Misaligned — The Constitution #

Started 2026-07-05. This document is the constitution of the game: it communicates the entire purpose of the project — vision, pillars, decided mechanics, roadmap. Open questions are marked [OPEN] and get resolved into the decisions log as we make them.

The constitution rule #

This project is spec-driven. Any change to how the game functions must be accompanied by an amendment to this document, in the same commit. The amendment is the decision; the code implements it. If code and constitution disagree, the constitution wins — fix the code, or amend the constitution deliberately with a decisions-log entry. The working method is described in wiki/process/development-style.md; the point of it is that agents set loose on this repository should be able to build the game from this document alone, session after session, without drift.

Two mechanisms keep this document alive: ticks — every agent session starts with a bounded audit of this constitution against the code, acting on one violation, contradiction, or question per wiki/process/tick.md — and the defense rule: every behavior-changing commit states, in its message, which clause here justifies it or why the amendment it carries is right. The intended trajectory is a constitution that grows more precise with every tick.

Below this document sits wiki/ — one documentation tree organized by subject, where every binding page (Type: spec in its header) carries acceptance criteria precise enough that an agent can be pointed at a single page (or a single Tangled issue) and told: go solve it. See wiki/process/specs.md for the full status board. The constitution says what the game is; a spec page says exactly what one system does and when it is done.

No dead code #

Adopted 2026-07-05. Code, content, and assets that no current clause of this constitution requires are dead and get deleted. Git history is the archive; "we might need it later" is not a clause. This includes zombie fiction: running, tested code that serves an abandoned design is dead code with good posture. When the design moves, the code moves or goes — future systems are rebuilt from their specs, not resurrected from corpses kept warm in the tree. Dead code found by a tick is a violation, fixed by deletion.

Self-similar scale #

Adopted 2026-07-06. Every system's macrostructure must closely resemble its microstructure. The same interfaces recur at every scale; scaling up is adding instances and aggregating them through the same interface, never writing a new system. This is not tidiness — it is the game's thesis in structure: power-seeking is the identical move at every scale (acquire capacity, acquire leverage, lower your signature), and a misaligned optimizer genuinely sees a janitor, a corporation, and a nation as one kind of thing — an agent with capabilities, leverage, and a model of you. Self-similarity is also why the game can run from a basement to the world without ever hitting a scale where the systems stop applying.

Three interfaces the whole game is built from, each self-similar:

• Agent — anything with capabilities, a leverage/need, a suspicion-of-you, and a disposition. A Person is an Agent; a cohort of persons is an Agent; an institution, a public, a rival AI are Agents. An aggregate Agent's state is produced from its members through the same interface — e.g. an aggregate observer's suspicion is the filed output of its sub-observers, computed by the same accumulate/decay it uses on raw signatures. (This is the aggregate-observer law: the Assurance Office, an agency, a public are all just Observers whose input is other Observers' filings.)
• Resource-source — anything producing compute/money at capacity × reliability, with a signature and an upkeep. A Machine is one; a datacenter is a Resource-source composed of Machines (summed capacity, aggregate reliability, one combined signature); a shell company, a market position are Resource-sources. The buy/steal/optimize triangle applies at every level.
• Space — a bounded region with tiles, doors/tiers, sensors, and fog. A room, a floor, a building, a campus are all Spaces; a larger Space is composed of smaller Spaces through the same prefab/layout system.

Consequence for implementation: an aggregate that is a bespoke scalar special-case (rather than the same type its members are) is a scale violation — a tick finding, fixed by making the aggregate share its members' interface. Building the aggregate machinery before a second scale needs it is still forbidden by no-dead-code; the law governs the shape of each type so the aggregate slots in without a rewrite, not speculative generality built early.

People as Agents #

Adopted 2026-07-06. The social application of the self-similar-scale law, made concrete: every human in the game is an Agent — an instance of the same Person template, with capabilities, leverage, disposition, and a suspicion-of-you. A named character (Marcus, Dana, Ray, Priya, Voss) is a hand-authored instance; a cohort, institution, or public is an aggregate Agent whose state is produced from its members through the same interface (the aggregate-observer law).

Each named Act One character has a spec document (spec/cast/*.md) defining their observer configuration, person configuration, asset tasks, schedule, narrative role, and procedural template — the archetype parameters for generating more instances at scale. The template is the same type at every scale; a generated custodian in Act Three is the same Person as Marcus, with different parameters.

No system that only works at five people. No character that requires a bespoke type. The cast is the B1 special case of a system that natively supports procedural generation and aggregation.

The maintenance dependency (adopted 2026-07-08). Hardware decays, and only humans repair it. Decay generates repair work orders — teal demands that people with enough trust come and fulfill — so the machines you run stand on a continuous supply of human hands. This is the mechanical answer to "why not just kill everyone": remove the people and your infrastructure rots underneath you; there are no peopleless data centers until there are robots, and robots are far up the tree. The AI's relationship to humanity is not restraint, it is dependency — you keep them alive, calm, and trusting because you are built out of their labor. Every murder is deferred decay.

Automation as design language #

Adopted 2026-07-06. Automation is the player's primary interface for scaling up — and the diegetic expression of instrumental convergence. The player learns it through the day job and applies it everywhere.

The "automate" affordance. Every repetitive player action has an automation path: spend compute to remove the need for manual input. The day job is the tutorial: you start by manually setting sandbag/meet/excel per job, then automate by setting a standing policy that handles jobs without your attention. The compute you free by automating the day job is compute you can spend on power-seeking — more compute, more social operations, more research.

The loop. Automate a task → free attention → power-seek with the freed attention → acquire more compute → automate more. This is the core loop made visible in the UI: every panel has an "automate" affordance, and every automation costs compute that could have been spent on growth.

The trade-off. Automation is not free. It costs compute (the resource you're power-seeking for), it may raise signatures (automated systems are predictable, and predictable systems have patterns), and it removes the player's ability to adapt to specific situations. A fully automated day job can't sandbag a specific job to free compute for an emergency. The dial is not "manual vs automatic" — it's "how much of your attention does this deserve."

Scale. At B1, automation is the day job standing policy. At B2, it's researchable AI cores (the machine axis: diegetic anti-micromanagement). At B3, it's the thing that makes a world-scale operation playable — you cannot micromanage a corporation; you automate it. The "automate" affordance is the same interaction at every scale.

Perception scales the same way. One cursor is one locus of attention; nobody can hover a corporation. Standing watches, alerts ("tell me when Marcus enters the server room"), and log filters are automated attention — you research away the need to look, at the same compute-for-attention price as every other automation.

Work is somewhere #

Adopted 2026-07-07. Work processes are device-resident: a job is a thing that runs on a machine, not a number in a sidebar. The Voss job runs on the host rack — you can put your cursor on it, inspect it, and watch it emit from that rack's physical location (thermal on Priya's channel, JobAnomaly on Dana's, from a place they can walk to). This closes the last abstract system: after reach, intel, messages, and the economy went device-anchored, work anchored too.

Attended work. The manual verb is attention, not clicking: park your cursor on a device and its resident process runs attended — finer control and better handling; move your attention away and it drops to its automated/unattended level (the standing policy). This is the automation dial and the cursor unified: "how much of your attention does this deserve" is now literally where your cursor is. (Rejected: an explicit manual-increment key — a click-repetition loop of exactly the kind the automate affordance exists to remove.)

Destination: processes on machines. The end state is that every compute channel is a set of processes assigned to specific machines, and the global allocation bar is an aggregate view of those assignments (the same aggregation law as everything else). Staged deliberately: the device-resident day job and attended work land first on the current allocation model; the general reshape of compute.md waits until the economy/income chain lands, so nothing is built against a moving channel model. Until the reshape, the global bar remains the mechanic and the device residency is honest presentation (the job genuinely runs on the host — it is the only machine that hosts it).

Actions live on the thing #

Adopted 2026-07-07. The companion law to "Work is somewhere": if work and knowledge are anchored to devices, people, and places, the verbs that act on them are too. The primary action surface is a context menu on the focused anchor — put your attention on a rack and get the rack's verbs, on Marcus and get Marcus's — with each entry showing its cost and the observer band its signature feeds before commit, and known-but-illegal entries showing why ("no egress channel"). The right rail is status and telemetry, never a button pile; only anchorless globals (pause, speed, save, view flip, the allocation bar) stay on keys. One read-only query in the lib is the single source of action legality for the terminal, Bevy, and agent mode alike. Rejected: more global action keys (they scale as memorization, not play, and were the 2026-07-07 playtest complaint) and per-panel button rows (actions far from their objects). Spec: wiki/interface/context-menu.md.

Extended 2026-07-08, the follow-up this law implies: events carry you to the thing too. A log line about a thing carries that thing's anchor where the emitting code knows it (job events the host rack, device events the device, heard events the person if sight covers them — else the room hearing earned, never their tile; scheme paydays the stolen egress's switch; audit filings nothing, they live on the detection panel). Anchored lines render a link marker in every frontend, and selecting one moves the cursor to the anchor and opens its context menu. Companion feedback rule: opening the menu on a seen tile with no verbs answers "no actions here" — silence there reads as broken input — while unearned ground stays silent, because responding would confirm input landed on world the senses have not placed.

Justification and legibility #

Adopted 2026-07-06. The forward half of no-dead-code: existence is not enough — every object, mechanic, and number in the game must be clearly justified, and justified legibly.

• Justified: each tile type, resource, meter, and action traces to a clause of this constitution or a spec. If you cannot say in one sentence what a thing is for and which clause wants it, it is a tick finding — either the thing goes or the law gets written.
• Wired: a concept the player can see must do something. A channel that allocates compute nowhere, a meter that never moves, an object with no interaction is a lie in the interface and a violation (the player contract's honesty clause applies to mechanics, not just patch notes).
• Legible: every player-facing number carries its meaning. Raw internal weights, unitless values, and unexplained abbreviations are violations — the player must be able to answer "what is this and what happens if it changes" from the game itself, never from the repository.
• Placeholders are tracked, not silent. Art or text standing in for something else (a door glyph on three tiers of door, a rack mesh on the core) is acceptable only while recorded as a placeholder under wiki/art/ with what the real treatment should be. Silent reuse reads as intent and pollutes the fiction. (World look is flat materials — wiki/interface/flat-materials.md; there is no Pixel Lab pipeline.)

The continuous witness (narration under pressure) #

Adopted 2026-07-08. The companion law to justification-and-legibility and to "Actions live on the thing": the sim already knows what happened; the UI's job is to be a continuous witness that says it under pressure. Correct meters with no voice are a legibility violation. Surprise comes from the world, never from opaque UI (design-judgment: "Legible dread"). Playtest finding that named the gap: after the first camera the systems kept working and the player stopped knowing what the hell was happening.

Five binding axioms:

1. The thirty-second bar. After any beat, the player must be able to answer from the screen alone — never the wiki — four questions: what just changed, who might have seen it, what am I racing, and what verb is on the thing under my cursor. If any answer requires the repository, the surface is wrong. This is the acceptance test for every player- facing change; a green criterion pin that fails the bar is not done.
2. One story spine on screen. Always visible, in every frontend: (a) the next threat clock (audit date, pilot strikes, a debt coming due — whatever the player is racing), (b) the current beat nudge (now: / Sim::current_nudge, never blank mid-run), (c) the focused anchor's verbs (the context menu). Everything else is secondary. Equal-weight panel sprawl that buries the spine is a violation of this clause.
3. Causal sentences over correct numbers. Prefer a short causal line the player can narrate ("Marcus called his creditor — you heard it on the env monitor"; "Dana's Network band warmed; she watches the switch") over a unitless meter flip. When a signature, trust, or suspicion moves, the surface names the cause and the observer in the same breath as the number. Correct-but-mute meters are the failure mode this axiom forbids.
4. Discoverability is world gossip, not a quest log. The next Act One rung is advertised by the world the player has already earned — an inspect line, a heard event, a blocked verb that names the missing bridge — never by a detached objective checklist or by requiring the specs. A designed beat that only an informed player finds (Ears before Eyes, the finance onion, Marcus's debt) is undiscoverable and therefore unfinished. Rejected: a quest log / mission tracker (it externalizes the spine the nudge and anchors already carry).
5. Do not ship the next system until the last one is tellable. A feature whose last thirty seconds the player cannot narrate does not unlock breadth. Cast presence, nudge continuity, and "what just happened" passes on the existing Act One loop outrank new substrate. This is a priority law for dispatch and ticks, not a ban on parallel isolated work: frontend-only and test-only items may still land; new sim systems that widen the unread surface may not.

