Ardor

Add a canon rule: kind lock (fields frozen for a character), fact (a field's canonical value), or note. Rules must reference existing characters.

Record a screenshot specification (id, node, viewport, notes) for store/listing capture. The node must exist.

Run the safety audit alone: every surface present, enabled and ungated, plus the age-gate check for adult ratings.

Dry-run a proposed character/scene/dialogue/level write against the gate and report the verdict — allowed, or refused with the gate's code — without writing anything.

Scaffold a new project (name, engine, rating, age gate) with its safety surfaces seeded enabled and ungated. Adult-rated projects require an age gate — the gate refuses otherwise.

Per-channel credential rollup over the whole registry: auth kind, best status (verified/unverified/expired/missing), and the account records. Pass now (ISO timestamp) to evaluate expiry and rotation.

Declare a named flag (story, relationship, progression or system). Dialogue prerequisites and level gates may only reference declared flags.

Generate a deterministic playthrough of the authored graph under a seed (default seed 1) without recording it. The run hash is the replay contract.

One channel's full registry record, including its credential/auth record.

A channel's registry + auth record together with its account records and statuses.

One cast member's full record, including version and reaction profile.

One graph node's full record.

Project summary: metadata, per-document counts, and whether the safety audit passes.

The project's safety document: rating, age gate, content tags, all five surfaces, and the audit result.

All asset records and asset handoffs.

All canon rules for a project.

All channel account records (references and status only), optionally filtered by channel. Pass now (ISO timestamp) to evaluate expiry.

The channel-target registry: every English-language adult distribution channel with platforms, content policy, automation class, artifact requirements, handoff executor, auth kind, and live-verification status.

The full cast plus the amendment history.

Defect records, optionally filtered by status (open matches records with no status yet).

All prepared release handoffs for a project.

All levels.

Graph nodes, optionally filtered by kind (scene or dialogue).

Every project in the server home, with name, engine and rating.

All declared systems.

Prepare a release handoff record for a channel. The gate refuses when: the channel is unknown or flagged, artifacts are missing or lack SHA-256 digests, no verified channel account exists (group 10), or the safety audit fails. Ardor prepares the record; the channel's executor performs the release.

Deterministically preview a character's reaction under a context (relationship, arousal, fatigue, scene_history, prior_choices, action): score 0-100 and band (guarded/warming/engaged/ardent).

Describe a channel's verification probe (e.g. itch.io key validation, Patreon token validation) and its current attested status. Ardor holds no value, so the probe executes on the estate-store side; this tool returns the specification, not a value.

The publish preflight for a project + channel: channel known and verified, safety audit green, auth registered, verified, and (when now is supplied) unexpired — each as a named check.

Record that an asset was handed to a specialist (lumen, torori, ache, neemu, slipway) or a registry channel. The asset must be registered first.

Record a verification attestation for an account: result (verified/failed), method, verified_at (ISO timestamp), optional detail. The probe itself runs on the value holder's side; Ardor records the outcome, never the value.

Record a QA defect (id, title, severity low/medium/high/critical, optional node and detail).

Register an asset record: id, kind, SHA-256 content hash, provenance (source required), and route_to naming its specialist owner (lumen, torori, ache, neemu, local, unassigned). Records only — Ardor never processes the asset.

Register a channel account as a credential REFERENCE: channel, account identity, the channel's real credential kind, and store_ref naming where the value lives (primo pass path or Secure Vault entry). Values are refused — anything shaped like a raw secret, or under a secret-named field, fails the gate.

Generate a playthrough under a seed AND record the run (hash, step count, stop reason) in the project's QA document for later replay verification.

Set a character's reaction profile: base_receptivity, sensitivity, conditioning, stamina (each 0-100), optional per-action modifiers and notes. Previews and playtests key on this.

Configure one safety surface (stop, safeword, accessibility, aftercare, purge): presentation, wording, behaviour. Enabled and ungated are managed invariants — the gate refuses any attempt to disable a surface or progression-gate it.

Patch project metadata (name, engine, rating, age_gate, content_tags, start_node) through the gate: an adult rating still requires an age gate, and start_node must exist.

Create or update a story arc with beats referencing graph nodes; mark ending arcs with ending=true.

Create or update a cast member through the canon gate: locked fields and stated facts refuse the write unless an amendment with a reason is attached (amendments are recorded in the cast history).

Create or update a dialogue node: participants, lines, kink-legitimate actions with affirmative consent state and coverage, intensity 0-10, choices, prerequisites, continuity effects, and animation/voice/sound/haptic cues — all gate-checked.

Create or update a level: node placements, minigame placements (must reference declared minigame systems), and progression gates whose target node exists and whose condition flag is declared. Safety surfaces can never be gate targets.

Create or update a scene node (next, choices, triggers, cues). Referenced nodes and flags must exist or be declared; safety surfaces may never appear as progression gates.

Create or update a game system (schedule, economy, state_machine, minigame, progression). A system id may not collide with a safety surface.

Read-only story audit: beats referencing unknown nodes, nodes unreachable from the start node, declared endings.

Regenerate a recorded run from its seed and compare hashes: proof the authored graph still replays byte-identically.