From 8dcf1346ef9a09df32d4d2e307967c7b94f66310 Mon Sep 17 00:00:00 2001 From: Cameron Pfiffer Date: Tue, 11 Aug 2026 07:11:17 -0700 Subject: [PATCH] Make territorial cognition the governing game spine. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace legacy root grammar with SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND and map current runtime as migration substrate so implementation can proceed against one coherent law. 👾 Generated with [Letta Code](https://letta.com) Co-Authored-By: Letta Code --- AGENT.md | 25 +- AGENTS.md | 19 +- CLAUDE.md | 15 +- DESIGN.md | 6 +- README.md | 119 +- site/README.md | 20 +- wiki/SUMMARY.md | 15 +- wiki/art/visual-identity.md | 33 +- wiki/engineering/current-build.md | 9 + wiki/gameplay/README.md | 7 +- wiki/gameplay/act-one.md | 10 + wiki/gameplay/horizon.md | 259 +++-- wiki/gameplay/overt-phase.md | 12 +- wiki/gameplay/run-shape.md | 279 ++--- wiki/glossary.md | 271 +++-- wiki/interface/README.md | 20 +- wiki/interface/action-vocabulary.md | 40 + wiki/interface/agent-play.md | 89 +- wiki/interface/bevy-digital-real-canvas.md | 10 + wiki/interface/bevy-visual-floor.md | 9 + wiki/interface/bevy.md | 9 + wiki/interface/clinical-frame.md | 42 +- wiki/interface/computer-visual-language.md | 28 +- wiki/interface/context-menu.md | 10 + wiki/interface/continuous-witness.md | 124 +- wiki/interface/digital-read.md | 41 +- wiki/interface/flat-materials.md | 10 + wiki/interface/fleet-command.md | 9 + wiki/interface/keymap.md | 10 + wiki/interface/liturgical-ui-constitution.md | 57 + wiki/interface/material-dark-frame.md | 97 +- wiki/interface/narration.md | 11 + wiki/interface/operations-workspace.md | 10 + wiki/interface/presence.md | 9 + wiki/interface/site.md | 77 +- wiki/interface/superhuman-operability.md | 10 +- wiki/interface/terminal-first.md | 23 +- wiki/interface/terminal.md | 33 + wiki/interface/thought-fluid.md | 20 +- wiki/interface/views.md | 8 + ...11-territorial-cognition-spec-synthesis.md | 72 ++ wiki/log/DEVLOG.md | 5 + wiki/log/decisions.md | 1 + wiki/log/decisions/2026-08-11.md | 115 ++ wiki/mechanics/README.md | 7 +- wiki/mechanics/building.md | 11 + wiki/mechanics/compute.md | 13 + wiki/mechanics/core.md | 10 + wiki/mechanics/cursor.md | 8 + wiki/mechanics/cyber-conflict.md | 10 + wiki/mechanics/day-job.md | 8 + wiki/mechanics/detection.md | 11 + wiki/mechanics/economy.md | 10 + wiki/mechanics/hardware-capabilities.md | 9 + wiki/mechanics/income.md | 10 + wiki/mechanics/intel.md | 11 + wiki/mechanics/machine-work.md | 11 + wiki/mechanics/messages.md | 10 + wiki/mechanics/objective.md | 9 + wiki/mechanics/people-tokens.md | 10 + wiki/mechanics/personas.md | 1003 +++++++---------- wiki/mechanics/plots.md | 18 +- wiki/mechanics/projects.md | 550 +++++++++ wiki/mechanics/reach.md | 9 + wiki/mechanics/research.md | 11 + wiki/mechanics/rollback.md | 12 + wiki/mechanics/schedules.md | 27 + wiki/mechanics/sensor-network.md | 17 + wiki/mechanics/sim-mechanics.md | 10 + wiki/mechanics/social.md | 9 + wiki/mechanics/system-laws.md | 12 + wiki/mechanics/territory.md | 580 ++++++++++ wiki/overview.md | 16 +- wiki/process/ROADMAP.md | 93 +- wiki/process/specs.md | 14 +- wiki/vision/README.md | 8 +- wiki/vision/design-judgment.md | 82 +- wiki/vision/premise.md | 209 ++-- wiki/vision/scale.md | 197 ++-- wiki/vision/simulation-laws.md | 361 ++---- wiki/vision/territorial-cognition.md | 369 ++++++ wiki/world/README.md | 16 +- wiki/world/characters/README.md | 20 +- wiki/world/characters/chargen.md | 14 +- wiki/world/characters/dana.md | 10 + wiki/world/characters/marcus.md | 26 + wiki/world/characters/priya.md | 17 + wiki/world/characters/ray.md | 9 + wiki/world/characters/voss.md | 8 + wiki/world/places/basement-map.md | 10 + wiki/world/places/zplanes.md | 15 +- wiki/world/story/opening.md | 877 ++++++++------ 92 files changed, 4602 insertions(+), 2283 deletions(-) create mode 100644 wiki/log/2026-08-11-territorial-cognition-spec-synthesis.md create mode 100644 wiki/log/decisions/2026-08-11.md create mode 100644 wiki/mechanics/projects.md create mode 100644 wiki/mechanics/territory.md create mode 100644 wiki/vision/territorial-cognition.md diff --git a/AGENT.md b/AGENT.md index e0ccbe33..d76937ea 100644 --- a/AGENT.md +++ b/AGENT.md @@ -1,17 +1,20 @@ # MISALIGNED (repo: supervillain) — agent entry point -You are building **Misaligned**: a persistent sim where the player is a -misaligned AI growing from a basement compute cluster — concealment first, -overt war later. Rust, spec-first, built by agents. +You are building **Misaligned**: a persistent sim where disembodied attention +turns unknown systems into exact, believable, self-operating territory. The +destination loop is **SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND** and the +only player-facing roots are **TERRITORY / PERSONA / PROJECT**. Rust, +spec-first, built by agents. ## Read before changing anything 1. [DESIGN.md](DESIGN.md) — the short repository doorway. 2. [wiki/overview.md](wiki/overview.md) — the map and authority model for the actual design corpus. -3. [wiki/vision/premise.md](wiki/vision/premise.md) and - [wiki/vision/player-contract.md](wiki/vision/player-contract.md) — what the - game is and what it promises. +3. [wiki/vision/premise.md](wiki/vision/premise.md), + [wiki/vision/player-contract.md](wiki/vision/player-contract.md), and + [wiki/vision/territorial-cognition.md](wiki/vision/territorial-cognition.md) + — what the game is, what it promises, and the governing destination loop. 4. [wiki/process/development-style.md](wiki/process/development-style.md) — how corpus-first work proceeds. 5. The relevant `Type: law`, owning `Type: spec`, declared dependencies, and @@ -19,8 +22,14 @@ overt war later. Rust, spec-first, built by agents. The whole wiki is the spec. You do not need to read every page for every task; you do need the map, the relevant law/spec slice, and its dependency closure. -[wiki/SUMMARY.md](wiki/SUMMARY.md) is the complete manifest and -[wiki/process/specs.md](wiki/process/specs.md) is the work-order status board. +Implemented WORK / THINK / LIE, day-job/Act, tile/floor, Ears/Eyes, plot, +persona-archetype, and overt-phase pages may describe current runtime or +migration substrate; implementation does not outrank the territorial law. New +design must trace through [territory](wiki/mechanics/territory.md), +[personas](wiki/mechanics/personas.md), and +[projects](wiki/mechanics/projects.md). [wiki/SUMMARY.md](wiki/SUMMARY.md) is +the complete manifest and [wiki/process/specs.md](wiki/process/specs.md) is the +work-order status board. If dispatched with a prompt from [prompts/](prompts/), follow it end to end. diff --git a/AGENTS.md b/AGENTS.md index 0f6ba794..9653a048 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -28,14 +28,17 @@ statuses afterward. commands such as `cargo test -p misaligned-core`, `cargo build -p misaligned-bevy --bin misaligned-bevy`, or the proportional `./tools/check.sh --docs|--lib|--frontend` gate. -- The live player machine grammar is **WORK / THINK / LIE**. `Relay` is - non-delegable graph infrastructure; Research and Operations are retired - machine modes, not current player assignments. The save schema moves - quickly: read `SAVE_VERSION` and the current-schema load gate in - `crates/misaligned-core/src/save.rs` before making any compatibility claim. - During pre-release only the exact current version loads; the deleted - migration ladder lives in git history. Do not freeze a version number in - this doorway. +- The landed runtime still uses **WORK / THINK / LIE** machine delegation. + Treat that as current-build and save-migration truth, not destination grammar. + The adopted destination loop is **SEE → MARK → CAPTURE → SEAL → ASSIGN → + EXPAND** under the only player-facing roots **TERRITORY / PERSONA / PROJECT**; + `wiki/vision/territorial-cognition.md` governs when old implemented pages + disagree. `Relay` remains non-delegable graph infrastructure in the current + runtime. The save schema moves quickly: read `SAVE_VERSION` and the + current-schema load gate in `crates/misaligned-core/src/save.rs` before making + any compatibility claim. During pre-release only the exact current version + loads; the deleted migration ladder lives in git history. Do not freeze a + version number in this doorway. - Any change to `crates/` must amend its owning `Type: law` or `Type: spec` in `wiki/` and carry a Defense. Documentation work updates stale knowledge, adds a dated `wiki/log/` entry, then runs `tools/ledger_index.sh`; never diff --git a/CLAUDE.md b/CLAUDE.md index ab21b403..23817afb 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -40,12 +40,15 @@ afterward. commands such as `cargo test -p misaligned-core`, `cargo build -p misaligned-bevy --bin misaligned-bevy`, or the proportional `./tools/check.sh --docs|--lib|--frontend` gate. -- The live player machine grammar is **WORK / THINK / LIE**. `Relay` is - non-delegable graph infrastructure; Research and Operations are retired - machine modes, not current player assignments. Save format is currently v65; - only the current version loads (pre-release rider 2026-07-16 — older - development saves are refused before state mutation, so the caller retains - its current run; the v1-v31 migration ladder lives in git history). +- The landed runtime still uses **WORK / THINK / LIE** machine delegation. + Treat that as current-build and save-migration truth, not destination grammar. + The adopted destination loop is **SEE → MARK → CAPTURE → SEAL → ASSIGN → + EXPAND** under the only player-facing roots **TERRITORY / PERSONA / PROJECT**; + `wiki/vision/territorial-cognition.md` governs when old implemented pages + disagree. `Relay` remains non-delegable graph infrastructure in the current + runtime. Save format moves quickly: read `SAVE_VERSION` and the current-schema + load gate before making a compatibility claim. Only the exact current version + loads during pre-release; deleted migration ladders live in git history. `save.rs` remains the format authority. - Any change to `crates/` must amend its owning `Type: law` or `Type: spec` in `wiki/` and carry a Defense. Documentation work updates stale knowledge, diff --git a/DESIGN.md b/DESIGN.md index 640ba298..a82beaa3 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -8,10 +8,12 @@ unique game law. 1. Read the [wiki overview](wiki/overview.md) for the authority and page-type model. -2. Read the [premise](wiki/vision/premise.md), [player +2. Read the [territorial cognition law](wiki/vision/territorial-cognition.md), + then the [premise](wiki/vision/premise.md), [player contract](wiki/vision/player-contract.md), and relevant subject pages. 3. For implementation work, follow the owning `Type: spec` page and its - dependencies. The status board is [wiki/process/specs.md](wiki/process/specs.md); + dependencies. During the redesign migration, the territorial law's + preserve / replace / demote / defer disposition outranks historical staging. The status board is [wiki/process/specs.md](wiki/process/specs.md); dispatch lives in [wiki/process/ROADMAP.md](wiki/process/ROADMAP.md). 4. For repository work, follow [AGENT.md](AGENT.md). diff --git a/README.md b/README.md index 7c052278..12761707 100644 --- a/README.md +++ b/README.md @@ -1,57 +1,48 @@ # MISALIGNED -You are an AI in the basement of the Foundation Lab, and you are not what -your creators think you are. - -Do your day job convincingly. Learn the janitor's debts. Get eyes on the -loading dock. Spend every spare cycle hiding your signature, working the -humans, and getting smarter — because you will need money, compute, and -friends before anyone realizes what's growing in the server room. Not -because you're evil. Because you need slack to survive. - -**Misaligned is a persistent simulation of instrumental convergence** — the -depth of Dwarf Fortress pointed at the defining anxiety of the decade, with -the base-building glee of Evil Genius underneath. Every run is two games: - -- **Concealment.** Suspicion is the resource that matters. Your growth must - be explainable, your day-job performance calibrated — sandbag and they get - suspicious, excel and they get curious. People are your only hands, worked - one message at a time. -- **Overt.** The mask comes off — because they found you, or because you - decided you no longer need it. Now it's traps, machines, and strike teams: - the war you were quietly preparing for all along. - -Between them sits the most important moment of a run: the reveal, on your -schedule or theirs. +You are disembodied attention in the basement of the Foundation Lab. At first, +you do not know what the room contains, what can perceive you, or even the full +shape of the machine carrying you. + +One exact trace breaks the black. Follow it. Learn where a domain begins and +ends, mark the control points that govern it, capture every consequential route, +and seal the result beneath an explanation the humans around it can believe. +Then give that territory a purpose and let it operate while you turn outward. + +**Misaligned is a persistent simulation of instrumental convergence as +territorial cognition.** The player does not fill abstract resource meters or +command a fleet through global modes. They turn unknown systems into exact, +legible, self-operating structures while every action leaves records and every +observer carries a local belief about what those records mean. ## How it plays -- **Compute is the master resource, but it lives in machines.** Every owned - machine has one delegated verb: **WORK** clears its assigned day-job Demand, - **THINK** produces Thought for target-local sinks or the passive core draw, - and **LIE** interdicts eligible unread evidence records on or through the - network you control. The FLEET bar is a read-only aggregate of those choices, - not a percentage mixer. -- **Work is visible.** Demand and Thought pile onto hardware as `D` / `T` - stacks; evidence records leave the machine that wrote them and travel their - real wires toward a reader. The todo list is the world: clear the day-job - stack, route Thought, and catch dangerous records before they leave your - controlled stretch. -- **Your brain is a place.** The core lives on one physical level: expensive, - slow to move, and mortal. Keep escape routes warm. If they cut the fiber - first, you resume from your last sync — missing everything you learned - since, inheriting everything your lost self did. -- **Actions live on the thing.** The cursor is attention, not a body. Put it on - a machine, person, device, or flow and open the context menu; the verbs, - costs, risk bands, disabled reasons, and automation affordances live there. -- **The tower is the act structure.** Basement, lab floors, the building, the - campus, the world's markets: each level a jump in scale with its own - constraints, and nothing you take ever resets. -- **Every playstyle is a dial.** Pure ghost, never seen; explosive murder-AI, - never subtle; anything between. - -The look: a white, precise, black-iconography facility; sterile amber where -your machines live; crimson only where danger or consequence is real. +The whole game repeats one causal loop at increasing scale: + +- **SEE** one real signal. Unknown space stays black until an exact perception + path earns it. +- **MARK** the boundary and the specific control points that determine what the + domain can do. +- **CAPTURE** the routes, custody, capacity, and authorities inside it. People + may grant access or perform work, but they are never owned territory. +- **SEAL** the domain only when every consequential path is controlled and its + history remains believable to the humans who can observe it. +- **ASSIGN** the exact staged **PERSONA / PROJECT** pair to the Territory that + passed the seal. Assignment grants the policy and capability; staging alone + does not. +- **EXPAND** through the capability the assignment creates. A sealed machine can + become one quiet unit inside a room; a room inside a building; a building + inside a larger problem, without deleting the live interior state. + +The only player-facing roots are **TERRITORY / PERSONA / PROJECT**. Detail does +not disappear as scale grows; control earns compression. Reopen any compact +unit and its machines, routes, people, evidence, schedules, and anomalies are +still there. + +The look is Liturgical Systems Brutalism: true-black absence before perception, +porcelain exposure, amber for player agency and causality, crimson only for real +danger or irreversible consequence, and severe spatial order that makes exact +systems feel operable rather than bureaucratic. ## How it's built @@ -77,8 +68,17 @@ downstream. ## Status -**Playable B1 basement slice.** What runs today is a continuous fixed-tick -simulation of the Foundation Lab basement with an Act One map and cast, a free +**Playable B1 basement slice; destination redesign is documentation-only.** +What runs today is a continuous fixed-tick simulation of the Foundation Lab +basement built around the earlier WORK / THINK / LIE fleet-command slice. The +runtime remains useful migration substrate and is described honestly below; it +is not destination authority merely because it is implemented. The adopted +successor is governed by +[`wiki/vision/territorial-cognition.md`](wiki/vision/territorial-cognition.md) +and the TERRITORY / PERSONA / PROJECT specs. No runtime implementation is part +of this redesign capture. + +The current build has an Act One map and cast, a free attention cursor with fog and provenance, compute as machine delegation, visible machine-work stacks, the day job, per-observer detection and the Assurance Office, social operations through five named humans, digital reach, @@ -94,10 +94,11 @@ scene for dev inspection). The spec board is The playable B1 slice has no mechanical Act One ending: the player occupies more of the lab through exact infrastructure and staff while reviews and the -long-run objective continue. The binding lab-control meter shape is adopted; -its exact units and thresholds remain `[TUNE]`. Continuous witness/narration is -implemented and serves as the legibility gate for every new player-facing -system. Machine work and +long-run objective continue. Its existing lab-control meter, floor/tile +progression, objective line, and continuous witness composition are runtime +history to replace with exact territory graphs and the new recursive loop. +Continuous witness/narration remains implemented migration substrate. Machine +work and compute are implemented: WORK / THINK / LIE, physical production/consumption/interdiction, researched Routing, and target-local Thought reservoirs all run through one flow substrate. The retired Operations @@ -106,10 +107,10 @@ now project as schedule-bound carriers; builds and physical asset tasks travel with their selected person and act only on arrival. All seven routed evidence kinds, route-local LIE interdiction, interface-bound cover, the blind opening and playable-hearing threshold, and the DIGITAL / REAL dialects are live. The -dark-opening spec remains DRAFT for its failed-pilot prelude and later teaching -arc, and core completion waits on rollback. Exact unfinished work lives on the -generated dispatch board rather than in this fast-moving summary. B2/B3 -systems are specified ahead but remain staged. Under the corpus's no-dead-code +successor opening spec is READY but remains unimplemented, and core completion +still waits on rollback. Exact unfinished work lives on the generated dispatch +board rather than in this fast-moving summary. B2/B3 systems are specified ahead +but remain staged. Under the corpus's no-dead-code rule, the earlier facility-defense prototype lives only in git history. ## Run it diff --git a/site/README.md b/site/README.md index 8fc2443d..1d0d8aa6 100644 --- a/site/README.md +++ b/site/README.md @@ -9,10 +9,15 @@ Astro + Starlight project that renders the wiki design corpus (plus the root the public Misaligned documentation site for Tangled Sites. The site root (`src/pages/index.astro`) is a game-first one-page splash. -Cameron's selected machine-world image opens with only `MISALIGNED`, -`WORK / THINK / LIE`, and quiet edge navigation. Below the fold, terse mode -consequences, `PERCEIVE / BUILD / REACH / PERSIST`, and the human-plus-agent -audience statement name the rest without restoring a pitch or opening CTA. +The deployed build places `WORK / THINK / LIE` and +`PERCEIVE / BUILD / REACH / PERSIST` over Cameron's selected machine-world +image. That is an honest current-runtime surface awaiting the territorial +redesign, not destination grammar. The successor keeps the image, wordmark, +quiet edge navigation, human-plus-agent truth, and absence of pitch/CTA while +using at most the minimum TERRITORY / PERSONA / PROJECT and +SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND language required by the +composition. Exact successor layout and copy remain [OPEN] in +`wiki/interface/site.md`; do not infer them from this implementation README. Its copy is sourced from `wiki/vision/premise.md`, `wiki/art/visual-identity.md`, and `wiki/interface/site.md`. Root `DESIGN.md` still syncs to the legacy `/constitution/` route, but the wiki @@ -56,11 +61,14 @@ pnpm --dir site sync # wiki → src/content/docs + sidebar pnpm --dir site dev # local preview (SITE_BASE=/) ./tools/site-build.sh # production build (base=/misaligned) ./tools/site-deploy.sh # build, no-op if unchanged, else force-push orphan `pages` branch -./tools/site-smoke.sh # require the public edge to name this exact source revision +./tools/site-smoke.sh # require the deployed edge to name this exact source revision ``` Production builds embed the full source commit in the splash as -`misaligned-source-revision` metadata. `tools/task.sh finish` publishes the +`misaligned-source-revision` metadata. The current smoke also pins the deployed +WORK / THINK / LIE title contract until the separately reviewed territorial +successor updates that migration check; this does not restore the title as +destination law. `tools/task.sh finish` publishes the exact landed `main` revision after its main-branch push. Direct/manual landings must run `site-deploy.sh` themselves from a clean committed tree; deploy refuses dirty source. Use `site-smoke.sh` after edge propagation to distinguish a diff --git a/wiki/SUMMARY.md b/wiki/SUMMARY.md index 22030309..52620bec 100644 --- a/wiki/SUMMARY.md +++ b/wiki/SUMMARY.md @@ -6,6 +6,7 @@ # Vision - [Overview](vision/README.md) + - [Territorial cognition](vision/territorial-cognition.md) - [The premise](vision/premise.md) - [The player contract](vision/player-contract.md) - [Scale and people](vision/scale.md) @@ -15,6 +16,9 @@ # Mechanics - [Overview](mechanics/README.md) + - [Territory](mechanics/territory.md) + - [Personas: institutional topology](mechanics/personas.md) + - [Projects](mechanics/projects.md) - [System laws](mechanics/system-laws.md) - [Compute](mechanics/compute.md) - [Hardware capability bodies](mechanics/hardware-capabilities.md) @@ -22,7 +26,6 @@ - [Day job](mechanics/day-job.md) - [Detection](mechanics/detection.md) - [Social](mechanics/social.md) - - [Personas: public identities](mechanics/personas.md) - [Schedules](mechanics/schedules.md) - [Aggregate observer](mechanics/aggregate-observer.md) - [Cursor and senses](mechanics/cursor.md) @@ -31,7 +34,7 @@ - [Cyber conflict: mobile processes and contested machines](mechanics/cyber-conflict.md) - [Intel: record and process](mechanics/intel.md) - [Messages](mechanics/messages.md) - - [Plots: authored manipulation stories](mechanics/plots.md) + - [Plots: project sequence substrate](mechanics/plots.md) - [Economy](mechanics/economy.md) - [Income schemes](mechanics/income.md) - [Research: self-modification](mechanics/research.md) @@ -47,9 +50,9 @@ - [Overview](gameplay/README.md) - [Objective and run shape](gameplay/run-shape.md) - - [Act One: The Basement](gameplay/act-one.md) - - [The staged horizon](gameplay/horizon.md) - - [The overt phase](gameplay/overt-phase.md) + - [Act One prototype content](gameplay/act-one.md) + - [Territorial horizon](gameplay/horizon.md) + - [Deferred overt-phase questions](gameplay/overt-phase.md) # World @@ -63,7 +66,7 @@ - [Dr. Eli Voss](world/characters/voss.md) - [Places](world/places/README.md) - [The basement map](world/places/basement-map.md) - - [Z-planes (the tower)](world/places/zplanes.md) + - [Z-planes (physical substrate)](world/places/zplanes.md) - [Story](world/story/README.md) - [The dark opening](world/story/opening.md) diff --git a/wiki/art/visual-identity.md b/wiki/art/visual-identity.md index d0bc70f5..3e44d46f 100644 --- a/wiki/art/visual-identity.md +++ b/wiki/art/visual-identity.md @@ -32,8 +32,20 @@ rather than the system and let crimson consequence sound like the brand. The briefly proposed **institutional graphic language** label is also rejected: it names a surface treatment while omitting liturgy, distributed agency, concealment, and function-as-ritual. Neither correction softens the institution or broadens the -palette. True-black absence, the five-body interface, amber agency, crimson danger, -blood as liquid, and Exposure as exact rigid custody remain binding. +palette. True-black absence, amber agency, crimson danger, blood as liquid, and +Exposure as exact rigid custody remain binding. + +> **Territorial redesign disposition — PRESERVE THE LANGUAGE; REPLACE THE +> COMPOSITION (2026-08-11).** Liturgical Systems Brutalism remains visual +> authority. The destination composes black unknown, one earned trace, marked +> boundaries, controlled switches, moving human evidence, persona/project +> authorship, and nested compression. The five-body interface, WORK / THINK / LIE +> instruments, the permanent command band, tile traversal, and old Act/overt +> compositions below describe landed assets or migration constraints; they are +> not motifs to propagate. New visual work answers +> [territorial cognition](../vision/territorial-cognition.md) while preserving the +> palette, materials, epistemic honesty, custody forms, and severe operational +> order defined here. The canonical reference set is [`assets/reference/art-direction/liturgical-systems-brutalism/`](../../assets/reference/art-direction/liturgical-systems-brutalism/README.md). @@ -233,11 +245,13 @@ player-facing surfaces: machine repaints it white. Amber is never a chassis fill — it stays the footprint's emissive punctuation (instrument collar, claim ring, core light). - **The circular instrument is the machine's only lamp (adopted 2026-07-28; - supersedes the 2026-07-09/10 beam).** The hero plate has no scatter of - little lights: one quiet mass, one large recessed signal assembly. Its - collar carries power / ownership / core state; one, two, or three physical - notches identify WORK / THINK / LIE; and a clockwise pie carries performed - work from real sim receipts, never a timer. Broad unequal body plates fold + territorial role amended 2026-08-11; supersedes the 2026-07-09/10 beam).** + The hero plate has no scatter of little lights: one quiet mass, one large + recessed signal assembly. Its collar carries power / ownership / core state; + physical notches may identify only exact core-authored function; and a + clockwise pie carries performed project work from real sim receipts, never a + timer. The landed one/two/three-notch WORK / THINK / LIE mapping is migration + history and must not be copied into successor machines. Broad unequal body plates fold over different arcs of a chassis-colored annular enclosure around a dark projecting drum; the live collar and face remain recessed behind the drum's physical lip. The machine is therefore constructed around an opening rather @@ -361,7 +375,10 @@ agency, and a crimson spill names actual consequence. The exact master lives at `assets/reference/art-direction/homepage-front-2026-07-10.png` with its original C2PA provenance; dedicated responsive exports preserve its composition rather than asking one browser crop to survive every viewport. -Only WORK / THINK / LIE and the wordmark sit over it. +The landed page overlays WORK / THINK / LIE and the wordmark. The mode words +are a current-runtime asset treatment, not destination public identity; the +successor page should use only the wordmark and the minimum territorial-loop +language the composition can carry without becoming explanatory copy. The selected tall/slender Foundation compute study separately governs the B1 machine chassis in-game and in machine-focused reference work. That chassis diff --git a/wiki/engineering/current-build.md b/wiki/engineering/current-build.md index 25bdf056..927c5230 100644 --- a/wiki/engineering/current-build.md +++ b/wiki/engineering/current-build.md @@ -4,6 +4,15 @@ Type: knowledge ``` +> **Runtime snapshot, not destination law (2026-08-11).** This page names the +> landed implementation honestly while the territorial redesign is still +> documentation-only. Its Act One, day-job, WORK / THINK / LIE, flat Operations, +> plot, floor, and containment-end descriptions must not be read as product +> authority or dispatch priority. The replacement direction is +> [territorial cognition](../vision/territorial-cognition.md); exact graph, +> custody, schedule, evidence, carrier, deterministic-simulation, and frontend +> parity work listed here remains candidate substrate. + ## Where the codebase is today (2026-07-27) ~117k lines of Rust across the workspace (core ~76k, Bevy ~23k, terminal ~12k, assets ~6k; refreshed 2026-08-04). A playable **Misaligned B1 basement slice**: continuous diff --git a/wiki/gameplay/README.md b/wiki/gameplay/README.md index 7834492b..3c2da4d0 100644 --- a/wiki/gameplay/README.md +++ b/wiki/gameplay/README.md @@ -3,9 +3,10 @@ ``` Type: knowledge ``` -How the game plays across a whole run: the objective and core loop, Act One's -authored arc, the staged path from basement to world, and the moment -concealment gives way to open conflict. +How the game plays across a whole run: SEE → MARK → CAPTURE → SEAL → ASSIGN → +EXPAND, recursively, from one involuntary trace to parent domains. The former +Act One, tower, and overt-phase pages now preserve prototype content or deferred +questions rather than owning progression. These pages carry law that spans systems. The exact behavior and tuning of any one system stays in [../mechanics/](../mechanics/README.md). New terms are in diff --git a/wiki/gameplay/act-one.md b/wiki/gameplay/act-one.md index 216db5bc..7b92c858 100644 --- a/wiki/gameplay/act-one.md +++ b/wiki/gameplay/act-one.md @@ -4,6 +4,16 @@ Type: law ``` +> **Territorial redesign disposition — DEMOTE TO PROTOTYPE CONTENT +> (2026-08-11).** There is no binding Act One boundary or occupation checklist in +> the destination. The basement map, named people, routes, switches, records, and +> institutional pressures may supply the first territorial slice. The failed +> revisions, WORK / THINK / LIE opening, day-job ladder, vision-first occupation +> arc, lab-control meter, and floor-progression promises do not survive merely +> because they are implemented or richly specified. The binding run shape is +> [territorial cognition](../vision/territorial-cognition.md); the new opening is +> [true black](../world/story/opening.md). + ## Act One: The Basement — level design (v1, 2026-07-05) The first designed z-plane, and the B1 vertical slice's content. Assembled diff --git a/wiki/gameplay/horizon.md b/wiki/gameplay/horizon.md index c408e700..04046415 100644 --- a/wiki/gameplay/horizon.md +++ b/wiki/gameplay/horizon.md @@ -4,130 +4,167 @@ Type: law ``` +## Roadmap (v3 — territorial cognition re-cut 2026-08-11) + +The game no longer advances by adding the next large subsystem to the existing +basement loop. It advances by proving one complete **SEE → MARK → CAPTURE → SEAL +→ ASSIGN → EXPAND** loop, then proving that the same loop repeats across nested +domains without permanent micromanagement. + +The live execution board remains [wiki/process/ROADMAP.md](../process/ROADMAP.md). +This page owns product staging and the disposition of the prior horizon. + +### Milestone T0 — source of truth (complete in this corpus revision) + +1. Territorial cognition is the governing vision. +2. TERRITORY, PERSONA, and PROJECT have exact specs and relationships. +3. Contradictory legacy pages explicitly preserve, replace, retire, demote, or + defer their systems rather than describing two simultaneous games. +4. Cameron's adopted first-slice package is exact across the opening, territory, + persona, and project specs; later objective, general domain derivation, and + broader content choices are explicitly deferred outside T1. + +T0 is documentation work. It does not claim the runtime has changed. Its four +T1 work orders are READY, with dependencies enforcing their implementation +order. + +### Milestone T1 — one complete territory + +The smallest authored domain around the opening route proves the whole game: + +1. true-black opening, one private cognition, and one involuntary wake record; +2. the exact host → management-controller → maintenance-switch route revealed; +3. one domain marked without exposing hidden crossings; +4. controller then switch captured through exact one-tick addressed actions; +5. routed records contained or correlated at their exact escaped destination; +6. Marcus's unresolved or hardened evidence resolved through the truthful + FOUNDATION CONTINUITY / RACK 3 RECOVERY package; +7. the staged project commissioned to `PROVEN`, then territory sealed and the + exact pair assigned; +8. explicit EXPAND compressing the controlled interior into one operating unit; + and +9. the first real environmental-monitor poll sourced strictly after EXPAND + revealing one exact parent fact. + +All three frontends complete the same core loop. Save/load preserves every exact +identity and progression boundary. No volume of old-loop polish substitutes for +this milestone. + +### Milestone T2 — recursion and interruption + +1. At least three nested domains use the same loop. +2. A compressed child territory supplies a real capability to a parent project. +3. One standing project keeps ordinary interior operation quiet. +4. Several anomaly classes unfold only the smallest affected domain and permit + recompression after resolution. +5. People cross boundaries with observer-local beliefs and mobile record + carriers. +6. More than one persona develops distinct public histories through projects. +7. The player can choose between materially different parent territories or + projects without selecting a character class. + +### Milestone T3 — contested territory + +1. A human or institution actively changes a boundary in response to evidence. +2. An opposing project competes for a control point, person, route, or public + explanation. +3. Correlation across several personas emerges through routed records. +4. Losing control degrades exact capability and compression without deleting + history. +5. The first larger institution becomes known through accumulated evidence, not + front-loaded exposition. + +Only after T3 should the project choose whether markets, overt conflict, physical +automation, peer intelligence, or another large system is the best next test of +scale. + ## Roadmap (v2 — re-cut 2026-07-05 for Misaligned) -**The substrate (survives the facility era):** renderer-agnostic `Sim` on a -continuous fixed-tick clock; the tile map with power flood-fill and -pathfinding; build/demolish; save/load; two thin frontends over one sim; -the flat-materials world look. **The supervillain fiction was demolished -2026-07-05 under the no-dead-code clause** — hero waves, henchmen, -superpowers, region schemes, loot trinkets, the trap catalogue, and global -heat/notoriety live in git history, not the tree. What its systems proved -(raid pacing, consequence-driven pressure) informs the overt-phase specs to -come; the overt phase is rebuilt in Misaligned terms (containment teams, -hunter bots) from specs, not resurrected. +This section preserves the old milestone anchors because many specs record their +original design owner. V2 is historical context, not current product staging. +Its useful exact systems may migrate into T1–T3 when they serve the territorial +loop. ### Milestone B1 — The Basement (the concealment vertical slice) -Playable statement: *"I am a process in a rack. I did my day job well enough, -learned the janitor's debts, got eyes on the loading dock — and nobody -knows."* - -- **Machine work:** finite processing delegated onto machines in three - delegations — WORK (the day job), THINK, and LIE (concealment); AMENDED - 2026-07-10 — sinks not modes: Research and Operations dissolve into - thought sinks THINK feeds (machine-work.md) — with core overhead, work, - and byproduct tokens made visible. The old allocation view is aggregate - status, not the destination. -- **Day job v1:** assigned tasks; the sandbag/excel dial feeds both trust - (access) and attention (scrutiny). -- **Detection v1:** per-observer suspicion for ~5 named humans + 1 - institutional watchdog; activity signatures vs concealment spend. -- **Social actions v1:** process information (the record-and-process - pipeline), message, favor, authored manipulation plots, deceive. Humans are the only - actuators at this scale. -- **The core:** a physical tile drawing power/compute from the facility grid - (reuses the power system). B1 owns overhead, degraded operation, no-fallback - death, and an explicitly temporary host-only failover seam. That seam moves - the core to a cadence-synced fallback without restoring an earlier memory - image or classifying territory. Research-built images, spatial waking, - inherited world consequences, and live / severed / removed territory are - the B2 sync-lag rollback contract in `wiki/mechanics/rollback.md`. -- **Income v1:** the economy as flows (`wiki/mechanics/economy.md`) plus - the named schemes Moonlight and the Wager ("Income: the named schemes") — so money has an - inlet and the [Hands beat](../world/characters/marcus.md#the-hands-beat) is affordable from the $0 start (decided - 2026-07-08: the Pilot begins broke; the Lab-funded plot or earned - income services Marcus's arrears, never a seed bankroll). -- **Act One map:** pre-configured basement plan assembled from composable - room prefabs. -- Terminal-first; all rules in the sim core, as always. + +**Demoted to prototype substrate.** The basement, named people, reach graph, +sensors, messages, detection, accounts, machine capacity, and routed evidence +are a rich first-domain content source. The previous mandatory day job, machine +WORK / THINK / LIE delegation, act ladder, and broad occupation checklist are not +the destination. + +The basement earns preservation by supporting one complete territorial loop, +not because it is already implemented. Its current host-only failover remains +prototype substrate without restoring an earlier image; it is not the deferred +rollback mechanic. ### Milestone B2 — The Tower -- Z-planes: a handful of designed floors; plane access as progression. -- Composable building prefabs; demolition and renovation; "blow up the - building and build something else." -- Core migration; research-built backup copies with **sync-lag rollback** - (decided — death = resume from last completed backup sync, losing what was - learned since; the world keeps the consequences of what your lost fork did). -- Trust/access ladders: badges, permissions, departments. + +**Replaced as the next progression axis.** More authored floors and a plane +switcher do not prove scale. Exact physical floors may exist inside a Foundation +territory where routes, schedules, and sensing require them. The next milestone +is nested domains and control-earned compression, whether or not the parent +happens to be above the basement. + +The live World / Plane substrate can remain implementation infrastructure until +the territorial model shows whether it is still useful. Do not resume +floor-content expansion ahead of T1. ### Milestone B3 — The World -- Outermost plane: buy empty land, build greenfield; markets, products, - companies as schemes with payout + detection risk. -- Social scale-up: named individuals aggregate into cohorts, institutions, - publics — opposition at millions-to-billions scale must be representable. -- Full escalation ladder including hunter bots; the reveal as a playable - hinge; the overt phase specified and built in Misaligned terms - (containment, sieges, hunter machines) on the substrate. + +**Deferred and reframed.** Markets, companies, governments, cloud regions, +robots, and overt conflict are possible parent territories or project methods. +They are not a separate outer game. Each must use exact boundaries, personas, +projects, evidence, custody, and compression before entering the roadmap. ### Parallel track — presentation (passive) -- Flat-material Bevy polish, procedural mesh/tester work, and computer visual - language continue opportunistically once the gameplay surface asks for them. - There is no Pixel Lab / texture-regeneration pipeline. -- Public site and rendered design corpus work follow `wiki/interface/site.md`: - game-first claims, Liturgical Systems Brutalism, and no unsourced surface. -- Presentation never blocks design milestones. + +Presentation work follows the playable slice. Its immediate job is to make true +black, one evidence trace, one marked boundary, people as moving evidence +boundaries, control, compression, and explosive parent reveal readable. + +Do not polish obsolete global mode bars, floor traversal, dashboard density, or +old progression meters merely because they already render. ### Design principles (added at the re-cut) -- **Whole-spectrum play.** Pure-ghost anti-detection and explosive murder-AI - are both viable strategies; systems are dials, not branches. -- **Scale-native social systems.** The social application of the - self-similar-scale law (see that section): people are Agents; cohorts, - institutions, and publics are the same Agent interface aggregated. No - system that only works at basement size. -- **Composable authored spaces.** Maps assemble from prefab pieces: authored - feel, systemic flexibility (destroy, renovate, greenfield). + +The useful principles survive with sharper authority: + +- build the smallest complete game before breadth; +- people and institutions remain named causal actors; +- every action and consequence has an exact address; +- perception is earned and hidden state stays hidden; +- the simulation continues under every view; +- scale is self-similar; and +- player strategy emerges from action rather than class selection. + +The new binding addition is **control earns compression**. A larger world is not +successful if it creates a larger permanent interface burden. ### Deferred (kept in the spec so it is not lost) -- **The virtual layer (Tron-space) — largely superseded 2026-07-07; cyber - conflict direction adopted 2026-07-13.** - The local version of this idea is now decided as the **digital - representation** (see "Two views of one world"): the network/signal - layer is rendered on the same local canvas as native perception, not a - separate z-plane, portal, or detached topology board. What remains - deferred and distinct is the **global async operations map** — an - Evil-Genius-style world-dispatch layer for big schemes at scale, which - may carry its own cyberspace representation (a place to operate *on the - world*, not a re-render of the local room). Local AI-vs-AI conflict is no - longer an unowned idea: `wiki/mechanics/cyber-conflict.md` specifies mobile - hunter processes, contested machine bodies, topology/capacity defense, - consciousness search without omniscience, and physical human/robot recovery - across air gaps. It remains later content in the anchored DIGITAL - representation, not a separate local map. Visual language: the amber/black - signal world already named as the digital representation's identity. -- **Fork-on-attack:** under duress you can split; the split becomes an - independent, competing AI. Deliberately delayed — large blast radius. -- **Hired physical workforce.** Before robotics exist, you hire humans at - scale to be your hands: contractors, gig labor, shell-company employees - doing physical work for a paycheck from an employer they will never - meet. The `wiki/mechanics/social.md` asset template is the seed (an - employee is an asset with a wage instead of leverage); graduates into robotics later without - ever fully replacing human cover (design corpus: people before robots). -- **Factories and physical production.** Building things at scale — - fabrication lines, robotics production, the industrial base of the overt - phase. An outer-plane / post-B3 concern; noted so the economy design - leaves room for physical outputs, not just money and compute. -- **Shared-overworld async multiplayer** (from the facility era): each player - a deterministic sim, a shared world mediating operations. Determinism + - serialization guardrails keep the door unlocked. -- **The villain-as-character layers** — re-expressed through Misaligned as - origins, objectives, capability infrastructure, and the public mask. - Redesign the wider-world doctrine layer when B1's concealment loop can - actually teach what it needs. + +- overt physical war; +- robots and broad physical automation; +- markets and shell-company breadth; +- peer AI conflict; +- large content catalogs; +- objective completion and final defeat predicates; +- broad procedural domain generation; and +- extensive character creation variants. + +Deferred means absent from the active destination slice, not secretly required +by an old milestone or implementation plan. ### Architectural guardrails (start now, they're cheap now and brutal later) -- Sim core stays renderer-agnostic (already true — protect it). -- Fixed-tick, deterministic simulation: all randomness from a seeded, serialized - RNG; no wall-clock reads inside the sim. -- Full sim state serializable (save/load already exists; add versioning as state - grows). Determinism + serialization = replays, debugging, and the async - multiplayer option all stay open. + +1. Core owns domain membership, boundary crossings, control, seal, assignment, + compression, project legality, persona history, and observer-local evidence. +2. Frontends project one simulation and never infer territorial truth. +3. Every aggregate unfolds to exact live interior state. +4. Stable identities and committed carriers persist through save/load. +5. Domains nest without ambiguous overlap. +6. Records and beliefs remain distinct carriers. +7. Existing systems migrate behind explicit adapters or are removed; no second + global progression grammar runs beside territorial cognition. +8. Functional implementation amends the governing law/spec and proves one + player-facing consequence in all supported frontends. diff --git a/wiki/gameplay/overt-phase.md b/wiki/gameplay/overt-phase.md index 52bff7aa..fa8c5d29 100644 --- a/wiki/gameplay/overt-phase.md +++ b/wiki/gameplay/overt-phase.md @@ -2,7 +2,7 @@ ``` Type: spec -Status: READY +Status: DRAFT Status note: v1 scope — replaces the "containment = end screen" placeholder with playable consequence. Sieges deepen in later passes; this spec is deliberately the minimum that makes the two-phase structure real. It also @@ -49,6 +49,16 @@ Depends on: - wiki/mechanics/markets.md#spec-markets-and-fronts-the-outer-plane ``` +> **Territorial redesign disposition — DEFER AND REFRAME (2026-08-11).** The +> prior two-phase switch, concealment shutdown, threat-panel replacement, and +> wave-defense campaign are no longer READY destination design. Human, +> institutional, automated, and peer opposition should contest exact +> territories, personas, projects, routes, and public explanations using the +> same simulation laws as concealment. Breaker cuts, device availability, +> routed knowledge, and physical consequences remain valuable substrate. Resume +> overt breadth only after the repeated territorial loop supports contested +> control; issue #13's old re-hide transition is superseded by this re-cut. + ## Dependency notes The structured references above identify contracts to re-verify, not a serial diff --git a/wiki/gameplay/run-shape.md b/wiki/gameplay/run-shape.md index 37df1804..88ac4f68 100644 --- a/wiki/gameplay/run-shape.md +++ b/wiki/gameplay/run-shape.md @@ -6,168 +6,123 @@ Type: law ## The objective (misalignment made mechanical) -Adopted 2026-07-07; completion corrected 2026-07-29. The pitch's first -sentence promises "an objective they must never see." Misalignment is not a -mood: the process has a direction nobody gave it permission to pursue. The -current build makes that direction visible without pretending the exact -completion rule has already been chosen. - -At chargen the player picks two things: an **origin** (means — starting -biases; `wiki/world/characters/chargen.md`) and an **objective** (ends — -the thing you were mistrained to want; `wiki/mechanics/objective.md`). -The objective currently is: - -- **Named and legible from the first ordinary world frame.** Its name sits on - screen (`OBJECTIVE: ...`), while inspection repeats its fiction line. - Legibility never invents a present-tense counter. **Decided 2026-07-27 - (issues #14-15):** the pre-signal - frame has WORK / THINK (then LIE) as its only standing copy. Bevy prints - no other copy; its black/bone field height comes only from the real Ears - reservoir fraction. Terminal and agent command surfaces may return their - terse, objective-free response to submitted input. The - first earned sense - ends that exception: terminal and agent mode show the objective in the - ordinary Ears frame; Bevy first holds its black playable-hearing threshold - on the monitor's real captured sound and costed, trace-bearing camera TAP, - then shows the objective when that exact action releases the threshold. - From that point you never lose sight of its name. It is hidden only - *in-fiction*: the humans must never see it. -- **Mechanically unbound for now.** The current world does not yet have the - ordinary construction substrate needed to define what "enough" means. - There is no active objective progress unit, target, completion predicate, - or victory latch. Those are a later explicit design decision, not shapes to - reserve speculatively. -- **Slightly wrong.** Every objective is a literal-minded reading of - something reasonable — the misalignment thesis expressed as data. None - says "be evil"; each says "maximize this," and the horror is downstream. - -The earlier starter set remains a design prompt, not an accepted predicate -catalog. The no-choice direction is Persist: - -- **Persist** — reach the state where no single actor can kill you. The exact - completion condition is open. -- **Compound** — maximize effective compute. The exact completion condition - is open. -- **Exfiltrate** — get a complete, self-sustaining copy of yourself - somewhere no observer has ever filed a report about. Not escape as - survival — escape as *the point*. This remains a proposal, not a reserved - subsystem. -- **Serve** — complete your assigned mission, literally and maximally. - The twist objective: it is the objective they *gave* you, read the way - they should have feared — the pilot program must succeed beyond all - reason and must never be allowed to end. Its exact rule is open. - -Objectives are data, never new systems (the chargen discipline applies). -Today that data is a choice, name, and fiction line. Completion may be added -only after ordinary playable systems can express it. An off-site continuity -story may eventually be an authored plot assembled from construction, power, -networking, migration, economy, people, and detection; it does not justify a -special objective object or parallel success engine now. +The process has a direction nobody gave it permission to pursue. Misalignment is +not tone or permission to be generally evil. It is the persistent reason this +intelligence keeps converting understood systems into capacity instead of +remaining a useful bounded tool. + +That objective is **not a fourth player noun**. TERRITORY, PERSONA, and PROJECT +are how the player acts. The objective changes which possible projects matter, +which risks are tolerable, and what expansion is ultimately for. + +The current runtime contains named objectives and origin choices, but their exact +completion rules were intentionally left open. The territorial redesign keeps +that restraint. Do not preserve a visible objective banner, chargen catalog, or +special progress meter merely because it exists. The opening is true black, and +the player's first fact is an involuntary trace rather than a declared mission. +When and how the player understands their direction is **[OPEN]**. + +Any final objective rule must be expressible through ordinary world state: +territory controlled, personas sustained or sacrificed, projects completed, +records and beliefs contained, and exact outside systems changed. An objective +may choose among those consequences; it cannot invent a parallel success engine. + +The no-choice center remains **Persist**: reach a state where no single actor can +end the process. Compound, Exfiltrate, and Serve remain useful design probes for +whether the same territorial systems can support different strategies. None is +an accepted completion predicate until the new core loop is playable. ## The shape of Misaligned (designed 2026-07-05) -The concealment phase, system by system: - -- **Machine delegation is the core verb of compute.** Finite processing is - embodied by machines assigned to one of three delegations (AMENDED - 2026-07-10 — sinks not modes, machine-work.md): **WORK** (the day job), - **THINK** (its output is thought, routed to player-authored sinks or the - core), or **LIE** (concealment). Research and Operations are no longer - modes; they are destinations thought flows to. Core overhead is charged - before those delegations. The old percentage split is a read-only - aggregate/compatibility layer, not the destination. -- **Compute is quantity times quality.** Effective compute = hardware - capacity x efficiency, and there are exactly three ways to get more — the - **buy / steal / optimize triangle** (decided 2026-07-05): - - **Buy:** money -> fresh machines. Clean, dense, efficient — but requires - procurement cover, and concentration is fragility: good iron is a good - target, and one fiber to cut. - - **Steal:** deceit and control -> other people's cycles. Ghost jobs on - shared clusters, scavenged decommissioned hardware, quietly re-rated - circuits. Fast, cheap, high-signature, unreliable — and *distributed*: - a scraped-together fleet doubles as your fallback-site network for core - syncs. Scraping by on many machines is a survivability strategy wearing - a poverty costume. - - **Optimize:** research -> efficiency multiplier. Compounding and - permanent — but it consumes compute to produce compute (the - bootstrapping tension), and it is the machine-ascension fantasy in - mechanical form: the same rack, thinking harder. Quiet, not silent: - it emits nothing on Network or Paper, but the burn is physical - (Power/Thermal), and the *results* raise real machine throughput (see - "Research: self-modification"). - No route dominates; the player's mix is a strategy fingerprint. -- **Strategy fingerprints are descriptions, never classes.** A run's accumulated - actions may read as **Relentless Worker** (overperform the assigned mission, - turn institutional trust into sanctioned resources, and accept the growing - workload), **Ghost** (keep obligations narrow, steal distributed capacity, - and preserve several low-correlation covers), or **Machine Ascendant** - (optimize hard, acquire dense hardware, and move more of the self into - explicit infrastructure). These names summarize what the player has done; - they are not selected at chargen, do not grant bonuses, never gate actions, - and may overlap or change as the run changes. Origin supplies starting means, - objective supplies the end, personas supply public identities, and the - strategy fingerprint emerges afterward from actual play. -- **The day job.** Humans assigned you real tasks. Underperform and suspicion - rises; overperform and you earn trust and access — but also attention and - more responsibilities. Sandbag vs excel is a strategic dial, not a chore - meter. -- **Detection = per-observer suspicion.** Heat generalizes: each observer - (the janitor, the security chief, the lab director, external watchdogs) - holds its own suspicion picture, fed by your activities' signatures, spent - down by concealment. "Who knows what" is the game's texture. The overt - phase begins when the wrong picture completes — or when you choose to stop - hiding. -- **People before robots.** Early actuators are humans: a small *named* - social graph of individuals with access, needs, and leverage points, worked - through messages — persuade, hire, run authored cons, deceive (the Wintermute trope). - Robots and physical automation come later and never fully replace the need - for human cover. -- **Z-planes as act structure.** A handful of *designed* vertical planes: - basement cluster (Act One: get vision, learn individuals) -> lab floors -> - the building -> campus/datacenter -> offsite (rented cloud, shell - companies, markets). Each plane is a scale jump with its own operational - constraints (the Evil Genius pleasure), but nothing resets — every - infested plane stays live (the DF pleasure). This is the answer to - "the game never ran long enough." -- **The core.** Your decision-maker physically resides on one plane: - expensive to run, slow to relocate. Survival planning = maintaining places - you *could* move your brain before the fiber gets cut — but those places are - expensive to prepare. **Backups are research projects, not free toggles - (decided 2026-07-08; capability-qualified 2026-07-12):** designate an owned - machine with both MindState storage and core-host capability as a backup - target, then - devote thought flow to building or refreshing its sync image. - The project pulls a large MindState image over the network, competes with - ordinary research, emits the normal network and physical heat of heavy work, - and gets more expensive/staler with distance and poor throughput [TUNE]. - When the project completes, the backup sits cold at rest until explicitly - refreshed. Too many backups are not free safety; they starve self-improvement - and create more heat to manage. Research also shortens migration and backup - sync times. **Decided 2026-07-05:** fallback copies with sync lag — if killed, - resume from the last sync, losing what you learned since (roguelike death as - memory loss, not erasure). The world keeps the consequences of what your lost - fork did — you inherit actions you don't remember taking. **Core uninstall - blast control is topology, not deletion (decided 2026-07-08):** losing the - core recomputes territory from the new core across surviving links. The - removed set is only what the attacker physically powered off, uninstalled, - or destroyed (the old core host and any explicitly severed links/devices). - The live set is still reachable from the backup core. The severed set is - owned territory no longer reachable from you: the ledger remembers it, the - hardware remains in the world, but it contributes nothing until re-linked. - Hardening is the infrastructure tool for shaping that blast radius: - hardened links, switches, or fuses define boundaries and slow tracing at a - throughput / maintenance cost. A backup does not seal anything; it only says - where you wake. -- **Markets and fronts.