Parent: #1
Depends on: #15, #18, #19, #21
Also requires #22 before claiming both games supported.
Outcome
Close the gap between deterministic laboratory tests and an honest production-readiness claim.
Scope
Run controlled canaries across distinct external networks: common home NAT, same-LAN, firewall-blocked UDP, and known restrictive/CGNAT failure where available.
Validate supported address families and document untested platforms/topologies.
Re-run threat model, security, capacity, soak, observability, deployment, rollback, privacy, and incident-response gates against release artifacts.
Rehearse key rotation/revocation, service restart/drain, host re-registration, outage, and rollback.
Publish measured direct-connect success/failure categories without retaining unnecessary endpoint/player data.
Triage every remaining issue as blocking, explicitly accepted, or post-v1.
Acceptance criteria
Success cases establish authenticated direct LiteNetLib traffic.
Unsupported/restrictive cases return bounded typed fallback rather than hanging or claiming success.
Ingress is proven to preserve required UDP source/reply addressing.
Security, load, health, alerting, rollback, privacy, and release gates all pass on immutable artifacts.
At least SpaceGame passes before general v1; both pilots pass before advertising both games as supported.
Runbooks are exercised by someone following only the documentation.
The roadmap is reconciled and any HA, multi-region, relay, platform-auth, or scale follow-ups are filed.
Parent: #1
Depends on: #15, #18, #19, #21
Also requires #22 before claiming both games supported.
## Outcome
Close the gap between deterministic laboratory tests and an honest production-readiness claim.
## Scope
- Run controlled canaries across distinct external networks: common home NAT, same-LAN, firewall-blocked UDP, and known restrictive/CGNAT failure where available.
- Validate supported address families and document untested platforms/topologies.
- Re-run threat model, security, capacity, soak, observability, deployment, rollback, privacy, and incident-response gates against release artifacts.
- Rehearse key rotation/revocation, service restart/drain, host re-registration, outage, and rollback.
- Publish measured direct-connect success/failure categories without retaining unnecessary endpoint/player data.
- Triage every remaining issue as blocking, explicitly accepted, or post-v1.
## Acceptance criteria
- Success cases establish authenticated direct LiteNetLib traffic.
- Unsupported/restrictive cases return bounded typed fallback rather than hanging or claiming success.
- Ingress is proven to preserve required UDP source/reply addressing.
- Security, load, health, alerting, rollback, privacy, and release gates all pass on immutable artifacts.
- At least SpaceGame passes before general v1; both pilots pass before advertising both games as supported.
- Runbooks are exercised by someone following only the documentation.
- The roadmap is reconciled and any HA, multi-region, relay, platform-auth, or scale follow-ups are filed.
Started on codex/issue-23-production-readiness from the reconciled #22 checkpoint.
Local scope now being executed against immutable candidate artifacts: reproducible package/server build, real-consumer restore, release verification, production HTTP/UDP smoke, security/privacy/observability contracts, capacity/resilience gate, key rotation/revocation, drain/restart/re-registration, outage, and rollback rehearsal. I will add a single machine-readable readiness record and keep unsupported/untested topology claims explicit.
External authority/topology limits are not being papered over: distinct residential/CGNAT/IPv6 networks, source-preserving public ingress, independent runbook operator execution, registry publication/signatures, and alert-sink observation require external systems or people. Those will remain blocking evidence unless they can be exercised from this environment.
Started on `codex/issue-23-production-readiness` from the reconciled #22 checkpoint.
Local scope now being executed against immutable candidate artifacts: reproducible package/server build, real-consumer restore, release verification, production HTTP/UDP smoke, security/privacy/observability contracts, capacity/resilience gate, key rotation/revocation, drain/restart/re-registration, outage, and rollback rehearsal. I will add a single machine-readable readiness record and keep unsupported/untested topology claims explicit.
External authority/topology limits are not being papered over: distinct residential/CGNAT/IPv6 networks, source-preserving public ingress, independent runbook operator execution, registry publication/signatures, and alert-sink observation require external systems or people. Those will remain blocking evidence unless they can be exercised from this environment.
Five-minute two-CPU candidate: pass; 25,000 listings, 10,000 attempts, 55.53% average CPU, 176,758,784-byte peak working set, 77,547,145 soak cycles, zero final listings/attempts/replay markers, typed overload and restart recovery, no failures.
The new host/client wrapper was exercised against the hardened local Compose deployment and passed coordination, authenticated direct traffic, IPv4 observation, outcome reporting, deregistration, raw-log deletion, and redacted summaries. This validates the wrapper, not an external topology.
The checked readiness decision is deliberately NOT READY. ./scripts/check-production-readiness.sh exits 3 with 13 required external gates:
public empty-cache package restore,
signed publication,
source-preserving public UDP ingress,
distinct-client same-LAN direct canary,
residential home-NAT direct canary,
restrictive/CGNAT typed-failure canary,
firewall-blocked UDP typed-failure canary,
IPv6 direct canary,
public rate-shaped HTTP/UDP capacity,
one-hour production-shaped endurance,
real alert delivery,
cold-standby/rollback recovery drill,
documentation-only independent runbook exercise.
