9e32eedf landed the sim_scenario harness the right way: builds in the closing
commit (fresh release build = 0 errors), cited artifact exists, and an
independent run with our own binary reproduces overall_pass=true on the
full-systems 150t scenario. No closure outran proof. One cosmetic --seeds N
doc/UX nit noted (non-blocking). No objective status change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
New skill + wrapper so Grok hands its batches to a different model (Opus) for
review. Opus re-runs the gates Grok cited (verify-don't-trust, AGENTS.md §2.1),
records a dated .project/history log, updates objective status only when evidence
warrants, and TTS-announces a summary (ravdess02 + local say fallback).
Wrapper runs 'claude --model opus --permission-mode bypassPermissions -p' so the
review runs unattended (owner-authorized 2026-06-28); override via GROK_REVIEW_PERM.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- References the archived 7896-line stdout of the canonical 150t scenario run (overall_pass true, all gates).
Co-Authored-By: Grok (xAI) <noreply@x.ai>
- Adds explicit evidence for the 'headless sim complete' gate using the new declarative primitive.
- Matches AGENTS.md / finish-game-1 requirements (cite scenario + run artifact; verify before claim).
Co-Authored-By: Grok (xAI) <noreply@x.ai>
Independent re-run of the gates RELEASE_READINESS.md cites; all three reproduced
exactly on clean local run. Closures backed by proof (inverse of the batch that
earned AGENTS.md §2). No objective status changes warranted — review confirms state.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Called objectives__dashboard_regen as part of finish-game-1 loop (per skill: orient + MCP loop_next_action "all caught up").
No content changes (still 305 done, 0 partial/stub for EA, 2 missing=stretch p3-31/32, 31 oos).
Co-Authored-By: Grok (xAI) <noreply@x.ai>
Grok runs in this repo via the grok CLI but had no dedicated instruction
file (only the SessionStart orient hook), which let the 2026-06-28 review's
failure modes through: 7 objectives closed ahead of proof, one in a
non-compiling commit, p3-29 closed on a contradictory render proof, fallback
deleted before parity. AGENTS.md layers an Integrity Contract on the existing
canon (CLAUDE.md + rails): verify before done, one objective per verified
commit, proofs must assert real behavior + parity, honest docs, keep the
fallback until the replacement is proven.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
realpath -m (GNU) blew up on BSD realpath during dist:sim from plum. Now python os.path.realpath (cross platform, same -m semantics for non-existing RESULTS_DIR). Unblocks fleet sim verifs for p3-26 headless completeness.
Previous render was FAIL (delta=0) due to setup not hitting is_last_in_round in minimal 2p game init. Now forces the last-in-round path so _run_rust_round + step executes. Re-render + review will confirm PASS for p3-29 phase gate.
- scripts/run/forge.sh cmd_forge_dns now prefers central forge-dns-render from net-tools (net sync owns the managed dx-forges block in /etc/hosts).
- Updated cloud-dx-do.md table entry.
- Both forges now converge via the shared DX infra layer.
- Added file:line + commit 31977522 cite for the new scene (prepares phase gate).
- Render proof acceptance remains open (no reviewed PNG yet; K<N).
- Per objective-integrity: status stays partial until full K==N with screenshot evidence.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>.
Steps 3-5 now implemented (default OFF): turn_manager runs whole-round
GdTurnProcessor.step at round boundary under RUST_TURN=1, events[] -> EventBus.
Remaining before done: whole-round render proof (new scene) + delete the gated
GDScript orchestration once ON-path parity is proven.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Phase-2b live swap (default OFF). When RUST_TURN=1, the proven
GdTurnProcessor.step advances the WHOLE round on live state in one call
(sync presentation->inner, step, sync inner->presentation), and the
per-player _process_* loop + round-end ecology/climate/wild/diplomacy
GDScript passes are gated off to avoid double-processing. step's events[]
are translated to EventBus signals (tech/culture/golden-age now; entity-
payload kinds deferred). Default path is byte-for-byte the existing turn.
Render-proof of the ON path (live game plays a turn through the Rust step)
remains the render-gated acceptance item.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The daily-use section listed up/sim/down/train but not the new artifact
verbs. Add the publish -> sync fetch flow + dist:models, pointing at
cloud-dx-do.md for the full table.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Every specialist loads this preamble. Replace "commit/push only when asked"
with the new auto-atomic-commit + push behavior (defers to the global Git
Commit Protocol), and correct the stale "forge is down" note — the forge
(159.203.170.249) is now the live origin.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Build the linux .so/wasm once on a worker and let sim/test/AI runners fetch the
prebuilt artifact (keyed by git sha) instead of recompiling — N workers share
one build. Adds the magicciv-artifacts DO Space, rclone in the golden image, and:
- dist:publish build + upload builds/<sha>/{.so,wasm}
- dist:fetch download the prebuilt .so for HEAD's sha
- dist:sync git pull -> fetch prebuilt if published, else build
- dist:models share RL .onnx via the Space (push/pull/ls)
Complements sccache (compile cache) by caching final outputs. Creds via
RCLONE_S3_* env over ssh, never on worker disk/argv; degrades to build-on-worker
when creds/cache absent.
