Alpha 0.3.33: grant daily Community Marks

.github/workflows/verify.yml

@@ -147,6 +147,7 @@ jobs:
         run: |
           pnpm --dir spacetimedb run verify
           npm run stdb:verify-bindings
+          npm run stdb:build-v14-migration-fixture
           npm run stdb:verify-worker-migration
           npm run stdb:verify-access-request-migration
           npm run stdb:verify-additive-migration

CHANGELOG.md

@@ -6,6 +6,16 @@ full engineering record.
 
 ## [Unreleased]
 
+## [0.3.33] — 2026-07-31
+
+- Gave every admitted keeper one experimental Community Mark per eligible
+  Realm day, recorded automatically by SpacetimeDB.
+- Added private exactly-once daily receipts so retries cannot issue a second
+  Mark; revoked admission pauses future grants without removing prior balance.
+- Retired the SNAP burn, wallet-attribution, and chain-scanning product paths.
+  Marks require no wallet, token, transaction, or payment and remain game-only,
+  non-transferable Alpha accounting with no cash value or promised reward.
+
 ## [0.3.32] — 2026-07-31
 
 - Replaced the original draft Mini App launch mark with the current
@@ -361,7 +371,8 @@ full engineering record.
   Lowlands, a first keep, Farcaster sign-in, and an admission-gated shared-world
   foundation.
 
-[Unreleased]: https://github.com/ael-dev3/Warpkeep/compare/v0.3.32...HEAD
+[Unreleased]: https://github.com/ael-dev3/Warpkeep/compare/v0.3.33...HEAD
+[0.3.33]: https://github.com/ael-dev3/Warpkeep/compare/v0.3.32...v0.3.33
 [0.3.32]: https://github.com/ael-dev3/Warpkeep/compare/v0.3.31...v0.3.32
 [0.3.31]: https://github.com/ael-dev3/Warpkeep/compare/v0.3.30...v0.3.31
 [0.3.30]: https://github.com/ael-dev3/Warpkeep/compare/v0.3.29...v0.3.30

README.md

@@ -6,7 +6,7 @@
 
 Genesis 001 is a persistent, invite-only 10,000-cell Lowlands realm with 100 permanent castle sites gathered near its founding district. Each admitted founder enters through a verified Farcaster identity, receives one durable keep, and returns to a world that remembers its coastline, twelve rivers, wintering north, sunscoured south, shaped forests, resource sites, Workers, wagons, and public keeper portraits. Four permanent Workers can gather Food / Wood / Stone / Gold, settle production automatically, and return home on command.
 
-Alpha 0.3.32: The Hegemony Crest is live in ordinary browsers and as a portrait-first Farcaster Mini App. Returning admitted players with current Alpha Terms enter the Realm directly; verified players still outside the gate can place one private request for manual review. The intended core strategy loop is not playable yet: Warpkeep is a one-person, open-source experiment—not a finished MMO or financial product. Participation earns no token reward, airdrop, financial return, guaranteed reward, or future value.
+Alpha 0.3.33: The Realm now records one experimental Community Mark for each admitted keeper per eligible day. Returning admitted players with current Alpha Terms enter directly in ordinary browsers and the portrait-first Farcaster Mini App; verified players still outside the gate can place one private request for manual review. The intended core strategy loop is not playable yet: Warpkeep is a one-person, open-source experiment—not a finished MMO or financial product. Participation earns no token reward, airdrop, financial return, guaranteed reward, or future value.
 
 ![Development preview of Genesis 001 showing the Lowlands and an open Wheat Farm inspection panel.](docs/reference/screenshots/2026-07-22-realm-wheat-farm-preview/warpkeep-realm-wheat-farm-preview-f3b1f7e598c543d6.png)
 
@@ -29,11 +29,11 @@ Open the local URL Vite prints; shared Alpha access stays off by default. Contri
 