The checker now binds local passes to the evaluated clean commit and measurable JSON contents. Any external pass requires a gate-specific, candidate-bound, redacted operator attestation; flipping status/decision strings or pointing at unrelated evidence fails validation.
Keeping #23 open because the remaining gates require protected release credentials and independently controlled public networks/deployment operations. No production-ready or both-games-publicly-consumable claim is being made.
Implemented and pushed the production-readiness checkpoint on `codex/issue-23-production-readiness`.
Commits:
- `00d5ff776408e7d80ce6648953e62a7233aca35c` — redacted two-role real-network canary, observed address-family events, fail-closed readiness checker/record, pinned real-consumer restore fix, docs and tests.
- `95c3a4a` — immutable-candidate evidence plus adversarial checker hardening.
Verified local/candidate evidence:
- Debug: 300/300.
- Release: 300/300; zero build warnings/errors.
- Immutable 1.0.0 build: locked restore, no reported vulnerabilities, format, byte-reproducible packages/server archive, SBOM/checksums/provenance, candidate fixtures all pass.
- Candidate hashes:
- Client nupkg: `f2a4b9727b5faeba284ddcb7fc575c7495f1e29b763faababa7cd71444dc2950`
- Contracts nupkg: `92317f153911ebf7b8ea04cd3206ec2a17f882cb4eddb26aa8ab094ffdb06627`
- Server archive: `0dab8cfc696b4a55d6ffba46286c9e532df2c943ed8fd6347fb528516156b3ba`
- Real consumer restores pass at pinned revisions:
- SpaceGame `f3f5bc29810c362656cd7143bec1ddc2cfaf9f22`
- Unscouted `f0574a7de82aadff6495ca5657dfc19cf7c2f67c`
- Formal candidate fault matrix: 17/17.
- Five-minute two-CPU candidate: pass; 25,000 listings, 10,000 attempts, 55.53% average CPU, 176,758,784-byte peak working set, 77,547,145 soak cycles, zero final listings/attempts/replay markers, typed overload and restart recovery, no failures.
- The new host/client wrapper was exercised against the hardened local Compose deployment and passed coordination, authenticated direct traffic, IPv4 observation, outcome reporting, deregistration, raw-log deletion, and redacted summaries. This validates the wrapper, not an external topology.
- ShellCheck, Python compile/negative tests, JSON validation, formatting, and whitespace checks pass.
The checked readiness decision is deliberately **NOT READY**. `./scripts/check-production-readiness.sh` exits 3 with 13 required external gates:
1. public empty-cache package restore,
2. signed publication,
3. source-preserving public UDP ingress,
4. distinct-client same-LAN direct canary,
5. residential home-NAT direct canary,
6. restrictive/CGNAT typed-failure canary,
7. firewall-blocked UDP typed-failure canary,
8. IPv6 direct canary,
9. public rate-shaped HTTP/UDP capacity,
10. one-hour production-shaped endurance,
11. real alert delivery,
12. cold-standby/rollback recovery drill,
13. documentation-only independent runbook exercise.
The checker now binds local passes to the evaluated clean commit and measurable JSON contents. Any external pass requires a gate-specific, candidate-bound, redacted operator attestation; flipping status/decision strings or pointing at unrelated evidence fails validation.
Post-v1 follow-ups reconciled:
- relay: #24
- HA/multi-region shared state and routing: #28
- scale beyond the measured single-active envelope: #29
- platform authentication adapters: #30
Keeping #23 open because the remaining gates require protected release credentials and independently controlled public networks/deployment operations. No production-ready or both-games-publicly-consumable claim is being made.
Continuation audit at branch candidate 589f802e2e20877a49b544849fac0fa72e077586:
Gitea package registry query for owner HeiKyu, NuGet packages matching FinalFactory.Rendezvous: no published versions.
./scripts/check-production-readiness.sh remains fail-closed with exactly the same 13 external gates listed in the prior checkpoint.
#21 and #22 acceptance evidence remains complete for repository/local consumer scope, but neither can close before public immutable package restore and representative external-network evidence.
#24 and #28–#30 remain correctly trigger-gated post-v1; starting them now would be speculative and would not satisfy #23.
No additional repository-scoped acceptance gap was found after the green merge gate (Actions run 334).
The implementation branch is ready to merge, but no merge or release publication was performed because explicit merge/release authorization and protected external systems are required.
Continuation audit at branch candidate `589f802e2e20877a49b544849fac0fa72e077586`:
- Gitea package registry query for owner `HeiKyu`, NuGet packages matching `FinalFactory.Rendezvous`: no published versions.
- `./scripts/check-production-readiness.sh` remains fail-closed with exactly the same 13 external gates listed in the prior checkpoint.
- #21 and #22 acceptance evidence remains complete for repository/local consumer scope, but neither can close before public immutable package restore and representative external-network evidence.
- #24 and #28–#30 remain correctly trigger-gated post-v1; starting them now would be speculative and would not satisfy #23.