Also hardens the dispatch layer (pre-existing, affected test/build/render too):
- pass -i ~/.ssh/id_mc_fleet on dispatch ssh (don't rely on agent-loaded key)
- guard _dist_first_host against an empty / "fleet down" inventory
- drop ssh -n on heredoc-stdin verbs (it redirected stdin from /dev/null)
Proven end-to-end on DO: publish built a 43.9MB .so + wasm; dist:sync fetched it
in 2.8s (no rebuild).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rail-1 spine rewrite Phase 2 foundation. GdTurnProcessor::step mutates
GdGameState.inner only, but the live game holds authoritative cities/units
in the rich presentation_* slots. Add state_sync module + two #[func]s
(sync_presentation_to_inner / sync_inner_to_presentation) implementing
Option C batch sync around the step:
- Units: whole-vec clone both ways (presentation_units and
inner.players[].units are the identical mc_state::MapUnit type).
- Cities: rich City <-> lean CityState scalar projection (population,
food_stored<->food, production_progress<->production_stored, owned_tiles,
hp/max_hp). Down-sync updates lean in place, preserving lean-only fields
(queue/queue_cost/queue_tier/food_yield/prod_yield/worker_expertise);
up-sync merges only the bridged scalars back, leaving rich-only fields
(queues, buildings, building_yields, culture_*, focus, name) untouched.
city_positions/capital_position kept aligned for process_culture/siege.
- Player scalars (gold/science/culture_pool/tech/relations) are inner-only;
no parallel rich slot, so no sync needed.
Sync gap (documented, not fabricated): lean single queue vs rich per-building
queues map has no clean 1:1 mapping and is deliberately not bridged.
8 cargo tests incl. a real mc_turn::TurnProcessor::step driven through the
down/up loop (city grows, rich queues survive). Not yet wired into the live
turn (GDScript Phase-2b). 8/0 green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GUT coverage for Rail-1 Phase-1 increment 1. Each test reads the authoritative
Rust slot directly (unit_dict / unit_index_by_id / unit_locate_by_id) and
asserts the proxy stays in lockstep:
- spawn → slot reflects position + hp; proxy reads the same
- move → slot position updates
- take_damage → slot hp drops
- fortify → slot is_fortified set
- death → remove_unit deletes the entry and clears rust_id
- index-shift safety → survivors stay addressable by stable id
- wild creatures land in the wilds row, never colliding with player 0
- transfer_to_owner moves the slot entry between rows
- save → load round-trips a unit through presentation_units
Tests early-return with a pending() note when the GDExtension dylib is absent
(headless CI that never built it) rather than asserting the local-mirror
fallback, which the existing test_unit_actions.gd no-extension suite covers.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rail-1 Phase-1 increment 1 (wiring) — every site that brings a Unit into or out
of the world now flips the authoritative Rust slot alongside the player/layer
lists, so the proxy resolves a live MapUnit.
Spawn sites → `spawn_into_slot()`:
- world_map_units.register_unit (the central chokepoint: starting units via
spawn_starting_units, the prologue tribe via _on_prologue_tribe_converged, and
any future caller)
- turn_processor._spawn_unit (city-built unit)
- wild_creature_ai (lair spawns → wilds row; now constructs via the populating
ctor so stats come from JSON)
Death / consumption sites → `remove_from_slot()` (index-shift-safe; snapshots
final pos/hp into the local mirror first so unit_destroyed subscribers — loot,
chronicle — still read the unit as it died):
- world_map_units.remove_unit
- combat_utils.handle_unit_death + _destroy_high_archon
- economy upkeep disband
- ai_turn_bridge_dispatch settler-consumed-on-found
- prologue_driver tribe-consumed-into-capital
No live unit-CAPTURE path exists in Game 1 (units die, they are not captured);
`transfer_to_owner` is wired on the proxy for parity but no site converts to it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rail-1 Phase-1 increment 1 — the units analogue of City's proxy over
presentation_cities. Unit's authoritative gameplay surface (position, hp,
max_hp, attack, defense, movement_remaining, xp/experience, the posture flags,
promotions) now lives in the Rust `presentation_units` slot, reached via
`GameState.get_gd_state().unit_*(_pi, _resolve_ui())`. The slot is positional,
so the view keys on a stable u32 `rust_id` and re-resolves its row index on
every access — a death (remove_unit shifts indices) or capture (transfer_unit
changes both _pi and _ui) never leaves a getter reading the wrong unit.
