RogueIntelligence Provider Ingestion, Review, Activation, and Runtime Lifecycle Audit

Full report

On this page

1. Architectural Principles and Lifecycle Governance (rogueintelligence-persona-lifecycle.md)

The deployment of generative agents within interactive simulacra necessitates a rigorous governance framework to prevent autonomous systems from exhibiting excessive agency or corrupting the live runtime environment1. The current integration architecture of RogueIntelligence exhibits a critical failure mode: treating the mere receipt of a provider-generated persona response as equivalent to runtime activation readiness. By storing provider character JSON as operator evidence while continuing to utilize deterministic staged text for live public projection, the system violates fundamental AI lifecycle governance and provenance standards. This misalignment masks the true operational state of the agent, blurring the boundary between local fallback staging and live provider-backed intelligence. To rectify this, RogueIntelligence must adopt an end-to-end lifecycle and integration specification grounded in the principles of explicit state separation, cryptographic provenance, and immutable human review. The integration of large language models (LLMs) into interactive environments requires agents to store experiences, synthesize memories, and dynamically retrieve them to plan behavior1. If the foundational persona injected into this memory stream is unverified, subject to prompt leakage, or suffering from persona collapse, the resulting emergent social behaviors will degrade into homogeneous, stereotypical, or hallucinatory outputs4. The specification detailed in this report enforces a strict finite state machine that completely isolates local fallback staging from provider requests, responses, and live character sessions. A character must traverse a gauntlet of cryptographic hash verification, schema validation, semantic consistency checks, and population diversity measurements before it can be presented for human narrative review. The human reviewer evaluates and locks an exact runtime fingerprint utilizing the JSON Canonicalization Scheme (JCS)6. Only after a separate, authored world activation record explicitly references this locked fingerprint can the character become eligible for runtime deployment. At runtime, the construction of dialogue requests must rigorously exclude administrative evidence and stale revisions, mitigating the attack surface for prompt injection and sensitive information disclosure8.

2. Character State Machine Specification

The governance of an AI agent from conception to permanent retirement requires a deterministic state machine that treats the entity as a bounded identity under stringent access control10. The following JSON specification (character-state-machine.json) delineates the nineteen required states governing the ingestion, review, and deployment of a persona.

