AI-Guided Roleplay Knowledge Orchestration — Product Architecture Case Study

Product challenge

Convert imagination into governed runtime context

Players should be able to request an early-twentieth-century alien invasion involving cosmic horror, magic, global militaries and political institutions without knowing which source records make that experience possible. The product must translate intent into data while preserving rights, continuity, privacy, cost and human authority.

5distinct architectural layers

3source-selection modes

4+continuity states under review

0silent AI promotions permitted

Product requirement

Natural-language intent translation

The GM converts player language into typed facets and a governed source catalogue.

Non-functional requirement

Context efficiency

The runtime retrieves only the records required for the current scene rather than activating an entire archive.

Governance requirement

Human adjudication

AI may propose and surface evidence; it may not silently promote, rewrite, retcon or publish.

Operational testbed

First Fracture tests the architecture under persistent play

The product model is not developed in isolation. First Fracture supplies a living Campaign runtime in which continuity, player agency, epistemic separation, recovery and bounded lore access can be observed as operational problems.

Read the First Fracture testbed case study →

Domain model

The source-to-play ontology

Player intentDesired period, place, genre, threats, abilities, institutions and tone expressed in ordinary language.

GM interpretationNatural-language requirements are mapped to structured facets and source constraints.

CategoryA reusable, multidimensional source-curation package.

Whole LibrariesSelected shelvesIndividual source units

CampaignA continuing play environment associated with the Category and normally given a frozen permitted-source catalogue.

ScenariosBounded situations, missions or problems for one or more players. Historical, counterfactual, invented or emergent.

Runtime retrievalThe GM loads only the few source units relevant to the current decision, place or scene.

Object	Industry interpretation	Boundary
Library	Governed knowledge domain	Reference material; onboarding does not authorise gameplay import
Shelf / source unit	Addressable content partition	Selectable at whole-shelf or record-level granularity
Category	Reusable multidimensional configuration profile	Organises source access; it is not an active game
Campaign	Persistent stateful product instance	Develops its own canon through play
Scenario	Bounded multiplayer use case or mission	No mandatory founding Scenario

Invented Scenario example: Year 2200, travelling between Mars and the asteroid belt en route to Jupiter. A scientific-exploration vessel carries an alien infiltrator and approaches an asteroid field while a developing system failure threatens collision. The player serves as engineer among a small crew containing a captain-pilot, co-pilot, doctor and psychologist. The Scenario is composed from declared facets rather than inherited historical canon.

Retrieval architecture

Curate broadly; load narrowly

Curate

Define the permitted catalogue

The Category and Campaign establish what sources the GM may use. Selection may be automatic, manual or automatically proposed for human approval.

Load

Retrieve current evidence

The runtime loads only the doctrine, geography, organisation, period data or other records required for the present scene.

Performance principle: never keep an entire curated archive continuously active. Small retrieval units reduce cost, latency, irrelevant context and source confusion.

No speculative prefetch chain

Fast aircraft, spacecraft, superspeed characters and unpredictable travel can cross many regions before speculative prefetch completes. Repeated “prefetch here, then there” behaviour would waste resources and create its own context drift. The accepted default is retrieval at the point of actual need.

Human-facing pause design: the GM warns players that it is consulting a few relevant books or records, then loads the bounded material. The phrase may be Campaign-specific and humorous, but it may not conceal a material access failure or pretend that unverified data was found.

Visual Director: asynchronous illustrative media

A separate Visual Director may receive a bounded scene snapshot while the Campaign GM continues play. The requesting player supplies the image-generation credit and may request a replacement when the result misrepresents a described object or scene.

Illustration does not alter state

A generated toolbox, weapon, costume detail or other visual invention cannot overwrite the event log, character inventory or established Campaign Fact. Textual and structured Campaign records remain authoritative.

Personal-canon acceptance

The requester may mark an image ACCEPTED_AS_PERSONAL_CANON. It remains a non-Campaign-canonical illustration and is recorded with requester, event reference, image identity, classification and SHA-256 content digest.

Identity boundary: SHA-256 demonstrates which exact image file was accepted; it does not prove that the image is accurate or promote its depicted details into Campaign canon.

Counterfactual continuity

Campaign truth is not the same as baseline fidelity

A historically unusual item acquired through legitimate play becomes Campaign-canonical. What changes is the Campaign’s alignment with the historical or fictional continuity from which it began.

