Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pet purchases currently spend a local wallet, so balances earned in shared games cannot buy Pet items. This change binds the Pet save to an economy URL, instance, account and persistent store identity, then uses the shared SDK for purchases, adoption and device upgrades. A persisted intent and authenticated, identity-bound order receipt make delivery recoverable after a lost response or failed local write.
Legacy saves retain a create-only raw backup and their historical wallet/receipts. Positive balances require an operator-approved one-time entitlement; zero balances bind without minting. The existing Avatar, care, devices, skins and navigation presentation is retained. Offline copies of the same store identity remain independent local forks and do not guarantee globally unique inventory consumption.
Future normal root work retains the original 10,000-token-per-coin rate through Host readWork v2's exact policy/classification and a separate, explicitly authorized sponsor service. The service has a prefunded reward source, UTC daily limits and account limits. New authorization and epochs establish fresh baselines. Profile v1, game/fork/subagent/unknown usage, unconfigured intervals and interrupted periods never accrue catch-up rewards. At most one persisted grant replays the original event/body/key after uncertainty; a readonly source check and expectedInstanceId guard bind sponsorship to the wallet. User credentials cannot grant rewards; no credentials or HTTP handles enter Pet documents.
Validation at final consumer checkpoint e2822e3 (Host be2403c): Pet Linux CI passed exact SDK SHA-256 verification, normal npm ci with lifecycle scripts (14 seconds), SDK dependency resolution with one deduplicated Protocol, and npm run check (typecheck, production build, package graph verification, 171/171 tests). The prior Host 69b0146 success is retained in the provenance record. No Mac cold build or native restart was performed for the alignment. Eleven real SDK + HTTP + SQLite purchase/migration tests and ten additional work-reward tests cover conserved settlement → Pet purchase, replay, lost responses, local CAS failures, wrong identities, future-only rewards, limits, multi-window races and generation disposal. Package dry-run includes all 229 generated Pet SKUs and migration/recovery guidance. Shared ESLint policy passes changed source/tests; dprint checks the new economics modules and changed client/usage/config documentation scope.
Experimental dependencies are tracked portable tarballs with full source SHAs and checksums in .development/economy-dependencies.json: Host be2403c70664ff6624671224a405e409874d59c7, Protocol 465c444c65eec1be8e337b94c2cf658ed536f49c, Economy 5d688fc087f6dcad7a0ace5f90f328270078aa96. They are pushed provider candidates, not registry releases. Host is built using its exact-commit scripts/prepare-sdk.mjs recipe, with complete Channel/CLIProxy runtime bundles and a single shared Protocol module identity; its SHA-256 is abd300ccade96d095563f95f971164838237a376655a55b7f96bdccb3bf2dd46. The tracked be2403c bytes and lock integrity passed local hash checks and the exact-head Linux consumer CI. The Pet owner Linux workflow is committed at 637efcd and was pushed using the session’s existing SSH authorization. The lockfile has exactly one Protocol package, and its artifact integrity matches the provider. No type cast or skipLibCheck workaround is used. Host public HTTP/readWork implementations are included; provider full gates and native acceptance are separate.
Native verification used a separate host-isolated HOME/CODEX_HOME/Chromium profile. The Mono assembly checkpoint passed exact inputs; initial CDP evaluation and login-page screenshot succeeded, then the CDP target list itself timed out before Pet or the Host credential form was reachable. This remains a Host startup investigation and native acceptance gate. Only the owned launcher was stopped; no test credentials were read or submitted, no real user save was read or migrated, and no existing user App or preview was restarted. Host connections require same-identity reauthorization after reload; failed purchase/grant keys have no permanent server cancellation tombstone and remain recoverable.
Draft only: no merge, release or deployment.