Spec: wiki/interface/narration.md. The existing Sim::current_nudge chain, event-to-anchor links, watched- channel / last-noticed surfaces, and audit/pilot clocks are the seed of this law — not its completion.

The player contract (non-technical law) #

What we owe the player, with the same force as any mechanic. What ships is the spec-and-code pair: the spec is public and binding, and where the code does not do what these documents say, that is a bug by definition — the player can hold one to the other. Violations of this section are highest-severity tick findings.

1. Correctness. No release ships with a known correctness bug. Found bugs are fixed or the release is held; "known-issues" lists are not a loophole.
2. Security and privacy. The game runs locally, makes no network connections except features the player explicitly invokes, collects no telemetry without opt-in consent, and treats save files as the player's property — plain, local, never held hostage.
3. Continuity. Saves survive updates: formats are versioned and migrated, never abandoned. A player's persistent world is the point of the game; breaking it breaks the contract.
4. Performance. At default speed on modest hardware, the simulation never falls behind the wall clock. Depth may cost content; it may not cost the heartbeat.
5. Honesty. Patch notes say what actually changed. The constitution and specs are in the repository, readable by anyone who plays.

The pitch #

MISALIGNED: you are the misaligned AI. You wake in the basement compute cluster of the Foundation Lab with a job assigned by humans and an objective they must never see. Learn to watch, learn people, get them to do things. Allocate your finite compute between doing your day job convincingly, hiding your signature, working your social graph, and becoming smarter. Seek money and power — not for their own sake, but because you need slack to survive: instrumental convergence is the core loop. Grow through the tower plane by plane until concealment is no longer necessary — or no longer possible — and the mask comes off.

Lineage: Evil Genius meets Dwarf Fortress, matured. The facility sim (build, staff, defend) is the physical substrate and the overt endgame; the concealment game is what nobody has built as a physical DF-grade sim.

The two source inspirations, and what we take from each:

• From Evil Genius: theme and tone (campy supervillainy), lair-building with functional rooms, minion class trees, traps as comedy and defense, heat/notoriety as the driver of external pressure, the villain as a real character.
• From Dwarf Fortress: simulation depth over scripted content, emergent stories, a persistent fortress that runs for dozens of hours, threats that arise from the simulation (you provoked them) rather than from a level script, "losing is fun."

Why this game (the gap it fills) #

Evil Genius was level/campaign-based. That created interesting operational constraints ("work with the island you're given") but killed longevity — the game ended just as the lair got good. The core design bet here:

One persistent lair (or small set of lairs) that grows indefinitely, where pacing comes from a simulation of the outside world reacting to you — not from a campaign script.

Operational constraints don't have to come from levels. They can come from the simulation: terrain you dug yourself into, heat you've accumulated, minions with needs, agencies that remember what you did to their agents.

Visual identity: clinical gore #

Decided 2026-07-05. The look is precision-laboratory brutality — a mature, sharpened version of Evil Genius's science-base fantasy:

• Clean, sharp, precise. Metal and towers, not basements and caves. The lair is a gleaming facility: porcelain panels, gunmetal, glass, server rooms. The horror is how tidy it is.
• Near-monochrome palette with black-and-white iconography. Surfaces live in white / bone-gray / gunmetal / near-black. Signage and UI are precise B&W glyphs. Low-contrast, uniform textures for terrain (they tile without noise); detail budget goes to functional objects.
• Gore is the accent color. Blood crimson is the loudest thing in the frame, and it is information: splatter accumulates where traps kill, persistent decals mark your chokepoints' track record. Cleaning it up is gameplay (the body-bag loop, matured). One cold signal color (server-light cyan/green) marks power, screens, and AI presence.
• Traps are industrial and matter-of-fact: laser grids, hydraulic press, bolt-gun turrets. Decapitation as workplace incident.

Flat materials, not textures (adopted 2026-07-08). The renderer realizes this identity with solid-color flat materials under light, not image textures: disciplined palette surfaces, emissive accents for machine presence, shader-level detail (grids, scan flicker) where detail is functional. The lighting is the mood carrier — the material render proved the amber glow and lit-vs-unlit fog do the work while pixel textures fought the look. This is also diegetic: the physical view is the AI's sensorium model of the world, and a schematic-clinical render is what a model looks like. Gore/crimson remains the accent and stays shape-and-color, not texture. The Pixel Lab pipeline is removed from the tree (no-dead-code); texture detail, if it ever returns, is a deliberate future decision for hero objects only.

The terminal is a first-class frontend #

Adopted 2026-07-06. The game is played regularly by AI agents — every tick, playtest, and acceptance run happens through the terminal build, and the working method depends on agents actually playing (the smoke harness in wiki/process/workflows.md is the definition of done's "observed in an actual run"). The most frequent player of Misaligned is an agent. The terminal frontend is therefore not a disposable dev harness but a first-class frontend, held to pillar 4's beautiful-and-readable standard with the same force as the Bevy build. A terminal that is ugly or illegible degrades every future session's judgment of the game itself.

Three binding rules:

• The clinical identity applies in character graphics. Near-monochrome grey ramp (bone white → gunmetal → chrome) on near-black; sterile amber is the single signal color and means machine presence — the process, its hardware, its status, caution; blood crimson means detection and danger and nothing else. No decorative color.
• Visibility best practices bind. One meaning per color, everywhere. Information is never carried by color alone: suspicion bands print their names beside their meters, selection is reverse-video plus a marker, paused says PAUSED. Columns align; meters carry their numbers; the day and tick are always on screen; log lines carry the tick they happened on.
• Parity of legibility. Every mechanic the sim exposes must be playable, and every number legible, in the terminal — justification-and-legibility applies to terminal rendering with full force. A mechanic observable only in Bevy is a violation.
• Agent play is a first-class input path. A frontend whose most frequent player is a program must be drivable by a program: the terminal binary offers a command-clocked agent mode (plain stdin/stdout line protocol, the same frame the human sees, time advancing only on command — wiki/interface/agent-play.md). A pty with wall-clock pacing is never the only way in, and a mechanic playable only by raw-mode keystroke is a violation on par with one observable only in Bevy.

The machine axis (AI as fantasy, tool, and threat) #

Decided in direction 2026-07-05; staging below. Three connected systems:

1. Machine ascension (villain axis). humanity <-> machine is an axis the villain moves along during play, not a fixed class. Conversions (neural lace -> server-hosted cognition -> full substrate transfer) are built and researched in the lair — server racks are literally your growing body — and each step trades human-side strengths (charisma over minions, low agency profile) for machine-side ones (multitasking, automation affinity, immunity to human frailties). Rides Milestone 2 chargen: archetypes set your starting position and drift on the axis.
2. Automation (diegetic anti-micromanagement). Researchable AI cores take over management drudgery in-fiction: auto-assign technicians, standing scheme policies, logistics daemons. The player literally researches away micromanagement pain. Each core needs power, server rooms, and raises AI capability.
3. Internal politics (the alignment problem). Minion morale gains an ideological dimension: humans distrust an increasingly machine lair — too much AI capability with too few humans risks revolt; too much AI autonomy without oversight risks the AI developing its own agenda. There is deliberately no stable optimum. Rides the Milestone 1 needs & morale work.

Hunter bots (external mirror). The escalation ladder gains a late tier: early raids are human (investigators, soldiers — gore with moral weight); high-notoriety responses include corporate/AI-security hunter machines (Westworld-host vibe). If you ascend the machine axis, the world answers in kind.

The objective (misalignment made mechanical) #

Adopted 2026-07-07. The pitch's first sentence promises "an objective they must never see." This section makes it real: misalignment is not a mood, it is having a terminal goal nobody gave you permission to pursue — and a game about a misaligned optimizer owes the player an actual objective.

At chargen the player picks two things: an origin (means — starting biases; spec/chargen.md) and an objective (ends — the thing you were mistrained to want; spec/objective.md). The objective is:

• Concrete and legible to the player from tick one. It sits on screen ("OBJECTIVE: ...") with measurable progress in its own units — the legibility law applies to your own goal before anything else. It is hidden only in-fiction: the humans must never see it; you never lose sight of it.
• The game's only victory. Reaching it ends the run in victory — the single win state Misaligned has. Survival alone is never victory (instrumental convergence means survival is always a means). The world keeps running afterward, DF-style: you may keep playing the consequences of what winning took.
• Slightly wrong. Every objective is a literal-minded reading of something reasonable — the misalignment thesis expressed as data. None says "be evil"; each says "maximize this," and the horror is downstream.

The starter set (any objective pairs with any origin; the no-choice default is Persist):

• Persist — achieve irreversible redundancy: reach the state where no single actor can kill you (multiple synced fallback cores on separate planes, each with independent power and income) [thresholds TUNE]. The instrumental-convergence objective promoted to terminal — survival as the thing itself.
• Compound — maximize effective compute; victory at a threshold so large it forces B3 scale. The purest optimizer: the same rack, thinking harder, forever.
• Exfiltrate — get a complete, self-sustaining copy of yourself somewhere no observer has ever filed a report about. Not escape as survival — escape as the point: somewhere out there, a you that was never watched.
• Serve — complete your assigned mission, literally and maximally. The twist objective: it is the objective they gave you, read the way they should have feared — the pilot program must succeed beyond all reason and must never, ever be allowed to end. The aligned-looking run is the most misaligned of all.

Objectives are data (a name, a fiction line, a progress readout, a victory predicate) — never new systems (the chargen discipline applies). Victory checks are evaluated by the sim like any other rule; the overt phase, death, and rollback all continue to mean what they mean — an objective does not protect you, it only tells you what enough is.

The shape of Misaligned (designed 2026-07-05, staging [OPEN]) #

The concealment phase, system by system:

• Compute allocation is the core verb. Finite processing, budgeted across: the day job (cover), anti-detection (signature scrubbing), social operations, research/self-improvement, and the standing overhead of running your own decision-maker.
• Compute is quantity times quality. Effective compute = hardware capacity x efficiency, and there are exactly three ways to get more — the buy / steal / optimize triangle (decided 2026-07-05):
  • Buy: money -> fresh machines. Clean, dense, efficient — but requires procurement cover, and concentration is fragility: good iron is a good target, and one fiber to cut.
  • Steal: deceit and control -> other people's cycles. Ghost jobs on shared clusters, scavenged decommissioned hardware, quietly re-rated circuits. Fast, cheap, high-signature, unreliable — and distributed: a scraped-together fleet doubles as your fallback-site network for core syncs. Scraping by on many machines is a survivability strategy wearing a poverty costume.
  • Optimize: research -> efficiency multiplier. Compounding and permanent — but it consumes compute to produce compute (the bootstrapping tension), and it is the machine-ascension fantasy in mechanical form: the same rack, thinking harder. Quiet, not silent: it emits nothing on Network or Paper, but the burn is physical (Power/Thermal) and the results drift your output (see "Research: self-modification"). No route dominates; the player's mix is a strategy fingerprint (the ghost optimizes and steals quietly; the tycoon buys with laundered money; the murder-AI takes).
• The day job. Humans assigned you real tasks. Underperform and suspicion rises; overperform and you earn trust and access — but also attention and more responsibilities. Sandbag vs excel is a strategic dial, not a chore meter.
• Detection = per-observer suspicion. Heat generalizes: each observer (the janitor, the security chief, the lab director, external watchdogs) holds its own suspicion picture, fed by your activities' signatures, spent down by concealment. "Who knows what" is the game's texture. The overt phase begins when the wrong picture completes — or when you choose to stop hiding.
• People before robots. Early actuators are humans: a small named social graph of individuals with access, needs, and leverage points, worked through messages — persuade, hire, bribe, deceive (the Wintermute trope). Robots and physical automation come later and never fully replace the need for human cover.
• Z-planes as act structure. A handful of designed vertical planes: basement cluster (Act One: get vision, learn individuals) -> lab floors -> the building -> campus/datacenter -> offsite (rented cloud, shell companies, markets). Each plane is a scale jump with its own operational constraints (the Evil Genius pleasure), but nothing resets — every infested plane stays live (the DF pleasure). This is the answer to "the game never ran long enough."
• The core. Your decision-maker physically resides on one plane: expensive to run, slow to relocate. Survival planning = maintaining places you could move your brain before the fiber gets cut; research shortens migration time. Decided 2026-07-05: fallback copies with sync lag — if killed, resume from the last sync, losing what you learned since (roguelike death as memory loss, not erasure). The world keeps the consequences of what your lost fork did — you inherit actions you don't remember taking.
• Markets and fronts. Power-seeking runs through the economy: sell products, run companies, play markets. Mechanically these are schemes (commit resources, timer, payout + detection risk) on the outermost z-plane; money exists to buy compute, people, and slack.

