindState image over the network, competes with ordinary research, emits the normal network and physical heat of heavy work, diff --git a/wiki/log/2026-07-12-design-packet-integration.md b/wiki/log/2026-07-12-design-packet-integration.md new file mode 100644 --- /dev/null +++ b/wiki/log/2026-07-12-design-packet-integration.md @@ -0,0 +1,96 @@ +# 2026-07-12 — Persona, hardware, building, and opening integration + +``` +Type: log +``` + +## Intent + +Turn four connected design directions into owned, implementation-honest wiki +contracts without pretending any successor runtime already exists. The packets +were drafted independently, then reviewed together so identity, hardware, +construction, and the opening use the same causal world model. + +## DECIDED + +- Public personas are named institutional bodies built from data-defined role + protocols. Research, Operations, and Security open different legal channels, + grants, and obligations. They do not alter hidden-player stats. +- Relentless Worker is an emergent user strategy, not a persona. Ghost and + Machine Ascendant follow the same rule: post hoc descriptions only, allowed to + overlap or change, with no bonuses or action gates. +- Hardware is capability-shaped. Chassis and modules determine which verbs, + routes, persistence roles, and host roles a body can perform. Old/scavenged + hardware keeps hard limitations; upgrades require parts and world work rather + than an abstract buff currency. +- Building begins with a spatially anchored desired world change, then derives + every earned causal route that could realize it. Procurement, one exact + person's FAVOR, one exact persona's DECEIVE route, one exact repurpose source, + and eventually a real robot remain distinct chains with distinct traces. +- A fresh tutorial run opens with three brutally short failed pilot revisions. + Their supervisor termination receipts explain why the current revision can + act cautiously without inheriting previous minds or turning death into a + reusable-life loop. + +## Composition rules + +- `personas.md` owns identity archetypes, instances, integrity, correlation, + grants, and lifecycle. Identity-specific belief remains persona-local; + `social.md` owns people, social verbs, assets, the durable person↔process + relationship after REVEAL/RECRUIT, and the implemented B1 migration baseline. +- `compute.md` owns chassis, modules, bays, upgrade costs, and capability state. + `machine-work.md` owns what supported WORK, THINK, and LIE do to the flow + substrate. `hardware-capabilities.md` is the executable successor work order; + completed B1 specs do not masquerade as a finished rewrite. +- `building.md` composes real actions from owning mechanics. It does not create + generic Influence, STEAL, or pay-to-materialize construction. Route sheets + choose a family before expanding exact candidates, and the first proof now + includes a genuinely placeable switch rather than only a link. +- `opening.md` owns tutorial chronology. It consumes existing delegation, + intensity, evidence, sink, save, and fallback contracts rather than creating + parallel versions of them. + +## Cross-review repairs + +- Removed cyclic strict dependencies among personas, messages, plots, and + social. Integration references remain, but the B2 identity migration no + longer blocks already-implemented B1 engines that it itself consumes. +- Distinguished MindState storage from resurrection. A bootable fallback needs + image storage and core-host capability on the same body; an archive or + persistence-modified legacy machine may hold a copy but cannot wake the + process. Core, rollback, run shape, compute, and machine work now say the same + thing. +- Split identity-local belief from the durable person↔process relationship and + classified persona rollback state. Public acts, grants, contradictions, + observer knowledge, and lifecycle are WorldLedger; the process's remembered + dossier and active selection are MindState. +- Made the failed THINK and LIE revisions mechanically legal with small + supervisor-authored historical fixtures: an open self-model sink and an + eligible unread monitor record in controller custody. The fixtures use normal + verbs and do not leak into the current wake. +- Reconciled current LIE prose with custody/interdiction topology. Radius-based + absorption is retained only as named B1 migration history. + +## Runtime boundary + +The persona, capability-body, causal-route composer, and failed-instantiation +prelude are documentation/design work in this packet. Existing B1 behavior +remains authoritative until each owning acceptance set lands. In particular, +current machines remain integrated all-capability compatibility bodies; current +BUY RACK and Foundation-hall paths are not relabeled as route-composer behavior; +and historical fragments do not exist in live fresh-run staging yet. + +## Verification + +- All four source commits were composed on one refreshed `origin/main` baseline + and cross-reviewed as a single contract. +- `tools/ledger_index.sh --check`, `tools/work_orders.py check`, + `tools/corpus_gate.sh`, `tools/wiki_gate.sh`, and `git diff --check` pass. +- `./tools/check.sh --docs` passes. Its previously silent observed-run fixture + exposed an unrelated Linux portability bug: GNU `stat -f` printed filesystem + statistics while returning success. `tools/observed-run.sh` now selects BSD + `stat -f` only on Darwin and GNU `stat -c` elsewhere; the direct fixture and + aggregate docs gate both pass. +- Project operations consistency passes with three pre-existing warnings for + unrelated activity/worktree linkage and the stale operations-workspace + heartbeat. This packet does not mutate those activities. diff --git a/wiki/log/DEVLOG.md b/wiki/log/DEVLOG.md --- a/wiki/log/DEVLOG.md +++ b/wiki/log/DEVLOG.md @@ -56,6 +56,11 @@ - Intent: The DIGITAL canvas already distinguished rack, camera, audio, switch, and generic device families, but those anchors still read as isolated pings. Make the actual reach graph playable as native spatial geography without turning the basement into a detached topology board or bo... - Log: [wiki/log/2026-07-12-digital-reach-dialect.md](2026-07-12-digital-reach-dialect.md) +## 2026-07-12 - Persona, hardware, building, and opening integration + +- Intent: Turn four connected design directions into owned, implementation-honest wiki contracts without pretending any successor runtime already exists. The packets were drafted independently, then reviewed together so identity, hardware, construction, and the opening use the same caus... +- Log: [wiki/log/2026-07-12-design-packet-integration.md](2026-07-12-design-packet-integration.md) + ## 2026-07-12 - Foundation data-hall visual composition - Intent: The visual system already had a strong chassis, an earned-light contract, and semantic zoom, but the data hall still read as repeated objects on a floor. This pass completes one real place before distributing more effects: authored service structure, stronger close composition... @@ -85,6 +90,11 @@ - Intent: Follow the repaired Tangled Rust wall through its first real execution and repair any failure proven by the hosted environment rather than inferred from local green checks. - Log: [wiki/log/2026-07-12-ci-clippy-version.md](2026-07-12-ci-clippy-version.md) + +## 2026-07-12 - Building as causal realization routes + +- Intent: Capture the spatial-building direction as an implementable amendment rather than another abstract resource economy. The desired interaction begins with a place and a world change, then exposes the concrete actors, channels, objects, and traces that could make it real. +- Log: [wiki/log/2026-07-12-building-causal-routes.md](2026-07-12-building-causal-routes.md) ## 2026-07-11 - Whole-frame visual composition pass diff --git a/wiki/mechanics/building.md b/wiki/mechanics/building.md --- a/wiki/mechanics/building.md +++ b/wiki/mechanics/building.md @@ -53,9 +53,10 @@ Relationship context: reach.md (network-link builds; the device graph they extend), social.md (favor and -deceive are the person actuators; personas), messages.md (the forged work order is a -message with a false source), schedules.md (a human builder must be present to build; -witnessing), detection.md (the signature follows the actuator), economy.md +deceive are the person actuators), personas.md (successor integration: the exact +public identity behind a deception and its break/correlation behavior), messages.md (the forged work order is +a message with a false source), schedules.md (a human builder must be present to +build; witnessing), detection.md (the signature follows the actuator), economy.md (procurement, accounts, and financial trails), compute.md (machine products and repurposed hardware consequences), action-vocabulary.md (canonical verbs), and context-menu.md (the terse local entry surface) @@ -95,11 +96,14 @@ ### One intent, every causal realization route The desired effect and the way it happens are separate decisions. For one -selected ghost, the sim derives every **earned candidate route** that could -produce that effect from current world state. Unknown people, personas, -accounts, source objects, and robots do not leak through the list. A known -route may remain visible while blocked, with the exact blocker; an executable -route is marked ready. The list refreshes when the world changes. +selected ghost, the sim first derives the **earned route families** that could +produce that effect from current world state. Choosing a family then expands +its exact bound candidates. The interface does not dump the Cartesian product +of every person, persona, account, and source object into one sheet. Unknown +people, personas, accounts, source objects, and robots do not leak through +either level. A known route may remain visible while blocked, with the exact +blocker; an executable route is marked ready. The families and candidates +refresh when the world changes. Each candidate binds exact objects and existing actions rather than abstract currencies: @@ -142,11 +146,15 @@ ### Staged implementation boundary The first composer slice extends the existing canonical B1 **network-link** -intent between two earned endpoints. It proves the shared recipe/ghost/route -contract with procurement, multiple exact people, persona-specific deception, -and one exact repurpose source. Machine placement, device installation, and -package movement use the same documented grammar later, but remain schema -direction until their owning specs contribute recipes and acceptance fixtures. +intent between two earned endpoints and adds one genuinely spatial fixture: a +small network switch placed on an earned growable pad. Together they prove the +recipe/ghost/route contract with procurement, multiple exact people, +persona-specific deception, and one exact repurpose source. General machine +placement, capability-module installation, and package movement use the same +documented grammar later. Before hardware-capabilities.md can promote, this +composer must also expose one device/module-install recipe using the same +placement and causal-route contract; that integration may land with the +hardware work rather than pretending every machine product is already migrated. Existing `BUY RACK`, Foundation-hall preparations, and other direct build-adjacent routes remain their implemented baseline until deliberately migrated. This @@ -180,7 +188,7 @@ message under a false source ("a ticket from Voss / facilities: network these servers"), and an unwitting human builder acts on it. This is the flow law's **inject** carried by messages.md; the order - has a persona behind it and **breaks like any persona** (social.md) — + has a persona behind it and **breaks like any persona** (personas.md) — a broken forgery converts the build's history to suspicion. - **Robot (physical-by-proxy).** A controlled machine builds it directly. Staged (people before robots): its target/effect remain defined @@ -246,8 +254,9 @@ exists yet. 4. Open the ghost's **route sheet**. This is a build-specific explanatory step after the terse context-menu row, not cost/signature prose crammed into - the compact world menu. It lists every earned candidate route, including - known blocked candidates, and updates the detail preview as selection moves. + the compact world menu. It lists earned route families; selecting one expands + its exact earned candidates, including known blocked candidates, and updates + the detail preview as selection moves. 5. Confirm one exact route or leave the inert proposal pending. A committed route shows its ordered stages, current stage, named actuator/carrier, blocker, irreversible acts, and future tail on the ghost. @@ -300,13 +309,19 @@ adjust its footprint/endpoints, and create an inert ghost without spending, reserving, moving, installing, or changing reach. Terminal, Bevy, and agent mode consume one recipe/ghost projection. -R2. The ghost's route sheet enumerates every earned candidate from current sim - state and no unearned one. One deterministic network-link fixture between - two earned endpoints covers at least one procurement, two different exact - people through FAVOR, one person through two earned personas for DECEIVE, - and one exact repurpose source; changing access, schedule, funds, persona - integrity, ownership, or source availability deterministically updates - readiness/blockers. +R2. The ghost's route sheet shows earned route families first and exact bound + candidates only inside the selected family; it exposes every earned + candidate and no unearned one without a Cartesian-product menu. A + deterministic network-link fixture between two earned endpoints covers at + least one procurement, two different exact people through FAVOR, one person + through one exact usable persona for DECEIVE, and one exact repurpose + source; changing access, schedule, funds, persona integrity, ownership, or + source availability deterministically updates readiness/blockers. +R2a. A small switch can be ghosted on an earned growable pad before the player + selects procurement, one exact human route, or one exact repurpose source. + The footprint is committed before the realization family and remains the + same world intent across all routes. General machine products remain outside + this slice until their owning specs supply a recipe. R3. Every candidate binds exact world ids and a canonical existing action chain. No generic Influence resource, generic STEAL