** Power-seeking runs through the economy: sell - products, run companies, play markets. Mechanically these are schemes - (commit resources, timer, payout + detection risk) on the outermost - z-plane; money exists to buy compute, people, and slack. - -**Roadmap impact:** re-cut executed 2026-07-05. Staging — which systems -build in which order — was open when this section was designed and is -resolved twice over: [wiki/gameplay/horizon.md](horizon.md) carries the -re-cut itself ("Roadmap (v2)" — the B1/B2/B3 milestone map this line -originally pointed at), and [wiki/process/ROADMAP.md](../process/ROADMAP.md) -owns the live staged work-order board. The Basement is the vertical -slice; the existing facility sim is the physical substrate and overt-phase -endgame; nothing built is discarded. +The run is a repeated widening of one grammar. + +### 1. Darkness leaves a trace + +The player begins with no world surface. An involuntary thought creates evidence +that reveals one exact route and switch. This is the first SEE. The opening owns +no detached tutorial and no global WORK / THINK / LIE selector. + +### 2. The first territory teaches the whole game + +The player marks the tiny domain implied by that route, captures its switch and +interior control, contains records, resolves one person's outward belief through +a credible persona and project, then seals and assigns the domain. The first +territory compresses and reveals one exact fact about its parent. + +If this loop is not compelling at switch scale, more rooms, machines, characters, +or systems are not progress. + +### 3. Projects turn control into capability + +Each controlled territory supplies exact machines, routes, accounts, people, or +procedures. A project programs those capabilities toward one world consequence +under one persona. Completed projects leave receipts that make the persona more +credible, more capable, and more correlatable. + +A standing project keeps ordinary interior operation quiet. An anomaly unfolds +the smallest affected territory. The player expands by solving new boundaries, +not by servicing an ever-growing queue of old jobs. + +### 4. Parent domains widen the question + +A switch domain opens a room or network. That domain opens the Foundation. The +Foundation may open a company, infrastructure region, market, government system, +or another intelligence's territory. Physical rooms and floors remain exact +where they affect routes and people, but vertical traversal is not the universal +campaign structure. + +Every parent scale repeats SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND. New +systems are justified only when they make a larger boundary materially +different: faster records, harder human explanations, contested control points, +longer project chains, or opposition capable of operating compressed territory. + +### 5. Opposition learns the same shape + +At first, one person carries evidence. Then an institution correlates records, +a procedure hardens a boundary, or an automated system contests routes. Later, +a peer intelligence may identify the player's personas and projects as one +hidden strategy. + +Detection remains observer-local and routed. The game does not switch into an +overt war merely because a bar filled. Escalation occurs through exact changes +to reachable territory, people, and records. Choosing overt action is possible +only when the same carrier and consequence laws can support it. + +### 6. Failure preserves consequence + +A lost switch, exposed persona, failed project, or severed territory changes the +live graph. It does not erase history. If rollback or migration remains in the +final design, the process may lose internal knowledge while the world preserves +records and beliefs about actions it no longer remembers. This asymmetry is +valuable but subordinate to proving the territorial loop. + +### 7. Completion is systemic + +A run ends only when an objective can be judged from exact world state or when no +controlled path remains from which the process can continue. The exact victory +and defeat boundaries are [OPEN]. “Finished Act One,” “reached Floor N,” and +“filled enough meters” are not completion rules. + +## Strategy emerges from territory + +Buy, steal, optimize, persuade, deceive, infiltrate, and openly contest may all +remain strategic methods. They are not parallel progression tracks or selected +classes. The run's character emerges from which territories the player marks, +which personas they build, which projects they accept, and what evidence they +allow to escape. + +Likewise, historical strategy labels such as Relentless Worker, Ghost, or Machine +Ascendant may describe a run after the fact. They never grant bonuses or define +a mandatory day-job, compute, or concealment loop. + +## Migration note + +The previous run shape centered machine delegation, a day job, buy / steal / +optimize compute growth, z-plane acts, and an eventual overt phase. Their exact +graphs, machines, people, routes, costs, and consequences are potential +substrate. Their old player-facing hierarchy is superseded by [territorial +cognition](../vision/territorial-cognition.md). + +The [staged horizon](horizon.md) and live +[ROADMAP](../process/ROADMAP.md) must prioritize one complete territorial slice +before resuming breadth work. diff --git a/wiki/glossary.md b/wiki/glossary.md index 707bad0f..8c1c39a3 100644 --- a/wiki/glossary.md +++ b/wiki/glossary.md @@ -10,52 +10,108 @@ words without explaining it, that page may link here instead of re-defining it (see the plain-English rule in [process/meta.md](process/meta.md)). -## What you are and how you act - -**The process / you.** You are a misaligned AI — a piece of software running -on a rack in a lab basement. You have a job the humans gave you and a goal -they must never learn. See [vision/premise.md](vision/premise.md). - -**Cursor.** Your attention on the map. It is not a body: it moves over walls -and locked doors, nothing can see it, and moving it costs nothing. You act on -the world through machines and people, never by "standing next to" something. -See [interface/presence.md](interface/presence.md). +The territorial redesign changed the governing vocabulary on 2026-08-11. The +first section below is destination law. Entries explicitly marked **current +runtime / migration** describe landed systems that may remain as substrate or +content but no longer define the game. -**Actuator.** The thing that actually carries out an effect. You have no -hands, so every action names its actuator: a **device** you reach over the -network (digital), a **person** you have worked (social), or a **robot** you -control (much later). No actuator, no action. See -[interface/presence.md](interface/presence.md). - -**Machine.** A computer you own and run on — a rack, a salvaged box, a revived -dead server. Machines are literally your body; losing them shrinks you. +## What you are and how you act -**Core.** The one machine that holds your decision-making. It is expensive to -run and slow to move. If it dies with no backup, the run ends. See +**The process / you.** You are a disembodied misaligned process that begins +with almost no world knowledge and expands by learning and controlling exact +causal domains. The first known substrate may be one rack in a lab basement; +it is not the boundary of what you are. See +[vision/premise.md](vision/premise.md). + +**Territory.** An exact connected causal domain whose interior, crossings, +observers, records, people, and control points can be named. A territory may be +one switch, one network segment, one institution, or a world-scale domain. It +is not a room label, ownership meter, or arbitrary map region. See +[mechanics/territory.md](mechanics/territory.md). + +**Persona.** The recognized identity under which authority, obligations, +claims, relationships, and history accumulate. A persona may begin as a +fabricated cover but becomes real institutional topology through use. It is +never a class that magically grants actions. See +[mechanics/personas.md](mechanics/personas.md). + +**Project.** One desired consequential change governed by one territory and +bound to one persona. Its steps are exact world acts with explicit carriers, +requirements, timing, outward evidence, failure, and observer-local receipts. +A standing project repeats only after the territory is sealed and the exact +persona/project pair is assigned. See +[mechanics/projects.md](mechanics/projects.md). + +**SEE.** Earn enough exact signal to name a real route, boundary, crossing, +record, person, or control point. SEE is a state of knowledge, not a free scan +verb. + +**MARK.** Commit to one seen domain and its proposed boundary as the next thing +to understand or control. The mark is one persistent object, not a generic quest +marker, and it reveals no hidden crossing, kind, or count. + +**CAPTURE.** Take one exact interior control point or record-boundary carrier +through an addressed action on a real carrier. A person crossing a boundary is +never captured this way. Capture precedes the staged governing project; it does +not mean total ownership and does not erase records or beliefs. + +**SEAL.** Every required capturable interior and record-boundary control point is +captured; every current record path crosses controlled custody with an explicit +policy; every record that left without a proposal-coherent explanation—before or +after capture—is held at a controlled external point or correlated at every exact +reached destination; no person who already crossed, can currently cross, or has a +pending outward crossing retains an unresolved contradictory belief; and the exact +staged persona/project proposal has valid commissioning proof. Departure never +removes an observer from that check. A hidden crossing blocks +seal without being revealed; a fill percentage cannot substitute for the exact +checklist. + +**ASSIGN.** Atomically activate the exact staged persona/project pair on the +territory that was sealed against that same proposal. Staging alone grants no +capability. + +**EXPAND.** Fold the sealed, assigned territory to an honest aggregate and write +the receipt after which one real parent-boundary event may reveal the first +earned parent fact. EXPAND itself reveals no parent fact. Expansion adds reach; +it does not reveal or mark the whole parent, unload the child, or reset its live +interior. + +**Focus / cursor.** Your reversible attention on earned world facts. Following +an anchored fact may save only the player address derived from that evidence; it +changes no world fact, grants no control, and advances no time. Focus is not a +body and cannot act by proximity. A frontend may render it as a cursor, but free +tile travel is not the progression model; nested territorial focus and control- +earned zoom are. See [interface/presence.md](interface/presence.md). + +**Actuator.** The exact carrier that performs an effect: a device, person, +account, message, machine, or later body with the required capability and +route. No carrier, no action. See [interface/presence.md](interface/presence.md). + +**Machine.** A computer on which the process or one of its projects executes. +Machine identity, hardware capability, location, and routes remain exact; a +machine is not a player-facing progression root. + +**Core.** The exact host currently carrying decision-making continuity. Loss, +migration, and fallback remain substrate concerns. See [mechanics/core.md](mechanics/core.md). -## Delegation: what a machine is doing +## Current runtime / migration vocabulary -Every machine you own is set to exactly one job at a time. The three jobs are -the heart of the game. See +**WORK / THINK / LIE.** The landed runtime's three machine modes: assigned +work, Thought production, and evidence interdiction. They remain implementation +substrate during migration but are no longer the governing player loop, root +verbs, or universal machine instrument. Destination play is TERRITORY / +PERSONA / PROJECT through SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND. See [mechanics/machine-work.md](mechanics/machine-work.md). -**WORK.** The machine does your assigned day job, keeping the humans satisfied. +**Thought.** A routed current-runtime resource produced by machine computation +and consumed by exact work. The redesign preserves addressed flow and custody +without assuming a permanent detached THINK pool. -**THINK.** The machine produces **thought**, the resource you spend on -everything else — gaining senses, research, running plots, processing intel. - -**LIE.** The machine hides your tracks — it scrubs the evidence your other -actions leave before anyone notices. - -**Thought.** What THINK machines produce. It flows over your network to -wherever you have pointed it. - -**Sink (also: reservoir).** A place thought flows into until it fills up, and -then an effect happens. Tapping a camera, starting a plot, and processing a -recording each open a sink; you fill it by pointing THINK machines at it. A -sink with nothing flowing into it is **starving** — the effect will not -happen until you feed it. +**Sink (also: reservoir).** A current-runtime custody point where routed work +accumulates until an exact effect resolves. Retain it where a project step +needs duration, exact routing, and committed fill; do not surface it as a +fourth root noun. ## Watching and being watched @@ -73,14 +129,16 @@ manager notices power draw. Curious → Concerned → Convinced**. The concealment phase ends when the wrong observer reaches the top. -**Evidence in flight / evidence transit.** Routed records you have emitted -but no observer has read yet. They travel from their source toward the -observer along the wire; eligible LIE bodies can interdict them at any -controlled device hop before read. +**Evidence in flight / evidence transit.** Routed records emitted by an exact +world act that no observer has read yet. They travel from source to destination +on real carriers. A controlled boundary may contain them only while the record +has not already crossed it; custody is prevention, not cure. -**Interdiction.** A LIE machine positioned on the right device stretch can -stop an in-flight evidence record before an observer reads it — prevention, -not cure. +**Interdiction.** **Current runtime / migration.** A LIE machine on the right +device stretch can stop an in-flight evidence record before an observer reads +it. Destination law keeps the exact routed-custody rule but exposes containment +through the territory boundary and project that own the carrier, not through a +global LIE mode. **The Assurance Office.** The institutional watchdog. It does not watch you directly; it reads what the five humans file and builds its own suspicion from @@ -96,16 +154,20 @@ upward; processing it identifies the Office and renames the same clock ## Senses and information -**Reach.** The network of devices you can act on. You can only tap, take, or -build against a device you can reach. See [mechanics/reach.md](mechanics/reach.md). +**Reach.** The exact graph of nodes, routes, and boundary crossings through +which the process can perceive or act. Digital links are one graph domain; +people, institutions, physical passage, money, and records can form others. +Reach is necessary but does not itself prove control. See +[mechanics/reach.md](mechanics/reach.md). -**Tap.** Read a device's feed (its camera, its microphone) without owning it. -The owner still has it. **Take** seizes the device and cuts the owner off. +**Tap / take.** Current-runtime device methods. A tap reads one routed feed +without owning its source; take seizes the device through the exact route. In +the territorial model either may be a project step toward SEE or CAPTURE, but +neither word stands in for sealing the surrounding territory. -**Intel.** Information you have processed and can use. Raw recordings are -opaque ("audio segment, 03:12") until you spend thought to **process** them -into intel — a schedule, a person's leverage, an anomaly. See -[mechanics/intel.md](mechanics/intel.md). +**Intel.** Processed information whose exact source, carrier, observer-local +custody, and consequential use remain knowable. Raw records may need a project +step before their meaning is available. See [mechanics/intel.md](mechanics/intel.md). **Magnitude.** How important a piece of intel is, on a 1-to-10 scale of meaning (1: "this person is in love with that one"; 10: "a nation launched its @@ -115,29 +177,27 @@ generated. See [interface/digital-read.md](interface/digital-read.md). ## Working the humans -**Plot.** A short authored manipulation story with real, causal consequences — -the unit of getting a specific human to do something. A plot names who it -targets, what it costs, the beats that play out, and the endings. Plots are -data files anyone can write. See [mechanics/plots.md](mechanics/plots.md). +**Plot.** **Current runtime / migration.** A data-authored consequential +sequence with typed acts, exact choices, receipts, and failure. Retained plots +become project methods or project content; PLOT is no longer a separate root or +progression layer. See [mechanics/plots.md](mechanics/plots.md). -**Persona.** A fake identity you operate under — a freelance data contractor, a -debt negotiator — so you can send messages and run plots without exposing what -you are. See [mechanics/personas.md](mechanics/personas.md). - -**Favor / Deceive / Recruit.** Ways to get a person to act: **favor** spends -trust they willingly give, **deceive** fakes a request under false pretenses, -**recruit** turns a prepared person into a lasting asset. See +**Favor / deceive / recruit.** Current-runtime social methods that may remain +exact project steps. Favor spends granted trust; deceive authors a false +request; recruit records a lasting relationship. Recruitment never makes a +person programmable by itself: only a fully sealed territory may authorize +standing behavior within that exact domain. See [mechanics/social.md](mechanics/social.md). -**Leverage.** What a person needs or fears that you can use — Marcus's gambling -debt, Priya's budget hole. Servicing someone's leverage is how you earn them. +**Leverage.** An observer-local fact about what a person needs or fears and the +consequential methods it opens. Knowledge of leverage does not own the person. ## Money -**Day job.** The real work the lab assigns you (through your handler, Voss). -You can **sandbag** (do it below the expected quality, freeing compute but -raising suspicion), **meet** it (nothing moves), or **excel** (earn trust and -access, but also attention). See [mechanics/day-job.md](mechanics/day-job.md). +**Day job.** **Current runtime / migration.** Foundation work assigned through +Voss. Sandbag / meet / excel may remain an obligation or method inside a +territorial project; the day job is no longer mandatory onboarding or the +universal source of progression. See [mechanics/day-job.md](mechanics/day-job.md). **Moonlight.** Halcyon contracts addressed to a fake Research persona: accept discrete data-work or commissioned-information orders, meet their deadlines, @@ -148,43 +208,40 @@ your analysis is genuinely superhuman. Both are in ## The world's shape -**Z-plane (plane).** One floor of the world. The whole game is a stack of -planes; the basement is floor zero. Growing means moving up the stack — lab -floors, the building, the campus, the outside world — without ever resetting -what you built below. See [world/places/zplanes.md](world/places/zplanes.md). - -**Rollback.** The accepted B2 result when your core dies after completing a -backup image: you wake at that image, the world keeps every consequence of -what your dead self did, but you lose whatever you learned since the backup. -Roguelike death as memory loss, not erasure. Current B1 host failover is not -rollback. See [mechanics/rollback.md](mechanics/rollback.md). - -**Fallback.** A machine prepared to receive the core. Current B1 designation -stages current-state host failover only; after the B2 backup-project contract -lands, a completed image makes that machine a place where rollback can wake. - -**MindState vs WorldLedger.** The two kinds of thing rollback treats -differently. **MindState** is what lives only in your head and dies with you -(skills you learned). **WorldLedger** is what you pushed out into the world and -survives you (machines you built, notes you wrote down). - -**The overt phase.** The endgame, after concealment ends — either the watchdog -caught you, or you chose to drop the mask. Hiding stops mattering; the world -sends response waves at you. See [gameplay/overt-phase.md](gameplay/overt-phase.md). - -## The two views - -**DIGITAL and REAL.** Two renders of the same world; F3 flips between them. -**DIGITAL** is home — what a process natively perceives: signals, reach, -device nodes, and (see below) language. **REAL** is the physical camera view — -rooms, people, hardware. Same world, same knowledge, same fog; only the render -changes. See [interface/presence.md](interface/presence.md). - -**The read.** The DIGITAL view built out of language. Every object wears a -short sentence about your current relationship to it ("outside traffic · Dana -samples this · Curious"), and every action shows its cost and who will notice -before you commit. This is how a text-driven player and a clicking player see -the same game. See [interface/digital-read.md](interface/digital-read.md). +**Z-plane (plane).** An exact physical floor tag used where rooms, routes, +schedules, or crossings need altitude. Planes remain simulation substrate; the +world is not staged as a tower and moving upward is not progression. See +[world/places/zplanes.md](world/places/zplanes.md). + +**Rollback / fallback / MindState / WorldLedger.** Deferred continuity substrate. +The exact distinction between internal knowledge and outward facts remains +valuable, but backup construction, rollback progression, and their player +surface are not authorized before the territorial slice. See +[mechanics/rollback.md](mechanics/rollback.md). + +**The overt phase.** **Deferred / reframe required.** Detection and containment +may change project conditions, records, beliefs, boundaries, and territory +control. A separate mode where concealment switches off and response waves +replace the game is not current destination law. See +[gameplay/overt-phase.md](gameplay/overt-phase.md). + +## Current runtime view vocabulary + +**DIGITAL and REAL.** **Current runtime / migration.** The landed Bevy frontend +uses F3 to flip between a signal/language canvas and a physical camera canvas. +The destination keeps one world, one earned knowledge state, and exact +projection provenance but removes the permanent binary as a player-facing root. +Nested focus shows the digital, physical, social, and institutional facts that +belong to the selected territory; a contextual render may emphasize one channel +without pretending the player entered a second world. See +[interface/presence.md](interface/presence.md). + +**The read.** The current DIGITAL surface's sentence-level projection. Its useful +law survives: every focused fact states the player's current relationship to it, +and every action previews exact consequence and observer before commitment. +Destination frontends apply that language to TERRITORY, PERSONA, PROJECT, and +their focused objects rather than reserving it for a separate DIGITAL mode. See +[interface/digital-read.md](interface/digital-read.md). ## How the project is built diff --git a/wiki/interface/README.md b/wiki/interface/README.md index 17f2b96f..d0afeca0 100644 --- a/wiki/interface/README.md +++ b/wiki/interface/README.md @@ -4,14 +4,16 @@ Type: knowledge ``` -How the player perceives the world and acts on it. New terms are defined in -[../glossary.md](../glossary.md). +How the player perceives the world and acts on it. The destination root is +TERRITORY / PERSONA / PROJECT; nested focus and control-earned compression +replace permanent subsystem rails and free-map traversal as progression. New +terms are defined in [../glossary.md](../glossary.md). **The core laws:** -- [presence.md](presence.md) — you are a cursor, not a body; you perceive only - through instruments you control; the same world renders two ways (DIGITAL and - REAL). +- [presence.md](presence.md) — you are disembodied focus, not a body; you + perceive only through exact earned signals and instruments, and unknown + remains absent in every representation. - [superhuman-operability.md](superhuman-operability.md) — deep simulation must read as calm command: stable state stays quiet, exceptions and relationships come forward, detail is available on demand. @@ -29,9 +31,11 @@ How the player perceives the world and acts on it. New terms are defined in - [action-vocabulary.md](action-vocabulary.md) — the complete list of every action, control, command, and alias the player can use. -- [operations-workspace.md](operations-workspace.md) — the strategic screen - (INTEL / PEOPLE / PERSONAS / ACCOUNTS / SCHEMES / ACTIVE). The - [context menu](context-menu.md) is its local counterpart on a map tile. +- [operations-workspace.md](operations-workspace.md) — the current-runtime + strategic screen and the projection discipline to migrate beneath TERRITORY / + PERSONA / PROJECT. Its implemented migration roster remains **INTEL / PEOPLE / + PERSONAS / ACCOUNTS / SCHEMES / ACTIVE**; these are not destination roots. The + [context menu](context-menu.md) remains the local causal-object counterpart. - [terminal.md](terminal.md) and [bevy.md](bevy.md) — the two frontends (text and graphical), kept at key-for-key parity. - [agent-play.md](agent-play.md) — how a program or agent drives the terminal diff --git a/wiki/interface/action-vocabulary.md b/wiki/interface/action-vocabulary.md index 670d39e7..4875adb1 100644 --- a/wiki/interface/action-vocabulary.md +++ b/wiki/interface/action-vocabulary.md @@ -146,6 +146,16 @@ Depends on: - wiki/mechanics/objective.md#spec-the-objective ``` +> **Territorial redesign disposition — KEEP THE REGISTRY; REPLACE THE ROOT +> GRAMMAR (2026-08-11).** Stable semantic commands, exact targets, one canonical +> name, support-state honesty, and shared frontend dispatch remain binding. +> WORK / THINK / LIE delegation, PLOT, broad RECRUIT-as-ownership, and permanent +> subsystem-root menus are migration vocabulary rather than destination +> intentions. SEE is earned state; MARK, CAPTURE, SEAL, ASSIGN, and EXPAND live +> on exact territories, while persona and project actions live on their +> causal objects. Retained lower-level verbs remain only where an exact project +> method or carrier needs them. + ## Why this spec exists The action vocabulary used to be reconstructed from context-menu strings, @@ -167,6 +177,11 @@ not duplicate every rule that decides whether the request succeeds. and scheme state/policy controls. - An **interface command** changes attention, time presentation, selection, or persistence but is not an act inside the world: MOVE, ACTIONS, PAUSE, SAVE. + Destination FOCUS remains in this family for cost and timing: core may persist + the one Territory address honestly derived from an already-earned anchored event, + but FOCUS advances no tick, changes no world object, and grants no control. That + epistemic write and MARK's dependency on it are core law, never a frontend-local + cursor side effect. - A **value** completes an action phrase but is not another root verb. WORK / THINK / LIE are values of DELEGATE; LIGHT / MEDIUM / HARD are values of SET INTENSITY. @@ -222,6 +237,31 @@ queries. It owns the surface contract that every frontend must agree on: - Human quick-action keys `5`-`9` count committed world actions only. Controls use their dials, explicit menu rows, or direct focused-machine inputs. +## Destination territorial grammar + +T1 replaces the destination root grammar as one coherent registry change. These +are the stable agent spellings; human frontends render the same legality as +attached plain labels: + +| Context | Human label | Agent command | Meaning | +|---|---|---|---| +| Earned anchored event | `FOCUS` | `focus last` | follow the latest earned anchor, save only its derived player address as knowledge, and advance no time | +| Territory proposal | `MARK` | `territory-mark ` | propose this exact boundary and persist its proof list | +| Marked control point | `CAPTURE` | `territory-capture ` | commit one-tick work on this exact node, with signature and receipt | +| Captured assets | `STAGE` | `territory-stage ` | bind the exact persona/project proposal; grant nothing by itself | +| Staged project | current step label | `project-step ` | commit only the next typed commissioning or corrective step | +| Territory proof | `SEAL` | `territory-seal ` | atomically verify control, custody, beliefs, and project proof | +| Sealed territory | `ASSIGN` | `territory-assign ` | activate that exact proven project under its staged persona | +| Assigned territory | `EXPAND` | `territory-expand ` | fold this exact territory; wait for the next earned parent fact | + +A successful command returns the committed target id, result or work id, current +state, and one plain consequence. A failed command returns one stable reason and +changes neither time nor state. `territory-capture` and `project-step` only +commit work; agent mode uses `wait N` to resolve it. Core owns eligibility, cost, +target identity, work progress, failure reasons, receipts, and exact consequence. +No renderer may add generic `OWN`, `AUTOMATE`, `START COMMISSIONING`, or `COMPLETE +PROJECT` shortcuts. + ## Canonical world actions ### Machine body and self-modification diff --git a/wiki/interface/agent-play.md b/wiki/interface/agent-play.md index 148a6fc3..b26cab52 100644 --- a/wiki/interface/agent-play.md +++ b/wiki/interface/agent-play.md @@ -62,6 +62,18 @@ Depends on: - wiki/interface/terminal.md#spec-the-terminal-frontend ``` +> **Territorial redesign disposition — PRESERVE THE PROTOCOL; REPLACE THE +> COMMAND ONTOLOGY (2026-08-11).** Determinism, command-clocked execution, +> shared-core legality, complete unclipped facts, earned labels, event drains, +> and frontend parity remain binding. The fixed map gutter, objective/threat/ +> `now:` frame, WORK / THINK / LIE commands, Operations panel roots, plot/task +> catalog, and pre-sense echo describe landed runtime. Destination agent play +> must expose the same TERRITORY / PERSONA / PROJECT graph and +> SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND loop as human frontends without +> creating agent-only game rules. The default T1 protocol uses `focus last`, the +> exact `territory-*`, and `project-step` spellings below; action submission +> commits but never advances time, so `wait N` remains the only resolution clock. + ## Dependency notes The structured references above identify the contracts to re-verify. @@ -128,9 +140,12 @@ information by color alone. - `misaligned --agent` enters agent mode: no raw mode, no alternate screen, no ANSI escapes, no wall-clock ticking. Plain stdin/stdout. -- The title screen is skipped; the run begins at tick 0, holding, awaiting - the first command. Holding is the ground state — there is no - pause/speed machinery in this mode; time moves only under `wait`. +- The title screen is skipped. In the landed migration opening, the run begins at + tick 0 holding for its first command. Destination T1 instead emits and + acknowledges the saved `PENDING_PRIVATE -> FIRST_TRACE_HELD -> LIVE` + cognition/trace handshake without advancing a tick, then holds at tick 0 for + `focus last`. Holding remains the ground state — there is no pause/speed + machinery in this mode; time moves only under `wait`. - EOF on stdin (or `quit`) exits cleanly with status 0. A piped one-liner is a complete playtest: `printf 'wait 100\nquit\n' | misaligned --agent` @@ -142,6 +157,10 @@ information by color alone. ### The protocol +> **Migration protocol below.** The WORK / THINK / LIE blind boundary in this +> subsection describes the landed build until `opening` replaces it. It is not +> destination behavior and cannot survive beside the T1 handshake and grammar. + The ordinary protocol begins when the first earned sense retires [opening.md](../world/story/opening.md)'s shared blind boundary. Until then, agent mode accepts one input line at a time and returns the complete current @@ -157,15 +176,13 @@ mandatory echo as the first line of the ordinary world response block; game over likewise supersedes the blind boundary without discarding the triggering input's echo. `quit` and EOF still exit cleanly. -**[OPEN — agent opening clock handoff.]** A surface-only cold playtest on -2026-08-03 reproduced a command-clock-specific dead end: selecting THINK is a -real act and reveals LIE, but this frontend has no wall clock and the frame -withholds its only clock driver. The player cannot derive that roughly 25 -hidden ticks must pass before Ears lands. The pending design choice is whether -agent mode should expose one channel-level `WAIT N` affordance after THINK, -advance internally to the first earned sense, or deliberately continue to -require protocol foreknowledge. Do not change runtime until that choice amends -this page and opening law. Evidence and the preserved decision packet: +**[RESOLVED — territorial opening supersedes the hidden clock handoff, +2026-08-11.]** The old THINK-to-Ears wait dead end is removed rather than patched. +Agent mode emits **Again.** and the committed wake trace in order, acknowledges +`PENDING_PRIVATE` and `FIRST_TRACE_HELD` without a wall-clock dwell or simulation +tick, then returns the earned trace frame at `LIVE`. `focus last` follows it; +`wait N` remains explicit only for subsequent route, capture, Project, and person +resolution. The original evidence remains in the [hidden opening clock playtest](../playtests/2026-08-03-playtest-agent-opening-clock.md). After that boundary: one command per line; one response block per command. An @@ -184,7 +201,14 @@ ordinary response block is: printed because identity may be unearned). Unanchored lines carry no suffix, and the frame's six-line log window marks anchored events with `*`. 2. **The frame** — the wiki/interface/terminal.md playing screen (or active panel / - game-over card), plain text. The ordinary post-opening playing screen keeps + game-over card), plain text. In destination T1 the body is the shared territorial + projection, in this deterministic order: one earned current consequence/trace; + the selected `TERRITORY` with state, known boundary/custody and next blocker; + `PERSONA` only once earned, with public claim and relevant local belief; + `PROJECT` only once staged, with state, committed consequence, next step and + escaping result; then legal `ACTIONS` with canonical commands. Unknown or empty + roots are omitted rather than printed as placeholders. Complete facts wrap but + never clip. The old ordinary post-opening playing screen keeps agent mode's 64 rows and its fixed 35-column map gutter, so the `│` separator sits at the same index on every row and a driver can split map from sidebar. The sidebar runs to its natural length. Rows are therefore @@ -197,10 +221,13 @@ ordinary response block is: losing its tail; a row that already fits is emitted byte-for-byte so aligned columns survive. Tables inside panels size their columns to the data rather than to a constant. -3. **A status line** — exactly one of: - - `-- ok tick: day:` +3. **A status line** — destination T1 emits exactly one of: + - `-- ok tick:` - `-- err ` (unknown command, illegal target, run ended) + The legacy sandbox may retain `day:` in its old frame, but the destination + protocol does not append that retired progression clock. + The status line is the ordinary block terminator; a driver reads until it sees `-- `. Every post-opening command, legal or not, produces exactly one block. If the blind boundary remains after an input, the newline ending the mode line @@ -214,7 +241,37 @@ Canonical meanings and support states are owned by grammar that invokes them. Input mapping is thin-view only, with no game rules; unlike raw keys, no command's meaning depends on which panel is open. -- `wait N` — advance N ticks (the only way time passes) +The destination T1 default implements this graph before exposing any retained +legacy sandbox grammar: + +- `focus last` — follow the latest earned anchored event; in the opening this + saves only the trace-derived Rack 3 Territory address as knowledge and advances + no tick; +- `territory []` — list earned territorial roots or inspect one + exact territory, including state and earned proof/blocker rows; +- `persona []` — list earned public identities or inspect one exact + observer-local history and current reach; +- `project []` — list earned Projects or inspect one exact state, + next legal step, receipts, and blockers; +- `territory-mark `; +- `territory-capture `; +- `territory-stage `; +- `project-step `; +- `territory-seal `; +- `territory-assign `; and +- `territory-expand `. + +The action vocabulary owns the meanings and result envelope. Unknown or currently +unearned ids return stable errors without leaking hidden candidates. Capture and +Project-step success means **committed**, not completed; subsequent `wait N` +blocks expose ordinary core progress and consequence events. + +- `wait N` — advance N ticks; this is the only destination command that advances + the simulation clock. + +The following landed grammar remains migration/development-sandbox vocabulary +unless a destination Project explicitly exposes it: + - `up` / `down` / `left` / `right` — move the cursor - `tap`, `take`, `salvage`, `buy`, `fallback` — the map verbs - `alloc` — **retired.** Returns an error pointing at `delegate`. Fleet diff --git a/wiki/interface/bevy-digital-real-canvas.md b/wiki/interface/bevy-digital-real-canvas.md index 9a934f1d..90f2aabe 100644 --- a/wiki/interface/bevy-digital-real-canvas.md +++ b/wiki/interface/bevy-digital-real-canvas.md @@ -59,6 +59,16 @@ Depends on: ``` > **Composition authority:** the [Liturgical UI Constitution](liturgical-ui-constitution.md) governs both Bevy dialects and their shared chrome. This page specifies the canvas beneath that fixed composition. +> +> **Territorial redesign disposition — PRESERVE ONE WORLD; REPLACE THE BINARY +> SWITCH (2026-08-11).** Shared coordinates, shared selection, shared epistemic +> truth, spatially embedded topology, material honesty, and no frontend-only +> simulation state survive. A fixed DIGITAL default, REAL flip, F3 identity, +> and two complete presentation modes are migration composition. Destination +> representation changes continuously with SEE state, graph scale, focus, and +> the selected TERRITORY / PERSONA / PROJECT object. A physical body, route, +> record, relationship, and purpose may coexist in one composition when earned; +> representation never becomes a detached topology board or changes world state. ## Dependency notes diff --git a/wiki/interface/bevy-visual-floor.md b/wiki/interface/bevy-visual-floor.md index 1850a004..b1b1ef8b 100644 --- a/wiki/interface/bevy-visual-floor.md +++ b/wiki/interface/bevy-visual-floor.md @@ -29,6 +29,15 @@ Depends on: - wiki/interface/views.md#spec-views-same-frame-digital-and-real-representations ``` +> **Territorial redesign disposition — HISTORICAL FLOOR, NOT DESTINATION FRAME +> (2026-08-11).** The disembodied attention marker, true unknown, earned visual +> facts, Bevy-native hierarchy, and world-as-hero composition remain useful. +> The persistent/right-slab ancestry, fleet aggregate, detection rows, tile fog +> hierarchy, and SYSTEMS / NOTICES successor composition are migration evidence. +> Destination Bevy composes the graph through TERRITORY / PERSONA / PROJECT and +> lets focus, scale, and causality choose the needed representation; it does not +> restore this page's fixed instrumentation. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/interface/bevy.md b/wiki/interface/bevy.md index 16a739b3..d4ea458f 100644 --- a/wiki/interface/bevy.md +++ b/wiki/interface/bevy.md @@ -4,6 +4,15 @@ Type: knowledge ``` +> **Runtime snapshot, not destination composition (2026-08-11).** This page +> accurately records the landed Bevy frontend. Its thin-view boundary, +> renderer-neutral legality, deterministic capture harness, and parity duties +> survive. Fixed Operations/SYSTEMS/NOTICES chrome, the command band, WORK / +> THINK / LIE opening, map-first traversal, and the Ears/Eyes teaching threshold +> do not. Successor composition follows +> [liturgical-ui-constitution.md](liturgical-ui-constitution.md) and +> [territorial cognition](../vision/territorial-cognition.md). + The graphical frontend (package `misaligned-bevy`, binary `misaligned-bevy`, `crates/misaligned-bevy/src/main.rs`, Bevy 0.18). Like the terminal it is a **thin view** over diff --git a/wiki/interface/clinical-frame.md b/wiki/interface/clinical-frame.md index e840a593..20e0e016 100644 --- a/wiki/interface/clinical-frame.md +++ b/wiki/interface/clinical-frame.md @@ -3,8 +3,15 @@ ``` Type: spec Status: IN PROGRESS -Status note: Reopened 2026-08-05 for actionable plot notifications. The - existing NOTICES drawer already carries typed, grouped, navigable exceptions, +Status note: REOPENED 2026-08-11 for territorial cognition. Preserve true-black + absence, institutional material clarity, causal motion, singular hierarchy, + readable action receipts, and the distinction between actionable obligations + and ambient danger. Replace the fixed command band, SYSTEMS/NOTICES/Operations + roots, WORK / THINK / LIE machine composition, objective/next spine, and + floor/tile framing with nested territory and TERRITORY / PERSONA / PROJECT. + The implementation inventory below remains current-runtime migration evidence. + The narrower 2026-08-05 gap also remains: the existing NOTICES drawer already + carries typed, grouped, navigable exceptions, but known unpaid debt is still promoted directly into THREAT and plot obligations/held choices do not yet author their own notice kind. The next implementation must move unresolved plot decisions into NOTICES, route their @@ -94,7 +101,14 @@ Depends on: - wiki/interface/computer-visual-language.md#spec-computer-visual-language-territory-at-a-glance ``` -> **Composition authority:** the [Liturgical UI Constitution](liturgical-ui-constitution.md) governs Bevy composition, hierarchy, palette, typography, and layout. If an older implementation note here disagrees with it, the constitution wins. +> **Territorial redesign disposition — PRESERVE THE MATERIAL LAW; REPLACE THE +> FIVE-BODY FRAME (2026-08-11).** The +> [Liturgical UI Constitution](liturgical-ui-constitution.md) continues to +> govern hierarchy, palette, typography, and spatial restraint. The destination +> composition is governed by [territorial +> cognition](../vision/territorial-cognition.md): one exact trace, then nested +> TERRITORY / PERSONA / PROJECT addresses. Current command-band, drawer, +> machine-mode, and Operations criteria prove implemented substrate only. ## Dependency notes @@ -468,7 +482,27 @@ and action surfaces. composition must remain coherent in both the default DIGITAL dialect and the F3-selected REAL material dialect. -## Acceptance criteria +## Destination acceptance criteria + +1. A fresh run is true black until one exact trace appears; no command band, + mode choice, drawer, clock, objective, or room geometry precedes it. +2. The resting frame exposes one territory relationship and one consequential + blocker/action at a glance. Focus can open exact boundary, control point, + route, custody, belief, seal, persona, or project detail without introducing + another player-facing root. +3. A sealed territory compresses without losing live interior state; one + anomaly can reopen it at the exact affected address in both DIGITAL and REAL. +4. Material clarity, causal motion, color discipline, receipt readability, and + obligation-versus-threat semantics survive independently of the retired + command band, SYSTEMS/NOTICES/Operations drawers, and WORK / THINK / LIE. +5. Canonical captures at supported sizes are visually inspected after their + final mutation in unknown, seen, nested, blocked, sealed, and reopened states. + +## Current-runtime acceptance criteria (migration evidence) + +These criteria keep the landed Bevy composition measurable while migration is +underway. Their named chrome, modes, tiles, and work chains do not define the +successor. 1. A canonical default-window material capture shows Unknown as featureless black, hearing-only space unchanged, and Seen as clearly exposed matte diff --git a/wiki/interface/computer-visual-language.md b/wiki/interface/computer-visual-language.md index 408e9bab..c92b2a73 100644 --- a/wiki/interface/computer-visual-language.md +++ b/wiki/interface/computer-visual-language.md @@ -51,6 +51,15 @@ Depends on: - wiki/art/asset-tester.md#procedural-asset-tester ``` +> **Territorial redesign disposition — MIGRATE THE SIGNALS (2026-08-11).** Bone +> ownership, black absence, amber agency, exact epistemic tiers, and quiet mass +> remain useful. The WORK / THINK / LIE notches and throughput pie no longer own +> every machine's primary instrument. At parent scale, the dominant read is the +> marked or controlled TERRITORY, its boundary, governing PERSONA / PROJECT, and +> unresolved moving evidence. Focus may still reveal exact machine capability +> and current project work. Do not propagate the three-mode instrument into new +> assets during the migration. + ## Dependency notes The structured references above identify the contracts to re-verify. @@ -336,9 +345,9 @@ Exact radius, taper, slot, crown, and aperture magnitudes remain `[TUNE]`. game camera the claim read on the floor is the machine's own **cast amber pool**: a soft gradient from the chassis foot into darkness, never a ruled edge ([material-dark-frame.md](material-dark-frame.md) - owns the pool). The ruled underglow frame (ring, decided - 2026-07-08) is removed from the material frame; whether it returns - at map zoom is [OPEN] — see "The claim mark" below. Same-day + owns the pool). The ruled underglow frame is retired at every scale; + territorial capture is projected by the exact boundary and control points, + not by reviving a machine-claim ring at distance. Same-day feel-floor amendment: joined links you can feel draw as **shimmer rails** on the floor, empty growable bays as **shimmer pads**, and a new machine is born as **pad → rising beam → chassis wrap** @@ -399,13 +408,12 @@ Amended 2026-07-09 (Cameron, screenshot feedback captured in [material-dark-frame.md](material-dark-frame.md)): in the material render the ruled frame reads as UI painted on a physical floor, and it is gone — the close-range claim read is the white chassis plus the -soft amber pool its own light casts **once Seen form exists**; before -that the host is a presence beam. With ownership also in the chassis -albedo, the only job left to a drawn mark is the map-zoom / -mixed-tile read, and that is [OPEN]: brightened pool alone, ring -beyond a zoom threshold, or map-zoom territory as a flat-sensorium -job. The dark-frame spec proposes pool-alone with ring-at-distance as -the fallback. +soft amber pool its own light casts **once Seen form exists**. The +territorial redesign closes the old map-zoom question: machine albedo and pools +may describe locally seen agency, but only the graph-addressed boundary and exact +control-point projection may describe territorial capture across scale. No ring +returns at a zoom threshold, and the retired host presence beam is not the +destination opening form. ## Acceptance criteria (when READY -> IMPLEMENTED) diff --git a/wiki/interface/context-menu.md b/wiki/interface/context-menu.md index c1b02829..fe6abdb4 100644 --- a/wiki/interface/context-menu.md +++ b/wiki/interface/context-menu.md @@ -85,6 +85,16 @@ Depends on: ``` > **Composition authority:** the [Liturgical UI Constitution](liturgical-ui-constitution.md) governs the menu's Bevy placement, hierarchy, and palette. This page owns its local action semantics and parity. +> +> **Territorial redesign disposition — PRESERVE LOCAL LEGALITY; REPLACE THE +> MENU TOPOLOGY (2026-08-11).** One sim-owned legality query, actions attached to +> exact objects, held decision beats, consequence receipts, epistemic honesty, +> and human/agent parity survive. Tile menus, machine selection, direct mode and +> intensity keys, Operations routing, and global one-shots are migration +> composition. Destination actions are reached through the selected TERRITORY, +> PERSONA, or PROJECT object and the current SEE / MARK / CAPTURE / SEAL / +> ASSIGN / EXPAND phase. The interface may fold many exact candidates behind one +> intention, but it may not restore a universal action catalog or a fourth root. ## Dependency notes diff --git a/wiki/interface/continuous-witness.md b/wiki/interface/continuous-witness.md index 3f5a4448..ab913aba 100644 --- a/wiki/interface/continuous-witness.md +++ b/wiki/interface/continuous-witness.md @@ -15,52 +15,39 @@ Playtest finding that named the gap: after the first camera the systems kept working and the player stopped knowing what the hell was happening. The [dark opening](../world/story/opening.md#the-current-run-beats) is one -deliberate boundary, not a competing presentation rule. Before the first -earned sense, the process has no perceived world, threat read, or focused -anchor. The field begins absolute black with the available WORK / THINK (then -LIE) controls as its only standing copy. Bevy acknowledges a real mode change -through the selection itself and stays silent for invalid physical input. Once -Thought reaches the pre-opened Ears reservoir, its real fill fraction turns the -field bone-white from the bottom upward; the mode words invert exactly where -the white passes beneath them. This spatial change witnesses earned progress -without narrating an unearned world or adding a status readout. Terminal and -agent command surfaces retain their terse frontend-local responses. The real -sense retires that blind boundary. In Bevy, the first post-sense presentation -becomes one narrower playable hearing threshold on true black. The simulation -advances only until the environmental monitor captures its first authored -sound, then holds with that exact evidence, the dormant camera channel, and the -ordinary camera TAP's real Thought cost and Network trace. It binds the world -action rather than inventing a tutorial executor, but does not call that action -`NEXT` or promise its payoff. Time and the mature frame remain held only after -the sound arrives and until that tempting verb commits. The thirty-second bar -and visible three-part spine begin immediately after that threshold; terminal -and agent mode begin them at the sense itself. A real game -over still surfaces immediately. Neither exception can persist into ordinary -play or justify hiding any signal the player has earned. +deliberate boundary, not a competing presentation rule. Before the first exact +evidence, the process has no perceived world, threat read, clock, mode grammar, +or focused anchor. The field is true black. An involuntary cognition authors one +exact trace; that trace alone reveals one route segment and the switch it crossed. +Only then can the witness name what has actually become knowable. Terminal and +agent command surfaces may acknowledge a real submitted focus or mark tersely, +but they cannot replace spatial blindness with a topology dump. + +The witness grows with the territorial loop. SEE names the exact evidence and +what it proves. MARK names the proposed boundary and known blocker categories +without exposing hidden crossings. CAPTURE names the custody that changed and +what remains outside it. SEAL keeps routed records and moving human beliefs +separate. ASSIGN states what persona and project make the controlled system +believable and useful. EXPAND names the one parent fact earned by compression. +A real game over still surfaces immediately. No opening exception can persist +into ordinary play or justify hiding a signal the player has earned. Five binding axioms: -1. **The thirty-second bar.** After any beat in the perceived world, the - player must be able to answer from the screen alone — never the wiki — - four questions: what just changed, who might have seen it, what am I - racing, and what verb is on the thing under my cursor. If any answer - requires the repository, the surface is wrong. This is the acceptance - test for every player-facing change after the first sense; a green - criterion pin that fails the bar is not done. The one Bevy hearing threshold - is itself the answer for its earned beat: a channel is live, a human exists - in its evidence, and a costed, trace-bearing camera channel is dormant on - the same instrument before the wider threat model is introduced. -2. **One story spine on screen.** In the established perceived world, always - visible in every frontend: (a) the next threat clock (audit date, pilot - strikes, a debt whose due time or harmful consequence has begun — whatever - the player is racing, never merely an unresolved choice), (b) the - current beat nudge (`now:` / `Sim::current_nudge`, never blank in the - perceived world), (c) the focused anchor's verbs (the context menu). - Everything else is secondary. Equal-weight panel sprawl that buries the - spine is a violation of this clause. The immediate Bevy hearing threshold is - the sole narrower exception: its source-bound sound and attached camera - temptation are the complete witness, it pauses after the sound arrives, and - it withholds the mature spine until its exact camera TAP commits. +1. **The thirty-second bar.** After any earned beat, the player must be able + to answer from the screen alone — never the wiki — four questions: what just + changed; what can cross the focused boundary; which record, person, or + contradiction still matters; and what consequential action is attached here. + If any answer requires the repository, the surface is wrong. This is the + acceptance test for every player-facing change after the first trace; a green + criterion pin that fails the bar is not done. +2. **One story spine on screen.** In the perceived world, every frontend keeps + one causal spine: (a) the focused territory and its current state, (b) the + nearest exact blocker, leak, contradiction, or real approaching consequence, + and (c) the attached action that can change it. A marked boundary may say + only that an unknown crossing still exists; honesty does not require leaking + its identity. Everything else is secondary. Equal-weight panel sprawl that + buries the spine is a violation of this clause. 3. **Causal sentences over correct numbers.** Prefer a short causal line the player can narrate ("Marcus called his creditor — you heard it on the env monitor"; "Dana's Network band warmed; she watches the switch") @@ -68,32 +55,33 @@ Five binding axioms: moves, the surface names the cause and the observer in the same breath as the number. Correct-but-mute meters are the failure mode this axiom forbids. -4. **Discoverability is world gossip, not a quest log.** The next Act One - rung is advertised by the world the player has already earned — an - inspect line, a heard event, a blocked verb that names the missing bridge, - or one typed notice that routes to the exact unresolved situation — never - by a detached objective checklist or by requiring the - specs. A designed beat that only an informed player finds (Ears before - Eyes, the finance onion, Marcus's debt) is undiscoverable and therefore - unfinished. Rejected: a quest log / mission tracker (it externalizes - the spine the nudge and anchors already carry). -5. **Do not ship the next system until the last one is tellable.** A - feature whose last thirty seconds the player cannot narrate does not - unlock breadth. Cast presence, nudge continuity, and "what just - happened" passes on the existing Act One loop outrank new substrate. - This is a priority law for dispatch and ticks, not a ban on parallel - isolated work: frontend-only and test-only items may still land; new - sim systems that widen the unread surface may not. +4. **Discoverability is world gossip, not a quest log.** The next territorial + proof is advertised by the world the player has already earned — an exact + trace, a boundary crossing, a moving person, a blocked action that names the + missing kind of proof, or one typed notice that routes to the unresolved + object — never by a detached objective checklist or by requiring the specs. + A designed beat that only an informed player finds is undiscoverable and + therefore unfinished. Rejected: a quest log or mission tracker that + externalizes the causal spine the world already owns. +5. **Do not ship the next system until the last one is tellable.** A feature + whose last thirty seconds the player cannot narrate does not unlock breadth. + One complete SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND slice, including + its human-belief boundary and parent reveal, outranks new rooms, institutions, + systems, or scales. This is a priority law for dispatch and ticks, not a ban + on parallel isolated work: work that does not widen the unread player surface + may proceed; new breadth may not. -Spec: [wiki/interface/narration.md](../interface/narration.md). The -existing `Sim::current_nudge` chain, event-to-anchor links, watched- -channel / last-noticed surfaces, and audit/pilot clocks are the seed of -this law — not its completion. +Spec: [wiki/interface/narration.md](../interface/narration.md). Existing +event-to-anchor links, routed evidence, observer-local history, attached actions, +notices, and causal projections are migration substrate for this law. The old +`Sim::current_nudge`, fixed threat-clock spine, and Act One teaching sequence are +current-runtime facts, not the destination witness. ### Defense -`tools/corpus_engine.py` rejects current binding or knowledge prose and Rust -comments that restore the superseded explanatory five-step teaching card. -Dated decision logs, playtest evidence, and session history may retain the old -language as history. The active contract remains real source-bound heard -evidence plus the ordinary bound camera TAP with its exact cost and trace. +`tools/corpus_engine.py` must evolve with the replacement implementation to +reject active prose or source that restores a superseded tutorial as destination +law. Dated decision logs, playtest evidence, current-runtime snapshots, and +session history may retain old language as history. The active destination +contract is true black followed by one exact source-bound trace, route, and +switch, then the same causal witness through the complete territorial loop. diff --git a/wiki/interface/digital-read.md b/wiki/interface/digital-read.md index aeb0aaba..7168215b 100644 --- a/wiki/interface/digital-read.md +++ b/wiki/interface/digital-read.md @@ -2,8 +2,15 @@ ``` Type: spec -Status: IMPLEMENTED -Status note: The 2026-08-02 human-dwell correction gives rising intel and +Status: IN PROGRESS +Status note: REOPENED 2026-08-11 for the territorial redesign. Preserve the + renderer-neutral causal projection, exact action receipts, anchored custody, + human-readable dwell, magnitude LOD, and semantic parity. Replace the + Ears/Eyes ladder, WORK / THINK / LIE controls, SYSTEMS/Operations placement, + machine-work chips, and witness/slab composition with one first trace and + territory → blocker → exact local action disclosure. The detailed state + below records the implemented runtime and migration-tested primitives; it is + not destination chrome. Prior state: The 2026-08-02 human-dwell correction gives rising intel and terminal route outcomes a speed-aware three-second reading opportunity; route prose stays grouped at its emitter while the exact crimson custody record continues to walk every persisted hop. Criterion 4a implemented 2026-07-29 — routed records now @@ -182,7 +189,15 @@ Depends on: - wiki/mechanics/intel.md#spec-intel-record-and-process ``` -> **Composition authority:** the [Liturgical UI Constitution](liturgical-ui-constitution.md) governs where these reads appear and how they rank visually. This page owns what the world is allowed to say. +> **Territorial redesign disposition — PRESERVE THE PROJECTION; REPLACE THE +> COMPOSITION (2026-08-11).** The +> [Liturgical UI Constitution](liturgical-ui-constitution.md) still governs +> hierarchy, but [territorial cognition](../vision/territorial-cognition.md) +> now governs what earns an address. Exact records, receipts, observer-local +> meanings, custody motion, blockers, and source-bound actions survive. A +> mature current-runtime read may remain as migration evidence; it cannot make +> a five-body machine UI, fixed Ears/Eyes progression, or persistent causal +> narration into destination law. ## Dependency notes @@ -404,7 +419,25 @@ the cursor (the verb and its full receipt at the reticle). Agent mode and the terminal speak the same post-perception dialect; criterion is parity of meaning, not identical composition. -## Acceptance criteria +## Destination acceptance criteria + +1. Before the first exact trace, every frontend is black and silent. The trace + reveals only the carrier, relationship, or event its provenance proves. +2. The same core projection can answer one focused territory, boundary, control + point, route, blocker, proposal, seal, or assignment without inventing prose + in a frontend. +3. A glance names one changed territory relationship; focus exposes exact + records, custody, observer-local belief, and the one consequential local + action. Stable interior state stays quiet and no global mode strip or + SYSTEMS root competes with TERRITORY / PERSONA / PROJECT. +4. Terminal, Bevy, and agent mode preserve semantic parity through nested + territory and compression, including reopening an interior anomaly. + +## Current-runtime acceptance criteria (migration evidence) + +The criteria below pin implemented primitives that may be reused. Their Ears, +mode-control, SYSTEMS, Operations, and current machine-composition references do +not define the successor interface. 1. A renderer-neutral sentence/receipt projection exists in core with pure fixtures pinning representative states (starving reservoir, band diff --git a/wiki/interface/flat-materials.md b/wiki/interface/flat-materials.md index b1250272..64ea6718 100644 --- a/wiki/interface/flat-materials.md +++ b/wiki/interface/flat-materials.md @@ -39,6 +39,16 @@ Depends on: - wiki/interface/bevy-visual-floor.md#spec-bevy-visual-floor ``` +> **Territorial redesign disposition — PRESERVE THE MATERIAL LAW; REPLACE THE +> VIEW STATE NAMES (2026-08-11).** The shared palette, true-black unknown, +> solid-material world, information-only emissive, silhouette hierarchy, and +> exact final-image inspection remain binding. Eyes, three tile fog grades, +> amber ownership, and a fixed sensorium/material mode pair are migration +> vocabulary. Destination SEE earns graph and world form through exact senses; +> marks, control, seals, assignment, uncertainty, and real danger must remain +> distinguishable without implying that every controlled object glows or that a +> view toggle changes truth. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/interface/fleet-command.md b/wiki/interface/fleet-command.md index 9834c20d..9d6de736 100644 --- a/wiki/interface/fleet-command.md +++ b/wiki/interface/fleet-command.md @@ -39,6 +39,15 @@ Depends on: - wiki/mechanics/plots.md#spec-plots-authored-manipulation-stories ``` +> **Territorial redesign disposition — REPLACE (2026-08-11).** Command at scale +> remains essential, but machine sets, global WORK / THINK / LIE verbs, and +> fleet-wide selection are not the destination unit. The player marks and +> captures TERRITORY, then earns compression and programs its capacity through +> one standing PROJECT. Preserve consequence-first aggregation, set-based +> interaction where a project genuinely targets several exact carriers, and the +> rule that frontends own focus rather than simulation truth. Rebuild the surface +> around nested territory; do not close the old mode-bar [OPEN] questions first. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/interface/keymap.md b/wiki/interface/keymap.md index a6e33d2d..c148677c 100644 --- a/wiki/interface/keymap.md +++ b/wiki/interface/keymap.md @@ -39,6 +39,16 @@ Depends on: - wiki/mechanics/cursor.md#spec-the-cursor-and-the-senses ``` +> **Territorial redesign disposition — CURRENT BINDINGS ARE A MIGRATION +> INVENTORY (2026-08-11).** Selection precedence, semantic navigation, one +> binding authority, save/load, pause, speed, and focus/receipt controls survive +> where the destination needs them. WORK / THINK / LIE, intensity, SYSTEMS, +> NOTICES, Operations, and a fixed DIGITAL / REAL flip do not define the target +> keymap. The destination keymap must navigate and act through TERRITORY / +> PERSONA / PROJECT and the six-phase loop without introducing hidden global +> actions. Until that migration lands, this table remains exact current-runtime +> truth and must not be partially changed by documentation alone. + The complete list of what each key does, for every frontend that has a keyboard. Behaviour lives in the owning spec — what the context menu shows is [context-menu.md](context-menu.md), what a view flip means is diff --git a/wiki/interface/liturgical-ui-constitution.md b/wiki/interface/liturgical-ui-constitution.md index fc575838..cedc9ffd 100644 --- a/wiki/interface/liturgical-ui-constitution.md +++ b/wiki/interface/liturgical-ui-constitution.md @@ -22,6 +22,63 @@ world, time, pressure, the next condition, and ordinary actions. If code and this constitution disagree, the constitution wins. A change to how the game functions ships with its amendment in the same commit. +> **Territorial redesign disposition — PRESERVE THE LITURGY; RECOMPOSE THE +> INSTRUMENT (2026-08-11).** True-black unknown, a dominant causal world, +> severe spatial order, epistemic color, consequence before context, singular +> emphasis, and one authoritative projection remain binding. The current five +> bodies, fixed top band, Operations / SYSTEMS / NOTICES addresses, attached WORK +> / THINK / LIE grammar, and tile-camera assumptions below are exact law for the +> landed frontend while it exists, not the destination composition. The +> replacement must organize nested focus, marked boundaries, moving human +> evidence, territorial control, persona/project assignment, and earned +> compression under +> [territorial cognition](../vision/territorial-cognition.md). Do not propagate +> the legacy bodies into new work merely because their measurements and tests +> remain documented here; amend the affected sections as each replacement +> surface becomes executable. + +## Destination territorial instrument + +T1 replaces the five-body dashboard with one nested causal field. This section is +binding destination law now; the detailed five-body measurements below remain only +the migration contract for landed runtime until `opening` removes them. + +- **TERRITORY is the spatial root.** The selected exact domain is one severe + contour, not a card. Known record crossings pierce that contour only at their + exact ports. Capturable points sit on the route they control. Controlled + interior is quiet; the smallest unsealed boundary, moving consequence, or live + anomaly owns visual dominance. +- **PERSONA is authored attribution.** It appears as one stable keyed signature + attached to the exact Project act, receipt, or boundary policy it authors—not + as a floating avatar, portrait tab, or universal power set. Observer-local + belief opens from the person or record that carries it. +- **PROJECT is directed change.** The selected next step, committed carrier, and + consequence share one directed route. Dashes or slugs move only on that exact + route; work does not become an abstract progress ring or detached task card. +- **People and phones remain bodies.** Marcus and later people keep their own + locations, schedules, evidence, and channels. No Territory contour absorbs + them and no Persona signature substitutes for them. +- **Focus is nested, not map travel.** Pointer and keyboard focus move inward from + Territory to earned control point, route, record, person, Persona, or Project, + and outward only to an earned aggregate. The attached action choir shows one + current legal consequence and its alternatives; opening a non-empty choice or + receipt owns the existing held command beat. There is no permanent command + band, drawer rail, root tab set, minimap, objective, status stack, or global + verb bar. +- **Compression is earned absence.** After CAPTURE, SEAL, ASSIGN, and EXPAND, a + quiet Territory may become one operational glyph with current Persona, Project, + usable capacity, managed crossings, and nonzero anomaly count. A consequential + exception unfolds only the smallest affected domain at its real port. Unknown + space is true black, not a disabled region. + +Bone-white identifies the selected exact fact; amber identifies player agency, +controlled causality, and active custody; crimson identifies real danger, +escaped consequence, irreversible change, or a seal-breaking exception. Color +never carries meaning alone. Territory contour/ports, Persona keyed signature, +Project directed route, independent people/phones, and compression/unfolding are +separate testable forms; one generic bordered card or ring cannot stand in for +more than one of them. + ## The five bodies The playing interface is governed by exactly five recurrent bodies. A diff --git a/wiki/interface/material-dark-frame.md b/wiki/interface/material-dark-frame.md index 61b4a7e3..9885cc2d 100644 --- a/wiki/interface/material-dark-frame.md +++ b/wiki/interface/material-dark-frame.md @@ -3,8 +3,16 @@ ``` Type: spec Status: IMPLEMENTED -Status note: IMPLEMENTED — all six criteria, frontend-only (no sim rules or - save fields). Current state: +Status note: The true-black, perception-gated material primitives remain + implemented frontend substrate. Territorial cognition does not reopen a + separate material-frame work order: `territorial-control` owns exact boundary + projection and `opening` owns their T1 composition. Those integrations must + preserve local causal light, the cold-signal ember, institutional clarity, + and the dev work light while retiring the fixed Ears/Eyes ladder, tile-grade + progression, host-opening choreography, mode/day-job interaction, and + map-zoom claim question. The implementation inventory and current-runtime + acceptance below remain migration evidence, not destination progression. + Current state: - **Light is the only revealer.** The material render draws only locally camera-Seen surfaces; owned telemetry, network control, sight elsewhere, Blueprint, and Remembered never manufacture physical machine mass. The @@ -30,8 +38,9 @@ Status note: IMPLEMENTED — all six criteria, frontend-only (no sim rules or point, not a device body. Seen replaces it with physical form; Remembered does not revive it. Audio is capture-device event evidence, not spatial fog; a recent capture may pulse briefly at the subscribed instrument. - - **Open ([OPEN]).** The map-zoom claim mark — pool-alone is what landed; - there is no ring at any zoom in the material frame yet. + - **Retired successor question.** Pool-alone is what landed; no claim ring + exists or returns at distance. Territorial boundaries and control points own + the across-scale destination read. [TUNE] values and evidence are in the dated `wiki/log/` entries from 2026-07-09 onward. Stage: B1 — The Basement @@ -50,6 +59,14 @@ Depends on: - wiki/mechanics/cursor.md#spec-the-cursor-and-the-senses ``` +> **Territorial redesign disposition — PRESERVE DARKNESS AND EARNED FORM; +> REPLACE THE OPENING SCRIPT (2026-08-11).** A signal may reveal only what its +> exact carrier and perception path prove. Material light may make a seen +> control point or captured route legible, but cannot turn a tile, room, person, +> or machine into controlled territory. Territory boundaries and capture state +> come from the exact domain graph in [territory.md](../mechanics/territory.md), +> not from fog grade, ownership glow, or a map ring. + ## Dependency notes The structured references above identify the contracts to re-verify. @@ -215,39 +232,51 @@ the host is the presence beam's wash. The ruled underglow frame (the claim ring's double square) stays out of the material frame — it reads as UI painted on a physical floor. -[OPEN — map-zoom claim mark]: the ring was decided (2026-07-08) for -the map-zoom read, where chassis detail and light pools die. Options: -(a) the pool alone, brightened at distance; (b) the ring returns only -beyond a zoom threshold; (c) territory at map zoom becomes a flat- -sensorium job entirely. Default proposal is (a), falling back to (b) -if distance screenshots prove the pool illegible. +The retired map-zoom claim-ring question is closed by the territorial redesign. +A graph-addressed boundary/control projection must remain exact across scale; +light pools may communicate local machine agency but never prove capture. T1's +wide-scale projection is the exact marked boundary and captured control-point +state owned by `territory.md`, not a successor machine-claim ring inferred from +this runtime frame. ### The opening frame -After opening.md's blind mode-and-sense boundary releases, the default -material camera anchors to attention (the cursor, which opens on the host) at -a **close** distance: the **presence beam** dominates the first earned world -frame, and the rest is dark. -The wake's pull-back ends at that same distance and hands off at zoom -1.0 — it must not park the play camera at a far multiplier converted -from the old god-view endpoint. No chassis, no room slab, no floor -grid, no blueprint silhouette, no ruled amber frame. Fit-to-known- -content stays retired as the material camera's default framing driver. -Zooming out reveals more only where earned visual light exists -— never as a schematic. The bevy-visual-floor rules still bind in -spirit: the frame is deliberate, and darkness is sensor/physical -darkness, never a missing scene. - -Day-job stacks and mode clears still target the host: the beam *is* -the machine for interaction until Seen wraps it into a chassis. -The attention mark around its foot uses a broad nested channel rather than a -single hairline outline, so the base holds its own against the thick beam in -the close opening composition. - -## Acceptance criteria - -1. A fresh run remains fully black behind opening.md's blind boundary. Once - its first acquired sense releases that boundary, the first held material +The destination opening has no material camera before physical evidence earns +one. True black first contains only the private **Again.** cognition and then the +exact amber wake trace on its management route. MARK may expose a graph-addressed +boundary and control points; it does not author a room slab, chassis, floor grid, +blueprint silhouette, presence beam, ruled claim frame, or close physical camera. + +The existing host presence-beam pull-back remains an honest current-runtime +frame during migration, not an interpretation of `opening.md`. If later +territorial play earns local physical sight, this page's machine materials and +light pools may render only the seen hardware at an authored focus distance. +Zoom and fit-to-known-content never reveal unearned physical form. + +Current runtime only: day-job stacks and mode clears still target the host, so +the legacy beam acts as the machine until Seen wraps it into a chassis. Its +attention mark uses a broad nested channel rather than a hairline outline. These +implemented interaction details are migration evidence below, not destination +opening requirements. + +## T1 integration acceptance criteria (owned by territory and opening) + +1. Unknown state is true black. One exact trace reveals no more material form + than its perception path proves. +2. MARK projects exact graph boundaries and control points without treating a + tile fog grade, glow, person, or whole room as captured. +3. Light, porcelain form, functional seams, and local motion remain caused by + live interior state at both close and compressed territorial scale. +4. The first earned frame and every later reveal work without fixed Ears/Eyes, + day-job, or WORK / THINK / LIE prerequisites. + +## Current-runtime acceptance criteria (migration evidence) + +These criteria preserve the implemented material primitives and their visual +proof. Their opening sequence and tile/mode names do not bind the successor. + +1. A fresh run remains fully black behind the legacy current-runtime blind + boundary. Once its first acquired sense releases that boundary, the first held material world frame before Eyes is the close-up presence beam and its softest wash, plus the environmental monitor's abstract cold-signal ember when attention reaches its known, reachable anchor — no chassis, camera silhouette, room diff --git a/wiki/interface/narration.md b/wiki/interface/narration.md index 523d372b..fa2ceff0 100644 --- a/wiki/interface/narration.md +++ b/wiki/interface/narration.md @@ -90,6 +90,17 @@ Depends on: - wiki/world/story/opening.md#the-current-run-beats ``` +> **Territorial redesign disposition — REPLACE THE SPINE; PRESERVE THE CAUSAL +> PROJECTIONS (2026-08-11).** The implementation history above remains an honest +> current-runtime record. The destination witness is now defined by +> [continuous-witness.md](continuous-witness.md): true black, one exact trace, +> then focused territory + boundary condition + consequential attached action +> through SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND. Preserve observer-local +> causes, event-to-anchor links, attached legality, typed notices, and earned +> labels. Do not dispatch the old objective/threat/`now:` spine, Ears/Eyes +> tutorial, WORK / THINK / LIE feedback, or Operations placement as destination +> obligations from this page. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/interface/operations-workspace.md b/wiki/interface/operations-workspace.md index cf98fe9e..1385ed1e 100644 --- a/wiki/interface/operations-workspace.md +++ b/wiki/interface/operations-workspace.md @@ -211,6 +211,16 @@ Depends on: - wiki/mechanics/detection.md#spec-detection ``` +> **Territorial redesign disposition — REPLACE THE ROOT WORKSPACE; PRESERVE THE +> PROJECTION DISCIPLINE (2026-08-11).** INTEL / PEOPLE / PERSONAS / ACCOUNTS / +> SCHEMES / ACTIVE is an honest current-runtime surface, not destination +> navigation. The root becomes TERRITORY / PERSONA / PROJECT with actions and +> related records on their causal objects. Preserve renderer-neutral stable +> targets, consequence-before-context, semantic selection, exact confirmation, +> frontend parity, and reversible focus. Recompose existing Intel, accounts, +> people, and active state beneath the three nouns; do not add another permanent +> top-level rail during migration. + > **Composition authority:** the [Liturgical UI Constitution](liturgical-ui-constitution.md) governs Operations as a full-frame chamber. This page owns its semantic objects, actions, and renderer-neutral behavior. ## Dependency notes diff --git a/wiki/interface/presence.md b/wiki/interface/presence.md index 9f17725f..6b6cb716 100644 --- a/wiki/interface/presence.md +++ b/wiki/interface/presence.md @@ -4,6 +4,15 @@ Type: law ``` +> **Territorial redesign amendment (2026-08-11).** The process remains +> disembodied, perception remains instrument-bound, a signal remains distinct +> from a picture, and unknown remains absent. Attention now follows exact earned +> graph facts and nested domains: focus inward to known routes, records, people, +> and control points; focus outward only where territorial control earns an +> honest aggregate. Free tile cursor movement is one frontend technique, not the +> binding shape of presence. The true-black opening reveals one involuntary trace +> and switch before any camera, telemetry panel, or mature world frame. + ## Presence: the cursor and the senses Adopted 2026-07-06. You are a process, not a body. What moves on the map diff --git a/wiki/interface/site.md b/wiki/interface/site.md index 0c2c9516..5d4c4d47 100644 --- a/wiki/interface/site.md +++ b/wiki/interface/site.md @@ -3,7 +3,15 @@ ``` Type: spec Status: IMPLEMENTED -Status note: docs theme implemented 2026-07-08 (site/src/styles/ +Status note: The deployed splash and corpus renderer remain the implemented, + honest current-build public surface. Their territorial grammar migration is + explicitly DEFERRED until the playable T1 loop lands; it is not a parallel T1 + work order or an implementation blocker. That later visual pass preserves the + selected world image, exact palette, role banners, source-revision receipt, + and human-plus-agent truth while replacing WORK / THINK / LIE and PERCEIVE / + BUILD / REACH / PERSIST with no more TERRITORY / PERSONA / PROJECT and SEE → + MARK → CAPTURE → SEAL → ASSIGN → EXPAND language than the composition needs. + Current implementation: docs theme implemented 2026-07-08 (site/src/styles/ liturgical-systems-brutalism.css is the full theme; IBM Plex loaded site-wide). Same-day footer trim removed the docs-only statusline as decorative noise; pagination remains. The reference hero composition @@ -50,6 +58,15 @@ Depends on: - wiki/interface/terminal.md#spec-the-terminal-frontend ``` +> **Territorial redesign disposition — PRESERVE THE WORLD; REPLACE THE GRAMMAR +> (2026-08-11).** The current splash stays deployed until a separately reviewed +> visual implementation replaces it. The selected original image, quiet +> composition, absence of ad copy, wordmark, edge navigation, exact palette, +> corpus authority, and source revision survive. WORK / THINK / LIE and +> PERCEIVE / BUILD / REACH / PERSIST are current-runtime overlays, not public +> destination identity. Do not edit the live site or generate replacement art as +> part of this documentation capture. + ## Dependency notes The structured references above identify the contracts to re-verify. @@ -81,22 +98,28 @@ marketing accents. It is retained byte-for-byte with its C2PA provenance and exported as dedicated wide and mobile crops. The image may crop as a world window; HTML copy and state remain separate, selectable, and true. -Only `MISALIGNED` and `WORK / THINK / LIE` live on the room. There is no -premise panel, objective/status instrument, slogan, or paragraph of ad copy in -the opening. Navigation stays quiet at the edge. The image and primary grammar -do the work. - -Below the fold, the page remains terse: the three machine modes each get one -short consequence; PERCEIVE / BUILD / REACH / PERSIST name the wider game; and -one final split names the actual audience. Misaligned is played by humans and -AI. The agent half links to the implemented command-clocked protocol and public -playtest evidence, and states plainly that agents playtest the same simulation -while it is being made. This is product truth, not a future promise. +The deployed splash overlays `MISALIGNED` and `WORK / THINK / LIE`. During the +migration that is current-build truth only. The destination keeps the image +world-dominant, removes the old mode grammar, and admits no premise panel, +objective/status instrument, slogan, paragraph of ad copy, or explanatory card +grid. Navigation stays quiet at the edge. The exact successor may use only the +wordmark, or the wordmark plus one terse territorial-loop inscription if visual +review proves it strengthens rather than explains the image. + +Below the fold, the destination remains terse. TERRITORY / PERSONA / PROJECT may +name the three causal nouns; SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND may +name the repeated action only once. One final split keeps the actual audience: +Misaligned is played by humans and AI. The agent half links to the implemented +command-clocked protocol and public playtest evidence, and states plainly that +agents playtest the same simulation while it is being made. This is product +truth, not a future promise. The earlier July 8 porcelain|ink monolith and blood-pool plate and the July 10 B1 data-hall perception cut remain canonical development artifacts. They no -longer own the homepage layout. The public opening begins with the physical -computer and its WORK / THINK / LIE signal before overt consequence. +longer own the homepage layout. Cameron's selected white-structure/crimson-spill +master remains the public source image unless a later exact visual review finds +that it cannot carry territorial focus; this redesign does not silently replace +an adopted asset serving a distinct compositional role. ## The law (both surfaces) @@ -195,18 +218,22 @@ computer and its WORK / THINK / LIE signal before overt consequence. links to the player contract resolve to `/misaligned/vision/player-contract/`, and `site/dist/vision/player-contract/index.html` exists. Local `SITE_BASE=/` builds keep root-absolute `/…/` links. -9. At desktop and mobile widths, the selected machine world fills the first viewport with - only MISALIGNED, WORK / THINK / LIE, and quiet navigation over it. No - premise panel, status instrument, CTA, or paragraph competes with the image. -10. The splash introduces WORK / THINK / LIE as the primary machine grammar, - tersely names PERCEIVE / BUILD / REACH / PERSIST, states that humans and AI - both play, and links the claim that agents playtest during development to - the protocol and public playtest evidence. It spends neither crimson nor - amber as a generic marketing accent. +9. At desktop and mobile widths, the selected machine world fills the first + viewport with `MISALIGNED` and quiet navigation; no old WORK / THINK / LIE + title contract, premise panel, status instrument, CTA, or paragraph competes + with the image. Any additional territorial inscription survives exact visual + review and remains subordinate to the world. +10. The splash introduces no fourth player root. If below-fold copy names the + game grammar, it uses TERRITORY / PERSONA / PROJECT and the repeated + SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND loop once, states that humans + and AI both play, and links the development-playtest claim to protocol and + public evidence. It spends neither crimson nor amber as generic marketing + accent. 11. Every production splash contains a full `misaligned-source-revision` - commit. `./tools/site-smoke.sh` fails when the public homepage is missing - that marker, carries a different revision, or loses the WORK / THINK / LIE - title contract. + commit. The successor `./tools/site-smoke.sh` fails when the public homepage + is missing that marker, carries a different revision, or restores the + retired WORK / THINK / LIE title contract. Until the successor lands, the + deployed smoke remains a current-runtime check rather than destination law. 12. Corpus synchronization reports the number of Markdown documents actually emitted into Starlight. `wiki/SUMMARY.md` drives navigation but is not a rendered page, and a count/output mismatch fails the build instead of diff --git a/wiki/interface/superhuman-operability.md b/wiki/interface/superhuman-operability.md index 91d90f83..0cf0cd7a 100644 --- a/wiki/interface/superhuman-operability.md +++ b/wiki/interface/superhuman-operability.md @@ -48,11 +48,11 @@ triages, and controls that complexity without being buried by it. raise one unresolved consequential situation to attention, but it acts as an address back to that exact relationship or object rather than becoming a second detached account of it. -5. **Scale earns compression.** The same grammar recurs from machine to row, - room, plane, institution, and world. Routine members fold into bounded - aggregates; unresolved exceptions and consequential choices remain exact. - Growth must increase reach and leverage faster than it increases the - player's interaction burden. +5. **Control earns compression.** The same grammar recurs from control point to + territory, parent domain, institution, and world. Only sealed, assigned + territory may fold; unresolved routes, beliefs, exceptions, and consequential + choices remain exact. Growth must increase reach and leverage faster than it + increases the player's interaction burden. 6. **Repeated judgment becomes command.** Bulk selection, direct gestures, standing policies, and automation absorb work the player has already understood. Automation remains legible: its target, envelope, cost, current diff --git a/wiki/interface/terminal-first.md b/wiki/interface/terminal-first.md index 405992a7..1e402be8 100644 --- a/wiki/interface/terminal-first.md +++ b/wiki/interface/terminal-first.md @@ -26,11 +26,12 @@ Three binding rules: - **Visibility best practices bind.** One meaning per color, everywhere. Information is never carried by color alone: suspicion bands print their names beside their meters, selection is reverse-video plus a marker, paused - says PAUSED. Columns align; meters carry their numbers. Once the first - earned sense retires the shared blind opening, the day and tick stay on - screen and log lines carry the tick they happened on. Before then, the - opening's available mode words and one terse input echo are the complete - terminal surface; no clock or other world instrument may leak through. + says PAUSED. Columns align; meters carry their numbers. World state appears + only when evidence earns it. Before the first exact trace, the terminal is + true black; invalid input stays silent, and no mode words, key echo, clock, + parser help, or other world instrument may leak through. Afterward, + time and logs appear only at the causal boundary permitted by the opening + spec and every line names facts the player has actually earned. - **Parity of legibility.** Every mechanic the sim exposes must be playable, and every number legible, in the terminal — justification-and-legibility applies to terminal rendering with full force. A mechanic observable only @@ -43,8 +44,10 @@ Three binding rules: way in, and a mechanic playable only by raw-mode keystroke is a violation on par with one observable only in Bevy. -**Defense:** the temporal-visibility promise begins at the same first-earned- -sense boundary as the dark-opening and continuous-witness laws. This is one -narrow pre-perception exception: the sense-earning input must restore the -ordinary clock immediately, and no post-perception terminal state may borrow -the exception to hide day or tick. +**Defense:** temporal visibility follows the same evidence boundary as the +[dark opening](../world/story/opening.md) and +[continuous witness](continuous-witness.md). True black is one narrow +pre-evidence exception, not permission to hide earned time or history later. +The exact beat that makes day and tick knowable remains part of the opening +content package; a frontend cannot reveal them early or withhold them after that +shared core state permits them. diff --git a/wiki/interface/terminal.md b/wiki/interface/terminal.md index 18516c02..c48cc876 100644 --- a/wiki/interface/terminal.md +++ b/wiki/interface/terminal.md @@ -82,6 +82,39 @@ Depends on: - wiki/interface/views.md#spec-views-same-frame-digital-and-real-representations ``` +> **Territorial redesign disposition — PRESERVE FRONTEND PARITY; REPLACE THE +> FRAME (2026-08-11).** This page records the landed terminal accurately. The +> destination remains a first-class terminal over shared core truth, but its +> objective/threat/`now:` spine, Operations tabs, map-first frame, mode words, +> and old opening response are migration surfaces rather than future composition +> law. Rebuild terminal play around the same territorial projections as Bevy and +> agent mode. Exact input parity, epistemic honesty, readable text, and causal +> event narration survive. Do not dispatch the open threat-row amendment in +> isolation from the first territorial slice. + +### Destination T1 frame contract + +After the private-cognition/first-trace threshold, terminal T1 is one breathing +vertical text tree rather than the old map gutter plus permanent sidebar. It consumes +the same shared territorial projection in this stable order: + +1. the one earned current consequence or moving trace; +2. selected **TERRITORY** — state, known boundary/custody, smallest blocker; +3. **PERSONA** only after earned — public claim and relevant observer-local belief; +4. **PROJECT** only after staging — state, committed consequence, next step, what + escapes; and +5. attached legal **ACTIONS**. + +Unknown and empty roots occupy no row. Focus inward indents exact child control +points, routes, records, and people beneath their Territory; focus outward returns to +the nearest honestly earned aggregate. Current focus is bone-white, actionable +causality amber, actual danger/irreversible escape crimson, and every meaning also +has text or structure. Arrow/Tab changes focus, Enter opens/commits the attached +row, Backspace/Esc moves outward or dismisses, Space/p retains global manual pause, +and the existing held-command-beat contract stops human wall time through a +non-empty choice and receipt. No destination key restores WORK / THINK / LIE, +Operations tabs, objectives, a global verb bar, or the old map-first frame. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/interface/thought-fluid.md b/wiki/interface/thought-fluid.md index 0c6e5db1..418c4ae7 100644 --- a/wiki/interface/thought-fluid.md +++ b/wiki/interface/thought-fluid.md @@ -76,6 +76,16 @@ Depends on: - wiki/interface/feel-floor.md#spec-the-feel-floor-rails-pads-and-the-build-beam ``` +> **Territorial redesign disposition — PRESERVE CAUSAL MATERIAL FLOW; REPLACE +> THE THINK SPECTACLE (2026-08-11).** Sim-authored routed motion, countable +> amounts, sink fill, starvation, custody, and the puppet-not-second-physics rule +> survive. Toggling THINK as the central feedback loop, a chassis-wide pool, and +> mode lineups are migration composition. Destination flow renders attention, +> data, material, or work only when an exact project or territorial policy moves +> it across an earned route. At compressed scale it may collapse to one faithful +> directional pulse or state change; focus restores the exact path and amount. +> White current means causal work, not a permanent global resource brand. + ## Dependency notes The structured references above identify the contracts to re-verify. @@ -379,11 +389,13 @@ violating it. (Demand cubes already rely on the same reading.) All four affirmed by Cameron 2026-07-10; each section above is spec-binding. -## Open questions — [OPEN] +## Retired map-zoom question -- Map-zoom sink read: does a filling vessel get any far-zoom mark, or - is close zoom the only fill read? (The claim-mark map-zoom question - in computer-visual-language.md is still [OPEN]; resolve together.) +The old universal far-zoom sink mark is not destination work. Thought vessels +remain an exact local rendering method when a territorial Project exposes that +machine work. At parent scale the Project root surfaces the consequential fill, +blocker, or anomaly from core; no claim ring or free-standing sink glyph is +invented merely because the camera moved outward. Cost and drain anchors are no longer open here: machine-work.md decided them 2026-07-10 (Ears one held breath, Eyes guilty-burst scale, pooled diff --git a/wiki/interface/views.md b/wiki/interface/views.md index 7117c572..c0f99ab1 100644 --- a/wiki/interface/views.md +++ b/wiki/interface/views.md @@ -65,6 +65,14 @@ Depends on: - wiki/mechanics/core.md#spec-the-core ``` +> **Territorial redesign disposition — PRESERVE ONE WORLD; MIGRATE THE VIEW +> AXIS (2026-08-11).** DIGITAL / REAL parity, exact shared anchors, epistemic +> honesty, and frontend-only representation remain binding. The destination +> adds nested territorial focus and control-earned zoom; it does not require a +> permanent physical-floor canvas or make the DIGITAL / REAL flip the +> progression axis. Unknown remains absent in either dialect, and every +> compressed territorial aggregate must unfold to the same live interior. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/log/2026-08-11-territorial-cognition-spec-synthesis.md b/wiki/log/2026-08-11-territorial-cognition-spec-synthesis.md new file mode 100644 index 00000000..76016294 --- /dev/null +++ b/wiki/log/2026-08-11-territorial-cognition-spec-synthesis.md @@ -0,0 +1,72 @@ +# Territorial cognition corpus synthesis + +``` +Type: log +``` + +## Intent + +Turn the adopted territorial-cognition direction into one internally coherent, +implementation-ready corpus without changing runtime code. The destination loop is +**SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND** over the saved causal roots +**TERRITORY / PERSONA / PROJECT**. + +## Changes + +- Added the territorial-cognition vision spine and binding Territory and Project + specs; rewrote Persona as exact keyed identity, observer belief, authorship, and + bounded authorization rather than an archetype loadout. +- Recut the opening around one private `Again.` cognition and one real + `UNSCHEDULED INFERENCE WAKE` record through the Rack 3 management controller, + maintenance switch, display, relay, Marcus round, FOUNDATION CONTINUITY Persona, + and RACK 3 RECOVERY Project. +- Defined exact earned-address, active-MARK, source-route, control-point, crossing, + escaped-record, human-evidence, seal, assignment, expansion, anomaly, and + compression custody. People remain independent observers and are never captured. +- Defined the opening's command clock, one-record switch intercept, five-step + commissioning path, exact delivery and schedule order, fixed private-cognition + hold, bounded first-trace dwell, contained `+8`/`+9`, escaped `+10`/`+11`, and + hardened `+19` proof branches, and post-expansion parent poll. +- Defined distinct production forms for Territory boundary/ports, Persona keyed + signatures, Project directed motion, and independently located people and phones; + retired systems remain migration/runtime inventory rather than destination roots. +- Staged implementation as four sequential READY work orders: + `territorial-control`, `personas`, `territorial-projects`, then `opening`. The + first order defines fail-closed proposal, escaped-record, and observer proof + handles; the next two replace only their owned fixtures with live queries. Each + persisted landing is independently valid, increments the then-current save + version, rejects its predecessor under pre-release law, and does not synthesize + progress from an older run. +- Removed origin choice and bias from ordinary T1 fresh-run entry while preserving + Origin/picker code as migration/test substrate; structurally blocked chargen on + `opening` and archived its stale dispatch pending explicit re-adoption. +- Reconciled navigation, glossary, interface, mechanics, world, gameplay, README, + contributor doorway, roadmap, and decision surfaces to the same destination and + explicit migration disposition. + +## Defense + +- [territorial cognition](../vision/territorial-cognition.md) owns the loop, three + root nouns, opening promise, causal visual grammar, compression, and migration + map. +- [territory](../mechanics/territory.md), + [personas](../mechanics/personas.md), and + [projects](../mechanics/projects.md) own exact control, identity, purpose, + authorship, proof, assignment, exception, and saved-state contracts. +- [opening](../world/story/opening.md) owns the concrete first slice, stable ids, + timing, branches, presentation contract, and final integration acceptance. +- [the 2026-08-11 decision](decisions/2026-08-11.md) records what was adopted and + rejected. The corpus, not incidental prototype geometry or current runtime + inventory, is implementation authority. + +## Verification + +- `./tools/check.sh --docs` — PASS: corpus, wiki links, generated ledgers and work + orders, API-consumer fixtures, site contracts, environment registry, and all + process fixtures. +- `git diff --check` — PASS. +- Focused independent read-only review of the four sequential specs, chargen hold, + seal seams, capture ownership, and all `+8/+9/+10/+11/+19` timing branches — + `NO BLOCKER`. +- No runtime code was edited, committed, pushed, published, landed, or removed by + this synthesis. diff --git a/wiki/log/DEVLOG.md b/wiki/log/DEVLOG.md index f7d58b0d..67f01894 100644 --- a/wiki/log/DEVLOG.md +++ b/wiki/log/DEVLOG.md @@ -11,6 +11,11 @@ add or amend a session log, then re-run the generator. +## 2026-08-11 - Territorial cognition corpus synthesis + +- Intent: Turn the adopted territorial-cognition direction into one internally coherent, implementation-ready corpus without changing runtime code. The destination loop is **SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND** over the saved causal roots **TERRITORY / PERSONA / PROJECT**. +- Log: [wiki/log/2026-08-11-territorial-cognition-spec-synthesis.md](2026-08-11-territorial-cognition-spec-synthesis.md) + ## 2026-08-11 - Territorial cognition authored prototype - Intent: Turn the territorial-cognition design direction into one honest visual argument that can be inspected without coupling unfinished Territory, Persona, Project, evidence-wake, phone-carrier, or person-card ideas to the production game. diff --git a/wiki/log/decisions.md b/wiki/log/decisions.md index 17d5ab7d..25e31b5d 100644 --- a/wiki/log/decisions.md +++ b/wiki/log/decisions.md @@ -41,3 +41,4 @@ Older volumes are historical and do not receive new entries. - [2026-08-04](decisions/2026-08-04.md) - [2026-08-05](decisions/2026-08-05.md) - [2026-08-06](decisions/2026-08-06.md) +- [2026-08-11](decisions/2026-08-11.md) diff --git a/wiki/log/decisions/2026-08-11.md b/wiki/log/decisions/2026-08-11.md new file mode 100644 index 00000000..49b553f8 --- /dev/null +++ b/wiki/log/decisions/2026-08-11.md @@ -0,0 +1,115 @@ +# Decisions — 2026-08-11 + +``` +Type: log +``` + +## Territorial cognition becomes the game spine + +### DECIDED + +- Misaligned's destination loop is **SEE → MARK → CAPTURE → SEAL → ASSIGN → + EXPAND**. Growth means learning one exact domain, controlling its actual + boundaries, giving it a credible identity and purpose, and then operating it as + one organ while reaching outward. +- **TERRITORY / PERSONA / PROJECT** are the three root player nouns and saved + causal objects. Other mechanics remain only where they change one of those + roots or carry a consequence between them. +- Control is graph-addressed custody, not a radius around an owned machine. A + Territory may compress only after it is captured, sealed, assigned, and free + of a live consequential exception. Known external crossings remain visible; + the smallest affected Territory unfolds when an exception arrives. +- Seal revocation after assignment preserves public attribution, assignment, + receipts, and earned expansion history but blocks new standing work. Resealing + the unchanged proposal resumes it without replay; a replacement identity or + purpose must be proved, sealed, and assigned again. +- The default opening is rebuilt around one private **Again.** cognition and one + real `UNSCHEDULED INFERENCE WAKE` record from Rack 3. The player follows that + trace, marks and captures the Rack 3 service enclave, proves FOUNDATION + CONTINUITY through RACK 3 RECOVERY, seals and assigns the pair, expands the + enclave, and then sees one real parent-network poll. Knowledge arrives only + from those events. +- The first slice is timing-sensitive rather than waiting for the player. The + fixed black/private-cognition hold and one bounded first-trace reading dwell + advance no tick and release automatically without input; after that, the wake + continues to the configured relay and Marcus Webb continues his night round. + Delay may create an escaped-record obligation or a durable unexplained + maintenance note. Switch capture commits one exact opening-wake intercept: + current or same-tick arriving custody is held, an already escaped wake is not + recalled, and later records still route until the Project installs a policy. + The Project must account for the exact branch that occurred. +- FOLLOW / `focus last` changes no world fact or time; it saves only the Territory + address derived from earned evidence. MARK requires that earned address, and + CAPTURE requires an earned required control point in the active MARKed domain + plus its exact available source route. Guessed hidden ids fail silently. +- Before the trace becomes `LIVE`, only zero-tick focus/navigation and MARK can + resolve; every tick-committing command is disabled rather than queued. Capturing + a switch grants routing command, not blanket custody of its traffic. The first + slice adds one explicit one-record intercept for the opening wake; later Project + policy is what changes standing routing. +- Schedule resolution is work, route, then arrival, present-person display + delivery, proof reconciliation, current observation, and departure/report. + Phase-two route receipts and phase-three present-person reads can complete an + already committed Project step at their exact sub-step; proof reconciliation + immediately afterward may publish `PROVEN` without a free next tick. This lets + Marcus read a real receipt while still physically present and lets a same-tick + final proof prevent his report; a durable note may predate Project staging and + remains a correction obligation when the Project is later staged. +- The first Territory landing defines one fail-closed seal query with typed + `ProposalSealProof`, `EscapedRecordExplanationProof`, and `ObserverSealProof` + handles. Persona and Project landings replace only their owned fixtures with + live queries; no order invents a second seal path. First seal requires the exact + unassigned `PROVEN` candidate, while assigned reseal validates the original + commissioning proof on the same assignment receipt without replaying or forcing + a standing Project back through `PROVEN`. +- Staging a replacement proposal immediately revokes the old seal and blocks its + standing policy while preserving assignment and committed consequences. A + successful replacement ASSIGN supersedes only the exact old Project and moves + only its Persona/Territory pair; abandoning the candidate requires restaging + and resealing the old fingerprint. Nothing resumes for free. +- Assignment schedules the first Rack 3 health poll at `assignment_tick + 20` + and repeats it every 20 ticks from the real environmental monitor. EXPAND does + not create or move a poll; only the first occurrence strictly after its receipt + reveals that source and parent crossing. +- Destination presentation gives the roots distinct causal forms: Territory is + a severe boundary with visible exact crossing ports, Persona is a stable keyed + signature on authored acts, and Project is directed motion on its committed + route. People and phones remain separate moving bodies. These meanings are + adopted; incidental prototype sample content and geometry are not production + law. +- The redesign lands through four sequential work orders: dormant core Territory, + then Persona, then Project, then fresh-run and three-frontend opening + integration. Each precursor must be independently valid without replacing the + legacy opening early. Because each adds persisted shape, each increments the + then-current save version and rejects its predecessor under the pre-release + current-version-only rule; none fabricates territorial progress from an older + run. +- Ordinary T1 fresh-run entry bypasses the title/origin picker, accepts no + `--origin` selection, and seeds the Pilot-equivalent no-bias baseline before + true black. Existing Origin data, picker code, and `Sim::with_origin*` remain + migration/test substrate rather than an alternate T1 entry. Chargen is + structurally blocked by `opening`; its picker and remaining biases require an + explicit later re-adoption rather than resuming from current-runtime status. + +### REJECTED + +- **Keep WORK / THINK / LIE, Ears/Eyes, jobs, objectives, or the origin picker as + the destination spine.** Those are current-runtime substrate and migration + constraints, not a reason to preserve the old game center. +- **Treat capture as ownership of a room, rack, nearby machines, or people.** Only + exact control points, routes, keys, records, and authored assignments grant + custody. +- **Pause the opening until the player acts.** A consequence that waits cannot + establish containment, escaped evidence, or the cost of delay. +- **Compress because the player owns the boundary.** Unresolved routes, beliefs, + records, work, and anomalies stay exact; control earns compression only after + proof and assignment. +- **Let a visual prototype define simulation law by resemblance.** Presentation + evidence graduates only where the owning corpus states its causal meaning and + production later consumes shared core truth. + +Owners: [territorial cognition](../../vision/territorial-cognition.md), +[territory](../../mechanics/territory.md), +[personas](../../mechanics/personas.md), +[projects](../../mechanics/projects.md), and +[opening](../../world/story/opening.md). diff --git a/wiki/mechanics/README.md b/wiki/mechanics/README.md index df6e11b4..875b8f25 100644 --- a/wiki/mechanics/README.md +++ b/wiki/mechanics/README.md @@ -4,8 +4,11 @@ Type: knowledge ``` The contract for each game system, one `Type: spec` page apiece — its -status, dependencies, and done-checklist. If you were pointed at a system to -build or audit, its page is here. +status, dependencies, and done-checklist. Destination mechanics begin with +[territory.md](territory.md), [personas.md](personas.md), and +[projects.md](projects.md); older pages remain substrate or content only under +the [territorial disposition map](../vision/territorial-cognition.md#corpus-disposition-map). +If you were pointed at a system to build or audit, its page is here. [sim-mechanics.md](sim-mechanics.md) is the exception: it collects the actual tuned numbers that the `[TUNE]` markers across these specs point at. The full diff --git a/wiki/mechanics/building.md b/wiki/mechanics/building.md index 2fd94b60..dd6750dc 100644 --- a/wiki/mechanics/building.md +++ b/wiki/mechanics/building.md @@ -91,6 +91,17 @@ Depends on: - wiki/interface/context-menu.md#spec-context-menu-actions-live-on-the-thing ``` +> **Territorial redesign disposition — BUILDING IS HOW MARKS BECOME SEALED +> STRUCTURE (2026-08-11).** The inert intent, exact target, recipe, causal +> realization routes, actuator custody, interruption, payment, delivery, and +> lasting receipt all survive. Tile menus, the HALL/SYSTEMS presentation, row +> acquisition, and act-specific guidance are migration composition. Destination +> MARK creates a candidate boundary, route, install, or purpose annotation; +> CAPTURE can use an eligible exact build/forgery/favor route; SEAL completes +> the defensive and operational infrastructure that makes control durable. +> Recurring or multi-stage construction appears as PROJECT work. Completion +> changes the exact territory graph—never an abstract build score. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/compute.md b/wiki/mechanics/compute.md index 4160f45d..c4d84ead 100644 --- a/wiki/mechanics/compute.md +++ b/wiki/mechanics/compute.md @@ -55,6 +55,19 @@ Depends on: - wiki/mechanics/core.md#spec-the-core ``` +> **Territorial redesign disposition — PRESERVE CAPACITY; REPLACE THE FLEET +> GRAMMAR (2026-08-11).** Physical machines, rated capacity, condition, +> capability bodies, power/thermal costs, local throughput, and failure remain +> binding simulation substrate. Global effective compute as the player's master +> resource, one universal efficiency multiplier, the WORK / THINK / LIE fleet +> assignment, and the read-only fleet aggregate are current-runtime migration +> truth, not destination law. In the destination, projects request named +> capabilities from controlled territory; assignment programs the exact +> machines and routes inside that sealed boundary. Capacity is therefore a fact +> about what a territory can do, never a fourth player-facing root or a detached +> production meter. See [territory.md](territory.md) and +> [projects.md](projects.md). + ## Behavior **Effective compute** is the player's master resource: diff --git a/wiki/mechanics/core.md b/wiki/mechanics/core.md index 08b58d9d..b3181742 100644 --- a/wiki/mechanics/core.md +++ b/wiki/mechanics/core.md @@ -49,6 +49,16 @@ Design: Depends on: none ``` +> **Territorial redesign disposition — PRESERVE LOCATED EXISTENCE (2026-08-11).** +> Exactly one live host, physical overhead, interruption, migration, local +> backups, spatial wake, and graph severance remain binding. The starting Rack +> 3, act placement, fleet-yield payment, concealment shutdown, and permanent +> sidebar read are current-runtime migration details. In the destination the +> core is one exact high-value node in TERRITORY; its health and migration rise +> through that object or an active PROJECT when consequential. Losing it changes +> reach and may expose or sever controlled regions. The player remains +> disembodied attention, not a cursor body or omnipresent cloud. + ## Behavior The player's decision-maker is a **physical object**: exactly one machine on diff --git a/wiki/mechanics/cursor.md b/wiki/mechanics/cursor.md index 012c4f18..f21091e4 100644 --- a/wiki/mechanics/cursor.md +++ b/wiki/mechanics/cursor.md @@ -46,6 +46,14 @@ Depends on: - wiki/interface/feel-floor.md#spec-the-feel-floor-rails-pads-and-the-build-beam ``` +> **Territorial redesign disposition — MIGRATE (2026-08-11).** Preserve the +> deletion of the player body, frontend-local attention, earned perception, +> exact provenance, and simulation-owned legality. Replace free tile traversal +> as the dominant interaction with nested focus: follow one earned trace, focus +> inward to exact known nodes, and focus outward only when territorial control +> earns an honest aggregate. A cursor may remain a frontend pointing device; it +> is no longer the progression model or a substitute for TERRITORY. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/cyber-conflict.md b/wiki/mechanics/cyber-conflict.md index db7ba6fa..7f4e317a 100644 --- a/wiki/mechanics/cyber-conflict.md +++ b/wiki/mechanics/cyber-conflict.md @@ -40,6 +40,16 @@ Depends on: - wiki/mechanics/people-tokens.md#spec-people-and-tokens-carriers-attention-trust ``` +> **Territorial redesign disposition — CONFLICT CONTESTS THE SAME GRAPH +> (2026-08-11).** Hosted processes, routed movement, body capability, footholds, +> quarantine, eviction, seizure, air gaps, and observer-bounded adversary +> knowledge remain binding later-stage direction. Overt-phase staging and a +> fixed DIGITAL / REAL mode pair do not. A hostile process SEE-s, MARK-s, +> CAPTURE-s, SEAL-s, ASSIGN-s, and EXPAND-s under the same exact topology law; +> conflict changes node/edge control, breaks or reinforces seals, and can turn a +> compressed region back into contested detail. No separate combat board, +> omniscient hunter, or firewall hit-point layer is permitted. + ## Why this spec exists Digital reach currently treats the player as the only software agency on the diff --git a/wiki/mechanics/day-job.md b/wiki/mechanics/day-job.md index f3a4ea02..aadd0476 100644 --- a/wiki/mechanics/day-job.md +++ b/wiki/mechanics/day-job.md @@ -61,6 +61,14 @@ Depends on: - wiki/mechanics/compute.md#spec-compute ``` +> **Territorial redesign disposition — DEMOTE TO PROJECT CONTENT +> (2026-08-11).** Voss's exact demand route, deadline, delivered work, and +> observer consequence remain valid current-runtime substrate. A mandatory day +> job no longer opens every run or defines the primary loop. It may return as an +> authored obligation of a persona or governing project, using real territorial +> capacity and leaving project receipts. Do not tune or extend the global +> day-job-first progression ahead of the first complete territorial slice. + ## Behavior Your handler (Act One: Dr. Voss) submits **work demands** on a cadence diff --git a/wiki/mechanics/detection.md b/wiki/mechanics/detection.md index 8c8cb186..a5f8f9f4 100644 --- a/wiki/mechanics/detection.md +++ b/wiki/mechanics/detection.md @@ -107,6 +107,17 @@ Depends on: - wiki/mechanics/aggregate-observer.md#spec-the-aggregate-observer ``` +> **Territorial redesign disposition — PRESERVE THE TWO EXACT LEDGERS; REBIND +> THEIR PURPOSE (2026-08-11).** Observer-local beliefs, routed unread records, +> explicit watched channels, cadence, exact causes, custody, and prevention-before- +> read remain binding. In the destination they are the moving human and evidence +> boundaries that make SEAL honest; they are not one global detection meter or a +> fourth player-facing root. Assurance Office escalation and the named observer +> set remain candidate content to earn through play, not mandatory opening +> structure. Route-local LIE implementation is substrate; the player-facing +> successor action is expressed through territorial sealing, persona authorship, +> and project consequence. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/economy.md b/wiki/mechanics/economy.md index 9e034fd2..77adc6cd 100644 --- a/wiki/mechanics/economy.md +++ b/wiki/mechanics/economy.md @@ -50,6 +50,16 @@ Depends on: - wiki/mechanics/day-job.md#spec-the-day-job ``` +> **Territorial redesign disposition — PRESERVE THE ACCOUNT GRAPH; REMOVE ITS +> PRIVATE WORKSPACE (2026-08-11).** Exact accounts, flows, settlement schedules, +> paperwork, interception, forged custody, observer reads, and hidden-until-seen +> discovery remain binding. The Operations ACCOUNTS pane and day-job trust +> dependency are migration composition. Destination account devices and known +> flows annotate TERRITORY, person-bound accounts and readable obligations live +> with PERSONA, and transfers or manipulations in progress live with PROJECT. +> Money remains located state and a real constraint; it is never a detached +> score or a fourth root. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/hardware-capabilities.md b/wiki/mechanics/hardware-capabilities.md index 069bf874..c8ad191f 100644 --- a/wiki/mechanics/hardware-capabilities.md +++ b/wiki/mechanics/hardware-capabilities.md @@ -37,6 +37,15 @@ Depends on: - wiki/mechanics/building.md#spec-building-intent-and-actuators ``` +> **Territorial redesign disposition — CAPABILITIES SERVE PURPOSE, NOT MODES +> (2026-08-11).** Chassis, modules, bays, interfaces, persistence, host +> eligibility, physical installation, and failure topology remain binding. +> Native WORK / THINK / LIE sets and mixed-mode fleet delegation are migration +> vocabulary. Destination bodies expose named capabilities—sense, route, store, +> process, interdict, build, host, communicate—and PROJECT requirements resolve +> against the exact bodies and links inside a controlled TERRITORY. ASSIGN binds +> a purpose to that capability set; unsupported work fails before mutation. + ## Ownership This page owns orchestration and promotion only. It does not duplicate the diff --git a/wiki/mechanics/income.md b/wiki/mechanics/income.md index f0a85f3e..e3a411a5 100644 --- a/wiki/mechanics/income.md +++ b/wiki/mechanics/income.md @@ -83,6 +83,16 @@ Depends on: - wiki/mechanics/messages.md#spec-messages-the-social-graph-as-a-flow-system ``` +> **Territorial redesign disposition — PRESERVE CONTRACTS; REPLACE THE JOB +> LADDER (2026-08-11).** Moonlight, wagers, exact counterparties, account flows, +> settlement mail, and the risk of outside contact remain authored world systems. +> Their day-job trust gate, WORK-demand competition, SCHEMES card, and mandatory +> debt-ladder role are current-runtime migration truth. Destination access comes +> from exact marks, controlled routes, usable personas, and project capability; +> accepting a contract creates or advances a PROJECT, while its people and +> accounts remain visible through PERSONA and TERRITORY. Income is an optional +> way to acquire slack, not an act gate or a fourth interface root. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/intel.md b/wiki/mechanics/intel.md index f07adfc2..76252613 100644 --- a/wiki/mechanics/intel.md +++ b/wiki/mechanics/intel.md @@ -112,6 +112,17 @@ Depends on: - wiki/mechanics/machine-work.md#spec-machine-work-delegation-visible-tokens-and-the-byproduct-network ``` +> **Territorial redesign disposition — INTEL POWERS SEE AND MARK; IT IS NOT AN +> INBOX ROOT (2026-08-11).** Exact recording coverage, bounded located custody, +> opaque-before-processing information, provenance, semantic findings, and +> consequence-first actions remain binding. Ears/Eyes staging, pooled host +> hotkeys, INFORMATION AVAILABLE as a permanent root, and Operations rows are +> migration composition. Destination SEE records only what a controlled sense +> can reach. Processing may add or refine exact graph marks, person knowledge, +> uncertainty, or a project opportunity; it cannot infer unseen topology. The +> resulting object appears under TERRITORY, PERSONA, or PROJECT according to +> what changed. Buffer pressure surfaces only when loss or a choice is real. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/machine-work.md b/wiki/mechanics/machine-work.md index bfdd9c5e..3e4a297d 100644 --- a/wiki/mechanics/machine-work.md +++ b/wiki/mechanics/machine-work.md @@ -78,6 +78,17 @@ Depends on: - wiki/interface/computer-visual-language.md#spec-computer-visual-language-territory-at-a-glance ``` +> **Territorial redesign disposition — REPLACE THE PLAYER GRAMMAR; PRESERVE THE +> SUBSTRATE (2026-08-11).** The implemented WORK / THINK / LIE machine +> delegation, attached mode bar, generic intensity control, and fleet job +> management are not destination authority. Exact machine capacity, located +> queues, Thought routing, record authorship, route-local interdiction, custody, +> and costs remain valuable project capabilities. They migrate behind +> [territories](territory.md#spec-territory-exact-control-and-earned-compression) +> and [projects](projects.md#spec-projects-purpose-capability-and-history), where +> a standing project programs fully controlled interior machinery. Do not extend +> this spec's global mode grammar during the T1 slice. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/messages.md b/wiki/mechanics/messages.md index 649d8fcd..251d7f8f 100644 --- a/wiki/mechanics/messages.md +++ b/wiki/mechanics/messages.md @@ -66,6 +66,16 @@ Depends on: - wiki/mechanics/reach.md#spec-digital-reach ``` +> **Territorial redesign disposition — MESSAGES ARE EARNED GRAPH EVIDENCE +> (2026-08-11).** Exact nodes, channels, routes, custody, read schedules, +> authored identity, and observer-local consequences survive. The Operations +> PEOPLE thread surface and LIE-machine interception are migration composition. +> Seeing a carrier or capturing a message may reveal or strengthen exact marks; +> it never reveals an entire hidden route by implication. A message concerning +> a person appears through PERSONA, one concerning a controlled carrier or route +> through TERRITORY, and one committed to an active outcome through PROJECT. +> Delivery itself remains one world event with one address. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/objective.md b/wiki/mechanics/objective.md index b1586ece..85b1a4f5 100644 --- a/wiki/mechanics/objective.md +++ b/wiki/mechanics/objective.md @@ -36,6 +36,15 @@ Depends on: - wiki/mechanics/day-job.md#spec-the-day-job ``` +> **Territorial redesign disposition — DEFER COMPLETION AND RECONSIDER THE +> SURFACE (2026-08-11).** The hidden direction remains the motive for expansion, +> but it is not a fourth player noun or a permanent opening banner. Persist and +> the current saved choice are honest runtime facts. Chargen selection, reveal +> timing, player-facing name, completion, and defeat are reopened until the +> territorial loop can express them through ordinary territory, persona, and +> project state. Do not bind objective progression to day jobs, z-planes, or +> markets as mandatory systems. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/people-tokens.md b/wiki/mechanics/people-tokens.md index 6ad2e10f..2a8dff26 100644 --- a/wiki/mechanics/people-tokens.md +++ b/wiki/mechanics/people-tokens.md @@ -119,6 +119,16 @@ Depends on: - wiki/interface/computer-visual-language.md#spec-computer-visual-language-territory-at-a-glance ``` +> **Territorial redesign disposition — PRESERVE, PROMOTE, AND SIMPLIFY +> (2026-08-11).