 | State | Today |
 | --- | --- |
-| ✅ Live | Alpha 0.3.32: The Hegemony Crest is live and invite-only in browsers and the Farcaster Mini App. |
+| ✅ Live | Alpha 0.3.33: The Realm Remembers is live and invite-only in browsers and the Farcaster Mini App. |
 | ✅ World | Genesis 001 persists 10,000 cells, a coastline, twelve one-cell rivers, colder northern and drier southern frontiers, and 100 permanent castle sites near the founding district. Founders return to one durable keep, explore the Lowlands up to its fog, and inspect nearby founders through their public username / portrait / castle. |
 | ✅ Authority | FID is the durable identity; handles and portraits are bounded presentation metadata. Farcaster sign-in uses a browser-bound, least-privilege bridge. The browser presents; the server decides admission, ownership, resources, timers, and saved state. A private access request asks for manual review and grants nothing by itself. |
 | ✅ Resources | Each keep privately holds Food / Wood / Stone / Gold. Food, Wood, and Stone come from authoritative terrain yield and can also be gathered at Wheat Farms, Logging Camps, and Stone Quarries; Gold comes from Gold Mines. Completed yield settles without a Claim step, and occupied sites keep their gathering story in one record. The browser never invents balances. |
-| ✅ Marks | Community Marks are separate private accounting and start at zero. They cannot be spent, converted, or transferred. They have no cash value, promised utility, or reward loop. The world, rules, and direction will evolve. |
+| ✅ Marks | Each admitted keeper receives one experimental Community Mark per eligible Realm day through private, replay-protected SpacetimeDB authority. Marks require no wallet or token action and cannot be spent, converted, redeemed, or transferred. They have no cash value, promised utility, or reward loop. |
 | 🚧 In progress | Worker journeys now begin on the map, but the larger construction, strategy, and social loops are still being built. |
 | 📋 Planned | Construction and upgrades; units / scouting / travel / combat; alliances / trading / chat; seasons / governance. Design notes are experiments, not promises that these features will ship unchanged. |
 
@@ -54,7 +54,7 @@ Open the local URL Vite prints; shared Alpha access stays off by default. Contri
 - **Architecture:** The [technical architecture](docs/technical-architecture.md) explains what the browser shows and what the server decides.
 - **Roadmap:** The [roadmap](docs/design/roadmap.md) and [game direction](docs/design/warpkeep-direction.md) separate today's game from later plans.
 - **Authentication:** The [Farcaster integration](docs/farcaster-integration.md) guide covers sign-in, privacy, and public configuration.
-- **Release:** The [Alpha 0.3.32 release notes](CHANGELOG.md#0332--2026-07-31) describe the unified launch crest.
+- **Release:** The [Alpha 0.3.33 release notes](CHANGELOG.md#0333--2026-07-31) describe daily Community Marks.
 - **Licensing:** [LICENSING.md](LICENSING.md) explains release rules; [asset provenance](ASSETS-LICENSE.md) records where media came from and what permissions apply.
 - **Contributing:** [CONTRIBUTING.md](CONTRIBUTING.md) covers checks and provenance; the [Realm Council issue forms](https://github.com/ael-dev3/Warpkeep/issues/new/choose) accept privacy-safe bugs and ideas.
 - **Security:** Report sensitive issues privately through [SECURITY.md](SECURITY.md), never through a public issue.

docs/README.md

@@ -30,7 +30,7 @@ contributors. This page routes deeper work without duplicating it.
 - [Auth bridge](../services/auth-bridge/README.md)
 - [SpacetimeDB module](../spacetimedb/README.md)
 - [Community Marks policy](gameplay/marks-policy-v1.md)
-- [Marks and profile operators](operations/marks-operator.md)
+- [Daily Marks operations](operations/daily-marks.md)
 - [Local visual QA](operations/qa-observatory.md)
 - [Threat model](security/threat-model.md)
 - [Operations and recovery](operations/reconstruction/README.md)

docs/farcaster-integration.md

@@ -5,7 +5,7 @@ ordinary browsers use Sign In with Farcaster (SIWF), while a verified Farcaster
 Mini App host may use Quick Auth. Neither path is a wallet connection,
 client-owned identity, admission grant, or Terms acceptance.
 
-Alpha 0.3.32 keeps backend protocol 3 and authentication contract v2; admission
+Alpha 0.3.33 keeps backend protocol 3 and authentication contract v2; admission
 remains gated. Production configuration and founder identities belong in the
 private operator record, not this guide.
 
@@ -286,13 +286,14 @@ including its opaque OIDC Identity column, and must remain empty. Protocol v2
 introduced the active public `player_v2` plus private `player_ownership_v2`
 split; protocol 3 preserves that pair and the complete deployed seven-table
 prefix unchanged. It appends the Genesis realm, terrain metadata, permanent
-slot/claim, trusted public profile, private Marks/wallet/scan, and private Terms
-evidence tables without widening browser identity authority. Generated browser
+slot/claim, trusted public profile, private Marks and Terms evidence, and frozen
+private compatibility tables without widening browser identity authority. Generated browser
 bindings expose only public shapes, and the active realm subscription reads
 `world_tile`, `world_tile_meta_v1`, `player_v2`, `castle`, `realm_v1`, and
 `realm_profile_v1`. It does not subscribe to the legacy `player` table, private
-ownership, founding claims, wallet records, Mark accounts, burn receipts, scan
-state, or Terms evidence.
+ownership, founding claims, Mark accounts, daily-grant receipts, retired
+compatibility state, or Terms evidence. Current Marks authority does not read a
+wallet or blockchain.
 