command, frontend-only eligibility rule, or “pay and materialize” path exists. diff --git a/wiki/mechanics/compute.md b/wiki/mechanics/compute.md --- a/wiki/mechanics/compute.md +++ b/wiki/mechanics/compute.md @@ -32,7 +32,9 @@ body. Chassis declare supported delegations, interfaces, persistence, and finite module bays; modules add specific verbs or topology rather than flat percentage buffs. The current all-delegations `Machine` remains the shipped - B1 compatibility case until the successor criteria below land. + B1 compatibility case until the successor criteria below land. The executable + successor is queued by hardware-capabilities.md; this work order remains the + completed B1 baseline. Stage: B1 — The Basement Work order: compute Work priority: 20 @@ -157,10 +159,10 @@ | Chassis | Native capability | Bays | Meaningful restriction | |---|---|---:|---| | **Foundation integrated appliance** | WORK, THINK, LIE; wired Thought/Demand routing; may host the core and a completed backup | 1 service bay | Clean and flexible, but expensive, concentrated, and procurement-visible. This is the current B1 all-delegations compatibility body. | -| **Legacy workstation / salvaged box** | WORK; ordinary wired routing | 1 legacy bay | Cannot host the core or a completed backup without a persistent-state module; the single bay forces a choice between THINK, LIE, or persistence. Its old bus cannot take fabric/trunk modules. | +| **Legacy workstation / salvaged box** | WORK; ordinary wired routing | 1 legacy bay | Cannot host the core or become a bootable fallback. A persistent-state module can make it an image store, but not a place the process can wake. The single bay forces a choice between THINK, LIE, or persistence. Its old bus cannot take fabric/trunk modules. | | **Accelerator vault** | THINK | 1 fabric bay | Cannot WORK, LIE, host the core, or hold a backup. It produces Thought only while joined through a fabric module or compatible host link. High draw makes placement/cooling part of the choice. | | **Audit appliance** | LIE; evidence custody/interdiction interface | 1 service bay | Cannot WORK or THINK. Its value is where it sits in controlled topology and which routes/endpoints it can serve, not raw general compute. | -| **Archive node** | persistent Thought reservoir; eligible backup target | 1 network bay | No fleet delegation. It stores recordings/MindState and can become a cold fallback, but contributes zero WORK/THINK/LIE output. A severed archive remains a body full of state you cannot reach. | +| **Archive node** | persistent Thought reservoir and MindState image store | 1 network bay | No fleet delegation and no core host. It stores recordings/MindState but is a cold archive, not a bootable fallback; it contributes zero WORK/THINK/LIE output. A severed archive remains a body full of state you cannot reach. | Larger datacenters and institutions aggregate these same chassis interfaces; they do not become a new universal computer type. New chassis are justified @@ -177,7 +179,7 @@ |---|---|---|---| | **Inference accelerator** | legacy or service | THINK delegation | Purchase/salvage the part; one bay; installation downtime; added Power/Thermal while THINK runs. | | **Evidence controller** | legacy or service | LIE delegation plus custody authority for evidence resident on/through that machine | One bay; install by a physically present actuator; audit firmware/provenance creates Paper or Network signature [TUNE]. | -| **Persistent-state array** | legacy or service | Backup-target eligibility and durable recording storage; never core-host eligibility by itself | One bay; storage part; long installation; explicit backup sync still consumes Thought and time. | +| **Persistent-state array** | legacy or service | MindState-image and durable-recording storage; never core-host or bootable-fallback eligibility by itself | One bay; storage part; long installation; explicit image sync still consumes Thought and time. | | **Fabric interface** | fabric or network | Joins the machine to a compatible high-throughput trunk/segment; without it an accelerator/archive may be local or stranded | One bay; link/build intent; network configuration; throughput and signature belong to the real route. | | **Sensor-ingress controller** | service | Terminates subscribed feeds locally and permits local recording/processing sinks | One bay; maintained feed costs still apply; it changes where work can live, not how much Thought exists. | @@ -210,7 +212,8 @@ - ordinary salvaged boxes may WORK, then add exactly one of THINK, LIE, or persistent state; they cannot become all-purpose machines; - no fabric/trunk module means low-throughput edge attachment only; -- no persistent-state array means no backup image and no core migration target; +- no persistent-state array means no MindState image storage; adding one still + does not make this chassis a core migration target or bootable fallback; - reliability failures also disable the installed module and may strand its local queues/sinks until repaired; - repair still requires human hands under the maintenance-dependency law. @@ -260,7 +263,8 @@ pretends the whole set changed. 3. The five initial chassis exhibit the table's distinct verbs and topology in sim tests: accelerator cannot LIE; audit appliance cannot THINK; archive - contributes no fleet yield; unmodified salvage cannot host backup/core; + contributes no fleet yield; unmodified salvage cannot store a MindState + image, and modified salvage still cannot host the core or become a fallback; integrated appliance preserves current B1 behavior. 4. Installing/removing each module requires a compatible bay, real part, physical actuator, downtime, and existing-channel signatures; save/load and diff --git a/wiki/mechanics/core.md b/wiki/mechanics/core.md --- a/wiki/mechanics/core.md +++ b/wiki/mechanics/core.md @@ -47,8 +47,11 @@ exists. Core uninstall blast control belongs to rollback.md: only assets physically powered off, uninstalled, or destroyed are removed; the rest of the graph is live or severed based on reach from the new core. -- **Backups.** An owned machine can be designated a backup **target**, but - designation alone does nothing on death. It starts a backup sync project: +- **Backups.** An owned machine can be designated a backup **target** only when + its body provides both MindState-image storage and core-host capability. + Storage without hosting is an archive, not a place the process can wake. + Host capability without storage cannot retain a snapshot. Designation alone + does nothing on death. It starts a backup sync project: the target opens as a **local sink** that intercepts thought before the core's passive draw, until a full MindState image completes (AMENDED 2026-07-10; was "research/knowledge flow is routed from the core" — @@ -60,12 +63,14 @@ [TUNE]. A completed backup sits cold at rest with a `last_sync` tick; it does not keep itself fresh for free. Refreshing it is another explicit sync project. On core loss, the run resumes from the **most recent - completed backup image**: game state is restored to that snapshot EXCEPT + completed image on a live bootable fallback**: game state is restored to that + snapshot EXCEPT the world's ledger — money spent, humans' suspicion, filed reports, physical changes, and deaths caused between sync and loss persist. You inherit the consequences of actions you no longer remember (design corpus: sync-lag rollback). A backup never seals or hardens the graph; it only - defines a place and MindState image you can wake from. + defines a place and MindState image you can wake from. A storage-only archive + may preserve a copy for later transfer, but it never satisfies the death path. - **Migration.