JSON { "document": "character-state-machine.json", "version": "1.0.0", "states": { "draft": { "meaning": "Initial local conception. Persona attributes are proposed but no provider linkage exists. The identity is isolated from external LLM execution.", "entry\_conditions": \["User initiates new character workflow in local tooling."\], "required\_evidence": \["Local staging record ID", "Requested identity blueprint."\], "allowed\_transitions": \["local-fallback", "provider-request-pending", "deactivated"\], "forbidden\_transitions": \["provider-response-stored", "activation-eligible", "active"\], "user\_interface\_label": "Draft", "api\_representation": "DRAFT", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": false }, "local-fallback": { "meaning": "Local deterministic text is authored to serve as a baseline, strictly separated from live provider generation. This text serves as a failsafe but must never masquerade as AI-generated output.", "entry\_conditions": \["Minimum schema fields populated in staging record.", "Fallback text committed."\], "required\_evidence": \["Fallback text payload", "Fallback-quality status."\], "allowed\_transitions": \["draft", "provider-request-pending", "deactivated"\], "forbidden\_transitions": \["activation-eligible", "human-review-pending"\], "user\_interface\_label": "Local Staging", "api\_representation": "LOCAL\_FALLBACK", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": true, "exportable": true, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": false }, "provider-request-pending": { "meaning": "A request for a generated persona has been dispatched to the external provider. The agent's identity boundary is temporarily expanded to the external network.", "entry\_conditions": \["Provider linkage configured.", "Request payload successfully constructed."\], "required\_evidence": \["Provider evidence record ID", "Request body", "Timestamp"\], "allowed\_transitions": \["provider-request-failed", "provider-response-stored"\], "forbidden\_transitions": \["local-fallback", "draft"\], "user\_interface\_label": "Awaiting Provider", "api\_representation": "PROVIDER\_REQ\_PENDING", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": true }, "provider-request-failed": { "meaning": "The external provider failed to return a response due to timeout, complete outage, or transport error. The operation degrades gracefully.", "entry\_conditions": \["Transport layer exception", "Timeout threshold exceeded."\], "required\_evidence": \["Transport status code", "Error log reference."\], "allowed\_transitions": \["provider-request-pending", "local-fallback", "deactivated"\], "forbidden\_transitions": \["provider-response-stored", "provider-hash-verified"\], "user\_interface\_label": "Provider Failed", "api\_representation": "PROVIDER\_REQ\_FAILED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": false }, "provider-response-stored": { "meaning": "Raw payload from the provider is stored but unverified. Content remains highly untrusted and isolated from the human review pipeline.", "entry\_conditions": \["HTTP 200 OK from provider.", "Response payload captured in storage."\], "required\_evidence": \["Provider response ID", "Raw response body", "Response timestamp."\], "allowed\_transitions": \["provider-hash-verified", "provider-request-pending"\], "forbidden\_transitions": \["human-review-pending", "activation-eligible"\], "user\_interface\_label": "Response Received", "api\_representation": "PROVIDER\_RES\_STORED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": true }, "provider-hash-verified": { "meaning": "The RFC 8785 JSON Canonicalization Scheme (JCS) hash of the response matches the expected transport digest, ensuring no in-transit tampering occurred.", "entry\_conditions": \["JCS transformation successful.", "SHA-256 match validated."\], "required\_evidence": \["JCS Content hash", "Cryptographic verification flag."\], "allowed\_transitions": \["identity-validation-failed", "schema-validation-failed", "semantic-validation-failed", "population-validation-failed", "human-review-pending"\], "forbidden\_transitions": \["provider-response-stored"\], "user\_interface\_label": "Integrity Verified", "api\_representation": "HASH\_VERIFIED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": true }, "identity-validation-failed": { "meaning": "The provider response mutated immutable core identity markers (e.g., name, age) assigned during local drafting, presenting a substitution risk.", "entry\_conditions": \["Mismatch between local requested identity and resolved provider identity."\], "required\_evidence": \["Identity preservation diff", "Failed validation report."\], "allowed\_transitions": \["provider-request-pending", "draft", "deactivated"\], "forbidden\_transitions": \["human-review-pending"\], "user\_interface\_label": "Identity Mismatch", "api\_representation": "IDENTITY\_FAILED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": false }, "schema-validation-failed": { "meaning": "The response violates JSON Schema constraints, exhibiting missing fields, invalid types, or ID collisions.", "entry\_conditions": \["Draft 2020-12 Validator rejects payload based on schema URI."\], "required\_evidence": \["Schema version", "Validation error path."\], "allowed\_transitions": \["provider-request-pending", "draft", "deactivated"\], "forbidden\_transitions": \["human-review-pending"\], "user\_interface\_label": "Malformed Data", "api\_representation": "SCHEMA\_FAILED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": false }, "semantic-validation-failed": { "meaning": "The content contains logical contradictions, hallucinates lore violating system facts, or fails grammar thresholds, assessed via LLM-as-a-judge.", "entry\_conditions": \["Generative ontology validator flags structural logic faults."\], "required\_evidence": \["Semantic validation report", "Contradiction transcript."\], "allowed\_transitions": \["provider-request-pending", "draft", "deactivated"\], "forbidden\_transitions": \["human-review-pending"\], "user\_interface\_label": "Logic/Lore Error", "api\_representation": "SEMANTIC\_FAILED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": false }, "population-validation-failed": { "meaning": "The character contributes to persona collapse by lacking distinct semantic traits relative to the global population matrix, degrading social simulacra.", "entry\_conditions": \["Behavioral trait matrix embedding distance falls below uniqueness threshold."