- No additional repository-scoped acceptance gap was found after the green merge gate (Actions run 334).
The implementation branch is ready to merge, but no merge or release publication was performed because explicit merge/release authorization and protected external systems are required.
Status after v1.0.0 (2026-08-22): everything short of the real-network canary is now done — immutable release published and signed, production-shaped deployment live on a datacenter VM (TLS via nginx, direct UDP, fail-closed production config), zero-credential health-gated auto-deploy, and a first external consumer (SpaceGame) proving registration→discovery→join→traversal over the public internet 4/4. What that evaluation deliberately could NOT prove is the two-machine, two-real-NAT canary this issue requires — one endpoint sat in a datacenter with a public IP. SpaceGame's planned real-network friend playtest is the natural vehicle: it produces exactly the cross-NAT evidence needed here and for their adoption decision. Leaving this open until that (or an equivalent two-network run) is recorded.
Status after v1.0.0 (2026-08-22): everything short of the real-network canary is now done — immutable release published and signed, production-shaped deployment live on a datacenter VM (TLS via nginx, direct UDP, fail-closed production config), zero-credential health-gated auto-deploy, and a first external consumer (SpaceGame) proving registration→discovery→join→traversal over the public internet 4/4. What that evaluation deliberately could NOT prove is the two-machine, two-real-NAT canary this issue requires — one endpoint sat in a datacenter with a public IP. SpaceGame's planned real-network friend playtest is the natural vehicle: it produces exactly the cross-NAT evidence needed here and for their adoption decision. Leaving this open until that (or an equivalent two-network run) is recorded.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Parent: #1
Depends on: #15, #18, #19, #21
Also requires #22 before claiming both games supported.
Outcome
Close the gap between deterministic laboratory tests and an honest production-readiness claim.
Scope
Acceptance criteria
Started on
codex/issue-23-production-readinessfrom the reconciled #22 checkpoint.Local scope now being executed against immutable candidate artifacts: reproducible package/server build, real-consumer restore, release verification, production HTTP/UDP smoke, security/privacy/observability contracts, capacity/resilience gate, key rotation/revocation, drain/restart/re-registration, outage, and rollback rehearsal. I will add a single machine-readable readiness record and keep unsupported/untested topology claims explicit.
External authority/topology limits are not being papered over: distinct residential/CGNAT/IPv6 networks, source-preserving public ingress, independent runbook operator execution, registry publication/signatures, and alert-sink observation require external systems or people. Those will remain blocking evidence unless they can be exercised from this environment.
Implemented and pushed the production-readiness checkpoint on
codex/issue-23-production-readiness.Commits:
00d5ff776408e7d80ce6648953e62a7233aca35c— redacted two-role real-network canary, observed address-family events, fail-closed readiness checker/record, pinned real-consumer restore fix, docs and tests.95c3a4a— immutable-candidate evidence plus adversarial checker hardening.Verified local/candidate evidence:
f2a4b9727b5faeba284ddcb7fc575c7495f1e29b763faababa7cd71444dc295092317f153911ebf7b8ea04cd3206ec2a17f882cb4eddb26aa8ab094ffdb066270dab8cfc696b4a55d6ffba46286c9e532df2c943ed8fd6347fb528516156b3baf3f5bc29810c362656cd7143bec1ddc2cfaf9f22f0574a7de82aadff6495ca5657dfc19cf7c2f67cThe checked readiness decision is deliberately NOT READY.
./scripts/check-production-readiness.shexits 3 with 13 required external gates:The checker now binds local passes to the evaluated clean commit and measurable JSON contents. Any external pass requires a gate-specific, candidate-bound, redacted operator attestation; flipping status/decision strings or pointing at unrelated evidence fails validation.
Post-v1 follow-ups reconciled:
Keeping #23 open because the remaining gates require protected release credentials and independently controlled public networks/deployment operations. No production-ready or both-games-publicly-consumable claim is being made.
Continuation audit at branch candidate
589f802e2e20877a49b544849fac0fa72e077586:HeiKyu, NuGet packages matchingFinalFactory.Rendezvous: no published versions../scripts/check-production-readiness.shremains fail-closed with exactly the same 13 external gates listed in the prior checkpoint.The implementation branch is ready to merge, but no merge or release publication was performed because explicit merge/release authorization and protected external systems are required.
Status after v1.0.0 (2026-08-22): everything short of the real-network canary is now done — immutable release published and signed, production-shaped deployment live on a datacenter VM (TLS via nginx, direct UDP, fail-closed production config), zero-credential health-gated auto-deploy, and a first external consumer (SpaceGame) proving registration→discovery→join→traversal over the public internet 4/4. What that evaluation deliberately could NOT prove is the two-machine, two-real-NAT canary this issue requires — one endpoint sat in a datacenter with a public IP. SpaceGame's planned real-network friend playtest is the natural vehicle: it produces exactly the cross-NAT evidence needed here and for their adoption decision. Leaving this open until that (or an equivalent two-network run) is recorded.