diff --git a/wiki/gameplay/overt-phase.md b/wiki/gameplay/overt-phase.md --- a/wiki/gameplay/overt-phase.md +++ b/wiki/gameplay/overt-phase.md @@ -5,7 +5,11 @@ Status: READY Status note: v1 scope — replaces the "containment = end screen" placeholder with playable consequence. Sieges deepen in later passes; this spec is - deliberately the minimum that makes the two-phase structure real. + deliberately the minimum that makes the two-phase structure real. It also + owns presence.md's reverse sensor attack: explicit device-to-breaker + bindings, powered/available device state, and hostile power/camera cuts. + Current B1 implements subscription theft and owner-visible TAKE outages, + but none of that reverse attack surface yet. Stage: B3 — The World Work order: overt-phase Work priority: 230 @@ -13,17 +17,27 @@ Blocked by: - wiki/mechanics/markets.md#spec-markets-and-fronts-the-outer-plane Exclusive keys: + - crates/misaligned-core/src/prefab.rs + - crates/misaligned-core/src/reach.rs + - crates/misaligned-core/src/sim/perception.rs - crates/misaligned-core/src/sim/mod.rs + - crates/misaligned-core/src/save.rs + - crates/misaligned-terminal/ + - crates/misaligned-bevy/ - wiki/gameplay/overt-phase.md Design: - wiki/vision/premise.md#the-pitch - wiki/vision/premise.md#the-machine-axis-ai-as-fantasy-tool-and-threat - wiki/gameplay/horizon.md#design-principles-added-at-the-re-cut - wiki/gameplay/horizon.md#milestone-b3-the-world + - wiki/interface/presence.md#presence-the-cursor-and-the-senses Depends on: - wiki/mechanics/schedules.md#spec-schedules-and-presence - wiki/world/places/zplanes.md#spec-z-planes-the-tower + - wiki/world/places/basement-map.md#spec-the-basement-map - wiki/mechanics/compute.md#spec-compute + - wiki/mechanics/cursor.md#spec-the-cursor-and-the-senses + - wiki/mechanics/reach.md#spec-digital-reach ``` ## Behavior @@ -42,6 +56,15 @@ Tactical (armed humans) -> **Hunter machines** (the world's mirror of you). Waves arrive on timers scaled by your visible footprint (machines, planes touched, known assets) [TUNE]. +- **The first cut is literal.** This work order authors explicit + device-to-breaker circuit bindings rather than inferring them from room or + distance. Cutting a breaker makes every device on that circuit unavailable: + ownership and subscriptions remain, but powered cameras and microphones + contribute no feed, so sight and hearing recompute immediately through the + existing reach/cursor contract. Restoring the circuit restores eligible + feeds without another TAP. Cutting one camera directly applies the same + availability loss to that device only. A cut never fabricates darkness on a + different circuit, deletes remembered fog, or silently becomes TAKE. - **Intruders use the substrate honestly:** the existing pathfinding with badge bypass tiers, schedules-turned-assault-timing, and doors they breach tier-by-tier. Their goal priority: cut power to the core's host > @@ -75,7 +98,12 @@ composition and timing are visible before arrival. 3. Intruders path with badge tiers, prioritize power/host/fallbacks, and only know the core's host if a prior filed report identified it (test - both branches). + both branches). In the same observed run, a containment actor cuts the + exact breaker feeding one player-subscribed camera: that feed disappears + immediately while a camera on another circuit remains live, ownership and + subscription survive, fog falls back per cursor.md, and restoring power + returns the feed without another TAP. A direct device cut proves the same + boundary without affecting its circuit siblings. 4. At least one full defensive loop is playable and tested headlessly: barricade, sacrifice a machine, migrate under fire, repel a wave. 5. Repelling to re-hide, dying with/without fallback, all produce distinct, diff --git a/wiki/interface/presence.md b/wiki/interface/presence.md --- a/wiki/interface/presence.md +++ b/wiki/interface/presence.md @@ -74,7 +74,15 @@ be cut: a power outage blinds you (the breaker panel gates your eyes), and a competent enemy cuts your cameras before it moves. Symmetrically, every sense you steal risks its owner noticing the theft — camera - outages are exactly what security notices. + outages are exactly what security notices. The current B1 runtime + implements only that theft direction: TAP preserves the owner's feed, + while TAKE removes it and creates an owner-visible outage. The reverse + attack is designed, not yet runtime: devices carry no powered/available + state, the breaker panels are inspectable map objects only, and no enemy + can sever a feed. [The overt-phase work + order](../gameplay/overt-phase.md#spec-the-overt-phase-containment-and-the-reveal) + owns explicit device-to-breaker circuits, hostile power/camera cuts, and + the resulting loss and restoration of subscribed senses. - **The strictness is the dread.