\], "required\_evidence": \["Cosine similarity score", "Population findings report."\], "allowed\_transitions": \["provider-request-pending", "draft", "deactivated"\], "forbidden\_transitions": \["human-review-pending"\], "user\_interface\_label": "Persona Collapse", "api\_representation": "POPULATION\_FAILED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": false }, "human-review-pending": { "meaning": "The response passed all automated validation gates and awaits manual narrative evaluation of the exact locked cryptographic fingerprint.", "entry\_conditions": \["Hash, identity, schema, semantic, and population checks passed."\], "required\_evidence": \["Consolidated validation report", "Locked runtime fingerprint."\], "allowed\_transitions": \["human-review-rejected", "human-review-accepted", "superseded", "deactivated"\], "forbidden\_transitions": \["activation-eligible", "active"\], "user\_interface\_label": "Awaiting Review", "api\_representation": "REVIEW\_PENDING", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": true, "human\_review\_allowed": true, "fingerprint\_change\_invalidates": true }, "human-review-rejected": { "meaning": "The human reviewer deemed the character unfit for deployment based on narrative, tone, or safety considerations.", "entry\_conditions": \["Reviewer submitted explicit rejection via governance portal."\], "required\_evidence": \["Reviewer ID", "Review timestamp", "Rejection rationale."\], "allowed\_transitions": \["provider-request-pending", "draft", "deactivated"\], "forbidden\_transitions": \["human-review-accepted", "activation-record-pending"\], "user\_interface\_label": "Rejected", "api\_representation": "REVIEW\_REJECTED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": false }, "human-review-accepted": { "meaning": "The human reviewer authorized the exact runtime fingerprint. The accepted version is permanently locked.", "entry\_conditions": \["Reviewer submitted explicit acceptance against the immutable JCS hash."\], "required\_evidence": \["Reviewer ID", "Review timestamp", "Accepted persona record.", "Accepted fingerprint."\], "allowed\_transitions": \["activation-record-pending", "superseded", "deactivated"\], "forbidden\_transitions": \["human-review-pending", "provider-request-pending"\], "user\_interface\_label": "Accepted", "api\_representation": "REVIEW\_ACCEPTED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": true, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": true }, "activation-record-pending": { "meaning": "The persona is approved, but lacks spatial, controller context, and memory namespace for world integration.", "entry\_conditions": \["Human review accepted."\], "required\_evidence": \["Accepted fingerprint reference."\], "allowed\_transitions": \["activation-eligible", "superseded", "deactivated"\], "forbidden\_transitions": \["active"\], "user\_interface\_label": "Awaiting World Auth", "api\_representation": "ACTIVATION\_PENDING", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": true }, "activation-eligible": { "meaning": "The character possesses a completed activation record linking the accepted fingerprint to world coordinates and a disclosed controller type.", "entry\_conditions": \["Activation record finalized.", "Controller disclosure established."\], "required\_evidence": \["Activation record ID", "World ID", "Controller type."\], "allowed\_transitions": \["active", "paused", "deactivated", "superseded"\], "forbidden\_transitions": \["provider-request-pending"\], "user\_interface\_label": "Ready for Runtime", "api\_representation": "ACTIVATION\_ELIGIBLE", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": true, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": true }, "active": { "meaning": "The character is live in the runtime environment, retrieving memories, planning behavior, and engaging in dynamic generative sessions.", "entry\_conditions": \["System orchestrator dispatches character to active scene."\], "required\_evidence": \["Live session record ID", "Activation timestamp."\], "allowed\_transitions": \["paused", "deactivated", "superseded"\], "forbidden\_transitions": \["activation-record-pending", "draft"\], "user\_interface\_label": "Live", "api\_representation": "ACTIVE", "visible\_to\_players": true, "runtime\_dialogue\_allowed": true, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": true }, "paused": { "meaning": "The character is temporarily removed from the live runtime due to outage, context overflow, or anomaly detection (e.g., hallucination spikes).", "entry\_conditions": \["Provider timeout", "Excessive agency detection", "Context window breach."\], "required\_evidence": \["Pause timestamp", "Suspension reason code."\], "allowed\_transitions": \["active", "deactivated", "superseded"\], "forbidden\_transitions": \["provider-request-pending"\], "user\_interface\_label": "Temporarily Unavailable", "api\_representation": "PAUSED", "visible\_to\_players": true, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": false, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": true }, "superseded": { "meaning": "The character revision was updated, rendering this exact fingerprint obsolete. Retained for audit and rollback.", "entry\_conditions": \["A new provider request cycle completes and is accepted for the same local identity."\], "required\_evidence": \["Supersession chain ID", "Next fingerprint reference."\], "allowed\_transitions": \[\], "forbidden\_transitions": \["active", "activation-eligible", "human-review-pending"\], "user\_interface\_label": "Archived Version", "api\_representation": "SUPERSEDED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": true, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": false }, "deactivated": { "meaning": "The character is permanently retired. Credentials, memory access tokens, and runtime API capabilities are irrevocably revoked.", "entry\_conditions": \["Administrative manual retirement", "Irrecoverable behavioral or safety violation."\], "required\_evidence": \["Deactivation timestamp", "Revocation log reference."\], "allowed\_transitions": \[\], "forbidden\_transitions": \["active", "paused", "draft", "provider-request-pending"\], "user\_interface\_label": "Retired", "api\_representation": "DEACTIVATED", "visible\_to\_players": false, "runtime\_dialogue\_allowed": false, "fallback\_dialogue\_allowed": false, "exportable": true, "human\_review\_allowed": false, "fingerprint\_change\_invalidates": false } } }

