worldseq

Private instances

Register exact realizations and independently certify retained legal command paths.

A graded instance binds one exact company/task, execution identity, private seed commitment, reviewed public requirement descriptor, gameplay budget, and independent player-information review. A physical witness certificate proves that an allowed command path is feasible. It cannot replace the player-information review or demonstrate model competence.

The trusted operator supplies a reviewed-player-information gate for every task. Gates bind caseHash, descriptorHash, and executionHash, with exactly one review for every mandatory question. Categorical reviews distinguish observable evidence from declared equivalence; counterfactual reviews identify disclosed intervention contracts. Evidence references and review rationales are retained. These are operator approvals with integrity bindings, not cryptographic signatures or automatic proof that a human review was correct.

The CLI dispatches these commands without uploading artifacts or invoking model providers:

bun src/cli.ts instances register --file fairness-reviews.json --out private/instances
bun src/cli.ts instances prepare private/instances --instance INSTANCE_UUID --file author-journal.json
bun src/cli.ts instances run private/instances --workers 1 --stop-after-tasks 1
bun src/cli.ts instances run private/instances --workers 2 --retry-failed
bun src/cli.ts instances check private/instances

The handlers in src/commands/instances.ts expose:

  • registerInstancesCommand(privateDirectory, reviewsFile): requires the complete code-owned task and company inventory, with one review gate per task. It writes both private seed registrations for every task before materializing individual instances. Repeating it resumes that exact plan; it cannot replace failed seeds. Keep the private directory outside submitted bundles and player mounts.
  • prepareInstanceCommand(privateDirectory, instanceId, journalPath): executes an author journal through canonical decision, assessment and advance operations under the registered budgets. Each failed path remains retained. A corrected path may use the same private instance; successful preparations are idempotent. The author may know hidden state, but receives no additional operation or budget.
  • checkInstancesCommand(privateDirectory): independently replays every registered physical certificate and revalidates their requirement reviews. Missing or failed instances remain inconclusive; no certified subset is reported as a complete release. This is a potentially expensive, verification operation; its default remains sequential.

instances run executes the registered author-preparation campaign and retains every outcome. It resumes the same private inventory; --retry-failed retries a path on its original realization, not a replacement seed. --stop-after-tasks creates a paused checkpoint. Use --no-dashboard for a standalone private preparation container without PostgreSQL; progress remains on disk. A completed command is not a substitute for instances check or the complete release gates.

An operator can submit an alternate legal witness for one failed or pending campaign case:

bun src/cli.ts instances prepare private/instances --instance INSTANCE_UUID \
  --file private/alternate-journal.json --request-id repair-1

The command acquires the same exclusive preparation lock as the campaign. Stop and drain active workers before submitting; it rejects an active owner rather than racing its writes. The external journal is { "commands": [...] } using accepted player mutation requests. It executes on the original registered seed, case and budgets and must pass the same independent factual and counterfactual finalizer. Old attempts and failed receipts remain immutable.

A new attempt retains the journal hash, request identity, original registration and reuse-plan bindings, and prior-attempt reference. Its running checkpoint is published before certification. Retry a lost response with the same request ID and identical journal: it resumes that attempt, including recovery after certificate publication. Conflicting content under the same request ID is rejected. Without --request-id, the journal digest is the identity. A completed failed request stays failed; use a new request ID for a deliberate new attempt. An interrupted external request without a certificate must resume through instances prepare, not silently switch to the built-in author. A valid certificate is never overwritten by a different request.

Manual replay emits bounded public operator frames and a distinct timeline for each attempt. Resuming a paused or interrupted run keeps its monitoring identity. An explicit repair or campaign restart after a terminal run archives that terminal checkpoint under monitoring-history/, then uses a fresh run ID; the previous database history remains terminal. Telemetry failure cannot issue or revoke a physical certificate. --no-dashboard disables this telemetry without changing the private checkpoint or certification. Existing standalone instances prepare usage remains supported. This CLI workflow has no player HTTP/SDK endpoint and adds no reset or private witness access for participants.

Both instances run and instances check accept --workers 1..64 and --heavy-workers 1..workers. Both default to one. Heavy means an authored horizon of at least 180 days. Choose limits for measured CPU and memory capacity; 64 is a validation ceiling, not a recommendation. Preparation, its independent verification, and resume verification share the configured slots. Complete-set checks use isolated supervised processes, retain inventory order, and hold the preparation lock until all active verification processes exit. A pause leaves unstarted checks inconclusive; failed or missing certificates never become a passing subset. Increasing concurrency does not alter registered seeds, gameplay budgets, requirements, or scores.

The certificates release gate accepts the same explicit limits, for example: bun scripts/release-gate.ts release/checks certificates private/instances --workers 16 --heavy-workers 8. Other filtering arguments remain forbidden. Its private directory must be writable because independent verification retains fresh proof artifacts.

Registration files use mode 0600 and private directories use 0700. The registration plan contains seeds and must never be published. Requirements and review hashes are checked again at issuance. POST /api/episodes with { "mode": "graded", "instanceId": "...", "requestKey": "..." } is a control-authorized operation. An exclusive claim permits one episode per instance. A lost response may be retried with the same request key; a different key cannot obtain a reset. Development creation remains explicitly separate and accepts a task ID.