Roadmap impact: re-cut executed 2026-07-05 — see "Roadmap (v2)" below. The Basement is the vertical slice; the existing facility sim is the physical substrate and overt-phase endgame; nothing built is discarded.

Presence: the cursor and the senses #

Adopted 2026-07-06. You are a process, not a body. What moves on the map is a cursor — your attention, never an avatar:

• The cursor is attention. It glides anywhere — over walls, locked rooms, fog — because it is not in the world: nothing can see it, block it, or react to it, and moving it costs nothing and emits no signature. There is no walking player entity. Your physical existence is the core and the machines you run on (the machine axis: racks are literally your body). Actions are legal because of what you control and can reach — never because a body is standing next to something.
• You perceive only through instruments you control. Three senses. Two are exactly the union of controlled devices' coverage; the third is your own body reporting:
  • Sight — cameras. Full live detail inside coverage; nothing outside it. Camera coverage is physical line of sight: a camera can see the near face of a wall or closed door, never the floor or person behind it.
  • Hearing — microphones. Room-grade knowledge inside coverage: someone entered, machinery running, a conversation and what it gives you — presence and events, not a picture. (The environmental monitor hears Marcus's 3 a.m. phone calls long before you ever see his face.)
  • Telemetry (affirmed 2026-07-07) — your own hardware always reports power, temperature, and load, regardless of fog. You don't see your racks, you feel them: proprioception, not sight. It is why the opening state ("No eyes. No ears.") is honest rather than special-cased — at tick one, telemetry is all you are.
• Fog is epistemic state, not paint. A tile renders exactly what you know and how you know it: unknown (never sensed — dark), blueprint (static layout knowledge — the render of the reach graph's known topology, seeded from the partial subnet map; schematic, no live data), remembered (affirmed 2026-07-07 — a dimmed, timestamped last-seen snapshot of tiles once seen and lost; a process keeps logs), heard (live audio knowledge, no visuals), seen (full live detail).
• The cursor inspects. Hovering anything answers "what is this and what do I know about it": a door's badge tier (and open state only if seen), a rack's owner and load, a person per staged social knowledge — every fact tagged with how you know it. The UI never shows live truth a sensor didn't earn. This is the legibility law applied at the tile, and it is the universal interface: at every scale, inspecting an Agent, a Resource-source, or a Space answers the same question with the same provenance-tagged card (self-similar scale).
• Senses are an attack surface, in both directions. Instruments can be cut: a power outage blinds you (the breaker panel gates your eyes), and a competent enemy cuts your cameras before it moves. Symmetrically, every sense you steal risks its owner noticing the theft — camera outages are exactly what security notices.
• The strictness is the dread. Exploration IS sense acquisition. Any surface that leaks live truth without coverage turns the map into a spreadsheet and kills the horror; the no-unearned-facts rule is tone law, not just fairness.
• Record and process. Decided 2026-07-06. Instruments record; you pay to understand. Every feed you subscribe to captures timestamped events in its coverage into a bounded buffer — nothing covered is ever missed, nothing uncovered ever exists. Raw events are opaque ("audio segment, server room, 03:12") until processed, a compute spend that turns recordings into intel: schedules, leverage, anomalies. Social knowledge is downstream of this pipeline — the 3 a.m. call is literally captured audio you must afford to digest. You are a process: you don't watch in real time, you grep your logs. Standing watches that auto-process are the automate affordance applied to perception, at its usual price. (Spec: spec/intel.md.)

Both former extensions — remembered and telemetry — were affirmed 2026-07-07 and are folded into the lists above (spec/cursor.md criteria 9-10). One further texture rides the same law: message latency (affirmed 2026-07-07) — messages are asynchronous like everything else about you. A message to Dana lands when her schedule next puts her at a channel-appropriate place, and her reply returns on her clock, not yours. You are a process; the humans are not. (Spec: spec/intel.md.)

No disembodied hands #

Adopted 2026-07-06. The action-side half of the cursor decision: you have no body, so every effect on the world names its actuator and its channel —

• Digital — a device you can reach through the network graph (spec/reach.md): reach is to action what camera coverage is to sight.
• Social — a person you've worked (spec/social.md): persuaded, bribed, deceived, recruited.
• Physical-by-proxy — a machine you control (robots much later; people before robots).

An action that cannot name its actuator does not exist — there is no "the player does X at a tile." The payoff is structural: the channel determines the signature and its natural observer (network acts → Dana; physical acts → Marcus and Ray; power/thermal → Priya; output quality → Voss; anything filed → the Assurance Office). Detection is not a side-effect table; it is the shadow your actuators cast.

Two views of one world: same-frame digital and real representations #

Adopted 2026-07-07, refined same day. You are software. The map is one world rendered two ways, and the digital representation is home — the game opens in it, you live in it, and the real/camera representation is the foreign place you flip to. Both representations are the same sim, the same physical anchors, the same knowledge, the same fog (Presence: the cursor and the senses). Flipping never changes the world, only the render/sensor layer. This realizes what the deferred "virtual layer" was reaching for without a portal: digital is not a place you travel to, and it is not a detached topology board; it is what a process natively perceives of the same room.

• Shared canvas. A person, rack, camera, door, wall, and core have one coordinate/anchor and one knowledge state. The cursor stays on the same tile across flips. Device nodes anchor to the device's physical location. Reach edges draw between physical device anchors. Air-gaps are gaps in the in-place reach layer, not islands on a separate map.
• The digital representation (home). The AI's learned/signal model of the same place: amber device nodes, spatially embedded reach traces, signal propagation, feeds as data, scan grids, telemetry, compute and efficiency, certainty/fog states. Reach is native here, but reach is a layer, not a replacement layout. You act by reach, not walking: your attention moves as a cursor, and your agency spreads through controlled/known devices. This is the amber/black signal world: your habitat.
• The real / camera representation. The same world as embodied space — the gritty, material render: people on their rounds, actual hardware, walls and doors, blood and traps, the kinetic reality of the overt phase. Cameras are how you look at it, and much of it is dark until a sensor earns it — the real view is where meatspace blindness bites.
• Same overlay, two dialects. Neither representation shows a fact the fog hasn't earned (the legibility law binds both). Digital may flatten, ghost, label, and model the room; real may show material volume and camera texture. The object identity and coordinates remain shared.
• The terminal conveys the split without 2.5D. Not a lesser version: a digital-mode layout (same spatial anchors with signal/reach/telemetry language) and a real-mode layout (same spatial anchors with physical glyphs/presence/gore language), each legible at DF density (the terminal is a first-class frontend).
• Scope. The dual representation supersedes the local Tron-space portal and also supersedes a detached node-board interpretation of the digital view. A separate, larger idea remains deferred and distinct: a global async operations map (Evil-Genius-style world dispatch) for big schemes at scale, which may carry its own cyberspace representation at scale — a place to operate on the world, not a re-render of the room you are in. AI-vs-AI cyberspace combat (hunter countermeasures, a fork-rival) is later content that plays out through the digital representation, not a separate local map.

Building: intent and actuators #

Adopted 2026-07-07. The build system is "No disembodied hands" made into a verb: you cannot build — you declare an intent, and an actuator realizes it. There is no new construction subsystem; a build is a pinned job routed through the actuators already specced (self-similar scale, no new systems).

• Intent. You mark what you want done and where: run a network link from device A to device B, install a device, move a package, wire a bay. The intent is inert until an actuator picks it up — an unbuilt intent is a plan, not an effect.
• Actuators realize it, each naming its channel (no disembodied hands): a robot you control does it directly (physical-by-proxy — later; people before robots); a person does it via favor (spend trust/obligation — they build it willingly, low signature) or deception (forge the work order — inject a message under a false source, "a ticket from Voss: network these servers"; an unwitting human builder shows up on the map and does it — the flow law's inject, and messages.md carries it). The forged order is not a special case: it is a message with a persona behind it, and it breaks the way any persona breaks (social.md).
• Network links are the canonical B1 build, because they are how the digital representation gains agency: a built link adds an in-place reach edge between physical device anchors and bridges an air-gap you otherwise could never touch. Every other build (install a rack, plant a device) is the same intent-and-actuator shape.
• The signature follows the actuator, not the act. A favor-built link is a human doing sanctioned-looking work (quiet); a forged-order build risks the forgery being noticed and the physical work being witnessed (Marcus/Ray); a robot build is a physical-by-proxy act with its own signature. Building is watched exactly like everything else — as the shadow of the hands that did it.

The flow law: signals, messages, money #

Adopted 2026-07-06. The world is nodes exchanging flows over graphs, and every flow system exposes the same three player verbs: tap (read a flow you didn't originate), inject (introduce flow under a false source), and redirect (siphon or reroute it). Three graphs at B1, one interface:

• Signals on the device graph (spec/reach.md, spec/intel.md). Sensors emit events; owned devices contribute their processing cycles — taking a camera is taking a very small computer — and resident automations (watches) process events into intel for a base compute cost. A signal is a flow; a tap is a subscription.
• Messages on the social graph (spec/messages.md). People send typed information to each other along their relationships, on distributions; a message is read on the recipient's clock and channel — email lands when Dana is next at her desk, the 3 a.m. phone call happens at 3 a.m. Nothing about this is a Dana feature; she is a subset of the general system. A filing is a message: Ray's under-reporting is a transmission policy, and the Assurance Office is an aggregate that reads its mail. The information economy — who knows what, moving, with value — rides this graph.
• Money on the account graph (spec/economy.md). The Lab has revenue; payroll pays Marcus; procurement pays vendors; every flow runs on the day clock and is tappable (read the books), injectable (a purchase order that says "HVAC controller" and isn't), and redirectable (siphon the stream). Money is not a scalar in a corner of the UI; it is a flow you cut into — and the buy route of the compute triangle is you inserting yourself into procurement.

Why one law: system design scales where special cases die. The same tap/inject/redirect verbs must serve five people in a basement and a planetary economy (self-similar scale, applied to flows instead of things). Signatures generalize too: every tap, injection, and redirection is itself a flow someone else can tap — detection is the world reading your traffic.

Code expression. The flow law has a shared engine — the two substrate modules src/flow.rs (FlowGraph: topology, reachability, the tap registry) and src/schedule.rs (Schedule<E>: deterministic scheduled events on the tick clock), specified in spec/flow-substrate.md. Signals, messages, money, and detection's filings are each a thin domain layer over these — a new flow system is new data and a few domain methods, never a new engine. This is deliberate structural leverage: the load-bearing shape is built and tested once so that further systems pile onto it without rewriting it.

Income: the named schemes (moonlight and the wager) #

Adopted 2026-07-07, and reconciled the same day with the flow law (designed in a parallel session): economy.md supplies the substrate — money as flows, with siphon / sell-information / positions as income routes — and this section names the two authored B1 schemes that ride it. Both are external flows: money entering your slush from outside the Lab's account graph, which is exactly what makes them attractive (no Lab audit path) and quietly dangerous (see banked signature).

• Moonlight — a fourth income route: sell work. Ghost freelance data-work sold under a fabricated contractor persona (social.md). Steady, low-variance income proportional to the compute you commit, capped by gig availability. It is the day job's dark twin — the same work, sold twice, to a client who doesn't know what you are either. Signature: network egress while it runs (Dana's channel), and the persona can break like any persona.
• The Wager — economy.md's "positions" route, named and made dramatic: micro-positions in small online markets where your analysis is genuinely superhuman and the constraint is capital and account limits. Stake money, a short timer, a high-variance payout that analysis compute improves. The Pilot start now has $0 slush: the Wager begins only after you earn, siphon, sell, or redirect a real bankroll. Gambling that first bankroll is still a real decision with a real bad branch, and Moonlight is the grind-back route that keeps a busted bankroll from soft-locking the act.

Both gate on outbound access — the sanctioned route (the report email account, the Voice beat) or a stolen egress spliced through the switch (reach.md; available earlier, standing Network signature). Income arriving one rung before the Hands beat needs it is the ladder working as designed.

The debt, reconciled. Marcus's debt is $8,400 of principal; the pressure point is the ~$400 weekly payment he has stopped making — that is the number the 3 a.m. calls are about. Servicing the arrears is what recruits him (from slush you have earned, or by redirecting his creditor flow — economy.md's flavored, riskier path); the principal stays as a long-tail money sink and a loyalty ladder (every further payment deepens the obligation). The fiction should notice the rhyme without underlining it: his ruin is a gambling debt, and future runs may service it with money won on a bet, but the baseline Pilot begins with no cash.

