CMOnet

Current evidence summary — generated from docs/evidence/ledger.json by tools/evidence.py render. The authoritative current status is docs/STATUS.md; where older text in this document disagrees, docs/STATUS.md wins.

• Current qualification runtime: v1.10 - Build 1900.20, scenario AI TEST SCENARIO, side AI, proxy v22-t6-build4-outbox1 (rt-1900.20-6ea83b7ddca3).
• Game reads: 38 (35 verified normal operation, 3 implemented but unverified).
• Game writes: 68 (2 verified normal operation, 62 verified at an earlier adapter revision only, 4 implemented but unverified).
• Prohibited/blocked definitions: 11; application-local definitions: 123.
• Roadmap qualification records: 7.0: 3 decided, 9 passed; 8: 8 passed; 9: 4 passed; 10: 4 passed; 11: 1 decided, 3 passed; 12: 3 decided, 2 passed; 13: 3 decided, 1 partial, 10 passed.
• Live evidence is exact to its runtime tuple and never transfers to another build, scenario, side or adapter revision; a library sync changes every library write's revision, and tools/qualify_library.py verifies them again.

Versions

The version lives in src/cmonet/__init__.py; the page footer, /healthz and /api/v1/status show it. Every pull request raises it once (owner decision 2026-10-13): open PRs with python tools/pr.py --title "...", which bumps the patch version with tools/version.py, commits it as "Version X.Y.Z ()" and pushes the PR to git.vlyons.net (a PR stacked on another one gets its own bump). python tools/check.py fails if a copy of the version disagrees. 0.7.0 (2026-10-13) follows 0.6.3 and covers the work through roadmap Stage 13.

CMOnet is a local, shared command center for Command Modern Operations. The text below grew from v0.6.3, which added a functional General-only LLM command path while retaining an explicit general_and_commanders option for later use. General-only is the default; it consolidates existing application ownership under the General, retires Commander work safely, and removes Commander-only tools from model packets.

General-only live integration

• Model input is a fresh, task-specific decision capsule: active presidential intent and fixed policy are retained, routine events are coalesced, observations are columnar and geographically diverse, and tool continuations keep correlated outcomes within explicit character budgets.
• One persistent provider queue still defaults to one actual upstream request. Complete fenced JSON replies are accepted; partial/malformed replies never execute tools.
• Game writes run only in the human-selected Controlled actions mode (operator policy 2026-09-22) for installed normal-player adapters on the selected side. A browser, model, settings flag or caller attestation cannot create that authority, and fresh identity/ownership/native checks, reservations and independent read-back still apply to every write.
• Live verification history is reported separately from permission. Which operations have an exact live read-back on which build/scenario/side is generated in docs/STATUS.md from the evidence ledger; this README no longer carries a hand-maintained count.
• Observation stays on the governed legacy reader plus the optional CMO event bridge (transport decision). The framed T9 telemetry session was retired on 2026-10-15 (owner decision 11, lifecycle plan); the injector's world cache replaces it.

See the extended-control status, the exact existing live record, deterministic socket evidence, capabilities, and migration.

Roadmap stages 7.0–13 (working tree)

The future development roadmap is implemented as follows; each stage's gate status is generated in docs/STATUS.md.

• 7.0 evidence and qualification — one evidence ledger and generated status; fog-of-war, backup/restore/rollback, deployment, map-provider, degradation and clock-rollback drills and live connected soaks under docs/verification/stage7/; transport decision.
• 8 perception — live read qualification, readiness/fuel coverage and a typed-event drill (docs/verification/stage8/); typed events, picture summaries, engagement links and policy evidence (world model).
• 9 execution — live write qualification, the mission lifecycle and the composite operations from CMOnet through a scripted General, with the Build 1900.20 adapter fixes they found (write qualification); a static no-shortcuts audit (tools/audit_no_shortcuts.py).
• 10 planning — deterministic planning engine and planning.* tools (engine).
• 11 tactical execution — closed-loop managers, oscillation guard and tactical.* tools, with live fault cases (track/support loss, missed window, bingo, deviation, launch delay, external edit) (tactical execution).
• 12 laboratory — corpus, capture/replay (run on live decisions), AAR, candidate evaluation and approval (laboratory).
• 13 evaluation and hardening — human-parity evaluation harness and claim gates (evaluation); metrics, integrity, watchdog with opt-in hang detection, TLS, secret storage, evidence export, release integrity, dependency review and soak, each with a drill (runtime hardening, docs/verification/stage13/).