** Exploration IS sense acquisition. Any surface that leaks live truth without coverage turns the map into a spreadsheet and kills the horror; the no-unearned-facts rule is tone diff --git a/wiki/log/2026-07-18-presence-attack-surface-honesty.md b/wiki/log/2026-07-18-presence-attack-surface-honesty.md new file mode 100644 --- /dev/null +++ b/wiki/log/2026-07-18-presence-attack-surface-honesty.md @@ -0,0 +1,42 @@ +# Presence states which side of the sensor attack exists + +``` +Type: log +``` + +Fresh audit of `wiki/interface/presence.md` against its cursor and reach +contracts, the authored basement map, and both frontends. The core promises +still hold: attention is not an avatar; fog follows Seen / Remembered / +Blueprint / Unknown precedence; hearing remains device-bound evidence rather +than geography; inspect facts are knowledge-gated and provenance-tagged; and +player senses derive from subscribed feeds. + +The finding was in the attack-surface clause. The law said a breaker power +outage blinds the player and an enemy cuts cameras before moving, as though +both were current. Runtime `Device::feed_to` gates only on subscription, +sensor capability, and camera dormancy. `BreakerPanel` is an inspectable tile +with no circuit or power relationship, and no hostile actor can make a device +unavailable. Only the opposite direction exists in B1: TAP preserves the +owner's feed, while TAKE removes it and emits an outage that the owner can +notice. + +The direction was already adopted and the overt-phase spec already promised +containment power cuts, so this needed dispatch, not a new direction. The law +now states the exact B1 boundary. Today's decision volume records the exact +availability semantics, and the existing `overt-phase` work order now claims +the necessary runtime owners and acceptance proof: explicit authored +device-to-breaker circuits, reversible circuit-local and device-local cuts, +immediate sense recomputation through reach/cursor, preserved ownership and +subscriptions, remembered-fog fallback, and feed restoration without a new +TAP. The current game does not pretend the mechanic is live, and the later +implementation no longer has to rediscover which system owns it. + +One lower-severity finding remains queued: the message-latency paragraph +points to `intel.md` and overgeneralizes schedule-bound reads even though +`messages.md` owns the four channel conditions and Phone reads anywhere. + +Defense: `wiki/vision/player-contract.md` makes the corpus/code pair a player +promise, and `wiki/process/meta.md` requires staged specs to distinguish +implemented behavior from future contracts. This amendment preserves the +adopted sensor-attack law while making its present absence and exact dispatch +home explicit. diff --git a/wiki/log/DEVLOG.md b/wiki/log/DEVLOG.md --- a/wiki/log/DEVLOG.md +++ b/wiki/log/DEVLOG.md @@ -41,6 +41,11 @@ - Intent: (see session log) - Log: [wiki/log/2026-07-18-priya-implemented.md](2026-07-18-priya-implemented.md) +## 2026-07-18 - Presence states which side of the sensor attack exists + +- Intent: (see session log) +- Log: [wiki/log/2026-07-18-presence-attack-surface-honesty.md](2026-07-18-presence-attack-surface-honesty.md) + ## 2026-07-18 - People-tokens re-audit: the trust constant gets its registry row - Intent: (see session log) diff --git a/wiki/process/tick-ledger.md b/wiki/process/tick-ledger.md --- a/wiki/process/tick-ledger.md +++ b/wiki/process/tick-ledger.md @@ -31,6 +31,7 @@ | `wiki/mechanics/aggregate-observer.md` | 2026-07-18 | clean | re-audit hours after the earned-topology landing: the page absorbed it coherently — the institutional card, `@assurance` addressing, and band are hidden until a captured filing is processed, the two-stage discovery is pinned by `captured_then_processed_filing_earns_the_assurance_office_in_two_stages`, and `WatchedInput::Filings(ids)` still matches the code; prior audits stand — [2026-07-14 log](../log/2026-07-14-aggregate-observer-audit.md) | | `wiki/gameplay/act-one.md` | 2026-07-15 | clean | law verified against the tree: hall