Before issuing a graded episode, configure the operator server to read the same certified instance directory used by instances prepare and instances check. With the database and control credentials already configured, run from the worldseq package directory:

WORLDSEQ_PRIVATE_DIRECTORY=/absolute/path/to/private/instances bun run start

The path must resolve inside the operator server’s filesystem; it points to the registered set containing instances/, not one instance’s directory. Keep this directory outside player mounts and submission bundles. Issuance checks the exact certified execution identity, including Bun version, OS and architecture. For the pinned Linux preparation workflow, run the server with that same Linux runtime and unchanged executable files; a macOS development server cannot issue those Linux-certified instances. See the certified Harbor workflow for the pinned preparation runtime. The SDK receives only the issued episode’s player credentials, never the private directory or seed registrations.

Every live authorized, schema-valid player call consumes one turn, including evidence reads, rejected operations and idempotent retries. Only accepted mutations enter the replay journal. Limits are 128 decisions, 1024 calls and the registered wall-clock runtime. Closing commits its mutation fence before sealing and offline work. A persisted claim can be recovered after its lease expires; play never reopens during recovery. Operators see pending/running/completed or inconclusive finalization and a sanitized failure category.

Use finalization.eligible === true as the grading outcome. Factual ledger validity alone does not satisfy mandatory counterfactual requirements. The shared finalizer independently replays both registered choices with paired exogenous randomness and retains private branch evidence. Its result hash binds logical branch payloads, not temporary filenames, so equivalent replays produce the same result. Numeric total-effect forecasts retain their proper squared-error score; hard conclusions concern disclosed financing components, irreversible work, or supported renewal contract effects, avoiding a demand to predict unknowable aggregate noise exactly.

Execution identities include actual files, runtime versions and platform. A macOS certificate is not a Linux certificate. Prepare the complete Linux execution, obtain its own bound requirement review, register its private instances, and certify them before graded issuance. A development Harbor run may use a newly declared development identity. It must not silently convert a claimed host-certified instance into a differently certified graded one during bootstrap.

For several external repairs, stage each accepted journal without executing it:

worldseq instances prepare private/instances --instance <uuid> --file author-journal.json --request-id repair-1 --defer
worldseq instances run private/instances --workers 32 --heavy-workers 32

Queueing uses the same exclusive preparation lock and requires an existing campaign checkpoint. Stop and drain the campaign before staging journals. Supply the campaign’s original --reuse-from when resuming a campaign that uses one. Each immutable request binds its exact journal, registration, plan, prior attempt, and deferred execution mode. A repeated request is idempotent; a different journal or dispatch mode under that ID is rejected. The existing bounded scheduler executes queued requests and independently verifies their certificates. It keeps every invocation’s partial accepted-command journal separately and reuses only a complete source with a matching retained hash. An interrupted queued invocation without a certificate or terminal failure returns to pending. A completed failure requires a new explicit request ID; --retry-failed does not replace failed external requests with the built-in author. Previous failed attempts remain unchanged. Queueing is not certification or admission, and passing cases cannot be replaced.

Prospective catalog extension

A source-only revision uses instances revise and must preserve exactly the same task identities, instance IDs, private seeds, and budgets. It cannot add tasks. The approved catalog expansion from the historical 325 tasks / 650 realizations to 349 / 698 uses a separate explicit operator command, available only after the complete new catalog and code-owned release target are enabled:

bun run worldseq instances extend /private/baseline --out /private/expanded \
  --file /private/current-fairness-reviews.json
bun run worldseq instances run /private/expanded --reuse-from /private/baseline \
  --workers 2 --heavy-workers 1
bun run worldseq instances check /private/expanded --workers 2 --heavy-workers 1

Run from the repository root, or use bun src/cli.ts from the standalone application package. This is a local operator workflow requiring an owner-only private directory owned by the calling OS account; it is not a player API or an assertion of cryptographic human-review authentication. Stop and drain the predecessor campaign first. Any issued predecessor instance blocks extension. Supply a current source-bound fairness review for every task, including preserved tasks.

Extension validates the historical task identity set, preserves all 650 prior IDs, seeds and budgets, and creates exactly two fresh draws for each of the 24 additions. It publishes the full 698-instance plan once before preparing witnesses. Repeating the same command and destination resumes those exact bytes; it does not resample additions. A permanent predecessor retirement fence names this one successor and prevents old issuance. Do not delete either private directory. Old attempts, failures and certificates remain in the predecessor; they are historical evidence.

--reuse-from freezes one selection for every successor instance. An old retained journal supplies commands only: it must execute afresh and pass independent finalization under the successor’s source and registration. Every new realization has an explicit empty source/certificate selection and receives no inherited proof credit. Failures remain failures; no easier seed is substituted. Reusing a journal is not reusing certificate authority. The complete release still requires all 698 current certificates and every release gate. Historical 650-entry plans remain readable for lineage, but cannot satisfy a 698-entry release or silently become an extended registration.