Items that need things CMOnet cannot supply — operator scenario saves and human trial participants — are recorded as blocked_external with their harnesses ready. CMOnet never changes time compression; accelerated runs use the compression the operator set.

The existing hierarchy, rules, reset/recovery, provider configuration, observations, audit history, catalog, mapping/cache, replay and low-impact serialized CMO socket governor remain in force. Observation jobs, built-in job benchmarks and Lua Bench share that same governor; Lua Bench does not create another socket writer or consume an LLM slot.

Human Lua and LLM boundary (2026-09-29). The LLM agents act only through CMOnet's reviewed tools: rule proposals containing Lua are rejected, rules.inspect withholds human Lua source, and Lua Bench activity is excluded from agent event feeds. Lua Bench now runs human-authored Lua as written (reads and writes, multi-line, any side) through the same governor; SELECTED_SIDE holds the selected side GUID, and results stay in Lua Bench history. This supersedes the read-only, selected-side Lua Bench limits described in the v0.6.2 notes below. Rules also accept human-authored cmo_lua conditions (run live once per refresh for all scoped entities via ENTITIES, returning a boolean or {[game_id]=boolean}) and cmo_lua actions (run once per fired entity with ENTITY_ID); previews never run them, and their output stays in the rule run. Promoted Lua Bench drafts can be registered as Lua jobs (Jobs → Lua jobs): each runs as written every N real seconds (5–86,400) when enabled, one due job at a time through the governor, with the last 50 results kept per job and never shown to agents. Schema 11 adds their tables.

v0.6.3 clock compatibility hotfix

• Fixes live probe failures where VP_GetScenario().CurrentTime is present but is not a finite numeric Unix timestamp.
• Collectors now prefer the read-only ScenEdit_CurrentTime() UTC Unix timestamp when exposed, and retain numeric Scenario.CurrentTime only as a compatibility fallback.
• Successful scenario samples record clock_source so diagnostics show which path actually worked.
• Lua Bench now exposes ScenEdit_CurrentTime() in its read-only capability environment for direct timing/shape tests.
• The operator-supplied commandlua-docs.zip does not contain a function page for ScenEdit_CurrentTime; CMOnet therefore labels it compatibility-only rather than uploaded-doc verified. Current official Command Lua documentation is the secondary reference, and live read-only verification remains required.
• Schema remains 8; this hotfix does not migrate or rewrite operational data.

v0.6.2 Jobs and Lua Bench

• Jobs expose mode, triggers, freshness, last/next reason, coverage, duration and exact Lua provenance.
• Configuration/loadout/local doctrine is explicitly trigger-only with no periodic reconciliation.
• Contacts use a compact whole-side snapshot; missions and areas use triggered snapshots with slower safety reconciliation.
• Lua Bench supports read-only Lua experiments, 1–25 measured runs, 0–5 warm-ups, raw/parsed output, queue/first-byte/round-trip/parse/total timing, request/response bytes, saved snippets, run comparison and disabled job-draft promotion.
• State-changing Lua Bench remains blocked until player-equivalent live-write authority is verified; the console cannot bypass CMOnet permissions.
• Command Lua dependencies are audited against the operator-supplied documentation. ScenEdit_GetUnit, ScenEdit_SetUnit and the other declared ScenEdit_* dependencies are documented; VP_GetScenario, VP_GetSide and VP_GetSides remain explicitly compatibility-only pending live read-only probes.