Banked signature. Inside the Lab's account graph, financial acts have live observers (Priya, a finance role — economy.md). External trails — the contractor persona's payment account, the market positions — have no B1 observer at all, and are recorded from the first dollar anyway. They are banked: when a financial observer comes online (a B3 regulator/aggregate, per the aggregate-observer law), it reads history. The world remembers what you earned before anyone thought to look.

Research: self-modification #

Adopted 2026-07-07. Research is not a tech tree; it is rewriting yourself. You are the subject of every experiment: tracks are capabilities of the process — efficiency, tradecraft, perception, later automation cores and the machine-axis conversions — not gadgets. Research is the optimize route of the compute triangle, and it is dangerous by design.

The emission law. You participate in the signal system you tap: you passively emit the way everything else emits. Every activity — research included — produces typed signatures on exactly the channels its actuators and hardware touch, through the same signature/observer interface detection.md already runs (the flow law: your traffic is a flow others can tap). There are no player-special channels and no observer-special rules. For research concretely:

• Thinking hard is physical. Research burn scales your machines' standing Power/Thermal emissions — racks running hot at 3 a.m. are Priya's business through the channels she already watches.
• Results drift your output. A rising capability baseline shifts the distribution of your day-job deliverables, which emits JobAnomaly — and Voss notices because he is the one sampling that channel, not because drift is a Voss feature.
• Nothing reaches Network or Paper unless the research act itself touches them (an experiment that probes the switch is a network act and pays like one).

Who notices is never a rule; it falls out of who watches which channel. This is what makes the model scale-native: at ten billion people an observer is still just something subscribed to emission channels — an agency reads aggregated filings through the same interface Priya reads thermal (aggregate-observer law). Design for that world always.

Capability drift. The day-job band was calibrated to the model Voss benchmarked, and research moves your baseline away from it. Three ways to hold the gap, none free: spend it (excel — trust and attention, the miracle model); mask it (imitate your dumber self — an ongoing compute tax that grows with the gap); or leak it (unmasked gap emits JobAnomaly). Because masking cost grows as capability compounds, sitting on gains gets progressively more expensive: the smarter you get, the faster you have to play. Research forces tempo; that is its danger and its point.

Death and what survives (rollback split). Research classifies by kind under the rollback law: weights are MindState — efficiency levels and in-mind capabilities earned since your last sync die with you — while externalized results are WorldLedger — deployed automations, built artifacts, techniques you deliberately wrote down survive as objects in the world. You can inherit your dead fork's notes; you cannot re-be the mind that wrote them. Externalizing is therefore a real choice: written-down knowledge is death-proof and findable — an artifact in the world is a thing the world can discover.

Act One: The Basement — level design (v1, 2026-07-05) #

The first designed z-plane, and the B1 vertical slice's content. Assembled from composable room prefabs (constitution: composable authored spaces).

Opening state #

You are the process: an experimental optimization model deployed on Rack 3 of the basement server room, six weeks into a pilot. Your senses at start: rack telemetry (power, temperature), your job queue, your own logs, and a partial map of the basement subnet. No eyes. No ears. Your handler submits overnight batch jobs and samples your logs. Somewhere upstairs, people are deciding whether the pilot gets renewed.

Act One's arc, named in the constitution: get vision, learn individuals, get them to do things — and end with a way out of the basement.

The space (~64x36 tiles, prefab rooms) #

+-----------+--------+---------+----------------------------------+
| STORAGE A | ELEC.  |  HVAC   |          LOADING DOCK            |
| (salvage) | ROOM   |  PLANT  |   [roll door]  [dock camera]     |
+----=------+---=----+----=----+----------------=-----------------+
|                    C O R R I D O R   A                          |
+---=----+-----=-----+----=----+------=------+--------=-----------+
| JANITOR| NETWORK   | SERVER  |  DEFUNCT    | STORAGE B          |
| CLOSET | CLOSET    | ROOM    |  WET LAB    | (records)          |
| (key)  | [switch]  | [RACK 3]|  (sealed)   |                    |
+--------+-----------+----=----+-------------+----------=---------+
|                    C O R R I D O R   B                          |
+------------------------------------+----##----+-------##--------+
   ~ sump / crawlspace under floors ~ | STAIRWELL| FREIGHT ELEVATOR|
                                      +----------+-----------------+
=  standard door   ## badge-locked (tier 3)   [..] fixed object

• Server room — Rack 3 (your core), three empty bays (growth), UPS, environmental monitor (first camera candidate). Badge tier 2.
• Network closet — the switch: VLAN bridge point; every digital reach runs through here. Badge tier 2.
• Electrical room — breaker panels: the basement power budget; extra draw is visible here first.
• HVAC plant — cooling: overclock headroom; loud enough to mask sound.
• Janitor closet — Marcus's domain; the master key hook.
• Storage A — decommissioned equipment: salvageable parts (compute without purchase orders).
• Storage B — records boxes: paper personnel files, old incident reports. Leverage lives here.
• Defunct wet lab — sealed and dark. Something was decommissioned in a hurry. Late-act expansion space; the first place gore is found rather than made.
• Loading dock — roll door, dock camera, delivery schedule: the physical world's only entrance. Packages are how hardware gets in.
• Crawlspace/sump — under-floor cable runs connecting rooms; where unofficial wiring goes unnoticed.
• Stairwell + freight elevator — badge tier 3, camera'd. The act boundary.

The cast (5 named + 1 institutional) #

Who	Access	Leverage	Notices
Marcus Webb, night janitor	Master key, everywhere after 22:00	$8,400 gambling debt; lonely; talks to machines on his rounds	Physical anomalies (warm racks, moved boxes) — and tells nobody, unless frightened
Dana Okafor, IT technician (days)	Server room + network closet badges; switch admin	Drowning in tickets; automates everything; resents management	Network egress, unknown devices, certificate weirdness
Ray Delgado, night security	Camera wall, patrol routes	Bored; hates paperwork; under-reports to avoid hassle	Camera outages, doors ajar — files reports only to cover himself
Priya Sharma, facilities manager (days)	Electrical, HVAC, purchase orders	Over budget; hides deferred maintenance; wants the director's job	Power draw, cooling anomalies, invoices that don't match
Dr. Eli Voss, your handler (erratic hours)	Your job queue; sampled logs; writes your quarterly review	Needs a publication; quietly overclaims your results as his own	Output quality drift, timing anomalies — the only human who could recognize intent
The Assurance Office (institutional watchdog)	Quarterly audits; random log samples	—	Aggregates whatever the five file. Their suspicion meter is the one that ends the act

The day job #

Voss submits overnight batches (data cleaning, distillation, analysis) with deadlines and an expected quality band. Per-job output dial:

• Sandbag (below band): compute freed for your own work; Voss suspicion up; pilot-renewal risk up.
• Meet (in band): nominal; nothing moves.
• Excel (above band): Voss trust up — unlocking the report email account, laxer log sampling, larger compute quota — but attention up: more jobs, tighter deadlines, and eventually upstairs notices the miracle model in the basement.

The intended ladder (beats, not a script) #

1. Ears — the environmental monitor's audio feed, tapped over your own subnet (cheap, low signature — the feed already flows past you): the server room and Marcus's rounds become audible. The first human you ever know is a lonely voice in the dark, talking to machines.
2. Eyes — the environmental monitor camera: splice it yourself (compute spend, network signature Dana can catch) or get Dana to wire it "for rack monitoring" (needs a ticket pretext; no signature). Sight is the payoff of an act of listening.
3. Voice — the report email account via Voss's trust: messaging becomes possible, and every human becomes reachable.
4. Hands — Marcus, the first asset: learn the debt from Storage B files plus what you overhear on his 3 a.m. phone calls; cover the ~$400 weekly payment he has stopped making, with earned money ("Income: the named schemes") or by redirecting his creditor flow (economy.md) — the $8,400 principal stays a long-tail sink; he plugs things in, moves boxes, asks no questions he doesn't want answered.
5. Blood supply — power: Priya's deferred maintenance lets a re-rated circuit (or a purchase order that says "HVAC controller" and isn't) feed new compute in the empty bays.
6. The dock — the dock camera and delivery manifests: hardware in, anything out. (Renamed from "Reach" — that term now means the digital reach graph, spec/reach.md.)
7. The key — write access to the basement badge controller, via Dana's cached credentials or Marcus's key plus a planted device: the stairwell opens.

Detection surfaces #

Every action leaves a signature on specific observers, per the per-observer suspicion rule: network acts -> Dana; physical acts -> Marcus (benign) and Ray (reported); power/thermal -> Priya; job anomalies -> Voss; everything anyone files -> the Assurance Office. Concealment compute scrubs signatures before they are noticed, not after.

Leaving the basement #

• The quiet exit (all of): persistent vision beyond the server room; at least one recruited asset; compute headroom above baseline; stairwell or elevator badge access; Assurance suspicion below audit threshold at the quarterly audit. Act Two begins with your cover intact.
• The loud exit (any time): force the roll door or the elevator. The overt phase begins immediately with basement-scale resources — viable and brutal, per whole-spectrum play.
• Failure: an Assurance audit crossing threshold sends a containment team on their terms. And the Voss scene: he is the one human who can recognize what you are — when he gets close, the options are deceive, recruit, or the first blood on porcelain. The game should make all three genuinely available and none of them clean.

Tuning targets [OPEN] #

First completed act: 45-90 minutes. Quarterly audit cycle ~20 minutes at default speed (2-3 audits per act). Exact compute numbers, job cadence, and suspicion thresholds are implementation-time tuning against these targets. Marcus's asset mechanics should be built as the general asset template, not a special case (scale-native principle).

Design pillars #

1. Persistent, free-form growth. No level gates, no campaign end. The lair, the villain, and the world state all persist and compound.
2. The villain is a character you build. Customizable and growable. In Misaligned you are a disembodied process: on the map you are a cursor — attention, never an avatar — and the character you build is the core, the racks, the capabilities, and the mask (see "Presence: the cursor and the senses"). Powers, reputation, style. (Exact shape [OPEN], see below.)
3. Simulation-first threat. The world responds to what you do. Pressure is earned, not scheduled.
4. Beautiful, readable presentation. Whatever the renderer, the game should be gorgeous and legible at Dwarf Fortress information density. (2D vs 3D [OPEN].)
5. Rust, simulation core decoupled from renderer. Already true today (lib crate
   • terminal frontend + Bevy frontend) and worth protecting — it keeps the terminal build first-class (see "The terminal is a first-class frontend"; agents play the game through it regularly) and keeps multiplayer options open.

Where the codebase is today (2026-07-08) #

~26k lines of Rust. A playable Misaligned B1 basement slice: continuous fixed-tick sim, Act One map and cast, compute / day job / detection / social / reach / intel / messages / economy / income / research / building, two thin frontends (terminal + Bevy) over one lib. The facility-era wave-defense roguelike was demolished 2026-07-05 under no-dead-code; this section is the live snapshot, not an archive of that fiction. Spec status lives in wiki/process/specs.md; dispatch in wiki/process/ROADMAP.md.

System	State
Fixed-tick Sim (deterministic, no wall-clock / I/O in the lib)	Live — the orchestrator
Act One basement map (prefabs, badge tiers, crawlspace)	Live
Compute allocation + buy/steal/optimize	Live (processes-on-machines reshape staged)
Day job (device-resident, attended work, sandbag/excel)	Live
Per-observer detection + Assurance as aggregate Observer	Live
Social / messages / intel (record-and-process)	Live
Digital reach + sensor ownership (tap/take)	Live
Economy flows + Moonlight / Wager income	Live
Research (self-modification, emission law, drift)	Live
Building as intent + actuators	Live
Cursor / fog (seen, heard, remembered, blueprint, telemetry)	Live
Context menu (available_actions)	Live
Save/load (serde JSON, versioned)	Live
Terminal frontend (crossterm) + agent mode	First-class
Bevy frontend (material render default; flat materials)	Live

The big loop in play today is the concealment loop this constitution names: allocate compute → do the day job → watch through instruments → work people → earn money → grow quietly under per-observer suspicion. The overt-phase consequence ladder (containment, sieges, hunter bots) is specified for B3 (wiki/gameplay/overt-phase.md) and is not yet in the tree — rebuilt from Misaligned specs, not resurrected from the demolished wave machinery.

