docs(integration): verify Godot and Linux SpaceGame pilot (#21)

README.md

@@ -119,6 +119,10 @@ versioning, and secure rollout seams are in the
 The always-on three-party scenarios, optional Linux namespace topology, and
 simulation limits are documented in the
 [deterministic topology harness](docs/integration/topology-harness.md).
+The current consumer evidence and the still-open public-package, Godot-process,
+fallback, reconnect, Linux, and external-NAT gates are tracked in the
+[SpaceGame consumer pilot](docs/integration/spacegame-pilot.md).
+
 
 ## Development
 

deploy/compose/appsettings.Production.json

@@ -1,5 +1,5 @@
 {
-  "AllowedHosts": "localhost;127.0.0.1",
+  "AllowedHosts": "localhost;127.0.0.1;rendezvous",
   "Rendezvous": {
     "Deployment": {
       "PublicHttpBaseUrl": "https://localhost/",
@@ -39,18 +39,20 @@
           "GameId": "space-game",
           "EnvironmentId": "smoke",
           "Enabled": true,
-          "ProtocolVersions": [1],
+          "ProtocolVersions": [1, 2],
           "Regions": ["local"],
           "VisibilityModes": ["Public"],
           "PublisherTrustModes": ["ManagedDedicated"],
-          "MetadataValueMaxBytes": {},
+          "MetadataValueMaxBytes": {
+            "mode": 32
+          },
           "RequiredMetadataKeys": [],
           "MetadataMaxBytes": 512,
-          "MetadataMaxKeys": 0,
+          "MetadataMaxKeys": 1,
           "MaxListingsPerPrincipal": 10,
           "MaxAnonymousListingsPerAddress": 0,
           "MaxActiveJoinAttempts": 100,
-          "FallbackPolicy": "Disabled"
+          "FallbackPolicy": "DedicatedEndpointAllowed"
         }
       ]
     }

docs/deployment/linux.md

@@ -42,9 +42,11 @@ test "$RENDEZVOUS_UID" -ne 0
 docker compose -f deploy/compose/compose.yaml up --build --detach
 ```
 
-`deploy/compose/appsettings.Production.json` is an isolated loopback smoke
-profile, not an Internet template: it deliberately opts into private advertised
-endpoints and has no TLS proxy. Its random key is ignored by Git and must be
+`deploy/compose/appsettings.Production.json` is a local/private-bridge smoke
+profile, not an Internet template: TCP is published only on host loopback, the
+explicit `rendezvous` host name serves isolated clients on the Compose network,
+and the profile deliberately opts into private advertised endpoints without a
+TLS proxy. Its random key is ignored by Git and must be
 deleted after use. Its deliberately long key window only keeps this disposable
 local fixture usable; production keys require short, reviewed rotation windows.
 Production configuration must use its real public names and must leave

docs/evidence/consumers/spacegame.json

@@ -0,0 +1,86 @@
+{
+  "schemaVersion": "1.0",
+  "recordedAt": "2026-07-16",
+  "issue": 21,
+  "consumerIssue": "Kyuubi/SpaceGame#3",
+  "result": "checkpoint-pass-with-external-gates",
+  "rendezvousBaseCommit": "ebb5eb617c0bbb170418afab396b68584b7f992e",
+  "consumerCommit": "f3f5bc29810c362656cd7143bec1ddc2cfaf9f22",
+  "consumerIssueComment": 11469,
+  "packages": {
+    "FinalFactory.Rendezvous.Client": {
+      "version": "1.0.0",
+      "source": "local-candidate",
+      "sourceCommit": "07004cd75fe172aa5dfdb3edda22fc280a4c4477",
+      "sha256": "fb156cf48b49f75c244dd25ea7cc4aa9fc6fab0a878393bb7efd5d9b131d0395"
+    },
+    "FinalFactory.Rendezvous.Contracts": {
+      "version": "1.0.0",
+      "source": "local-candidate",
+      "sourceCommit": "07004cd75fe172aa5dfdb3edda22fc280a4c4477",
+      "sha256": "a82ba986d3905d599096d1d8ce8f32cd4feb104abfca37b0f65e0d2ef3df9a6f"
+    },
+    "LiteNetLib": {
+      "version": "2.1.4"
+    }
+  },
+  "localRun": {