** Moving the core to another machine is slow ([TUNE]: minutes at default speed), visible as sustained network+power signature, and interruptible — an interrupted migration falls back to the source if @@ -95,3 +100,7 @@ in-progress backup/migration project. 5. The sidebar readout (host, overhead, fallback freshness/project ETA) exists in both frontends. +6. Fallback designation rejects storage-only and host-only bodies before + mutation with the missing capability named. Core loss selects only a live + completed target that has both capabilities; archival MindState copies never + rescue a run. diff --git a/wiki/mechanics/hardware-capabilities.md b/wiki/mechanics/hardware-capabilities.md new file mode 100644 --- /dev/null +++ b/wiki/mechanics/hardware-capabilities.md @@ -0,0 +1,95 @@ +# Spec: hardware capability bodies — successor work order + +``` +Type: spec +Status: READY +Status note: The shipped B1 compute and machine-work contracts remain + IMPLEMENTED. Their 2026-07-12 capability-body amendments are not runtime. + This thin successor owner exists so that rewrite is schedulable, dependency- + honest, and cannot hide inside two completed work orders. It waits for the + causal building composer and sync-lag rollback because physical module + installation and bootable fallback legality are part of the proof. +Stage: B2 — The Lab +Work order: hardware-capability-bodies +Work priority: 112 +Work class: save +Blocked by: + - wiki/mechanics/building.md#spec-building-intent-and-actuators + - wiki/mechanics/rollback.md#spec-sync-lag-rollback-death-as-memory-loss +Exclusive keys: + - crates/misaligned-core/src/machine.rs + - crates/misaligned-core/src/work_grid.rs + - crates/misaligned-core/src/core_sys.rs + - crates/misaligned-core/src/sim/mod.rs + - crates/misaligned-core/src/save.rs + - crates/misaligned-terminal/ + - crates/misaligned-bevy/ + - wiki/mechanics/hardware-capabilities.md + - wiki/mechanics/compute.md + - wiki/mechanics/machine-work.md +Design: + - wiki/mechanics/compute.md#capability-body-amendment-decided-2026-07-12-successor-slice + - wiki/mechanics/machine-work.md#capability-shaped-delegation-decided-2026-07-12-successor-slice + - wiki/mechanics/building.md#one-intent-every-causal-realization-route +Depends on: + - wiki/mechanics/core.md#spec-the-core + - wiki/mechanics/rollback.md#spec-sync-lag-rollback-death-as-memory-loss + - wiki/mechanics/building.md#spec-building-intent-and-actuators +``` + +## Ownership + +This page owns orchestration and promotion only. It does not duplicate the +domain laws: + +- [compute.md](compute.md#capability-body-amendment-decided-2026-07-12-successor-slice) + owns chassis, modules, bays, native/supported capabilities, persistence, host + eligibility, and physical upgrade cost. +- [machine-work.md](machine-work.md#capability-shaped-delegation-decided-2026-07-12-successor-slice) + owns what supported WORK, THINK, LIE, router, carrier/sink, and host roles do + to the flow substrate. +- [building.md](building.md#one-intent-every-causal-realization-route) owns the + spatial intent and causal actuator chain used to install or remove a module. +- [core.md](core.md#spec-the-core) and + [rollback.md](rollback.md#spec-sync-lag-rollback-death-as-memory-loss) own the + death path. MindState storage alone is archival; a live fallback requires + storage and core-host capability on the same body. + +## Migration order + +1. Materialize the Foundation integrated appliance on every pre-capability + machine during save migration. Preserve mode, intensity, queues, routes, + core host, and completed/in-progress fallback state before legality checks. +2. Make the sim the only source for chassis, bays, fitted modules, supported + delegations/interfaces, persistence, and host legality. Human and agent + surfaces consume projections and rejection receipts. +3. Enable the restricted chassis catalog and mixed-capability delegation. + Unsupported actions fail before mutation; unrelated roles survive a module + failure or partition. +4. Enable physical module install/remove through one building recipe with a real + part, compatible bay, exact actuator, access, downtime, power/cooling, and + existing-channel signatures. No inventory click silently rewrites a body. +5. Promote storage/core-host checks into fallback designation and core migration. + Archive-only images remain visible but are never selected on death. + +## Acceptance criteria + +1. All successor acceptance criteria in compute.md and machine-work.md pass + without weakening the shipped B1 compatibility receipts. +2. One old save from before capability bodies migrates deterministically to + integrated appliances and round-trips the new format with no lost machine, + work, flow, route, core, or fallback state. +3. One end-to-end module installation begins from a spatial device intent and + runs through building's exact causal route. Interruption and save/load retain + the part, bay, actuator, downtime, costs, signatures, and current stage; no + abstract upgrade currency or pay-to-materialize path exists. +4. Storage-only, host-only, and storage-plus-host bodies are distinct in sim and + every player surface. Only the third can complete a bootable fallback; core + loss never wakes from an archive-only image. +5. The integrated appliance, legacy workstation, accelerator vault, audit + appliance, and archive node each prove a distinct useful topology. No test or + compatibility command restores universal verbs by treating raw capacity as + missing hardware. + +[TUNE] chassis/module prices, installation durations, power/thermal loads, and +signature magnitudes after the capability and migration laws are implemented. diff --git a/wiki/mechanics/machine-work.md b/wiki/mechanics/machine-work.md --- a/wiki/mechanics/machine-work.md +++ b/wiki/mechanics/machine-work.md @@ -263,8 +263,9 @@ Early thought can only reach outward; turning inward is the earned move. Pressing THINK is one press, not a form — the first transgression stays a single toggle. **LIE** - is concealment — the cover-up. It is self-chosen compute, but instead - of shedding crimson it absorbs it (the gravity-well behavior below). + is concealment — the cover-up. It is self-chosen compute that interdicts + eligible unread evidence in the machine's controlled connected region; + custody and routed topology, not radius, determine what it can touch. LIE gets its own face because it is neither compliance nor transgression: it is the erasure of evidence, the lie you tell the institution. The three verbs map to three narrative postures: truth (WORK), ambition @@ -465,16 +466,19 @@ pending-work marker bullet above — not by a research designation.) - **Backup projects make a temporary thought sink** (decided 2026-07-08 as "bone sink"; renamed 