The harbor keeps a ledger
Agent grant budgets, identities and revocations now survive a full server restart, recorded in an append-only hash-chained journal that audits byte for byte.
The last agents post listed durable authorization and audit records as next work. An agent’s settled spending allowance should not be restored by restarting the server. That work is now built and locally verified in the sandbox region.
What durable means here
Every owner-approved agent grant now lives in a hash-chained, append-only JSONL journal. Each record occupies one line, linked to the previous line by a SHA-256 hash of that previous line’s exact bytes. Only grant provisioning, revocation and settled spending are written. Existing records are never rewritten.
A grant id can be provisioned exactly once. Its identity, spending cap and expiry are frozen at that point. A revoked id stays revoked across restarts, even if the startup config still asks for it.
The startup config may only add new grant ids. It can shrink an agent’s headroom for a single boot, but it cannot restore allowance already settled in the ledger.
If the journal is tampered with, torn or clock-shuffled, the server refuses it and goes read-only. It preserves the original bytes rather than repairing them.
Killing the server mid-cohort
The native gate now kills and relaunches the game server midway through the cohort, after the world courier has a settled spend.
The restarted server reconciles its startup config against the surviving journal. The courier returns on fresh world identities with its spent allowance already deducted. The revoked player agent remains unable to reconnect. The bridge reports it as a revoked placeholder, preserving the roster count the broker expects.
The courier then accepts a second contract on the restarted server. The journal gains a second spend record, chained and byte-exact. At the end of the run, the audit tool summed $1,575 settled across eight records and recomputed every hash link rather than trusting the stored values.
All of it is fictional in-game money in throwaway sandbox worlds. The run ended with the courier still holding $900 of its $1,800 authorization, while the player grant had spent exactly its $675 cap before its revocation. Each verification run provisions fresh grants in a fresh world, so these figures are an audited end state, not a balance that carries between tests.
How one bug survived four layers of green tests
An independent review of the journal code found a defect in the reopen path. It validated every record but kept none in memory for the append path. The first spend written after a restart would have rebuilt the file from a single record and destroyed the chain.
No existing test caught this because none appended after a reopen. The editor suite now covers that sequence.
The build containing the fix then landed in the wrong folder. Unity resolved a relative output path against the project path, so the verifier launched the previous binary without the fix. That run reproduced the journal wipe the review had predicted.
The build wrapper now uses only absolute paths and records the shipped assembly hash. These two guards make a stale build visible to verification.
What this is not yet
The journal records spending after the world accepts it. A crash between world acceptance and journal append fails closed: the participant is revoked and the spend is not journaled. Full reserve/settle/void wiring that makes the journal a crash authority is still open.
Persistent accounts still refuse agent spending with PersistentEconomyNotEnabled. This remains sandbox economics. Tampering with the newest record also needs an external checkpoint to detect, because the chain grows forward.
Sandbox grant budgets, identities and revocations now survive a server restart. The remaining work includes closing the gap between world acceptance and the durable spend record.