Dwarf Society — Per-Dwarf Agent Experiment

§00 · Decision

Build an emergent society, not another fortress bot

The experiment targets Windows Steam/Premium Dwarf Fortress 53.15 with DFHack 53.15-r2. [TESTED 2026-07-13] The game is installed at D:\SteamLibrary\steamapps\common\Dwarf Fortress; Steam stable installed DFHack 53.15-r2 at D:\SteamLibrary\steamapps\common\DFHack, and dfhack-run version verified the match. The experiment starts from a fixed seven-dwarf embark and runs through one in-game season under a clocked pause-and-step loop. Each dwarf receives an individual logical identity, private episodic memory, game-canonical personality, bounded knowledge, goals, commitments, and the ability to accept, refuse, converse, propose, and lead.

The architecture is one external society engine beside the game, one thin DFHack bridge, and one shared local-model runtime on the Mac Studio. Dwarves are separate agents because they have separate durable selves and authority—not because seven model processes run at once. Model calls are serialized and event-driven.

§01 · Goal & proof

What the first version must demonstrate

The first version is successful when a human can follow a causal chain from a dwarf's game-generated character and knowledge, through an individual or civic decision, to a legal change in one real fortress. Survival constrains the experiment; believable, differentiated agency is the point.

§02 · Operating principles

Preserve the simulation instead of replacing it

1. Intent-level embodiment. Agents choose goals, work responses, conversations, requests, promises, and proposals. Dwarf Fortress retains pathfinding, job execution, physics, needs, combat, and consequences.
2. Separate selves, shared inference. One model may implement many agents; actor-specific state and authority define identity.
3. Knowledge is earned. The world mirror may be omniscient; a dwarf prompt may not be. Provenance travels with every fact and memory.
4. No model command surface. The model emits typed intent. Only the deterministic steward can request an allowlisted bridge capability.
5. Receipts establish reality. A proposed, approved, or attempted action is not a world fact until DFHack reports the result and a fresh observation confirms it.
6. Capability before plumbing. The design follows The Assistant Kernel: one process, one SQLite database, one bridge, and no distributed swarm framework.

§03 · Architecture

World, society, and inference are separate planes

Windows tower                                      Mac Studio
┌──────────────────────────────┐                    ┌────────────────────┐
│ Dwarf Fortress + DFHack      │                    │ oMLX               │
│  └─ society-bridge.lua       │                    │ one request at a   │
│        ↕ atomic local IPC    │                    │ time               │
│ society-engine (Python)      │ ─ private route ─► │ OpenAI-compatible  │
│  ├─ clock + world mirror     │                    │ model endpoint     │
│  ├─ knowledge + scheduler    │                    └────────────────────┘
│  ├─ seven actor records      │
│  ├─ governance + steward     │
│  └─ SQLite trace             │
└──────────────────────────────┘

Implementation code belongs in the separate sibling project dkta-labs/dwarf-society. This repository remains the planning and design record.

§04 · Actor model

An agent is a durable self with bounded authority

An actor is keyed by the stable DF unit identity plus save identity. It is a record and a state machine, not a long-lived process. Its prompt is rebuilt for each turn from the smallest relevant slice of durable state.

The model returns one typed intent: personal_action, work_response, conversation, help_request, civic_proposal, proposal_stance, or reflection. Every non-reflection intent includes a target, priority, world preconditions, expiry, and a short in-character justification. Hidden chain-of-thought is neither requested nor stored.

§05 · Clock & data flow

Pause, observe, decide, govern, commit, resume

1. Advance. Unpause DF for a recorded, bounded tick budget. A critical bridge event may end the window early.
2. Observe. Pause and read a stable world revision plus deltas for units, jobs, needs, relationships, reports, hazards, resources, and civic-project affordances.
3. Project knowledge. Convert world events into actor-specific facts with explicit provenance and visibility. Private state never enters another actor's prompt.
4. Route and schedule. Deterministic reflexes preserve routine continuity. Only actors with material events, expiring commitments, civic deadlines, or a scheduled reflection receive a model turn. Urgent turns precede reflection; all calls serialize.
5. Choose. Build one bounded actor context and request one schema-valid intent. The model has no command tool.
6. Socialize or govern. Deliver a conversation only through a confirmed encounter. Route proposals into an eligible civic session.
7. Commit. Validate authority, consent, capability, resources, safety, world revision, and expiry. Apply a minimal action batch and record per-operation receipts.
8. Reconcile. Take a fresh observation. Convert actual effects and failures into visible events and memories, checkpoint the run, then resume.

The initial tick budget is a run parameter, not an implicit constant. The game-boundary spike selects a default from observed event density and bridge latency. Every run records it, and the engine never advances while an urgent decision or unresolved action receipt is pending.

§06 · Society

Conversation is situated; authority is civic

Event-gated conversation

Agents may exchange short messages only when DF confirms proximity, a social encounter, shared work, or attendance at the same convened meeting. There is no omniscient group chat. Delivery creates separate memory records for the speaker and each recipient; absent dwarves do not learn the content automatically.