+    "processes": ["Rendezvous", "Godot SpaceGame host", "two sequential Godot SpaceGame clients"],
+    "typedOutcome": "Connected",
+    "gameAdmission": "Accepted",
+    "directGameplay": true,
+    "authenticatedSessions": 2,
+    "directInputs": 2,
+    "directSnapshots": 2,
+    "lifecyclePackets": 4,
+    "gameplayTransport": "caller-owned-litenetlib",
+    "rendezvousGameplayPayloadPath": "none",
+    "hostLeaseRenewed": true,
+    "reconnected": true,
+    "deregistered": true
+  },
+  "linuxRun": {
+    "runtime": "Godot 4.7 .NET Linux x86_64",
+    "freshExport": true,
+    "sourceDirty": false,
+    "optimized": true,
+    "dedicatedHostNamespace": "docker",
+    "remoteClientNamespace": "docker",
+    "topology": "private-bridge",
+    "directGameplay": true,
+    "fallback": "PunchTimedOut to explicit Docker-gateway endpoint, then Accepted game admission and direct gameplay",
+    "artifactHashes": "SpaceGame issue #3 comment 11469"
+  },
+  "negativePaths": {
+    "incompatibleProtocol": "proven",
+    "staleHostPresence": "proven",
+    "punchTimeout": "proven",
+    "invalidAdmission": "integration-proven",
+    "capacity": "regression-tested",
+    "fallbackConnection": "godot-and-isolated-linux-proven",
+    "reconnect": "proven"
+  },
+  "verification": {
+    "debugBuild": "passed",
+    "releaseBuild": "passed",
+    "debugTests": { "passed": 31, "failed": 0 },
+    "releaseTests": { "passed": 31, "failed": 0 },
+    "exportRelease": "optimized-without-debug-symbols",
+    "format": "passed",
+    "shellcheck": "passed",
+    "godotReconnectHarness": "passed",
+    "godotFallbackHarness": "passed",
+    "linuxContainerHarness": "passed-clean-source",
+    "failureMatrix": "passed",
+    "adversarialReview": "passed-after-fixes"
+  },
+  "openGates": [
+    "public-package-restore",
+    "representative-external-nat"
+  ],
+  "relatedSpaceGameGates": [
+    "production-enet-replacement",
+    "capacity-profiles-64-and-128",
+    "sigterm-drain-save"
+  ]
+}

docs/integration/sdk-seams.md

@@ -70,6 +70,7 @@ thread and do not also call `NetManager.PollEvents()` during that period.
 ```csharp
 RendezvousNetListener networkEvents = new();
 NetManager gameplayNetwork = networkEvents.CreateManager();
+gameplayNetwork.ChannelsCount = 3; // set the game's required count before Start
 if (!gameplayNetwork.Start(gameplayPort))
 {
     throw new InvalidOperationException("Gameplay UDP socket could not start.");
@@ -85,6 +86,10 @@ using RendezvousHostCoordinator host = new(
 host.Poll(); // call each game frame while this coordinator owns polling
 ```
 
+LiteNetLib defaults to one QoS channel. Set `ChannelsCount` before `Start` when
+the game protocol uses additional channels; both peers must configure the same
+count. Rendezvous does not choose, remap, or reserve a gameplay channel.
+
 Register normal game callbacks on `networkEvents.GameplayEvents`. Rendezvous
 reserves only its authenticated direct requests and forwards other callbacks.
 The same socket sends host presence, punches through the mediator, establishes

docs/integration/spacegame-pilot.md

@@ -0,0 +1,112 @@
+# SpaceGame consumer pilot
+
+Tracking: Rendezvous #21 and SpaceGame #3.
+
+The current SpaceGame checkpoint proves that the v1 client boundary establishes
+authenticated direct LiteNetLib traffic without taking ownership of the game's
+protocol, admission, player identity, entity identity, capacity, lifecycle, or
+gameplay payloads. Real Godot processes, reconnect, an explicit dedicated
+fallback, and a fresh Linux export now pass. The public package restore and a
+representative external NAT/CGNAT canary remain required before #21 can close.