The state machine design above directly addresses lifecycle failure vectors identified in modern agentic frameworks. Agents operating in multi-agent environments require rigorous capability scoping11. When an AI agent transitions into the active state, it gains execution authority; if its underlying prompts or contextual memory stream become corrupted, the agent can translate a single instruction into an uncontrolled sequence of tool calls—a risk characterized as excessive agency (LLM06:2025)2. The inclusion of validation failure states (identity-validation-failed, schema-validation-failed, semantic-validation-failed, population-validation-failed) acts as a series of circuit breakers, ensuring that compromised, hallucinating, or homogeneous agents are blocked from reaching human-review-pending, let alone activation-eligible.

3. Required Record Separation and Data Schemas

The separation of local staging from provider intelligence necessitates distinct data structures. By leveraging the JSON Schema Draft 2020-12 specification, RogueIntelligence ensures structural determinism. The Draft 2020-12 update introduces critical mechanisms for this architecture, specifically the ability to combine $ref with sibling keywords, ensuring that descriptions, read-only flags, and constraints are processed alongside referenced external schemas rather than silently ignored as in older drafts12. This guarantees that nested persona attributes inherited from global world lore remain structurally intact during validation. Furthermore, the unevaluatedItems keyword enforces strict boundaries on what the provider can return, preventing the injection of unapproved attributes into the JSON payload13. The record structures must align with the W3C PROV-DM conceptual data model14. In this framework, the local authoring acts as the Agent generating an initial Entity (the draft record). The provider request is the Activity generating a new Entity (the provider evidence record), which must be tracked independently.

provider-evidence-record.schema.json

This schema captures the raw interaction with the external provider. It serves as an immutable evidence vault, capturing the request and the canonicalized response hash. It is explicitly separated from the activation candidate pool to prevent unreviewed AI output from entering the game database.

JSON { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://rogueintelligence.local/schemas/provider-evidence-record", "title": "Provider Evidence Record", "type": "object", "description": "Immutable log of external provider transaction. Never presented as a runtime candidate.", "properties": { "request\_id": { "type": "string", "format": "uuid" }, "response\_id": { "type": "string", "format": "uuid" }, "provider": { "type": "string" }, "model": { "type": "string" }, "timestamp": { "type": "string", "format": "date-time" }, "request\_body": { "type": "object", "description": "Exact JSON payload dispatched to the external provider API." }, "response\_body": { "type": "object", "description": "Raw JSON payload received, pre-validation." }, "content\_hash": { "type": "string", "description": "RFC 8785 JCS canonicalized SHA-256 hash representing the response fingerprint." }, "transport\_status": { "type": "integer" }, "schema\_version": { "type": "string" }, "raw\_evidence\_location": { "type": "string", "format": "uri" } }, "required": \[ "request\_id", "response\_id", "provider", "model", "timestamp", "content\_hash", "transport\_status" \], "additionalProperties": false }

accepted-persona-record.schema.json

Once human review concludes, the accepted-persona-record is instantiated. This schema acts as the definitive reference for the character's identity and generative capabilities, bound cryptographically to the exact hash accepted by the reviewer.

JSON { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://rogueintelligence.local/schemas/accepted-persona-record", "title": "Accepted Persona Record", "type": "object", "description": "The locked, validated, and human-approved projection of the AI agent.", "properties": { "exact\_accepted\_projection": { "type": "object", "description": "The synthesized character dossier merged according to the allowlisted policy." }, "runtime\_fingerprint": { "type": "string", "description": "The immutable JCS SHA-256 hash of the exact\_accepted\_projection." }, "human\_reviewer": { "type": "string" }, "review\_timestamp": { "type": "string", "format": "date-time" }, "validation\_versions": { "type": "object", "properties": { "schema\_validator": { "type": "string" }, "semantic\_validator": { "type": "string" }, "population\_validator": { "type": "string" } }, "required": \["schema\_validator", "semantic\_validator", "population\_validator"\] }, "provider\_response\_hash": { "type": "string" }, "identity\_preserved\_result": { "type": "boolean", "const": true }, "acceptance\_status": { "type": "string", "enum": \["ACCEPTED"\] }, "supersession\_chain": { "type": "string", "format": "uuid" } }, "required": \[ "exact\_accepted\_projection", "runtime\_fingerprint", "human\_reviewer", "review\_timestamp", "provider\_response\_hash", "identity\_preserved\_result", "acceptance\_status" \] }

activation-record.schema.json

The activation record explicitly maps a locked persona fingerprint to spatial, physical, and operational parameters within the simulation. This aligns with AI lifecycle risk management paradigms (such as ISO/IEC 42001\) which require defining intended operational boundaries before deployment16.