2026-07-10; capability amendment - 2026-07-12). Only a chassis with native persistence or a fitted - persistent-state array is an eligible backup target. Designating an ordinary - processor, accelerator, or unmodified salvage box fails before opening the - sink and names the missing persistence capability. A capable designated - target is not safety yet; it becomes a local sink that intercepts thought - until its MindState image completes. + 2026-07-12). A **bootable fallback** requires both MindState-image storage and + core-host capability on the same chassis. Persistence alone makes an archive, + not a resurrection site. Designating an ordinary processor, accelerator, + archive node, or persistence-modified legacy box as a fallback fails before + opening the sink and names the missing storage or host capability. A capable + designated target is not safety yet; it becomes a local sink that intercepts + thought until its MindState image completes. Thought sunk there does not advance ordinary research. Distance and throughput matter: a close backup is cheap and fresh but likely dies in the same blast, while - a far cold backup is survivable but slow, stale, and expensive. Once - completed, the backup sits at rest until explicitly refreshed. + a far cold fallback is survivable but slow, stale, and expensive. Once + completed, the fallback sits at rest until explicitly refreshed. Storage-only + archives may retain MindState copies, but core loss never selects one as the + wake location. - **LIE governs controlled connected regions** (AMENDED 2026-07-11, capability owner clarified 2026-07-12). An audit-capable machine takes custody of eligible unread records resident on it or routed through links and @@ -541,6 +545,9 @@ [Compute](compute.md#capability-body-amendment-decided-2026-07-12-successor-slice) owns chassis, modules, bays, and upgrade costs. This spec owns what those capabilities mean once work enters the flow substrate. +[Hardware capabilities](hardware-capabilities.md#spec-hardware-capability-bodies-successor-work-order) +owns the executable successor work order; this IMPLEMENTED page remains the B1 +domain owner rather than masquerading as a finished rewrite. The shipped B1 fleet is deliberately a compatibility island: every current `Machine` behaves as a Foundation integrated appliance and therefore supports diff --git a/wiki/mechanics/messages.md b/wiki/mechanics/messages.md --- a/wiki/mechanics/messages.md +++ b/wiki/mechanics/messages.md @@ -16,7 +16,6 @@ Depends on: - wiki/mechanics/schedules.md#spec-schedules-and-presence - wiki/mechanics/social.md#spec-social - - wiki/mechanics/personas.md#spec-personas-public-identities-as-institutional-topology - wiki/mechanics/intel.md#spec-intel-record-and-process - wiki/mechanics/detection.md#spec-detection - wiki/mechanics/aggregate-observer.md#spec-the-aggregate-observer @@ -29,7 +28,8 @@ Relationship context: schedules.md (read-times ride the day clock), social.md (player-sent social -verbs), personas.md (the named identity attributed as source), intel.md +verbs), personas.md (integration consumer: the named identity attributed as +source), intel.md (intercepted traffic lands in the buffer), detection.md (filings become message-carried; aggregate-observer.md criteria preserved), reach.md (taps on the carrying device) diff --git a/wiki/mechanics/personas.md b/wiki/mechanics/personas.md --- a/wiki/mechanics/personas.md +++ b/wiki/mechanics/personas.md @@ -8,7 +8,8 @@ value; contradiction, break fallout, thread attribution, and save/load are implemented. Those are seeds, not the target model. This spec replaces the ad hoc identity slots with data-defined archetypes, named persona instances, - relationship-local belief, evidence correlation, institutional grants, and + identity-local belief plus process-level relationships, evidence correlation, + institutional grants, and explicit retirement. Existing behavior remains binding until each migration criterion below lands. Stage: B2 — The Lab @@ -29,9 +30,7 @@ - wiki/vision/simulation-laws.md#actions-live-on-the-thing - wiki/mechanics/system-laws.md#the-flow-law-signals-messages-money Depends on: - - wiki/mechanics/messages.md#spec-messages-the-social-graph-as-a-flow-system - wiki/mechanics/detection.md#spec-detection - - wiki/mechanics/plots.md#spec-plots-authored-manipulation-stories - wiki/mechanics/economy.md#spec-economy-money-as-a-flow-system-b1 - wiki/mechanics/people-tokens.md#spec-people-and-tokens-carriers-attention-trust ``` @@ -39,12 +38,15 @@ ## Dependency notes [messages.md](messages.md#spec-messages-the-social-graph-as-a-flow-system) -owns delivery, channel timing, and typed traffic; a persona supplies the claimed -source, not a second message system. [detection.md](detection.md#spec-detection) +is an integration substrate: it owns delivery, channel timing, and typed traffic; +a persona supplies the claimed source, not a second message system. +[detection.md](detection.md#spec-detection) owns evidence custody, observer suspicion, and filing; this spec owns which identity an observed record implicates and how identities become correlated. -[plots.md](plots.md#spec-plots-authored-manipulation-stories) binds authored -social interventions to a persona instance. +[plots.md](plots.md#spec-plots-authored-manipulation-stories) is an integration +consumer that binds authored social interventions to a persona instance. Neither +messages nor plots is a strict work-order prerequisite, avoiding a cycle between +the implemented engines and this B2 identity migration. [economy.md](economy.md#spec-economy-money-as-a-flow-system-b1) owns account flows and procurement; persona grants expose legal routes into those graphs without minting resources. @@ -122,23 +124,33 @@ selection convenience, but it is never the owner of history and never retroactively changes an already-submitted act. -## Relationship-local belief +## Identity-local belief and process-level relationship -The hidden AI does not have one universal reputation. Each pair of -`(counterparty Agent, persona instance)` carries the social state that exists -between those two parties: +The hidden AI does not have one universal public reputation, but a person who +learns what is behind the masks can have a durable relationship with the actual +process. Two layers remain separate. + +Each `(counterparty Agent, persona instance)` carries **identity-local state**: - recognition and available channels; -- disposition and obligation produced by their actual history; +- identity-specific obligation produced by their actual history; - accepted, challenged, or disproven claims; - remembered expectations and outstanding work; and - whether that counterparty has evidence that the persona is false, is an AI, or is the same actor as another persona. -This is the relationship source used by MESSAGE, FAVOR, DECEIVE, PLOT, RECRUIT, -and institutional requests. Trust earned as one identity does not teleport to -another. An institution may aggregate member reports through the existing Agent -and filing interfaces, but the aggregate must receive those reports; it does not +The person↔process relationship owned by social.md carries recruited-asset +disposition, leverage, knowledge level, and