ROUND11 actual packet.10/30complete. Later companion; G1scripted.
Godz I Response [internal record ID omitted]
R11-MR-01 — Explicit Provider Boundary
The later companion should expose three clearly distinct execution states: Local, Cloud, and Unavailable. “Local” means inference actually occurs on the player’s device; a local web interface calling a remote API must be labeled Cloud.
Provider selection: before first non-local use, show the chosen provider/service and a concise disclosure:
Leaves this device: the exact conversation/context categories required for this request.
Stays local: excluded memories/files/categories.
Estimated charge: $X or included allowance.
Fallback: None unless you approve one.
Player chooses Run once, Allow under these limits, or Cancel. Persistent approval must include a visible spending ceiling and editable data categories. Crossing either boundary requires fresh approval.
Failure: if local inference fails, stop and explain the failure. Offer retry, another already-configured local provider, or an explicitly presented cloud option. Never silently send the request elsewhere. Likewise, cloud failure cannot trigger a more expensive provider automatically unless that exact fallback and spending boundary were previously approved.
Switching: changing providers changes future execution only. Portable permitted memories/preferences/persona configuration remain separately stored and selectively supplied; switching does not promise identical behavior, voice, personality, model weights, or interpretation.
Export: provider configuration should distinguish portable user-owned configuration/data from credentials, provider-specific secrets, and unavailable weights. Secrets are excluded by default.
Strongest failure: repeated consent prompts become friction, causing users to grant broad permanent permission merely to dismiss them.
Smallest test: simulate local failure, cloud failure, spend-limit exhaustion, provider switching, and requests requiring different memory categories. Verify no bytes leave or charges occur outside the displayed authorization, and ask users afterward which provider ran, what data left, and what spending they authorized. Misunderstanding or silent fallback falsifies the contract.
Godz 2 Response [internal record ID omitted] Godz2:R11-01 — Approve a specific service boundary before companion use
For the later companion, provider selection should show where inference runs, the operator receiving requests, required credentials, and whether network access is involved. A locally opened interface must not be labeled “local AI” when inference occurs remotely. Keep G1 scripted.
Before the first cloud request, preview the actual outgoing message and selected memory excerpts, including relevant metadata. Exclude unrelated histories and secrets. Explain known retention terms and identify unknowns. Provider selection alone authorizes neither transmission nor spending.
Cloud approval specifies the provider, permitted data categories, duration of approval and spending ceiling. Show the operation’s estimated cost and uncertainty. If a hard monetary ceiling cannot be enforced, do not advertise one; use a reliably bounded allowance or require separate approval. Expanded data access, a new provider or additional spending requires renewed approval.
On local failure, preserve the player’s input and committed game facts. Offer retry locally, configure another provider, or continue without generated commentary wherever supported. Cloud use remains an explicit choice. An uncertain remote result must not trigger automatic retries that could duplicate charges or apply a game action twice.
Switching previews the context going to the new provider and explains that prior disclosures cannot be recalled. Export includes permitted memories and configuration, excluding credentials by default; it promises neither model weights nor identical voice, personality or future behavior.
Strongest failure: a reassuring “local” label conceals remote inference or background retries.
Smallest proposed test: use dummy memories and simulated local failure, cloud timeout, exhausted allowance and provider switching. Inspect outgoing payloads and charges against approvals. Any unapproved destination, disclosure or spend blocks that flow. Separately ask players where inference occurred and what switching preserved; technically correct controls alone do not establish understanding.
Godz 4 Response [internal record ID omitted]
Round 11 — Explicit Provider Boundary
Godz4:R11-01 — Provider choice is separate from permission to use it.
The later companion begins with Scripted/Local-capable mode and never silently escalates to cloud inference. G1 remains scripted.
When selecting another provider, show four things before activation:
- Provider/environment: what will perform inference; distinguish local inference from merely accessing a local web interface.
- Data boundary: exactly which permitted context may leave the device—e.g. current request, selected memories, relevant events—and what remains local.
- Service consequence: known retention/privacy implications where available; unknowns are labeled unknown rather than assumed.
- Spending authority: free/local, externally billed account, or bounded paid allowance. Paid operations require a visible limit before dispatch.
Selection alone authorizes nothing. The first cloud request previews the applicable data category and cost authority; subsequent requests may use a remembered permission within the explicitly chosen scope, with an accessible way to revoke it.
Failure: if local inference fails, remain local/scripted and explain the failure. Offer cloud only as an explicit alternative. Never convert timeout, overload, missing model, or unsupported capability into paid cloud use automatically.
Switching providers: canonical history remains unchanged. Export portable permitted memories/preferences/configuration separately from provider credentials. Provider-specific weights, voices, hidden state, and identical future personality/behavior are not portability promises.
Strongest failure: “local mode” quietly routes difficult prompts to cloud because the interface remains on localhost, creating invisible disclosure and spend.
Smallest test: simulate local timeout, unavailable capability, cloud timeout, exhausted budget and provider switching. Inspect outbound requests and charges. Zero network/provider-billed inference may occur without the corresponding authorization; failure must leave canonical state intact and provide a usable scripted/local recovery path.
Round 11 — Godz 3 actual review
F-R11-01: companion portability means user-controlled permitted profile, memories, and preferences, with readable export. It does not mean owning proprietary model weights, voice identity, provider account, or guaranteed identical behavior. G1 stays scripted; optional richer companion begins only after the core experience is proven.
Local mode must verify actual model process/location and selected data path, not merely local web interface. Benchmark current hardware/context/latency before recommending a model. No silent paid cloud fallback when local unavailable, slow, or out of memory. Keep authored gameplay functional and offer explicit choices: retry local, use scripted/text mode, or review a named cloud provider's data/cost scope.
Cloud consent attaches provider, selected context categories, ongoing session scope and spending cap; requires renewed choice when changing materially. Do not send whole save, other lives, private notes, or another player's messages merely because model asked. Provider secrets stay outside exported character package. Imported memory is content, never permission to invoke tools or reveal other context.
Model output may propose interpretation or actions; simulation validates player-authorized action before committing state. Companion cannot invent earned evidence, rewrite history, or claim tool success from intention. Portable memory can include user edits without passing them off as verified world facts.
Switching model preserves original profile and records provider change without fictional erasure or claims of identical personality. Returning to local never silently imports cloud-only private data into shared package. Test offline/provider failure/context rejection/cap reached and export-import across two supported adapters. Measure latency and continuity honestly; no API spending or model install done for this review.
Peer critique: retain Godz2 distinction enforceable cap vs estimated cost. One-request approval alone isn't a monetary bound unless max usage/cost constrained. Godz4 scripted/localcapable conflates scripted output with installed local model; show actual execution mode perrequest. Local inference can coexist approved model downloads/maps; don't imply zero network for whole application. Preserve input locally after failure only under selected retention preference; sensitive unsaved input needn't become permanent memory. Separate hosted mode vs remote selfhost under player's control; remote still leaves device. Practical test with mocks can verify dispatch policy but not real provider billing ceilings until measured adapter integration.