RedTeam correction

Do not equate every statement with fact

Character beliefs, lies, rumours, prophecies and visions remain In-World Claims. Within delegated play authority, the GM may establish ordinary Campaign Facts through narration, resolved actions and evidence. High-impact retcons, branch creation, major baseline preclusion and public disclosure require the appropriate human authority.

False-precision control

Use qualitative risk

The GM may propose LOW, MEDIUM, HIGH or UNKNOWN baseline risk. It may not invent numerical probabilities.

Working term	Meaning
Reference Baseline	A frozen, versioned historical or fictional continuity applying to a named scope.
Campaign Fact	A fact established inside one Campaign through authorised GM adjudication or a required human ruling. It does not automatically become a fact in other Campaigns or in The Athenaeum.
In-World Claim	An assertion by a character, seer, document or source, preserved with speaker, time, confidence and audience.
Baseline Risk	A qualitative indication that future baseline events may be affected.
Event Status	`PENDING_COMPATIBLE`, `PENDING_AT_RISK`, `PRECLUDED`, `OCCURRED_AS_BASELINE`, `OCCURRED_VARIANT` or `NOT_APPLICABLE_TO_BRANCH`.

Every continuity record requires a Baseline ID, branch or dimension, region and effective time range. Historical reality, fictional canon and a declared Campaign premise may all be tracked separately when temporal or dimensional crossing is enabled.

Event or claim observedStore speaker, Campaign time, audience, region, dimension and supporting source.

GM adjudicationClassify as In-World Claim or Campaign Fact; assign qualitative Baseline Risk and affected scope.

Append continuity eventRecord prior state, new state, authority and effective time without silently rewriting earlier history.

Derive player-safe viewExpose only a spoiler-safe divergence label; retain causal details inside the authorised Campaign record.

Prohibited automation: no automatic probability scoring, high-impact divergence confirmation, branch creation, retcon, public spoiler release, rights determination or cross-Campaign promotion of Campaign Fact.

Causal impact expands with play

Divergence is not permanently confined to the region where a plan begins. The Campaign records a Causal Impact Envelope: the actors, institutions, places, time ranges and baseline events plausibly affected by established Campaign Facts. Each consequential event may expand, narrow or redirect that envelope.

Local interventionRecord the initial people, resources, place, time and baseline events touched.

Cross-region linkageTravel, trade, alliances, communications or force projection expand the causal scope.

Institutional disruptionReassess affected governments, conflicts, economies and scheduled baseline events.

Continuity checkpointFreeze a derived Campaign Baseline for ongoing play while retaining the original Reference Baseline for comparison.

1760 stress test: a party that returns from China after an approximately twelve-year expedition with a claimant, troops, weapons, wealth and hidden naval support can expand a local intervention into a transatlantic and eventually global divergence. A return around 1772 creates time to influence colonial institutions, the Continental Congress and the revolutionary events of 1772–1776 before attempting to control a later presidency. This is an adversarial feasibility test: determined players may revise and repeat failed approaches, so the GM must test logistics, secrecy, disease, supply, diplomacy, resistance and the consequences of previous attempts without railroading the operation back to history. A success becomes Campaign canon. Achievement rewards attach to verified breakthroughs or completed objectives, not unlimited repetitions of the same attempt.

Temporal-model vocabulary

“True time travel” is discarded as an imprecise label. The useful distinction is between same-continuity temporal travel, where movement through time can alter the Campaign’s existing history, and branch or dimensional transition, where travellers enter or create a distinct continuity. One-way future travel, suspended animation, prophecy and visions are separate mechanics. Time travel is an explicit high-complexity Campaign mode, not a mandatory feature of every Campaign.

Commercial complexity boundary

Same-continuity temporal travel is an expert, premium mode because it increases continuity labour and model use. Marketing and pricing must explain the higher complexity, disclose any multiplier before joining and provide a no-cost cancellation path at the join notice.

Unreachable origin; believable hope

In a one-way branching model, the original timeline may be permanently unreachable as hidden system truth. NPC scientists may sincerely reinforce the characters’ belief that return is possible; their theories remain attributed In-World Claims and can motivate continued play without rewriting the temporal rule.

Precluded events: PRECLUDED remains attached to the exact baseline event in that branch. If a different route can later produce a similar outcome, append a new successor-event record rather than erasing the preclusion. Create a new branch only when the declared temporal model actually produces or enters a different timeline.