JSON { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://rogueintelligence.local/schemas/activation-record", "title": "Activation Record", "type": "object", "description": "Authored context bridging the accepted persona with the physical game runtime.", "properties": { "character\_id": { "type": "string", "format": "uuid" }, "accepted\_fingerprint": { "type": "string" }, "world\_id": { "type": "string" }, "location": { "type": "object", "properties": { "x": { "type": "number" }, "y": { "type": "number" }, "z": { "type": "number" } }, "required": \["x", "y", "z"\] }, "spawn\_conditions": { "type": "object" }, "controller\_type": { "type": "string", "enum": \["AI\_PROVIDER", "HUMAN", "DETERMINISTIC"\], "description": "Enforces mandatory controller disclosure." }, "runtime\_provider\_config\_ref": { "type": "string" }, "memory\_namespace": { "type": "string", "description": "Vector database partition key for semantic retrieval." }, "activation\_timestamp": { "type": "string", "format": "date-time" }, "deactivation\_conditions": { "type": "object" } }, "required": \[ "character\_id", "accepted\_fingerprint", "world\_id", "location", "controller\_type", "memory\_namespace" \] }

live-session-record.schema.json

During execution, generative agents require a memory stream architecture capable of observation, retrieval, and reflection1. The live session record captures these state changes dynamically while maintaining a continuous pointer to the original accepted fingerprint.

JSON { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://rogueintelligence.local/schemas/live-session-record", "title": "Live Session Record", "type": "object", "properties": { "session\_id": { "type": "string", "format": "uuid" }, "character\_id": { "type": "string", "format": "uuid" }, "accepted\_fingerprint": { "type": "string" }, "scene\_state": { "type": "object" }, "current\_participants": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "retrieved\_memory\_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "recent\_dialogue": { "type": "array", "items": { "type": "object" } }, "current\_emotional\_state": { "type": "string" }, "runtime\_provider\_request\_hashes": { "type": "array", "items": { "type": "string" } }, "runtime\_provider\_response\_hashes": { "type": "array", "items": { "type": "string" } }, "session\_revision": { "type": "integer" } }, "required": \[ "session\_id", "character\_id", "accepted\_fingerprint", "session\_revision", "runtime\_provider\_request\_hashes", "runtime\_provider\_response\_hashes" \] }

4. Provider-Response Merge Policy (provider-merge-policy.md)

The creation of the final exact\_accepted\_projection relies on merging local authoring data with the rich output generated by the LLM provider. However, unconstrained merging operations present severe risks of identity substitution and semantic contradiction17. RogueIntelligence must execute an allowlisted merge procedure to preserve structural integrity.

Merge Rules Matrix

Conflict Resolution and Build Process

When merging the provider output with the local baseline, RogueIntelligence employs generative ontology principles17. Conflicts are strictly forbidden. If a provider introduces a structural logic fault or invents an unsupported world fact (e.g., claiming a relationship with a non-existent faction), an LLM-as-a-judge system executing semantic validation rules will flag the deviation18. This immediately suspends the merge, logging the discrepancy in a semantic validation report and shifting the entity to semantic-validation-failed. If the provider omits an optional field, the merge logic strips the corresponding local fallback field rather than retaining it. The objective is to build an accepted projection that relies purely on what the provider intended to generate in its holistic response, preventing Frankenstein composites. The original fallback material is retained exclusively within the local staging record for compliance audits19. Crucially, if a later provider revision is initiated for the same character ID, the merge policy treats it as a completely isolated transaction. The resulting JCS hash of the new projection will inherently differ from the original. This action invalidates the previous human review approval, appending the new record to the supersession\_chain and returning the active character to the superseded state. The merge must never silently combine two different provider iterations.

5. Runtime Context Construction (runtime-context-construction.md)

Constructing the dialogue prompt for the live generative model during a session requires exacting precision. Bloated prompts degrade logical coherence, escalate inference costs, and exponentially increase the attack surface for Prompt Injection (LLM01:2025) and Sensitive Information Disclosure (LLM02:2025)2.

Required Context Constituents

RogueIntelligence must constrain the runtime request payload strictly to the following parameters:

• Accepted Projection: The immutable, fingerprinted character dossier (biography, dialect, psychological constraints).
• Scene State: Ephemeral physical context (time of day, spatial coordinates, weather).
• Relevant Memories: Information dynamically retrieved via cosine similarity using Sentence-BERT (SBERT) embeddings from the character's memory stream, weighted by relevance, recency, and importance1.
• Recent Dialogue: The immediate conversational transcript, constrained by a rolling window.
• Current Player Input: The immediate interaction stimulus.
• Runtime Truth Boundaries: Hard system instructions prioritizing safe and grounded responses to prevent hallucination2.
• Response-Format Constraints: Directives forcing the model to output strict JSON schemas for internal state updates alongside natural language dialogue.

Forbidden Context Constituents

Under no circumstances should the runtime request include:

• The entire authoring dossier or design documentation.
• Administrative evidence, audit trails, or validation reports.
• Provider request history (which can introduce contextual poisoning or adversarial strings)8.
• Data pertaining to unrelated characters or global player metrics.
• Stale revisions of the character's persona.
• Platform-safety material or UAI/UAIX diagnostics. Including these invites System Prompt Leakage (LLM07), allowing adversaries to reverse-engineer or bypass safety constraints9.