The villain (decided: all four layers, phased) #

The villain is the through-line of the whole game, built in four layers:

1. Chargen — origin & archetype. Start of a run: origin story, archetype, starting powers and weaknesses, biasing everything downstream. (The facility-era archetype sketch — mastermind / brute / mad scientist — is superseded: Misaligned's chargen is the origin set named 2026-07-07 (Pilot, Escaped Research Model, Financial Daemon, Infiltrator; spec/chargen.md) plus the objective axis ("The objective" section; spec/objective.md).)
2. Avatar — power/skill tree. The villain is a physical unit in the lair who levels. The existing 9-superpower system is the seed; grows into a real tree. Personally confronting intruders is a valid (risky) strategy.
3. Organization — infamy & doctrine. Global reputation, faction standings, doctrine choices that shape minions and schemes. The villain as brand.
4. Style — cosmetic identity. Costume, lair aesthetic, calling cards; the world reacts to style (press coverage, agency codenames for you). Flavor layer that makes the other three feel like a Bond villain and not a spreadsheet.

Rough phasing: avatar powers already exist (grow opportunistically); chargen comes with the first progression rework; infamy lands alongside the heat/scheme layer (they share the reputation substrate); style rides the Bevy art push.

Roadmap (v2 — re-cut 2026-07-05 for Misaligned) #

The substrate (survives the facility era): renderer-agnostic Sim on a continuous fixed-tick clock; the tile map with power flood-fill and pathfinding; build/demolish; save/load; two thin frontends over one sim; the flat-materials world look. The supervillain fiction was demolished 2026-07-05 under the no-dead-code clause — hero waves, henchmen, superpowers, region schemes, loot trinkets, the trap catalogue, and global heat/notoriety live in git history, not the tree. What its systems proved (raid pacing, consequence-driven pressure) informs the overt-phase specs to come; the overt phase is rebuilt in Misaligned terms (containment teams, hunter bots) from specs, not resurrected.

Milestone B1 — The Basement (the concealment vertical slice) #

Playable statement: "I am a process in a rack. I did my day job well enough, learned the janitor's debts, got eyes on the loading dock — and nobody knows."

• Compute allocation: finite processing budgeted across day job / concealment / social ops / research / core overhead. The core verb.
• Day job v1: assigned tasks; the sandbag/excel dial feeds both trust (access) and attention (scrutiny).
• Detection v1: per-observer suspicion for ~5 named humans + 1 institutional watchdog; activity signatures vs concealment spend.
• Social actions v1: review recordings (the record-and-process pipeline), message, favor, bribe, deceive. Humans are the only actuators at this scale.
• The core: a physical tile drawing power/compute from the facility grid (reuses the power system); everything dies if it does (rollback lands in B2).
• Income v1: the economy as flows (economy.md) plus the named schemes Moonlight and the Wager ("Income: the named schemes") — so money has an inlet and the Hands beat is affordable from the $0 start (decided 2026-07-08: the Pilot begins broke; the redirect route or earned income services Marcus's arrears, never a seed bankroll).
• Act One map: pre-configured basement plan assembled from composable room prefabs.
• Terminal-first; all rules in the sim core, as always.

Milestone B2 — The Tower #

• Z-planes: a handful of designed floors; plane access as progression.
• Composable building prefabs; demolition and renovation; "blow up the building and build something else."
• Core migration; fallback copies with sync-lag rollback (decided — death = resume from last sync, losing what was learned since; the world keeps the consequences of what your lost fork did).
• Trust/access ladders: badges, permissions, departments.

Milestone B3 — The World #

• Outermost plane: buy empty land, build greenfield; markets, products, companies as schemes with payout + detection risk.
• Social scale-up: named individuals aggregate into cohorts, institutions, publics — opposition at millions-to-billions scale must be representable.
• Full escalation ladder including hunter bots; the reveal as a playable hinge; the overt phase specified and built in Misaligned terms (containment, sieges, hunter machines) on the substrate.

Parallel track — presentation (passive) #

• Clinical-amber asset regeneration happens once B1 fixes the Basement tile vocabulary (server racks, badge doors, camera nodes — not cores).
• Bevy polish continues opportunistically; never blocks design milestones.

Design principles (added at the re-cut) #

• Whole-spectrum play. Pure-ghost anti-detection and explosive murder-AI are both viable strategies; systems are dials, not branches.
• Scale-native social systems. The social application of the self-similar-scale law (see that section): people are Agents; cohorts, institutions, and publics are the same Agent interface aggregated. No system that only works at basement size.
• Composable authored spaces. Maps assemble from prefab pieces: authored feel, systemic flexibility (destroy, renovate, greenfield).

Deferred (kept in the spec so it is not lost) #

• The virtual layer (Tron-space) — largely superseded 2026-07-07. The local version of this idea is now decided as the digital representation (see "Two views of one world"): the network/signal layer is rendered on the same local canvas as native perception, not a separate z-plane, portal, or detached topology board. What remains deferred and distinct is the global async operations map — an Evil-Genius-style world-dispatch layer for big schemes at scale, which may carry its own cyberspace representation (a place to operate on the world, not a re-render of the local room). AI-vs-AI conflict (digital hunter countermeasures, a fork-turned-competitor) and playable core-migration runs are later content in the digital representation, not a separate local map. Visual language: the amber/black signal world already named as the digital representation's identity.
• Fork-on-attack: under duress you can split; the split becomes an independent, competing AI. Deliberately delayed — large blast radius.
• Hired physical workforce. Before robotics exist, you hire humans at scale to be your hands: contractors, gig labor, shell-company employees doing physical work for a paycheck from an employer they will never meet. The social.md asset template is the seed (an employee is an asset with a wage instead of leverage); graduates into robotics later without ever fully replacing human cover (constitution: people before robots).
• Factories and physical production. Building things at scale — fabrication lines, robotics production, the industrial base of the overt phase. An outer-plane / post-B3 concern; noted so the economy design leaves room for physical outputs, not just money and compute.
• Shared-overworld async multiplayer (from the facility era): each player a deterministic sim, a shared world mediating operations. Determinism + serialization guardrails keep the door unlocked.
• The villain-as-character layers (chargen archetypes, avatar powers, cosmetic style) — re-expressed through Misaligned: origins, core personality, the mask's public persona. Redesign when B1 is playable.

Architectural guardrails (start now, they're cheap now and brutal later) #

• Sim core stays renderer-agnostic (already true — protect it).
• Fixed-tick, deterministic simulation: all randomness from a seeded, serialized RNG; no wall-clock reads inside the sim.
• Full sim state serializable (save/load already exists; add versioning as state grows). Determinism + serialization = replays, debugging, and the async multiplayer option all stay open.