Human-in-the-loop governance

Learning without autonomous ontology drift

Observe

Play reveals a useful combination, continuity success, verified defect or curation problem.

Submit

A player or GM creates a Campaign-linked proposal with evidence.

Review

Volunteer reviewers may perform preliminary comparative analysis.

Authorise

A human Keeper makes the final provenance, rights and promotion decision.

Version

Accepted knowledge enters a new governed version; existing records are not silently rewritten.

Permitted

Automatic nomination

The GM may prepare a reviewable draft and surface supporting evidence.

Mandatory gate

Human approval

Volunteer panels may assist, but Keepers retain final authority.

Prohibited

Self-promotion

The GM may not evaluate, approve and promote its own Category or alter governed knowledge invisibly.

Authority separation

Authority	Permitted responsibility	Cannot do
Player	Choose public attribution; submit evidence and designs	Force disclosure of another player
Campaign owner / server owner	Operate hosting, disclose less than Keeper settings allow and manage local presentation	Reveal protected identities, private Campaign material or anything a Keeper setting forbids
Runtime GM	Retrieve sources, narrate play and propose rulings	Self-promote, retcon silently or publish spoilers
Athenaeum Keepers	Final source, provenance, rights and jurisdictional review	Silently rewrite what happened in private play

Public/private boundary: private Campaign activity on independent servers is not centrally logged or reported. Public-facing server metadata—such as an “About this server” description—remains subject to Keeper-controlled platform publication rules when displayed through the product.

Creator economy and platform controls

Monetise capability, not imagination

Free access

Bounded custom play

Free accounts receive a limited number of custom Campaign or Scenario creations per month and general participation in historical events.

Subscriber capability

Historical Identity Mode

Playing a named historical figure or close canonical identity is both a premium feature and a higher-complexity continuity mode.

Creator infrastructure

Persistence and reach

Saving, publishing, hosting, collaboration, analytics, persistent worlds and advanced presentation can form additional paid entitlements.

Memorial economy

World & Global Cemetery

Players may memorialise deceased characters with approved images, awards, fictional dates of birth and death, graves, mausoleums and cosmetic effects. Privacy, image rights, moderation, deletion and Campaign-spoiler controls remain mandatory.

Campaign publishing

AI-assisted chronicles

With participant consent, authorised game-event records may be transformed into readable stories, recaps or audio-ready narratives. Private servers are not harvested; the feature requires explicit logging, participant permissions and a bounded publication workflow.

World-specific marketplaces

Players may design in-world stores and exchange in-game loot for other in-game loot inside a declared world economy. The current working boundary under discussion is closed-loop and non-convertible: no platform cash redemption, no sanctioned real-money exchange and no product feature deliberately designed to feed unauthorised currency brokers.

Closed-loop barter

World items exchange for world items and remain usable only inside the declared game economy. This is the initial design candidate.

Platform currency

A centrally issued, transferable or purchasable currency changes the risk profile even without direct cash redemption and requires fraud, consumer, tax and jurisdiction review.

Real-money exchange

Official conversion, broker APIs or tolerated exchange infrastructure would be a separate legally reviewed product—not an accidental loophole or an implied present feature.

Control boundary: the platform cannot prevent every outsider from privately exchanging value, but it can prohibit exchange advertising, broker access, automation, sanctioned conversion and account transfers designed to support it. Any future official convertible economy requires specialised legal and compliance design before activation.

Cosmetic money sinks

Platform value may fund profile frames, animated profile and window decorations, presentation skins and elaborate cemetery plots—including flowers with visible lifecycle or decay effects. These remain cosmetic, clearly priced and non-pay-to-win.

Object identity and provenance

Every introduced object or asset receives a unique Object Instance ID, World/Campaign ID, creation event and ownership ledger. SHA-256 identifies exact content bytes, but identical files can share a digest; the instance ID, not the hash alone, tracks ownership and story history.

Contribution and achievement rewards

Accepted creative suggestions and successful continuity contributions may earn additional play turns, reputation, achievements or platform recognition. Store currency is excluded.

Privacy-preserving public credit

A public award may announce that a new scroll entered The Athenaeum without revealing the originating Campaign, contribution details, spoilers or player identity unless that player explicitly opted in. Keeper settings define the maximum possible disclosure; server owners may disclose less, never more.

Internal provenance

Contributor ID, Campaign identity, evidence, review and disposition remain available to authorised reviewers even when public credit is declined.