Operational Integration

At runtime, context precedence dictates that system constraints override character constraints, and character constraints override user inputs. This hierarchy hardens the model against jailbreaking attempts. Memory retrieval acts as the engine of continuity; however, failure to retrieve memories due to vector database latency must result in a safe degradation (generalized responses) rather than system panic or fabricated lore. Action proposal validation is enforced strictly through server authority—the LLM agent may propose an action (e.g., trading an item), but the game server validates the physics, inventory, and permissions before execution9. To manage cost controls, tokens are proactively monitored. If the context budget is nearing exhaustion, older dialogue is summarized and lower-importance memories are evicted before transmission. All player inputs are subjected to data sanitization pipelines to ensure privacy, masking personally identifiable information (PII) before it crosses the boundary to external API providers20.

6. Fallback and Outage Policy (fallback-and-outage-policy.md)

When the external provider connection degrades, RogueIntelligence must degrade safely and transparently. AI agent lifecycle governance demands explicit visibility of diminished capability10. The system must enforce a strict prohibition against local deterministic fallback dialogue masquerading as live provider-generated content. Such masquerading violates controller disclosure requirements and undermines player trust. The architecture delineates specific behaviors based on the nature of the outage:

• Temporary Provider Timeout: If the API times out (e.g., \> 3000ms), the system implements an exponential backoff retry mechanism (maximum 2 retries). If unresolved, the character transitions to a paused state, displaying a visually distinct Temporarily unavailable status indicator.
• Complete Provider Outage: During prolonged API downtime, the character may switch to a Limited authored fallback mode. This must be a physically distinct interface (e.g., a grayed-out, non-interactive dialogue box) presenting static text that explicitly notifies the user of the generative suspension.
• Invalid Provider Response: If the model outputs malformed JSON or triggers an excessive agency guardrail (e.g., hallucinating a weapon it does not possess), the response is swallowed, and the agent is immediately paused to protect scene integrity2.
• Context Overflow: If proactive token checks determine the context window will be breached and summarization fails, the agent transitions to Awaiting provider until the conversational state can be safely condensed.
• Memory Retrieval Failure: If the embedding database is unreachable, the agent operates in a diminished capacity, utilizing only the base projection and recent dialogue.
• Stale Fingerprint / Unreviewed Character: If an entity is requested that has not completed human review or possesses an invalid JCS hash, the system blocks interaction entirely, flagging the character as Not activation eligible in both the API and player interface.

7. Human Narrative Review Workflow (human-review-workflow.md)

Human oversight serves as the paramount governance gate, preventing misaligned model behaviors, biases, and excessive agency from entering production2. The human narrative review is not a cursory check; it is a cryptographic authorization. The reviewer operates within a dedicated portal that evaluates the exact, immutable, fingerprinted version of the persona. The review interface requires the evaluator to process multiple data points simultaneously:

• Requested vs. Resolved Identity: A visual diff highlighting demographic drift to ensure the LLM did not substitute core traits.
• Integrity Markers: Display of the RFC 8785 JCS Provider Response Hash and the proposed Runtime Fingerprint, proving cryptographic integrity6.
• Narrative Elements: The generated biography, relationship maps, dialogue examples, and ordinary-life continuity proposals.
• Memory Bootstrap: Verification of seeded initial memories to ensure historical grounding1.
• Validation Findings: Detailed alerts from the semantic and schema checks, highlighting any detected logical faults.
• Population Findings: A critical metric preventing "Persona Collapse." The reviewer examines the character's embedding distance relative to the global population. LLMs often converge into narrow behavioral modes, producing a homogeneous population that defaults to demographic stereotypes4. The review interface highlights Coverage, Uniformity, and Complexity metrics to ensure the persona contributes distinct semantic value to the simulacra4.
• Unsupported World Facts: Flags for hallucinations, such as the character claiming to inhabit an unbuilt region.
• Controller Disclosure: A compliance check ensuring players will be notified that the entity is AI-controlled, as mandated by emerging standards22.

The reviewer's decision to accept the persona cryptographically signs the runtime fingerprint. Modifying even a single character post-approval fundamentally alters the canonicalized hash, immediately invalidating the review and forcing a supersession cycle23.

8. Audit and Provenance Model (audit-and-provenance-model.md)

The integrity of RogueIntelligence relies on an append-only traceability framework compliant with the W3C PROV-DM conceptual data model. This standard distinguishes core structures—Entities, Activities, and Agents—allowing the system to map the entire lifecycle of a piece of data15.