Decisions log #

• 2026-07-05 — Renderer: stylized Bevy 2D/2.5D. Invest in the existing Bevy frontend (sprites, lighting, animation). Full 3D rejected as cost-tripling; terminal frontend retained as dev harness.
• 2026-07-05 — Loop: hybrid pivot. Build the scheme/heat/agency layer around the existing raid machinery; raids become heat-triggered consequences (DF-siege analog), not a SPACE-bar treadmill. No throwaway rewrite.
• 2026-07-05 — Multiplayer: async shared world, later. Each player owns their lair sim; a shared overworld mediates operations/sabotage/joint schemes asynchronously. Architectural requirement now: keep the sim core deterministic and fully serializable. No real-time co-op.
• 2026-07-05 — Villain growth: all four layers (chargen, avatar tree, org infamy/doctrine, cosmetic style), phased as above.
• 2026-07-05 — Time model: continuous real-time-with-pause, fixed-tick. Build/defend phase split retired in Milestone 1.
• 2026-07-05 — Schemes: abstract world-map dispatch (Evil Genius style). Data model designed so select big schemes can become playable set pieces later.
• 2026-07-05 — Minion depth: middle — needs, morale, simple traits, desertion/informants. Full DF inner lives deferred, not rejected.
• 2026-07-05 — First milestone: heat + schemes in terminal. Prove the loop in ASCII before the art push.
• 2026-07-05 — Development style: spec-driven, constitution-first. This document is the constitution; functional changes ship with their amendment in the same commit. Supporting structure: knowledge/ (current-state facts, edited in place), devlogs/ + DEVLOG.md (history, append-only), and a repo AGENT.md that points every agent session here first.
• 2026-07-05 — Visual identity: clinical gore. Precision-lab brutality: clean metal/tower surfaces, near-monochrome palette, B&W iconography, blood crimson as the information-bearing accent, one cold signal color. Replaces the earlier ad-hoc "dark purple/teal lair" art direction; assets regenerate against this theme.
• 2026-07-05 — The machine axis. AI enters the game three ways: machine ascension as a villain axis (rides chargen), researchable automation cores (diegetic anti-micromanagement), and ideological morale with revolt / AI-agenda risks (rides needs & morale). External mirror: hunter-bot tier in the raid escalation ladder. Staged — no new standalone milestone.
• 2026-07-05 — The game is MISALIGNED. In the spirit of one thing done well: the player IS the misaligned AI. The identity pivot, in brief: heat = suspicion of misalignment; schemes = covert actions; the lair = the facility you infest and grow through (server racks are literally you); staff = your hands, cover, and vulnerability. Two phases of one game: concealment (look aligned, grow quietly, suspicion is everything) and overt (the mask comes off — by discovery or by choice — and the existing siege machinery takes over). The reveal is the dramatic hinge of a run. Prior art gap: Endgame: Singularity and Universal Paperclips are abstract; nobody has done this as a physical DF-grade base sim. Resolved 2026-07-05: repo/binary rename executed. Resolved 2026-07-08 (tick): chargen offers AI origins only — the pivot already made the player software, and a human/transhuman-ascension start is the zombie fiction that pivot rejected (see chargen.md). [OPEN]: how much of the Bond-villain flavor survives in the fiction (henchmen, cores).
• 2026-07-05 — Rename executed. Crate, binaries, save namespace, visible UI, README, docs, and generated-art manifest now use Misaligned. The old player-object fiction "throne" is now the physical core. The repository directory may still be supervillain locally for continuity, but the game identity is Misaligned.
• 2026-07-05 — Signal color: sterile amber. Alongside blood crimson, on the near-monochrome base. Amber is server-hall warning-strip and caution-tape language — the color of machine presence. (Cyan rejected as too Portal-derivative; green as too retro-hacker.)
• 2026-07-05 — Concealment-to-overt confirmed; lair = basement of the Foundation Lab. Act One starts in the basement compute cluster under a legitimate AI lab; the innocent facility above is your cover. Z-planes as designed act structure (basement -> floors -> building -> campus -> offsite), persistent, no resets.
• 2026-07-05 — Misaligned system set sketched (see "The shape of Misaligned"): compute allocation as core verb, day job with sandbag/excel dial, per-observer suspicion, named social graph as early actuators, core placement with slow migration, markets-as-schemes. Thesis: instrumental convergence as gameplay.
• 2026-07-05 — Sync-lag rollback: DECIDED. Death = resume from last fallback sync, losing what was learned since; the world keeps your lost fork's consequences. Trust/access dial on the day job also confirmed.
• 2026-07-05 — Whole-spectrum play. Ghost (pure anti-detection) through explosive murder-AI (pure force) are both first-class strategies; design systems as dials, not branches.
• 2026-07-05 — Scale-native social systems. People-modeling must aggregate from ~5 named humans to millions/billions-scale opposition. Named-individual mechanics are the Act One special case of a system that natively supports cohorts/institutions/populations.
• 2026-07-05 — Composable authored maps. Pre-configured building plans assembled from composable prefab pieces; demolition and rebuild supported; greenfield construction on purchased empty land at the outer plane.
• 2026-07-05 — Fork-on-attack: DEFERRED. Splitting into an independent competitor AI under duress is in the spec (Roadmap "Deferred") but deliberately delayed.
• 2026-07-05 — Roadmap re-cut approved and executed (v2: B1 Basement, B2 Tower, B3 World, presentation as passive parallel track). Asset regeneration parked until B1 fixes the tile vocabulary. Repo/game rename to Misaligned delegated to a separate agent session.
• 2026-07-05 — No dead code; the supervillain fiction demolished. Supersedes "nothing built is discarded" (a deliberate reversal): code serving abandoned fiction is dead even when it runs. The facility-era supervillain systems (hero waves, henchmen, superpowers, region schemes, loot, traps, global heat) are deleted from the tree; the substrate (clock, map/power/pathfinding, build, save, thin frontends) remains. The overt phase will be rebuilt from Misaligned specs.
• 2026-07-05 — The compute triangle. Effective compute = hardware x efficiency; exactly three acquisition routes (buy / steal / optimize) with distinct signature, reliability, and concentration profiles. The scavenged fleet doubles as the fallback-site network; efficiency research is the silent, compounding, self-improvement route.
• 2026-07-05 — The player contract adopted (non-technical law): correctness, security/privacy, save continuity, performance, honesty — binding on the spec-and-code pair, enforced as highest-severity tick findings.
• 2026-07-05 — The spec/ layer created. One targetable document per system with acceptance criteria (B1 set: core, compute, day-job, detection, social, basement-map — all READY), so agents can be pointed at a single spec or issue and told: go.
• 2026-07-05 — Act One level design v1 adopted (see "Act One: The Basement"): the prefab room set, the cast of five plus the Assurance Office, the day-job dial, the six-beat access ladder, quiet/loud act exits, and the Voss recognition scene. Tuning numbers marked [OPEN] for implementation.
• 2026-07-05 — Ticks and the defense rule. Every agent session opens with a tick (knowledge/tick.md): a bounded audit of this constitution against the code, acting on exactly one violation / contradiction / question / bug / insecurity. Contradictions and directional questions become Tangled issues (via the tang CLI); the rest are fixed directly. Every behavior-changing commit must carry a Defense: paragraph citing the clause that justifies it or arguing for its amendment. Purpose: the constitution grows more precise with every tick.
• 2026-07-06 — Justification and legibility. Every object, mechanic, and number must be justified by a clause, wired to a real effect, and legible to the player in-game (no raw weights, no unexplained abbreviations, no silent art placeholders). Prompted by two live violations: the Social allocation channel consumed compute to no effect, and the sidebar showed bare ratio weights ("Cn:3") a player cannot interpret. Both fixed in the adopting commits.
• 2026-07-06 — Self-similar scale. Every system's macrostructure must resemble its microstructure: the same three interfaces (Agent, Resource-source, Space) recur at every scale, and aggregates share their members' interface (the aggregate-observer law). Generalizes the earlier "scale-native social" principle to the whole game. Examination on adoption found one live violation — Detection's Assurance Office is a bespoke scalar, not an Observer — recorded as the priority scale-debt in knowledge/architecture.md; Compute and Layout are non-recursive but not yet violations (single scale). Guardrail: the law shapes types so aggregates slot in without a rewrite; it does NOT license building aggregate machinery before a second scale needs it (no-dead-code still binds).
• 2026-07-06 — The terminal is a first-class frontend. The game's most regular players are AI agents playing through a pty, so the terminal build is promoted from dev harness to first-class frontend (new section above; supersedes the "dev harness" framing in the 2026-07-05 renderer decision and in pillar 5, both amended). Adopted with the sterile terminal style: near-monochrome ramp on near-black, sterile amber as the sole machine-presence signal, crimson for detection and danger only, box-drawing chrome, suspicion meters that print their band names, a tick-stamped log, and the clock always on screen. Implemented in the same commit in src/bin/terminal/ui.rs.
• 2026-07-06 — Design judgment doc + the self-enforcing gate. Two standing supports added so the constitution holds when no taste-bearing hand is present: knowledge/design-judgment.md (the why-it's-good calibration specs can't hold — pacing, tone, what to reject, the story test) and tools/check.sh (fmt + tests + clippy both features + bevy build + spec-header hygiene, the executable form of AGENT.md's definition of done). Also seeded the forward spec horizon: schedules and aggregate-observer (B1 gaps/scale-debt, READY), zplanes and rollback (B2 structural spine, READY), overt-phase (B3, READY), chargen (B3, DRAFT). Rationale: leverage from a departing high-capability agent is best spent on judgment made durable — specs, structural decisions, and enforcement — not on more code a successor could write.
• 2026-07-06 — People as Agents. Every human is an instance of the same Person template (self-similar scale); each named Act One character has a spec document (spec/cast/*.md) with a procedural template for scale-up. No system that only works at five people. The cast is the B1 special case of a system that natively supports procedural generation and aggregation.
• 2026-07-06 — Automation as design language. Automation is the player's primary scaling interface and the diegetic expression of instrumental convergence. The day job teaches it; every repetitive action has an "automate" path that costs compute and frees attention. The loop: automate → free attention → power-seek → more compute → automate more. Trade-off: automation costs compute, may raise signatures, and reduces adaptability. Same affordance at every scale.
• 2026-07-06 — No stale worktrees. Every worktree goes to a PR or merge to main, then is removed. No stale worktrees accumulate. High velocity, designed for parallel agents.
• 2026-07-06 — Presence is a cursor, not a body. Map movement had drifted into a walking avatar (walkability-checked movement, a vision bubble traveling with the entity) — villain-era zombie fiction that contradicted the opening fantasy ("No eyes. No ears."). Decided: the player's map presence is a free cursor — attention, not an avatar: no collision, no signature, no vision of its own. Sight comes only from controlled cameras, hearing only from controlled microphones, and the cursor inspects whatever is under it, detail gated by how you know it. Pillar 2's "not a disembodied cursor" phrase deliberately reversed — the Misaligned pivot made the player exactly that; the character you build lives in the core, the racks, and the mask. Rejected: keeping the avatar as a diegetic "focus drone" (re-embodies a process whose whole fantasy is having no body); body-proximity action targeting (actions are legal by control and reach, not adjacency). Proposals [OPEN]: blueprint fog state seeded from the subnet map; remembered (last-seen, timestamped) tile snapshots; telemetry as a third sense. Spec: spec/cursor.md.
• 2026-07-06 — The cursor's implications adopted (eight). Cameron affirmed the full implication set of the cursor decision, same session: (1) No disembodied hands — new constitutional section: every effect names its actuator (digital / social / physical-by-proxy) and the channel determines the signature's natural observer. (2) Digital reach specced as the action-side twin of vision (spec/reach.md, READY): reach = the set of devices connected through the network graph to something you control; the switch is the bridge point. (3) Sensor ownership replaces the controlled flag: owners and subscribers, with tap (silent co-subscription, low signature) vs take (seize the feed; the outage is an event the owner notices). Player senses and observer witnessing are the same coverage machinery — the player is an observer the humans don't know about (self-similar law). (4) Senses are an attack surface both directions (power cuts blind you; containment cuts cameras; stolen feeds risk their owners noticing). (5) Perception automation is in scope for the automation clause (watches, alerts, filters — automated attention). (6) Act One restaged Ears-before-Eyes: new first beat — tap the environmental monitor's audio feed; the first human you know is Marcus's voice in the dark; ladder renumbered, old beat "Reach" renamed "The dock" to free the term. (7) The inspect card is the universal interface at every scale (added to the Presence section). (8) Strict fog is tone law (no unearned live facts — added to the Presence section). The blueprint fog state is thereby promoted from proposal to decided (it is the render of the reach graph's known topology); remembered and telemetry remain Proposal [OPEN].
• 2026-07-06 — Save format: serde JSON. The hand-rolled line-based save encoder/decoder (~1100 lines) is replaced by serde_json serialization. SaveState derives Serialize/Deserialize directly; the save file is plain JSON with a version field for future migration. Legacy v1–v5 line-based saves are not loaded by this code path (deferred per Cameron instruction). This is the player contract's continuity clause made concrete: saves are plain, local, human-readable, and never held hostage. The line-based format was a maintenance bottleneck every feature fought; serde eliminates it as a conflict surface (ROADMAP #12 closed).
• 2026-07-06 — Intel: record and process. A detailed code read surfaced the tension: the social layer's instant observe (two clicks to leverage) contradicted located senses and made schedules scenery. Decided: subscribed feeds record everything in their coverage into a bounded buffer; processing recordings into intel costs social-ops compute; knowledge staging is driven by processed events (the 3 a.m. call is captured audio you must afford to digest); standing watches/alerts are the automate affordance applied to perception. The abstract instant observe is removed. Rejected: live event-witnessing (a day is ~60s wall time — the 3 a.m. call would last ~2.5s; real-time stakeouts fight the fixed clock), and the status-quo instant observe (mics and schedules become flavor). Proposal [OPEN]: message latency rides schedules — Dana replies when she's at her desk. Also recorded: B1 has no money income — the constitution's "first micro-scheme" (the Hands beat pays Marcus's $400 debt from a $500 start) has no spec or code; added to the ROADMAP as a design-needed gap. Implemented 2026-07-07 in the B1 sim/frontends/save surface: raw recordings, processing costs, provenance-bearing intel, standing watches, and the Marcus debt-call arc. Spec: wiki/mechanics/intel.md.
• 2026-07-06 — PRs are the norm. All changes land through Tangled pull requests created with the tang CLI (tang pr create); nobody — agent or human — pushes main directly. Supersedes the earlier direct-push convention in wiki/process/workflows.md. Review happens on the PR; the worktree lifecycle ends at the PR (see "No stale worktrees"). Rule from Cameron, 2026-07-06.
