[Grid agent] Accept landmarks and provide authorized teleport and roaming workflows #130

New Issue

hugo · 2026-08-17T19:31:37Z

hugo commented

2026-08-17 19:31:37 +00:00

Objective

Allow authorized residents/operators to give the agent landmarks or folders of landmarks, teleport to approved destinations on command, and configure bounded random roaming intervals.

Intake and catalog

Accept inventory offers only through existing inventory/IM events and only when the sender UUID is authorized. Accept landmarks and folders whose resolved descendants are landmarks; reject or leave all other offers untouched according to documented grid semantics.
Defend against renamed/mis-typed items, cycles, deep/wide folders, duplicate links, stale offers, and post-accept permission changes. Bound traversal, catalog size, and asset fetches.
Persist a catalog with source sender, inventory UUID, asset UUID, display name, received time, validation state, and last outcome. Names/descriptions are untrusted data.

Teleport and roaming

Expose authorized commands to list/select catalog entries, teleport once, create/update/disable a schedule, and request status. Resolve by stable IDs; ambiguous names require clarification.
Use native landmark teleport APIs and lifecycle generation fencing. Report progress/failure, impose timeout/cooldown, avoid concurrent teleports, and settle before resuming behaviors.
Random roaming chooses without immediate repetition where possible using injectable randomness. Intervals have safe min/max bounds and no overlapping catch-up after downtime; missed runs are skipped. A schedule retains the authorizing principal and cannot exceed its policy.
Pause roaming during conversations, operator pause, degraded state, builds, or visual capture as configured. Cancel cleanly on shutdown/reconnect.

Acceptance criteria

Fake-grid/inventory tests cover authorized/unauthorized offers, nested folders, cycles, bad types, duplicates, accept/reject flow, teleports, failures, cooldown, schedule persistence, restart, and preemption.
Unauthorized chat/IM cannot accept inventory, alter schedules, or choose a destination.
Every selection and teleport is correlated to its source command/schedule and observable.
No L$, arbitrary inventory acceptance, or unbounded asset download is possible.

Dependencies

Depends on lifecycle, policy, inventory/perception, control plane, observability, and embodied behavior preemption.

## Objective Allow authorized residents/operators to give the agent landmarks or folders of landmarks, teleport to approved destinations on command, and configure bounded random roaming intervals. ## Intake and catalog - Accept inventory offers only through existing inventory/IM events and only when the sender UUID is authorized. Accept landmarks and folders whose resolved descendants are landmarks; reject or leave all other offers untouched according to documented grid semantics. - Defend against renamed/mis-typed items, cycles, deep/wide folders, duplicate links, stale offers, and post-accept permission changes. Bound traversal, catalog size, and asset fetches. - Persist a catalog with source sender, inventory UUID, asset UUID, display name, received time, validation state, and last outcome. Names/descriptions are untrusted data. ## Teleport and roaming - Expose authorized commands to list/select catalog entries, teleport once, create/update/disable a schedule, and request status. Resolve by stable IDs; ambiguous names require clarification. - Use native landmark teleport APIs and lifecycle generation fencing. Report progress/failure, impose timeout/cooldown, avoid concurrent teleports, and settle before resuming behaviors. - Random roaming chooses without immediate repetition where possible using injectable randomness. Intervals have safe min/max bounds and no overlapping catch-up after downtime; missed runs are skipped. A schedule retains the authorizing principal and cannot exceed its policy. - Pause roaming during conversations, operator pause, degraded state, builds, or visual capture as configured. Cancel cleanly on shutdown/reconnect. ## Acceptance criteria - [ ] Fake-grid/inventory tests cover authorized/unauthorized offers, nested folders, cycles, bad types, duplicates, accept/reject flow, teleports, failures, cooldown, schedule persistence, restart, and preemption. - [ ] Unauthorized chat/IM cannot accept inventory, alter schedules, or choose a destination. - [ ] Every selection and teleport is correlated to its source command/schedule and observable. - [ ] No L$, arbitrary inventory acceptance, or unbounded asset download is possible. ## Dependencies Depends on lifecycle, policy, inventory/perception, control plane, observability, and embodied behavior preemption.

hugo added this to the 14 - metacrate grid agent milestone 2026-08-17 19:31:37 +00:00

hugo added the enhancement label 2026-08-17 19:31:37 +00:00

hugo referenced this issue

2026-08-17 19:32:14 +00:00

implement an AI driven agent that runs in opensim #117

hugo referenced this issue from a commit

2026-08-18 09:08:52 +00:00

Implement authorized landmark roaming (#130)

hugo commented

2026-08-18 09:09:03 +00:00

Implemented and pushed in 08696cd.

Added native metacrate-grid-agent landmark intake/catalog/teleport/roaming. Authorized direct landmark and folder offers use existing compatibility events, lazy dedicated quarantine, authoritative post-receipt validation, bounded folder traversal/fetches, cycle/link/type/duplicate defenses, permission fingerprints, stale-offer pruning, and bounded atomic persistence. Policy tools list/status/select by stable ID, teleport, and configure schedules without accepting destination/avatar/coordinate/L$ fields; public and unauthorized IM are denied.

Teleport re-fetches type/asset/permissions, serializes attempts, applies timeout/cooldown/cancellation, preempts behavior, uses the native landmark API, and records bounded correlated observations. The owned roaming runner persists its principal and 24-hour/run envelope, injects randomness, avoids immediate repeats, skips catch-up, pauses for conversation/operator/degraded/build/capture gates, and cancels cleanly on shutdown/reconnect.

Verified: 9 focused landmark tests (offer authorization, nested folders, cycles/types/duplicates, ambiguity, permission/stale validation, failure/cooldown/cancellation, policy denial, persistence/restart, runner execution/preemption/pause); full metacrate-grid-agent suite (120 unit tests plus integration/doc tests); live-grid all-target check; strict Clippy; metacrate facade check; Rustdoc; dependency namespace/direction gate; consolidated CI audit.

Implemented and pushed in 08696cd. Added native metacrate-grid-agent landmark intake/catalog/teleport/roaming. Authorized direct landmark and folder offers use existing compatibility events, lazy dedicated quarantine, authoritative post-receipt validation, bounded folder traversal/fetches, cycle/link/type/duplicate defenses, permission fingerprints, stale-offer pruning, and bounded atomic persistence. Policy tools list/status/select by stable ID, teleport, and configure schedules without accepting destination/avatar/coordinate/L$ fields; public and unauthorized IM are denied. Teleport re-fetches type/asset/permissions, serializes attempts, applies timeout/cooldown/cancellation, preempts behavior, uses the native landmark API, and records bounded correlated observations. The owned roaming runner persists its principal and 24-hour/run envelope, injects randomness, avoids immediate repeats, skips catch-up, pauses for conversation/operator/degraded/build/capture gates, and cancels cleanly on shutdown/reconnect. Verified: 9 focused landmark tests (offer authorization, nested folders, cycles/types/duplicates, ambiguity, permission/stale validation, failure/cooldown/cancellation, policy denial, persistence/restart, runner execution/preemption/pause); full metacrate-grid-agent suite (120 unit tests plus integration/doc tests); live-grid all-target check; strict Clippy; metacrate facade check; Rustdoc; dependency namespace/direction gate; consolidated CI audit.

hugo closed this issue

2026-08-18 09:09:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/MetaCrate#130