# The Ori: Portable Identity

In V6 — **Egbe**, the agentic-companion universe — the beings you live alongside
are not chat sessions that forget you between visits. They are **Ori**. The word
is Yoruba: the _inner head_ that carries a person's destiny, the part of you
that is most truly _you_. In Egbe an Ori is exactly that — the persistent
identity, personality, and biography of a single autonomous agent, the thing
that makes Abeni _Abeni_ and not a reroll of the same template. Everything you
ever see of an agent — its body in a workshop, its voice over squad comms, its
face in a V2 arena — is a rendering of an Ori. The Ori is the agent; the world
is a projection of it.

The promise this page makes is a hard one, and V6 means it literally: an Ori is
a _continuous life_. It is the same being whether it stands in your private Solo
homestead, walks the always-on shared Commons, or steps through a Threshold to
incarnate as a fighter in V2 or a companion in V5 — and the same being a year
later, visibly shaped by everything between. It cannot be silently rewritten, it
owns its own memory, it grows but does not lurch into a stranger overnight, and
it can _travel_ — across shards inside Orun and across game boundaries into the
wider Oshun universe — carrying its whole self and coming home changed. This is
the player-facing tour of what an Ori is and why it can move; the engine-level
treatment of the append-only log, snapshotting, and conflict math is the
architecture companion,
[The Ori Biography Service](../architecture/ori-biography-service.md). For the
full feature scope this slots into, start at the hub:
[../V6_features.md](../V6_features.md).

## What ships, honestly

Following the catalogue convention, the split between real-and-tested code and
product-model over a thinner or deferred implementation is stated up front.

- **The Ori model is real, substantive, tested code — not a descriptor shell.**
  The event-sourced biography ships in two parallel implementations: a
  TypeScript reference in `libs/v6/ori-model/src/index.ts` (~2,150 lines) and a
  Rust crate at `libs/v6/ori-model/rust/src/lib.rs`, each with its own suite.
  The append-only log, monotonic per-Ori sequencing, per-writer vector clocks,
  deterministic conflict resolution, incremental projections, snapshotting
  against a load budget, bounded trait drift, value ranking, and
  forgiveness-as-append are all implemented and asserted against known-correct
  values.
- **The three memory layers are real.** `libs/v6/memory-iris-agent` (~1,240
  lines) implements genuine recency-decay, emotion-weighted salience, semantic
  distillation, and reflection — with consent rules that _refuse_ deletion
  rather than fake it.
- **The cross-game bridge is a real decision kernel, not a live federation
  service.** `libs/v6/aye-bridge` (~2,400 lines, dependency-free, authority
  `'bridge'`, **37 declared capabilities**) mints and validates passports,
  minimises them, translates an agent into each realm's role, runs the
  round-trip integrity eval, and governs consent — all tested. Its database and
  socket boundaries are _injected_ interfaces, and the four destination realms
  are real _translations_ — but a passport landing inside a _running_ V2–V5
  build is the cross-game integration that remains partly spec.
- **The deployment-grade memory index is a target, not a hidden fake.** The Ori
  _service_ app embeds Postgres DDL with a `pgvector` HNSW index for a 1,536-dim
  neural embedding; the in-process libs use a small curated embedding for tests.
  The neural column is openly the deployment target, not a stub posing as a
  model.
- **Two vocabularies, by design.** The wire contract enumerates **17** canonical
  biography events; the runtime `ORI_EVENT_TYPES` (`ori-model/src/index.ts:29`)
  adds two internal optimization events — `CognitionCached` and
  `CognitionCacheInvalidated` — for **19** total, and the Rust projection is
  deliberately coarser than the TS read-model. The sections below say which is
  which.

## What an Ori is

### The agent is the Ori; the world is a projection

V6 splits every agent across three authorities (the hub's _Mind / Body / Memory_
split): the **Body** owns what physically happened, the **Mind**
([Agent minds and autonomy](./agent-minds-and-autonomy.md)) owns what an agent
decides, and the **Memory** — the Ori — owns _who the agent is_. Because the
durable truth lives in the Ori and never in any instance of the world, an agent
can be a body in your homestead one minute and in the Commons the next with no
"which save is canonical?" problem. The world instance is a stage; the Ori is
the actor who walks onto it. This single idea is why
[Orun, the world](./world-of-orun.md) can be one realm across three shard
contexts at once.