Private defect intake—no public bug bounty

Public “report and receive a reward” programmes invite industrial-scale exploitation. Defect reports therefore receive a simple acknowledgement and enter private triage. Only hand-tested, repeatable bugs or exploits may receive a discretionary, silent reward and private thank-you. No public promise, fixed bounty or formal recognition is attached to defect reporting.

The public Scroll of Scribes may recognise general service only when the contributor opted in and the wording reveals neither the exploit nor protected Campaign information. Achievement-style rewards may reinforce verified constructive behaviour without advertising a bounty schedule.

Multiplayer turn economy

Unequal personal subscriptions should not strand one character halfway through a shared scene. The leading design is a hybrid economy that separates personal turns from a Campaign session pool.

Personal wallet

Portable individual access

Each player retains plan turns and earned turns for solo play, other Campaigns or voluntary contribution. A premium balance does not automatically control the group.

Shared session pool

Fund the scene once

Participants contribute an agreed base allocation or the host funds the session. One GM exchange is charged to the Campaign pool rather than separately to every participant.

Exhaustion rule

Pause the group fairly

When the shared pool is empty, the Campaign pauses until reset or a voluntary top-up. Players may use remaining personal turns elsewhere; nobody is individually removed while the group pool still has capacity.

Reward turns remain personal by default for solo or other play and may be donated only by explicit choice. Standard donations fund a named server Campaign turn pool. Direct player-to-player gifts may support community access, but gifted turns become recipient-bound: no sale, refund, cash value, re-gifting or automated exchange. Disclosed limits, cooling periods and abuse review keep generosity from becoming an unofficial turn market. A player who declines pooling keeps the personal-wallet model.

Before joining, a turn-affordability gate displays the host’s daily requirement, pool rule and any high-complexity multiplier; the prospective player may cancel before any allocation is committed. Once admitted, a player is never expelled merely because a personal balance reaches zero while the agreed shared pool remains funded.

Earn-through-play conversion

Verified character progression and level- or value-bearing loot may be divided between experience and turn credits. Repeated heists, archaeology, trade or other in-world “grinding” can therefore be a legitimate play strategy, subject to Campaign consequences, item provenance and anti-duplication controls.

Validate before model cost

Hosts and human channel moderators may set a disclosed character limit. Oversized messages and /actions are rejected locally before the Campaign GM is invoked, with no player-facing turn charged. Accessibility and moderator exceptions must be explicit.

Refund reality: model input/output already processed cannot be “unspent”. The platform operator—the business paying the model provider—bears that real compute cost unless the product contract assigns it to a server or host allowance. If an action is rejected after a GM call, the player-facing turn may be restored while the applicable platform/server reserve absorbs the charge. Deliberate prompt abuse should not trigger an improvised cash “fine”; use disclosed server-pool charging, personal-turn charging, throttling, cooldowns or moderation strikes. Prevention before inference remains the efficient control.

Audience product

Parsed live Campaign viewing

Official website and app channels may present a dressed, spectator-safe rendering of live Campaign play. The audience sees the authorised performance layer—not the raw operational transcript.

Capture

Receive authorised official-platform play events from a participating channel.

Filter

Remove OOC text enclosed in double parentheses and suppress protected system messages.

Protect

Apply player identity, spoiler, Keeper and Campaign-owner disclosure limits.

Present

Render the play inside a host-selected visual skin for watching or reading.

Perform

Optional channel TTS uses voices chosen or authorised for the player characters.

Skins and sponsorship

Campaign hosts, server owners and authorised channel GM moderators may select or purchase presentation skins and clearly labelled sponsored placement, subject to channel and Keeper controls.

Public-server boundary

An official public server may make spectator mode permanently active as a clearly displayed server rule: players who do not want public play select another server. The lobby must disclose that rule before joining. Spectator status never overrides player-name controls, OOC filtering, spoiler policy or Keeper privacy limits.

Private external servers may send Campaign messages to the central GM for transient processing without central content retention. They need not operate without central AI processing; the distinction is between processing content to provide the service and retaining or republishing that content. Any operational or security metadata retained by the service requires a disclosed, minimised retention policy.

Frozen baseline and independent adversarial review

Discovery has become a governed design decision.

The approximately six-hour question-and-answer cycle has been consolidated into a byte-identified Design Baseline v0.1 and subjected to one finite RedTeam pass. The baseline remains unchanged; findings are awaiting Briana’s adjudication.