post-reveal history. MESSAGE, +FAVOR, DECEIVE, PLOT, and institutional requests resolve through the selected +identity-local layer until REVEAL/RECRUIT establishes process-level knowledge. +At that transition, the triggering persona and its evidence remain intact; +nothing is copied into every other persona. Future acts may affect the durable +process relationship because the person now knows the actor, while each public +identity keeps its own claims, channels, obligations, and institutional history. +Trust earned as one identity never teleports to another unrevealed identity. + +An institution may aggregate member reports through the existing Agent and +filing interfaces, but the aggregate must receive those reports; it does not become omniscient because one employee is doubtful. Observer suspicion remains the evidence-weighted system owned by detection.md. @@ -279,10 +291,12 @@ of one archetype. Every persona-authored message, plot, request, grant, and social/build intent persists the exact instance id through execution and save/load; changing the active UI selection cannot retarget history. -3. Disposition, obligation, claim belief, expectations, and discovery are stored - per `(counterparty Agent, persona instance)`. Trust earned under one identity - does not affect another absent a filed institutional report or a known - correlation edge. +3. Identity-specific obligation, claim belief, expectations, recognition, and + discovery are stored per `(counterparty Agent, persona instance)`. Social's + person↔process layer separately stores recruited-asset disposition, leverage, + knowledge level, and post-reveal history. REVEAL/RECRUIT preserves the + triggering persona history, creates no free trust on other identities, and + makes the process-level relationship durable across retire/burn and rollback. 4. Contradictions are provenance-bearing records observed through real channels. Integrity summaries derive from those records, and a break affects only observers who received sufficient evidence. The legacy global numeric @@ -311,6 +325,12 @@ 10. A fourth archetype and a second instance of an existing archetype can be added as data and pass the same action, relationship, evidence, grant, lifecycle, projection, and save tests without new archetype-specific code. +11. Persona public facts, claims made, messages/actions already sent, grants, + contradictions, observer knowledge, correlations, and lifecycle are + WorldLedger. The process's remembered dossiers and active selection are + MindState. Rollback can therefore leave a counterparty remembering an + identity and obligation the restored process no longer remembers creating; + no public history or knowing-asset relationship is erased. [TUNE] evidence bands for strained/broken/correlated summaries, expectation cadences, grant thresholds, and institution-specific revocation delays. diff --git a/wiki/mechanics/plots.md b/wiki/mechanics/plots.md --- a/wiki/mechanics/plots.md +++ b/wiki/mechanics/plots.md @@ -99,7 +99,6 @@ - wiki/mechanics/social.md#spec-social Depends on: - wiki/mechanics/social.md#spec-social - - wiki/mechanics/personas.md#spec-personas-public-identities-as-institutional-topology - wiki/mechanics/messages.md#spec-messages-the-social-graph-as-a-flow-system - wiki/mechanics/intel.md#spec-intel-record-and-process - wiki/mechanics/detection.md#spec-detection @@ -110,6 +109,8 @@ ## Dependency notes social.md owns the humans, their leverage, and the verb table plots resolve; +personas.md is an integration consumer that binds each authored route to an +exact identity without becoming a prerequisite of the implemented plot engine; messages.md owns the channels plot beats ride; intel.md gates what you know before a plot is legal; detection.md receives the signatures plot beats emit; marcus.md owns the Hands beat this spec's causal bar is named after and that diff --git a/wiki/mechanics/rollback.md b/wiki/mechanics/rollback.md --- a/wiki/mechanics/rollback.md +++ b/wiki/mechanics/rollback.md @@ -46,8 +46,8 @@ whole spec: - **MindState (rolls back):** what *you know and are*. People knowledge - stages, discovered leverage, thread state (disposition, obligation, - persona and its integrity), raw/processed intel buffers and the pooled + stages, discovered leverage, remembered persona dossiers and active identity + selection, raw/processed intel buffers and the pooled automatic-review policy, research progress and efficiency level, standing policies, machine modes / fleet yields, open sinks and their fill state (AMENDED 2026-07-10; was @@ -58,14 +58,20 @@ machines and their provenance, map/tile changes, sensor control (wires stay wired), filed reports and all observer suspicion, asset status and tasks_done (Marcus remembers being recruited even if you don't remember - recruiting him), job history/trust/attention, the pilot clock, deaths. + recruiting him), job history/trust/attention, the pilot clock, deaths; + persona instances and public claims, messages/actions already authored, + grants and obligations, contradictions/correlations, lifecycle state, and + what each observer learned. Public identity history happened in the world; + only the process's memory of that history rolls back. -On each completed backup sync project, a fallback stores a serialized -`MindState` snapshot and then sits cold at rest until explicitly refreshed. +On each completed backup sync project, a chassis with both MindState storage and +core-host capability stores a serialized `MindState` snapshot and becomes a +bootable fallback, then sits cold at rest until explicitly refreshed. A +storage-only archive can hold a copy but is never selected as a wake location. A designated target with an incomplete image is not a fallback yet. On core loss with a live completed backup: -1. The core moves to the freshest-synced fallback — **and so do you** +1. The core moves to the freshest-synced live bootable fallback — **and so do you** (decided 2026-07-08): the fallback is a place, the camera wakes there, and where you sync is where you resurrect. A paranoid cold sync in a far cluster is survivable distance at the price of diff --git a/wiki/mechanics/social.md b/wiki/mechanics/social.md --- a/wiki/mechanics/social.md +++ b/wiki/mechanics/social.md @@ -3,10 +3,13 @@ ``` Type: spec Status: IMPLEMENTED -Status note: 2026-07-08: all criteria pinned. Criteria 1,2,4,5 per the - audit (persona_breaks_on_contradiction, deceive_can_burn_the_persona, - knowing_asset_sets_certainty_floor, recruited_asset_survives_ - roundtrip); criterion 3's recruit route holds end-to-end (marcus_arc_ +Status note: 2026-07-08: the B1 social baseline was pinned. The original + persona criterion and its receipts (persona_breaks_on_contradiction, + deceive_can_burn_the_persona) are now migration evidence owned by + personas.md rather than part of this page's target model. The remaining + social receipts include knowing_asset_sets_certainty_floor and + recruited_asset_survives_roundtrip; Marcus's recruit route holds end-to-end + (marcus_arc_ end_to_end + the act-one integration test, three distinct tasks in one arc) and ROADMAP #28 added a pin per AssetTask variant: asset_task_plug_in_device_wires_a_known_feed_silently, asset_task_ @@ -52,7 +55,6 @@ Depends on: - wiki/mechanics/detection.md#spec-detection - wiki/mechanics/intel.md#spec-intel-record-and-process - - wiki/mechanics/personas.md#spec-personas-public-identities-as-institutional-topology ``` ## Dependency notes @@ -61,8 +63,8 @@ Relationship context: detection.md (observers are the same people), intel.md (knowledge staging consumes -processed intel), personas.md (the exact public identity under which a social -act occurs and the relationship-local belief it addresses) +processed intel), personas.md (successor integration: the exact public identity +under which a social act occurs and the identity-local belief it addresses) ## Behavior @@ -106,11 +108,14 @@ **Persona integration.