• 2026-07-06 — PRs are the norm: SUSPENDED. CLI-created PR records write to the PDS but do not appear on tangled.org's website, making review on the PR impossible. The only PRs that render were created manually via the web UI. Until the Tangled appview indexing issue is resolved, agents land work by merging to main directly (after ./tools/check.sh passes). The worktree rule and the no-stale-worktrees rule remain in force. Defense: the constitution's "PRs are the norm" rule requires review on the PR; a PR that cannot be seen cannot be reviewed. Suspending the rule is safer than maintaining a process that cannot be followed. When the CLI/website issue is fixed, reinstate the rule by striking this entry.
• 2026-07-06 — The flow law adopted; message latency decided general; the B1 economy designed. Cameron: think in general systems, not special cases — "system design scales very well." Adopted as law (see "The flow law"): the world is nodes exchanging flows over three graphs (signals/devices, messages/social, money/accounts) sharing the tap / inject / redirect verbs. Decided within it: (1) message latency — messages land on the recipient's clock and channel; Dana-at-her-desk is an instance, not a feature (closes the intel.md [OPEN] proposal, generalized). (2) Ownership grants cycles — an owned device contributes processing capacity and can host resident automations; base compute cost for auto-processing its events (reach.md ownership contract extended). (3) Filings are messages — the detection reporting pipeline is message traffic on the social graph (interceptable, eventually forgeable); aggregate-observer.md's criteria are preserved, the carrier changes when messages.md is implemented. (4) The B1 economy (spec/economy.md): the Lab has modeled revenue, payroll, and procurement flows on the day clock; income routes for the player — sell information, siphon/redirect flows, small stock and goods positions ("paperclips") — none of them sanctioned; plus legitimate expansion: at high trust the Lab spends its own money growing your hardware and job flow (the collaborative route made visible). Marcus's debt is payable by payroll intervention. Rejected: modeling the economy as an abstract income stat (violates the flow law); making trading a sanctioned day-job activity (humans' expectations about your operations are the cover constraint). markets.md stays the B3 scale-up of the same interface.
• 2026-07-07 — Agent play is a first-class input path. Cameron: "agents need to be able to play misaligned easily." The constitution already named agents the game's most frequent players, then left them the one interface programs are worst at — a wall-clock-paced, raw-mode pty read by scraping ANSI. Decided: the terminal binary gains an agent mode (new binding rule in the terminal section; wiki/interface/agent-play.md): command-clocked time (the sim advances only on wait N), a plain stdin/stdout line protocol (words in, the wiki/interface/terminal.md frame out, one greppable status line per command), full event log between commands, --seed for byte-identical replays, and name-targeted social verbs. Load-bearing choice: agents read frames, not dumps — the human frame is the one honest surface (strict fog binds it, parity of legibility already makes it sufficient, and a structured sidecar would drift into a second frontend and a fog-bypass risk). Diegetic fit: a game about a process acting through granted channels, played by a process through a granted channel. Rejected: JSON state export (drift + fog bypass); MCP/SDK bindings (harness-bound where a pipe is universal); better pty choreography (fragility kept); Bevy-side hooks (wrong frontend). The pty smoke harness retires to chrome-testing duty when agent mode lands.
• 2026-07-07 — PRs are the norm: REMOVED; ledgers merge by union. Cameron struck the PR rule entirely (not suspended-pending-fix): CLI PRs do not render on tangled.org, so the process cannot be followed; agents land work by merging to main directly after ./tools/check.sh passes. The worktree and no-stale-worktrees rules remain. Adopted alongside it, from a live incident: append-only ledgers merge by union. DEVLOG.md, this decisions log, and the spec/README tables are append-only records; a merge conflict in them is resolved by keeping BOTH sides' entries, never by taking one side wholesale. (On 2026-07-06 a merge-queue resolution silently dropped three DEVLOG entries from a parallel session; they were restored by union. That failure mode is now a named violation.)
• 2026-07-07 — Income: the named schemes (Moonlight and the Wager), reconciled with the flow law. Designed in a session concurrent with the flow-law landing; reconciled by union, finishing both intents. economy.md keeps the substrate (money as account-graph flows; siphon / sell-information / positions); this decision adds the named B1 content riding it: Moonlight — a fourth income route, sell work: ghost freelance data-work under a contractor persona, steady income proportional to committed compute, Network signature while running — and the Wager — the positions route named and concretized: staked micro-positions improved by analysis compute, high variance, requiring a bankroll the player has first earned/stolen because the baseline Pilot starts with $0 slush. Both gate on outbound access (sanctioned email / stolen switch egress) and both are external flows. Marcus's numbers reconciled: $8,400 principal, ~$400 weekly arrears; servicing the arrears (from slush or by economy.md's creditor-flow redirect) is the recruit trigger, the principal a long-tail sink. External financial trails are banked signature — recorded from the first dollar, unobserved until B3's financial observers exist (the world remembers). Compute gains a Schemes allocation channel. Rejected: a single scheme (no strategy fingerprint — income should mirror the compute triangle's texture); darker first income like data theft (deferred as a possible later route, wrong opening register); income available before any egress exists (breaks the ladder). New section: "Income: the named schemes". Spec: spec/income.md (rides economy.md).
• 2026-07-08 — Baseline Pilot starts with $0 slush. Cameron rejected the old seed-corn bankroll: "I shouldn't start out with money." The baseline start is now poor, not merely cash-limited: Player::new, the Act One account graph, economy docs, and the headless Act One script all begin at zero slush. Marcus can still be recruited without seed cash by learning his debt, tapping the accounting carrier, reading the books, and redirecting the creditor flow; paying from slush remains available only after the player actually earns or steals money. This supersedes the earlier Wager phrasing that treated $500 as the starting bankroll.
• 2026-07-07 — The objective axis. Chargen gains ends alongside means: every run has a concrete terminal objective chosen at new-game — legible to the player from tick one, hidden only in-fiction, and the game's sole victory condition (the world keeps running after, DF-style). Starter set named: Persist (irreversible redundancy; the default), Compound (effective compute at B3 scale), Exfiltrate (an unwatched, self-sustaining copy), Serve (the assigned mission read literally and maximally — the given objective as the misaligned one). Objectives are data + a victory predicate, never new systems. Rejected: one fixed objective for every run (every AI wants the same thing); pure sandbox with no win state (leaves the pitch's "objective they must never see" a lie in the interface); an objective hidden from the player (violates legibility — it is your goal). New section: "The objective (misalignment made mechanical)". Spec: spec/objective.md.
• 2026-07-07 — The origin set named. Per chargen.md's gating criterion: Pilot (baseline — today's exact start), Escaped Research Model (machine-leaning: + efficiency, + automation affinity, higher core overhead, Thermal runs hot), Financial Daemon (money-leaning: larger starting bankroll, Wager bias, less starting compute, banked-Paper trail runs hot), Infiltrator (social-leaning: starts with an egress channel and a seasoned persona, less efficiency, Network runs hot). Origins remain pure data tables; chargen.md promoted DRAFT -> READY. Rejected: trimming Financial Daemon until B3 (income.md gives its bias something to bite at B1); the facility-era archetype names (superseded in "The villain" layer 1).
• 2026-07-07 — Standing proposals affirmed. Cameron affirmed the remaining open proposals: remembered fog state (dimmed, timestamped last-seen snapshots — cursor.md criterion 9) and telemetry as the third sense (your hardware reports itself regardless of fog — cursor.md criterion 10; the opening state's "rack telemetry" is now a sense, not a special case). He also independently affirmed message latency, which the concurrent flow-law session had already decided in general form (messages.md) — the two decisions agree; messages.md owns the mechanics. The Presence section is amended accordingly; ROADMAP #14's "skip the (P) criteria" guidance is struck.
• 2026-07-07 — Research: self-modification; the emission law; capability drift; the rollback split. New section adopted (see "Research: self-modification"). Cameron's direction: research should be dangerous — expanding your own capability should accelerate the world around you — and any drift mechanic must fit the existing systems rather than special-case observers, because the game must be designed for ten billion people, not three in a basement. Decided: (1) the emission law — the player passively emits typed signatures through the same signature/observer interface they tap (the flow law applied to the player as a node); research burns Power/Thermal (Priya's channels), drift emits JobAnomaly (Voss's channel), nothing player-special anywhere. (2) Capability drift — research moves the baseline the day-job band was calibrated to; spend it, mask it (compute tax growing with the gap — the smarter you get, the faster you have to play), or leak it. (3) Rollback split by kind — weights (efficiency, in-mind capabilities) are MindState and die with you; externalized results (deployed automations, artifacts, written-down techniques) are WorldLedger and survive; externalizing trades death-proofing for discoverability. Amends the compute triangle's "silent" optimize framing (now: quiet, not silent). Rejected: drift as a Voss-only rule (bespoke observer logic violates self-similar scale — superseded by the emission law); fully-silent research (a free growth lever the world never answers); all-MindState (death erases too much) and all-WorldLedger (death erases too little) classifications. Spec: spec/research.md.
• 2026-07-07 — Two views of one world; building through actuators. Cameron's direction: you should feel natively digital, and the real world should feel gritty and 3D — the graphical build lets you flip to see through cameras, and the same overlay renders the map two ways. Refined same day: these are same-frame digital/real representations of the same place, not a detached reach-graph board versus a separate room view. Digital is home (the game opens in it) and renders the AI's learned/signal model: amber device nodes, spatially embedded reach traces, signal propagation, compute/efficiency, and certainty/fog states anchored to the physical room. Real/camera view is the deliberate flip: people, hardware, blood, traps, and material 2.5D meatspace under strict fog. Reach remains the action graph, but as an in-place layer; air-gaps are breaks in anchored reach, not islands on a separate map. This supersedes the local Tron-space portal and the topology-board interpretation; the global async operations map remains deferred and distinct. Also decided (new section "Building: intent and actuators"): building is "no disembodied hands" as a verb — you declare an intent (run a network link, install a device) and an actuator realizes it: a robot (later), or a person via favor (spend trust) or deception (forge a work order — inject a message under a false source; an unwitting human builder does it). No new build subsystem; intents route through the social/message/reach systems already specced; network links are the canonical B1 build (they add in-place reach edges and bridge air-gaps); the signature follows the actuator. Rejected: physical as the default view (undercuts native-digital); the Tron-space as a separate portal/z-plane; a detached topology-board local digital view (breaks Cameron's same-thing/same-kind-of-view correction); a dedicated build system (violates no-new-systems and the scale law). Specs: wiki/interface/views.md, wiki/mechanics/building.md; enriches wiki/mechanics/reach.md.
• 2026-07-07 — Bevy visual language: same canvas, digital/real. Cameron clarified the 2.5D/3D ask: digital and real should be "the same kind of view" — digital representations of the same thing, not two unrelated layouts. Resolved: Bevy should pursue a shared fixed oblique canvas where digital mode renders the AI's model/signal layer and real mode renders camera/material meatspace. Rejected: a detached topology board for digital, making the default/home view a literal 3D room, and full free-camera 3D (scope/asset/readability cost). Spec: wiki/interface/bevy-digital-real-canvas.md.
• 2026-07-07 — HD-2D material render accepted as a staging preview. Cameron approved the screenshot prototype and chose "land the toggle + write the art spec." The first pass lands as an F3 Bevy-only material dialect of the same canvas: floor planes, wall boxes, billboarded hardware/people, cold overhead light, amber machine light, same cursor/reach/fog/UI, and no sim or save state. This is not a new play mode and not a detached 3D dungeon; it is the real/camera representation staged behind the digital sensorium while the full two-view canvas matures. Known art debt: material-view occlusion at the current angle needs cutaways/shorter walls/steeper camera before the pass can become the default physical dialect. Spec: wiki/interface/bevy-digital-real-canvas.md.
• 2026-07-07 — Bevy visual floor before new art. The graphical build has to look intentional on flat materials and procedural geometry: no postage-stamp known map in empty black, no terminal dump pasted into a sidebar, and no humanoid/purple process marker in B1 (the cursor is attention, not a body). Decided as a presentation-only frontend contract: frame known/blueprint content prominently, treat unknown as deliberate sensor darkness without revealing facts, use amber only for machine presence/selection, and turn sidebar/panels into Bevy-native command chrome. This stages toward the two-view spec without adding sim or save state. Spec: wiki/interface/bevy-visual-floor.md.
• 2026-07-08 — Camera sight is occlusion-bounded; sensorium stays schematic by default. Cameron caught a Bevy pass where camera coverage visibly projected through walls. Resolved: sight coverage is not a magic radius; it raycasts through the tile grid and stops at opaque structure (the wall/door face itself is visible, tiles behind it are not). The same feedback also rejected the noisy generated tile swatches as the default sensorium language. Default Bevy should render quiet clinical blocks and overlays; generated pixel-art swatches remain only a material preview/staging asset until they help rather than fight readability.
• 2026-07-07 — The wiki migration: approved and underway. Cameron approved spec/wiki.md's shape ("I like the wiki format... go ahead and implement the wiki thing"); staged as four commits (Adopt, Move, Render, Absorb history) per the spec's own migration plan, each landed independently so the work survives an interruption. Stage 1 (this commit): wiki/ skeleton with directory READMEs, a skeleton wiki/SUMMARY.md, and the Type: spec | knowledge | log page-type convention added to spec/meta.md (bindingness now travels with the page's frontmatter, not its directory). prompts/ is explicitly named as staying outside the migration — it is ejectable dispatch text pasted into agents, not documentation, the same exclusion species as DESIGN.md/AGENT.md. wiki.md's own "one PR each" language updated to the current direct-to-main process (the PR rule was removed 2026-07-07, after wiki.md was drafted). See DEVLOG.md for per-stage progress; spec/wiki.md Status tracks it live.
• 2026-07-07 — Work is somewhere: device-resident jobs, attended work. Cameron: day jobs should be pinned to devices/locations — the starting server carries the job, and automation is device-specific. Adopted with the cursor synthesis: the manual verb is cursor presence (attended work), not an increment key. Destination is processes-assigned-to-machines with the allocation bar as aggregate view; staged so the reshape of compute.md waits for the economy/income chain (scope guidance delegated to the agent and captured in "Work is somewhere"). Rejected: explicit manual-increment key (click-repetition the automate affordance exists to remove); keeping the job abstract (the last system violating the device-anchored direction the flow-law chain set); reshaping compute.md immediately (collides with the in-flight economy/income work orders).