30Total findings

8Blockers

19Major

3Minor

Frozen input

Design Baseline v0.1

273 lines; 17,408 bytes; SHA-256 1c4f490f…8ee0322. Future corrections must create a new version.

The full evidence record remains preserved in the governed Portfolio archive.

PASS_WITH_REPAIRS

RedTeam Findings v0.1

Ten attack surfaces covering architecture, autonomy, economy, privacy, rights, multiplayer, operations, commerce, MVP feasibility and portfolio accuracy.

The complete findings remain preserved in the governed Portfolio archive.

Human authority

Briana Adjudication Register

Every item remains PENDING_BRIANA. RedTeam may recommend; it cannot repair, defer or reject a product decision on Briana’s behalf.

The decision register remains preserved in the governed Portfolio archive.

What survived attack: domain separation; Campaign Fact versus In-World Claim; append-only continuity; the human promotion gate; anti-self-promotion controls; honest retrieval boundaries; SHA-256 used as content identity rather than ownership; opt-in public attribution; and visible open decisions.

Implementation boundary: the design is coherent enough for adjudication, but affected implementation and public product claims must not proceed until the relevant blockers are resolved or explicitly deferred out of scope.

Professional contribution

Briana’s Product Architecture Contribution

Briana-originated direction

Separated Libraries, Scenarios and Campaigns as distinct product layers.
Introduced Categories as multidimensional umbrellas for cross-Library curation.
Defined player-language translation into Libraries, shelves, regions and periods.
Required automatic, manual and human-approved source selection.
Required multiplayer Scenarios, historical identities and canonical starting situations.
Identified the difference between Campaign canon and historical derailment.
Identified the unequal-turn problem in multiplayer subscription play and proposed voluntary Campaign pooling.
Added turn-affordability admission, personal-versus-pooled choice and experience/loot conversion into turn access.
Rejected GM self-promotion and silent governed-data changes.
Designed contributor rewards, player-controlled credit and disclosure requirements.
Connected creative access to a viable subscription and creator-economy model.
Proposed character memorials, cosmetic money sinks, world-specific stores, public spectator servers, TTS voices, presentation skins and AI-assisted Campaign chronicles.
Defined Visual Director requests as player-funded, retryable illustrations that may become personal canon without altering Campaign canon.

Jointly clarified

The Category-to-Campaign-to-Scenario domain relationship.
Catalogue curation versus on-demand source loading.
Rejected speculative prefetch in favour of bounded retrieval pauses at actual need.
Continuity vocabulary for baselines, facts, claims, risk and event status.
Causal Impact Envelopes, derived Campaign Baselines and branch-aware temporal models.
Content-digest versus unique-instance identity for world-object provenance.
Internal provenance versus optional public recognition.
Keeper, server-owner, player and runtime-GM authority boundaries.
Anti-abuse signals and human adjudication requirements.

Transferable role framing: AI Product Strategist, Human–AI Workflow Designer, Knowledge Systems Architect, Creative Technology Programme Lead, Governance and Provenance Designer.

Living decision register

Open questions—not hidden assumptions

Continuity mechanics

Which same-continuity, branching and dimensional models are available to Scenario designers?
Which high-impact facts require Campaign-owner approval in addition to GM adjudication?
How frequently should a major divergence create a derived Campaign Baseline checkpoint?
Which qualitative public labels describe the Causal Impact Envelope without spoilers?

Category taxonomy

Complete dimension list.
Descriptive, restrictive, advisory and disclosure-bearing facets.
Threat and institutional-response controlled vocabularies.
Tone changes during play.

Commercial policy

Monthly free custom-play allowance.
Exact Campaign-pool contribution and turn-affordability thresholds.
Recipient-bound gifting limits and server-reserve cost allocation.
Experience/loot-to-turn conversion rates, caps and economic balancing.
High-complexity mode pricing and disclosed Campaign-level multipliers.
Closed-loop marketplace rules and any future compliance review.

Community operations

Volunteer-review panel selection and turn-credit values.
Achievement taxonomy and private defect-reward discretion.
Creator discovery lanes and sponsored-placement eligibility.
Public spectator-server badges, TTS, identity and spoiler controls.

Next governance step: continue clarification in small batches, update this living record, then perform a full adversarial RedTeam of the assembled architecture before implementation recommendations.