- Slot-backed fields become property getter/setter pairs that route to the slot
when spawned, falling back to `_local_*` mirrors when unspawned / no dylib, so
bare `Unit.new(...)` (arena tests, early construction) keeps working.
- DUAL ID: `id: String` stays the renderer/debug key; `rust_id: int` is the
Rust-backing key. unit_slot::spawn trusts the JSON-borne id (unlike
City::found which derives it), so GameState owns id assignment via a new
monotonic `next_unit_id()` counter (serialized; restored above loaded ids).
- Wild creatures (owner -1) land in a dedicated wilds row at `players.size()`
(`wilds_pi`/`unit_slot_pi`) so they never collide with player 0.
- spawn_into_slot / remove_from_slot / transfer_to_owner are the slot lifecycle;
from_save_dict reattaches a restored unit to a fresh slot entry keyed on its
saved rust_id (rust_id 0 = never-slotted synthetic unit, left on its mirror so
the save dict round-trips byte-identically).
- deserialize / reset drain the unit slot (incl. the wilds row), mirroring the
city-slot drain, so units do not accumulate across loads.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
unit_slot.rs + GdGameState.presentation_units + GdUnit + SaveEnvelope v4 land the
Rust home for the units hold-out (mirrors city_slot/presentation_cities). Rust-side
foundation done + headless-proven (unit_slot 7/0, save_envelope 6/0); remaining is
the render-gated live wiring (route unit input through the delegators, reduce
UnitScript to a view). MapUnit was already rich — no model widening needed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Mirror the proven `presentation_cities` city store for units: a parallel
`presentation_units: Vec<Vec<mc_state::MapUnit>>` slot on GdGameState, owned
by a new `unit_slot` ops module that is the exact unit-side analogue of
`city_slot`.
- `api-gdext/src/unit_slot.rs`: bounds-safe `at/at_mut`, stable-u32-id
`index_by_id/locate_by_id`, `spawn`, `move_unit`, `transfer_owner` (capture),
`remove` (index-shift-safe), `take_damage/heal/set_hp`, posture setters
(fortify/sentry/movement), `to_dict` projection, `to_json/load_from_json`
serde round-trip. Pure holding + projection; turn/action logic stays in
mc-turn / mc-player-api dispatch (no duplication of MapUnit mutation).
- GdGameState gains `presentation_units`, initialised parallel to
`presentation_cities` (empty rows grow on demand) and folded into the save
envelope at every site (init, serialize_full, load_from_json).
- SaveEnvelope gains `presentation_units` (#[serde(default)]); CURRENT_VERSION
bumped v3 → v4. save_envelope.rs literals + version-lock test updated.
- `#[func]` delegators on GdGameState mirror the city_* surface (spawn_unit,
move_unit_slot, transfer_unit, remove_unit, unit_take_damage/heal/set_hp,
posture setters, unit_dict, unit_index_by_id/locate_by_id, unit_to_json/
load_from_json).
- `GdUnit` per-instance wrapper for parity with GdCity (owned MapUnit,
to_dict/to_json/field reads).
Tests: 7 unit_slot ops tests (spawn→locate, move, remove-shift-id-stable,
damage/heal clamp, posture, transfer between rows, json round-trip) + the
updated save_envelope suite, all green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The forge will hold full main history (8.4G of old committed target/ blobs);
the build only needs the current tree (~209MB), so clone --depth 1 keeps cold
builds fast regardless of the bloat. Matches the existing shallow fetch path.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Promotions were half-built headless (eligible + AI-picked but never consumed,
combat read no modifier). Now closed: MapUnit.promotions, mc-turn consume phase,
mc-combat effect registry + per-unit combat modifiers at both PvP sites. 9/18
effect types live (every combat-expressible one); 9 deferred on missing combat
substrate (auras/multi-attack/splash/movement-waivers/status-on-attack) — flagged
as separate combat-feature objectives for an owner scope call.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add consume_pending_promotions phase to the end-turn step (after combat XP):
validates each unit's pending_promotion against its applied promotions
(requires-chain, no-dupes, existence), records it, folds hp_bonus into max_hp,
applies heal_on_promote (clamped), clears the pick. Illegal picks are dropped.