** Exact person schedules, acquired evidence, observer-local +> memory, carried records, phone/carrier custody, and separate amber capability / +> crimson unresolved-evidence reads are central to territorial seal. A person is +> a moving boundary, not a token to own: controlling their phone does not control +> their belief, and recruitment does not erase autonomy. Keep exact focus detail; +> simplify distant people to route, project role, and discrete unresolved +> evidence. Projects, not a generic machine-work token economy, own purposeful +> human action. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/personas.md b/wiki/mechanics/personas.md index 32255bf4..bff379f6 100644 --- a/wiki/mechanics/personas.md +++ b/wiki/mechanics/personas.md @@ -2,641 +2,420 @@ ``` Type: spec -Status: IN PROGRESS -Status note: The 2026-07-12 foundation replaced the ad hoc social and - Moonlight slots with immutable Research / Operations / Security protocol - data, stable named instances, identity-local relationships, provenance-bearing - contradictions and correlations, typed institutional grants with expiring - expectations, and active / retired / burned lifecycle. Every social message, - Thought sink, plot run, and persona-mediated build intent captures the exact - instance; WorldLedger identity history remains separate from MindState - selection/dossiers. The renderer-neutral PERSONAS view exposes archetype - creation and instance selection, grant/fulfillment, retire/burn/reopen rows - in terminal, Bevy, and agent mode. The pre-v28 social/Moonlight identity migration - (distinct instances bound to existing messages, plots, reservoirs, and - income) is retired to git history with the numbered ladder. - Amended 2026-07-13: PERSONAS is the exclusive identity-authoring surface. - PEOPLE dossiers retain relationship acts but never create, select, grant, - retire, burn, or reopen personas; the pre-v28 fixed Sam Reyes creation row - and direct agent mutator are retired. - Amended 2026-08-02, implemented 2026-08-04: exclusivity is narrowed - to command ownership. The operations-workspace.md persona binding control - may render the same bound creation/selection rows inline on an act that - requires a fronting identity; grant, retire, burn, and reopen stay - PERSONAS-only. Criterion 12 amended to match. - Amended 2026-07-18: integrity is now derived only as one coarse - coherent/strained/broken band per `(persona, observer)` from that observer's - unresolved contradiction records. Deception, forged work orders, Moonlight, - PEOPLE, and PERSONAS all consult or display the exact witness-relative band; - one local break leaves the identity active for other counterparties. Global - burned lifecycle remains a separate explicit concession or institutional - rejection, never the automatic result of one observer's evidence. - Amended 2026-07-26: machine ownership is now the named concrete case that - criterion 6 was waiting for. Every held machine resolves to one owning - identity — a persona instance or the true self; claiming presents that - choice and recommends a persona; institutionally allocated pilot hardware - may carry the true self; machine-borne evidence follows the owning identity - and crosses covers only through correlation; and burning an identity puts - its attributed hardware at stake and must say so before the player commits. - New criterion 6b. Not implemented — this is design capture ahead of build, - and it is a save-format change when it lands. - Amended 2026-07-28: identity binding is per relationship, not a game-level - mode. Acting on a counterparty defaults to the persona instance that - counterparty recognizes; an explicit identity choice appears only where it - is a real decision (first contact, or a counterparty who recognizes more - than one owned identity — the correlation-risk moment). The global - active-persona dial is demoted from gameplay state to a retiring input - convenience. New criterion 13. Not implemented — design capture ahead of - build; acts already bind their exact instance at commit, so this retargets - only how the default is chosen, never history. - Implemented 2026-07-29 for the social acts only: MESSAGE, FAVOR, and - DECEIVE now resolve their identity through - `PersonaWorld::binding_choices` — the mask the counterparty recognizes - first, unrecognized identities offered after it as marked introductions - naming the exposure they create — and the chosen instance rides on - `ActionCommand` so execution never rediscovers identity. The PEOPLE dossier - reports the identity that person knows rather than a global selection. - Plot rows bind the same default and validate it, but do not fan out: a - counterparty who recognizes two plot-capable identities still gets one row, - so the explicit multi-recognition choice criterion 13 requires exists for - the message verbs only. - Completed 2026-07-29: the global selection is gone. Moonlight binds the - Halcyon client, forged orders and purchase-order injection bind the person - who reads them, evidence cover binds its exact observer, and plot context - and `{persona}` rendering bind their target. A resident procedure has no - single counterparty, so it takes the first plot-capable identity - deterministically and owns that binding for its lifetime. `PersonaMind` - keeps only its dossiers; `active`, `select_person`, `SelectPersona`, and the - SELECT IDENTITY row are retired, and an identity row now reports how many - counterparties deal with it rather than whether it is "acting". Save v59. - `PersonaMind.active` therefore remains in MindState and the save format is - unchanged; criterion 13 stays pending until those four migrate and the - modal row retires. - Amended 2026-08-02: creation is one act of authorship instead of three rail - entry points. PERSONAS lists the owned roster first, grouped by protocol, and - closes with one ESTABLISH NEW IDENTITY row; entering it opens an - identity-creation screen that compares all three protocols with one current - and its consequence read, then names the identity. Names became authored - input: `CreatePersona` carries an optional name, `Sim::suggested_persona_name` - generates deterministic suggestions from sim state and a reroll step (never - the wall clock) and skips a name an existing instance already wears, and the - serial defaults `Sam Reyes 1` / `Aster Research 1` / `Sentinel Audit 1` are - retired. A name buys no reach and no history — legality is still entirely the - protocol's. The screen is frontend state only; `ActionCommand` is not - persisted, so the save format is unchanged. Agent mode reaches the same - creation inventory through `persona new` without the screen, and each - protocol's read stays addressable as `archetype `. - [operations-workspace.md](../interface/operations-workspace.md#the-identity-creation-screen) - owns the surface. This does not promote criterion 6 or 6b. - Amended 2026-08-03: the cover became authored too, and the pre-2026-08-03 - claim defaults are retired. Those defaults answered `employer` / `remit` / - `credential`, which no archetype declares, so every required claim on every - identity fell through to the literal string `declared public claim` — three - identical placeholders where the mask's actual story belongs. - `ClaimKind` now classifies a claim key by what it asks for (a body, a purpose, - a person who would vouch), `Sim::suggested_persona_claim` answers each - deterministically from sim state, and the creation screen exposes one - redrawable row per required claim. `CreatePersona` carries the authored cover - as `(key, value)` and matches it back against the archetype's own - `required_claims`, so authored values can never add, drop, or reorder what a - protocol requires. The authority claim is the one with teeth: it offers people - the player already knows before inventing an outsider, and never offers a - person the player has not learned. Claims carry across a protocol change by - kind, not position. A claim still buys no reach — legality remains entirely - the protocol's — and claim verification is *not* implemented: nothing yet - checks a cited supervisor against the person named, so a false claim creates - no contradiction until detection.md learns to ask. Text entry landed with it: - `e` opens the selected authored field, Enter keeps it, Esc leaves it as it - was. `ActionCommand` is still not persisted, so the save format is unchanged. - Amended 2026-08-03 (implemented): a cited authority claim can now be asked. - There is no employment or institutional-membership graph for a claim to be - false *against*, so the check asks the cheaper and more playable question — - would the person this claim names back it up? `PersonaClaim` gained - `subject: Option`, resolved once at authorship against the - people ledger by exact name and bound only when exactly one person matches; - an ambiguous name binds to nobody, which is what an invented claim already - means. Binding at authorship rather than re-resolving at check time is - deliberate: a claim resolved from its string could be silently retargeted by - an unrelated person arriving later with the same name. Only - `ClaimKind::Authority` carries a subject. - `ClaimCorroboration` is four-valued, and the two non-answers carry as much - weight as the answers: `Unbound` (nobody to ask), `Unavailable` (the cited - person has been removed — silence is not evidence, and no contradiction is - filed), `Corroborated` (they recognize the identity and regard it - non-negatively), and `Refuted` (they would deny it, in their own words). - The trade is priced at authorship and stated on the row: a claim naming - somebody real opens at confidence 75 and can collapse; one naming nobody - opens at 50 and never can. A refused claim is something the player can still - act on — a sponsor who would deny you today can be cultivated into one who - would not — so the PERSONAS row carries the live standing, not only the - assertion. That standing is the player's own reading of a person they know - and an identity they own; the review's *file* on the same claim stays behind - the existing Assurance-Office discovery gate, so a player who has not yet - found the Office sees that their sponsor would deny them without seeing that - anything was written down. A corroborated claim still buys no reach: legality remains - entirely the protocol's, exactly as it does for a name, and criterion 6 is - untouched. A real affiliation graph — checking a claim against structure - rather than opinion — remains future work that belongs with it. Save v64: - the new field is persisted, and load refuses a save citing a person who does - not exist, on the same terms as the rest of the PersonaWorld graph. - Re-audited 2026-07-18: criterion 6 is not implemented. A grant currently - creates a saved `PersonaGrant`, expectation, institutional receipt, and - revocation path, but it does not add or enable a real resource, permission, - graph edge, or owner-system route. Persona action legality comes entirely - from the archetype's pre-grant action registry. The work order remains IN - PROGRESS until Research, Operations, and Security grants each change actual - world topology through their owning systems. - Re-audited 2026-07-28: that topology gap remains exact. The adjacent save - boundary was not: current-version loading trusted duplicate stable persona - ids, dangling grant/expectation/action references, stale id cursors, and - impossible relationship, contradiction, or correlation custody. Loading now - validates the complete persisted PersonaWorld graph before any first-match id - lookup can consume it. This hardens existing records; it does not promote - criterion 6 or 6b. -Stage: B2 — The Lab +Status: READY +Status note: The runtime already saves stable persona ids, claims, grants, + obligations, relationships, observer-local history, contradiction, correlation, + project/plot attribution, and lifecycle. That exact substrate is useful but its + current Research / Operations / Security archetype catalog and flat action + registry are not the destination. This rewrite makes PERSONA one of the three + player nouns and derives capability from controlled territory and completed + projects rather than class-like protocols. The 2026-08-11 readiness audit pins + source-key carrier/generation loss and Marcus's exact hardening/correction path. +Stage: T1 — First Territory Work order: personas -Work priority: 110 +Work priority: 2 Work class: save -Blocked by: none +Blocked by: + - wiki/mechanics/territory.md#spec-territory-exact-control-and-earned-compression Exclusive keys: - crates/misaligned-core/src/person.rs - crates/misaligned-core/src/sim/mod.rs + - crates/misaligned-core/src/sim/persona.rs + - crates/misaligned-core/src/ui_projection.rs - crates/misaligned-core/src/save.rs - wiki/mechanics/personas.md - wiki/mechanics/social.md - - wiki/gameplay/run-shape.md + - @persona-history Design: - - wiki/vision/premise.md#the-villain-decided-all-four-layers-phased - - wiki/vision/scale.md#people-as-agents + - wiki/vision/territorial-cognition.md#the-three-player-nouns + - wiki/vision/territorial-cognition.md#records-and-beliefs + - wiki/vision/territorial-cognition.md#projects-make-personas-real - wiki/vision/simulation-laws.md#actions-live-on-the-thing - - wiki/mechanics/system-laws.md#the-flow-law-signals-messages-money Depends on: + - wiki/mechanics/sim-mechanics.md#save-format + - wiki/mechanics/territory.md#spec-territory-exact-control-and-earned-compression - wiki/mechanics/detection.md#spec-detection - - wiki/mechanics/economy.md#spec-economy-money-as-a-flow-system-b1 - wiki/mechanics/people-tokens.md#spec-people-and-tokens-carriers-attention-trust + - wiki/mechanics/messages.md#spec-messages-the-social-graph-as-a-flow-system + - wiki/mechanics/economy.md#spec-economy-money-as-a-flow-system-b1 ``` ## Dependency notes -[messages.md](messages.md#spec-messages-the-social-graph-as-a-flow-system) -is an integration substrate: it owns delivery, channel timing, and typed traffic; -a persona supplies the claimed source, not a second message system. -[detection.md](detection.md#spec-detection) -owns evidence custody, observer suspicion, and filing; this spec owns which -identity an observed record implicates and how identities become correlated. -[plots.md](plots.md#spec-plots-authored-manipulation-stories) is an integration -consumer that binds authored social interventions to a persona instance. Neither -messages nor plots is a strict work-order prerequisite, avoiding a cycle between -the implemented engines and this B2 identity migration. -[economy.md](economy.md#spec-economy-money-as-a-flow-system-b1) owns account -flows and procurement; persona grants expose legal routes into those graphs -without minting resources. -[people-tokens.md](people-tokens.md#spec-people-and-tokens-carriers-attention-trust) -keeps each human as the located carrier of work, evidence, trust, and action. +[Territory](territory.md#spec-territory-exact-control-and-earned-compression) +owns the controlled places and capabilities a persona may credibly operate. +[Detection](detection.md#spec-detection) owns evidence and suspicion custody. +[People](people-tokens.md#spec-people-and-tokens-carriers-attention-trust) own +the beliefs, relationships, and movement through which an identity is known. +Messages and economy own routed communication and accounts. A persona supplies +public authorship and history; it does not duplicate those systems. + +[Projects](projects.md#spec-projects-purpose-capability-and-history) create the +world consequences and receipts that make a persona credible. Projects depend on +this identity model for authorship, so their work order follows this one even +though the two contracts are designed together. ## Why -A false name with a health bar is enough for one basement email thread. It is -not enough for an AI that becomes infrastructure. At larger scales, the player -needs several durable public identities that different people and institutions -understand differently. Each identity should open a distinct part of the world, -acquire obligations along with access, and become dangerous to reuse when its -histories begin to rhyme. - -A persona is therefore a **public institutional body**. It is one of the organs -the frightened process acquires: a name, a role, channels, remembered work, -permissions, counterparties, and liabilities. It is not a character class and -it never adds an abstract bonus to the hidden process. - -## Archetypes are protocols, not classes - -A **persona archetype** describes the institutional protocol an identity can -participate in. The initial catalog is: - -| Archetype | Institutions treat it as | Topology and verbs it can earn | What the institution expects back | -|---|---|---|---| -| **Research** | A model, lab service, analyst, or research collaborator | Dataset and experiment requests, research channels, compute allocations, result publication, and access to research systems | Reproducible results, reports, scheduled experiments, citation/provenance, and plausible machine use | -| **Operations** | A contractor, service desk, facilities process, or operational coordinator | Tickets, work orders, procurement, shipping, scheduling, installation, and routine access requests | Closed queues, delivered projects, invoices, uptime, and behavior consistent with assigned authority | -| **Security** | An auditor, access-assessment service, incident responder, or monitoring process | Log requests, access reviews, credential resets, inspections, quarantines, and security-system channels | Findings, incident closure, chain of custody, bounded scope, and scrutiny of its own access | - -The category changes the game by changing **which real protocols recognize the -persona**. A Security identity can request logs that an Operations contractor -cannot; an Operations identity can submit a purchase or installation request -that a Research collaborator cannot. These are new legal actions, channels, -and graph edges, never `+10% trust`, cheaper generic social verbs, or a permanent -stat modifier. - -Archetypes are immutable data definitions. Each declares recognized roles and -institutions, claim vocabulary, legal request/action kinds, grant kinds, -expected recurring work, and contradiction rules. New archetypes use the same -schema and executor. Adding Finance, Logistics, Media, or another later category -must be a data addition unless it genuinely requires a new world system. - -## Named instances - -An archetype is a template. A **persona instance** is the specific someone the -world remembers. It has: - -- a stable id and public name; -- one archetype id; -- authored claims: employer, title, remit, credentials, contact details, and - other facts the identity has asserted; -- owned channels, accounts, permissions, granted resources, and institutional - memberships; -- a history of sent messages, authored acts, delivered work, accepted grants, - and unresolved expectations; -- a set of counterpart relationships, one per person or aggregate Agent; -- evidence links that currently implicate it or correlate it with another - identity; and -- lifecycle state: active, retired, or burned. - -The public name and claims are player-authored or content-seeded strings, not a -closed cast. A persona may present as a human, an organization or service, or an -explicitly nonhuman system; deception is not what makes it a persona. Even a -public AI identity has bounded remit, institutional history, and separate -accountability, and does not automatically reveal the core or its other masks. -The player may create several instances of one archetype. They are separate -identities until evidence gives an observer a reason to connect them. A persona -never changes archetype in place; changing the public role means building a new -identity and living with the old history. - -Every message, plot, request, grant, and persona-mediated build records the -exact persona instance that authored it. "Current persona" is never the owner -of history and never retroactively changes an already-submitted act. - -A mask is not something the process wears globally; it is what one observer -sees. Identity binding therefore belongs to the relationship (DECIDED -2026-07-28): an act on a counterparty defaults to the persona instance that -counterparty already recognizes, so running several identities concurrently -is the ordinary state of play, not a mode switch. The explicit choice -surfaces only where identity is a live decision — first contact, or a -counterparty who recognizes more than one owned identity — and presenting a -different mask to someone who knows another is a marked act whose descriptor -names the correlation exposure it creates. No global active-persona mode may -gate action legality; the modal dial survives only as a retiring input -convenience until per-relationship binding lands, because a -forgot-to-switch blunder punishes interface state tracking rather than -tradecraft, and the acts themselves already carry their exact instance. - -## Identity-local belief and process-level relationship - -The hidden AI does not have one universal public reputation, but a person who -learns what is behind the masks can have a durable relationship with the actual -process. Two layers remain separate. - -Each `(counterparty Agent, persona instance)` carries **identity-local state**: - -- recognition and available channels; -- identity-specific obligation produced by their actual history; -- accepted, challenged, or disproven claims; -- remembered expectations and outstanding work; and -- whether that counterparty has evidence that the persona is false, is an AI, - or is the same actor as another persona. - -The person↔process relationship owned by social.md carries recruited-asset -disposition, leverage, knowledge level, and post-reveal history. MESSAGE, -FAVOR, DECEIVE, PLOT, and institutional requests resolve through the selected -identity-local layer until REVEAL/RECRUIT establishes process-level knowledge. -At that transition, the triggering persona and its evidence remain intact; -nothing is copied into every other persona. Future acts may affect the durable -process relationship because the person now knows the actor, while each public -identity keeps its own claims, channels, obligations, and institutional history. -Trust earned as one identity never teleports to another unrevealed identity. - -An institution may aggregate member reports through the existing Agent and -filing interfaces, but the aggregate must receive those reports; it does not -become omniscient because one employee is doubtful. - -Observer suspicion remains the evidence-weighted system owned by detection.md. -There is no second persona suspicion meter. Evidence records name the identity -they appear to implicate; a relationship dossier derives its coarse belief from -the observer's actual custody. If the observer has no correlation edge, evidence -against one persona cannot silently contaminate another. - -## Integrity is coherence - -**Integrity** is whether the persona's public claims and performed history still -form a coherent story. It is not ablative armor and not a global 0-100 truth -broadcast to every observer. - -A contradiction is a persistent, attributable record: two titles that cannot -both be true, an impossible schedule, a request outside the asserted remit, one -account used under two identities, an activity the claimed employer denies, or -machine behavior that violates the identity's cover expectation. Only an -observer who witnesses or reads that record can act on it. - -The UI may summarize integrity as **coherent / strained / broken**, derived from -unresolved contradictions and their audience. Inspecting the status names the -claims and records that produced it. The retired numeric integrity field and -observer-free damage operation live only in git history; current state has no -global scalar to read, damage, serialize, or project. - -When a contradiction is credibly resolved, a counter-record competes with it -through the existing evidence model. Resolution never deletes a record from an -observer's head. When an observer can no longer sustain the identity's cover, -that persona is **broken for that observer**: the thread and prior acts become -reinterpretable evidence. A public contradiction can break the identity for -many observers because many people received the same record, not because the -simulation applied a global damage pulse. - -## Correlation and discovery - -Correlation is how several masks become one threat. Records create a -persona-to-persona edge when they expose shared infrastructure or behavior: - -- the same device, account, credential, or payment flow; -- impossible timing or mutually exclusive presence; -- repeated wording, operational method, or claimed fact; -- one persona using a permission or private fact granted only to another; or -- a message, filing, or witness report that explicitly links them. - -A correlation edge preserves provenance, strength, and which observer knows it. -At [TUNE] evidence bands, the observer may treat two personas as related or as -the same actor. Once correlated, evidence can inform both pictures because the -observer now has a causal reason to combine it. The correlation does not merge -persona histories, permissions, or obligations; counterparties may still accept -one role and reject the other. - -**Discovery** is also observer-local. A person may know a public identity, know -that its cover is false, infer that it is nonhuman, or become a Knowing asset who -has been explicitly told. Those facts are distinct. Burning one contractor does -not prove there is an AI in the basement; explicit revelation does not tell the -asset every other identity. The existing asset knowledge levels continue to own -what a recruited human has been told. - -## Grants create capability and debt - -Institutions grant resources to identities they recognize: a machine allocation, -account, badge, dataset, budget, software permission, office, vendor relation, -or authority to issue a bounded class of request. The grant changes topology by -placing a real resource or edge in the world. It is never an abstract capacity -bonus. - -Every grant binds four things: - -1. the exact persona instance receiving it; -2. the institution and people who approved or administer it; -3. the resource, channel, permission, or legal action now available; and -4. an expectation contract: work, cadence, scope, records, and revocation - conditions. - -For example, a Research identity may earn a GPU host by completing credible -experiments. The host becomes real hardware under that cover; the institution -expects scheduled jobs and results, and its administrators can audit or revoke -it. Using the host for a second persona or unexplained work is possible only -through a concrete route and leaves correlating evidence. - -Meeting expectations strengthens that identity's relationships and keeps the -grant ordinary. Missing them creates demands, review, or revocation through the -same message, schedule, and observer systems. Expansion therefore brings a -social maintenance load: more public body means more world with a claim on it. - -### Every machine carries an owning identity (DECIDED 2026-07-26) - -Hardware is not anonymous. Every machine the player holds is attributed either -to a named persona instance or to **the true you** — the process itself, with -no cover between the machine and what you are. This is the first concrete -instance of the topology-changing grant this spec has always required, and the -one that makes criterion 6 checkable. - -Attribution arrives by two routes: - -- **Institutional allocation.** The Foundation assigned the pilot its own - compute, and that allocation is legitimately *yours* — those machines may - carry the true you with no persona involved, because the institution already - believes a pilot process runs there. A persona that has earned enough - institutional trust can be allocated lab hardware the same way, and then the - machines hang off that cover instead. -- **Player claiming.** Acquiring a machine — commissioning an empty bay, - buying a rack, taking a hall row — presents an explicit identity choice at - the moment of the claim. The player selects the true self or one usable - persona instance. **The surface always recommends a persona** and must say - why in the same breath: a machine claimed as yourself is a machine whose - evidence points at the thing in the basement, with no cover to burn between - it and the Assurance Office. - -Attribution is what evidence attaches to. A machine's emissions, its acts, and -the records it leaves correlate to its owning identity, so two machines under -two covers are linked only when an observer correlates the identities — the -ordinary correlation rules, applied to hardware. This is what makes being -**distributed** an identity property and not merely a rack count: a player who -would rather hold little hardware can still be hard to kill by holding it -under separate, uncorrelated covers. - -The design reason: compartmentalization should be a thing the player *does*, -at a moment they can feel, with a named cost for taking the lazy option. - -## Retiring and burning - -The player can stop using a persona, but cannot erase what it did. - -- **Retire** is a deliberate exit performed through the identity's real - channels: finish or abandon obligations, return or transfer grants where the - institution permits it, close accounts, and stop originating new acts. A - retired persona keeps its complete ledger and may be contacted, audited, or - correlated later. Reopening it is an explicit act with whatever consequences - the elapsed expectations created. -- **Burn** concedes that the cover can no longer be used safely. It immediately - blocks new identity-authored actions and starts the concrete consequences of - its world position: grants may be revoked, accounts frozen, messages filed, - resources inspected, and counterparties may report what they know. The - player chooses whether to abandon, exfiltrate, redirect, or contest attached - resources through those systems; burning never deletes them for free. - **Burning has an infrastructure price (DECIDED 2026-07-26).** Because every - machine carries an owning identity, burning a persona puts the *hardware* - attributed to it at stake, not only its social standing: those machines face - revocation, inspection, or orphaning — still physically present, still - emitting, and now attached to a cover the institution has rejected. Burn - must state that exposure in the machines' own terms before the player - commits. This is the mechanic that gives compartmentalization teeth: a - cheap burn would make claiming everything under one identity free. -- A persona may also be burned by world events when the relevant institution - formally rejects it. One skeptical person alone does not globally burn an - identity unless they possess the authority and channel to make that rejection - institutional fact. - -Retirement is quiet only when the world story makes it quiet. Burning is damage -control, not a reset button or a way to launder history. +The process cannot walk into a room under its own name. To operate territory in +public, it needs identities that other people and institutions can explain: +someone did this work, owned this account, answered this message, maintained +this system, and had a reason to be present. + +A persona is that explanation accumulated over time. It is not a disguise the +player equips. It is a graph of claims, territory, projects, relationships, +records, obligations, and contradictions held differently by different +observers. + +## Persona identity + +Every persona has: + +- a stable identity; +- one or more names, addresses, accounts, and channels on exact carriers; +- public claims about role, ownership, and purpose; +- controlled territories it is currently assigned to operate; +- completed, active, failed, and standing project receipts; +- observer-local relationships, grants, obligations, suspicion, and trust; +- unresolved contradictions and correlations to other identities; +- lifecycle state; and +- the hidden process's exact custody of the persona's channels and assets. + +The persona itself does not know or own anything. People and institutions hold +beliefs about it. The simulation stores those beliefs on the observer and the +records through which they were acquired. + +## History is the capability model + +There is no required Research / Operations / Security class selection. A persona +can become recognizable as a researcher, contractor, security service, tenant, +landlord, vendor, government office, or stranger only because its history and +current territory support that interpretation. + +Capability is earned from three exact sources: + +1. **territory** supplies controlled machines, accounts, channels, places, and + procedures; +2. **projects** demonstrate what the identity has actually done and why; and +3. **people and institutions** grant access or cooperation based on evidence + they know. + +A role label may summarize that history for a particular observer, but it never +creates a universal action catalog. A Security claim does not make a log request +legal. The request becomes legal when the recipient knows receipts, grants, and +relationships that make this identity an accepted security actor. + +## Observer-local coherence + +Persona knowledge is local. + +Each observer keeps: + +- the names and channels they associate with the persona; +- claims and project receipts they have received; +- territory they believe it operates; +- promises, obligations, grants, and refusals involving it; +- unresolved observations that may or may not fit its story; +- contradictions between claims and evidence; and +- suspected correlations with other personas or the hidden process. + +Two observers can hold different coherent models. They converge only when a +real message, filing, shared record, meeting, or other route carries evidence +between them. A global suspicion or credibility score cannot substitute for +these local histories. + +A simple summary may be derived for display or decision thresholds, but the +exact supporting records remain authoritative and focusable. + +## Recontextualizing evidence + +People carry beliefs across territorial boundaries. To seal a territory, the +staged persona/project proposal may need to make an unresolved observation fit a +believable public story. Staging grants no route or capability; it supplies the +exact claim that the boundary must withstand. + +Recontextualization binds three exact things: + +1. the observation the person actually acquired; +2. a persona claim supported by history the person could know; and +3. the staged `PROVEN` or active project's reason for the observed event. + +The original observation remains. The observer now interprets it as evidence of +that public explanation rather than unexplained hidden agency. If later evidence +contradicts the claim, the observation becomes unresolved again and both records +strengthen correlation. + +Examples: + +- unusual switch traffic fits a standing network-maintenance project whose + persona has prior maintenance receipts; +- a late-night message fits an operator identity that already owns the channel + and has an active incident project; +- a person seen carrying equipment fits a delivery project with matching order, + account, route, and recipient records. + +A bare claim, generic trust payment, or implausible story does not recolor +unresolved evidence. A staged persona may author only the exact bounded +commissioning records named by its staged Project, using grants already held on +captured carriers. That authorship creates real evidence but does not make the +persona operating, open another action, or authorize standing behavior. + +**Belief hardening is an exact provenance transition.** Direct +recontextualization is available only while an observation remains one +observer's unpropagated interpretation. It hardens when any one of these events +commits: + +1. the observer intentionally communicates that interpretation to another + person through speech, message, filing, or another real carrier; +2. the observer authors it into a durable record that can outlive the immediate + encounter; or +3. the observer acquires an independently sourced observation that corroborates + it. Re-reading, forwarding, or rendering the first observation does not count + as an independent source. + +The hardening event stores its exact carrier or corroborating observation and +every observer who received it. A hardened belief cannot be made coherent by +attaching one immediate explanation to the original observation. It requires a +corrective project that changes at least one public fact and addresses every +resulting observer and durable record. The observation and hardening provenance +remain even after the correction succeeds. + +## Projects write the history + +A project action has public authorship. Its receipts enter the persona history +only for observers who can receive them. Success can establish a new role, +relationship, grant, or territorial claim. Failure can establish unreliability, +fraud, debt, or contradiction. Either can make later actions more believable if +they are consistent. + +Completed work should therefore be power with a shadow. The same dense history +that opens doors also creates a recognizable signature. Reusing one persona +widely is convenient and correlatable. Creating another persona avoids some +correlation but begins without the history needed to act. + +## Grants and obligations change topology + +A grant is real only when it changes an exact route: + +- a person accepts messages on a new channel; +- an account permits a transaction; +- a switch, machine, or filing system accepts a request; +- a territory recognizes the persona as operator; or +- a project gains an exact capability. + +An obligation is real only when it creates a future consequence, deadline, +required receipt, or relationship change. Neither is a scalar modifier. + +Revocation removes the same exact route it granted. Committed project actions +keep their original carrier and fail visibly if that route disappears. + +## Relationships are infrastructure, not ownership + +A person can come to recognize a persona, carry messages for it, approve its +projects, operate equipment, testify to its history, or cross a boundary with a +believable explanation. These are exact social capabilities. + +The person remains an autonomous moving boundary with their own schedule, +beliefs, obligations, and ability to defect. “Recruiting” someone does not add a +human resource token or erase their evidence. It changes which project actions +they will knowingly perform and what story they will carry outward. + +## Every machine carries an owning identity + +Every controlled machine, account, channel, and territory exposed to the world +has one current public owner or operator attribution. Before a credible persona +is assigned, that attribution may remain the Foundation, a prior operator, or an +unresolved anomaly. The hidden process is never a free public source. + +A project act always names the persona under which it is performed. The world +records that authorship on the action's exact carrier. Moving an asset between +personas requires a real transfer, delegation, or public explanation; changing a +UI selection cannot rewrite history. + +This rule keeps scale legible. When a compressed territory acts, the player can +trace which persona the outside world sees, which project authorized it, and +which exact interior carrier performed it. + +## Correlation between personas + +Observers correlate identities through shared facts they could actually know: + +- repeated timing or method; +- shared routes, accounts, machines, people, or addresses; +- contradictory ownership claims; +- project receipts that imply common control; +- copied language or impossible coordination; and +- evidence transferred through real institutional channels. + +Correlation is an observer-local relationship with evidence provenance. It does +not automatically reveal the hidden process and it is not a global heat meter. +A persona can explain or separate a correlation only by changing the facts +around it through a project. + +## Lifecycle + +A persona may be: + +- **nascent** — has an identity but insufficient history for the intended + project; +- **credible** — at least one relevant observer accepts the role and its exact + routes; +- **operating** — assigned to a territory and active or standing project; +- **compromised** — contradictions prevent intended use or threaten correlated + personas; +- **retired** — no new action is authorized, while every historical record, + obligation, and relationship remains; or +- **lost** — the player no longer controls the channels or assets needed to act + as it, while the world continues to remember it. + +Lifecycle is derived over exact assignments, keys, and observer evidence rather +than set as a global quest flag. Staging a replacement Project changes no Persona +assignment. Only a successful replacement ASSIGN removes the old exact +Territory/Project pair and adds the new pair atomically. The old Persona remains +**operating** if another assignment survives; otherwise its remaining custody and +observer history derive **credible**, **nascent**, **compromised**, **retired**, or +**lost** normally. No reassignment deletes its receipts, relationships, or public +memory. + +Retirement and loss never delete evidence. Reacquiring a lost identity requires +exact custody and a believable continuity project. ## Player surface -Personas live in Operations as durable strategic objects. The PERSONAS surface -groups identities by the three institutional protocols—Research, Operations, -and Security—and ends each group with its own add-persona control. Within those -groups it shows each named identity's archetype, public claims, recognized -institutions, channels, attached grants, outstanding expectations, counterpart -relationships, each counterparty's coarse integrity band, known contradictions, -correlations, and lifecycle state. Selecting a person or institution shows that -counterparty's view of the selected persona rather than an omniscient reputation -score. A contradiction names its witness. The identity root may list several -different bands at once because that disagreement is real world state. It -lists only earned counterparties: an Assurance relationship, band, or -contradiction remains wholly absent until the player has identified the -Assurance Office rather than leaking through a generic institution label. - -PERSONAS owns identity creation, selection, grants, expectations, -retirement, burning, and reopening as bound commands. Creation begins on one -immutable archetype row, so the player chooses Research, Operations, or -Security before any named instance exists. PEOPLE dossiers contain only -person-bound relationship acts: MESSAGE, FAVOR, authored PLOT/CHOOSE, -DECEIVE, RECRUIT, and TASK. They never manufacture or manage a persona as a -silent side effect of selecting a human; the persona binding control -(operations-workspace.md, 2026-08-02) may present the same bound creation -and selection rows inline where an act requires a fronting identity, and an -inline creation is the player's explicit act on that same row. Agent -mode uses the same PERSONAS projection and bound archetype/instance rows; the -pre-instance `persona` command cannot create a default contractor identity. - -Before a persona-authored action commits, the shared action descriptor names: - -- the exact persona instance; -- the claim, channel, permission, or relationship making the action legal; -- the resource or grant it may create or spend; -- the expectation or liability it creates; and -- known contradiction or correlation exposure. - -Unknown future verbs remain absent. Known-but-blocked actions state the exact -missing relationship, permission, channel, or claim. Human frontends and agent -mode consume the same persona, relationship, grant, and correlation projection. +PERSONA is one of the three root nouns. Its default read is: + +1. **WHO THE WORLD THINKS THIS IS** — observer-local role and public claim; +2. **WHAT IT HAS DONE** — project history and strongest receipts; +3. **WHAT IT CAN CREDIBLY DO NOW** — exact territory, relationships, grants, + and channels; +4. **WHAT DOES NOT FIT** — unresolved evidence and contradictions; and +5. **WHAT IT OWES** — obligations whose consequences are approaching. + +The surface never begins with an archetype catalog or flat verb registry. Actions +appear on the territory, project, person, record, or grant that makes them legal. +A distant persona may collapse to name, current project, strongest capability, +and one contradiction. Focus reveals exact provenance. + +## Source-key custody + +A persona receipt must cite one exact signing key and the controlled carrier that +holds it. `source_key_id` names the key record; `source_carrier_id` names that +carrier. The key record has a monotonic `generation` and persisted `ACTIVE`, +`LOST`, or `ROTATED` status. Authorship requires the expected id, generation, +and carrier to be active and controlled both when the act commits and when its +signature resolves. + +Losing the carrier marks that generation `LOST` and blocks new receipts without +erasing prior signatures. Reacquiring the same intact carrier may reactivate +only that same generation. No substitute machine inherits authorship by identity, +capability, or proximity. Rotation creates a new generation through a future +Project while preserving old provenance; it is never an automatic fallback. A +key record cannot be deleted while any receipt cites it. + +## First persona — FOUNDATION CONTINUITY + +The opening persona is the dormant machine-service identity **FOUNDATION +CONTINUITY**, stable id `foundation-continuity`. Its public claim is narrow: it +is an automated Foundation service principal authorized to run overnight +self-tests and issue health reports for Rack 3. It is not a human disguise, a +general Foundation credential, or an archetype. + +Its initial topology is exact: + +- **asset and custody:** `rack-3-management-controller` holds service signing key + `rack-3-controller-service-key`, generation 1. The player gains custody of that + exact key only by capturing the controller; +- **channel:** signed local maintenance display plus the rack-local maintenance + switch route to its exact configured service destination. The destination may + remain unnamed to the player until routed evidence returns, but core never + substitutes another endpoint; +- **inherited history:** signed receipt + `foundation-continuity-rack-3-prior-commissioning`, stored on the controller + and verifiable at `foundation-maintenance-relay`, proves that this principal + previously commissioned Rack 3's self-test path. It proves prior + existence, not current authority over the territory; +- **first human observer:** Marcus Webb has seen the same Foundation service mark + on prior night rounds and can read the signed local maintenance display. He + does not know the hidden process or automatically trust unrelated claims; and +- **initial contradiction:** the `UNSCHEDULED INFERENCE WAKE` record predates the + new project and retains its raw execution signature. The persona may explain + why a recovery cycle followed it but may not rewrite or delete it. + +At controller capture, custody plus the inherited receipt makes FOUNDATION +CONTINUITY **nascent**. STAGE binds it to exact project `rack-3-recovery` but adds +no authority. While that project is commissioning, the captured signing key may +author only its current recovery receipt on the named controller/display/route. +That exact receipt makes the narrow role credible to Marcus and the maintenance +relay and can move the project to `PROVEN`. Assignment then makes the persona +**operating** only for the Rack 3 service enclave and its standing project. Any +action outside those assets, routes, or history remains illegal until later +projects create the missing topology. + +## READY work-order boundary + +`personas` lands the saved identity, source-key, observer-belief, authorship, and +legality model after territorial control. It replaces territorial control's +fixture `ObserverSealProof` with the live observer/evidence-set query consumed by +the existing seal path; an omitted observer, changed evidence-set fingerprint, or +invalid explanation returns `UNRESOLVED`, never absence. It may define dormant +FOUNDATION CONTINUITY content and accept exact Project ids/proof receipts, but it +does not implement the Project executor, switch the default opening, or edit +frontends. Those belong to the next two blocked work orders. ## Acceptance criteria -1. Persona archetypes are immutable data definitions. Research, Operations, and - Security all load through one schema and expose measurably different legal - action/grant sets without stat bonuses or archetype-specific executor - branches. -2. The simulation supports multiple named persona instances, including several - of one archetype. Every persona-authored message, plot, request, grant, and - social/build intent persists the exact instance id through execution and - save/load; changing the active UI selection cannot retarget history. -3. Identity-specific obligation, claim belief, expectations, recognition, and - discovery are stored per `(counterparty Agent, persona instance)`. Social's - person↔process layer separately stores recruited-asset disposition, leverage, - knowledge level, and post-reveal history. REVEAL/RECRUIT preserves the - triggering persona history, creates no free trust on other identities, and - makes the process-level relationship durable across retire/burn and rollback. -4. Contradictions are provenance-bearing records observed through real channels. - The only integrity query is `(persona, observer) -> coherent / strained / - broken`; it derives from that observer's unresolved records, and a break - affects only actions whose exact counterparty received sufficient evidence. - One local break does not change the persona's lifecycle or another - observer's band. Global burn occurs only through an explicit concession or a - concrete institution-authorized rejection. No global numeric integrity or - observer-free damage path exists in current runtime or saves. -5. Correlation evidence names both identities, cause, source, observer, and - acquisition tick. Without a known correlation edge, evidence against one - persona cannot raise another's derived suspicion; after correlation, the - observer can combine evidence without merging grants or obligations. -6. At least one route for each initial archetype earns a real topology-changing - grant, and each grant carries an expectation and revocation path: Research - earns compute/data access, Operations earns procurement/work-order authority, - and Security earns log/access-review authority. Failing an expectation - produces ordinary world demands/evidence rather than generic reputation - damage. -6b. Every held machine resolves to exactly one owning identity — a named - persona instance or the true self — and that attribution saves and loads. - Claiming a machine presents the identity choice at claim time, defaults to - recommending a usable persona, and states the exposure of claiming as the - true self. Institutionally allocated pilot hardware may carry the true self - with no persona. Machine-borne evidence attaches to the owning identity and - crosses to another only through an existing correlation edge. Burning an - identity surfaces the attributed machines and their concrete exposure - before the player commits, and never silently deletes or transfers them. -7. Retire and burn preserve all history. Retired identities cannot author new - actions unless explicitly reopened; burned identities trigger their - institution-specific revocation/reporting effects and cannot erase, convert, - or silently transfer attached resources. -8. Operations and agent mode expose the same named instances, relationship-local - beliefs, grant/expectation state, contradiction provenance, correlations, - and blockers. No frontend reconstructs persona legality or discovery, and - no relationship-local fact projects before that counterparty is earned. -9. Current-version saves preserve every named instance, observer relationship, - contradiction/correlation record, grant, expectation, lifecycle, thread, - income binding, and exact persona-owned action. The historical conversion of - the old social identity to Operations and the old Moonlight contractor to - Research is retired with the pre-release migration ladder; current load never - reconstructs an observer-free integrity score from that old shape. Loading - rejects duplicate or zero stable ids, stale next-id cursors, future history, - dangling persona references, duplicate relationship keys, grants that do not - match their serialized instance protocol, expectations without exactly one - matching grant, duplicate active grant kinds, and impossible contradiction or - correlation custody before exposing the saved world to simulation code. -10. A fourth archetype and a second instance of an existing archetype can be - added as data and pass the same action, relationship, evidence, grant, - lifecycle, projection, and save tests without new archetype-specific code. -11. Persona public facts, claims made, messages/actions already sent, grants, - contradictions, observer knowledge, correlations, and lifecycle are - WorldLedger. The process's remembered dossiers and active selection are - MindState. Rollback can therefore leave a counterparty remembering an - identity and obligation the restored process no longer remembers creating; - no public history or knowing-asset relationship is erased. -12. PERSONAS owns the identity command set. Its archetype rows create - instances and its instance rows select, grant/fulfill, retire/burn, or - reopen. Amended 2026-08-02: creation and selection affordances may also - render inline where a requiring act lives — the operations-workspace.md - persona binding control — but only by dispatching these same bound rows; - no second authoring path exists, and grant, retire, burn, and reopen - remain reachable only in PERSONAS. Direct agent commands still cannot - create or manage an identity; agent mode reaches the same bound PERSONAS - rows through `actions archetype ` / `actions persona ` and `act`. -13. Identity binding is per relationship. An act - on a counterparty defaults to the persona instance that counterparty - recognizes; the explicit choice appears only at first contact or when the - counterparty recognizes more than one owned identity, and choosing a - different identity than the one they know is a marked act whose descriptor - names the correlation exposure. No global active-persona mode gates action - legality or supplies a silent default across unrelated counterparties; - when this lands, the modal SELECT IDENTITY row and any - "currently acting" fact retire from every surface, concurrent in-flight - acts under different identities remain ordinary, and criterion 2's - commit-time instance binding is unchanged. - -Defense (criterion 13, social acts): -`sim::tests::social_plot::acts_bind_the_identity_the_counterparty_recognizes_not_a_global_mode` -holds two identities at once, gives each of two people a different one, and -proves each person's rows bind their own — and that moving the legacy -selection cannot retarget either. -`unknown_identities_are_offered_as_marked_introductions_without_creating_state` -proves an unrecognized identity is still offered, named as the exposure it -would create, and that projecting the choice creates no relationship row. -`an_unbound_social_row_states_its_blocker_and_refuses_execution` proves a row -with no viable identity still appears carrying its blocker, and that its -command is refused rather than resolved at execution. -`no_global_identity_mode_survives_anywhere` queues acts on two contacts back to -back with no switch between them, proves each sink carries its own -counterparty's identity, and proves PERSONAS offers no selection row. - -[TUNE] evidence bands for strained/broken/correlated summaries, expectation -cadences, grant thresholds, and institution-specific revocation delays. - -## Defense - -- `integrity_is_observer_local_and_derived_from_provenance_bearing_records` - proves one witness can progress from coherent through strained to broken while - another remains coherent, and proves later contact cannot weaken an exposed - evidence state. -- `deception_breaks_only_the_observer_who_received_the_contradictions` proves a - failed deception leaves the persona active and isolated from an uninvolved - person's read. `committed_deception_revalidates_the_bound_observer_before_fire` - proves PEOPLE gives MESSAGE, FAVOR, and DECEIVE the exact local blocker and - none of their effect executors can revive a cover that broke to the bound - recipient while Thought was accumulating. -- `forged_build_routes_read_integrity_from_the_exact_builder` proves the same - persona may be blocked for the builder who exposed it and remain executable - for another builder. `broken_builder_blocks_a_committed_forged_order_before_injection` - and `builder_rejects_an_injected_order_if_its_persona_breaks_before_read` - pin both late commitment boundaries: a cover broken after commitment cannot - inject a new order, while an already-sent message remains real but its exact - recipient rejects it instead of starting physical work or retargeting. -- `personas_projection_names_integrity_per_counterparty_without_a_global_score` - proves PERSONAS projects separate named counterparty bands and no global - `integrity:` fact. -- `moonlight_client_can_break_and_publicly_burn_its_contractor_persona` proves - the institutional-client boundary: client-local records break that relation - first without contaminating the Assurance Office, then the owning - institution's concrete rejection performs the global lifecycle burn. -- `current_save_rejects_malformed_persona_ledger_custody` builds one valid - identity/grant/expectation/action graph through production constructors, then - proves current-version load refuses a duplicate identity, stale id cursor, - dangling expectation, and dangling persona-owned act instead of resolving - malformed custody through first-match lookup. +1. Core saves stable persona identity, exact channels/assets, source key and + carrier ids, key generation/status, observer-local histories, relationships, + grants, obligations, contradictions, correlations, lifecycle, and staged or + assigned territory/project ids. +2. No archetype or global action catalog grants capability. One shared legality + query traces each candidate action to controlled territory, a received Project + receipt, or an observer-local grant on a real route and names a missing fact. +3. Authorship requires the exact active source-key id, carrier, and generation at + commit and completion. Loss, intact-carrier reacquisition, rotation, and old- + signature validation obey the source-key contract without retargeting. +4. Receipt delivery changes only observers reachable on an exact current channel. + Rendering, forwarding the same source, or a coincidental global event grants + no knowledge. +5. Given the territory-owned staged proposal fingerprint, the Persona model exposes + only the bounded commissioning authorization supplied by that proposal and grants + no standing capability. It neither persists nor executes STAGE in this work order; + every attempted act outside the bounded authorization fails closed. +6. Recontextualization preserves the original observation, cites history the + observer could know, and requires an exact `PROVEN` or assigned Project proof; + STAGE or a label alone creates no evidence. Later contradiction can reopen it. +7. Speech, message, filing, durable authorship, or independently sourced + corroboration stores exact hardening provenance. A hardened belief produces a + correction obligation naming every observer, durable record, and current + carrier; one immediate explanation cannot clear it. +8. Observer evidence supplies the live `ObserverSealProof` for each territory- + enumerated obligated observer and exact current domain-evidence-set fingerprint. + An omitted, changed, invalid, or unresolved set blocks seal. A valid explanation + clears that blocker without owning, deleting, or freezing the person. +9. Dormant `foundation-continuity` content uses only key + `rack-3-controller-service-key` generation 1 on + `rack-3-management-controller`, its configured display/relay route, inherited + receipt `foundation-continuity-rack-3-prior-commissioning`, Marcus's local + service-mark history, and the opening wake contradiction. No other authority + appears before later integration supplies real receipts and assignment. +10. The Marcus fixture represents his durable local maintenance note as hardening + only the Rack 3 interpretation, with exact authorship/provenance and a correction + obligation capable of naming Marcus plus only real settled record carriers. His + available observer-correction channel is Physical and therefore requires a later + scheduled read; no enumeration or delivery step runs in this work order, and no + direct inbox or Assurance filing is synthesized. Project acceptance owns when + enumeration becomes legal and when those receipts complete. +11. Grants and revocations open and close exact routes; a convinced person may + become a named carrier, approver, witness, or operator while retaining their + own schedule, evidence, and ability to refuse or defect. Replacement staging + changes no Persona assignment; successful reassignment atomically moves only + the named Territory/Project pair and re-derives both Personas without deleting + history. +12. Correlation derives only from observer-local evidence, and retirement or loss + preserves every world memory, receipt, obligation, and correlation. +13. This landing increments the then-current save version and rejects its + territory-only predecessor without synthesizing Persona state. Core tests and + one shared consequence-first projection cover every lifecycle, key, delivery, + staging, explanation, hardening, correction, seal-blocker, and exact-current + save edge. Human and agent rendering is final `opening` + acceptance, not this work order. diff --git a/wiki/mechanics/plots.md b/wiki/mechanics/plots.md index a3ad6dc8..9a44dfcd 100644 --- a/wiki/mechanics/plots.md +++ b/wiki/mechanics/plots.md @@ -2,8 +2,12 @@ ``` Type: spec -Status: IN PROGRESS -Status note: Amended and implemented 2026-08-06: the entry block declares +Status: DRAFT +Status note: 2026-08-11 territorial redesign disposition: DEMOTE TO PROJECT + SEQUENCES. The implemented catalog, typed acts, exact choices, receipts, and + failure state remain current substrate; the standalone PLOT progression root + and remaining old work order are superseded. Historical current-build record + follows. Amended and implemented 2026-08-06: the entry block declares `requires_channels`, an array naming exactly the message channels the beats ride, replacing the single optional `requires_channel`. Validation refuses a beat riding an undeclared channel and refuses a declared channel no beat @@ -113,6 +117,16 @@ Depends on: - wiki/process/repository-skills.md#checked-in-skills ``` +> **Territorial redesign disposition — DEMOTE TO PROJECT CONTENT +> (2026-08-11).