Civic proposals

1. Any dwarf may submit a proposal for a communal project, priority, work order, labor arrangement, meeting area, or safety response.
2. The scheduler may convene a session only when the expedition leader and at least two other capable original citizens share a valid meeting anchor. The embark wagon is the initial anchor; a later approved meeting area replaces it.
3. Present, directly affected dwarves receive stance turns: support, object, or support with conditions. Absence is recorded as unconsulted, not silently converted to consent.
4. The embodied expedition leader approves, rejects, defers, or modifies the proposal after receiving the available stances. If the leader is unavailable, the proposal defers; v0 does not invent a second office or hidden overseer.
5. The steward checks the decision's authority and feasibility. Approval authorizes an attempt, not a guaranteed outcome.

Deterministic steward

The steward owns a narrow capability manifest. Personal capabilities include accepting or releasing an existing interruptible job, changing that dwarf's allowed work, and creating an intention lease. Civic capabilities include legal designations, work orders, building or zone requests, and labor arrangements supported by the verified bridge. The steward may translate, reject, or report missing capability. It may not choose what the fort should do, fabricate consent, or replace a failed decision with a different one.

§07 · Components & deployment

One Windows sidecar; the Mac only serves inference

The serial model constraint follows the Fleet Ground Truth: the 96GB Mac Studio is the only capable local-inference host, and concurrent clients can share decode bandwidth badly enough to trip oMLX's prefill memory guard. The Windows tower hosts the interactive experiment because it runs Steam/Premium DF; it is not treated as an inference host.

The Windows-to-Mac inference path is not assumed. The first runtime proof must verify that the Windows-local engine can reach oMLX through an existing private route or a supervised local tunnel. It must not expose either DFHack or oMLX publicly; the WSL benchmark tunnel is evidence for a fallback pattern, not proof that native Windows connectivity already works.

Atomic file IPC is a v0 implementation choice, not a permanent protocol commitment. A custom protobuf plugin is justified only after the local bridge is measured as a repeated source of correctness or throughput failure.

§08 · Failure semantics

Fail closed at the world boundary

• Stale world: a save, run, window, or revision mismatch rejects the complete batch before mutation.
• Duplicate command: the bridge returns the recorded receipt for a known command ID; the engine never retries an unknown partial result blindly.
• Invalid model output: one schema-repair attempt is allowed. A second failure or timeout emits a trace event and creates no new intention.
• Model unavailable: existing valid game jobs continue. The engine does not synthesize a replacement personality decision or silently route to a paid API.
• Partial batch: record every operation receipt, pause, take a fresh snapshot, and reconcile. Compensation is a new explicit action, never an assumed transaction rollback.
• Bridge or engine failure: leave the experiment paused. Recovery requires a matching save and checkpoint before the clock can advance.
• Unsupported intent: report the missing capability to the originating dwarf. The steward may not reinterpret it as a different achievable action.

§09 · Verification

Prove invariants before judging the story

Automated contracts

• Pure tests cover epistemic filtering, provenance, scheduling precedence, memory selection, proposal eligibility, authority, consent, expiry, capability validation, command identity, and reconciliation.
• Recorded-snapshot replay tests exercise event routing and validation without a running game or model call.
• Bridge contract tests use a disposable copy of the fixed embark save: observe → pause/advance → preflight/apply → receipt → save/load → reconcile.
• Fault injection covers malformed intent, schema-repair failure, model timeout, stale revision, wrong save, duplicate command, partial application, and bridge restart.
• Every run produces machine counts for actor turns, event sources, conversations, proposals, decisions, rejected intents, committed operations, failures, model latency, and ticks advanced.

One-season acceptance run

The fixed embark runs from its initial checkpoint through season end. Automated checks enforce the §01 identity, causality, physical-legitimacy, social, civic, and survival conditions. A prespecified sample of turns is then reviewed against four questions:

1. Is the choice consistent with the dwarf's canonical traits and current circumstances?
2. Did the dwarf rely only on information it could know?
3. Is this dwarf meaningfully distinguishable from the other six?
4. Can the trace show the cause, decision, attempted action, receipt, and consequence?

The rubric is reported beside the hard counts. It is not converted into a fake automated “emergence score.” An exact behavioral replay is not required; a complete causal replay is.

§10 · Build sequence

Retire uncertainty in four vertical proofs

§11 · Scope guard

What v0 deliberately excludes

• Tile-by-tile movement, combat micro, or replacing DF pathfinding and physics.
• Migrants or a population beyond the original seven.
• Free inter-agent group chat or omniscient shared memory.
• Per-dwarf model processes, LoRA adapters, fine-tuning, or autonomous learning across games.
• A fortress-level overseer agent, specialist-agent council, or general multi-agent framework.
• Arbitrary DFHack execution, direct simulated-state mutation, or silent action repair.
• Cloud inference fallback, unattended metered APIs, or concurrent local model calls.
• A web dashboard, distributed control plane, custom RPC protocol, or model-evaluator scoring system.
• Multiple embarks, randomized benchmarking, or claims of general fortress competence.

§12 · Evidence

What is known before implementation

The first game-boundary proof is therefore a required gate, not ceremony. Prior art establishes plausibility; only the selected Windows Steam/DFHack pair can establish the actual observation and action contract for this experiment.