+
+## Pinned checkpoint
+
+| Input | Value |
+| --- | --- |
+| Rendezvous compatibility source | `ebb5eb617c0bbb170418afab396b68584b7f992e` plus the current #21 configuration/evidence changes |
+| Rendezvous package source | `07004cd75fe172aa5dfdb3edda22fc280a4c4477` |
+| SpaceGame source | `f3f5bc29810c362656cd7143bec1ddc2cfaf9f22` |
+| Client package | `FinalFactory.Rendezvous.Client` `1.0.0` |
+| Contracts package | `FinalFactory.Rendezvous.Contracts` `1.0.0` |
+| LiteNetLib | `2.1.4` |
+| HTTP, UDP, ticket contracts | `1` |
+| SpaceGame gameplay protocol | `2` |
+
+At the checkpoint date, the Final Factory Gitea NuGet service was reachable but
+both `FinalFactory.Rendezvous.*` `1.0.0` registrations returned HTTP 404. The run
+therefore restored locally built candidate packages with the hashes recorded in
+[`spacegame.json`](../evidence/consumers/spacegame.json). This proves candidate
+compatibility, not immutable registry publication. The release package restore
+must be repeated from the public feed.
+
+## Proven local path
+
+The SpaceGame host and client each create one caller-owned `NetManager`, set its
+three gameplay QoS channels before `Start`, and give the same manager and
+`RendezvousNetListener` to the coordinator. Rendezvous authenticates discovery,
+join authorization, host presence, mediation, and connection outcome reporting.
+After traversal, SpaceGame performs a separate audience-bound admission exchange
+on its own reliable command channel. A trusted game-auth boundary mints the
+opaque assertion; the player process never receives the signing key.
+
+The authoritative host rejects expired, replayed, incorrectly signed,
+wrong-listing, duplicate-player, over-capacity, identity-mismatched,
+out-of-sequence, and over-rate traffic. It assigns a canonical game entity ID
+only after admission. The player ID, entity ID, listing ID, join-attempt ID, and
+LiteNetLib peer ID remain distinct values.
+
+The bounded real-process harnesses observed:
+
+- host publication and lease maintenance;
+- browser compatibility filtering and join authorization;
+- typed traversal outcome `Connected`;
+- successful audience-bound game admission;
+- reliable ordered frame-definition and spawn lifecycle records, reliable
+  ordered input, and sequenced state snapshots on the caller-owned gameplay
+  socket;
+- disconnect and a new authenticated session for the same durable player while
+  LiteNetLib peers and canonical entity IDs change;
+- immediate host lease renewal and successful host deregistration;
+- a fresh optimized Linux export running the host and client in distinct
+  hardened container namespaces; and
+- a forced punch timeout that connects the isolated client to an explicitly
+  advertised, non-loopback Docker-gateway fallback and repeats game admission.
+
+Rendezvous exposes no gameplay relay API; all lifecycle, command, and snapshot
+bytes are sent by SpaceGame through its caller-owned `NetManager`. Both Debug
+and Release builds passed. Both Debug and Release test runs passed 31 tests with
+zero failures. ExportRelease is optimized with debug symbols removed. The
+focused formatter, shell checker, fresh-export provenance gate, clean
+candidate-package restore, and adversarial branch review also passed.
+
+## Failure evidence
+
+| Path | Evidence | Status |
+| --- | --- | --- |
+| Incompatible protocol | protocol `999` returns no compatible listing and starts no traversal | Proven |
+| Stale/no host presence | typed `NoHostPresence/RendezvousService/HostPresence/Mediation` | Proven |
+| Traversal timeout | non-listening mediator produces typed `PunchTimedOut/LocalTraversal/NatTraversal/NatTraversal` | Proven |
+| Rejected game admission | invalid signature denies gameplay in the process matrix; wrong audience, expiry, and replay are regression-tested | Proven |
+| Capacity and duplicate player | game-owned roster rejects both and publishes current capacity | Regression-tested |
+| Configured fallback | typed `PunchTimedOut`, explicit non-loopback endpoint, same game admission, direct gameplay | Proven locally and across Linux namespaces |
+| Disconnect | host observes zero active players and final admitted count zero | Proven |
+| Reconnect | same durable player enters a second authenticated session with new peer/entity IDs | Proven |
+
+## Rendezvous-side compatibility fixes
+
+The pilot found generic integration gaps and keeps their fixes in this
+repository:
+
+- the local production-shaped smoke tenant accepts SpaceGame gameplay protocol
+  `2` and the bounded `mode` metadata key;
+- the Compose smoke tenant explicitly allows its private-network service name
+  and enables only the dedicated-endpoint fallback policy;
+- SDK guidance requires games using multiple LiteNetLib QoS channels to set
+  `ChannelsCount` before `Start` and states that Rendezvous reserves no gameplay
+  channel; and
+- the local credential helper rejects any signing-key file with group or other
+  permissions, in addition to its ownership, symlink, and hard-link checks.