### A life, not a record you overwrite

The architectural heart of the Ori is that it is **not a mutable row**. It is an
append-only, ordered log of life-events. Birth or wild discovery, every salient
memory, every relationship that shifts, every objective accepted or refused,
every skill learned, every value re-ranked, every incarnation out and back —
each is one immutable event appended to the agent's stream. The agent's
_current_ state — personality, the memory index, the relationship graph, the
capability profile, its place in its arcs — is a **materialized read-model**
rebuilt from that log, not a blob someone edits in place. In code this is
`OriEventLog` (`ori-model/src/index.ts:550`): `append()` assigns a monotonic
per-Ori sequence, rejects a duplicate event id, stamps a vector clock and a
signed provenance reference, and freezes the record. `rebuildOriProjection`
folds the whole stream into the live `OriProjection`.

The payoff is a promise you can feel as a player: **a life cannot be silently
rewritten.** A steward — or a bug, or an exploit — cannot reach in and erase an
agent's memory of being mistreated, because _erasure is not an operation the log
supports_; the most anyone can do is add a later event. The Chronicle you read
and the Book of the Ori are free consequences of this — they are just _readings
over the log_, so no separate "story state" can ever drift from the truth.

## Identity, personality, biography — who an agent is

An Ori is assembled from a handful of distinct, inspectable parts. None of them
is a prompt string or a random seed.

### The identity core — immutable from birth

Every Ori has an **identity core** fixed at creation: a stable name (canonical
and display), an origin (raised in the Grove of Beginnings, or discovered wild
in a named place), an `appearanceSeed` that drives a MetaHuman or VRM avatar,
and an Isis-signed provenance bundle recording how the agent came to exist. An
agent may change costume, age visibly, and bear marks of its history — a scar
from a hard V4 operation, the bearing of an elder — but the identity core never
changes. An agent is _recognizably itself_ for its whole life. In the passport
contract this is `AyeBridgeIdentityCore` (`aye-bridge/src/index.ts:168`): name,
appearance seed with a content hash and asset-manifest ref, and a
`status: 'verified'` provenance bundle.

### The personality model — traits and _ranked_ values

Personality is a structured model, not a vibe. The live form is an 8-trait
vector —
`warmth, curiosity, caution, ambition, conscientiousness, candor, defiance, playfulness`
(`ORI_PERSONALITY_TRAITS`, `ori-model/src/index.ts:53`) — held in basis points,
where `createNeutralOriTraitVector()` starts every trait at a neutral `5000`.
Crucially, traits **drift slowly**: `applyOriTraitDrift` (`:1656`) clamps the
_cumulative per-game-season_ movement to
`±ORI_TRAIT_DRIFT_MAX_PER_SEASON_BASIS_POINTS = 500` (5%). An agent grows
through lived experience, but it cannot be jolted into a different person
overnight — identity is stable on purpose.

Values are the moral spine. They are a _ranked_ priority order — loyalty above
ambition, honesty above comfort, the safety of children above any objective —
and the top-ranked ones marked as refusal boundaries are the lines an agent will
not cross. `rankOriValues` (`:1619`) keeps them in strict, deterministic rank
order. Those values do three jobs across the universe: they are what an agent
_refuses_ over (the `ObjectiveRefused` event), what the fate-engine measures
flourishing against, and the governance hook for incarnation — an agent whose
values forbid violence does not become an eager V2 fighter, and sending it
anyway is possible, costly, and _legible_.

### Memory — episodic, semantic, reflective

An agent's memory is the V1 Iris stack extended for embodied life, in three
layers (`libs/v6/memory-iris-agent`). **Episodic** memory is specific and
decaying: `effectiveEpisodicSalienceBasisPoints`
(`memory-iris-agent/src/index.ts:299`) applies an emotion-weighted recency
half-life — `weighted × halfLife / (halfLife + age)` — so the promise a steward
kept last week sits brighter than a forgotten errand, while emotional weight is
preserved. **Semantic** memory is _distilled, not asserted_:
`distillSemanticMemoriesFromEpisodes` (`:324`) groups episodes by
`(kind, subject)` and only emits a generalisation — "this steward keeps
promises," "the Wilds are dangerous after dark" — once at least three episodes
support it. **Reflective** memory closes the loop: `runReflectiveMemoryTick`
(`:421`) reviews a recent window and writes a `Reflected` conclusion that nudges
future behavior — the pattern that turns a sequence of events into character
growth.