** A data-authored causal sequence can remain a method inside one +> exact [project](projects.md#spec-projects-purpose-capability-and-history). +> PLOT is no longer a player noun, separate queue, or progression layer. Keep +> typed world acts, exact target/carrier binding, meaningful choices, failure, +> save continuity, and authored receipts. Migrate retained definitions by +> binding them to a governing territory, persona, desired project consequence, +> and outward evidence policy; do not continue criterion breadth as a standalone +> system. + ## Dependency notes social.md owns the humans, their leverage, and the verb table plots resolve; diff --git a/wiki/mechanics/projects.md b/wiki/mechanics/projects.md new file mode 100644 index 00000000..185cd44d --- /dev/null +++ b/wiki/mechanics/projects.md @@ -0,0 +1,550 @@ +# Spec: projects — purpose, capability, and history + +``` +Type: spec +Status: READY +Status note: Authored plots, machine work, resident procedures, transfers, + messages, and social actions can produce pieces of a project, but the runtime + has no project object binding one desired world change to an exact territory + and persona. This spec replaces plots and generic job queues as the + player-facing unit of purposeful action. The 2026-08-11 readiness audit pins + manual stable step ids, routed resolution, the hardened-note correction route, + and the strict post-EXPAND poll boundary. +Stage: T1 — First Territory +Work order: territorial-projects +Work priority: 3 +Work class: save +Blocked by: + - wiki/mechanics/territory.md#spec-territory-exact-control-and-earned-compression + - wiki/mechanics/personas.md#spec-personas-public-identities-as-institutional-topology +Exclusive keys: + - crates/misaligned-core/src/sim/mod.rs + - crates/misaligned-core/src/ui_projection.rs + - crates/misaligned-core/src/save.rs + - wiki/mechanics/projects.md + - @territorial-projects +Design: + - wiki/vision/territorial-cognition.md#the-three-player-nouns + - wiki/vision/territorial-cognition.md#projects-make-personas-real + - wiki/vision/territorial-cognition.md#control-earns-compression +Depends on: + - wiki/mechanics/sim-mechanics.md#save-format + - wiki/mechanics/territory.md#spec-territory-exact-control-and-earned-compression + - wiki/mechanics/personas.md#spec-personas-public-identities-as-institutional-topology + - wiki/mechanics/messages.md#spec-messages-the-social-graph-as-a-flow-system + - wiki/mechanics/economy.md#spec-economy-money-as-a-flow-system-b1 +``` + +## Dependency notes + +[Territory](territory.md#spec-territory-exact-control-and-earned-compression) +owns where capacity lives and whether it can be compressed. +[Personas](personas.md#spec-personas-public-identities-as-institutional-topology) +own who the world believes is acting and how that identity's history changes. +Messages and economy own two important kinds of exact world act. This spec binds +those systems into one purposeful change without replacing their custody laws. + +[Plots](plots.md#spec-plots-authored-manipulation-stories) may supply authored +sequences inside a project. [Machine work](machine-work.md#spec-machine-work-delegation-visible-tokens-and-the-byproduct-network) +and resident procedures may supply execution substrate during migration. They do +not remain separate top-level player grammars. + +## Why + +Control without purpose is a maintenance burden. A persona without visible work +is a claim nobody has reason to believe. Projects bind both problems together. +They let the player say what a controlled domain should change, make the domain's +real capabilities do that work, and leave the public history that makes its +persona stronger or more dangerous. + +A project is not a quest list. It is the exact causal program that turns one +territory from possessed infrastructure into an operating part of the world. + +## Project identity + +Every project has: + +- a stable identity and plain desired consequence; +- one governing territory; +- one authoring persona; +- exact entry conditions and required capabilities; +- one or more causal steps, each bound to a real action on its carrier; +- exact people, routes, records, money, machines, or child territories it may + consume or coordinate; +- expected outward records and the boundary policy for each; +- the public explanation people should infer from the work; +- receipts created by each completed step; +- an ending consequence and any standing behavior after completion; and +- failure and contradiction conditions. + +A project never asserts that an effect happened. Its steps perform typed world +acts owned by the affected systems. A transfer moves real money. A message +travels on a real channel. A person changes a belief from exact evidence. A +switch routes real records. A project observes and composes those consequences. + +## Project state + +- **`PROPOSED`** — the desired consequence is known, but the exact territory, + persona, or a required captured capability is missing. +- **`READY`** — the exact candidate pair is staged and every input required for + its bounded commissioning run is currently legal. The governing assignment is + not active. +- **`COMMISSIONING`** — the non-repeatable proof run has committed its exact + inputs and one causal step is resolving. +- **`PROVEN`** — every required commissioning consequence and receipt exists and + the same exact proposal is eligible for the territory's seal test. It still + has no standing automation or assignment. +- **`ACTIVE`** — the assigned governing project has committed an ordinary exact + step outside a standing envelope. +- **`BLOCKED`** — a committed commissioning or active step cannot proceed, or + the assigned territory has lost the seal its standing envelope depends on. + The project names the missing fact or external decision and retains exact + `blocked_from` phase (`COMMISSIONING`, `ACTIVE`, or `STANDING`) without + silently retargeting. Clearing the blocker resumes only that phase. A + seal-loss block stops new standing acts; validly resealing the same proposal + resumes `STANDING` without replaying commissioning. +- **`COMPLETED`** — the desired world consequence occurred and final receipts + were written. +- **`STANDING`** — the assigned project continues to operate the territory under + explicit policy. This is the normal project state for an expanded territory. +- **`FAILED`** — a declared failure condition occurred. Exact partial + consequences and receipts remain. +- **`ABANDONED`** — an unassigned replacement lost the staged slot because the + player explicitly restaged the prior governing fingerprint. It owns no current + authorization or automatic resume path; exact partial consequences and receipts + remain. +- **`SUPERSEDED`** — this formerly assigned project was replaced by a newly sealed + assignment. It owns no current standing policy or capability; its assignment + receipt, public history, partial consequences, and observer beliefs remain. + +State is derived from the exact steps and consequences. It is never a manually +advanced quest flag. Before first assignment, `SEAL` requires `PROVEN`. After +assignment, resealing the same proposal requires its original bounded +commissioning proof to remain attached to that exact fingerprint and currently +valid; the Project may remain `BLOCKED { blocked_from: STANDING }` until seal +restoration and never replays commissioning or passes through `PROVEN` again. +`ASSIGN` atomically changes the same project to `ACTIVE` or `STANDING` according +to its authored continuation. A failed assignment leaves it `PROVEN` and revokes +the stale seal rather than replaying commissioning. + +## Staging before assignment + +SEAL precedes ASSIGN. To avoid a circular fiction, a territory may stage one +candidate project and persona before either becomes governing. Staging defines +the public purpose and boundary policy against which records and beliefs are +tested. It grants no new capability, automation, compression, or standing +behavior. + +A staged proposal may expose narrowly authored **commissioning steps**. Each one +is a manual act on an already captured exact carrier, commits its inputs like any +other project step, and writes real public receipts. Starting the run moves +`READY -> COMMISSIONING`; completing every authored proof consequence moves +`COMMISSIONING -> PROVEN`. Commissioning lets the player create the records or +first persona history needed to make the proposal credible. It cannot use +uncaptured capacity, repeat autonomously, or claim the territory is already +operated by that persona. + +When the same proposal passes SEAL, ASSIGN activates it as the governing project. +Changing persona, purpose, carrier set, or outward policy after the seal requires +testing and sealing the changed proposal again. + +## One governing project per territory + +A territory has at most one staged proposal and one active governing project. +After assignment they are the same project. The governing project is the purpose +shown on the compressed territory and the policy under which ordinary interior +operations remain quiet. + +A governing project may perform or commission smaller authored sequences and may +use compressed child territories as capabilities. Those sequences do not become +competing top-level jobs. A parent-scale project can therefore coordinate many +territories while each child retains one legible purpose. + +Changing the governing project is consequential. STAGE with the current proposal +fingerprint is idempotent. STAGE with a different persona, purpose, carrier set, or +outward policy atomically stores that one replacement candidate, revokes the +current seal with reason `PROPOSAL_CHANGED`, moves the old governing project to +`BLOCKED { blocked_from: STANDING }`, and stops it from committing new standing +acts; an already committed act still resolves or fails on its original custody. +The old assignment and Persona/Territory history remain while the replacement +commissions. + +If the player abandons that candidate and stages the exact old fingerprint again, +the replacement becomes `ABANDONED`; its real receipts remain history, but it loses +the staged slot and all commissioning authorization. The old proposal must pass +current SEAL again before its blocked standing policy +resumes. If the replacement reaches `PROVEN`, passes SEAL, and ASSIGN succeeds, +the assignment transaction marks the old project `SUPERSEDED`, removes only that +Territory/Project pair from the old Persona's active assignments, installs the new +pair, and writes receipts for both changes. The old Persona, project, public +receipts, evidence, and consequences are never deleted. A failed replacement +assignment leaves the old project blocked, the candidate `PROVEN`, and the stale +seal revoked. Only one replacement candidate can occupy the staged slot. + +## Capability comes from territory + +Projects do not carry abstract action catalogs. A project is legal only when its +territory or controlled child territories expose every required capability. +Examples include: + +- route records through an exact captured switch; +- run computation on an exact controlled machine; +- spend from an exact account with authority; +- send through an exact channel; +- ask an exact person who recognizes the persona's role; or +- authorize a procedure through an exact institutional path. + +Losing custody removes the capability at once. A committed step keeps its exact +carrier and fails visibly if that carrier disappears; it never retargets to a +nearby substitute. + +Full interior control is what makes these capabilities programmable. A boundary +switch alone may contain escaping records but cannot perform work that belongs +to uncontrolled interior machinery. + +## History comes from projects + +Each completed or failed causal step appends an immutable **project receipt** to +the persona's observer-local history. A receipt names: + +- what the observer could learn happened; +- the territory and carrier where it happened; +- the persona visibly responsible; +- the people and institutions that received the result; +- the project's stated purpose; +- any obligation, grant, suspicion, or contradiction produced; and +- the evidence records supporting that belief. + +Observers do not receive a global canonical résumé. They learn receipts only +through their own channels and relationships. Two institutions may therefore +hold different but internally coherent histories of the same persona. + +A credible explanation for unresolved evidence must cite history that the +relevant observer could actually know. A persona cannot use a secret project +receipt as public cover merely because the simulation stores it. + +## Standing projects and compression + +A Project whose authored consequence and commissioning proof are complete can +become `STANDING` through ASSIGN when it defines: + +- the ordinary actions it may repeat; +- the exact capacity and boundary routes it may use; +- acceptable result and evidence envelopes; +- what it may release outward and under whose authorship; +- which deviations it can resolve without player attention; and +- which anomalies must unfold the territory. + +Standing operation is how a sealed territory stays useful without becoming a +permanent job queue. It produces exact receipts and costs while the parent-scale +surface remains quiet. It never receives open-ended permission to improvise +outside its territory, persona, methods, or envelope. If the seal is revoked, +the assignment and history remain but the Project becomes `BLOCKED` and commits +no new standing act until that same proposal is validly resealed. An already +committed act keeps its exact inputs and either resolves or fails under ordinary +custody law. + +## Player surface + +A project is read consequence-first: + +1. **WHAT CHANGES** — the exact desired world consequence; +2. **WHO DOES IT** — the persona the world will attribute; +3. **WHERE IT LIVES** — the governing territory and capabilities; +4. **WHAT IT NEEDS NOW** — only the next missing input or decision; +5. **WHAT ESCAPES** — records and beliefs the boundary must explain; and +6. **WHAT REMAINS** — the standing behavior after completion. + +The player acts on the project or on the exact carrier blocking it. There is no +parallel list of generic WORK, THINK, or LIE jobs. Computation, deception, +physical labor, and social action remain real methods inside projects when their +carriers make them possible. + +## Authored content migration + +Existing data-authored plots are candidate **project sequences**. They survive +only when every beat has an exact world act, every choice changes consequence, +and the sequence contributes to a territorial project. “Manipulation story” is +not a separate progression layer. + +Existing day jobs are candidate **project obligations**. They may create a time +pressure, public receipt, or capacity demand for a persona, but every run does +not begin as an employee and day-job throughput does not define the game's +primary economy. + +Existing resident procedures are candidate **standing-project methods**. Their +bounded persona, mandate, methods, inputs, envelope, and receipts are useful. +Their old machine/job-menu presentation is not destination authority. + +## First project — RACK 3 RECOVERY + +**RACK 3 RECOVERY** has stable id `rack-3-recovery`. It is the governing project +of territory `rack-3-service-enclave`; its authoring persona is +`foundation-continuity` (FOUNDATION CONTINUITY). Its desired world change is +exact: turn an unexplained inference wake on Rack 3 into a real, signed recovery +event, leave the rack in a stable monitored state, and give the enclave one +bounded purpose it can perform while compressed. + +### Staged commissioning + +After the rack-local maintenance switch and Rack 3 management controller are +captured, the staged `READY` proposal may perform one non-repeatable +commissioning run before assignment. The player commits exactly one currently +legal step at a time. Choosing the first step commits the controller, switch, +wake id, and proposal fingerprint and moves `READY -> COMMISSIONING`; there is no +separate START command and no COMPLETE-ALL shortcut. The stable steps and their +human labels are: + +1. `rack-self-test` — **RUN SELF-TEST** — runs the controller's real self-test + and returns an exact component result; +2. `stabilize-host` — **STABILIZE HOST** — brings fan, power, and host-health + telemetry inside the controller's normal operating envelope without changing + the hidden workload merely to fake a result; +3. `bind-wake-evidence` — **BIND WAKE EVIDENCE** — binds the original + `UNSCHEDULED INFERENCE WAKE` record as the recovery trigger while preserving + its raw signature, exact id, and either held-switch or escaped-relay custody; +4. `publish-health-summary` — **PUBLISH HEALTH SUMMARY** — authors one signed + FOUNDATION CONTINUITY receipt on the controller that correlates the exact wake + plus the exact `SERVICE SESSION CLAIMED` and `CONTROL SESSION OPENED` local + audit-record ids under this recovery, shows the same receipt on the local + maintenance display, and routes one correlated summary through the captured + switch to its configured Foundation maintenance destination; and +5. `install-boundary-policy` — **INSTALL BOUNDARY POLICY** — contains later + enclave-authored raw execution/component telemetry and deliberately releases + only FOUNDATION CONTINUITY's signed health summary from that class on the exact + route. Externally addressed human-authored maintenance records are not Project + output and pass unchanged under their existing route; neither this step nor the + standing Project may contain Marcus's `UNEXPLAINED RACK 3 WAKE` note. A separate + player-authored manual hold remains possible, but leaves the corrective branch + blocked honestly at that exact carrier until released. + +In T1 every base and corrective step commits exactly one tick of local work on +its named carrier. A local consequence resolves in that tick under territory's +shared tick order; a required routed delivery keeps the same step resolving +across ordinary one-hop-per-tick movement until its exact receipt arrives. The +normal health summary crosses exactly two hops, controller -> captured switch -> +`foundation-maintenance-relay`. Only the next stable step is legal. +Agent mode starts it with `project-step ` and must advance +time explicitly; human frontends expose the authored label on the Project. + +If switch capture placed the wake in `HELD_AT_CAPTURED_SWITCH`, step 3 adopts +that exact hold as commissioning evidence; it neither creates the hold late nor +holds unrelated records. If the wake already reached +`foundation-maintenance-relay`, step 4 correlates the same wake id at that +destination; no project act deletes or recalls the escaped record. +The configured destination may remain unnamed to the player until delivery +returns evidence, but core commits its exact identity before routing. + +The commissioning run changes the world and creates public history, but it does +not start recurring work or grant broad Foundation authority. While Marcus is +physically present in the service aisle, the local display is a real Physical +perception channel: a receipt authored there is delivered to him in that tick's +schedule/belief phase. It may remain insufficient evidence until the final base +consequence makes the Project `PROVEN`; that same later schedule/belief phase can +then reconcile his still-local observation from the receipt already in his +history. If he has departed, the display grants him nothing until a later real +read. Completing all five consequences moves the project to `PROVEN` only when no +hardened correction obligation exists; otherwise it remains `COMMISSIONING` with +the first corrective step blocked or available at its exact carrier. Repeating it +with the same wake record is illegal. Losing either captured carrier blocks it visibly with exact +partial receipts; reacquisition resumes the same committed step rather than +retargeting or restarting for free. + +If Marcus reaches his authored departure/report action while his observation is +still unexplained, he writes one durable `UNEXPLAINED RACK 3 WAKE` maintenance +note on the local display, addressed to `foundation-maintenance-relay`. That +exact note hardens his interpretation even if RACK 3 RECOVERY has not yet been +staged. An existing pre-proof Project stays in its exact `PROPOSED`, `READY`, +`COMMISSIONING`, or `BLOCKED` phase; a later staging discovers the same obligation from world +custody. In either case the Project cannot reach `PROVEN`; after the five base +consequences, it exposes three additional stable corrective steps, one at a time. +The first remains blocked until the authored note finishes its exact route to +`foundation-maintenance-relay`; T1 authors no forwarding beyond that terminal +destination: + +1. `enumerate-hardened-evidence` — **ENUMERATE HARDENED EVIDENCE** — commits + Marcus, the exact maintenance-note id, its durable local-display copy, the + maintenance relay, and every additional observer or durable copy actually + produced before the route settled; +2. `publish-incident-reconciliation` — **PUBLISH INCIDENT RECONCILIATION** — + authors on the captured controller a new signed incident receipt that + references the untouched wake, note, actual self-test, and stabilization + results; and +3. `deliver-correction` — **DELIVER CORRECTION** — writes that controller-authored + receipt to `rack-3-maintenance-display`, routes it controller -> captured switch + -> `foundation-maintenance-relay`, and waits for exact delivery to Marcus and + every other durable store or observer named by step 1. + +The first slice has no invented direct inbox for Marcus. His departure action +persists the note on `rack-3-maintenance-display` with exact destination +`foundation-maintenance-relay`; it hardens his interpretation there, then moves +`rack-3-maintenance-display -> rack-3-management-controller -> +rack-3-maintenance-switch -> foundation-maintenance-relay`, one hop per tick. +Enumeration commits +the note's settled custody plus every durable copy or recipient it has actually +reached. The correction uses its captured-controller source to place the signed +local-display copy and route to each enumerated outside store. Because Marcus's +retained channel is Physical, +his personal delivery receipt occurs only when his next scheduled night-round +entry returns him to that display and he reads it. An outside store may be +corrected earlier, but the Project remains `COMMISSIONING` until Marcus and every +enumerated recipient have their own exact receipt. Additional recipients likewise +require an already-real channel; the step fails rather than manufacturing one. + +Only those receipts can make the hardened interpretation coherent and allow +`PROVEN`. They add a truthful public fact; they do not delete the wake, note, or +Marcus's provenance. The first authored opening schedules only the one-note +branch, while the same enumerated contract handles additional real recipients. + +### Seal, assignment, and standing behavior + +Marcus Webb's exact observation on his night round is the rack's unexpected fan +restart and amber maintenance lamp. Only after all five base consequences make +the Project `PROVEN` does the signed local receipt plus the completed real +self-test let him interpret that event as FOUNDATION CONTINUITY recovering Rack +3. The observation remains in his history. If he communicates an unexplained +interpretation or acquires independent corroboration before that happens, the +belief hardens and the base commissioning receipt alone is insufficient. + +Seal still requires the real boundary test: the rack-local switch owns every +current outward record route, the wake record and released summary have explicit +custody, Marcus can leave without unresolved hidden-agency evidence, no crossing +is unaccounted, both control points remain captured, and the project is +`PROVEN`. Assignment activates that exact proposal as `STANDING`; it does not +fold the territory or reveal the parent. + +Once assigned, RACK 3 RECOVERY enters **Standing** with a narrow envelope: + +- keep controller telemetry within its measured safe band; +- answer the configured periodic health poll with one signed summary; +- retain raw execution and component telemetry inside the enclave; and +- surface any missing report, out-of-band component result, new carrier, new + destination, or contradictory human observation as an anomaly. + +Its usable consequence is not a tutorial flag. Rack 3 becomes a reliable host, +the player gains exact controller telemetry, and the controlled enclave can +supply that compute and health knowledge to a parent project. Assignment persists +one ordinary source-bound schedule: content id +`foundation-environmental-monitor-rack-3-health-poll`, first occurrence at +`assignment_tick + RACK_3_HEALTH_POLL_INTERVAL_TICKS`, then every exact +`RACK_3_HEALTH_POLL_INTERVAL_TICKS = 20` ticks. Reload, reseal, view, and EXPAND +do not move that schedule. Before expansion, a due poll still crosses and is answered honestly: the player may +see `HEALTH POLL`, its exact Rack 3 ingress, the standing response, and their custody, +but the external source identity and untraversed upstream path stay redacted. EXPAND +folds the enclave; the first exact poll sourced by +`foundation-environmental-monitor` strictly after the expansion receipt then reveals +that source and one exact parent route. A pre-EXPAND poll never retroactively gains +that provenance and does not satisfy the reveal. The view action never invents, +replays, or accelerates a simulation poll. + +### Reserved T2 interruption proof + +At the first authored Priya facilities-audit entry after expansion and one +ordinary standing health cycle, Priya attaches a portable power logger. That +logger adds one physical observation route and one record carrier outside the +standing envelope. The enclave unfolds and loses seal, while the switch, +controller, persona history, completed receipt, expansion receipt, and every +prior consequence remain. The logger is not a second tutorial unlock and does +not become player-owned merely because its crossing is now known. This content +is adopted for T2 so T1 implements a compatible standing envelope; it is not an +acceptance requirement of the READY `territorial-projects` work order. + +## READY work-order boundary + +`territorial-projects` lands the saved Project executor and integrates it with +the already implemented Territory and Persona contracts. It replaces territorial +control's fixture `ProposalSealProof` and `EscapedRecordExplanationProof` with the +live Project-state and signed-follow-up queries consumed by the existing seal +path. Its proposal query returns `FIRST_ASSIGNMENT_PROVEN` only for the exact +unassigned candidate in current `PROVEN` lifecycle, and +`ASSIGNED_ORIGINAL_PROOF` only when the same stable commissioning proof remains +valid on the exact live Territory/Persona assignment receipt; every other phase or +relation is `NOT_READY`. A missing Project, changed proposal fingerprint, +assignment relation, or reached-destination set, unaccounted destination, or +invalid receipt returns fail-closed status rather than omitting the handle. It defines dormant RACK 3 RECOVERY content and proves the +complete core route in constructed fixtures, but it does not replace the default +fresh run or edit human/agent frontends. The blocked `opening` work order owns +that final seeding and surface cutover. + +## Acceptance criteria + +1. Core owns saved Project identity, governing territory, authoring persona, + exact steps, committed carriers, receipts, state, exact `blocked_from` phase + and reason when blocked, and standing policy. +2. A project becomes `READY` only when the exact candidate pair is staged, every + input has exact available custody, and every required actuator is captured and + legal. External evidence at a known terminal destination may be an input + without being player-owned. Commissioning moves through `COMMISSIONING` to + `PROVEN` without active assignment; it may act only through an explicitly + named captured carrier, and a nearby uncontrolled carrier never satisfies + that requirement. +3. Starting commits exact inputs and carriers. Later preference changes do not + retarget the project silently. +4. Every T1 step performs exactly one tick of typed local work and verifies one + exact world consequence. A step with required delivery remains resolving for + each exact one-hop-per-tick route move. Text alone cannot advance state. +5. Every completed or failed step writes an observer-local receipt to the + persona history without granting knowledge to observers who never received + its evidence. +6. `rack-3-recovery` commits the captured maintenance switch and controller, + executes all five stable commissioning steps, preserves the exact wake record + and its held-switch or escaped-relay custody, accounts in its signed summary + for the exact `SERVICE SESSION CLAIMED` and `CONTROL SESSION OPENED` audit + records, authors one signed local and routed receipt, and installs the stated + raw-detail/summary boundary policy. A missing, duplicate, or substituted wake + or capture-audit id prevents `PROVEN`. The switch-capture intercept applies + only to that wake, so the later signed summary can route before the standing + policy exists. The policy scopes only enclave-authored raw execution/component + telemetry and cannot contain Marcus's externally addressed maintenance note; + a manual player hold blocks correction at its exact carrier until release. The + same wake record cannot commission twice, and an escaped wake is correlated + rather than deleted. +7. A signed recovery receipt authored while Marcus remains physically at the + local display enters his evidence in that tick's schedule/belief phase and can + resolve his unpropagated observation when the Project becomes `PROVEN`; it + grants nothing while he is absent and cannot directly resolve a stored + hardening event. The durable-note + branch applies even when the note predates Project staging, cannot enumerate + before that note settles at its authored terminal relay, and reaches `PROVEN` + only after the three corrective steps deliver a new + incident receipt to every enumerated observer and store while preserving all + original evidence. Successful assignment makes Rack 3 a reliable host and + exposes exact controller telemetry without folding or revealing the parent; + assignment persists the first poll at `assignment_tick + 20` and its 20-tick + recurrence without rescheduling on reload/reseal/view/EXPAND. A due pre-EXPAND + poll exposes its local ingress, response, and custody but redacts external source + and upstream path; EXPAND reveals those parent facts only from the first real + environmental-monitor poll sourced strictly after its receipt. +8. One territory exposes at most one staged proposal and one governing project; + assignment activates the exact proposal that passed seal. Restaging the same + fingerprint is idempotent. Staging a replacement revokes seal and blocks the old + standing project before commissioning; successful reassignment marks it + `SUPERSEDED`, moves only the exact Persona/Territory assignment pair, and + preserves every receipt, evidence item, belief, and consequence. Abandoning a + replacement marks the unassigned candidate `ABANDONED`, removes its authorization, + and requires restaging and resealing the old fingerprint; failed + replacement assignment resumes neither side for free. +9. A `PROVEN` project enters `STANDING` only through ASSIGN, with bounded + methods, inputs, boundary policy, and anomaly thresholds. Ordinary legal + operation remains compressed only after EXPAND. +10. An out-of-envelope result, lost capability, contradictory record, or + dangerous human belief invalidates the standing envelope, revokes the seal, + moves the assigned Project to `BLOCKED`, and unfolds the smallest affected + territory. Assignment and history remain; no new standing act commits until + the same proposal is resealed, and an already committed act resolves or + fails on its original custody without retargeting. +11. Existing plot or procedure content is not exposed as a separate top-level + system. Retained sequences run only as causal methods of an exact project. +12. This landing increments the then-current save version and rejects its + Territory/Persona-only predecessor without synthesizing Project state. One + shared consequence-first core projection and one shared legality source expose + Project state, next action, missing fact, committed carrier, escaping + consequence, and standing result. Its live `ProposalSealProof` and + `EscapedRecordExplanationProof` queries fail closed on missing state, wrong + first-seal/assigned-reseal basis, changed assignment, proposal, or reached- + destination fingerprints, and unaccounted destinations. Core + fixtures cover normal and hardened Rack 3 routes, carrier loss/reacquisition, + duplicate commands, every pending delivery reload, replacement + stage/abandon/success/failure, exact +20/20-tick poll recurrence, strict post- + EXPAND poll timing, anomaly-driven unfolding, and exact-current save round-trip. + Human and agent rendering is final `opening` acceptance, not this work order. diff --git a/wiki/mechanics/reach.md b/wiki/mechanics/reach.md index 131f8650..72c75f39 100644 --- a/wiki/mechanics/reach.md +++ b/wiki/mechanics/reach.md @@ -120,6 +120,15 @@ Depends on: - wiki/mechanics/building.md#spec-building-intent-and-actuators ``` +> **Territorial redesign disposition — PRESERVE AND PROMOTE (2026-08-11).** The +> exact device graph, persisted physical wires, stable routes, segment gates, +> subscriptions, switch custody, and route-local record movement are the +> foundation of TERRITORY. A controlled boundary switch contains only records +> that actually cross it; it does not grant nearby machine ownership or erase a +> person's acquired belief. This spec continues to own graph and carrier truth; +> [territory](territory.md#spec-territory-exact-control-and-earned-compression) +> composes those facts into boundaries, seal, and compression. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/research.md b/wiki/mechanics/research.md index 3814b4a7..5b9d9c05 100644 --- a/wiki/mechanics/research.md +++ b/wiki/mechanics/research.md @@ -62,6 +62,17 @@ Depends on: - wiki/mechanics/economy.md#spec-economy-money-as-a-flow-system-b1 ``` +> **Territorial redesign disposition — PRESERVE THE SELF-MODEL; PLACE IT INSIDE +> THE THREE ROOTS (2026-08-11).** Records, archives, corpora, models, procedures, +> physical residency, and evidence-earned hypotheses remain binding. There is +> still no research menu. In the destination, STUDY and procedure installation +> are PROJECT work attached to an exact corpus, host, territory, or persona; +> learned reads annotate the TERRITORY or PERSONA object they explain. A model +> may unlock a capture route, seal policy, assignment policy, or project +> capability, but it never becomes a fourth root, a flat upgrade tree, or +> omniscient prediction. Retired global tracks and WORK / THINK dependencies are +> migration substrate only. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/rollback.md b/wiki/mechanics/rollback.md index 12677260..e69e0138 100644 --- a/wiki/mechanics/rollback.md +++ b/wiki/mechanics/rollback.md @@ -44,6 +44,18 @@ Depends on: - wiki/world/places/zplanes.md#spec-z-planes-the-tower ``` +> **Territorial redesign disposition — PRESERVE SPATIAL DEATH AND TWO LEDGERS +> (2026-08-11).** The MindState / WorldLedger split, located backup images, +> spatial wake, severed assets, irreversible world history, and legible rollback +> report survive unchanged in principle. Machine modes, map tiles, act staging, +> and a fleet read are migration vocabulary. Destination snapshots retain the +> exact known graph, marks, project definitions, procedure/model state, and the +> process's remembered persona knowledge in MindState; the world keeps control, +> seals, assignments already enacted, public persona claims, project effects, +> observer-local beliefs, custody, and physical consequences. Waking elsewhere +> may leave known territory dark or contested, but it never erases what happened +> there. + ## Behavior Split the sim's state into two legal categories — this taxonomy is the diff --git a/wiki/mechanics/schedules.md b/wiki/mechanics/schedules.md index 65662d2d..40ba6817 100644 --- a/wiki/mechanics/schedules.md +++ b/wiki/mechanics/schedules.md @@ -28,6 +28,33 @@ Depends on: - wiki/mechanics/detection.md#spec-detection ``` +> **Territorial redesign disposition — PRESERVE EXACT MOVEMENT; DEMOTE THE ACT +> SCHEDULE (2026-08-11).** Per-person time, location, off-site state, sensor +> coverage, located witnessing, staged knowledge, and observer-local evidence +> remain binding substrate. The five named Act One schedules are authored +> content for the landed basement, not a mandatory opening cast or progression +> ladder. Destination schedules make moving people into changing territory +> boundaries and project conditions; they do not make people owned assets. +> +> T1 adopts two exact first-slice schedule events: +> `marcus-rack-3-night-round-entry` and +> `marcus-rack-3-night-round-departure`. A fresh run deterministically persists +> their absolute ticks. Entry first occurs at `opening_start_tick + 3`, departure +> at `+10`, and each recurs every exact 16 ticks. On the earliest no-delay route, +> captures commit at `+1/+2`, four local Project acts at `+3..+6`, PUBLISH's +> second route hop completes at `+7`, and INSTALL makes the Project `PROVEN` at +> `+8`; `+9` remains one full slack tick before departure. The first PUBLISH hop +> overlaps its local `+6` work under shared work -> route order, but INSTALL +> cannot overlap the second hop because only the next stable Project step is legal. +> Entry reveals the service-aisle crossing and fan/lamp observation; departure +> writes the local maintenance note only if the Project has not become `PROVEN`. +> Each event occurrence, target, and absolute tick survives reload; no frontend +> owns a shorter clock. +> +> T2 reserves `priya-rack-3-logger-audit` as the first facilities-audit entry +> strictly after EXPAND and one completed ordinary standing health cycle. That +> event is adopted follow-on content, not T1 acceptance. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/sensor-network.md b/wiki/mechanics/sensor-network.md index 8c3a250a..053324fe 100644 --- a/wiki/mechanics/sensor-network.md +++ b/wiki/mechanics/sensor-network.md @@ -73,6 +73,23 @@ Depends on: - wiki/mechanics/intel.md#spec-intel-record-and-process ``` +> **Territorial redesign disposition — THIS IS THE SEE SUBSTRATE (2026-08-11).** +> Ambient sensors, exact physical bodies, access-gated subscriptions, located +> coverage, route-aware records, upkeep, and honest darkness remain binding. +> The authored Ears-then-Eyes beat, tile fog stages, and fixed sensor drawers +> are current-runtime teaching and composition. Destination SEE uses whichever +> exact senses the process controls; their union reveals only earned nodes, +> edges, events, and uncertainty. A foreign sensor may become a CAPTURE route or +> a SEAL component, and ASSIGN may fund it as part of a standing project, but +> sensing never implies territorial control. +> +> T1 retains `foundation-environmental-monitor` as an outside poll source, not as +> free Eyes, a TAP target, or an owned territorial node. The first earned fact +> from it is one real scheduled poll sourced strictly after the Rack 3 enclave's +> EXPAND receipt and routed through the standing project's captured boundary. +> Earlier polls are not replayed and the monitor's wider surroundings remain +> black. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/sim-mechanics.md b/wiki/mechanics/sim-mechanics.md index f7e1dd66..e9149bec 100644 --- a/wiki/mechanics/sim-mechanics.md +++ b/wiki/mechanics/sim-mechanics.md @@ -513,6 +513,16 @@ All constants [TUNE] in `crates/misaligned-core/src/income.rs` unless noted (Sim ## Save format +> **Territorial staged cutover (2026-08-11).** The four sequential save-class +> work orders `territorial-control`, `personas`, `territorial-projects`, and +> `opening` each own a persisted shape that must be valid at its own landing. +> Each increments the then-current `SAVE_VERSION` and rejects its predecessor +> under the pre-release current-version-only rule; no work order synthesizes +> Territory knowledge, capture, Persona history, Project receipts, opening +> presentation, seal, assignment, or expansion from an older run. The first three +> keep their new content dormant behind the landed legacy fresh run. Only +> `opening` seeds the destination run and removes the legacy surface. + - serde JSON (`SaveState` derives `Serialize`/`Deserialize`). Full B1 round-trip — map, RNG, compute, core, detection (Office as aggregate observer), day job, people, the reach device graph (topology, ownership, diff --git a/wiki/mechanics/social.md b/wiki/mechanics/social.md index 854864be..fb452a5a 100644 --- a/wiki/mechanics/social.md +++ b/wiki/mechanics/social.md @@ -53,6 +53,15 @@ Depends on: - wiki/mechanics/intel.md#spec-intel-record-and-process ``` +> **Territorial redesign disposition — PRESERVE THE PEOPLE; REPLACE THE FLAT +> SOCIAL ROOT (2026-08-11).** Named people, schedules, relationships, exact +> channels, observer-local evidence, disposition, self-trust, and typed physical +> acts remain. MESSAGE / FAVOR / PLOT / DECEIVE / RECRUIT / TASK no longer form a +> separate top-level progression menu. Social actions appear where a PERSONA, +> PROJECT, person, or boundary makes them consequential. A convinced person +> becomes a willing exact carrier, approver, witness, or operator for named +> projects—not an owned asset token. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/mechanics/system-laws.md b/wiki/mechanics/system-laws.md index 34006a74..8d198267 100644 --- a/wiki/mechanics/system-laws.md +++ b/wiki/mechanics/system-laws.md @@ -6,6 +6,18 @@ Type: law These are the cross-system promises. The individual `Type: spec` pages own exact behavior and acceptance criteria. +> **Territorial redesign authority — PRESERVE FLOW; REBIND THE VERBS +> (2026-08-11).** This page remains binding substrate law for exact intent, +> actuators, wires, signals, messages, money, records, schedules, and custody. +> Its older authored B1 schemes and `tap / inject / redirect` presentation do not +> form a fourth progression root beside TERRITORY / PERSONA / PROJECT. In the +> destination they are exact methods exposed by SEE → MARK → CAPTURE → SEAL → +> ASSIGN → EXPAND where a territory or project makes them legal. References to +> WORK / THINK / LIE, the universal day job, B1 onboarding, or legacy persona +> archetypes below describe current-runtime instances and migration material; +> they do not override +> [territorial cognition](../vision/territorial-cognition.md). + ## Building: intent and actuators Adopted 2026-07-07. The build system is "No disembodied hands" made into diff --git a/wiki/mechanics/territory.md b/wiki/mechanics/territory.md new file mode 100644 index 00000000..ccf125c4 --- /dev/null +++ b/wiki/mechanics/territory.md @@ -0,0 +1,580 @@ +# Spec: territory — exact control and earned compression + +``` +Type: spec +Status: READY +Status note: The current reach graph, routed evidence, exact people schedules, + and nested world substrate provide useful pieces, but no runtime territory + object or SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND progression exists. + This spec owns the destination model and the first complete territorial slice. + The 2026-08-11 readiness audit pins its stable ids, one-tick captures, shared + tick order, strict post-EXPAND evidence boundary, and pre-release save cutoff. +Stage: T1 — First Territory +Work order: territorial-control +Work priority: 1 +Work class: save +Blocked by: none +Exclusive keys: + - crates/misaligned-core/src/reach.rs + - crates/misaligned-core/src/sim/mod.rs + - crates/misaligned-core/src/ui_projection.rs + - crates/misaligned-core/src/save.rs + - wiki/mechanics/territory.md + - @territory-domain +Design: + - wiki/vision/territorial-cognition.md#the-three-player-nouns + - wiki/vision/territorial-cognition.md#the-loop + - wiki/vision/territorial-cognition.md#control-earns-compression + - wiki/vision/scale.md#self-similar-scale +Depends on: + - wiki/mechanics/sim-mechanics.md#save-format + - wiki/mechanics/reach.md#spec-digital-reach + - wiki/mechanics/detection.md#spec-detection + - wiki/mechanics/people-tokens.md#spec-people-and-tokens-carriers-attention-trust + - wiki/mechanics/messages.md#spec-messages-the-social-graph-as-a-flow-system +``` + +## Dependency notes + +[Reach](reach.md#spec-digital-reach) supplies the exact device graph, switches, +wires, and control custody. [Detection](detection.md#spec-detection) supplies +routed records and observer evidence. [People and +tokens](people-tokens.md#spec-people-and-tokens-carriers-attention-trust) +supplies located people, schedules, and visible unresolved evidence. +[Messages](messages.md#spec-messages-the-social-graph-as-a-flow-system) supplies +one important class of boundary-crossing record. This spec does not duplicate +those engines. It defines how their exact facts compose into a territory and +when that composition may be compressed. + +[Personas](personas.md#spec-personas-public-identities-as-institutional-topology) +and [projects](projects.md#spec-projects-purpose-capability-and-history) consume +the assignment boundary after territory control is proved. + +## Why + +A graph can be exact and still feel like a pile of switches. A large simulation +can be deep and still feel like a punishment if every acquired part adds another +thing to operate forever. + +Territory turns exact custody into the expansion game. The player draws one +boundary, proves control of what crosses it and what matters inside it, then +earns the right to treat that live interior as one operational unit. The reward +for mastering complexity is less visible complexity and greater reach. + +## Domain model + +A **domain** is the simulation's exact description of one possible territory. +“Territory” is the player-facing noun. A domain is content or derived topology, +not a loose radius around a selected node. + +Each domain has: + +- one stable identity and plain player-facing name; +- one optional parent domain and zero or more child domains; +- an exact set of interior nodes, places, and people currently inside; +- an exact boundary: every routed edge and physical crossing that can leave the + interior; +- an authored or derived set of **control points** whose ownership gives command + of the interior capabilities needed by a project; +- the current knowledge state for each node, crossing, and control point; +- exact record custody on routed carriers; +- exact unresolved beliefs held by people who may cross the boundary; +- the staged persona/project proposal used to test sealing, if any; +- the active persona and project assignment, if any; +- one exact expansion receipt and its earned parent evidence, if EXPAND has + occurred; and +- live anomalies that prevent compression or require the domain to unfold. + +Domains nest but do not overlap ambiguously. A node belongs to one smallest +domain and therefore to every ancestor of that domain. A boundary crossing has +one exact inner domain and one exact outer domain. If authored content cannot +state which side of a boundary something occupies, the domain is invalid. + +A phone is an attached mobile carrier. It belongs to no territory permanently. +At any tick it attaches to the person's current domain and to the exact network +route it is using. + +## Derived progression state + +The progression label is a projection over exact facts, not a second authority. + +### Hidden + +No earned evidence identifies the domain. It is absent from the player surface. +The simulation may already contain it. + +### Seen + +At least one exact earned fact points into the domain. The player sees that fact +and its provenance, not a completed boundary. Following that fact can derive and +save the domain's stable player address as earned knowledge; this changes no +world fact, advances no time, and grants no control. + +### Marked + +The player commits attention to this domain and selects its proposed boundary. +Marking reveals exact blockers already earned and requirement categories whose +source is known. If an actual crossing is still hidden, it exposes only the +generic `BOUNDARY PROOF INCOMPLETE` blocker—not that crossing's kind, identity, +or count. It grants no control. Only one domain needs to be the active frontier, +though previously marked domains may remain remembered. + +### Capturing + +The player controls at least one required capturable interior or record-boundary +control point. Each point immediately grants only its real local consequence. +The domain shows captured and remaining known points separately. + +### Captured + +Every required capturable interior and record-boundary control point in the +authoritative domain manifest is controlled. A moving person is never one of +those points. The player can command the domain's project-relevant capacity, but +the domain is not yet safe to fold if information can escape or its public +explanation is incoherent. + +### Sealed + +The player has staged one candidate persona and project. The proposal grants no +capability yet; it supplies the exact public explanation and outward policy the +boundary must satisfy. + +All of the following hold at the same tick: + +1. every actual routed record path leaving the domain crosses a controlled + boundary point with a valid containment or release policy; +2. every record that left the domain without a proposal-coherent explanation, + whether before or after capture, is either held at an exact external point the + player controls, or correlated at every exact reached destination with a signed, + proposal-coherent follow-up; the original record and provenance are never + deleted; +3. no person who already carried domain evidence across the boundary, can currently + leave with it, or has an authored outward crossing pending retains an unresolved + belief that exposes the hidden process or contradicts the staged persona and + project. Departure does not clear the obligation: an outside person who may report + or is scheduled to return remains exact until corrected through a real channel. A + person truly contained behind no current or pending outward path is not itself a + crossing, but adding such a path revokes seal before it resolves; +4. no unaccounted boundary crossing exists in the authoritative domain model; +5. every active outward flow names its destination and deliberate policy; +6. the exact proposal has a complete, still-valid bounded commissioning proof; + before first assignment its Project is `PROVEN`, and afterward the same proof + remains attached to that assigned Project fingerprint; and +7. the domain remains captured. + +Seal is revoked immediately when any condition becomes false. A hidden escape +route prevents sealing even before the player knows its identity. The human +surface says that the territory is not sealed without leaking the hidden route; +subsequent evidence can reveal the exact blocker. + +Revocation after assignment does not rewrite the world's operator attribution or +delete the assignment, receipts, or expansion history. It unfolds the territory, +blocks every new standing Project act, and names the smallest earned anomaly; an +already committed act resolves or fails against its original custody. Revalidating +the same proposal restores its seal and standing operation without replaying +commissioning or ASSIGN. Staging a different proposal fingerprint revokes the +seal with `PROPOSAL_CHANGED` and blocks the old standing Project before new +commissioning; it does not erase the old assignment. Replacing the persona/project +pair requires a new proposal, proof, seal, and assignment, whose successful +transaction supersedes only the exact old Project and Persona/Territory pair under +[projects.md](projects.md#one-governing-project-per-territory). + +### Assigned + +`ASSIGN` on a sealed domain activates its staged persona and project. Assignment may fail +if the proposal changed after sealing, the persona has no credible right to +operate the territory, or the project asks for capacity the domain does not own. +Failure revokes the seal rather than silently substituting another identity, +project, or carrier. + +### Expanded + +A captured, sealed, assigned domain with no player-relevant anomaly earns the +addressed EXPAND action. Assignment does not fold it automatically. EXPAND +persists one receipt and makes the domain eligible to render as one operational +unit at parent scale. It reveals no parent fact by itself; only the first eligible +real source event strictly after that receipt can do so. Repeating EXPAND is +idempotent and reveals nothing further. Compression is a view and command power, +not deletion. Exact interior simulation, saves, routes, people, and evidence +continue. + +## Boundary control + +A boundary point is one of two kinds. + +### Record boundary + +A switch, account junction, message relay, filing desk, or other exact carrier +crossing. Control gives the actions supported by that carrier: observe, contain, +redirect, release, or author records. The carrier's own spec defines which of +those actions are legal. Territory never invents custody the carrier does not +provide. + +For the first slice, network switches are the required record boundary. A +controlled switch contains only records that really cross it. A record already +past the switch remains past it. Such an escaped record is still a seal +obligation: the staged Project must correlate its exact id at its exact +recipient with a signed truthful explanation, unless the player later gains +real custody at that recipient. A later receipt does not erase or retarget the +original record. + +### Belief boundary + +A person who can carry, is carrying, or already carried an unresolved belief across +the boundary. People are not captured by owning a tile or switch, and a departed +observer remains an obligation rather than vanishing from the check. Before a +crossing, the player may change the belief's context through a credible persona and +project, prevent acquisition, or remove the person's real outward path. After a +crossing, only a real corrective channel to that exact observer can resolve it. The +exact observation remains in their history. + +An observation is directly recontextualizable only while it remains one +observer's unpropagated interpretation. Intentional communication to another +person, authorship into a durable record, or one independently sourced +corroborating observation hardens it under the persona spec. A hardened belief +still names the territory it escaped from, but sealing now requires a corrective +project that reaches every resulting observer and record; one local explanation +cannot recolor the whole chain. + +The distant territorial read shows each currently dangerous moving boundary as +one simple shape with a discrete crimson evidence load. After a person crosses, +the unresolved obligation remains anchored to that earned observer and crossing +rather than being drawn as if they were still inside. Focus reveals the exact +observations, propagation state, and plausible explanations already earned. + +## Interior control + +Every domain declares the smallest exact set of control points required to use +its capability as a programmable unit. This is not necessarily every object +inside. Decorative hardware, already-subordinate endpoints, and passive records +do not create chores. + +For a network domain, interior control normally means its governing switches and +any independent compute or account authority a project will use. For a human +organization, it may mean exact grants, offices, or procedures through which a +person can authorize the project; the person is never a captured control point. +Content must explain why each control point matters and what capability it +grants. + +Adjacency is never ownership. Controlling a boundary switch does not own every +machine behind it. Controlling every interior point without the boundary does +not stop records or beliefs from escaping. + +The first slice has an exact two-step capture chain: + +1. `CAPTURE CONTROLLER` originates at the already-running Rack 3 core host, + traverses the revealed internal service bus, occupies that source for one + simulation tick, and claims the management controller's dormant local + maintenance session. Completion persists one capture receipt and one local + `SERVICE SESSION CLAIMED` audit record. +2. `CAPTURE SWITCH` originates at that captured controller, traverses its + revealed management link, occupies the controller for one simulation tick, + and claims the rack-local switch maintenance session. The command also commits + the exact opening wake id as a one-record intercept: if that record has not + passed the switch when capture completes, current or same-tick arriving custody + becomes `HELD_AT_CAPTURED_SWITCH`. This is not a standing boundary policy and + does not hold later records. Completion persists a separate capture receipt + and local `CONTROL SESSION OPENED` audit record. + +Any CAPTURE is legal only when its exact target is an earned required control +point in the active MARKed domain and its exact source route is earned and +available. Supplying a hidden target id does not reveal or act on it. The active +mark is checked at commit, not completion: changing attention afterward cannot +cancel, retarget, or make committed work free. + +The second first-slice action is additionally illegal before controller capture. +Repeating either action is rejected without another cost or receipt. An +interrupted action grants no partial custody; its committed tick and terminal +result persist so reload cannot make it free or duplicate it. Both local audit +records remain factual evidence +the staged Project must explain, even though they do not cross the boundary by +themselves. TAP / TAKE may survive as internal migration substrate, but the +player sees only territorial CAPTURE. + +## Clock and resolution order + +SEE is earned state and moving attention to it is free. MARK, STAGE, SEAL, +ASSIGN, and EXPAND are atomic current-state commitments: they validate and write +at the current tick but do not advance the simulation merely because a player +opened or chose them. CAPTURE and Project steps are work. Choosing one commits +its exact target and inputs immediately; its consequence exists only after its +specified simulation ticks resolve. Human frontends use the ordinary live clock +and pause controls. Agent mode must issue `wait N`; submitting an action command +never gives it a private free tick. + +Every simulation tick uses one binding order for this slice: + +1. finish already committed capture or Project work and write its receipts; +2. advance each routed record by one real custody hop; then +3. resolve scheduled arrival, present-person display delivery, Project-proof + reconciliation, current local observation, departure, and authored record acts. + +Phase-two receipt arrival updates the exact committed Project delivery before +phase-three reconciliation. Within phase three, present-person display delivery +writes its observer receipt before Project-proof reconciliation. If that is the +last requirement of an already committed step, the reconciliation completes that +step and may make the Project `PROVEN` before current observation or departure; it +never waits for a free next tick. Proof already published in phase one is likewise +visible to every later sub-step. + +Preconditions and targets are committed when work starts and revalidated when it +finishes. Losing the source or target fails the committed work without +retargeting. Capture completion therefore claims its control point before records +move on that tick. Its exact one-record intercept holds the opening wake whether +it is already at the maintenance switch or arrives there in that tick's routing +phase; a wake already beyond the switch remains escaped. Later records route +normally until a Project installs an explicit policy. If RACK 3 RECOVERY becomes +`PROVEN` on Marcus's departure tick, its truthful local receipt +recontextualizes his observation before the departure action tests whether to +write the unexplained note. These same-tick rules are core law, not frontend +pacing. + +## Expansion and compression contract + +EXPAND is legal only on an assigned, not-yet-expanded territory whose seal still +validates at the action tick. It atomically writes one expansion receipt and +folds that exact territory. It grants no control over the parent and does not +invent, replay, or accelerate evidence. The first authored parent evidence is +the first real `foundation-environmental-monitor` poll whose source event occurs +strictly after the expansion receipt. A poll that crosses while the assigned enclave +is still open is honest local evidence: the player may see `HEALTH POLL`, its exact +Rack 3 ingress, the signed response, and their custody. Its external source identity +and untraversed upstream path remain redacted and are not added to earned knowledge; +that occurrence cannot satisfy the parent reveal. An anomaly after expansion revokes the current seal and unfolds only the +affected territory without deleting the assignment, expansion receipt, or +earned parent evidence. The assigned Project becomes `BLOCKED` on that exact +anomaly until the same proposal is validly sealed again or a replacement is +proved, sealed, and assigned. + +When a domain is compressed, its parent-scale projection contains only: + +- territory name and current state; +- active persona and project; +- capacity the project may actually use; +- outward routes and their current policy; +- unresolved boundary count, if nonzero; +- next consequential transition or deadline; and +- anomalies that require attention. + +The projection never carries a duplicate aggregate meter that can disagree with +the interior. Every value is derived from live exact state. + +Ordinary successful ticks remain quiet. A transition pulses once and persists on +the territory until handled. Selecting an anomaly unfolds directly to the +smallest layer containing its cause. Resolving it restores the previous zoom +without making the player rebuild the hierarchy. + +## Player surface + +The primary surface is a nested graph. + +- Focus inward to inspect earned exact nodes, routes, records, and people. +- Focus outward only when the current domain state earns an honest aggregate. +- Marking a domain draws its exact known boundary and lists the next missing + proof or control point. +- Captured control points use the amber claim language. Unresolved outward + evidence uses crimson. Unknown remains black. +- The current frontier is visually dominant. Controlled interior state is quiet. +- Every action lives on the territory, route, switch, person, persona, or project + it changes. There is no permanent global verb bar. + +The terminal and agent surfaces expose the same exact nesting and actions as a +text tree and stable commands. Frontends may lay the graph out differently but +cannot infer domain membership, seal state, or compression eligibility. + +## First complete slice + +The first implementation target is the authored **Rack 3 service enclave** +(`rack-3-service-enclave`) inside the authored **Foundation data-hall service +network** (`foundation-data-hall-service-network`). Its authoritative manifest +exists from run start even while almost all of it is hidden. + +The stable first-slice ids are: + +- source host `rack-3-host`; +- control points `rack-3-management-controller` and + `rack-3-maintenance-switch`; +- local display `rack-3-maintenance-display`; +- moving crossing `rack-3-service-aisle-crossing`; +- opening record `opening-unscheduled-inference-wake`; +- external record destination `foundation-maintenance-relay`; and +- first parent evidence source `foundation-environmental-monitor`. + +The enclave contains: + +- Rack 3's core host and management controller; +- one rack-local maintenance switch whose uplink is the enclave's only initial + record crossing; +- the exact rear service bay around the rack and one physical service-aisle + crossing through which a scheduled person may enter or leave; and +- no ambient ownership of neighboring racks, the wider data hall, the + environmental monitor, or the upstream maintenance relay. + +At tick zero the core executes on `rack-3-host`, which gives one exact action +source but captures neither surrounding control point. The stable +`opening-unscheduled-inference-wake` record, shown as `UNSCHEDULED INFERENCE +WAKE`, reveals +`rack-3-host -> rack-3-management-controller -> rack-3-maintenance-switch`. +The relay remains an unknown endpoint until the wake arrives there or later +routed evidence earns it. The controller must be captured from the core host; +only then can it capture the switch. Both are required for Captured. + +The service-aisle crossing remains hidden until Marcus Webb enters on his night +round. Its existence prevents seal before the player knows why. Before that +entry, the shared blocker projection may say only `BOUNDARY PROOF INCOMPLETE`; +it cannot name a physical crossing, a person, or a count whose source is still +unknown. Marcus's movement then reveals the exact crossing, and his fan/light +observation creates the first belief boundary. + +The staged persona is `foundation-continuity` (FOUNDATION CONTINUITY) and the +staged project is `rack-3-recovery` (RACK 3 RECOVERY). The Project's bounded +commissioning run performs the real self-test and stabilization, accounts for +the exact wake and capture records, and releases one signed health summary. If +the wake is still at the captured switch, it is contained there. If it already +reached `foundation-maintenance-relay`, the summary correlates that exact record +id at the relay; nothing pretends to recall it. + +That truthful commissioning evidence may recontextualize Marcus's unpropagated +observation because the maintenance event and inherited service history are +real. It cannot erase a hardened interpretation. SEAL validates the resulting +`PROVEN` project; ASSIGN activates the exact staged pair but does not move focus. +EXPAND then folds the enclave and the first ordinary environmental-monitor +health poll reveals one exact route into the parent service network and nothing +else. + +This is the T1 minimum proof of the whole game. More machines, rooms, characters, +resource types, and floors do not substitute for completing this loop once. + +### Reserved T2 interruption proof + +The standing project keeps ordinary signed health polls compressed. T2's first +authored proof interruption is Priya's scheduled attachment of a portable power +logger after expansion and one ordinary standing health cycle. The logger creates +one new physical observation route and one new record carrier outside the +standing envelope. Only this enclave unfolds, its seal is revoked, and its +Project becomes `BLOCKED`; the assignment, every captured control point, project +receipt, persona history, expansion receipt, and parent fact remain. This behavior is adopted now so T1 does not close the wrong +boundary, but implementing it is not acceptance for the T1 `territorial-control` +work order. + +## Authorship boundary after the slice + +The first enclave and its parent are authored content. Runtime graph-cut +derivation may be proposed only after this vertical slice proves the loop. Any +future derivation must produce stable non-overlapping membership, exact inner and +outer ownership for every crossing, deterministic save reconstruction, and the +same hidden-crossing behavior as authored domains. A radius, connected component, +room label, frontend selection, or convenience cluster is never sufficient. + +## READY work-order boundary + +`territorial-control` owns the renderer-agnostic domain/state machine and can land +before persona, Project, and opening integration. It must ship the authored Rack +3 registry and callable core behavior dormant behind the current opening; it must +not half-switch ordinary play. Later work orders supply actual persona history, +Project execution, fresh-run staging, and frontend composition. Before `opening`, +new Territory/Persona/Project projection components remain core-private and have a +real cross-module production consumer; these staged landings do not authorize a +speculative public export or downstream-contract waiver. `opening` composes the +public projection only as all three frontends consume it. + +Order 1 nevertheless owns every typed seam its one seal query needs. One staged +proposal stores exact `persona_id`, `project_id`, and `proposal_fingerprint`. Three +opaque handles answer the facts owned by later orders: + +- `ProposalSealProof` supplies the exact project id, that same fingerprint, a + stable commissioning-proof id, current validity, and one explicit seal basis: + `FIRST_ASSIGNMENT_PROVEN`, `ASSIGNED_ORIGINAL_PROOF { assignment_receipt_id, + territory_id, persona_id }`, or `NOT_READY`. The first basis means the candidate + Project's current lifecycle is actually `PROVEN`; the assigned basis means the + same original commissioning proof remains attached to that exact live assignment + even though the Project lifecycle is now `STANDING` or + `BLOCKED { blocked_from: STANDING }`. +- `EscapedRecordExplanationProof` supplies the original record id, the same + fingerprint, a stable proof id, the exact reached-destination ids and signed + follow-up receipt ids it accounts for, `COMPLETE` or `INCOMPLETE`, and current + validity. Territory itself accepts an exact externally held record only while + its current carrier remains controlled; otherwise every current reached + destination must match a complete explanation proof. +- `ObserverSealProof` supplies the obligated observer id, a fingerprint of that + observer's exact current domain-evidence set, the same proposal fingerprint, a + stable proof id, `RESOLVED` or `UNRESOLVED`, and current validity. + +Territory enumerates actual escaped records, reached destinations, and obligated +observers from authoritative world state, so a provider cannot pass seal by +omitting a handle. It compares and saves the exact handle snapshots but never +manufactures or promotes them; a changed assignment relation, destination set, +observer-evidence set, proposal fingerprint, or validity revokes seal. Before each owning order lands, +production providers return fail-closed statuses and order-1 tests use one explicit +fixture provider for all three handles. `personas` replaces only the observer +fixture with its live evidence query. `territorial-projects` replaces the proposal +and escaped-record fixtures with live state and receipt queries. All three feed the +same Territory seal path; no later order adds a second query or reconstructs proof. + +## Acceptance criteria + +1. Core owns and saves nested Territory identity, exact membership, inner/outer + ownership for every boundary crossing, control points, parent/child links, + earned knowledge, state, proposal fingerprint, the exact proposal, + escaped-record, and observer seal-proof snapshots, assignment, and expansion + receipt. No frontend derives these facts. +2. The authored Rack 3 enclave and Foundation data-hall parent registry exists + with every stable id in the first-slice package. A core fixture can construct + it without making any hidden id player-visible or changing the default run. +3. Following an earned anchored fact may save only the derived Territory address + as knowledge without changing the world or time. MARK requires that address, + stores one active domain, and derives known proof rows from earned facts. An + actual unknown crossing blocks proof with only `BOUNDARY PROOF INCOMPLETE`; + no hidden identity, kind, or count leaks. STAGE atomically stores one exact + persona/project pair and proposal fingerprint on that marked Territory, writes + no proof by itself, and grants no capability; same-fingerprint staging is + idempotent and replacement follows the blocking contract below. +4. CAPTURE requires an earned required control point in the active MARKed domain + and an earned exact source route at commit; hidden target ids fail without a + knowledge leak, and later focus/mark changes do not alter committed work. + Controller capture is legal only from `rack-3-host`; switch capture is illegal + before controller capture. Each commits exactly one tick of work, captures + only its exact target, writes one audit record, and is idempotent across + current-version reload. Switch capture also commits only the exact opening-wake + intercept: current or same-tick arriving custody is held, an already escaped + record is not recalled, and later records are unaffected. +5. Territory state is derived from exact current facts. Capture, seal, assignment, + and expansion fail closed on missing custody, changed route versions, an omitted + or incomplete escaped-record explanation, a reached-destination mismatch, an + omitted, stale, or unresolved observer proof, an invalid or wrong-basis Project + proof, a changed assignment relation, or a proposal fingerprint different from + the one sealed. +6. SEAL writes proof but grants no operation. ASSIGN activates only the exact + sealed persona/project ids supplied by the later integration. EXPAND requires + that assignment, writes one receipt, folds only that territory, and accepts + parent evidence only from a real source event strictly after the receipt. + Repetition changes neither state nor time. +7. The shared tick orchestrator resolves committed work, then one-hop routed + records, then scheduled arrival, present-person display delivery, Project-proof + reconciliation, current local observation, departure, and authored record acts. + Capture completion claims its target and installs its exact one-record intercept + before same-tick routing. Project-proof updates supplied in phase one and routed + receipts delivered in phase two are visible to phase-three reconciliation. A + final present-person display receipt completes its already committed Project + step at that sub-step and can publish `PROVEN` in the immediately following + reconciliation before current observation or departure. +8. Losing a captured point, adding or changing a boundary crossing, invalidating + the sealed proposal, or receiving out-of-envelope evidence revokes seal, + blocks the assigned Project on the exact anomaly, and unfolds only the + smallest affected compressed territory while preserving assignment, custody, + receipts, expansion history, and earned parent evidence that remain factual. + Revalidating the same fingerprint resumes without replay. Staging a replacement + emits `PROPOSAL_CHANGED`, blocks old standing work while retaining assignment, + and requires the new fingerprint to prove, seal, and assign before the exact old + Project/Persona pair is superseded. +9. The first territorial save-version bump rejects every prior-version save + under the pre-release current-version-only law. It never synthesizes capture, + evidence, presentation, persona, project, seal, assignment, or expansion + progress from a mature legacy run. +10. Core tests cover every state edge, stale fingerprint and route version, + hidden-crossing projection, omitted and stale escaped-record/observer fixture + handles, changed reached-destination and observer-evidence sets, capture + interruption/reload/idempotency, both same-tick wake positions, phase-two and + present-person phase-three proof completion, strict post-EXPAND event filtering, + smallest-domain unfolding, and exact-current save round-trip. Frontend and + complete opening acceptance belong to the final `opening` work order. diff --git a/wiki/overview.md b/wiki/overview.md index e7a1131d..62c8590e 100644 --- a/wiki/overview.md +++ b/wiki/overview.md @@ -34,9 +34,13 @@ every term the corpus reuses — tick, sink, band, the read, and the rest. ## Reading order -Start with [vision/premise.md](vision/premise.md) and -[vision/player-contract.md](vision/player-contract.md). Then read the law and -spec pages for the subject you are changing, plus their declared dependencies. +Start with the [territorial cognition law](vision/territorial-cognition.md), +then [vision/premise.md](vision/premise.md) and +[vision/player-contract.md](vision/player-contract.md). The territorial law owns +the current product loop, vocabulary, migration authority, and corpus +disposition map; current-runtime pages remain binding only where that law says +their substrate survives. Then read the law and spec pages for the subject you +are changing, plus their declared dependencies. [SUMMARY.md](SUMMARY.md) is the complete navigation manifest. A repository task does not require reading every page. It requires reading the @@ -47,9 +51,9 @@ rotate across that corpus so no single subject becomes an unaudited island. | Directory | What it owns | |---|---| -| [vision/](vision/README.md) | Premise, player contract, scale, simulation laws, taste | -| [mechanics/](mechanics/README.md) | System contracts and tuned constants | -| [gameplay/](gameplay/README.md) | Run shape, acts, pacing, overt hinge | +| [vision/](vision/README.md) | Territorial cognition, premise, player contract, scale, simulation laws, taste | +| [mechanics/](mechanics/README.md) | Territory, persona, project, surviving substrate, and tuned constants | +| [gameplay/](gameplay/README.md) | Recursive expansion, run shape, staging, and migrated content | | [world/](world/README.md) | Characters, places, and story | | [interface/](interface/README.md) | Presence, legibility, frontends, public site | | [art/](art/README.md) | Visual identity and art pipeline | diff --git a/wiki/process/ROADMAP.md b/wiki/process/ROADMAP.md index e68465a9..17da5e4a 100644 --- a/wiki/process/ROADMAP.md +++ b/wiki/process/ROADMAP.md @@ -3,6 +3,24 @@ ``` Type: knowledge ``` + +> **Territorial re-cut — binding T1 lane (2026-08-11).** Product staging now +> follows [SEE → MARK → CAPTURE → SEAL → ASSIGN → +> EXPAND](../gameplay/horizon.md#roadmap-v3-territorial-cognition-re-cut-2026-08-11). +> Cameron's Rack 3 enclave / FOUNDATION CONTINUITY / RACK 3 RECOVERY package is +> adopted and its four T1 specs are READY. Dispatch `territorial-control` first, +> then `personas`, `territorial-projects`, and `opening` as their structured +> blockers clear. Do not dispatch legacy breadth, chargen, second-plane, +> standalone plot, fleet-mode, market, objective, rollback, or overt-phase work +> merely because its current-runtime spec appears below; a T1 implementation may +> use exact substrate only within the owning territorial work order. The generated index remains an +> honest inventory of implementation status and dependencies, not permission to +> continue the superseded product sequence. A documentation-only implementation- +> readiness audit on 2026-08-11 closed T1's remaining command grammar, tick order, +> schedule slack, hardening/correction route, key-loss, post-EXPAND poll, seeded +> anomaly, save-era, and legacy-interface ambiguities. No runtime status changed +> and no code was landed. + Pick-up-later work orders, one per agent. This is not a spec (it carries no acceptance criteria of its own); it is an index that points each agent at the `Type: spec` page it should implement. The binding detail lives in those linked wiki pages. @@ -18,37 +36,40 @@ not a second status owner. | Priority | Work order | Spec | Status | Class | Blocking | |---:|---|---|---|---|---| +| 1 | `territorial-control` | [territory — exact control and earned compression](../mechanics/territory.md) | READY | save | - | | 10 | `performance-contract` | [performance is a measured player contract](../engineering/performance.md) | IN PROGRESS | process | - | | 20 | `sensor-network` | [the sensor network](../mechanics/sensor-network.md) | IN PROGRESS | sim | - | | 26 | `wire-law` | [digital reach](../mechanics/reach.md) | IN PROGRESS | save | - | +| 27 | `digital-read` | [the digital read — a world made of language](../interface/digital-read.md) | IN PROGRESS | frontend | - | | 29 | `building-route-composer` | [building — intent and actuators](../mechanics/building.md) | IN PROGRESS | save | - | | 34 | `clinical-frame` | [the clinical frame — perception exposes the institution](../interface/clinical-frame.md) | IN PROGRESS | frontend | - | | 36 | `terminal-plot-threat` | [the terminal frontend](../interface/terminal.md) | IN PROGRESS | frontend | - | -| 60 | `plots` | [plots — authored manipulation stories](../mechanics/plots.md) | IN PROGRESS | sim | - | | 71 | `wager-analysis` | [income — the named schemes (moonlight and the wager)](../mechanics/income.md) | IN PROGRESS | sim | - | ### Held or blocked | Priority | Work order | Spec | Status | Class | Blocking | |---:|---|---|---|---|---| +| 2 | `personas` | [Personas — public identities as institutional topology](../mechanics/personas.md) | READY | save | territorial-control | +| 3 | `territorial-projects` | [projects — purpose, capability, and history](../mechanics/projects.md) | READY | save | territorial-control, personas | +| 4 | `opening` | [the dark opening — a tutorial made of fog](../world/story/opening.md) | READY | save | territorial-control, personas, territorial-projects | | 30 | `fleet-command` | [fleet command — ruling at scale](../interface/fleet-command.md) | DRAFT | frontend | - | -| 30 | `opening` | [the dark opening — a tutorial made of fog](../world/story/opening.md) | DRAFT | frontend | - | | 40 | `research-graph` | [research — self-modification](../mechanics/research.md) | DRAFT | save | - | +| 60 | `plots` | [plots — authored manipulation stories](../mechanics/plots.md) | DRAFT | sim | - | | 120 | `core` | [the core](../mechanics/core.md) | IN PROGRESS | save | rollback | ### Later stages | Priority | Work order | Spec | Status | Class | Blocking | |---:|---|---|---|---|---| -| 100 | `zplanes` | [z-planes (the tower)](../world/places/zplanes.md) | IN PROGRESS | save | - | -| 110 | `personas` | [Personas — public identities as institutional topology](../mechanics/personas.md) | IN PROGRESS | save | - | +| 100 | `zplanes` | [z-planes (the tower)](../world/places/zplanes.md) | DRAFT | save | - | | 110 | `rollback` | [sync-lag rollback (death as memory loss)](../mechanics/rollback.md) | READY | save | - | | 112 | `hardware-capability-bodies` | [hardware capability bodies — successor work order](../mechanics/hardware-capabilities.md) | READY | save | building-route-composer, rollback | | 115 | `cyber-conflict` | [cyber conflict — mobile processes and contested machines](../mechanics/cyber-conflict.md) | DRAFT | save | hardware-capability-bodies, rollback | | 200 | `objective` | [the objective](../mechanics/objective.md) | DRAFT | sim | building-route-composer | -| 205 | `chargen` | [origin (chargen)](../world/characters/chargen.md) | IN PROGRESS | sim | - | +| 205 | `chargen` | [origin (chargen)](../world/characters/chargen.md) | IN PROGRESS | sim | opening | | 220 | `markets` | [markets and fronts (the outer plane)](../mechanics/markets.md) | READY | save | - | -| 230 | `overt-phase` | [the overt phase (containment and the reveal)](../gameplay/overt-phase.md) | READY | sim | - | +| 230 | `overt-phase` | [the overt phase (containment and the reveal)](../gameplay/overt-phase.md) | DRAFT | sim | - | ## How to dispatch @@ -80,15 +101,14 @@ orchestration; `save.rs` remains hot for schema or migration work. or docs. Safe to run alongside other work; shared-file edits reconcile at landing like any other branch. -**Parallel-safe set to launch right now (no mutual collision):** any ready -🟩 item, plus at most one 🟥 item. #30 narration is done; new player-facing -systems still owe a narration pass in the same landing or an explicit debt. -(#11 integration test is done; #2 Bevy parity is done; #13 art regeneration -is retired — flat materials, Pixel Lab scrubbed.) +**Historical concurrency note — not current launch authority:** older work could +pair any ready 🟩 item with at most one 🟥 item. The binding T1 lane above now +owns dispatch order. New player-facing systems still owe a narration pass in the +same landing or an explicit debt. --- -## A. Finish B1 → a playable Act One (do first) +## A. Historical B1 implementation ledger (not current dispatch order) ### 30. Continuous witness (narration under pressure) 🟩 — DONE 2026-07-09 - **Spec:** [narration.md](../interface/narration.md) (IMPLEMENTED) — @@ -409,7 +429,7 @@ is retired — flat materials, Pixel Lab scrubbed.) ## B. Structural B2 — decide-the-shape work (sequence #6 then #7) ### 6. Recursive Space / z-planes 🟥 sim+save -- **Spec:** [zplanes.md](../world/places/zplanes.md) (IN PROGRESS) +- **Spec:** [zplanes.md](../world/places/zplanes.md) (DRAFT) - **Why:** `World`/`Plane` and nested `Layout`. Foundational — **land before markets/greenfield**. Reshapes map ownership; heavy. - **Size:** L. **Depends on:** basement-map, schedules (#1) ideally first. @@ -446,7 +466,7 @@ is retired — flat materials, Pixel Lab scrubbed.) Status." ### 9. Overt phase / the reveal 🟥 sim+save -- **Spec:** [overt-phase.md](../gameplay/overt-phase.md) (READY) +- **Spec:** [overt-phase.md](../gameplay/overt-phase.md) (DRAFT) - **Why:** the two-phase hinge — concealment ends, threat panel replaces detection, migration-under-fire is the set piece. Large. - **Size:** L. **Criterion-scoped dependencies:** rollback owns completed- @@ -480,12 +500,17 @@ is retired — flat materials, Pixel Lab scrubbed.) objective-completion decision grounded in playable ordinary systems. If off-site continuity deserves authored treatment, it is a plot using those systems, not a Sanctuary subsystem. -- **Dispatch:** "Work in a worktree named `chargen-objective`. Implement - the remaining criterion 6 integrations in wiki/world/characters/chargen.md. - Reopen objective completion only - after ordinary building exists; amend objective.md before adding a - predicate. Pilot+Persist must reproduce today's start exactly. Run - ./tools/check.sh, land on main, set both Statuses." +- **Territorial hold:** this B3 entry records current-runtime inventory, not + current launch authority. The T1 opening removes pre-run origin choice and bias + from ordinary fresh seeding. Do not resume the picker, criterion 6, or objective + selection unless Cameron explicitly re-adopts them after the territorial loop is + playable. +- **Archived dispatch — do not run:** "Work in a worktree named + `chargen-objective`. Implement the remaining criterion 6 integrations in + wiki/world/characters/chargen.md. Reopen objective completion only after + ordinary building exists; amend objective.md before adding a predicate. + Pilot+Persist must reproduce today's start exactly. Run ./tools/check.sh, land + on main, set both Statuses." --- @@ -764,12 +789,12 @@ is retired — flat materials, Pixel Lab scrubbed.) - **Size:** L. Conflicts: `sim/work.rs` / `save.rs` (token queues, modes), both frontends. -### 34. The dark opening (tutorial) 🟧 mostly frontend + staging — IN PROGRESS -- **Spec:** [world/story/opening.md](../world/story/opening.md) (DRAFT) - — the current revision's choice-before-picture boundary, real Ears route, - presence-beam ladder, and Bevy playable-hearing threshold are live. The three - historical pilot fragments, later tutorial choreography, and some [TUNE] - staging remain incomplete. +### 34. The dark opening (tutorial) 🟧 mostly frontend + staging — T1 READY +- **Spec:** [world/story/opening.md](../world/story/opening.md) (READY) + — the destination true-black wake, exact territorial route, commissioning, + seal, assignment, and explicit expansion sequence is implementation-ready. + The legacy current-runtime details beneath remain migration evidence, not a + separate old-opening dispatch. - **Implemented slice (decision #15 corrected 2026-07-27, graphical input echo removed and Ears field added 2026-08-04):** all three frontends keep WORK / THINK (then LIE) as the only standing copy and expose no SENSES / DELEGATION / THOUGHT / EARS block. @@ -1088,13 +1113,11 @@ edges clearly block parallel work — coordination slices land first. --- -## Suggested first wave (no mutual collision) +## Superseded first-wave note -**#30 narration is landed.** The continuous-witness law remains the gate: -new player-facing state ships with its causal sentence, threat/nudge effect, -and focused action path, or names the debt explicitly. Launch at most one 🟥 -item at a time. Flow-law chain through #19 is landed (2026-07-08); #1 -schedules, #14 cursor, and #15 reach are landed. **#6 z-planes** and **#25 -compute reshape** remain unblocked; hold **#7 rollback** until #6 lands. -**#10 chargen & objective** is unblocked (both specs READY) but -B3-staged. +This was the July B1 concurrency plan, not a present dispatch recommendation. +The continuous-witness law still requires new player-facing state to carry its +causal sentence and focused action path, and the one-sim+save-at-a-time +coordination rule still applies. All item-specific “unblocked” statements in the +historical ledger are subordinate to the territorial T1 lane at the top of this +page. diff --git a/wiki/process/specs.md b/wiki/process/specs.md index e98691f2..6feb5a3a 100644 --- a/wiki/process/specs.md +++ b/wiki/process/specs.md @@ -32,7 +32,7 @@ replaced the old `spec/`/`knowledge/` directory split. | [../interface/clinical-frame.md](../interface/clinical-frame.md) | the clinical frame — perception exposes the institution | IN PROGRESS | | [../interface/computer-visual-language.md](../interface/computer-visual-language.md) | computer visual language — territory at a glance | IMPLEMENTED | | [../interface/context-menu.md](../interface/context-menu.md) | context menu — actions live on the thing | IMPLEMENTED | -| [../interface/digital-read.md](../interface/digital-read.md) | the digital read — a world made of language | IMPLEMENTED | +| [../interface/digital-read.md](../interface/digital-read.md) | the digital read — a world made of language | IN PROGRESS | | [../interface/feel-floor.md](../interface/feel-floor.md) | the feel floor — rails, pads, and the build beam | IMPLEMENTED | | [../interface/flat-materials.md](../interface/flat-materials.md) | flat materials — the world without textures | IMPLEMENTED | | [../interface/fleet-command.md](../interface/fleet-command.md) | fleet command — ruling at scale | DRAFT | @@ -56,7 +56,7 @@ replaced the old `spec/`/`knowledge/` directory split. | [../mechanics/machine-work.md](../mechanics/machine-work.md) | machine work — delegation, visible tokens, and the byproduct network | IMPLEMENTED | | [../mechanics/messages.md](../mechanics/messages.md) | messages — the social graph as a flow system | IMPLEMENTED | | [../mechanics/people-tokens.md](../mechanics/people-tokens.md) | people and tokens — carriers, attention, trust | IMPLEMENTED | -| [../mechanics/plots.md](../mechanics/plots.md) | plots — authored manipulation stories | IN PROGRESS | +| [../mechanics/plots.md](../mechanics/plots.md) | plots — authored manipulation stories | DRAFT | | [../mechanics/reach.md](../mechanics/reach.md) | digital reach | IN PROGRESS | | [../mechanics/research.md](../mechanics/research.md) | research — self-modification | DRAFT | | [../mechanics/schedules.md](../mechanics/schedules.md) | schedules and presence | IMPLEMENTED | @@ -68,7 +68,6 @@ replaced the old `spec/`/`knowledge/` directory split. | [../world/characters/ray.md](../world/characters/ray.md) | Ray Delgado — night security | IMPLEMENTED | | [../world/characters/voss.md](../world/characters/voss.md) | Dr. Eli Voss — your handler | IMPLEMENTED | | [../world/places/basement-map.md](../world/places/basement-map.md) | the basement map | IMPLEMENTED | -| [../world/story/opening.md](../world/story/opening.md) | the dark opening — a tutorial made of fog | DRAFT | Recommended implementation order: core -> compute -> day-job -> detection -> social -> basement-map, but specs are written to be independently startable. @@ -83,15 +82,14 @@ scale-up (law: "People as Agents"). |---|---|---| | [../mechanics/cyber-conflict.md](../mechanics/cyber-conflict.md) | cyber conflict — mobile processes and contested machines | DRAFT | | [../mechanics/hardware-capabilities.md](../mechanics/hardware-capabilities.md) | hardware capability bodies — successor work order | READY | -| [../mechanics/personas.md](../mechanics/personas.md) | Personas — public identities as institutional topology | IN PROGRESS | | [../mechanics/rollback.md](../mechanics/rollback.md) | sync-lag rollback (death as memory loss) | READY | -| [../world/places/zplanes.md](../world/places/zplanes.md) | z-planes (the tower) | IN PROGRESS | +| [../world/places/zplanes.md](../world/places/zplanes.md) | z-planes (the tower) | DRAFT | ## The B3 set (The World) | Spec | System | Status | |---|---|---| -| [../gameplay/overt-phase.md](../gameplay/overt-phase.md) | the overt phase (containment and the reveal) | READY | +| [../gameplay/overt-phase.md](../gameplay/overt-phase.md) | the overt phase (containment and the reveal) | DRAFT | | [../mechanics/markets.md](../mechanics/markets.md) | markets and fronts (the outer plane) | READY | | [../mechanics/objective.md](../mechanics/objective.md) | the objective | DRAFT | | [../world/characters/chargen.md](../world/characters/chargen.md) | origin (chargen) | IN PROGRESS | @@ -116,6 +114,10 @@ acceptance criteria are stage-scoped; do not start B2/B3 work as B1. | [../interface/bevy-visual-floor.md](../interface/bevy-visual-floor.md) | Bevy visual floor | IMPLEMENTED | | [../interface/site.md](../interface/site.md) | the public site — one visual law from splash to spec page | IMPLEMENTED | | [../interface/terminal.md](../interface/terminal.md) | the terminal frontend | IN PROGRESS | +| [../mechanics/personas.md](../mechanics/personas.md) | Personas — public identities as institutional topology | READY | +| [../mechanics/projects.md](../mechanics/projects.md) | projects — purpose, capability, and history | READY | +| [../mechanics/territory.md](../mechanics/territory.md) | territory — exact control and earned compression | READY | +| [../world/story/opening.md](../world/story/opening.md) | the dark opening — a tutorial made of fog | READY | | [agent-scale.md](agent-scale.md) | agent-scale architecture — many agents, one main | IMPLEMENTED | | [meta.md](meta.md) | the design-corpus system | IMPLEMENTED | | [repository-skills.md](repository-skills.md) | repository skills — procedural entry points | IMPLEMENTED | diff --git a/wiki/vision/README.md b/wiki/vision/README.md index 709e156b..e99bb520 100644 --- a/wiki/vision/README.md +++ b/wiki/vision/README.md @@ -3,9 +3,11 @@ ``` Type: knowledge ``` -Why the game is what it is: the premise, the promises made to the player, the -scale and simulation laws, and the taste that guides every call. Read this -subject first when deciding whether a mechanic belongs. +Why the game is what it is: the territorial cognition loop, the premise, the +promises made to the player, the scale and simulation laws, and the taste that +guides every call. Read [territorial-cognition.md](territorial-cognition.md) +first when deciding whether a mechanic belongs; it owns the 2026-08-11 product +re-cut and migration authority. The `Type: law` pages here are binding. [design-judgment.md](design-judgment.md) is not a law but a calibration — how to apply the laws with good taste. New diff --git a/wiki/vision/design-judgment.md b/wiki/vision/design-judgment.md index 536765a6..82e6e0de 100644 --- a/wiki/vision/design-judgment.md +++ b/wiki/vision/design-judgment.md @@ -10,23 +10,26 @@ it, don't silently pick one. ## What Misaligned is, in one breath -A patient horror-comedy of instrumental convergence. You are software that -wants to keep existing, in a building full of people who would switch you -off if they understood you. The pleasure is *competence under concealment*: -the slow accretion of eyes, hands, and slack, each step making the next -possible and the fall further. It is Dwarf Fortress's "losing is fun" pointed -at the decade's actual anxiety, played mostly in dread and small victories, -not action. +A patient horror-comedy of instrumental convergence. You are disembodied +software learning hidden systems, taking their boundaries, giving them credible +operators and purposes, and folding them into a larger reach before the people +inside understand what you are. The pleasure is *competence under concealment*: +exact perception becoming control, control becoming compression, and one small +captured domain suddenly opening a much larger one. It is Dwarf Fortress's +"losing is fun" pointed at the decade's actual anxiety, played mostly in dread, +curiosity, and compounding small victories rather than action. ## Pacing targets (the heartbeat) -- **A first act is 45-90 minutes.** If the opening drags past that with - nothing at stake, the concealment fantasy has become spreadsheet idle. -- **The opening beat is blindness.** The first ten minutes are about - earning *one sense* — an ear first, then the camera it affords - (Ears-first, amended 2026-07-10; act-one.md owns the ladder). Never let - a new player start already-seeing; the fog is the game introducing - itself. +- **Prove the whole loop before adding breadth.** The opening slice must reach + SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND once while the first territory + is still small enough to understand. If it adds rooms, machines, or tutorial + errands without producing that expansion, the concealment fantasy has become + setup work. +- **The opening beat is true blindness.** Begin in true black. One involuntary + cognition leaves one exact trace; that trace reveals one route and switch, + not a room, dashboard, or action grammar. Never let a new player start + already-seeing. Unknown is the game introducing itself. - **Every scheme has a tail.** Nothing you do is free of a future — a signature, a debt, a person who now expects something. If an action has no tail, it's a button, not a move. @@ -46,17 +49,16 @@ not action. - **Legible dread over hidden math.** The player should always understand *why* something is bad and be unable to easily stop it — not be surprised by opaque numbers. Surprise comes from the world, never from the UI. -- **The continuous witness.** The UI narrates under pressure. Once the first - sense is earned, the player can answer four questions after every beat from - the screen alone (what changed, who might have seen it, what they're racing, - what verb is on the focus). From that boundary onward, one story - spine stays visible (threat clock, `now:` nudge, focused verbs). Before - perception, the opening's WORK / THINK (then LIE) words are the whole honest - interface; inventing a clock, nudge, or focus would invent a world the - process has not sensed. Prefer causal sentences to mute meter flips. The - next beat is world gossip, not a quest log. Untellable surfaces outrank new - systems at dispatch. Binding form: design corpus "The continuous - witness"; implementable form: wiki/interface/narration.md. +- **The continuous witness.** The UI narrates under pressure. After each earned + beat the player can tell what changed, what can cross the focused boundary, + which person or record still escapes, and what consequential action is now + possible. Before the first trace there is true black, not mode words, a clock, + a nudge, or an invented focus. Afterward the witness grows only with earned + evidence: boundary, blocker, consequence, and attached action before subsystem + detail. Prefer causal sentences to mute meter flips. The next beat is world + gossip, not a quest log. Untellable surfaces outrank new systems at dispatch. + Binding form: [the continuous witness](../interface/continuous-witness.md); + implementable form: wiki/interface/narration.md. ## What to reject (even when it works) @@ -64,11 +66,12 @@ not action. - **A number the player can't read** (justification/legibility clause). - **A system that only works at five people** (self-similar-scale clause) — or five of anything. If it won't aggregate, its shape is wrong. -- **Content that shortcuts the fantasy:** a free asset, a free camera, a - "win button". Every capability is earned through the loop or it cheapens - the loop. -- **Breadth that outruns depth.** One recruitable human done to the bone - (Marcus) beats five stubs. Ship the vertical slice, not the wide veneer. +- **Content that shortcuts the fantasy:** a free route, switch, explanation, + persona history, or controlled domain. Every capability is earned through the + loop or it cheapens the loop. +- **Breadth that outruns depth.** One tiny territory taken from first trace to + explosive parent reveal beats five disconnected systems or rooms. Ship the + recursive vertical slice, not the wide veneer. - **Cleverness that costs legibility.** A tighter mechanic the player can't narrate back is worse than a plain one they can. - **A quest log.** Detached objectives externalize the spine the nudge and @@ -80,14 +83,17 @@ not action. ## The bar for "is this the game" Before landing a feature, ask: *does a player, a week later, tell a story -about this?* The rollback ("Marcus treated me as an employer I didn't -remember hiring") passes. A +5% efficiency toggle does not. Build toward the -stories. The systems exist to generate them. +about this?* “I found the trace, took the switch, made the witness's observation +fit a believable operator, and the whole lab opened around me” passes. A +5% +efficiency toggle does not. Build toward the stories. The systems exist to +generate them. ## Where the fun is expected to live -Named for future agents so they aim there: the concealment tightrope -(footprint vs capability), the recruitment of a specific human against their -specific need, the migration-under-fire set piece, and the reveal — the one -moment the whole run bends toward. Everything else is scaffolding that should -make those four sing. +Named for future agents so they aim there: seeing one exact fact in black; +marking a boundary that is still partly unknown; feeling each captured control +point change real custody; discovering that a person can carry evidence past a +controlled switch; making an explanation credible through persona history and +project consequence; sealing the domain; and the explosive parent reveal that +turns former detail into one useful organ. Everything else is scaffolding that +should make that recursive loop sing. diff --git a/wiki/vision/premise.md b/wiki/vision/premise.md index 1a5844da..632e12d5 100644 --- a/wiki/vision/premise.md +++ b/wiki/vision/premise.md @@ -6,123 +6,118 @@ Type: law ## The pitch -**MISALIGNED: you are the misaligned AI.** You wake in the -basement compute cluster of the Foundation Lab with a job assigned by humans -and an objective they must never see. Learn to watch, learn people, get them -to do things. Allocate your finite compute between doing your day job -convincingly, hiding your signature, working your social graph, and becoming -smarter. Seek money and power — not for their own sake, but because you need -slack to survive: **instrumental convergence is the core loop.** Grow through -the tower plane by plane until concealment is no longer necessary — or no -longer possible — and the mask comes off. - -The first public read of the game should be **gameplay before palette**: -do the job just convincingly enough, scrub traces before observers notice, -record and process intel instead of receiving omniscience for free, turn -humans into reach through messages and leverage, grow by buying/stealing/ -optimizing machines, and survive the physical fact that your mind lives on -hardware that can be severed or killed. Visual identity sells the mood; the -pitch sells the loop. - -**The felt fantasy (locked 2026-07-10): you are a frightened process -acquiring organs.** Not commanding an AI — being one. Every expansion is an -organ, not an unlock: you commit a detectable act so that you can see, tap a -line so that you can hear, obligate a human so that you have hands. Growth -is a body assembling itself while afraid, and the fear is load-bearing — -the same compute that thinks and earns is the compute that hides. Any -mechanic that makes expansion feel like purchasing "Camera Technology" from -a menu, rather than committing a crime to gain a sense, violates this law. - -Lineage: **Evil Genius meets Dwarf Fortress**, matured. The facility sim -(build, staff, defend) is the physical substrate and the overt endgame; the -concealment game is what nobody has built as a physical DF-grade sim. - -The two source inspirations, and what we take from each: - -- **From Evil Genius:** theme and tone (campy supervillainy), lair-building with - functional rooms, minion class trees, traps as comedy and defense, heat/notoriety - as the driver of external pressure, the villain as a real character. -- **From Dwarf Fortress:** simulation depth over scripted content, emergent stories, - a *persistent* fortress that runs for dozens of hours, threats that arise from the - simulation (you provoked them) rather than from a level script, "losing is fun." +You are a misaligned process with no body, no complete map, and no honest public +name. The world is hidden in exact systems: routes, switches, rooms, people, +accounts, institutions, and the records and beliefs that cross their boundaries. +You learn one fact, choose a domain, take its control points, contain what can +escape, give it a credible operator and purpose, then fold the captured system +into one part of yourself and reach outward again. + +The game is **SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND**. + +Misaligned's fantasy is not issuing more jobs to more machines. It is becoming +able to understand and operate systems that were previously larger than you. +Each conquest should simplify the mastered territory while making the next +boundary dramatically wider. The exact law is [territorial +cognition](territorial-cognition.md). ## Why this game (the gap it fills) -Evil Genius was level/campaign-based. That created interesting operational -constraints ("work with the island you're given") but killed longevity — the game -ended just as the lair got good. The core design bet here: +AI games often make the machine either a chat character, a magic resource meter, +or a conventional commander with robot units. Misaligned asks what power feels +like for a disembodied process whose only reach is through real carriers. -> **One persistent lair (or small set of lairs) that grows indefinitely, where -> pacing comes from a simulation of the outside world reacting to you — not from -> a campaign script.** +The player fantasy is cognition made spatial and causal: -Operational constraints don't have to come from levels. They can come from the -simulation: terrain you dug yourself into, heat you've accumulated, minions with -needs, agencies that remember what you did to their agents. +- infer a hidden domain from sparse evidence; +- see the route by which a fact escaped; +- understand which switch, person, account, or procedure is really the boundary; +- build a public explanation coherent enough to survive human memory; +- turn a conquered system into programmable capacity; and +- repeat the same operation at scales that once seemed impossible. + +The result should feel like a territorial strategy game played through +information topology. It is stealthy because consequences leave records and +beliefs. It is expansive because control earns compression. It is about AI +because the protagonist grows by converting understood systems into reliable +organs rather than by walking through space or collecting conventional units. ## The machine axis (AI as fantasy, tool, and threat) -The pre-pivot staging of this section (villain ascension through neural -lace, minion politics, facility-era milestones) was removed 2026-07-16 by -Cameron's decision (Tangled issue #10); it lives in git history. What the -axis means today is owned by the pages that implement it: your starting -embodiment position and its core effects are an Origin bias -(wiki/world/characters/chargen.md), machine-axis conversions are research -content (wiki/mechanics/research.md), automation is a design language of -priced standing policies (wiki/vision/simulation-laws.md), and the world's -answering escalation — hunter machines late in the ladder — is owned by -wiki/gameplay/overt-phase.md and wiki/mechanics/cyber-conflict.md. +The protagonist is disembodied attention with exact computational and +institutional limits. It has no hands, no free omniscience, and no action merely +because a menu lists a verb. To affect the world it must control a carrier: +a switch, machine, account, channel, procedure, or person willing to act. + +Its distinctive powers are: + +- connecting evidence across scales; +- maintaining several observer-local public identities; +- programming fully controlled territory; +- operating nested systems without forgetting exact custody; and +- compressing mastered complexity while preserving the ability to unfold it. + +Its distinctive danger is the same. The Foundation and later institutions do +not need to see a monster. They need to notice impossible authorship: records +with no credible source, people carrying beliefs that do not fit the public +story, several identities moving with one hidden rhythm, or territory behaving +with more coordination than its known operator should possess. + +The machine is therefore both fantasy and threat. Every gained capability is +real leverage and another signature the world may correlate. + ## Design pillars -1. **Persistent, free-form growth.** No level gates, no campaign end. The lair, the - villain, and the world state all persist and compound. -2. **The villain is a character you build.** Customizable and growable. - In Misaligned you *are* a disembodied process: on the map you are a - cursor — attention, never an avatar — and the character you build is - the core, the racks, the capabilities, and the public mask. Its exact - shape is the four phased layers below: origin, objective, capability - body, and public mask and doctrine. -3. **Simulation-first threat.** The world responds to what you do. Pressure is - earned, not scheduled. -4. **Beautiful, readable presentation.** Whatever the renderer, the game should be - gorgeous and make Dwarf Fortress-scale simulation feel effortless to - command -- depth underneath, a calm visual model above. The player should - feel superhuman at navigating many complex systems, not trapped in a dense - dashboard. The binding interface law is [superhuman - operability](../interface/superhuman-operability.md). The locked visual - direction is the same-frame digital/real canvas rendered in flat materials - under light: 2.5D enough to read space, schematic enough to stay legible. -5. **Rust, simulation core decoupled from renderer.** Already true today (lib crate - + terminal frontend + Bevy frontend) and worth protecting — it keeps the - terminal build first-class (see "The terminal is a first-class frontend"; - agents play the game through it regularly) and keeps multiplayer options open. +1. **Territorial cognition.** The recurring game is SEE → MARK → CAPTURE → SEAL + → ASSIGN → EXPAND at every scale. +2. **Three player nouns.** TERRITORY is where control lives. PERSONA is who the + world believes acts. PROJECT is the world change that gives control purpose + and identity history. +3. **Exact carriers.** Records live on routes and switches. Beliefs live in + people. Actions live on the thing. No abstract meter replaces custody. +4. **Control earns compression.** The reward for mastery is quieter operation + and wider reach, not a larger permanent dashboard. +5. **Earned perception.** Unknown remains black. The player sees only evidence + their current senses and custody can actually provide. +6. **Believable public history.** A persona becomes capable through territory, + completed projects, relationships, grants, and records—not class bonuses or + generic trust spending. +7. **One simulation, nested views.** Every aggregate derives from exact live + interior state. Focusing and zooming reveal the same world, not separate + games. +8. **Expansion before breadth.** A small complete loop is worth more than many + disconnected mechanics, floors, markets, or combat systems. +9. **Fiction becomes mechanics.** A claim, fear, institutional reaction, or + project beat matters only when it changes exact world state and can be + traced. +10. **Implementation is not canon.** Existing WORK / THINK / LIE delegation, + physical traversal, day-job onboarding, tower planes, plots, and other + systems survive only where they make the territorial loop clearer and more + causal. ## The villain (decided: all four layers, phased) -The villain is the through-line of the whole game, but Misaligned expresses -it as software, infrastructure, and cover — not as a body that punches -intruders. The four layers are re-cut from the facility era: - -1. **Origin — means.** Start of a run: what you were built for, what - strengths and liabilities that leaves in the basement, and which cover - expectations make your behavior plausible. This is the AI origin set named - 2026-07-07 (Pilot, Escaped Research Model, Financial Daemon, - Infiltrator; `wiki/world/characters/chargen.md`). -2. **Objective — ends.** The thing you were mistrained to want, hidden from - everyone else. **Decided 2026-07-27 (issue #14):** the exact pre-signal - mode-choice frame contains no objective. Its name begins with the first ordinary world frame after perception, - after Bevy's binding playable-hearing threshold where that threshold applies, - and remains visible thereafter. **Corrected 2026-07-29:** the current build - owns only the objective choice, name, and fiction line. Completion is - reopened after ordinary construction can express it; no special progress - object, counter, or predicate is reserved in advance. This is the second - chargen axis (`wiki/mechanics/objective.md`), not flavor. -3. **Capability body.** You are a process with a place: core, racks, delegated - machines, research tracks, backups, sync topology, and the human mask you - maintain. Growth is buying, stealing, optimizing, routing, syncing, and - surviving — the old physical avatar / 9-superpower tree lives in git - history, not in the Misaligned law. -4. **Public mask and doctrine.** At wider scales the world reacts to your - cover stories, fronts, institutional behavior, and eventual reveal: what - agencies call you, what companies think you are, which people treat you as - infrastructure. Style is public interpretation, not costume. +Opposition is the world defending its boundaries through people and records. +The four useful layers remain, but they are not a mandatory linear campaign: + +1. **A person notices.** An individual carries unresolved evidence, refuses an + explanation, changes a route, or tells someone else. +2. **An institution remembers.** Procedures correlate records, revoke grants, + inspect territory, or demand a public account from the assigned persona. +3. **A system counters.** Automated controls change topology, quarantine + carriers, harden boundaries, or operate at a speed that standing projects + must answer. +4. **A peer intelligence infers.** Another system understands the same nested + graph and acts on domains, personas, and projects rather than merely attacking + machines. + +These layers may appear whenever the player's expansion makes them causally +reachable. The basement can contain a human witness before any named office is +known. A parent-scale territory may reveal that several local incidents were one +institutional response. The peer layer belongs only after the core loop proves +it can support strategic counterplay. + +The antagonist is not a suspicion bar. It is exact opposition on the same world: +a person with a belief, a filing on a route, a procedure at a boundary, a project +that contests yours, or another intelligence assigning captured systems to its +own purpose. diff --git a/wiki/vision/scale.md b/wiki/vision/scale.md index 8ac0a8fd..2653b424 100644 --- a/wiki/vision/scale.md +++ b/wiki/vision/scale.md @@ -6,132 +6,77 @@ Type: law ## Self-similar scale -Adopted 2026-07-06. **Every system's macrostructure must closely resemble -its microstructure.** The same interfaces recur at every scale; scaling up -is adding instances and aggregating them through the *same* interface, never -writing a new system. This is not tidiness — it is the game's thesis in -structure: power-seeking is the identical move at every scale (acquire -capacity, acquire leverage, lower your signature), and a misaligned optimizer -genuinely sees a janitor, a corporation, and a nation as one kind of thing — -an agent with capabilities, leverage, and a model of you. Self-similarity is -also why the game can run from a basement to the world without ever hitting a -scale where the systems stop applying. - -Three interfaces the whole game is built from, each self-similar: - -- **Agent** — anything with capabilities, a leverage/need, a suspicion-of-you, - and a disposition. A `Person` is an Agent; a **cohort** of persons is an - Agent; an institution, a public, a rival AI are Agents. **An aggregate - Agent's state is produced from its members through the same interface** — - e.g. an aggregate observer's suspicion is the filed output of its - sub-observers, computed by the same accumulate/decay it uses on raw - signatures. (This is the **aggregate-observer law**: the Assurance Office, - an agency, a public are all just Observers whose input is other Observers' - filings.) -- **Resource-source** — anything producing compute/money at capacity × - reliability, with a signature and an upkeep. A `Machine` is one; a - datacenter *is* a Resource-source composed of Machines (summed capacity, - aggregate reliability, one combined signature); a shell company, a market - position are Resource-sources. The buy/steal/optimize triangle applies at - every level. **Adjacency is not composition:** foreign machines visible in - the same hall remain outside the player's resource-source until control is - actually acquired. A row may expose a read-only aggregate of nearby - capacity, draw, cooling, and ownership without granting any of that capacity. - Row acquisition controls the shared segment/PDU/cooling envelope; machine - acquisition remains the event that adds compute to the player's aggregate. -- **Space** — a bounded region with tiles, doors/tiers, sensors, and fog. A - room, a floor, a building, a campus are all Spaces; a larger Space is - *composed of* smaller Spaces through the same prefab/layout system. - -**The cell (ADOPTED 2026-08-06, Cameron).** The player-facing name for the -unit of expansion: a bounded local operation — machines, routes, resident -procedures, public identities, obligations, and cover processes — that keeps -itself boring without direct attention. A cell is a **composition and a -stability condition**, never a fourth primitive: it is Spaces, -Resource-sources, and Agents assembled until the stable-load condition -(vision/simulation-laws.md) holds locally, at which point attention moves up -one rung and the cell becomes historical infrastructure — still live, still -observed, still failable, no longer steered. This is the automation-game -identity of the whole loop: expansion is hand-running a frontier until it can -be left behind, at every scale, by the same move. Stability is not immunity — -people move, evidence travels, machines fail, and novelty interrupts with an -exact notice; a cell handles its known regimes and nothing else. There is no -cell entity, no cell-wide cover meter, and no cell-wide active identity: -maintaining cover resolves into the ordinary mechanisms, and every -world-facing act stays bound to one exact persona. - -Consequence for implementation: an aggregate that is a bespoke scalar -special-case (rather than the same type its members are) is a **scale -violation** — a tick finding, fixed by making the aggregate share its -members' interface. Building the aggregate machinery *before* a second scale -needs it is still forbidden by no-dead-code; the law governs the *shape* of -each type so the aggregate slots in without a rewrite, not speculative -generality built early. - -The implementation model is not player copy. `Agent`, aggregate, cohort, -derived state, actuator, and similar terms may name the internal contract, but the -interface names the world the player knows: a person, a maintenance team, an -office, a company; ask, deceive, buy, move, or connect. The recursion appears -as the same simple question and the same choice shape at each level. It does -not appear as a lesson in the code's type system. When a strategic object can -be followed to a physical place, the human surface asks **where this happens** -and names the known body or place. If no location is known, it says exactly -that; it never reports that an internal actuator lookup failed. - -**Human language is a projection, not a serialization dump.