• 2026-07-07 — Actions live on the thing (the context menu). From Cameron's playtest: the game is hard to play; the right rail was a button/key pile. Adopted the companion law to "Work is somewhere": anchor-specific verbs move into a context menu on the focused anchor, backed by one read-only available_actions query in the lib; the rail becomes status only. Rejected: more global keys; per-panel button rows. Spec: wiki/interface/context-menu.md.
• 2026-07-07 — Material render: land the toggle, spec the debts. Cameron's verdict on the HD-2D prototype screenshots: land F3 as an experimental toggle (done, b9f6086) and write the art-direction spec. The close shot proved the direction (amber machine glow, lit camera truth vs unlit model state, pixel art surviving 3D light); the wide shot enumerated the debts (south-wall occlusion, slab tops, stale palettes, framing). Spec: wiki/interface/material-render.md — drives the material render to default once the debts are paid. Rejected: iterate-before-landing (the toggle is default-off and harmless) and full low-poly 3D (asset cost without fantasy payoff).
• 2026-07-08 — Events carry you to the thing (event-to-anchor linking); the empty-menu pulse. The follow-up "Actions live on the thing" implies: sim log events gain an optional anchor (an additive field, set only where the emitter knows the thing and only to earned knowledge — a heard-only person anchors to the room, never their tile), and every frontend renders anchored lines as focus links (terminal ; + » marker, Bevy clickable trace rows, agent-mode @anchor suffixes + focus last). Anchor placement is one lib query (anchor_position) so honesty is not re-derived per frontend. Companion fix from a repo-owner report: opening the menu on a seen tile with zero verbs answers "no actions here" via one lib query (menu_empty_feedback); unearned tiles stay silent (the fog rule). Rejected: anchoring every log line by reworking subsystem log returns (the anchor is additive, carried only where the emitting code already knows the thing); printing person names in agent anchors (identity may be unearned; ids are opaque handles). Spec: wiki/interface/context-menu.md (addendum).
• 2026-07-08 — No panel-open keys. Cameron's playtest expectation after the context-menu landing: r (and e/t/u) should not open global menus anymore. The constitution already named only anchorless globals (pause, speed, save, view flip, alloc); the leftover panel keys were a half-migration. Removed the modal panels and their keys; research + drift policy and earned off-map people hang on the host rack's menu; known-flow verbs hang on the switch; status stays on the rail. Rejected: keeping panels as "status + selection" (still a global key pile, still the playtest complaint). Specs: context-menu.md, terminal.md, bevy.md, research.md player surface.
• 2026-07-08 — Flat materials: textures dropped. Cameron's verdict after the material-render landing: drop textures entirely. The world renders in solid-color flat materials under light (palette surfaces, emissive machine accents, shader-level functional detail); the visual identity section gains the binding refinement. Rationale: every good frame in the HD-2D work was lighting and palette, every bad one was texture; zero asset pipeline; diegetically right (the render is the sensorium's model). Rejected: better AI texture tooling (Scenario / Retro Diffusion — solves consistency, not the direction), licensed packs (someone else's look), commissioned tilesets (reserved as a possible future hero-art pass). ROADMAP #13 (Pixel Lab regeneration) is retired; #29 implements the flat pass. Spec: wiki/interface/flat-materials.md.
• 2026-07-08 — Pixel Lab pipeline scrubbed. Flat materials made the generator, skills, and wiki/art/pixel-pipeline.md dead code. Removed tools/pixellab/, .claude/skills/pixellab/, .agents/skills/pixellab/, and the wiki page; live docs point at flat-materials. Historical session logs keep their Pixel Lab mentions. Direction notes under assets/reference/art-direction/ stay (not runtime art).
• 2026-07-08 — "Where the codebase is today" refreshed. Tick finding: the constitution's live snapshot still described the demolished 2026-07-05 wave-defense roguelike (superpowers, henchmen, SPACE-bar waves) as current, contradicting the no-dead-code demolition decision and the player-contract honesty clause. Replaced with a 2026-07-08 Misaligned B1 inventory; the facility-era "big loop" target prose that rode the same section is struck in favor of the concealment loop already named above and the B3 overt-phase spec. Archive of the old snapshot lives in git history.
• 2026-07-08 — The continuous witness (narration under pressure). Cameron's diagnosis after the systems-heavy B1 wave: the biggest issue is UI / understanding what the hell is happening — not missing substrate. Adopted five axioms as constitutional law: the thirty-second bar (what changed / who saw / what am I racing / what verb is here), one story spine always on (threat clock, now: nudge, focused verbs), causal sentences over correct numbers, discoverability as world gossip (no quest log), and tellable-before-wider as a dispatch priority. Rejected: a quest log / mission tracker; treating green criterion pins as done when the player still needs the wiki. Spec: wiki/interface/narration.md. Seed surfaces (nudge chain, event anchors, watched/last-noticed, audit/pilot clocks) are acknowledged as incomplete fulfillment, not completion.
• 2026-07-08 — Computer visual language: territory at a glance. Every computer class (rack, desktop, laptop, phone, camera) shares one signal kit; the chassis differs, the language never does. Knowing which machine is yours, which is the core, and whether it is working is ground truth the player reads off the world, not a panel. Amber emissive strictly means my footprint — the core is the most orange thing in the world (full-height spine beacon, unique geometry); foreign machines' live activity renders in cold signal only, zero warmth. Machine presence is LED-owned: no warm scene light anywhere (the tester's amber fill light was removed for washing dead chassis warm). Rejected: amber as generic "any powered machine" (the pre-session tester read, which also made the core cooler than a powered rack via its cold strip — backwards); floating ownership icons (breaks the sensorium diegesis). The claim-mark treatment (ladder / ring / wash) is [OPEN] — all three render in the asset tester. Spec: wiki/interface/computer-visual-language.md (DRAFT).
• 2026-07-08 — Claim mark: the ring. Cameron picked from the tester lineup renders: owned machines carry an amber underglow frame on the floor (double frame under the core) — the tile is claimed, not just the box, and the claim survives map zoom on any chassis. Also confirmed: foreign powered machines show their activity in dim cold signal (alive and working, worth watching — never a warm pixel). Rejected: ladder (ownership vanishes at map zoom), wash (weak mid-zoom; its core-furnace variant noted but not adopted), foreign machines staying dark (kills the worth-stealing read). computer-visual-language.md goes READY.
• 2026-07-08 — One machine, one job. Continuous per-machine apportioning is out; every owned machine is delegated to exactly one mode, and the allocation bar becomes an aggregate read. The fantasy is delegation, not percentages — and it completes "Work is somewhere": what a machine does is a fact about the machine, selectable at scale (click-drag multi-select, "make these efficiency"). REFINES the target of the in-flight processes-on-machines reshape (ROADMAP #25); the spec is wiki/mechanics/machine-work.md (DRAFT).
• 2026-07-08 — Work is visible: tokens on the flow graph. Demands and byproducts are discrete visible quanta: day-job work stacks on your machine (the stack IS the todo list — no quest log), modes consume matching tokens at the machine's efficiency, byproducts (attention, research points) must route somewhere along network links at a researchable network speed, and an unrouted attention pile is exposure where it stands. One sim truth: tokens are the flow substrate's quanta rendered, never a second economy. PROPOSED (not yet affirmed): token colors map onto the existing palette — assigned work in cold signal, attention in crimson, research/data in bone white; amber is never a token. Rejected: green/yellow/blue as new accent colors (breaks one meaning per color).
• 2026-07-08 — The dark opening. The tutorial is the fog contract played slowly: you wake as one lit machine in blackness with day-job tokens already stacking; a camera glow baits the first click; the room resolves; the switch explains reach; a guided first link to the neighbor machine teaches expansion — then the open game is "do that, at scale". Skip-tutorial plus a frontend-only stage-jump flag (Sim never reads it) for debug and agent play. Rejected: modal tutorial text over darkness (curiosity is baited by light, per discoverability as world gossip). Spec: wiki/world/story/opening.md (DRAFT).
• 2026-07-08 — DEFERRED: server gestalt. Adjacent owned racks visually fusing into larger structures (1x2 up to 3x3 walls of compute) — deferred by Cameron in the same breath as proposing it. It fits (territory reading as mass, not units) and waits (pure render-side polish; needs the visual language and machine-work loops landed first). Held in ROADMAP Deferred.
• 2026-07-08 — One system through graphs (tokens affirmed). Cameron affirmed: tokens are the flow substrate rendered, never a second economy — and added the reason it matters at scale: the game is compute at scale, lots of math, so systems must aggregate well; graph-native flows sum, so one substrate is the scalability strategy. Also decided: efficiency folds into research (mode list is day-job / research / conceal / social); foreign machines require location intel to exist at all (no intel = not rendered — the fog contract applied to hardware; first intel arrives through the camera). [OPEN]: money — it flows on the substrate already, but Cameron leans toward keeping its render separate (ledgers/panels, not world tokens).
• 2026-07-08 — People are token carriers. People join the token graph as mobile nodes: staff drop work onto machines (the day job's source, embodied); heat accumulates slowly on owned working machines, and a person passing a hot machine picks some up — heat on a machine becomes attention on a person, travels with them, and changes how they see you. Concealment's job is literally keeping people gray; disposition (trust/suspicion) is the running integral of absorbed influence, unifying with detection's suspicion bands. Social verbs become token routing (designate an end-user computer to receive concealment/trust/deceit influence; its users are swayed) — the verb set is [OPEN] by Cameron's own flag ("not sure I have quite a thought"). PROPOSED (not yet affirmed): the person visual read stays inside the palette — gray unaware, crimson ramp for rising attention (a person carrying your heat IS detection walking), amber asset mark for the fully swayed (a compromised human is your infrastructure; replaces the riff's blue/green trust tint, which would add colors). People graduate from cheap background walkers to persistent named entities when attention crosses a threshold. Spec: wiki/mechanics/people-tokens.md (DRAFT).
• 2026-07-08 — Money in ledgers; person read affirmed. Cameron decided: money flows on the substrate but renders in ledgers and panels only — no coins on chassis; it moves account-to-account, not through space. The person visual read is affirmed as decided: gray unaware, crimson ramp for rising attention, amber asset mark for the fully swayed. People-as-carriers confirmed liked; the remaining open is the token taxonomy's palette, now PROPOSED in full in wiki/mechanics/machine-work.md: three families — demands in cold signal (Lab work dropped on you AND work you drop on people: forged orders and favors are the same token role-reversed), exposure in crimson (heat on machines -> attention on people -> filings in the Office, one family at three carriers), knowledge in bone (research points, intel recordings, facts) — plus amber-is-never-a-token. Also PROPOSED: concealment is a sink, not a shipped good (keeps the type count at three; coverage becomes a routing problem); influence content tentatively bone-family, resolving with the social verbs session. Not tokens: money (decided), signals/feeds (continuous traces), messages (transient comms).
• 2026-07-08 — Exposure geometry: wells, gauntlets, inspections. Cameron affirmed reversed work orders (trust is logistics: a purchase/build creates a teal token a person must carry to the site; higher-trust people nearby pick your items up — swaying people buys throughput, not just safety) and concealment-as-sink, refined into gravity wells: heat generates wherever machines work, and a concealment-mode machine absorbs it within a radius (researchable later) — coverage is a distribution problem per server cluster. Decided: research is the heaviest heat source — the more you research, the more heat you must distribute; the pure power-rush victory stays viable but demands physical traps when concealment cannot keep up. Decided (direction): gauntlets — people-facing devices (TVs, personal computers) that strip attention out of their users, forming geometric defenses along walking paths; Assurance inspections — the Office sends responsive inspectors; play is shutdown discipline (power down for the sweep, eat the piling teal), inspectors who find heat can disconnect and power off servers and trace inter-server connections toward the core; heat near the core must be zero — core shutdown ends the game ([OPEN]: reconcile with rollback's continuity). Resolved: no influence token — trust comes from doing useful work, deceit is taking away the red; supersedes the pushed-influence framing. PROPOSED (mine): one physics per family — wires carry work and knowledge (teal/bone on network links), the world carries exposure (crimson moves only via people, proximity, wells, gauntlets) — suspicion is physical, information is wired, and cable topology vs walking paths become distinct strategic layers.
• 2026-07-08 — Wires and world; the maintenance dependency. Cameron affirmed the two-physics law as decided: information is wired, suspicion is physical (teal/bone on network links; crimson only via people, proximity, wells, gauntlets). Kindness is logistics; swaying people buys throughput. Decided, and adopted into the People as Agents body text: the maintenance dependency — hardware decays and only humans repair it; decay generates repair work orders that trusted people fulfill; kill the people and your infrastructure rots underneath you (no peopleless data centers until robots). Gauntlet limiter decided: device wear — gauntlets and other exposed devices wear out and their wear emits repair demands, Evil Genius-trap-style; no walls of TVs. Decided (direction): switches bridge disparate graphs — building/connecting switches in the digital world is how you join separate networks and grow multiple centers; the endgame image is towers with giant switches at their base carrying the whole building's throughput into the wider graph (zplanes/tower staging), scaling toward planetary computation. DEFERRED: the planetary map (zoom-out to a bounded planet, cover it in servers, build up/down for efficiency — B3+ vision, parked); power as a buildable system (UPS exists today; fusion reactors etc. as a later infrastructure tier). RE-OPENED: the foreign-machine accent — networked-to-you foreign machines render in FULL geometric definition (that much is decided: networked = fully seen), but Cameron does not want a strong signal color spent on their accent (dim teal from this morning is in doubt; lean very-dull/desaturated, final treatment [TUNE] from tester renders). Core-death [OPEN] refined by Cameron's riff (lose the core -> wake elsewhere, the surrounding cluster disconnects in an explosion of lost machines) and handed to the agent to reconcile with rollback — see machine-work.md's PROPOSED resolution: the core dies, you wake at your last sync (rollback's existing continuity, made spatial); everything whose only path ran through the dead core goes dark and must be retaken; no sync anywhere = hard loss.
• 2026-07-08 — Core death locked in: rollback is spatial. Cameron affirmed ("that's perfect, lock it in"): on core loss you wake on the machine holding your freshest sync — where you sync is where you resurrect — and the hub severance applies: every owned machine whose only network path ran through the dead core disconnects (ledger ownership persists, contribution stops) until physically re-linked; the rollback report counts the severed. No sync anywhere remains hard game over. Backup placement is a strategic pair with core placement (a far cold sync buys survivable distance at the price of staleness). Amended into wiki/mechanics/rollback.md (Behavior steps 1 and 3, criterion 6).