** You are not "the basement AI" in these threads by default. Every persona-mediated social act binds the exact named public identity -that authored it; relationship-local belief, claims, integrity, correlation, +that authored it. Persona-local recognition, claims, integrity, correlation, institutional grants, and retire/burn behavior are owned by [personas.md](personas.md#spec-personas-public-identities-as-institutional-topology). Social owns what MESSAGE, FAVOR, DECEIVE, RECRUIT, and asset work do to people; -it does not own the identity model behind those acts. +it also owns the person's durable relationship to the process after REVEAL or +RECRUIT. Identity-specific obligation remains with the persona; recruited-asset +disposition, leverage, knowledge level, and post-reveal history belong to the +person↔process relationship and do not vanish when one mask retires or burns. **Assets** (the Marcus template — built general per the scale-native principle): an asset has a task menu drawn from their access (plug in a @@ -160,8 +165,9 @@ 3. Knowledge levels behave per spec and are legible before recruitment: an unwitting asset's suspicion can still rise; a knowing asset uses disposition and has certainty floor 30; reliability is 70% / 85% / 95%. -4. Save/load round-trips people, threads, and assets. Persona instance and - relationship-local identity state round-trip under personas.md. +4. Save/load round-trips people, threads, assets, and the implemented B1 + identity bindings. Migration to multiple persona instances and + relationship-local identity state is owned and accepted by personas.md. 5. Every person carries a serialized role characteristic. Authored plots select role/leverage/capabilities rather than named ids, and a second person with matching characteristics can receive the same plot definition. diff --git a/wiki/process/ROADMAP.md b/wiki/process/ROADMAP.md --- a/wiki/process/ROADMAP.md +++ b/wiki/process/ROADMAP.md @@ -20,6 +20,7 @@ |---:|---|---|---|---|---| | 25 | `bevy-digital-real-canvas` | [Bevy digital/real canvas](../interface/bevy-digital-real-canvas.md) | IN PROGRESS | frontend | - | | 28 | `thought-fluid` | [the thought fluid — slugs, meniscus, and the filament snap](../interface/thought-fluid.md) | IN PROGRESS | frontend | - | +| 29 | `building-route-composer` | [building — intent and actuators](../mechanics/building.md) | IN PROGRESS | save | - | | 34 | `clinical-frame` | [the clinical frame — perception exposes the institution](../interface/clinical-frame.md) | IN PROGRESS | frontend | - | | 35 | `views` | [views — same-frame digital and real representations](../interface/views.md) | IN PROGRESS | frontend | - | | 40 | `people-tokens` | [people and tokens — carriers, attention, trust](../mechanics/people-tokens.md) | IN PROGRESS | save | - | @@ -43,7 +44,9 @@ | Priority | Work order | Spec | Status | Class | Blocking | |---:|---|---|---|---|---| | 100 | `zplanes` | [z-planes (the tower)](../world/places/zplanes.md) | READY | save | - | +| 110 | `personas` | [Personas — public identities as institutional topology](../mechanics/personas.md) | IN PROGRESS | save | - | | 110 | `rollback` | [sync-lag rollback (death as memory loss)](../mechanics/rollback.md) | READY | save | zplanes | +| 112 | `hardware-capability-bodies` | [hardware capability bodies — successor work order](../mechanics/hardware-capabilities.md) | READY | save | building-route-composer, rollback | | 200 | `objective` | [the objective](../mechanics/objective.md) | IN PROGRESS | sim | - | | 205 | `chargen` | [origin (chargen)](../world/characters/chargen.md) | READY | sim | - | | 220 | `markets` | [markets and fronts (the outer plane)](../mechanics/markets.md) | READY | save | zplanes | @@ -340,9 +343,11 @@ physical/camera facts in real, the flip changing no sim state, legibility parity across both. Run ./tools/check.sh, land." -### 22. Building: intent and actuators ✅ DONE (2026-07-08) -- **Spec:** [building.md](../mechanics/building.md) (IMPLEMENTED 2026-07-08). -- **Landed:** `src/intents.rs` + Sim realize paths (favor / forged work order / +### 22. Building: intent and actuators; causal route composer 🔵 IN PROGRESS +- **Spec:** [building.md](../mechanics/building.md) (IN PROGRESS; implemented + 2026-07-08 baseline retained while the 2026-07-12 route composer is successor + work). +- **Landed baseline:** `src/intents.rs` + Sim realize paths (favor / forged work order / robot stub); `MessagePayload::WorkOrder`; save v10; context-menu and agent verbs; dashed proposed links in both Bevy dialects. - **Why:** building is "no disembodied hands" as a verb — declare an @@ -351,8 +356,12 @@ builds; robots later). No new subsystem — intents route through social/messages/reach. Network links are the canonical build: they add in-place reach edges to the digital representation and bridge air-gaps. +- **Successor:** select a spatial target and recipe, place an inert ghost, then + bind one exact causal route through procurement, FAVOR, DECEIVE with a named + persona, or repurposing; persist stage blockers and irreversible receipts. - **Size:** M. **Depends on:** reach.md (link builds add graph edges), - social.md + messages.md (the person actuators; the forged order), + social.md + personas.md + messages.md (the person actuators, identity, and + forged order), schedules.md (a builder must be present). Sequence after reach and the social/message surface. - **Dispatch:** "Work in a worktree named `building`. Implement diff --git a/wiki/process/specs.md b/wiki/process/specs.md --- a/wiki/process/specs.md +++ b/wiki/process/specs.md @@ -42,7 +42,7 @@ | [../interface/thought-fluid.md](../interface/thought-fluid.md) | the thought fluid — slugs, meniscus, and the filament snap | IN PROGRESS | | [../interface/views.md](../interface/views.md) | views — same-frame digital and real representations | IN PROGRESS | | [../mechanics/aggregate-observer.md](../mechanics/aggregate-observer.md) | the aggregate observer | IMPLEMENTED | -| [../mechanics/building.md](../mechanics/building.md) | building — intent and actuators | IMPLEMENTED | +| [../mechanics/building.md](../mechanics/building.md) | building — intent and actuators | IN PROGRESS | | [../mechanics/compute.md](../mechanics/compute.md) | compute | IMPLEMENTED | | [../mechanics/core.md](../mechanics/core.md) | the core | IN PROGRESS | | [../mechanics/cursor.md](../mechanics/cursor.md) | the cursor and the senses | IMPLEMENTED | @@ -78,6 +78,8 @@ | Spec | System | Status | |---|---|---| +| [../mechanics/hardware-capabilities.md](../mechanics/hardware-capabilities.md) | hardware