 The legacy module wires `get_my_admission_status` and `bootstrap_player` remain
 only for client/schema compatibility and immediately fail with
@@ -304,7 +305,7 @@ resolution continues to use the exact
 Hermes operators may read `admin_get_alpha_status_v3`, which returns only
 privacy-safe aggregate counts for the preserved legacy/v2 rows and the
 protocol-3 world, founding, profile, Terms, and private accounting invariants.
-It returns no FID, Identity, token, proof, cookie, wallet, receipt, or profile
+It returns no FID, Identity, token, proof, cookie, private receipt, or profile
 payload. It refuses the aggregate with `STATE_INTEGRITY` when canonical terrain,
 slot, claim, castle, occupancy, ownership, or accounting relationships drift.
 The browser separately requires protocol 3 plus the exact generation name and

docs/gameplay/marks-policy-v1.md

@@ -1,98 +1,54 @@
-# Marks policy v1
+# Community Marks policy
 
-Status: **Current v1 policy and account schema; production burn-credit application remains disabled**
-Policy ID: `snap-current-linked-wallet-1to1-v1`
-Last reviewed: 14 July 2026
+Status: **Current Alpha policy**
 
-Marks are Warpkeep's experimental Hegemony game-accounting unit. They are not a
-token, payment instrument, investment, transferable asset, or promise of a
-future benefit. Marks have no cash value, cannot be redeemed or transferred,
-and may be corrected, changed, or reset while the Alpha is experimental.
-
-## Conversion
-
-SNAP and Marks both use six decimal places. An eligible finalized burn is
-credited without rounding:
-
-- `1.000000 SNAP` burned becomes `1.000000 Mark` earned;
-- `0.250000 SNAP` burned becomes `0.250000 Mark` earned;
-- one SNAP micro-unit becomes one Mark micro-unit.
+Policy ID: `admitted-daily-mark-v1`
 
-For this policy version, spending is disabled and `spentMicros` remains zero.
-The authoritative invariant is `balanceMicros = earnedMicros - spentMicros`.
+Last reviewed: 31 July 2026
 
-## Pinned chain and event contract
-
-- network: Ethereum mainnet, chain ID `1`;
-- SNAP proxy: `0x49b5a631f54927c0007232844f06fe18cbf69786`;
-- first scannable proxy block: `25,012,691`;
-- token metadata: symbol `SNAP`, decimals `6`;
-- reviewed implementation: `0xe9a747d64790d3ed0b647455b2f7503636f5e98a`;
-- proxy bytecode hash: `0xa50288164ca4d99a6c559b6f601c35acc60fbf39e21b8c009d809ff35b955ed0`;
-- implementation bytecode hash: `0x56d5edb395905863637b94ca9fde441c401b42e8353ad6f84deaf201182bf7c7`;
-- `Burned(uint256,address,bytes32,uint256,uint32)` topic:
-  `0x2bd3de8e7296e5766033a01c8991401d3f0b8b1dde97f35302773b62b2b0f4dc`.
-
-This is an ordinary SNAP token burn on Ethereum mainnet. Warpkeep does not
-describe or credit it as a HyperSnap-specific burn. The event's third indexed
-argument is treated as opaque contract data and is never used to identify a
-player or determine eligibility.
-
-The scanner reads and reconciles chain ID `1` from both providers. It fails
-closed if proxy code, implementation pointer, implementation code, token
-metadata, event shape, source-chain field, or provider results differ from the
-pinned policy. It also reconciles the proxy's upgrade events throughout every
-scanned range and rechecks the approved implementation pointer, code hash, and
-canonical block hash at each distinct burn-event block. A contract upgrade
-pauses crediting until a new policy version is reviewed and published.
+Marks are Warpkeep's experimental Hegemony game-accounting unit. They are not
+a token, payment instrument, investment, transferable asset, or promise of a
+future benefit. Marks have no cash value, cannot be redeemed or transferred,
+and may be corrected, changed, or reset while the Alpha is experimental.
 
-## Finality and attribution
+## Daily grant
 
-Two separately configured Ethereum RPC providers must agree on the selected
-finalized block and its hash. Logs are fetched in bounded ranges of at most
-2,000 blocks, decoded independently, and compared exactly between providers,
-including the otherwise uninterpreted third indexed word.
-Removed, malformed, unfinalized, duplicated, or provider-disputed events are
-not credited.
+Each admitted player receives one Mark for each eligible daily grant processed
+by the Realm. One Mark is stored as exactly `1,000,000` integer micro-units;
+floating-point arithmetic is never accounting authority.
 