• Immutable Evidence Blocks: Every lifecycle transition generates a read-only log event. Provider requests, responses, schema validations, human reviews, fingerprint locks, activations, runtime inferences, and deactivations are stored as discrete PROV-DM entities generated by specific system activities.
• Cryptographic Anchoring (JCS): To achieve true determinism, all JSON payloads are serialized according to the JSON Canonicalization Scheme (RFC 8785\) prior to hashing. This specification enforces strict rules: lexicographical sorting of object keys via UTF-16 code units, absolute removal of whitespace, and precise IEEE 754 number handling6. The resulting SHA-256 hash serves as an irrefutable cryptographic fingerprint.
• Redaction Policy: If PII or sensitive API keys are inadvertently captured in provider responses, they cannot simply be deleted without breaking the hash chain. RogueIntelligence utilizes ObjectHash principles, redacting the sensitive string by replacing it with a hash of itself, preserving the overall structural geometry and verifying the payload while masking the violation7.
• Interface Exclusions: While transparency is necessary for system operators, administrative provenance (exact timestamps of human review, internal JCS hashes, SBERT scores) is strictly excluded from player-facing interfaces to preserve narrative immersion. Only the Controller Type and the active/paused status are exposed to fulfill AI disclosure mandates16.

9. Required Failure Scenario Catalog (failure-scenario-catalog.json)

To maintain stability across adversarial manipulation, probabilistic model output, and infrastructural failure, RogueIntelligence must codify responses to specific failure modes. This catalog maps the detection vectors, state transitions, and audit requirements for twenty critical scenarios.

10. Activation Readiness Checklist (activation-readiness-checklist.md)

System orchestrators must execute this non-bypassable sequence. A character must not transition to activation-eligible until every condition evaluates to true, verifying that technical, semantic, and compliance obligations are fulfilled.

• \[x\] Provider Response Anchored: Live provider response is securely stored in an isolated provider evidence record.
• \[x\] Cryptographic Verification: Provider content hash is verified using RFC 8785 JCS canonicalization6.
• \[x\] Identity Fidelity: Requested identity (name, demographic core) is preserved without mutation.
• \[x\] Structural Integrity: Schema validation passes completely against Draft 2020-12 specifications, resolving all $ref paths12.
• \[x\] Logical Consistency: Semantic validation passes via LLM-as-a-judge; no hard contradictions or generative ontology errors remain17.
• \[x\] Population Variance: Population validation passes; the persona contributes measurable diversity (Coverage, Uniformity, Complexity) and avoids persona collapse4.
• \[x\] Memory Integrity: Memory bootstrap contains stable, UUID-tracked IDs with clean provenance3.
• \[x\] Fingerprint Locked: The runtime fingerprint is cryptographically locked and mathematically immutable.
• \[x\] Human Oversight: A human reviewer has accepted that exact, unadulterated fingerprint.
• \[x\] Spatial Assignment: The authored world activation record successfully references the locked fingerprint.
• \[x\] Runtime Configured: The runtime provider configuration references are valid, authenticated, and responding.
• \[x\] Compliance Met: Controller type (AI Agent) is explicitly disclosed in the interface layout, adhering to IEEE/ISO governance standards16.

11. Source Register (source-register.csv)

The research dependencies utilized to construct these architectural, security, and schema boundaries are structured below.

Code snippet document\_id,reference\_topic,source\_ids rogueintelligence-persona-lifecycle.md,Generative Agents & Memory Systems,"1, 2, 4, 6" audit-and-provenance-model.md,W3C PROV-DM & Provenance Models,"7, 8, 9, 10, 11, 12" record-schemas.json,JSON Schema 2020-12 Standard,"13, 14, 15, 17, 18" human-review-workflow.md,AI Agent Governance & Disclosure,"19, 20, 21, 24" provider-merge-policy.md,RFC 8785 JSON Canonicalization Scheme (JCS),"25, 27, 28, 29, 30" runtime-context-construction.md,OWASP Top 10 for LLMs (Prompt Injection & Safety),"31, 32, 33, 36" failure-scenario-catalog.json,Population Diversity & Persona Collapse,"37, 39, 40, 41" activation-readiness-checklist.md,Semantic Validation & LLM Agents,"42, 45, 47, 48"

Works cited

1. \[2304.03442\] Generative Agents: Interactive Simulacra of Human Behavior \- ar5iv \- arXiv, https://ar5iv.labs.arxiv.org/html/2304.03442

2. OWASP Top 10 for LLMs (2026) Security Testing & Mitigation Guide for AI Applications, https://www.siemba.io/owasp-top-10-llm-security-testing