See docs/stage6.2/JOBS_AND_LUA_BENCH.md for the full design and docs/verification/stage6.2/STATUS.md for exact evidence.

v0.6.1 overlap-selection correction

When a map click intersects multiple symbols, the floating list now keeps that exact overlap scope across live world updates, periodic summary refreshes, and selection changes. Stage 6 previously rendered the clicked candidates correctly, then a routine refresh rerendered the same open panel as the complete observed roster. Overlap scope is now stored by stable entity ID until the panel is closed, a single/empty map location is clicked, or the user deliberately opens/searches the full Entities roster. Timeline/world resets discard the old overlap scope.

Important boundaries

• Live game-changing actions remain operation-scoped. Three legacy operations are authorized only for the exact currently verified build/scenario/CHINA tuple. New source handlers are not authority: exact 7.0.0 evidence is required per operation, and unimplemented writes remain blocked.
• Mapping is geographical context only. Tiles are never game intelligence and are never sent to agents as observations.
• The bundled Natural Earth map is the safe startup default. Online mapping is opt-in.
• Bing Maps was evaluated first as required, but Microsoft retired free Bing Maps Basic accounts. CMOnet therefore keeps the Bing adapter visible as unavailable and does not embed a key, hard-code current Bing tile URLs, create Azure resources, or silently use a paid service.
• OpenStreetMap Standard is available as an explicitly enabled free interactive fallback. CMOnet requests only viewport tiles, supplies attribution, respects server cache headers, defaults missing cache metadata to a seven-day lifetime, and provides no bulk/offline downloader.

Upgrade

1. Disconnect and stop CMOnet. Back up the existing data/ directory. CMO may remain running.
2. Extract this release into a fresh folder. Copy the old data/ directory into the new CMOnet folder. Do not copy the old source or .venv.
3. Run start.bat, hard-refresh the browser (Ctrl+F5), and confirm the version in the page footer is the release's (python tools/version.py prints it).
4. Keep the CMO socket, timeout, job and observation-load settings that already work for your machine. The v22 proxy's documented legacy request frame is a CRLF blank line; new installs select it by default, while upgraded explicit delimiter choices remain unchanged. Reconnect and select the AI side normally.
5. Open Maps. Natural Earth remains active until you deliberately test/enable an online provider. Use Test provider before switching to OpenStreetMap on the controller that will actually retrieve tiles.

A recognized older data root upgrades sequentially to schema 10, with a verified private SQLite backup before each schema change. Schema 9 adds exact runtime-capability evidence; schema 20 drops the retired T9 telemetry settings. Migrations do not replay game actions or alter CMO. Map cache files remain separate under data/map-cache/, so catalog replacement, AI-memory reset and log clearing do not delete them.

Stage 6.2 workspaces

• Operations — map-first live side-limited picture and contextual presidential actions.
• Staff Views — forces/OOB and accountable ownership, readiness/resources, intelligence/contact needs, policies/holds, and operations/blockers using shared state without creating extra LLM agents.
• Attention Center — consolidated rule/supervisor incidents, policy evidence and holds. Acknowledging an item does not resolve it or alter CMO.
• History / Replay — read-only historical observation reconstruction by timeline and optional simulation cutoff. Historical mode never enables live order submission and does not claim perfect reconstruction where polling was sparse.
• Maps — provider availability/testing, shared cache status, download pause/resume and provider/all-cache clearing.
• Existing Command, Hierarchy / Plans, Agent Profiles, LLM Queue, Rules, Jobs, Diagnostics, Command Audit, Catalog and Settings remain available.

Mapping and persistent cache

Retrieval is browser viewport → CMOnet cache → validated online fetch if allowed → atomic host-disk write → browser response. Multiple browsers asking for the same missing tile share one in-flight fetch. Downloads use their own bounded path and never consume the CMO socket or an LLM slot.

Default map mode is cache_only with natural_earth. For online OSM use, switch mode to online, test the provider, then select it. Cache controls expose path, tile count, disk use, free disk, active downloads and recent failures. Storage limit and minimum-free-space settings stop new writes rather than silently filling the drive.

The browser renders raster tiles independently of operational overlays. Pan/zoom requests only visible tiles plus the configured zero/one tile margin. Dateline X coordinates wrap; Web-Mercator latitude is clamped. Provider changes do not restart agents, reset selection, or intentionally move the camera.