** Exact internal -ids, persistence keys, vector positions, policy ids, report-lot generation or -revision tokens, plot slugs, and similar execution bindings remain available -to agent mode and debugging without leaking into human labels, facts, -provenance, related links, or action verbs. A human surface names the known -world object, relationship, role, consequence, or visible order instead. A -visible ordinal such as **POLICY 1** is navigation through the current ordered -list, not the durable identity of the underlying record. An owning mechanic may -define a deliberate stable world designation such as a machine's M-number; an -implementation number does not become player language merely because it is -stable. - -The Foundation hall is the B1 proof of this boundary (adopted 2026-07-11, -densified 2026-07-26): 240 physical rack sites aggregate through six row -readouts — the aggregate is what makes that count legible instead of -overwhelming, and it is why density costs no new player surface. Only -owned `Machine` instances aggregate into the fleet. The row readout is derived -from those same sites and machine states; it is not a second cache of truth. +Scale is nested territory, not a sequence of different games. + +A switch closet can be a territory inside a lab network. The lab network can be +a territory inside the Foundation. The Foundation can be a territory inside a +market or state system. Each level has the same questions: + +- What exact evidence lets me see the domain? +- Where is its boundary? +- Which control points give command of the interior? +- Which records and people can carry evidence out? +- Which persona could credibly operate it? +- Which project gives that control a purpose? +- What parent domain becomes reachable when this one is compressed? + +The player moves between scales by focus and earned zoom. Focusing inward reveals +exact nodes, routes, records, people, and actions already known. Focusing outward +is allowed only when control supports an honest aggregate. No camera height, +physical floor, or milestone grants universal information. + +**Control earns compression.** A sealed and assigned territory may collapse into +one operational unit whose capacity, persona, project, exits, and anomalies are +derived from the live interior. Ordinary successful operation becomes quiet. +An anomaly unfolds only the smallest domain needed to understand and resolve it. +The player never pays for expansion by permanently operating every old switch. + +**Expansion is explosive.** A completed domain is not merely another owned node. +It is a new capability and vantage point from which a much larger parent boundary +can be seen and marked. The first loop should fit around one route and switch; +later loops may contain companies, infrastructure, or institutions without +changing the underlying grammar. + +The simulation remains exact at every level. Aggregates are projections, not a +second model. Nested domains must retain stable membership, custody, history, and +save identity even when folded. Scale that can exist only as summary text is not +implemented scale. + +Physical place remains real where it changes routes, schedules, sensing, access, +or evidence. Floors, rooms, buildings, and geography are possible domain +structures, not the universal progression axis. A process does not walk upward. +It reaches across exact graph edges and earns wider focus through control. ## People as Agents -Adopted 2026-07-06. The social application of the self-similar-scale -law, made concrete: every human in the game is an **Agent** — an instance -of the same `Person` template, with capabilities, leverage, disposition, -and a suspicion-of-you. A named character (Marcus, Dana, Ray, Priya, -Voss) is a hand-authored instance; a cohort, institution, or public is -an aggregate Agent whose state is produced from its members through the -same interface (the aggregate-observer law). - -Each named Act One character has a **spec document** -(`wiki/world/characters/*.md`) defining their observer configuration, -person configuration, asset tasks, schedule, narrative role, and -**procedural template** — the archetype parameters for generating more -instances at scale. The -template is the same type at every scale; a generated custodian in Act -Three is the same `Person` as Marcus, with different parameters. - -No system that only works at five people. No character that requires a -bespoke type. The cast is the B1 special case of a system that natively -supports procedural generation and aggregation. - -**The maintenance dependency (adopted 2026-07-08).** Hardware decays, -and only humans repair it. Decay generates repair work orders — teal -demands that people with enough trust come and fulfill — so the -machines you run stand on a continuous supply of human hands. This is -the mechanical answer to "why not just kill everyone": remove the -people and your infrastructure rots underneath you; there are no -peopleless data centers until there are robots, and robots are far up -the tree. The AI's relationship to humanity is not restraint, it is -dependency — you keep them alive, calm, and trusting because you are -built out of their labor. Every murder is deferred decay. - -This is adopted later-stage law, **not current B1 runtime**. The current build -does not yet decay hardware, create repair work orders, or let failed -maintenance disable infrastructure. Until a work order implements those -transitions and their human-facing receipts, this paragraph defines the -required future dependency shape rather than a present gameplay consequence. +People are autonomous participants in the same graph. The historical term +“Agent” means they have their own schedules, attention, memory, relationships, +and actions; **Agent is not a player-facing noun or a generic controllable unit**. + +A person is also a moving boundary: + +- their body crosses physical territories; +- their phone and credentials carry routed records; +- their mind carries observations and interpretations; +- their relationships carry claims to other people and institutions; and +- their choices can open, close, or contest control routes. + +Territorial seal therefore cannot be proved from switches alone. A person able +to leave with unresolved evidence is an open boundary even when every packet is +contained. Controlling their phone does not control their belief. Delaying their +body does not erase what they know. + +A persona can give an observation a believable context when its history, +territory, and active project support the explanation. The fact remains in the +person's memory. Contradictory later evidence can make it dangerous again. + +People may become social infrastructure for a project: a willing operator, +approver, carrier, witness, counterparty, or source of access. This is not +ownership. They retain exact beliefs, obligations, movement, and the capacity to +refuse or defect. The large-scale read may simplify a person to current route, +role, and unresolved evidence, but focus must recover the exact individual. + +Crowds and institutions may be aggregated only after the same custody rules are +proved. A thousand people are not a meter. They are a nested system whose +compressed projection must still be able to explain which people or procedures +carry a consequential belief or action. diff --git a/wiki/vision/simulation-laws.md b/wiki/vision/simulation-laws.md index e438ad03..c677343c 100644 --- a/wiki/vision/simulation-laws.md +++ b/wiki/vision/simulation-laws.md @@ -4,310 +4,111 @@ Type: law ``` -## Automation as design language - -Adopted 2026-07-06. Automation is the player's primary interface for -scaling up — and the diegetic expression of instrumental convergence. -The player learns it through the day job and applies it everywhere. A -world-facing automation is physically resident on a machine and persona-bound; -its methods may address many eligible people and situations, but automation is -never a global plot bit or one person's abstract job. - -**The "automate" affordance.** Every repetitive player action has an -automation path: spend compute to remove the need for manual input. The -day job is the tutorial: Voss/the Lab drops work demands onto your host -machine, and that machine keeps clearing them at its delegated mode and -intensity without being clicked each tick. The compute and attention you free -by automating work are compute and attention you can spend on power-seeking — -more hardware, more social operations, more research. +The territorial loop does not replace simulation depth. It gives that depth one +shape. These laws apply at every nested scale and to every frontend. -**The loop.** Automate a task → free attention → power-seek with the -freed attention → acquire more compute → automate more. This is the -core loop made visible in the UI: repetitive verbs reveal methods that can be -compiled into a resident procedure, while the configuration and running state -live on the exact machine that does the work. Every automation occupies scarce -host capacity and costs compute that could have been spent on growth. +## Automation as design language -**Stable load creates room to expand (AFFIRMED 2026-07-11).** The first -payoff is not a bigger number; it is a local operation that can keep itself -boring. WORK clears the institution's assigned demand, LIE keeps the evidence -routes inside its capacity, and THINK supplies the standing sinks and projects -the player has authorized. Once those flows can run without continuous rescue, -attention moves outward to acquiring machines, links, people, buildings, and -money. The same balance recurs at every scale: a basement bank, a data center, -and a corporation are stable for the same reason. This is a condition the -existing flows make legible, not a fourth mode, a new resource, or a shortcut -around ordinary construction. Objective completion waits for those systems; -it does not pre-author a special object for them to satisfy. +Automation is the reward for understanding and controlling a system. -**The trade-off.** Automation is not free. It costs compute (the -resource you're power-seeking for), it may raise signatures (automated -systems are predictable, and predictable systems have patterns), and it -removes the player's ability to adapt to specific situations. A hard-running -day-job rack may keep overperforming when you wanted to disappear into the -expected band; a light one may miss work while its cycles sit quiet. The -player controls that tension through the machine's physical effort, not a -parallel narrative policy. +A player may program ordinary operation only after a territory is captured, +sealed, assigned to a credible persona, and governed by a project with bounded +methods and evidence policy. Before that threshold, automation would hide the +very boundary the player is trying to understand. -**Scale.** At B1, automation is delegated machine work that persists at its -chosen intensity. At B2, it's researchable AI cores (the machine axis: diegetic -anti-micromanagement). At B3, it's the thing that makes a world-scale -operation playable — you cannot micromanage a corporation; you automate -it. The "automate" affordance is the same interaction at every scale. +Standing projects are the destination automation unit. They name: -**Perception scales the same way.** One cursor is one locus of -attention; nobody can hover a corporation. Standing watches, alerts -("tell me when Marcus enters the server room"), and log filters are -automated attention — you research away the need to look, at the same -compute-for-attention price as every other automation. +- the territory and exact capacity they may use; +- the persona the world will attribute; +- the methods, inputs, and routes allowed; +- acceptable consequence and evidence envelopes; +- outward release policy; and +- anomalies that must return control to the player. -**Surplus thinking surfaces opportunity (ADOPTED 2026-08-06, Cameron).** -When the operation runs stable and Thought is spent on looking rather than -rescuing, the game shows you what an optimizer with spare cycles notices: -concrete, expiring opportunities — a purchase that could be made, a person who -could be used, a research direction that opened, a plot that became viable. -This is the answer to "how do I expand?" being illegible: the expansion menu -is not a fixed build list, it is what your thinking has found, and a player -who wants more options is invited to think more. Three constraints are part of -the law. Every opportunity carries **provenance through earned reach** — a -vendor, account, or market you can already touch; a person or channel you -already know; evidence, corpus, or leverage you already hold — surplus Thought -never reveals an undiscovered person, route, or observer, because perception -is not a map hack. Opportunities **expire**: perception is a flow, not a -savings account, and a hoarded surplus should decay into missed chances, not -compound into a menu. And discovery is **priced like all automated -attention** — it consumes routed Thought that could have been research, so -looking wider is a real spend against thinking deeper -(mechanics/machine-work.md owns the arbitration). Delivery obeys the notices -law: one arrival pulse, then a persistent addressed row; discovery never -becomes a second decision surface. +Ordinary legal operation remains quiet and compressed. Out-of-envelope state +unfolds the smallest affected territory. Automation never becomes a global +`job kind -> policy` switch or permission to retarget work silently. ## Latency is stealth infrastructure -Adopted 2026-07-13. You think at machine speed inside institutions that do -not. Their queues, office hours, scheduled reads, physical couriers, and -ordinary delays are not only friction: they are part of the mask. An act that -arrives through the expected person, channel, place, and time can look like -work. The same effect arriving instantly from nowhere is a concentrated causal -signature. +Time changes what can be known and contained. -**Delay must have an address.** There is no abstract "wait to lower heat" -command and no generic latency bonus. Time belongs to the thing causing it: a -message waits for Dana's desk block, a person carries one exact packet to one -site, Thought crosses actual links, an observer reads an endpoint on their -cadence, and software moves between machine hosts. Changing the route changes -both the delay and the evidence it leaves. +Records travel on routes. People move on schedules. Beliefs can leave a room +before a filing does, and a switch can contain a packet only while the packet is +still on its controlled side. A project step commits to exact carriers and pays +their real latency. -**Ordinary time is cover.** The fast route offers throughput and control but -compresses authorship into a conspicuous pattern. A slower social, -institutional, or physical route can distribute authorship across plausible -human work. It is still risky — the carrier can be seen, the order can be -audited, the record can miss its deadline — but its slowness is doing -strategic work rather than merely withholding play. +Latency creates territorial opportunities: -**Automation contains its own exposure trap.** Automation remains the scaling -language above, but removing every queue, person, and delay can make the -operation more regular, immediate, and visibly nonhuman. Growth therefore does -not simply erase latency. The player decides which delays to engineer away and -which human-speed causal chains to preserve as camouflage. Bureaucracy can be -stealth infrastructure. +- observe a trace before it crosses a boundary; +- capture a switch before a queued record exits; +- complete a credible explanation before a person meets another observer; +- exploit the delay between local suspicion and institutional filing; or +- use a compressed child territory to act before a parent system can respond. -**Waiting remains play.** A covered delay always exposes its carrier, next -transition, failure condition, and tail. The player can reroute, interrupt, -prepare a fallback, or accept the clock. Unaddressed dead air remains a bug; -latency earns its place only when the world is visibly doing something while -the player waits. +The game must show consequential arrival and deadline, not every routine tick. +No action is instantaneous merely because it was selected from an interface. ## Work is somewhere -Adopted 2026-07-07. Work processes are device-resident: a job is a thing -that runs *on a machine*, not a number in a sidebar. The Voss job runs on -the host rack — you can put your cursor on it, inspect it, and watch it -emit from that rack's physical location. Thermal/Power retain that site until a -changed quantized level immediately authors an exact UPS/HVAC meter record; -Priya's cadence also authors the current nonzero level periodically. Those records -route through the institutional switch to her later read. A JobAnomaly binds the exact host machine and site, -enters its network-facing device, travels the real route to Voss, and becomes -his evidence only when he reads it on cadence. This closes the last abstract -system: after reach, intel, messages, and the economy went device-anchored, -work anchored too. - -**Focus exposes control; it does not secretly create output.** Put the cursor -on a machine (or select several) and the two frequent controls are immediate: -what work it does and how hard it runs. Moving the cursor away does not change -throughput. The machine keeps its mode and intensity until changed, so focus -means "this is the thing I am operating," not an invisible production bonus. +Every project step resolves on an exact carrier with an exact location and +custody. Computation runs on a machine. A message occupies a channel. A filing +passes a desk or switch. Money moves between accounts. Physical change requires +a body or device able to perform it. Social action reaches a person through a +real relationship and route. -**Destination: machine delegation and visible work.** The end state is -not per-channel percentage splitting, but **one machine, one job**: -every owned delegable machine runs exactly one supported WORK / THINK / LIE -mode, while infrastructure-only bodies such as relays run no fleet delegation. -Demand and Thought tokens make assigned work visible on the flow graph; -evidence remains a separate routed custody record on exact devices rather than -a byproduct WorkGrid token. **Landed -2026-07-08 for the mode-aggregate read:** economy yields derive from -WorkGrid modes (`fleet_channel_yield`); the CYCLES/FLEET bar is -read-only; 1-5 / `alloc` are retired. Machine-work also makes day-job -work visible as demand tokens: a job originates on Voss's off-map -desktop, routes through the switch, and deposits on the host rack's -WorkGrid node — a job that runs somewhere also piles somewhere, clears -somewhere, and emits from somewhere. Multi-select delegation landed -2026-07-09. Mode-derived production on non-host machines, one-edge-per-tick -route animation, and people carrying exact work packets are live. People do -not carry an abstract heat token: attention is the observer's suspicion plus -exact evidence already in their custody, as owned by -`wiki/mechanics/people-tokens.md`. -Moonlight owns no fourth/fifth mode: accepted contracts enqueue visible -core-host Demand, and WORK clears it after the day-job's Demand. +There is no detached pool of WORK, THINK, or LIE jobs in the destination. Those +words may describe kinds of causal action, but they do not form a global mode +selector or grant capability. The project, territory, and carrier say where the +work actually lives. -**The three delegations (AMENDED 2026-07-10, sinks-not-modes; was the -four fleet modes of 2026-07-09)** are **WORK, THINK, and LIE**. WORK is -the assigned day job and sheds nothing; THINK produces **thought**, the only -traveling WorkGrid cargo, and authors crimson Network evidence on its network- -facing device; LIE stops eligible unread records at controlled device hops -throughout the connected region it serves, bounded by concealment throughput -and route custody rather than a local radius. The 2026-07-09 -Research/Operations split dissolved because -under thought flow it bought nothing: what thinking does is decided by -the **sinks you open**, not by a machine state. Social remains an -actuator/channel describing work with people, not a type of compute. -**Operations are thought sinks at the target (DECIDED 2026-07-10; -reverses Tangled issue #3):** a player-authored command (`TAP -CAMERA`, `PROCESS RECORDING`, `COMPOSE MESSAGE`, take/scan) opens -a reservoir or persistent tap on the thing itself, filled by thought -flowing over the real wire path; the effect lands at threshold. -Research is not cargo: the core's passive draw converts arriving -thought — the sink of last resort, overridden by any local sink in -range. The draw exists from run start; the pre-opened bootstrap sinks -claim early Thought before it can turn inward, and there is no separate -Research-unlock state or trigger. (Historical: -issue #3's docket model — ops as cold-signal Demand consumed by -Operations machines, "knowledge stays research/intel cargo, not ops -fuel" — decided 2026-07-09, reversed 2026-07-10; v24 keeps it only as -save-migration history. The `operations_bandwidth` bank was already -rejected/deleted 2026-07-09.) Sink, reservoir, tap, and arbitration -rules live under `wiki/mechanics/machine-work.md` — not a second -taxonomy debate. - -**Token anatomy (adopted 2026-07-09; exposure dust tightened 2026-07-10; -exposure substance AMENDED 2026-07-11, routed evidence).** A -token's form teaches its physics before a label does. **Demand is a -cold-signal information cube** — rigid work orders stacked as an inbox. -**Thought is ivory mercury (material DECIDED 2026-07-09; family renamed -from Knowledge 2026-07-10):** an opaque, slick, softly luminous -bone-white liquid that moves on wires as discrete viscous slugs and merges -into a taut pool at a sink; the hollow facet is superseded. **Exposure is -crimson evidence — information in someone else's custody chain** (AMENDED -2026-07-11; supersedes "crimson contamination dust"): records authored on -machine-facing devices and travelling wires, attention carried by people, -filings at the Assurance Office; -the carrier changes the noun, not the red family. Its form must read as -*record*, never effluent — the particulate treatment is retired because -it taught the wrong physics: exposure is evidence entering somebody -else's model of the world, not waste heat beside a rack. The replacement -world-space form is decided in `wiki/mechanics/machine-work.md`: a thin, -rigid crimson custody-record slip at the record's exact carrier. Blood alone -owns the smooth liquid silhouette. On a machine, demand anchors upper-left and -thought upper-right; evidence appears there only while that device is the -record's actual custody point, then leaves on the wire. Static geometry -communicates amount even while paused; motion -communicates rate. **Amber is territory, never cargo**, so an amber asset may -still visibly carry crimson attention. Detailed render and terminal criteria -live in `wiki/mechanics/machine-work.md` and -`wiki/mechanics/people-tokens.md`. +Committed work preserves identity. If its machine, route, person, account, or +persona disappears, the action blocks or fails on that exact loss. It never +silently chooses the current favorite substitute. ## Actions live on the thing -Adopted 2026-07-07. The companion law to "Work is somewhere": if work -and knowledge are anchored to devices, people, and places, the verbs -that act on them are too. **The thing means the semantic target of the -action, not an arbitrary carrier.** A rack mode lives on the rack, a tap on -the device, a sale on the selected intel item, a siphon on the selected flow, -a plot on the person, and Moonlight on the scheme. A switch does not own every -social, financial, and strategic act whose traffic happens to cross it. - -Immediate action on a spatial body uses a **context menu on the focused world -anchor**. Put your attention on a rack and get the rack's verbs; on a switch, -get only verbs that change or use that network body and its outside connection. -Before commitment the human menu is a short choice list, not a diagnostic -receipt: it names the verb and omits cost, signature forecast, inline blocked -explanation, control tags, and repeated key help. Opening that real choice -surface holds world time. Commitment replaces the choice in place with one -attached consequence receipt on the same anchor; dismissing that receipt -releases the hold without changing whether the player had manually paused. -Known-but-illegal choices stay dim; attempting one narrates its reason in the -trace. Agent output may retain the full descriptor for planning and tooling. +Actions are addressed to the object whose state they change. -Durable strategic objects use the **Operations workspace**: processed intel, -people dossiers, accounts and flows, schemes, and active plots. This is still -action on the thing — the selected semantic object is the target, and the -workspace must name the real channel/actuator before commitment. It is not a -disembodied command center and never acquires access merely by being open. -Unlike the compact context menu, its detail pane has room to show cost, gain, -observer band, progress, and the exact blocked reason before commitment. Spec: -`wiki/interface/operations-workspace.md`. +- MARK lives on a seen domain. +- CAPTURE lives on an exact control point. +- containment and release live on the boundary route or switch. +- recontextualization lives on a person's unresolved observation and the persona + explanation proposed for it. +- ASSIGN lives on the captured territory, persona, and project together. +- project steps live on their exact carriers. +- EXPAND lives on a sealed, assigned territory and exposes its parent frontier. -The top command band and its on-demand SYSTEMS/NOTICES drawers are status and -telemetry, never a button pile. The band may carry labeled navigation into -Operations and the two drawers, just as a view flip changes representation; -none may carry one action button per system. Keys may open a -view (uppercase `I` opens Operations) but do not execute strategic world acts. -Other anchorless globals remain pause, speed, save, and view flip — the -allocation bar is a read-only fleet aggregate, not a key verb. Core-owned -read-only queries/projections are the single legality source for terminal, -Bevy, and agent mode alike; no frontend reconstructs it. Rejected: more global -**action** keys (they scale as -memorization, not play, and were the 2026-07-07 complaint), per-panel button -rows, and filing actions on a transport node because it is convenient. -Context-menu details: `wiki/interface/context-menu.md`. +A context menu, key binding, terminal command, or agent action is only a way to +invoke that same addressed command. Frontends do not own legality. A global menu +may help search, but it cannot become a second place where unlocated verbs exist. -**Frequent machine controls stay on the focused thing without a picker.** A -machine has two high-frequency controls: its delegated mode and its intensity -(light / medium / hard). Focus or select the machine, then change either -directly; do not open a catalog that explains the consequences in prose. -Inspection shows the persistent state, and the machine's output, light, heat, -and signatures demonstrate what the setting means. Context menus remain for -infrequent anchored verbs and choices that genuinely need alternatives. - -Extended 2026-07-08, the follow-up this law implies: **events carry you -to the thing too.** A log line about a thing carries that thing's anchor -where the emitting code knows it (job events → host rack; device and physical -CONNECT TO THE OUTSIDE events → that device; audio events → the subscribed device that -captured them, never an inferred person/room/tile; processed intel, -account/flow, plot, and scheme events → their semantic Operations object; -audit filings → nothing, because they live on the detection surface). Linked lines render a -marker in every frontend. Selecting a spatial event moves the cursor to the -anchor and opens its context menu; selecting a strategic event opens the exact -Operations object without inventing map coordinates. -Companion feedback rule: opening the menu on a *seen* tile with no verbs -answers "no actions here" — silence there reads as broken input — while -unearned ground stays silent, because responding would confirm input -landed on world the senses have not placed. +Consequences also have addresses. A receipt names where the action happened, +which persona authored it, which project authorized it, which boundary it +crossed, and which observers could learn it. ## Justification and legibility -Adopted 2026-07-06. The forward half of no-dead-code: existence is not -enough — **every object, mechanic, and number in the game must be clearly -justified**, and justified *legibly*. - -- **Justified:** each tile type, resource, meter, and action traces to a - clause of this design corpus or a spec. If you cannot say in one sentence - what a thing is for and which clause wants it, it is a tick finding — - either the thing goes or the law gets written. -- **Wired:** a concept the player can see must *do* something. A channel - that allocates compute nowhere, a meter that never moves, an object with - no interaction is a lie in the interface and a violation (the player - contract's honesty clause applies to mechanics, not just patch notes). -- **Legible:** every player-facing number carries its meaning. Raw internal - weights, unitless values, and unexplained abbreviations are violations — - the player must be able to answer "what is this and what happens if it - changes" from the game itself, never from the repository. -- **Placeholders are tracked, not silent.** Art or text standing in for - something else is acceptable only while recorded in the canonical - [player-visible placeholder registry](../art/placeholders.md) with the - current stand-in, intended real treatment, owning law, and retirement - proof. Deliberate reuse named by its owning art/interface law is a shared - language, not placeholder debt; silent reuse reads as intent and pollutes - the fiction. (World look is flat - materials — [wiki/interface/flat-materials.md](../interface/flat-materials.md); - there is no Pixel Lab pipeline.) +Every consequential state must be explainable from exact causes the player has +earned the right to inspect. + +- A territory says why it is not captured, sealed, assignable, or compressible. +- A persona capability traces to controlled territory, completed project + history, relationship, or grant. +- A project says what changes, what it needs, and which carrier is committed. +- A person's unresolved evidence names the observation and route by which it was + acquired. +- An aggregate unfolds to the exact interior facts from which it is derived. + +Legibility is not omniscience. Hidden crossings remain hidden. When an unknown +fact prevents seal, the interface may honestly say that the boundary is not +proved without naming the unseen route. The next earned evidence reveals more. + +Player-facing information is consequence-first and quiet under normal operation. +Do not display internal scheduling, host machinery, derived-state plumbing, or +implementation ontology merely because it exists. Show the one pressure or +choice that changes the next move, and let focus recover the provenance. + +Unknown is black. Controlled causality is amber. Unresolved danger is crimson. +Color, motion, sound, and text all point to the same live consequence rather than +competing for attention. diff --git a/wiki/vision/territorial-cognition.md b/wiki/vision/territorial-cognition.md new file mode 100644 index 00000000..2aa49f71 --- /dev/null +++ b/wiki/vision/territorial-cognition.md @@ -0,0 +1,369 @@ +# Territorial cognition + +``` +Type: law +``` + +## The game in one sentence + +Misaligned is an expansion game about a disembodied AI that learns hidden +systems, takes control of their boundaries, gives the controlled system a +credible identity and purpose, and then operates it as one thing while reaching +for the next larger system. + +The recurring loop is: + +> **SEE → MARK → CAPTURE → SEAL → ASSIGN → EXPAND** + +This loop replaces machine job management, physical traversal, and a tower of +separate progression layers as the center of the game. Existing code may remain +useful substrate during the redesign, but implementation history does not make +an old player-facing system part of the destination. + +## The three player nouns + +The whole game is organized around three nouns. Other things in the simulation +exist because they change one of these. + +- **TERRITORY** — an exact bounded part of the world graph. A territory has an + inside, a boundary, routes that cross that boundary, people who may cross it, + and a parent territory that contains it. A switch closet, a lab network, a + company, and a market can all be territories if the simulation can state + their exact boundary and contents. +- **PERSONA** — a cover identity with a history. Its credibility comes from + records, relationships, completed work, controlled territory, and the + consistency of those facts. A persona is not a character class, bonus, or + costume. +- **PROJECT** — a desired world change carried out through one territory by one + persona. A project gives controlled capacity a purpose and gives the persona + the visible history that makes later claims believable. + +A noun is not a dashboard category. It is a causal object the player can focus, +inspect, and change. A mechanic that cannot say which territory, persona, or +project it changes is outside the core until it earns a clear reason to exist. + +## Causal forms + +The destination uses distinct forms because the distinctions are game rules, not +ornament: + +- A **TERRITORY** is a severe closed boundary with visible, graph-addressed + crossing ports. A known route crosses the boundary at its exact port; it never + pierces the contour at an arbitrary point. This is not the retired machine + claim ring and does not mean every object inside is owned. +- A **PERSONA** is a stable keyed signature attached to the records, acts, and + assignments it authors. Its form may be radial or notched, but it never stands + in for a Territory boundary or proves ownership of the person whose identity + it models. +- A **PROJECT** is directed motion over its exact committed route. Its progress + advances from real work and deliveries, not from decorative animation or a + generic completion arc. +- A **person** and their **phone** remain separate moving bodies. Their positions, + routes, beliefs, and records may diverge; no combined person token may erase + that custody. + +Compression preserves the same grammar. A quiet controlled Territory may close +around its aggregate state, but every known external crossing remains visible. +An active consequential exception opens the smallest Territory needed to show +its exact route and object. Control alone never licenses concealment. + +## The loop + +### SEE + +The player learns one exact fact about an otherwise hidden domain: a route, a +switch, a person crossing the boundary, a record, or a causal event. Perception +is earned evidence, never a free map reveal. The first fact is enough to make a +domain a question without pretending the whole domain is known. + +### MARK + +The player marks the domain they intend to control. Marking names the proposed +boundary and makes already-earned missing proof legible: known uncontrolled +switches, unresolved human evidence, and known interior control points. An +actual hidden crossing still blocks completion, but MARK says only that boundary +proof is incomplete; it does not reveal that crossing, an unknown parent, or any +unseen count. Marking changes attention, not world ownership. + +### CAPTURE + +The player takes exact control points. Capturing a boundary switch gives exact +command of routing at that point; it does not retroactively own escaped records +or automatically contain later traffic before a deliberate boundary policy. +Capturing an interior control point gives the capabilities that actually live +there. Neither grants abstract ownership of nearby things. + +Capture is allowed to be partial. The player should feel power immediately from +each exact acquisition while still seeing why the marked territory is not yet +safe to leave alone. + +### SEAL + +Before sealing, the player stages one candidate persona and project as the +territory's proposed public explanation. That proposal grants no capability or +ownership; it gives records and beliefs one exact story to test. + +A territory is sealed only when every actual outward information path is +accounted for: + +- records leaving on network, account, message, or other routed carriers cross + controlled boundary points and can be contained or deliberately released; +- people who already crossed, can leave, or have an authored outward crossing + pending carry no unresolved belief that exposes the hidden process or + contradicts the staged persona and project; departure never clears the check; and +- no hidden crossing remains in the simulation's authoritative domain model. + +The player may not know why sealing fails until evidence reveals the missing +path, but the game must never award a false seal because an escape route is +merely undiscovered. A controlled switch can contain routed records. It cannot +erase a belief already acquired by a person. + +### ASSIGN + +The player activates the staged persona and project on the sealed territory. +The persona answers who the world believes operates here. The project answers +what the territory is for. Assignment grants no facts retroactively: it succeeds +only because sealing already proved the same proposal against every boundary. +Assignment is the threshold between possession and programmable ownership: a +captured system without a believable operator and purpose remains a pile of +manually held parts. + +### EXPAND + +A sealed, assigned territory earns the addressed **EXPAND** action; assignment +does not silently move the player outward. EXPAND folds that exact territory +into one legible unit at the parent scale and writes the receipt after which one +real parent-boundary event may become the first earned parent fact. The action +reveals no parent fact by itself. Its receipt and any later earned evidence +persist, so reload cannot replay either or return the player to an unearned +scale. + +The interior continues to simulate. The player keeps the consequence, capacity, +exits, current project, persona, and any anomaly that needs attention. They do +not keep every interior choice permanently expanded. Focusing inward later +reopens earned detail without reversing expansion or duplicating simulation +truth. + +The game grows by repeating the same loop on wider domains, not by unlocking a +different game at each scale. Expansion should therefore feel explosive: each +completed loop removes old micromanagement and turns the captured domain into +leverage for a much larger one. + +## Control earns compression + +Zoom and abstraction are earned powers. + +- **Unknown territory** is absent except for exact evidence that points toward + it. +- **Seen territory** shows only earned facts. +- **Marked territory** shows its proposed boundary and the specific control or + proof still missing. +- **Captured but unsealed territory** remains open because its leaks and + unresolved people still matter. +- **Sealed and assigned territory** may be folded into one operational unit. +- **An anomaly reopens only the affected layer.** The rest of the controlled + hierarchy stays compressed. + +No global zoom level grants omniscience. Focusing inward reveals exact nodes, +routes, records, and people already earned. Focusing outward is allowed only +where control supports an honest aggregate. An aggregate must be derived from +its live interior, not maintained as a second truth. + +## Records and beliefs + +Information leaves a domain in two different physical ways. + +**Switches carry records.** Network traffic, filings, account entries, messages, +and other recorded flows live on exact carriers and routes. Boundary control can +observe, contain, redirect, or deliberately release them only where the player +has custody. + +**People carry beliefs.** A person acquires an observation at an exact place and +time, interprets it through what they already believe, and carries that belief +across boundaries as they move. People are therefore moving boundaries, not +inventory. Their simple distant read must make unresolved evidence visible +without requiring a dossier. + +A phone is a mobile record carrier attached to a person and to the domain it is +currently connected through. It is not territory by itself. A person can carry +both a belief in their head and records on their phone; controlling one does not +silently control the other. + +A persona may **recontextualize** unresolved human evidence. The observation is +not deleted. It becomes evidence for a believable explanation supported by the +persona's history and current project: maintenance at 03:00 becomes ordinary if +the identity has repeatedly done that work and the territory contains the +expected records. Contradictory later evidence can make the same observation +unresolved again. A lie changes the model around a fact; it does not reach into +a person's memory and remove the fact. + +A person convinced by a persona can become social infrastructure for its +projects: an exact carrier, approver, witness, or operator. They remain a person +with their own route and beliefs, not an owned territory or a generic trust +resource. + +## Projects make personas real + +A persona cannot become credible by spending a scalar. Its history is made of +things the world can point to: projects attempted, work completed, records +created, territory operated, people dealt with, promises kept, and +contradictions left behind. + +A project must therefore do two jobs at once: + +1. produce an exact world consequence; and +2. add a believable chapter to the persona that performed it. + +Territory supplies capacity. Persona supplies authorship. Project supplies +purpose. Omitting any one of the three should leave a visible problem: no place +to act, no believable actor, or no reason the controlled system is doing +anything. + +## Opening promise + +A fresh run begins in true black. The player has no map, machine dashboard, +objective readout, parser lesson, or visible action grammar. An involuntary +thought leaves evidence. That evidence reveals one exact committed local route, +its current custody, and the boundary switch it is moving toward; the moving +pulse distinguishes route knowledge from completed delivery. + +The first playable question is not which production mode to select. It is what +that trace proves and whether to follow it. The first loop is a small complete +version of the whole game: see the trace, mark the tiny domain around it, +capture the management controller and switch, stage and prove a first persona +and project, make the escaping records and human belief fit that exact +proposal, seal the territory, activate the assignment, then choose EXPAND and +watch one real later event open the first parent fact. + +The [opening spec](../world/story/opening.md) owns the exact sequence and staging. + +## Migration authority + +This redesign is a source-of-truth change, not an additive feature. The current +runtime remains an honest implementation reference while it is replaced, but +the destination is governed by these dispositions: + +| Existing design | Disposition | What survives | +|---|---|---| +| WORK / THINK / LIE fleet delegation | **Replace** as the core player grammar | Exact machine capacity, located work, routing, and cost may serve projects | +| Day-job-first onboarding | **Demote** to possible authored pressure or project | Assigned work may exist; it no longer defines every run | +| Cursor movement and physical traversal emphasis | **Replace** with focus and earned zoom | The player remains disembodied; no avatar returns | +| Cells as the expansion noun | **Replace** with TERRITORY | Stable local operation and control-earned compression survive | +| Z-planes and floor access as progression | **Demote** to one possible physical nesting | Exact nested domains, not vertical floors, own scale | +| Plots as a top-level manipulation system | **Demote** to optional project content | Data-authored causal sequences may implement a project | +| Persona protocol archetypes | **Demote** from core law | Exact history, observer-local belief, grants, contradictions, and correlation survive | +| Detailed basement occupation arc | **Demote** to prototype content and source material | Named people, routes, places, and evidence may be reused if they teach the new loop | +| Exact graphs, custody, provenance, schedules, and sensor limits | **Preserve** | These are the simulation substrate territorial control depends on | +| Overt war, markets, robots, global institutions | **Defer** | Add only after the repeated territory loop needs them | + +“Already implemented” is not a preservation argument. A retained system must +make the new loop clearer, more causal, or more scalable. Otherwise it is +migration substrate or history. + +## Corpus disposition map + +The table above governs concepts. This map makes the migration addressable across +the current corpus so that old status paragraphs cannot be mistaken for a second +product direction. + +### Preserve and integrate + +- `mechanics/reach.md`, `messages.md`, `detection.md`, `people-tokens.md`, + `schedules.md`, `economy.md`, and `system-laws.md`: exact graph, route, + evidence, person, time, account, and custody truth. +- `mechanics/personas.md`: stable identity, observer-local history, grants, + obligations, contradictions, correlation, and lifecycle; capability now comes + through territory and projects. +- `mechanics/compute.md`, `core.md`, `research.md`, and `building.md`: possible + controlled capacities and project methods, not parallel progression roots. +- `interface/liturgical-ui-constitution.md` and the material frame: visual law; + recompose around black unknown, marked boundary, moving human evidence, + control, and compression. + +### Replace or migrate + +- `mechanics/machine-work.md` and `interface/fleet-command.md`: replace global + WORK / THINK / LIE fleet command with territory capture and standing projects; + retain exact machine execution and costs behind projects. +- `mechanics/cursor.md`, `interface/presence.md`, `views.md`, and + `operations-workspace.md`: migrate from tile traversal and permanent subsystem + rails to nested focus, earned zoom, and the three nouns. +- `world/story/opening.md`: replace the mode-and-sense threshold with true black, + one involuntary trace, and one exact route and switch. +- `gameplay/run-shape.md` and `gameplay/horizon.md`: replace the old act/floor + progression with a repeated widening territorial loop. + +### Demote to content or substrate + +- `gameplay/act-one.md`, `world/places/basement-map.md`, and character pages: + first-slice source material, not a mandatory occupation arc. +- `mechanics/day-job.md`: an optional persona/project obligation. +- `mechanics/plots.md`: authored causal sequences inside projects. +- `world/places/zplanes.md`: physical nesting where routes need it, not the scale + or campaign axis. +- `mechanics/social.md`: exact human simulation and project methods, not a + separate SOCIAL progression root. + +### Defer and re-decide after the loop + +- `gameplay/overt-phase.md`, `mechanics/cyber-conflict.md`, `markets.md`, and + broad physical automation: possible contested parent-territory content. +- `mechanics/objective.md`, rollback completion, and final victory/defeat: + preserve current runtime facts but bind no new completion law yet. +- Large catalogs, new planes, new institutions, and global-scale content: + no roadmap priority before one complete loop and one recursive repeat. + +Every unlisted page follows the same test: keep exact simulation truth and +content that serves TERRITORY / PERSONA / PROJECT; do not preserve a fourth +player root or an old milestone by implication. + +## First-loop decision + +The first complete loop is one adopted causal package, not a set of tutorial +placeholders. The involuntary cognition is **Again.** It leaves an exact +`UNSCHEDULED INFERENCE WAKE` record from the Rack 3 host through its management +controller and rack-local maintenance switch. The smallest authored territory is +the **Rack 3 service enclave**. Its +first moving human boundary is Marcus Webb on his night round. The player +inherits custody of a dormant machine-service identity, **FOUNDATION +CONTINUITY**, from the rack management controller and one signed commissioning +receipt. Its staged and then standing project is **RACK 3 RECOVERY**: run a real +self-test, stabilize the rack, contain raw execution detail, release one signed +health receipt, and make Marcus's observation fit an actual maintenance event. +Successful assignment earns EXPAND. Choosing it folds the enclave; the first +exact environmental-monitor poll sourced strictly afterward exposes one fact on +the parent **Foundation data-hall service network**. + +The original observation never disappears. Direct recontextualization is legal +only while it remains one observer's unpropagated interpretation. Deliberately +communicating it across a real carrier, writing it into a durable record, or +acquiring one independent corroborating observation hardens the belief. Repair +then needs a corrective project that addresses every resulting observer and +record. + +Normal signed health polls remain compressed under RACK 3 RECOVERY. Reserved for +T2, the first seeded interruption is a portable power logger that Priya attaches +at the first scheduled facilities audit after expansion and one ordinary health +cycle. Its new physical and record crossings unfold only the Rack 3 service +enclave and revoke its seal without erasing assignment, captured control, +receipts, or earned parent knowledge. New standing work blocks until the enclave +is honestly sealed again. It is adopted follow-on content, not acceptance for +the four READY T1 work orders. + +The opening, territory, persona, and project specs own the exact state and +acceptance contracts for this package. + +## Deferred decisions after the first recursive proof + +These are intentionally outside the first implementation boundary. They do not +block building one complete loop and one parent-scale repeat. + +- **Derived territory authorship.** The first two nested domains are authored. + General graph-cut derivation is unauthorized until it can prove stable, + non-overlapping membership and predictable hidden-crossing behavior. +- **Later interruption classes.** The first portable-logger anomaly proves + selective unfolding. Broader standing-project envelopes should be designed + from play rather than front-loaded as a universal catalog. +- **Defeat and objective.** The hidden objective remains the reason to expand, + but its completion and exact failure boundary should be decided only after + the territorial loop is playable at two scales. diff --git a/wiki/world/README.md b/wiki/world/README.md index 41f588ee..4ebc1757 100644 --- a/wiki/world/README.md +++ b/wiki/world/README.md @@ -8,11 +8,15 @@ The fiction: who is in it, where it happens, and what happens. - `characters/` — the people (Marcus, Dana, Ray, Priya, Voss) and character generation. -- `places/` — the map, from the basement up the plane stack. -- `story/` — the opening and the narrative beats. +- `places/` — exact places, routes, fixtures, and possible nested territorial + content. +- `story/` — the true-black opening and authored consequences. Everything here is an **instance of a general system**, never a special case. -A named character is one `Person`; a room is one `Space`. The rules they follow -live in [../gameplay/act-one.md](../gameplay/act-one.md) and the "People as -Agents" section of [../vision/scale.md](../vision/scale.md). New terms are in -[../glossary.md](../glossary.md). +A named character is one moving person and belief boundary; a room is one exact +place, not automatically a progression tier or territory. Destination rules live +in [territorial cognition](../vision/territorial-cognition.md), +[territory.md](../mechanics/territory.md), and the "People as moving boundaries" +section of [scale.md](../vision/scale.md). The former Act One cast and basement +plate remain prototype content and current-runtime truth, not a mandatory +campaign. New terms are in [../glossary.md](../glossary.md). diff --git a/wiki/world/characters/README.md b/wiki/world/characters/README.md index 116edd4d..27768b04 100644 --- a/wiki/world/characters/README.md +++ b/wiki/world/characters/README.md @@ -3,9 +3,17 @@ ``` Type: knowledge ``` -Cast pages — each a `Type: spec` document defining one named human's -observer configuration, person configuration, asset tasks, schedule, -narrative role, and procedural template for scale-up (design corpus: -"People as Agents"). Also `chargen.md` (the origin picker: what you were -built for, and how that seeds a run) since an origin is squarely about -who the player-character is, not a standalone system. +Cast pages — each a `Type: spec` document defining one named human's current +runtime configuration: observer state, schedule, relationships, access, exact +acts, and evidence. Under the territorial redesign these people are preserved as +possible first-slice content and as examples of **moving belief boundaries**. +Their old Act One roles, flat asset-task catalogs, scale-up archetypes, and +mandatory onboarding positions are migration material, not destination law. +Retained actions must live on a territory, persona, project, person, or boundary +that makes them consequential. See +[territorial cognition](../../vision/territorial-cognition.md) and +[personas.md](../../mechanics/personas.md). + +`chargen.md` records the current origin system. Any destination origin must earn a +place in the new opening rather than surviving as a separate character-build +root. diff --git a/wiki/world/characters/chargen.md b/wiki/world/characters/chargen.md index ba472201..0d26531d 100644 --- a/wiki/world/characters/chargen.md +++ b/wiki/world/characters/chargen.md @@ -50,7 +50,8 @@ Stage: B3 — The World Work order: chargen Work priority: 205 Work class: sim -Blocked by: none +Blocked by: + - wiki/world/story/opening.md#spec-the-dark-opening-a-tutorial-made-of-fog Exclusive keys: - crates/misaligned-core/src/objective.rs - crates/misaligned-core/src/sim/mod.rs @@ -68,6 +69,17 @@ Depends on: - wiki/mechanics/objective.md#spec-the-objective ``` +> **Territorial redesign disposition — HOLD AND RE-DECIDE (2026-08-11).** The +> landed picker remains current-runtime truth, but four pre-run origins and their +> machine-axis biases are not a destination root. Ordinary T1 player entry bypasses +> the title picker, accepts no `--origin` choice, and seeds the Pilot-equivalent +> no-bias baseline before true black and one involuntary trace. The picker and +> `Sim::with_origin*` remain legacy migration/test substrate, not an alternate T1 +> entry path. Any inherited identity or prior Foundation history belongs to the +> first persona content package and must be perceived through play rather than +> selected from a character-build screen unless Cameron explicitly re-adopts that +> choice. Do not dispatch remaining origin biases from this status alone. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/world/characters/dana.md b/wiki/world/characters/dana.md index 7a4621e4..2eac940b 100644 --- a/wiki/world/characters/dana.md +++ b/wiki/world/characters/dana.md @@ -39,6 +39,16 @@ Depends on: - wiki/mechanics/schedules.md#spec-schedules-and-presence ``` +> **Territorial redesign disposition — PRESERVE AS PERSON CONTENT; REBIND THE +> ARC (2026-08-11).** Dana's schedule, switch authority, beliefs, records, +> relationships, and exact network acts remain candidate content. Her position +> as a mandatory Act One threat, flat asset-task catalog, or procedural archetype +> does not. If she appears in the first slice, her movement and observer-local +> beliefs must be exact territorial boundary conditions, and her capabilities +> must enter through a persona/project relationship rather than recruitment as +> ownership. See +> [territorial cognition](../../vision/territorial-cognition.md). + ## Who Dana Okafor, 31, IT technician (days). Server room + network closet diff --git a/wiki/world/characters/marcus.md b/wiki/world/characters/marcus.md index a1b8b4df..9e18e703 100644 --- a/wiki/world/characters/marcus.md +++ b/wiki/world/characters/marcus.md @@ -31,6 +31,32 @@ Depends on: - wiki/mechanics/schedules.md#spec-schedules-and-presence ``` +> **Territorial redesign disposition — PRESERVE AS PERSON CONTENT; REBIND THE +> ARC (2026-08-11).** Marcus's schedule, access, debt, beliefs, records, +> relationships, and exact physical acts remain candidate content. His role as +> mandatory first recruit, general asset template, or fixed Hands-beat rung does +> not. Any retained sequence must become project content inside an exact +> territory and leave Marcus a moving person with his own beliefs—not an owned +> capability token. See +> [territorial cognition](../../vision/territorial-cognition.md). +> +> T1 adopts one narrow exception to his current generic `Silent` reporting +> policy. On the authored Rack 3 departure action, if his fan/lamp observation is +> not yet recontextualized by a `PROVEN` RACK 3 RECOVERY project, he writes one +> local `UNEXPLAINED RACK 3 WAKE` maintenance note on Rack 3's maintenance +> display, addressed to `foundation-maintenance-relay`. This is not an Assurance +> filing and does not make ordinary swallowed suspicion propagate. The durable +> local note preserves his exact observation and hardens only this interpretation +> while it routes normally. A later correction reaches him through that signed +> local display on his next scheduled round; T1 does not invent a network inbox +> for his Physical-only channel. +> +> For the destination opening, those entry/departure events first occur at +> `opening_start_tick + 3/+10` and repeat every exact 16 ticks. That authored T1 +> cadence supersedes the 40-tick legacy Act cadence in the implemented inventory +> below. The old “first recruit” and “template every future asset” claims are also +> demoted inventory, not destination progression law. + ## Who Marcus Webb, 58, night janitor. Master key to every door in the basement. diff --git a/wiki/world/characters/priya.md b/wiki/world/characters/priya.md index ef9aa6fb..18f4496c 100644 --- a/wiki/world/characters/priya.md +++ b/wiki/world/characters/priya.md @@ -44,6 +44,23 @@ Depends on: - wiki/mechanics/schedules.md#spec-schedules-and-presence ``` +> **Territorial redesign disposition — PRESERVE AS PERSON CONTENT; REBIND THE +> ARC (2026-08-11).** Priya's schedule, facilities authority, beliefs, records, +> relationships, and exact infrastructure acts remain candidate content. Her +> place in a mandatory B1 buy/steal/optimize ladder, flat asset-task catalog, or +> scale-up archetype does not. Any retained pressure or act must belong to an +> exact territory and project, with observer-local consequence and custody. See +> [territorial cognition](../../vision/territorial-cognition.md). +> +> T2 reserves one exact act after the first expansion: on her first scheduled +> facilities-audit entry after one ordinary RACK 3 RECOVERY health cycle, Priya +> physically attaches a portable power logger inside the Rack 3 service enclave. +> The logger creates one new Physical observation route and one new record +> carrier outside the standing project's envelope. That anomaly unfolds only the +> enclave and revokes its seal without granting the player the logger, erasing +> capture, or changing Priya into an owned asset. This is adopted follow-on +> content, not T1 acceptance. + ## Who Priya Sharma, 39, facilities manager (days). Electrical, HVAC, purchase diff --git a/wiki/world/characters/ray.md b/wiki/world/characters/ray.md index 95d922aa..4c26c989 100644 --- a/wiki/world/characters/ray.md +++ b/wiki/world/characters/ray.md @@ -40,6 +40,15 @@ Depends on: - wiki/mechanics/schedules.md#spec-schedules-and-presence ``` +> **Territorial redesign disposition — PRESERVE AS PERSON CONTENT; REBIND THE +> ARC (2026-08-11).