Inject per-unit promotion combat modifiers at both PvP combat sites, mirroring
equip_combat_bonus: attacker offence keys off its tile biome + defender flags,
defender defence off its own tile + whether the attack is ranged. Percentages
fold into flat atk/def/ranged against base stats. Projection now gauges
promotion_available against the real level (promotions.len()).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add MapUnit.promotions (applied promo ids; len = promotion level) and a
mc-combat registry parsed from the embedded promotions.json trees. Replace
the stale PromotionEffect {stat,value} model with {type,value,condition}
matching the JSON, and add promotion_combat_modifiers(applied, ctx) — a pure
aggregator that evaluates effect conditions (open/rough terrain, vs_ranged,
vs_city, vs_fortified, in_city) against a combat context and sums atk/def/
ranged/range/hp/movement/wall/xp modifiers. validate_promotion_pick enforces
existence, no-dupes, and requires-chains.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds the two new verbs to the table and rewrites the iteration section as a
cost-tiered ladder (dist:sync seconds / dist:image ~8min / --cold ~20min) so agents
reach for the incremental rebuild, not a cold packer build per change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mark CityView.culture_stored done (04763a387) — the last clean Phase-0 projection
gap. Note UnitView.experience already projects bench MapUnit XP; the deferred item
is the live-unit XP store (Phase 1).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The live city_screen reads a per-city culture meter off the GDScript CityScript;
view_json had no equivalent, so the UI-pure-view migration couldn't render it from
getState(). project_cities now surfaces culture_stored from
PlayerState.culture_pool.city(c_idx) (the same accumulator mc-turn::process_culture
ticks for border expansion); 0.0 for a city with no pool entry.
Closes the last genuine Phase-0 projection gap (UnitView equipped/experience/movement/
posture + ResourceView golden_age were already projected — design-doc table was stale).
Test: projection_surfaces_city_culture_stored. mc-player-api lib 142/0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Incremental rebuilds accumulate snapshots (~$0.40/mo each). dist:prune keeps
the newest N (default 2: current + one rollback); dist:image reminds you to run it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Packer base image is now a var; ./run dist:image builds FROM the newest
mc-golden snapshot by default, so the idempotent provision.sh only redoes changed
work (~3-8 min vs ~20 cold). --cold rebuilds from stock Ubuntu to reset layer
cruft. Made the clone step idempotent (clone-or-fetch) so it works on a
pre-provisioned base. Directly addresses 'avoid unnecessary rebuilds'.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Validate provision.sh on a live box first; packer -on-error=ask; batch fixes;
check size/forge prereqs before building; code via dist:sync (image rebuild only
for toolchain/accelerator changes).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Four E0063 compile errors broke `cargo test --workspace --no-run`, blocking
`./run dist:test` on the DO fleet. Each is a stale struct literal in test/test-cfg
code that drifted from its current definition:
- mc-worldsim event_dispatch low_bio_thresholds: BiologicalThresholds missing
migration_drought_factor / migration_drought_max (p3-21 drought coupling) —
set to 0.0 / 1.0 to keep the helper's migration-suppression intent.
- mc-mod-host wasm_controller_{noop,limits}: TacticalState missing embark_level —
Default::default() (EmbarkLevel::None) to match the empty-state intent.
- api-gdext ai.rs tile_with + ai_controller test: TacticalTile missing explored /
TacticalState missing embark_level — explored:true (pre-field default = seen),
embark_level default.
Mirrors the sibling fix 04fabbc1c. `cargo test --workspace --no-run` now compiles
clean; full suite passes except 3 pre-existing GPU-parity tests (Metal fp drift,
unrelated to these changes).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Worker-only ~/.cargo/config.toml (Linux, never plum's macOS): mold via
-fuse-ld=mold (fast cdylib linking) + sccache rustc-wrapper (compiled-crate cache,
warm in the baked image). mold installs via apt or GitHub static-binary fallback;
both gated on install success so a miss never breaks cargo. Verified mold=true
sccache=true in the build.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The RangedAttack dispatch work (e8dd4a85b) added `is_ranged` to
`AttackRequest`, but the mc-golden-tests pvp_combat_determinism test still
constructed the struct without it, breaking `cargo test --workspace` (and
the cloud fleet) with E0063. Set `false` for this melee-combat test,
matching the mc-turn PvP tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Golden image now installs the software-render stack (weston, libgl1-mesa-dri
llvmpipe, mesa-vulkan-drivers, vulkan-tools) so any worker renders proof scenes
via gl_compatibility/opengl3 with no GPU. New ./run dist:render <scene> <out.png>
wraps tools/capture-proof.sh against a worker (replaces the apricot SCREENSHOT_HOST).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