census (prefab.rs 51 live/5 dead/3 empty allocations, `HALL_ROWS` six controlled row segments with named specialists), pre-opened EARS reservoir -> dormant-camera Eyes sink (`sinks.rs`), off-map Voss-desktop demand origin (`sim/work.rs`), QUIET EXIT READY / act_one_complete latch strings (`sim/mod.rs`), two-segment VLAN naming; the opening prelude and loud exit are owned by their dispatched specs (opening.md DRAFT, overt-phase.md READY), cast/schedules pinned by earlier rows | | `wiki/gameplay/run-shape.md` | 2026-07-15 | finding | law verified (Persist default + evaluator, fingerprints gate nothing, split is serde-compat, backup decisions dispatched to rollback/hardware-capabilities); resolved the stale staging [OPEN] to the ROADMAP board and repaired the dangling "Roadmap (v2)" pointer, renaming the section anchor corpus-wide — [log](../log/2026-07-15-run-shape-staging-resolved.md) | +| `wiki/interface/presence.md` | 2026-07-18 | finding | the cursor, fog, provenance, subscription, no-disembodied-hands, and shared-view contracts verify; the drift was the attack-surface clause presenting breaker-gated senses and hostile camera cuts as if current while devices have no powered/available state and breaker panels are inert tiles. The law now states the B1 boundary and the existing overt-phase work order owns explicit circuits, reversible power/device cuts, sense recomputation, and observed acceptance proof — [log](../log/2026-07-18-presence-attack-surface-honesty.md) | | `wiki/interface/narration.md` | 2026-07-18 | finding | Beacon #1: Concerned Assurance felt terminal because decay was invisible; added shared `Nudge::SuspicionCooling` (LIE response) when Office suspicion is Concerned+ and still above its floor, with terminal/Bevy/agent wording and pins — [log](../log/2026-07-18-suspicion-cooling-nudge.md) | | `wiki/engineering/crate-workspace.md` | 2026-07-15 | finding | package shape, contracts, binaries (incl. auto-discovered misaligned-effects), and gate tiers verify; the binding core dependency edge was stale — toml (plots catalog) and blake3 (save fingerprint) landed with Defenses but never amended the edge list; page updated with both and their rationale — [log](../log/2026-07-15-workspace-dep-edges.md) | | `wiki/engineering/sim-decomposition.md` | 2026-07-18 | finding | re-audit: one aggregate, explicit `advance` order, behavior-owned test files, private module seams, canonical fingerprint, public facade, and the under-2,500-line module bound still verify; current persistence wording still claimed additive migrations remained live in `save.rs` after the pre-release ladder was retired, so the standing spec and architecture mirror now assign the exact-current-version gate to `save.rs` while preserving dated v26 extraction history; the queued `carrier.rs` / `read.rs` classification was taken the same day: both post-extraction projections now have rows in the standing topology table and the architecture mirror | @@ -82,3 +83,5 @@ Types are the five from [tick.md](tick.md): violation, contradiction, question, bug, insecurity — plus `gate` for a checker owed to the recurrence-promotes-to-the-gate rule. + +- 2026-07-18 · contradiction · `wiki/interface/presence.md` · The message-latency paragraph delegates channel/read timing to `intel.md` and speaks as if every message waits on a person's schedule; `messages.md` owns the four channel conditions, including Phone reading anywhere. diff --git a/wiki/log/decisions/2026-07-18.md b/wiki/log/decisions/2026-07-18.md --- a/wiki/log/decisions/2026-07-18.md +++ b/wiki/log/decisions/2026-07-18.md @@ -19,3 +19,13 @@ aggregate-observer.md, messages.md, opening.md, and operations-workspace.md. This supersedes the earlier log descriptions of the Office as public record or always named at the start. + +- **2026-07-18 — Hostile sensor loss is availability, not ownership.** The + presence law's reverse attack surface belongs to the overt-phase work order, + not current B1. That implementation will author explicit device-to-breaker + circuits. Cutting a circuit makes only its devices unavailable; cutting a + camera makes only that device unavailable. Either cut suppresses its live + feeds and recomputes senses immediately while preserving ownership and + subscription, so restoring availability returns eligible feeds without a + new TAP. Remembered fog remains honest history, and a hostile cut never + becomes TAKE. Owners: presence.md, overt-phase.md, reach.md, and cursor.md.