+
+Documentation contract tests cover these generic requirements.
+
+## Remaining acceptance gates
+
+Do not mark #21 passed until both remaining external gates have direct evidence:
+
+1. restore the exact immutable `1.0.0` packages from the public Gitea feed; and
+2. run representative external NAT/CGNAT canaries and record the network
+   topology and typed outcome.
+
+SpaceGame #3 remains open independently for the production ENet replacement,
+64/128-player profiles, and SIGTERM/drain/save evidence. The consumer pilot
+does not claim those broader game-migration gates.

scripts/mint-local-publisher-credential.sh

@@ -42,8 +42,8 @@ if stat.S_ISLNK(parent.st_mode) or not stat.S_ISDIR(parent.st_mode):
     raise SystemExit(f"Local Compose secret directory must be a non-symlink directory: {parent_path}")
 if parent.st_uid != os.geteuid() or parent.st_mode & 0o077:
     raise SystemExit(f"Local Compose secret directory must be owned by this user with mode 0700: {parent_path}")
-if metadata.st_uid != os.geteuid() or metadata.st_mode & 0o022 or metadata.st_nlink != 1:
-    raise SystemExit(f"Local Compose smoke key must be owned by this user, single-linked, and not group/world writable: {key_path}")
+if metadata.st_uid != os.geteuid() or metadata.st_mode & 0o077 or metadata.st_nlink != 1:
+    raise SystemExit(f"Local Compose smoke key must be owned by this user, single-linked, and private to its owner: {key_path}")
 
 with open(key_path, "rb") as key_file:
     key = key_file.read(33)

src/FinalFactory.Rendezvous.Client/README.md

@@ -67,12 +67,17 @@ factory does not open a socket, and synchronized events must remain enabled:
 ```csharp
 RendezvousNetListener networkEvents = new();
 NetManager gameplayNetManager = networkEvents.CreateManager();
+gameplayNetManager.ChannelsCount = 3; // example: configure the game protocol first
 if (!gameplayNetManager.Start(0))
 {
     throw new InvalidOperationException("The gameplay UDP socket could not start.");
 }
 ```
 
+LiteNetLib defaults to one QoS channel. Set `ChannelsCount` before `Start` when
+the game protocol uses more than one; both game processes must agree. Rendezvous
+does not reserve or reinterpret any gameplay channel.