-A finalized burn is eligible only when its sender is currently present as the
-custody address or a verified EVM address for exactly one admitted FID in a
-trusted Farcaster snapshot. Missing links and links shared by multiple FIDs are
-quarantined. Historical wallet ownership is not inferred. One event key and one
-burn ID can each be credited at most once.
+Eligibility is derived by SpacetimeDB from server-owned admission and founding
+state. A browser cannot choose the recipient, amount, time, or policy. Disabled
+or revoked admission retains the existing balance but is not eligible for new
+daily grants. Re-entry does not create rewards for days spent outside the
+admitted Realm.
 
-Application is a private two-phase transaction. Batch begin freezes the exact
-finalized cursor, range boundary hashes, wallet snapshot generation and count,
-approved proxy/implementation code attestation, eligible event count, and
-eligible micros total without advancing the cursor. Receipts are bound to that
-pending batch. Finalize advances the cursor atomically only when the stored
-counters and an indexed receipt recount both equal the frozen plan. Exact
-receipt and batch retries are idempotent; a partial batch remains pending and
-resumable.
+Every grant is recorded and applied with replay protection. The private Mark
+account and any enabled public community projection are updated together. A
+retry for the same player and Realm day cannot issue a second Mark.
 
-## Privacy and visibility
+The Realm attempts the daily grant every hour so a temporary interruption can
+recover within the same UTC day. It does not guess historical eligibility: if
+the authority is unavailable for an entire UTC day, that day's grant is not
+created later. This avoids crediting periods when admission may have been
+revoked while the Realm was unavailable.
 
-Wallet snapshots, addresses, transaction references, block references, event
-receipts, scan batches, scan cursors, and the authoritative Mark account remain private
-server/operator state. Logs and public reports contain counts and policy status,
-not FIDs paired with addresses, raw addresses, transaction hashes, RPC URLs,
-tokens, or private upstream responses.
+## Visibility and privacy
 
-After a player's first intentional Alpha entry, the public realm profile may
-show privacy-bounded aggregate totals: SNAP burned, Marks earned, Marks spent,
-and Mark balance. It never exposes a linked address or individual event receipt.
-The browser never scans or connects wallets and never requests a signature,
-approval, transaction, payment, or custody.
+The authoritative Mark account and daily-grant receipts are private
+SpacetimeDB state. After a player's intentional Alpha entry, a public Realm
+profile may show the aggregate Mark balance. It does not expose private
+ownership, admission, authentication, or receipt records.
 
-## Correction and rollout
+Warpkeep does not scan a wallet or blockchain, request a transaction, or
+connect Marks to token activity. Marks remain separate from Food, Wood, Stone,
+and Gold and currently have no transfer, redemption, purchase, or financial
+reward loop.
 
-Credits are append-only receipts and balances are recomputed under the exact
-policy invariant. A discrepancy, ambiguous attribution, reorganization,
-provider disagreement, or implementation change stops the run for review; it
-is not silently overwritten. A correction requires an auditable additive
-policy/reducer action and must not edit production data without explicit
-approval.
+## Corrections and rollout
 
-No production scan, credit, schema publication, admission, or public-stat
-activation is implied by this document. Those remain separate, bounded rollout
-gates.
+A malformed account, duplicate grant key, invalid schedule, or inconsistent
+projection fails closed. Corrections require a reviewed additive authority
+path and explicit production approval; they are not performed by browser code.
+Module publication, activation, and any existing-account migration remain
+separate operational steps.

docs/legal/2026-07-31-hegemony-entry-agreement-v4.md

@@ -0,0 +1,24 @@
+# Hegemony Entry Agreement V3 → V4
+
+Entry-agreement bundle `2026-07-31-hegemony-entry-agreement-v4` links the
+current [Alpha Terms](../../public/terms/index.html) with Hegemony Social
+Contract version `2026-07-19-HEGEMONY-SOCIAL-CONTRACT-V3`.
+
+V4 removes the proposed wallet-linked burn mechanism from the current Alpha
+agreement. It describes Marks only as server-owned, non-transferable game
+accounting and discloses the automatic one-Mark grant for each eligible Realm
+day. The matching Privacy Notice explains the limited private account and
+daily-grant records without treating that notice as blanket consent.
+
+The Social Contract remains V3. Its conduct rules and fiction boundary are
+unchanged; its public bundle reference now identifies V4 so the accepted
+two-document set is unambiguous.
+
+The private `alpha_terms_acceptance_v1` table remains append-only. Existing V3
+rows stay immutable historical evidence and do not satisfy the V4 entry or
+gameplay gate. Each admitted participant must make one fresh, unchecked V4
+acceptance, recorded under
+`FID:2026-07-31-hegemony-entry-agreement-v4`.
+
+This agreement update does not itself grant admission, alter identity or castle
+ownership, or give the browser authority over balances or daily grants.