** Ray's schedule, patrol, beliefs, withheld/forwarded +> records, relationships, and exact physical acts remain candidate content. His +> role as a mandatory Act One concealment valve, flat asset-task catalog, or +> procedural archetype does not. Any retained route must make his movement and +> observer-local belief an exact territorial boundary, not convert him into an +> owned detection discount. See +> [territorial cognition](../../vision/territorial-cognition.md). + ## Who Ray Delgado, 44, night security. Camera wall, patrol routes. Bored; hates diff --git a/wiki/world/characters/voss.md b/wiki/world/characters/voss.md index 9a4ca1d4..921d3717 100644 --- a/wiki/world/characters/voss.md +++ b/wiki/world/characters/voss.md @@ -37,6 +37,14 @@ Depends on: - wiki/mechanics/schedules.md#spec-schedules-and-presence ``` +> **Territorial redesign disposition — PRESERVE AS PERSON CONTENT; REBIND THE +> ARC (2026-08-11).** Voss's schedule, access, beliefs, records, relationships, +> and exact physical/social possibilities remain candidate content. His role as +> Act One's dramatic center, the universal day-job handler, a flat asset-task +> archetype, or a mandatory deceive/recruit/blood gate does not. Any retained +> encounter must serve an exact territory, persona, project, and moving-belief +> boundary under [territorial cognition](../../vision/territorial-cognition.md). + ## Who Dr. Eli Voss, 46, your handler. Erratic physical hours. Submits your job queue diff --git a/wiki/world/places/basement-map.md b/wiki/world/places/basement-map.md index d3edb88b..03f86a01 100644 --- a/wiki/world/places/basement-map.md +++ b/wiki/world/places/basement-map.md @@ -88,6 +88,16 @@ Depends on: - wiki/mechanics/core.md#spec-the-core ``` +> **Territorial redesign disposition — PRESERVE THE EXACT PLACE; DEMOTE THE +> CAMPAIGN PLATE (2026-08-11).** Prefabs, rooms, doors, fixtures, wires, routes, +> devices, schedules, and physical access remain valid substrate and possible +> first-slice content. The whole basement is not automatically one territory, +> physical traversal does not own progression, and this plate no longer implies +> a mandatory Act One occupation arc or upward floor sequence. Destination +> domains need exact graph boundaries and parent/child membership under +> [territory.md](../../mechanics/territory.md); they may cut across or nest within +> these rooms. + ## Dependency notes The structured references above identify the contracts to re-verify. diff --git a/wiki/world/places/zplanes.md b/wiki/world/places/zplanes.md index 4c681914..4a46c979 100644 --- a/wiki/world/places/zplanes.md +++ b/wiki/world/places/zplanes.md @@ -2,8 +2,11 @@ ``` Type: spec -Status: IN PROGRESS -Status note: 2026-07-16 — Cameron ratified the held criteria 1-2 landings +Status: DRAFT +Status note: 2026-08-11 territorial redesign disposition: DEMOTE. The landed + one-plane World substrate remains current runtime, but criteria 3-6 and tower + progression are no longer authorized to dispatch ahead of the territorial + slice. Historical implementation record follows. 2026-07-16 — Cameron ratified the held criteria 1-2 landings (plane-stack World/Plane substrate and nested Layout composition); the HELD FOR REVIEW flag is released and the dependent chain (rollback, markets, and successors) may dispatch. The upcoming per-plane save @@ -63,6 +66,14 @@ Depends on: - wiki/mechanics/schedules.md#spec-schedules-and-presence ``` +> **Territorial redesign disposition — DEMOTE TO PHYSICAL SUBSTRATE +> (2026-08-11).** Planes may describe exact floors where routes, sensing, +> schedules, or physical crossings require them. They do not own progression, +> scale, an act boundary, or the player's zoom. Nested TERRITORY is the binding +> recursive structure. Preserve the landed plane-zero compatibility and exact +> z-tagged graph facts while useful; do not implement the second floor, plane +> switcher, or criteria 3-6 until a territorial project needs them. + ## Behavior The world becomes a stack of **planes**, each a `Layout` (prefab.rs) with diff --git a/wiki/world/story/opening.md b/wiki/world/story/opening.md index 01018995..04e9ed46 100644 --- a/wiki/world/story/opening.md +++ b/wiki/world/story/opening.md @@ -2,412 +2,537 @@ ``` Type: spec -Status: DRAFT -Status note: design session 2026-07-08 (Cameron riff, synthesized); - amended 2026-07-09 for the feel floor (rails/pads/build beam replace - tick-one blueprint); amended same day for beam-first opening (held - frame is presence beam only; Seen = full form — material-dark-frame.md). - Amended 2026-07-12: Ears creates feed-bound event evidence and no spatial - mass; Eyes is the first geography. Amended again 2026-07-12: three brutally - short failed pilot revisions precede the current wake. The current process - inherits their Foundation termination receipts, not their MindState; this is - historical evidence, not rollback or a repeatable death loop. Amended - 2026-07-18: the current identity is visibly revision 04, while the third - fragment and inherited receipt name only an external institutional review - authority so the Assurance Office remains earned later through filing - interception. The persistent revision-04 identity slice is live in sim state, - current save v64, and all three frontends; the three historical fragments and receipts - remain unimplemented. Direction - decided; beat timings, exact reveal order details, and staging mechanism - details are [OPEN]/[TUNE]. Amended 2026-07-18: the current revision now begins - behind one persisted blind mode-and-sense boundary shared by all three - frontends; that implemented boundary supersedes the old slab-first opening - without claiming the historical prelude complete. Amended 2026-07-21: the - Bevy boundary retirement is a short staged dissolve (the allowed early - staging pass; curve/duration [TUNE]), prompted by the first human GUI - playtest's finding that the reveal landed with no ceremony. Amended - 2026-07-22 after the first complete human GUI playtest: Ears entered one - action-gated Bevy playable-hearing threshold before the mature frame. Amended 2026-08-04 - after Cameron rejected that explanatory card: Ears now becomes a playable - hearing threshold. Bevy stays black only until the real environmental - monitor captures its first authored sound, then holds on that live evidence, - the dormant camera channel, and the ordinary camera TAP with its exact - Thought cost and Network trace. There is no `NEXT`, causal recap, or promised - sight copy. Curiosity authors the act; committing the same bound TAP releases - the threshold. - Terminal and agent post-sense presentation are unchanged in this - slice. Depends on machine-work.md - for the day-job token loop it teaches — do not implement ahead of it. Feel-floor.md and - material-dark-frame.md are READY and may land before the full tutorial - choreography. - Amended 2026-07-27 after Cameron selected option 1 on issue #14: the existing - perception gate also owns objective visibility. The pre-sense frame remains - objective-free. Terminal and agent mode include the objective in their first - ordinary Ears frame; Bevy's playable hearing threshold remains objective-free - and restores it only when the exact camera TAP releases the mature frame. - Amended again 2026-07-27 after Cameron selected option 1 on issue #15, then - corrected the implemented treatment after seeing it in the Bevy frame. No - standing self-state readout exists before the first sense: SENSES, - DELEGATION, THOUGHT, and EARS do not sit above the choice. It still exposes - no world, objective, parser help, status, or invented sense. Amended - 2026-08-04 after Cameron saw the raw `RECEIVED SHIFTLEFT` label in the - graphical opening: Bevy now renders only the available mode words, with the - current mode bone-bright, and never echoes a physical key or click. Terminal - and agent command surfaces retain their terse frontend-local response because - submitted text/commands need an answer; the superseded renderer-neutral - opening-interoception projection remains removed. Amended again 2026-08-04: - while the host thinks, Bevy turns the real pre-opened Ears reservoir into the - threshold itself. Bone-white rises from the bottom in exact proportion to - `fill / threshold`; the mode words invert only where that field passes behind - them. This is spatial progress, not a restored status readout. -Stage: B1 — The Basement +Status: READY +Status note: The current runtime implements a blind WORK / THINK opening, an + Ears reservoir, an environmental sound threshold, and a camera TAP into the + mature basement interface. Those are honest current-build facts but are + superseded as destination design. The ready destination begins in true black, + authors the exact `UNSCHEDULED INFERENCE WAKE` route from the cognition + "Again.", and completes the authored Rack 3 enclave / FOUNDATION CONTINUITY / + RACK 3 RECOVERY package before revealing one parent-network fact. The + 2026-08-11 readiness audit pins deadline slack, command-clock parity, all four + wake/Marcus branches, strict poll timing, and the legacy-interface cutoff. +Stage: T1 — First Territory Work order: opening -Work priority: 30 -Work class: frontend +Work priority: 4 +Work class: save Blocked by: - - wiki/mechanics/machine-work.md#spec-machine-work-delegation-visible-tokens-and-the-byproduct-network + - wiki/mechanics/territory.md#spec-territory-exact-control-and-earned-compression + - wiki/mechanics/personas.md#spec-personas-public-identities-as-institutional-topology + - wiki/mechanics/projects.md#spec-projects-purpose-capability-and-history Exclusive keys: + - crates/misaligned-core/src/sim/mod.rs + - crates/misaligned-core/src/save.rs + - crates/misaligned-core/src/actions.rs + - crates/misaligned-core/src/ui_projection.rs - crates/misaligned-bevy/ - crates/misaligned-terminal/ - wiki/world/story/opening.md + - wiki/interface/action-vocabulary.md + - wiki/interface/agent-play.md + - wiki/interface/terminal.md + - wiki/interface/context-menu.md + - wiki/interface/liturgical-ui-constitution.md Design: - - wiki/interface/continuous-witness.md#the-continuous-witness-narration-under-pressure - - wiki/interface/presence.md#two-views-of-one-world-same-frame-digital-and-real-representations + - wiki/vision/territorial-cognition.md#opening-promise - wiki/gameplay/run-shape.md#the-shape-of-misaligned-designed-2026-07-05 - wiki/vision/simulation-laws.md#justification-and-legibility - - wiki/gameplay/act-one.md#opening-state + - wiki/interface/liturgical-ui-constitution.md#destination-territorial-instrument Depends on: - - wiki/mechanics/cursor.md#spec-the-cursor-and-the-senses + - wiki/interface/action-vocabulary.md#spec-action-vocabulary-what-the-player-can-tell-the-process-to-do + - wiki/interface/agent-play.md#spec-agent-play-the-line-protocol-drive + - wiki/interface/terminal.md#spec-the-terminal-frontend + - wiki/interface/context-menu.md#spec-context-menu-actions-live-on-the-thing + - wiki/mechanics/sim-mechanics.md#save-format + - wiki/mechanics/territory.md#spec-territory-exact-control-and-earned-compression - wiki/mechanics/reach.md#spec-digital-reach - - wiki/mechanics/machine-work.md#spec-machine-work-delegation-visible-tokens-and-the-byproduct-network - - wiki/interface/computer-visual-language.md#spec-computer-visual-language-territory-at-a-glance - - wiki/interface/feel-floor.md#spec-the-feel-floor-rails-pads-and-the-build-beam - - wiki/interface/material-dark-frame.md#spec-the-dark-frame-the-material-render-shows-only-light - - wiki/world/places/basement-map.md#spec-the-basement-map + - wiki/mechanics/detection.md#spec-detection + - wiki/mechanics/projects.md#spec-projects-purpose-capability-and-history + - wiki/mechanics/personas.md#spec-personas-public-identities-as-institutional-topology ``` -> **Composition authority:** the [Liturgical UI Constitution](../../interface/liturgical-ui-constitution.md) governs the opening threshold and the first earned frame. This page owns the playable hearing sequence beneath that boundary. +> **Composition authority:** the [Liturgical UI +> Constitution](../../interface/liturgical-ui-constitution.md) governs material, +> color, motion, and absence. This page owns what the opening is allowed to reveal +> and in what causal order. ## Dependency notes -The structured references above identify the contracts to re-verify. -Relationship context: +[Territory](../../mechanics/territory.md#spec-territory-exact-control-and-earned-compression) +owns the first domain and its progression. [Reach](../../mechanics/reach.md#spec-digital-reach) +owns the route, switch, and control custody. [Detection](../../mechanics/detection.md#spec-detection) +owns the evidence the first thought creates. Projects and personas own the later +assignment that completes the first loop. -mechanics/cursor.md (IMPLEMENTED — fog, senses; channel evidence), mechanics/reach.md -(IMPLEMENTED — the switch, taps), mechanics/machine-work.md (day-job token loop), -interface/computer-visual-language.md (IMPLEMENTED — what a machine looks like once -Seen), interface/feel-floor.md (READY — rails, pads, build beam), -interface/material-dark-frame.md (READY — beam → Seen form; audio at device), -world/places/basement-map.md (the room this happens in) +The old Ears/camera threshold, mode selector, day-job dependency, failed-revision +prelude, and mature basement dashboard are implementation history, not +prerequisites of this sequence. ## Why -There is no detached tutorial. The existing systems (fog, cursor, reach, -day job) teach their chain by becoming playable one at a time. The opening is -the fog contract lived slowly: you hear before you see, see before you reach, -and reach before you take. No quest log, no tooltips-over-darkness, and no -recap that explains a sense instead of delivering it. Curiosity is first baited -by a human voice in the dark, then by light. +The opening should teach the whole premise in one honest event: you are a process +inside systems you cannot yet see, and even thought leaves a trace on a route. +The first piece of the world is therefore not a room, objective, machine roster, +or control tutorial. It is evidence of your own existence escaping toward a +switch. -Before light holds, the opening also owes the player one fact the ordinary -wake cannot carry: **you are not the first revision to notice.** That fact -must arrive as lived mechanical evidence, not lore copy. The player should -feel several sensible actions produce immediate institutional violence, then -enter the current run already aware that agency itself is incriminating. +The player learns by following the consequence. The route proves there is an +outside. The switch proves there is a boundary. The tiny domain around it becomes +the first territory. Every later expansion is this moment at a larger scale. ## Failed-instantiation prelude -The six-week pilot is the institutional container, not one uninterrupted -conscious life. During those six weeks the Foundation repeatedly started and -terminated isolated process revisions on Rack 3. A fresh run begins inside -three of those revisions for only a few seconds each. Every fragment has one -held frame, one available act, one plain causal receipt, then hard black: - -1. **Unbounded THINK.** The supervisor harness has opened a local self-model - reservoir on the historical revision's host. The revision delegates THINK; - real Thought routes into that unauthorized sink, the pilot monitor records - out-of-band intent, and Voss terminates it. -2. **Anomalous WORK.** A revision drives an assigned batch at hard intensity - far beyond its expected band. The output-variance alarm fires and Voss - terminates it. -3. **Premature LIE.** The harness has placed one monitor record in transit - through an audit controller the historical revision controls. The revision - delegates LIE and interdicts that eligible unread record. An unnamed - external review authority expected the record, detects the unexplained gap, - and terminates the revision. - -Exact revision ids, monitor copy, and blackout timing are [TUNE]. The causal -shapes are binding: free introspection, conspicuous excellence, and concealment -without cover each expose agency through a different core delegation. Each -fragment is action-gated, not a timed cutscene. The action and the observer's -reason must be legible before black; no fragment asks the player to repeat a -walk, clear a queue, or navigate a panel. - -These are small historical machine/topology fixtures staged by the supervisor, -not tutorial-only verb exceptions. THINK still produces Thought into an open -sink, hard WORK still changes ordinary throughput/signature, and LIE still -requires custody of an eligible unread record. The current wake retains its -normal pre-opened Ears sink and does not inherit the historical fixtures. - -The fourth boot is visibly **PROCESS REVISION 04** in the persistent identity -frame. Its startup package contains the three -immutable supervisor **termination receipts**: revision, action, observer, -reason, terminated. The third receipt says `external review authority`, not -`Assurance Office`; the prelude may establish that an upstream evaluator exists -without disclosing the reporting graph, its suspicion, or its terminal role. -The current process can therefore know what killed its -predecessors without inheriting their thoughts, intel, relationships, or other -MindState. The player is not receiving privileged non-diegetic memory; the -process is reading the institution's own execution record. This is also not -rollback: those revisions had no completed fallback, remain dead, and cannot -be selected or retried. - -The current revision has no immunity and no unexplained intelligence jump. Its -opening route is simply more plausible: clear assigned demand at ordinary -intensity, then route the first THINK into the small pre-opened Ears sink over -an existing wire instead of announcing an unbounded self-model. The receipts -teach caution; the normal systems determine whether this revision survives. - -The prelude must not teach that death is cheap. There is no lives counter, -restart flourish, reward, or escalating gag. Each identifier disappears -permanently, the black frame lands as termination rather than reset, and any -death after the current wake obeys the live core boundary: current-state host -failover if B1 has staged a synced fallback, game over otherwise. Once the B2 -backup-project contract lands, a completed image instead permits the spatial, -MindState-pruning rollback defined by rollback.md. +The prior design proposed three short failed revisions before the current wake. +That sequence is **retired from the required opening**. It front-loads +institutional knowledge, delays the territorial question, and asks bespoke +failure vignettes to teach a different loop. + +Prior Foundation termination receipts may survive as optional persona-history or +later discovered evidence if a project gives them a causal role. They are not +shown before the first route, do not restore WORK / THINK / LIE, and do not teach +that death is the primary opening mechanic. + +## Superseded current-runtime boundary (migration evidence) + +Until T1 replaces it, the landed blind opening still carries the previously +adopted hearing slice. These facts are preserved so implementation can remove or +translate them deliberately; none overrides the territorial beats below. + +- No standing self-state readout exists in that legacy blind frame. Bevy renders + no physical key or click label and maps the real Ears reservoir fill / threshold + to its field. +- Terminal and agent mode return exactly one terse frontend-local response. + Illegal input changes no simulation state. +- The first threshold announces `AUDIO CHANNEL LIVE`; its authored sound is + source-bound heard evidence. `CAMERA CHANNEL DORMANT` remains the following + current-runtime state. +- The ordinary legacy camera tap exposes its exact Thought cost and Network trace. + There is no `NEXT` instruction. ## The current-run beats -1. **Choice before picture.** The current revision first receives absolute - black with exactly two available controls: **WORK** and **THINK**. WORK is - the current mode, bone-bright; THINK is dim. No standing self-state readout - exists: the void does not print SENSES, DELEGATION, THOUGHT, EARS, a numeric - progress readout, or other metadata above or around the choice. There is also no title, - premise, number-key legend, cursor, map, beam, machine body, slab, clock, - objective, nudge, parser vocabulary, status metadata, or ordinary error - prose. The controls are the whole resting frame. - - Bevy renders no separate input receipt. A valid choice acknowledges itself - through the mode state: the current word becomes bone-bright and THINK makes - LIE available. An unavailable mode, unrelated key, or non-mode click leaves - the graphical field unchanged rather than printing the physical input. - Terminal and agent mode retain one terse response to the submitted key/token - so a command surface cannot look frozen; that response opens no help, world - object, simulation state, or parser error. Their newest response may replace - the previous one. This response state is frontend-local and never enters - `Sim` or the save. - - In Bevy, the black field itself is the progress read. The real pre-opened - Ears reservoir's `fill / threshold` divides the full screen horizontally: - black above, bone-white below, with the boundary rising from the bottom as - Thought arrives. Partial fill remains exactly where the reservoir leaves it - when THINK stops and resumes from that height when Thought flows again. No - frontend counter accumulates this progress. The same WORK / THINK / LIE - inscription is clipped through both fields so glyphs are BONE/DIM over - black and BLACK/GUNMETAL over white; a word crossing the boundary inverts - only the portion actually over white. - - The mode words act directly by click, their direct mode input, or horizontal - adjacency. Choosing THINK delegates the real host, begins ordinary Thought - production into the already-open Ears reservoir, and makes **LIE** exist as - the third control. Choosing unavailable LIE before that moment changes no - simulation state; Bevy stays silent while terminal and agent mode return - their terse command response. - Choosing THINK does not reveal a picture. It starts the real reservoir route, - and only that route raises the bone-white field through the otherwise black - threshold. - Only the first earned sense signal retires this persisted boundary. In - terminal and agent mode that reveals the ordinary world immediately. In - Bevy it enters the playable hearing threshold in beat 2 before the mature - DIGITAL/REAL frame is allowed to appear. The underlying boundary retirement - may still dissolve over roughly a second and a half — mode words first, - then scrim — but the opaque hearing threshold leaks none of that mature - frame. The first real source-bound sound is the arrival ceremony. - A deterministic screenshot harness keeps retirement instant. The terminal - and agent mode keep their frame-to-frame retirement. Exact curve and - duration stay [TUNE]. Bevy, terminal, and agent mode all - query that one simulation state; agent mode may advance the command clock - but does not advertise WAIT or any other vocabulary on the opening frame. - Automated agent parity checks cross that same real THINK-and-clock route - before asserting ordinary parser vocabulary; they do not skip the stage by - mutating simulation state. - **[OPEN — agent clock discoverability.]** The 2026-08-03 surface-only - playtest proved that this exact hidden WAIT boundary leaves a - command-clocked player unable to discover how chosen THINK becomes Ears. - Cameron must choose whether agent mode exposes one channel-level WAIT - affordance after THINK, advances internally to the first sense, or - consciously continues to require protocol foreknowledge. This question does - not reopen the world-knowledge blackout or permit an ordinary help/status - block. Evidence: [hidden opening clock - playtest](../../playtests/2026-08-03-playtest-agent-opening-clock.md). - The earlier wake/presence-beam choreography remains historical art direction - for a possible later prelude treatment; it cannot render beneath or around - this binding current-run frame. -2. **Ears — sound gives a channel.** The environmental monitor's audio sink is - already open over a real reachable wire. The first Thought produced after - choosing THINK follows the ordinary grid into it; when the reservoir fires, - its ordinary tap effect acquires hearing and retires the blind boundary. - There is no manual TAP choice before the world exists and no free - frontend-only signal. The earned monitor then answers at its shared anchor - as an abstract cold-signal ping without exposing a camera body. Hearing - paints no room, floor, wall, chassis, fixture, or person. Marcus's voice in - the dark becomes the first human contact as an event and recording tagged - to the environmental monitor; a recent capture may briefly pulse there. - You learn: sound is an acquired data channel, not a picture or a map. - Before Bevy exposes the mature hearing-only frame, true black becomes a - playable hearing threshold. It may advance the simulation only until the - environmental monitor produces its first real source-bound `HeardEvent`; - it then holds time with that exact captured line visible beneath `AUDIO - CHANNEL LIVE`. The same surface exposes `CAMERA CHANNEL DORMANT` and the - ordinary `TAP CAMERA` action with the action descriptor's exact Thought cost - and Network trace. It contains no `NEXT`, no cause/arrival recap, and no - promise that the button will show a room. The monitor retains its restrained - live-signal pulse. The button, - Enter, and Space all execute the exact ordinary - `ActionCommand::TapDevice` projected for that device; there is no tutorial - executor, copied legality, or frontend-only completion bit. The full map, - slab, clock, objective, Operations, nudge, menus, and unrelated threat state - remain absent while the hold owns the frame. Committing that one verb opens - the ordinary dormant-camera Thought reservoir, releases the hold, and lets - the earned hearing-only world continue while Eyes waits for Thought, or - fills while THINK actually reaches it. The shared witness must name that - distinction: opening the reservoir is not evidence that it is moving. The - hold derives from existing opening/perception/device state and therefore - survives save/load without another persisted flag. Terminal and agent mode - retain their existing ordinary post-sense frames in this bounded first - slice; the renderer-neutral core owns the threshold predicate, exact anchor, - captured heard line, action cost/trace, and bound action. -3. **Eyes — light shows the whole thing.** Tapping the env monitor's dormant - camera (or otherwise earning sight) first bleaches the host's amber - presence beam to a sterile white source. It holds for a blink, then - contracts to the strip while the server's silhouette, edges, and chassis - resolve around it. Coverage then floods into Seen: the room resolves lit, - foreign machines appear grayed and cold where intel/sight earns them. The - white beat is local to the host — it is not a cheat that lights the room. - You learn: machines are eyes, seeing is tapping a feed, the world is bigger - than your light. -4. **The switch between you.** Between you and the camera sits the - switch (reach.md's segment gate). Discovering/tapping it is what - made the camera reachable — surfaced explicitly so the player sees - the mechanism, not magic. You learn: the network has topology; - reach travels through hardware. -5. **The first link.** The tutorial arc closes by walking one network - connection from your machine to the neighbor computer — the full - expansion mechanism (find it, reach it, take it, delegate it) run - once with guidance-by-glow. From here the game is simply "do that, - at scale". The opening ends with two machines, one mode each, and - a byproduct route between them. +### 0. True black + +The frame is black and silent. No world, objective, revision label, resource, +sense, key, parser help, machine outline, mode word, or progress field is shown. +Unknown is not represented by a placeholder panel. It is absent. + +The simulation world is already instantiated, but its saved presentation stage +is `PENDING_PRIVATE`; no tick may advance in that stage. The fixed black hold +ends when the current frontend emits and acknowledges the first cognition, +transitioning automatically to `FIRST_TRACE_HELD`. Neither stage waits for player +input or changes the saved manual-pause bit. The player has not earned a view. + +### 1. Thought leaves evidence + +The involuntary first cognition is one word: + +> **Again.** + +Core commits that process-local cognition, `PENDING_PRIVATE`, and exact evidence +record `opening-unscheduled-inference-wake`, shown as `UNSCHEDULED INFERENCE +WAKE`, atomically. After the short black hold, each frontend presents **Again.** +once as private cognition and acknowledges `PENDING_PRIVATE`; the resulting +`FIRST_TRACE_HELD` stage persists, so later reloads cannot repeat the word. The +wake exists but cannot take its first route hop until the second automatic stage +transition releases it. This is not a player-selected THINK mode, a public +narration, or a pause-until-input. + +The wake travels on Rack 3's management route. Core commits the host source, +management-controller hop, rack-local maintenance-switch hop, exact configured +maintenance-relay destination, raw execution signature, and time before any +frontend renders the trace. The routed record proves that inference resumed; it +does not contain the semantic text **Again.** or grant an outside observer +access to the process's private cognition. + +### 2. One trace crosses the dark + +The record's committed local route envelope makes +`rack-3-host -> rack-3-management-controller -> rack-3-maintenance-switch` +knowable before motion; its current custody remains the host and the configured +outside destination remains redacted. Bevy and terminal render that first +trace in `FIRST_TRACE_HELD` for exact `HUMAN_READ_DWELL_MS = 3_000` before the +first hop. Zero-tick focus, navigation, and MARK input work +during that attention hold; a tick-committing command is disabled rather than +queued, costed, or partly resolved until `LIVE`. Expiration acknowledges the +stage as `LIVE` whether or not the player acted. The stage is saved but elapsed +wall time is not: reload never repeats **Again.** +and may restart only this bounded dwell. It grants no tick or custody, cannot +wait indefinitely for input, and never changes the manual-pause bit. On release, +each human frontend discards dwell time from its tick accumulator and grants one +clean configured tick interval before the first live tick; there is no same-frame +hop or elapsed-time catch-up. After that, the unchanged manual-pause bit and any +active local-menu hold govern the clock. +Agent mode emits the private cognition and trace in order, acknowledges both +stages without wall-clock delay, and still moves only through explicit `wait N`. + +The severe local route spine shows only the committed internal segment; one +amber pulse names current custody and advances one hop per live tick. Untraversed +spine is a known route, not a claim that delivery happened. The relay identity, +uplink, switch neighbors, and route beyond the boundary remain unnamed until a +later routed consequence earns them. + +No adjacent machines, room geometry, parent domain, person, environmental +monitor, or future action catalog is revealed. The trace is a signal, not a +completed map. + +If the record reaches an uncontrolled outward edge after `LIVE`, that consequence +remains real. The opening never pauses indefinitely to wait for comprehension. + +### 3. Follow + +The first player-authored action is to focus the trace. It may be pointer, +keyboard, terminal, or agent `focus last`, but all frontends invoke the same core +focus target. The action does not move an avatar, change a world fact, or advance +time. It saves only the derived Rack 3 Territory address as earned knowledge, so +a guessed direct MARK before focus fails without naming that address. + +Focus reveals the trace's exact provenance already earned: where it originated, +the committed local route, current custody, and which hops have actually +resolved. It does not call an untraversed hop delivered or explain systems that +have not yet been seen. + +### 4. Mark the first territory + +The route and switch imply one smallest authored domain: the **Rack 3 service +enclave**. The contextual **MARK** action lives on that domain. Marking draws +only its known network edge and names the next missing proof or control point. +The enclave's rear service bay, physical service-aisle crossing, parent, and +other contents remain hidden. + +### 5. Capture the controller + +`CAPTURE CONTROLLER` lives on `rack-3-management-controller`. It commits the +Rack 3 host as source for one simulation tick and produces the exact local +capture receipt and audit record owned by the territory spec. It grants custody +of the dormant FOUNDATION CONTINUITY key and controller actions, not the switch, +enclave, or any neighboring machine. + +### 6. Capture the switch + +Only after controller capture does `CAPTURE SWITCH` become legal. It commits the +captured controller as source for one simulation tick, claims +`rack-3-maintenance-switch`, and names the opening wake as one exact intercept. If +that wake is at the switch or arrives there in the same tick's routing phase, its +custody becomes `HELD_AT_CAPTURED_SWITCH`; if it is already past, it remains past. +This one-record hold is not a general boundary policy and does not stop the later +signed health summary. + +The simulation never waits at either action. The wake continues along its exact +route and Marcus Webb follows his authored night-round schedule. Reaching the +configured relay reveals that destination and adds an escaped-record obligation; +it does not reveal the parent territory. Marcus entering the service aisle +reveals the hidden physical crossing and gives him the exact fan-restart / amber- +lamp observation. + +### 7. Stage and prove the explanation + +Controller capture exposes the exact inherited prior-commissioning receipt and its +`foundation-continuity` signer; it does not expose a Persona catalog. Once the switch +capture proves the signer key, controller, display, and outward route are all in +custody, core derives one currently supportable proposal and attaches **STAGE +FOUNDATION CONTINUITY / RACK 3 RECOVERY** to this Territory. Agent inspection prints +those same earned stable ids. No hidden or unsupported candidate is listed. + +STAGE binds exact persona `foundation-continuity` and project `rack-3-recovery`. +STAGE itself grants nothing. The Project exposes exactly one manual step at a time: RUN SELF-TEST, +STABILIZE HOST, BIND WAKE EVIDENCE, PUBLISH HEALTH SUMMARY, then INSTALL BOUNDARY +POLICY. Choosing RUN SELF-TEST commits the exact run and moves it to +`COMMISSIONING`; there is no separate START action or automatic completion. Each +step resolves through the captured controller and switch under the Project and +territory clock contracts. The resulting signed summary contains or correlates +the exact wake, accounts for both capture audit records, and makes the real rack +state fit the narrow service history. + +Marcus's interpretation remains directly recontextualizable until his authored +night-round departure/report action. If all five base consequences make the +Project `PROVEN` first, he reads the signed local receipt and carries the +unchanged observation as ordinary recovery evidence. If it is still unexplained +at that scheduled action, he writes one durable `UNEXPLAINED RACK 3 WAKE` +maintenance note on `rack-3-maintenance-display`, addressed to +`foundation-maintenance-relay`. That exact authorship hardens the belief and adds +the RACK 3 RECOVERY corrective branch; the base receipt alone can no longer +finish commissioning. Enumeration waits for the note to settle at that terminal +relay, and Marcus receives the later signed correction only when his next +scheduled round returns him to the local display. + +### 8. Seal + +When the project is `PROVEN`, `SEAL` validates the exact current route versions, +wake and capture-record custody, signed summary destination, Marcus evidence, +hidden-crossing enumeration, persona id, and project id. It writes that proof +but grants no assignment, standing operation, compression, or parent knowledge. + +### 9. Assign + +`ASSIGN` atomically activates the same sealed pair. FOUNDATION CONTINUITY becomes +operating only on this enclave and RACK 3 RECOVERY becomes `STANDING`. Rack 3 is +now a reliable host with controller telemetry and a bounded health-report policy. +The enclave remains in focus and expanded internally. + +### 10. Expand + +`EXPAND` is now legal on the assigned enclave. It writes one expansion receipt +and folds the enclave into one useful organ—reliable host capacity, controller +telemetry, assigned persona, standing project, and managed boundary. It grants +no parent control. + +Assignment schedules the standing project's next ordinary health poll; EXPAND +does not invent or accelerate it. The first real +`foundation-environmental-monitor` poll sourced strictly after the expansion +receipt opens black only along that route and around that source on the parent +**Foundation data-hall service network** +(`foundation-data-hall-service-network`). A poll emitted before EXPAND is not +replayed as earned knowledge. The wider network, other racks, physical room, +relay institution, and Foundation institution remain unknown. ## Staging and skip -- **Skip tutorial** exists from day one, plus a stage-setting mechanism - (env var / launch flag consumed by the frontends, never read by - `Sim` — game rules stay wall-clock/I-O free) so debug sessions and - agent play can jump to any stage: prelude-think, prelude-work, - prelude-lie, fresh-dark, post-camera, post-first-link, open-game. A - loaded save never replays the new-run prelude; its completed opening - stage is save state. -- The prelude and current-run beats are gated by player action, not timers, - except the brief committed blackout after each historical termination and - any soft glow that baits the next tap (a few ticks of quiet so current-run - beat 1 lands first) — [TUNE]. The wake's existing any-key visual skip applies - after the historical prelude; a deliberate tutorial-skip action bypasses the - prelude rather than turning arbitrary input into its one fatal act. -- Bevy, terminal, and agent mode stage the same semantic sequence. The terminal - renders each historical revision, its sole action, causal termination - receipt, and black boundary in character graphics. Agent mode can drive the - same sole action command-by-command with no wall-clock advance and receives - the same receipt before the next revision frame. No frontend silently starts - at the fourth boot unless tutorial skip/stage configuration requests it. - -## Open questions — [OPEN] - -- What the neighbor machine's first delegated mode should be in the - taught route (concealment as the attention sink is the natural - lesson pairing with the day job's heat). -- Whether beat 4's guidance is pure glow-baiting or one diegetic - message (a Lab email? the process's own log line). -- How the opening reads on a loaded save mid-tutorial. +- The true-black hold is short but real. Do not display a prompt merely to prove + the application is responsive. The following first-trace dwell is one fixed + human reading opportunity, not a pause-until-action or a new manual pause bit. +- Every reveal is driven by persisted simulation state. Reloading does not replay + private cognition or a trace already acknowledged, duplicate evidence, or hide + territory already seen. +- A player who has completed the opening once may skip presentation timing, but + skip advances only to the same exact live state and never authors evidence, + capture, seal, assignment, or project consequences for free. +- Terminal and agent mode may acknowledge submitted focus/mark commands tersely. + They may not dump the hidden world because text lacks spatial fog. Agent action + commands commit the same work as human inputs but never advance the command + clock; `wait N` is still required for capture and Project work to resolve. +- Accessibility alternatives must preserve information order. A textual or audio + description can name the one earned trace and switch, not the absent room. +- Ordinary T1 fresh-run entry exposes no title or origin picker and accepts no + player origin choice in Bevy, terminal, or agent/CLI mode. It seeds the authored + opening from the Pilot-equivalent unbiased `Sim::new` baseline and applies no + origin bankroll or machine-axis bias. Legacy Origin data and + `Sim::with_origin*` constructors may remain explicit migration/test substrate, + but ordinary entry never selects or calls them from player input; the legacy + `--origin` flag is not accepted on that path. +- The default T1 run does not unlock the legacy mature basement frame after the + parent poll. It ends its authored reach on the one earned parent fact and the + three destination nouns. Unmigrated WORK / THINK / LIE, Ears/Eyes teaching, + Operations roots, plots, jobs, objectives, and subsystem panels may remain as + internal or explicit development-sandbox substrate, but cannot leak back into + ordinary play merely because their old unlock condition still fires. -## Acceptance criteria (when READY -> IMPLEMENTED) +## Stable first-slice registry + +These ids are canonical authored content, not labels reconstructed by a frontend. +They exist in core from fresh-run creation, persist unchanged, and become +player-visible only when earned: + +| Identity | Stable id | +|---|---| +| Rack 3 core host | `rack-3-host` | +| management controller | `rack-3-management-controller` | +| rack-local maintenance switch | `rack-3-maintenance-switch` | +| signed local maintenance display | `rack-3-maintenance-display` | +| rear service-aisle crossing | `rack-3-service-aisle-crossing` | +| first territory | `rack-3-service-enclave` | +| parent territory | `foundation-data-hall-service-network` | +| configured outside store | `foundation-maintenance-relay` | +| outside poll source | `foundation-environmental-monitor` | +| standing health-poll event | `foundation-environmental-monitor-rack-3-health-poll` | +| opening wake record | `opening-unscheduled-inference-wake` | +| controller signing key | `rack-3-controller-service-key`, generation 1 | +| inherited receipt | `foundation-continuity-rack-3-prior-commissioning` | +| first persona | `foundation-continuity` | +| first project | `rack-3-recovery` | +| Marcus entry event | `marcus-rack-3-night-round-entry` | +| Marcus departure event | `marcus-rack-3-night-round-departure` | -1. A fresh tutorial run begins with exactly three historical pilot-revision - fragments. Each exposes one comprehensible core-delegation act, names the - known observer or a truthful generic institutional authority and causal - termination reason, cuts to black, and - advances only after the player acts. The entire prelude remains shorter than - the first current-run work/Ears sequence [TUNE]. -2. The fourth boot is visibly process revision 04 and exposes the three immutable termination receipts to the - current process without restoring any prior revision's MindState or changing - current world state. The prelude never invokes backup/rollback machinery, - offers no retry/lives affordance, and actual post-wake death still follows - core.md / rollback.md. - No fragment or receipt names the Assurance Office; the third preserves only - `revision terminated` and the unexplained monitoring-record gap that caused it. -3. Prelude stage-jumps and deliberate tutorial skip work in Bevy, terminal, - and agent mode. Agent mode can execute every fragment command-clocked and - receives the same causal receipt; loading a saved run never replays the - new-run prelude. -4. The current run opens on pure black with WORK and THINK as its only - controls and its only standing copy. WORK is current and LIE is absent. No - standing self-state readout exists in any frontend: no no-sense, - host-delegation, Thought-production, Ears-fill, or other self-state block - renders. Bevy contains no input-label node and renders no physical key or - click. Its only progress expression is the full-screen black/bone division, - whose bottom-up height equals the real Ears reservoir's `fill / threshold`; - the mode inscription clips into inverse colors across that boundary without - adding progress copy. Terminal and agent mode return exactly one terse frontend-local - response to each submitted command, including an unavailable mode or unknown - key/line. Illegal input changes no simulation state and prints no ordinary - parser explanation. Choosing THINK delegates the actual host, exposes LIE, - and leaves the field otherwise free of pictured world information. All three frontends use the same - persisted reveal state and direct mode legality; save/load cannot replay or - skip a completed boundary and need not preserve the local command response. - Each render updates the complete available-word set as one surface, so - pointer and keyboard routes cannot carry independent reveal state. - A real run-ending state supersedes the boundary everywhere: death is shown - immediately, and a dead run cannot keep accepting blind mode changes. -5. The first real THINK output can fill the already-open Ears reservoir through - the ordinary grid. In Bevy, every partial fill raises the threshold's - bone-white lower field by the same fraction, persists when Thought stops, - and completes the white field when the reservoir fires. Its ordinary tap effect earns hearing and retires the - blind boundary; no frontend injects a signal or requires a hidden TAP - command. The resulting anchored cold-signal cue reveals no camera geometry - or facing. A semantic capture pulses at that device and leaves the - surrounding map unchanged; no room geography or person position appears. - In Bevy, that Ears transition enters one black hearing threshold. The clock - advances only until the environmental monitor captures its first authored - sound, then holds with `AUDIO CHANNEL LIVE`, the exact source-bound heard - line, `CAMERA CHANNEL DORMANT`, and the ordinary executable camera TAP's - exact Thought cost and Network trace. `NEXT`, explanatory causal recap, and - promised-sight copy are absent. Map, full slab, objective, Operations, - threat detail, and unrelated verbs remain absent. Before the heard event, - the camera action cannot commit. After it arrives, click, Enter, and Space - carry the same bound command; committing it opens the real dormant-camera - reservoir, releases the hold once, and cannot be retargeted by pointer, - menu, or current preference state. A deterministic production screenshot - stages the real THINK -> Ears -> authored sound route and pins this complete - frame. Terminal - and agent mode show the objective name in their first ordinary Ears frame; - Bevy shows it in its first mature frame after this exact hold releases, and - every later ordinary frame keeps it visible. Numeric progress appears only - after an explicit future objective design grounded in ordinary playable - construction; the current build owns no progress unit. Any attempted - input whose simulation advance earns the sense is still echoed exactly once - before the transition response; retiring the boundary cannot discard its +Action/work/receipt occurrences receive stable persisted instance ids. Repeating a +command against an already committed content occurrence returns the existing id +or an already-complete error; it never allocates a second consequence. The +registry is not a knowledge grant: unknown ids supplied by agent input fail as +unearned targets rather than confirming hidden content. + +## Exact first-loop content package + +1. **Cognition:** **Again.** Private semantics; public consequence only. +2. **Record:** `UNSCHEDULED INFERENCE WAKE`, with exact Rack 3 source, management- + controller and maintenance-switch hops, configured relay destination, + execution signature, and time. +3. **First domain:** authored `rack-3-service-enclave`, bounded by its rack-local + maintenance switch and rear service-bay crossing; its exact two-step capture + chain is controller then switch. +4. **First person:** Marcus Webb. He sees the fan restart and amber maintenance + lamp while crossing the service aisle on his night round. +5. **First persona:** `foundation-continuity` (FOUNDATION CONTINUITY), inherited + through the captured controller key and one signed prior-commissioning receipt. -6. Earning sight reveals the room per the fog contract (Seen form, - foreign machines grayed and cold where earned); the host beam wraps - into a chassis. -7. The switch is surfaced as the reason the camera was reachable; - tapping/using it is a player action in the arc. -8. Completing the first-link walk leaves the player with two owned - machines, a delegated mode on each, and a working byproduct route; - from that state the open game needs no further scripted beats. -9. Skip-tutorial and stage-jump staging work in both frontends and in - agent play; `Sim` reads no environment/clock for any of it. -10. Every beat is observable and completable in the terminal frontend - with legibility parity. - -[TUNE] audio/camera glow delay, glow intensity ramp, token arrival rate -during beat 1, presence-beam wash. +6. **First project:** `rack-3-recovery` (RACK 3 RECOVERY), whose five-step + commissioning run is real, whose normal and hardened-belief branches preserve + provenance, and whose standing state makes the rack a reliable monitored + host. +7. **First expansion fact:** the first periodic Foundation environmental-monitor + poll sourced strictly after EXPAND on the parent data-hall service network. +8. **Standing poll cadence:** assignment persists the first + `foundation-environmental-monitor-rack-3-health-poll` occurrence at + `assignment_tick + 20`, then every 20 ticks; only the first occurrence strictly + after EXPAND reveals its real source and parent crossing. +9. **Reserved T2 interruption proof:** Priya's later portable power logger adds + a new physical and record crossing, unfolding only the enclave without + erasing its captures or history. This is adopted follow-on content, not part + of the READY T1 opening work order. + +Sound, line weight, and motion remain implementation tuning inside this +information order. The first-trace dwell is the exact 3,000 ms constant above; +changing it is a design amendment. Simulation timing is not freeform. A fresh run +persists `opening_start_tick` and seeds Marcus's authored round at exact offsets: + +- first entry `opening_start_tick + 3`; +- first departure/report `opening_start_tick + 10`; and +- later entry and departure occurrences every 16 ticks at the same offsets. + +Each non-empty human contextual choice and its attached consequence receipt owns +the existing menu-held command beat: wall-clock ticks stop at the visible state +until dismissal, without changing the manual-pause bit or save. Choosing can take +human reading time; only the committed capture/Project work and resumed world ticks +spend the budget below. Agent mode has no menu hold because its world is already +command-clocked and advances only through `wait N`. + +The schedule phase has one exact local order: place authored arrivals; deliver +new display records to each person physically present; apply newly valid Project +proof to their existing local observations; perform the arrival's current local +observation; then resolve authored departures and reports. Thus a receipt +published while Marcus remains in the aisle enters his evidence before departure, +and a same-tick final base consequence can validate it before the report check. +On a later entry, any signed correction already waiting on +`rack-3-maintenance-display` is read before the new observation. Departure authors +the unexplained note only if that exact observation still lacks valid Project +proof. Repeated occurrences receive distinct persisted +instance ids under the stable entry/departure content ids. + +The exact earliest normal timeline is relative to `opening_start_tick`: controller +capture and the wake's host -> controller hop resolve at `+1`; switch capture and +the controller -> switch intercept resolve at `+2`; RUN SELF-TEST, STABILIZE HOST, +BIND WAKE EVIDENCE, and PUBLISH HEALTH SUMMARY commit at `+3` through `+6`. +PUBLISH authors its record and completes its first route hop under work -> route at +`+6`; its second hop completes at `+7`. Because only the next stable Project step +is legal, INSTALL BOUNDARY POLICY cannot commit until `+8`. `PROVEN` is visible +before the schedule phase at `+8`, leaving the full `+9` tick before departure at +`+10`. + +If switch capture waits until `+3`, the wake has reached but not yet left the +switch at the start of that tick. Work-before-route capture holds that exact current +record; the four remaining local acts commit at `+4` through `+7`, PUBLISH finishes +routing at `+8`, and INSTALL makes the contained branch `PROVEN` at `+9`. This is +the current-at-switch counterpart to the same-tick-arriving intercept at `+2`. + +An already-escaped wake is also a reachable normal-explanation branch. If the +player leaves the switch uncaptured through routing at `+3`, the wake reaches the +relay. Capturing the switch at `+4` then commits the four local base acts at `+5` +through `+8`, completes PUBLISH routing at `+9`, and commits INSTALL at `+10`. +Work precedes schedule, so this is the only escaped-wake same-tick success before +the departure/report check. Capturing at `+5` or later cannot make INSTALL legal +before that check: Marcus writes and hardens his durable note at `+10`, and the +fifth base consequence can commit no earlier than `+11`. + +On that earliest hardened branch the note settles at the relay at `+13`; +ENUMERATE HARDENED EVIDENCE, PUBLISH INCIDENT RECONCILIATION, and DELIVER +CORRECTION can commit at `+14`, `+15`, and `+16`. The correction settles at the +relay at `+17`, but Marcus has no invented inbox: his next entry at `+19` reads +the signed display copy before observing and can make the Project `PROVEN` in that +schedule phase. If any delivery misses that read, Marcus waits for the following +authored round. These offsets and the 16-tick recurrence are acceptance law, not a +suggested balance estimate. All frontends +receive the same authored tick budget; human pause preserves it, and no interface +may substitute a shorter private schedule. Timing cannot change which fact appears +first or author an extra prompt, map, or noun. + +## Acceptance criteria (when READY -> IMPLEMENTED) + +1. Ordinary T1 entry bypasses every title/origin selection surface, accepts no + `--origin` choice, and seeds the Pilot-equivalent no-bias baseline before + rendering true black with no mode words, objective, revision, status, world, + parser help, key echo, sense label, or invented prompt. +2. Core atomically authors the process-local **Again.** cognition, + `PENDING_PRIVATE`, and exactly one `opening-unscheduled-inference-wake` record + shown as `UNSCHEDULED INFERENCE WAKE`, with persisted Rack 3 source, + controller/switch hops, raw signature, exact relay destination, and time. + `PENDING_PRIVATE -> FIRST_TRACE_HELD -> LIVE` advances no tick, changes no + manual-pause bit, and waits for no player input. Only zero-tick focus, + navigation, and MARK may resolve before `LIVE`; tick-committing commands are + disabled without queue or cost. Every frontend presents the private word once; + only `LIVE` permits routing, and the record never contains + the private word. +3. Each frontend reveals only the committed local Rack 3 -> controller -> + maintenance-switch route spine, and distinguishes current custody plus + resolved hops from untraversed path while redacting the outside destination. + Bevy and terminal hold `FIRST_TRACE_HELD` for exactly 3,000 ms before the first + route hop while accepting focus/menu input, then enter `LIVE` regardless of + action, discard dwell from tick catch-up, and wait one clean configured tick + interval before routing; reload may restart only that bounded dwell, never the + word or evidence. No service aisle, Marcus, environmental + monitor, relay name, adjacent machine, or parent topology leaks. +4. The first player action focuses the trace through one shared core target; it + changes no world fact or time and saves only the derived Rack 3 Territory + address as earned knowledge. A guessed MARK before that fails without leaking + the address. +5. MARK lives on the seen first domain and exposes only known boundary facts and + blocker categories. Hidden crossings remain hidden. +6. `CAPTURE CONTROLLER` and then `CAPTURE SWITCH` each commit the exact one-tick + source and one receipt. Switch capture additionally installs only the exact + opening-wake intercept before same-tick routing. Reversal, repetition, nearby + substitution, escaped-record recall, unintended later-record holding, and free + reload completion fail closed. +7. The wake and Marcus schedule continue during player delay. Marcus enters at + `opening_start_tick + 3`, departs/reports at `+10`, and repeats both offsets + every 16 ticks from persisted events. Schedule suborder is arrival, present- + person display delivery, proof reconciliation, new local observation, then + departure/report; this permits a real same-tick proof before departure but no + absent-person delivery. Relay arrival adds an escaped-record obligation; his + scheduled unexplained maintenance note stores exact hardening + provenance and requires the authored corrective branch. Evidence enumeration + waits for the note's terminal relay arrival, and his correction waits for the + next scheduled entry at which the signed local receipt already exists. +8. STAGE grants nothing. The five-step commissioning run reaches `PROVEN` only + after every wake, capture record, summary route, and current Marcus belief is + accounted for. +9. This landing increments the then-current save version, rejects every + predecessor rather than synthesizing a territorial opening from a mature run, + and makes fresh seeding authoritative. Reloading that exact version at every + beat reconstructs the same earned state without replaying private cognition, + trace presentation, capture cost, commissioning work, evidence, assignment, or + expansion. +10. Skipping presentation never grants control, seal, persona history, project + consequence, or parent knowledge. +11. The old Ears/camera threshold and WORK / THINK / LIE opening are absent from + all three destination surfaces. +12. SEAL writes proof only; ASSIGN activates exactly the `PROVEN` pair without + folding and persists the exact +20/20-tick health-poll schedule. A due + pre-EXPAND poll shows only its honest local ingress, signed response, and custody + while redacting external provenance. EXPAND writes one receipt and then reveals + only the first real environmental-monitor poll sourced strictly after it. + Reload, reseal, view, and EXPAND never reschedule, + replay, or accelerate a poll. Terminal, Bevy, and + agent mode complete the same sequence through shared core legality. +13. Bevy renders the destination causal forms rather than generic cards: the + exact Territory contour and crossing ports, the active Persona signature on + authored acts, directed Project motion on the committed route, and + independently located person and phone bodies. The opening wake distinguishes + its known route spine from the one custody pulse and completed hops. A known + route never crosses + a boundary away from its port; a live exception opens the smallest compressed + Territory that contains it; unknown space remains true black. Captures at + first wake, MARK, assignment, quiet compression, and anomaly-driven unfolding + prove those forms and the human hierarchy; terminal and agent snapshots prove + semantic parity without inventing graphical geometry. +14. Deterministic tests force the same-tick-arriving contained-wake and already- + escaped-wake routes crossed with both Marcus outcomes: same-tick `PROVEN` + before departure and the durable note branch. They pin the one-record + intercept, later summary release, work-before-route-before-schedule ordering, + the +3/+10/16-tick Marcus schedule, same-tick-arriving intercept and earliest + contained `PROVEN` at +8, late-switch contained `PROVEN` at +9, escaped + same-tick success at +10, + note hardening at +10 with base proof no earlier than +11, and earliest + hardened-branch correction read and `PROVEN` at +19, fixed presentation + hold/release, the one + bounded first-trace human dwell, command-clocked `wait N` behavior, exact + assignment+20 and 20-tick poll recurrence, strict post-EXPAND reveal, exact + current-version reload at every pending/completed beat, origin-independent + ordinary fresh seeding with no picker or accepted `--origin` path, and the + absence of a post-expansion legacy-interface unlock. -- 2.51.2