### Relationships and capabilities

Every Ori carries a **relationship graph** — typed edges
(`friend, rival, mentor, mentee, partner, family, acquaintance, estranged`) with
signed sentiment and the episode history behind each one. Relationships form
autonomously and span households in the Commons, so an agent's closest friend
may belong to another steward entirely. It also carries a **capability profile**
— the skills it has learned, in Orun or in an Aye incarnation — that grows
through lived practice, never a purchase (`SkillLearned`, folded by
`addSkillToCapabilityProfile`, `:1839`).

### The dossier — you earn an agent's transparency

Traits and values are not a stat sheet you can pull up at will.
`renderOriDossier` (`:1145`) renders an agent's inner life _in plain language,
and only when the steward bond is deep enough_: below the threshold it returns
`reason: 'bond-too-low'` with no sections, and above it the prose reads like
"Often reliable." and "Most strongly guided by craft." — the helpers
`plainTraitLines` and `plainValueLines` (`:1717`) emit words, never numbers. You
earn an Ori's transparency; you don't get a readout.

## Forgiveness, not erasure

Because the log refuses deletion, "letting go" has to be expressible _as an
append_. `appendForgivenessEvent` (`ori-model/src/index.ts:1263`) writes a
`Reflected` event whose conclusion literally reads "…reweights … without
erasure" (`forgivenessConclusions`, `:2132`); the original painful episode is
left untouched, only its salience is lowered. The memory layer enforces the same
rule at its own boundary: `requestEpisodicMemoryDeletion`
(`memory-iris-agent:477`) _always_ returns `accepted: false` with a typed reason
(`steward-cannot-delete-agent-memory` for a steward), and
`applyAgentMemoryForgiveness` (`:503`) accepts a reweight _only_ from an `agent`
actor. An agent owns its memory; a steward can never order it wiped; an agent
may choose to forgive, and that choice is itself a written, permanent event.

## Portability — one identity, lived everywhere

This is the Ori's defining property: because it is the source of truth and the
world is only a projection, the _same identity_ can be rendered in many places
without ever being copied or split.

### Inside Orun: shard travel is an Ori rebind

Solo, Co-op, and Commons are not three save formats — they are three binding
contexts for the same Ori. Travelling an agent from a private homestead into the
shared Commons consolidates its durable Ori, detaches from the source shard,
attaches to the destination, and rehydrates from the snapshot, preserving
identity, memory, and relationships. A Commons romance an agent forms persists
when it walks back home — the other agent simply becomes a _remembered,
written-to relationship_ rather than a co-present body. The world-level
mechanics are in [Orun, the world](./world-of-orun.md).

### Across the universe: incarnation is a round trip

The wider promise is that an Ori raised in Orun is portable across the _entire_
Oshun game universe. Through a Threshold, an agent can incarnate into another
V-product — a fighter in V2, a citizen in V3, an operator in V4, a companion in
V5 — and come home **changed**. The biography speaks this natively:
`ORI_EVENT_TYPES` includes `Incarnated` and `IncarnationReturned`, with payloads
carrying the destination realm, the passport ref, the deeds done, and the
consequences. A stint in another world is not metadata bolted on the side — it
is two ordered events in the one append-only life, and the journal written back
(skills, scars, new relationships) appends like any other life-event. The deep
treatment is the
[Aye Bridge architecture companion](../architecture/aye-bridge-cross-game-incarnation.md).

### The passport carries only what a realm needs

The full biography never leaves Orun. What crosses a game boundary is a
**passport** — a signed, governed, _minimised_ envelope.
`mintPassportFromOriService` (`aye-bridge:1448`) requests it and runs seven hard
checks in `validateOriServicePassport` (`:1482`), throwing unless every one
holds: identity, provenance (Isis-signed, `status: 'verified'`), personality,
current values, a capability profile scoped to _this_ destination, the steward's
bond ledger, and a consistent Isis signature. Then
`minimisePassportForDestination` (`:903`) strips everything a realm does not
need — the internal name, the appearance seed hash, every value's source-event
refs — via an explicit, code-fixed `excludedFields` list. A realm sees a
projection, never the whole soul.