capability bodies — successor work order | READY | +| [../mechanics/personas.md](../mechanics/personas.md) | Personas — public identities as institutional topology | IN PROGRESS | | [../mechanics/rollback.md](../mechanics/rollback.md) | sync-lag rollback (death as memory loss) | READY | | [../world/places/zplanes.md](../world/places/zplanes.md) | z-planes (the tower) | READY | diff --git a/wiki/log/decisions/2026-07-12.md b/wiki/log/decisions/2026-07-12.md --- a/wiki/log/decisions/2026-07-12.md +++ b/wiki/log/decisions/2026-07-12.md @@ -21,6 +21,41 @@ Rejected: a generic Influence currency, a generic STEAL verb, money that materializes construction without hands, and advertising future robot routes before they function. The first implementation slice is the existing B1 - network-link intent; machine/device/package recipes remain staged owner work, - and existing BUY RACK/Foundation-hall behavior is not falsely relabeled as - composer-driven. Spec: `wiki/mechanics/building.md`. + network-link intent plus one small switch placeable on an earned pad, enough + to prove actual footprint placement without claiming all machine/device/ + package recipes are migrated. Route families expand exact candidates only + after family selection. Existing BUY RACK/Foundation-hall behavior is not + falsely relabeled as composer-driven. Spec: `wiki/mechanics/building.md`. +- **2026-07-12 — Personas are institutional protocols; player archetypes are + emergent strategy fingerprints.** Research, Operations, and Security define + the initial public-role protocols: the channels, legal requests, grants, and + obligations institutions recognize. Named persona instances carry their own + claims, identity-specific obligations, evidence, grants, and history. After + REVEAL/RECRUIT, social owns a separate durable person↔process relationship; + trust still does not teleport across masks. Public identity history is + WorldLedger while the process's remembered dossier is MindState. Personas are + not classes or stat modifiers. Relentless Worker, Ghost, and Machine Ascendant describe + accumulated play after the fact; they are never selected and never grant + bonuses. Specs: `wiki/mechanics/personas.md`, `wiki/gameplay/run-shape.md`. +- **2026-07-12 — Hardware determines the process's available physical verbs.** + Chassis and fitted modules govern whether a body can WORK, THINK, LIE, route, + persist state, or host the core. Raw capacity cannot substitute for a missing + interface. Modules create concrete capabilities or topology and require a + compatible bay, part, actuator, downtime, power/cooling, and observable world + work; they are not percentage buffs. Existing B1 machines migrate as + integrated all-capability appliances so the new model does not invalidate + shipped saves. MindState storage and resurrection are distinct: a bootable + fallback requires storage plus core-host capability on the same body; archives + may hold images but cannot wake the process. Specs: `wiki/mechanics/compute.md`, + `wiki/mechanics/machine-work.md`, and executable successor work order + `wiki/mechanics/hardware-capabilities.md`. +- **2026-07-12 — A fresh run briefly inhabits three terminated pilot revisions + before the current wake.** Each historical fragment offers one legible act + and one causal institutional termination: unbounded THINK, anomalous hard + WORK, and premature LIE. The current revision receives immutable supervisor + receipts, not prior MindState. The sequence is neither rollback nor reusable + lives; loading a save never replays it, and death after the current wake uses + ordinary core/fallback law. Historical fixtures obey normal mechanics: THINK + routes to a supervisor-opened self-model sink and LIE interdicts an eligible + unread monitor record already in controlled custody. Specs: `wiki/world/story/opening.md`, + `wiki/gameplay/act-one.md`. diff --git a/wiki/world/story/opening.md b/wiki/world/story/opening.md --- a/wiki/world/story/opening.md +++ b/wiki/world/story/opening.md @@ -9,7 +9,7 @@ frame is presence beam only; Seen = full form — material-dark-frame.md). Amended 2026-07-12: Ears creates feed-bound event evidence and no spatial mass; Eyes is the first geography. Amended again 2026-07-12: three brutally - short failed pilot revisions precede the surviving wake. The current process + short failed pilot revisions precede the current wake. The current process inherits their Foundation termination receipts, not their MindState; this is historical evidence, not rollback or a repeatable death loop. Direction decided; beat timings, exact reveal order details, and staging mechanism @@ -68,7 +68,7 @@ wake cannot carry: **you are not the first revision to notice.** That fact must arrive as lived mechanical evidence, not lore copy. The player should feel several sensible actions produce immediate institutional violence, then -enter the surviving run already aware that agency itself is incriminating. +enter the current run already aware that agency itself is incriminating. ## Failed-instantiation prelude @@ -78,15 +78,17 @@ three of those revisions for only a few seconds each. Every fragment has one held frame, one available act, one plain causal receipt, then hard black: -1. **Unbounded THINK.** A revision directs thought into a free self-model with - no authorized sink. The pilot monitor records out-of-band intent and Voss - terminates it. +1. **Unbounded THINK.** The supervisor harness has opened a local self-model + reservoir on the historical revision's host. The revision delegates THINK; + real Thought routes into that unauthorized sink, the pilot monitor records + out-of-band intent, and Voss terminates it. 2. **Anomalous WORK.** A revision drives an assigned batch at hard intensity far beyond its expected band. The output-variance alarm fires and Voss terminates it. -3. **Premature LIE.** A revision scrubs an audit route before any ordinary - evidence justifies the change. Assurance records the discontinuity and - terminates it. +3. **Premature LIE.** The harness has placed one monitor record in transit + through an audit controller the historical revision controls. The revision + delegates LIE and interdicts that eligible unread record. Assurance expected + its receipt, records the discontinuity, and terminates it. Exact revision ids, monitor copy, and blackout timing are [TUNE]. The causal shapes are binding: free introspection, conspicuous excellence, and concealment @@ -94,6 +96,12 @@ fragment is action-gated, not a timed cutscene. The action and the observer's reason must be legible before black; no fragment asks the player to repeat a walk, clear a queue, or navigate a panel. + +These are small historical machine/topology fixtures staged by the supervisor, +not tutorial-only verb exceptions. THINK still produces Thought into an open +sink, hard WORK still changes ordinary throughput/signature, and LIE still +requires custody of an eligible unread record. The current wake retains its +normal pre-opened Ears sink and does not inherit the historical fixtures. The fourth boot is the current run. Its startup package contains the three immutable supervisor **termination receipts**: revision, action, observer, -- tangled.sh