+
 The host polls join invitations asynchronously; that method only queues a
 snapshot and never calls the manager. `Poll()` is the sole SDK path that invokes
 LiteNetLib and dispatches its synchronized callbacks. Call it once per game

tests/FinalFactory.Rendezvous.Tests/Documentation/DocumentationContractTests.cs

@@ -53,7 +53,7 @@ public sealed partial class DocumentationContractTests
         Assert.Contains("now + 600", helper, StringComparison.Ordinal);
         Assert.Contains("stat.S_ISLNK", helper, StringComparison.Ordinal);
         Assert.Contains("parent.st_mode & 0o077", helper, StringComparison.Ordinal);
-        Assert.Contains("metadata.st_mode & 0o022", helper, StringComparison.Ordinal);
+        Assert.Contains("metadata.st_mode & 0o077", helper, StringComparison.Ordinal);
         Assert.Contains("metadata.st_nlink != 1", helper, StringComparison.Ordinal);
         Assert.Contains("mint-local-publisher-credential.sh", smoke, StringComparison.Ordinal);
         Assert.DoesNotContain("hexkey:", smoke, StringComparison.Ordinal);
@@ -184,6 +184,48 @@ public sealed partial class DocumentationContractTests
         Assert.Equal(httpVersion, udpVersion);
         Assert.Equal(httpVersion, ticketVersion);
         Assert.Contains($"contract version `{httpVersion}`", guide, StringComparison.Ordinal);
+        Assert.Contains("gameplayNetwork.ChannelsCount = 3", guide, StringComparison.Ordinal);
+        Assert.Contains("defaults to one QoS channel", guide, StringComparison.Ordinal);
+        Assert.Contains("Rendezvous does not choose, remap, or reserve", guide, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SpaceGamePilotEvidenceSeparatesProvenBehaviorFromOpenGates()
+    {
+        string root = FindRepositoryRoot();
+        string guide = File.ReadAllText(Path.Combine(root, "docs", "integration", "spacegame-pilot.md"));
+        string deploymentGuide = File.ReadAllText(Path.Combine(root, "docs", "deployment", "linux.md"));
+        using JsonDocument evidence = JsonDocument.Parse(File.ReadAllText(
+            Path.Combine(root, "docs", "evidence", "consumers", "spacegame.json")));
+        JsonElement record = evidence.RootElement;
+
+        Assert.Equal("checkpoint-pass-with-external-gates", record.GetProperty("result").GetString());
+        Assert.Equal("none", record.GetProperty("localRun").GetProperty("rendezvousGameplayPayloadPath").GetString());
+        Assert.Equal("caller-owned-litenetlib", record.GetProperty("localRun").GetProperty("gameplayTransport").GetString());
+        Assert.True(record.GetProperty("localRun").GetProperty("directGameplay").GetBoolean());
+        Assert.True(record.GetProperty("localRun").GetProperty("reconnected").GetBoolean());
+        Assert.True(record.GetProperty("linuxRun").GetProperty("freshExport").GetBoolean());
+        Assert.False(record.GetProperty("linuxRun").GetProperty("sourceDirty").GetBoolean());
+        Assert.Equal(31, record.GetProperty("verification").GetProperty("debugTests").GetProperty("passed").GetInt32());
+        Assert.Equal(31, record.GetProperty("verification").GetProperty("releaseTests").GetProperty("passed").GetInt32());
+        Assert.Contains("public-package-restore", record.GetProperty("openGates").EnumerateArray().Select(static gate => gate.GetString()));
+        Assert.Contains("representative-external-nat", record.GetProperty("openGates").EnumerateArray().Select(static gate => gate.GetString()));
+        Assert.DoesNotContain("actual-godot-process-integration", record.GetProperty("openGates").EnumerateArray().Select(static gate => gate.GetString()));
+        Assert.DoesNotContain("dedicated-fallback-connection", record.GetProperty("openGates").EnumerateArray().Select(static gate => gate.GetString()));
+        Assert.Contains("Do not mark #21 passed", guide, StringComparison.Ordinal);
+        Assert.Contains("Rendezvous reserves no gameplay", guide, StringComparison.Ordinal);
+        Assert.Contains("private-network service name", guide, StringComparison.Ordinal);
+        Assert.Contains("local/private-bridge smoke", deploymentGuide, StringComparison.Ordinal);
+        Assert.Contains("explicit `rendezvous` host name", deploymentGuide, StringComparison.Ordinal);
+
+        using JsonDocument composeSettings = JsonDocument.Parse(File.ReadAllText(
+            Path.Combine(root, "deploy", "compose", "appsettings.Production.json")));
+        JsonElement compose = composeSettings.RootElement;
+        Assert.Contains("rendezvous", compose.GetProperty("AllowedHosts").GetString()!.Split(';'));
+        JsonElement game = compose.GetProperty("Rendezvous").GetProperty("Provisioning").GetProperty("Games")[0];
+        Assert.Contains(2, game.GetProperty("ProtocolVersions").EnumerateArray().Select(static version => version.GetInt32()));
+        Assert.Equal("DedicatedEndpointAllowed", game.GetProperty("FallbackPolicy").GetString());
+        Assert.DoesNotMatch(ReusableCredential(), guide);
     }
 
     [GeneratedRegex(@"rv1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+", RegexOptions.CultureInvariant)]