Protected suites

Use protected suites to keep evaluation company definitions, tasks, and starting conditions private. The Vesper and Moraine profile covers planning horizons from one week to two years. You choose which tasks to use for training or evaluation.

Private company specifications, task text, evidence packages, seeds, reviews and witness journals belong in an operator-only directory outside the repository and public distributions. No private package is shipped with this profile. The tests use explicitly synthetic fixtures; they are not holdout scenarios. Keep the player runtime, operator credentials and private artifacts isolated. In particular, do not set WORLDSEQ_CATALOG_PATH to the private package: that option is a public catalog override and exposes metadata through catalog listing. The private workflow below resolves registered cases without replacing the public catalog.

Review and approve before drawing seeds

Prepare a complete declarative package through the ordinary catalog authoring API or CLI. Structural/source checks do not establish solvability. Independently review the exact package and all public requirements, record its canonical contentHash from package preparation, and install the approved package and fairness reviews as owner-only regular files (0600) under a private directory (0700). The package is the strict package JSON, without adding generated report or contentHash fields to it.

Run the following only as the trusted operator, using the reviewed canonical hash:

bun run worldseq instances approve-suite REVIEWED_PACKAGE_HASH \
  --file /private/ceo/package.json --out /private/ceo/approval.json

export WORLDSEQ_PRIVATE_SUITE_APPROVAL=/private/ceo/approval.json
export WORLDSEQ_PRIVATE_SUITE_PACKAGE=/private/ceo/package.json

bun run worldseq instances register-suite \
  --file /private/ceo/fairness-reviews.json --out /private/ceo/instances

Approval never overwrites an existing file. The environment paths are trusted operator configuration, never player request parameters. Both files must belong to the operating user, have no group/other permissions and contain no symlink components. An untrusted registration cannot choose an approval file or authorize its own package. The approval binds the code-owned profile and the entire parsed package: company/task metadata and evidence provenance as well as executable specifications. A metadata-only change therefore invalidates private authority even when physical case hashes are unchanged.

Registration checks every case’s independently supplied fairness gate, then freezes every instance ID, seed and gameplay budget before any witness construction. The gameplay budget remains 128 decisions, 1,024 calls and the existing runtime limit, including for 730-day tasks. Repeating registration resumes the same plan; it cannot redraw seeds or substitute a successful subset. It cannot repurpose a public registration. No private witnesses or certificates are created by approval or registration.

Execute and independently check

Use the same ordinary preparation and verification paths as other private instances:

bun run worldseq instances prepare /private/ceo/instances \
  --instance REGISTERED_INSTANCE_ID --file /private/ceo/legal-journal.json
bun run worldseq instances run /private/ceo/instances \
  --workers 2 --heavy-workers 1 --no-dashboard
bun run worldseq instances check /private/ceo/instances --workers 2 --heavy-workers 1

Choose concurrency for the measured resource envelope. The scheduler reads the registered private case to classify long-horizon work. It does not need private metadata in the public catalog. Normal legal commands, independent replay, participant budgets and certificate checks remain authoritative. A completed registration or successful author construction alone is not a feasibility proof.

Every protected registration/certificate read rechecks the installed approval and package. Certificates bind the complete instance registration, including the suite binding. Removing that binding from a profile company, changing standard budgets, or replacing source provenance fails validation. The operator must continue to supply the approved package to trusted worker processes. Do not expose those paths or files to participant sandboxes.

An execution change requires the explicit operator-only private revision command, with independently reviewed fairness gates for the new execution and the same installed approved package:

bun run worldseq instances revise-suite PREVIOUS_PRIVATE_ROOT \
  --out NEW_PRIVATE_ROOT --file NEW_EXECUTION_FAIRNESS_GATES
bun run worldseq instances run NEW_PRIVATE_ROOT --reuse-from PREVIOUS_PRIVATE_ROOT
bun run worldseq instances check NEW_PRIVATE_ROOT

Revision preserves every registered instance ID, seed, budget, case requirement, and the approved package binding. It requires an unissued predecessor, locks its preparation, retains its evidence, and permanently fences its issuance before materializing the separate successor. Repeating the command with the same inputs resumes the same successor; it cannot select another destination or redraw seeds. The normal register-suite command does not create or resume a revision.

Journal reuse selects retained commands under checked predecessor hashes. Missing sources remain explicit. Every selected journal executes anew under the successor and receives fresh independent finalization; old certificates never confer a new pass. For a source-less failed attempt, submit its retained original accepted journal through the normal explicit preparation interface rather than selecting new seeds. Issued suites and changed packages cannot use this workflow.

Private suites cannot use the public revise or extend commands. Passing the public release checks does not certify a private suite. Private certification must finish independently and retain every failed or inconclusive instance; it must not be represented as public release completion.

Protected Harbor export

A certified suite instance uses the same harbor export TASK_ID --instance INSTANCE_UUID --private-directory REGISTERED_ROOT --out NEW_PRIVATE_DIRECTORY command as other certified instances. Run it from the matching Linux execution with the approved-suite package and approval environment installed. The exporter resolves the private case from its trusted registration; keep WORLDSEQ_CATALOG_PATH unset.

The simulator and separate verifier receive the selected certificate, witness and claim. They also receive the complete approved package, approval, frozen seed plan and registration marker because the existing suite validator checks complete membership. These files stay in the trusted contexts with owner-only permissions. No other instance’s certificate or witness is copied. The player image receives only its client, and its sole shared mount is the read-only public session. Keep the entire export private: host/Docker administrator access to trusted build contexts is outside the player isolation boundary.

The Docker regression exercises both public-catalog and synthetic private-suite certified instances through real issuance, collection and the separate verifier. A Harbor adapter change is part of execution identity, so certificates from an earlier executable cannot be relabeled as certification of the changed exporter/runtime.

Operator-only private company browsing

The control listener exposes GET /api/operator/private-worlds to the existing operator bearer token or authenticated dashboard session. The player listener does not register this route. Configure both WORLDSEQ_PRIVATE_SUITE_APPROVAL and WORLDSEQ_PRIVATE_SUITE_PACKAGE with the owner-only approved inputs. With neither configured, the endpoint returns an empty list; incomplete, invalid or changed suite inputs return a generic 503 response without filesystem details. Public catalog responses remain unchanged.

The response contains only company ID, name, description, task ID, title, objective and horizon, plus certification status. It never includes task specifications, answers, seeds, witnesses or approval contents. Browsing is an operator convenience, not player access or suite certification.

WORLDSEQ_PRIVATE_SUITE_ROOT is an optional, explicit private instance-set location. It never falls back to WORLDSEQ_PRIVATE_DIRECTORY or the public release inventory. Without it, certification is not_registered with zero certified cases and two realizations per task. When it is configured, this bounded metadata endpoint reports unavailable with zero certified cases: complete certificate verification requires independent replay and is deliberately not performed inside an HTTP request. A progress file, certificate filename or cached success flag is never presented as verified readiness. Use the existing trusted instance checks separately to inspect certification; this endpoint does not start checks, register instances or draw seeds.