3. Generative Agents: Interactive Simulacra of Human Behavior \- arXiv, https://arxiv.org/pdf/2304.03442

4. The Chameleon's Limit: Investigating Persona Collapse and Homogenization in Large Language Models \- arXiv, https://arxiv.org/html/2604.24698v1

5. Evolutionary Multi-Objective Prompt Learning for Synthetic Text Data Generation with Black-Box Large Language Models \- MDPI, https://www.mdpi.com/2076-3417/16/8/3623

6. The Vaara Receipt: A Recomputable Receipt Format for Decisions About Agent Actions, https://www.ietf.org/archive/id/draft-sirkkavaara-vaara-receipt-05.html

7. Determinism: Why Consistent Encodings Matter \- The CBOR, dCBOR, and Gordian Envelope Book, https://cborbook.com/part\_2/determinism.html

8. What are the OWASP Top 10 risks for LLMs? \- Cloudflare, https://www.cloudflare.com/learning/ai/owasp-top-10-risks-for-llms/

9. OWASP Top 10 AI Vulnerabilities Explained | Kiuwan, https://www.kiuwan.com/blog/owasp-top-10-ai-vulnerabilities-explained/

10. What Is AI Agent Lifecycle Governance? Definition & Examples, https://nhimg.org/glossary/ai-agent-lifecycle-governance/

11. Zero-Shot MARL Coordination and Theory-of-Mind Benchmarking of LLM Agents for Strategic Deception \- Robotics Institute Carnegie Mellon University, https://publications.ri.cmu.edu/storage/publications/2026/06/Karan\_Mirakhor\_MSR\_Thesis\_20260626164259.pdf

12. JSON Schema Draft 4 vs Draft 7 vs 2020-12: What Changed | theproductguy.in, https://theproductguy.in/blogs/json-schema-draft-comparison/

13. Draft 2020-12 \- JSON Schema, https://json-schema.org/draft/2020-12

14. PROV-DM: The PROV Data Model \- W3C, https://www.w3.org/2012/10/prov-dm

15. W3C Prov \- Wikipedia, https://en.wikipedia.org/wiki/W3C\_Prov

16. AI lifecycle risk management: ISO/IEC 42001:2023 for AI governance | AWS Security Blog, https://aws.amazon.com/blogs/security/ai-lifecycle-risk-management-iso-iec-420012023-for-ai-governance/

17. Generative Ontology: When Structured Knowledge Learns to Create \- arXiv, https://arxiv.org/html/2602.05636v2

18. Towards an Agentic LLM-based Approach to Requirement Formalization from Unstructured Specifications \- arXiv, https://arxiv.org/html/2604.18228v1

19. PROV-DM: The PROV Data Model \- W3C, https://www.w3.org/TR/2012/CR-prov-dm-20121211/diff.html

20. OWASP Top 10 for LLM Applications 2025 \- InSight Crime, https://insightcrime.org/wp-content/uploads/2026/01/LLMAll\_en-US\_FINAL.pdf

21. 9 March 2026 Peter Cihon, Senior Advisor Center for AI Standards and Innovation (CAISI) National Institute of Standards and T \- IEEE-USA, https://ieeeusa.org/assets/public-policy/policy-log/2026/IEEE-USA-NIST-RFI-Agentic-AI-030926.pdf

22. P7022 \- IEEE SA, https://standards.ieee.org/ieee/7022/12533

23. Bonus: A Word About JCS and SHA-256 | Entity Veracity, https://bonus-jcs-entityveracity.super-intelligent.ai/

24. Recommendation ITU-T X.590 (10/2023) JSON Signature Scheme (JSS), https://www.itu.int/rec/dologin\_pub.asp?lang=e\&id=T-REC-X.590-202310-I\!\!PDF-E\&type=items

25. JSON Schema 2020-12, https://www.learnjsonschema.com/2020-12/

26. Recommendation ITU-T X.590 (10/2023) \- JSON signature scheme (JSS), https://www.itu.int/epublications/publication/itu-t-x-590-2023-10-json-signature-scheme-jss

27. Building High-Quality AI Agents — A Comprehensive, Actionable Field Guide \- DEV Community, https://dev.to/truongpx396/building-high-quality-ai-agents-a-comprehensive-actionable-field-guide-5m1

28. SemaPop: Semantic-Persona Conditioned Population Synthesis \- arXiv, https://arxiv.org/html/2602.11569v1

29. \[R\] Generative Agents: Interactive Simulacra of Human Behavior \- Joon Sung Park et al Stanford University 2023 : r/MachineLearning \- Reddit, https://www.reddit.com/r/MachineLearning/comments/12hluz1/r\_generative\_agents\_interactive\_simulacra\_of/