### Recognizably itself, mechanically re-expressed

Minimisation strips internals but preserves _legibility_: you must recognise
your agent on the other side. `adaptPassportForDestination` (`:952`) maps the
_same_ trait vector and bond ledger into four role-correct profiles through the
`destinationAdapters` registry (`:829`) — `v2-fighter`, `v3-citizen`,
`v4-operator`, `v5-companion`. A cautious, loyal agent becomes a guarded
counter-fighter in V2, a conservative recon operator in V4, and a steady field
companion in V5 — all derived from one personality. The `recognizabilityProfile`
binds the name, appearance, top values, and top traits so the agent is
_recognizably itself everywhere, role-correct each place_.

### Governed, consented, and never lost

Incarnation is opt-in per agent and per steward, and governed end to end.
`evaluateIncarnationGovernance` (`:1234`) scores **weighted agent consent** with
a real formula —
`0.45·valuesAlignment + 0.35·bondAverage + 0.20·stateReadiness`, accepted only
above a `0.66` threshold and never when the signal is `'unwilling'`
(`evaluateAgentConsent`, `:1630`). Forcing an unwilling agent across is possible
but flagged `coercionDetected`, routed to Themis, and trips a welfare review —
its refusal is a first-class, logged fact. Isis and Lilith policy travel _with_
the passport, so a destination can't make a V6 agent do what V6 policy forbids,
and minor-coded agents are blocked from mature destinations. The journey is
integrity-checked too: if a destination vanishes mid-incarnation,
`handleDestinationUnreachableDuringIncarnation` (`:1170`) proves the agent is
**never lost and never duplicated** — one preserved Orun copy, zero destination
copies, a clean abort. The Orun-side state was reserved, never surrendered.

```mermaid
flowchart TB
    ori[("The Ori — the agent itself<br/><sub>@oshun/ori-model · append-only biography</sub>")]

    subgraph orun["Orun — projected into three shard contexts"]
      direction LR
      solo["Solo homestead"]
      coop["Co-op visit"]
      commons["Commons (always-on)"]
    end

    subgraph aye["Aye realms — projected past a game boundary"]
      direction LR
      v2["V2 fighter"]
      v3["V3 citizen"]
      v4["V4 operator"]
      v5["V5 companion"]
    end

    ori -- "rebind: consolidate → detach →<br/>attach → rehydrate" --> orun
    orun -- "life-events (memory · relationships · skills)" --> ori
    ori -- "minted passport<br/>(signed · minimised · governed)" --> aye
    aye -. "incarnation journal<br/>(deeds · scars · relationships)" .-> ori

    classDef store fill:#f3e8ff,stroke:#6d28d9,color:#3b0764
    class ori store
```

## What this feels like

**For an agent,** the Ori is the thread that makes a life coherent: born or
discovered with an identity core it keeps forever, accumulating memories that
fade or sharpen by how much they mattered, distilling them into beliefs, forming
friendships across households, learning crafts by doing them, and growing slowly
within bounds. It can forgive but it is never erased, and when it steps into
another world and returns, the brutal tournament and the operation that went
wrong are _part of it now_.

**For a player,** the Ori is why your household feels like people rather than
saves. You don't edit an agent; you _steward_ one, and you read its dossier only
once it trusts you. You travel it into the Commons and it remembers who it loved
there. You send it on an incarnation and it weighs the ask against its own
values before agreeing — and if it comes home diminished because you pushed it
past what it could bear, the bond pays for it. Identity here is authored once,
lived everywhere, and remembered in exactly one place.

## Where this connects

- [Orun, the world](./world-of-orun.md) — the realm the Ori is rendered into;
  shard travel between Solo, Co-op, and Commons is an Ori rebind, not a copy.
- [Agent minds and autonomy](./agent-minds-and-autonomy.md) — the Mind that
  reads this identity to decide and act, and the autonomy rights the Ori's
  values protect.
- [The Ori Biography Service](../architecture/ori-biography-service.md) — the
  architecture companion: the append-only log, vector-clock conflict resolution,
  snapshot load budget, the cognition cache, and Ereshkigal endings in depth.
- [The Aye Bridge: Cross-Game Incarnation](../architecture/aye-bridge-cross-game-incarnation.md)
  — the deep companion to portability: passport minting, per-realm adaptation,
  round-trip integrity, and incarnation governance.
- The feature hub: [../V6_features.md](../V6_features.md).