See docs/stage6/MAPPING_AND_CACHE.md for provider evidence and implementation limits.

Per-browser map/workspace behavior

Camera, labels, symbol size and selected entity remain browser-local. The Layers panel includes named World Overview, Regional Operations, and Detailed Inspection view slots; each can save/load the current camera and display settings without modifying game state or agent priority. Provider/cache configuration remains shared controller configuration.

Live updates continue through the shared browser event stream and preserve unsent order/settings drafts through the existing revision/conflict protections.

Historical replay

Replay reconstructs the latest retained significant observation per entity at a selected historical cutoff. It preserves the record as it was stored at that time; later classification is not substituted into the old record. It is explicitly incomplete when polling/history retention did not capture a transient event.

Replay is an application history view. It does not rewind, pause, load, or otherwise change CMO.

Free map-provider status

• Bing satellite: candidate adapter retained, online use disabled because free Basic service is retired. Microsoft also documents dynamic imagery metadata rather than stable hard-coded tile URLs. No paid Azure fallback is enabled.
• OpenStreetMap Standard: optional free interactive fallback. The public tile service is not an unlimited CDN; no bulk/offline prefetch exists and local caching follows response metadata/default minimum caching behavior.
• Natural Earth: bundled low-resolution physical geography, public-domain source, no online dependency.

Provider availability and terms can change. The application exposes explicit status and failure rather than silently changing providers.

Start and deployment

Windows: run start.bat with Python 3.12+. Prebuilt browser assets are included; Node is only needed to rebuild the TypeScript frontend.

./start.sh --no-browser
./start.sh --port 8090 --data-dir /path/to/cmonet-data
# Docker
docker compose up --build -d

Use one controller process per data root. LAN browsers connect to that shared controller; they do not create another General, observation collector, LLM queue or socket writer.

For development, start-reload.bat (or ./start.sh --reload) takes the same options and restarts the controller when a Python file under src/cmonet/ is saved. Each reload is a planned restart: open browser event streams end and reconnect, an already-submitted model turn drains first, and the game socket must be reconnected afterwards. Other files do not trigger a reload: refresh the browser for web assets (including rebuilt web/dist JavaScript), Lua scripts are read when used, and cached resources such as resources/operations.json need a manual restart. After a failed import (for example a syntax error), the reloader waits for the fix; once recovered, stopping may need a second Ctrl+C, as the first can stop only the controller.

Development checks

python -m pip install -r requirements-dev.txt
python tools/check.py
cd frontend && npm install && npm run build
cd ..
python tools/check.py --tsc frontend/node_modules/typescript/bin/tsc
python tools/check.py --rev HEAD
pytest -q tests/stage6

--rev checks one committed revision in a throwaway worktree under .tmp-check, so it can run in the background while work goes on; it ends with CHECK PASSED <sha> or CHECK FAILED <sha>. A worktree without frontend/node_modules uses the main checkout's TypeScript compiler.

The check lints with ruff's pyflakes rules (unused or undefined names; ruff check alone, configured in pyproject.toml) and runs the tests across processes with pytest-xdist (-n auto --dist loadfile), both from requirements-dev.txt; without them it says the lint was not run and runs the tests in one process.

tests/frontend opens the shipped command center and Scenario Builder pages in headless Chrome or Edge through Playwright (requirements-dev.txt); those tests skip when no browser is installed.

Stage 6.3 tests are synthetic/local unless explicitly stated otherwise. See docs/verification/stage6.3/STATUS.md for the clock hotfix evidence and docs/verification/stage6.2/STATUS.md for the underlying Jobs/Lua Bench release evidence.

What Stage 6 does not claim

This build does not claim live Bing/OSM retrieval was exercised from the build container, native-browser/LAN scale targets were met, all normal player actions are implemented, the opposing side was destroyed, or a 500+ vs 500+ accelerated scenario passed. A fixture, cached tile, successful model reply, setter return, or partial T9 report is never promoted to in-game proof.