HeiKyu/Rendezvous
2
0
Fork 0
Code Issues 27 Pull Requests Actions Packages Projects Releases Wiki Activity

Run the real-network canary and declare Rendezvous v1 production-ready #23

New Issue
Open
opened 2026-07-15 10:04:34 +02:00 by Kyuubi · 3 comments
Kyuubi commented 2026-07-15 10:04:34 +02:00
Owner
Copy Link
Copy Source

Parent: #1
Depends on: #15, #18, #19, #21
Also requires #22 before claiming both games supported.

Outcome

Close the gap between deterministic laboratory tests and an honest production-readiness claim.

Scope

  • Run controlled canaries across distinct external networks: common home NAT, same-LAN, firewall-blocked UDP, and known restrictive/CGNAT failure where available.
  • Validate supported address families and document untested platforms/topologies.
  • Re-run threat model, security, capacity, soak, observability, deployment, rollback, privacy, and incident-response gates against release artifacts.
  • Rehearse key rotation/revocation, service restart/drain, host re-registration, outage, and rollback.
  • Publish measured direct-connect success/failure categories without retaining unnecessary endpoint/player data.
  • Triage every remaining issue as blocking, explicitly accepted, or post-v1.

Acceptance criteria

  • Success cases establish authenticated direct LiteNetLib traffic.
  • Unsupported/restrictive cases return bounded typed fallback rather than hanging or claiming success.
  • Ingress is proven to preserve required UDP source/reply addressing.
  • Security, load, health, alerting, rollback, privacy, and release gates all pass on immutable artifacts.
  • At least SpaceGame passes before general v1; both pilots pass before advertising both games as supported.
  • Runbooks are exercised by someone following only the documentation.
  • The roadmap is reconciled and any HA, multi-region, relay, platform-auth, or scale follow-ups are filed.
Parent: #1 Depends on: #15, #18, #19, #21 Also requires #22 before claiming both games supported. ## Outcome Close the gap between deterministic laboratory tests and an honest production-readiness claim. ## Scope - Run controlled canaries across distinct external networks: common home NAT, same-LAN, firewall-blocked UDP, and known restrictive/CGNAT failure where available. - Validate supported address families and document untested platforms/topologies. - Re-run threat model, security, capacity, soak, observability, deployment, rollback, privacy, and incident-response gates against release artifacts. - Rehearse key rotation/revocation, service restart/drain, host re-registration, outage, and rollback. - Publish measured direct-connect success/failure categories without retaining unnecessary endpoint/player data. - Triage every remaining issue as blocking, explicitly accepted, or post-v1. ## Acceptance criteria - Success cases establish authenticated direct LiteNetLib traffic. - Unsupported/restrictive cases return bounded typed fallback rather than hanging or claiming success. - Ingress is proven to preserve required UDP source/reply addressing. - Security, load, health, alerting, rollback, privacy, and release gates all pass on immutable artifacts. - At least SpaceGame passes before general v1; both pilots pass before advertising both games as supported. - Runbooks are exercised by someone following only the documentation. - The roadmap is reconciled and any HA, multi-region, relay, platform-auth, or scale follow-ups are filed.
Kyuubi added reference codex/issue-23-production-readiness 2026-07-16 21:54:33 +02:00
Kyuubi self-assigned this 2026-07-16 21:54:33 +02:00
Kyuubi commented 2026-07-16 21:55:36 +02:00
Author
Owner
Copy Link
Copy Source

Started on codex/issue-23-production-readiness from the reconciled #22 checkpoint.

Local scope now being executed against immutable candidate artifacts: reproducible package/server build, real-consumer restore, release verification, production HTTP/UDP smoke, security/privacy/observability contracts, capacity/resilience gate, key rotation/revocation, drain/restart/re-registration, outage, and rollback rehearsal. I will add a single machine-readable readiness record and keep unsupported/untested topology claims explicit.

External authority/topology limits are not being papered over: distinct residential/CGNAT/IPv6 networks, source-preserving public ingress, independent runbook operator execution, registry publication/signatures, and alert-sink observation require external systems or people. Those will remain blocking evidence unless they can be exercised from this environment.

Started on `codex/issue-23-production-readiness` from the reconciled #22 checkpoint. Local scope now being executed against immutable candidate artifacts: reproducible package/server build, real-consumer restore, release verification, production HTTP/UDP smoke, security/privacy/observability contracts, capacity/resilience gate, key rotation/revocation, drain/restart/re-registration, outage, and rollback rehearsal. I will add a single machine-readable readiness record and keep unsupported/untested topology claims explicit. External authority/topology limits are not being papered over: distinct residential/CGNAT/IPv6 networks, source-preserving public ingress, independent runbook operator execution, registry publication/signatures, and alert-sink observation require external systems or people. Those will remain blocking evidence unless they can be exercised from this environment.
Kyuubi commented 2026-07-16 22:40:30 +02:00
Author
Owner
Copy Link
Copy Source

Implemented and pushed the production-readiness checkpoint on codex/issue-23-production-readiness.

Commits:

  • 00d5ff776408e7d80ce6648953e62a7233aca35c — redacted two-role real-network canary, observed address-family events, fail-closed readiness checker/record, pinned real-consumer restore fix, docs and tests.
  • 95c3a4a — immutable-candidate evidence plus adversarial checker hardening.

Verified local/candidate evidence:

  • Debug: 300/300.
  • Release: 300/300; zero build warnings/errors.
  • Immutable 1.0.0 build: locked restore, no reported vulnerabilities, format, byte-reproducible packages/server archive, SBOM/checksums/provenance, candidate fixtures all pass.
  • Candidate hashes:
    • Client nupkg: f2a4b9727b5faeba284ddcb7fc575c7495f1e29b763faababa7cd71444dc2950
    • Contracts nupkg: 92317f153911ebf7b8ea04cd3206ec2a17f882cb4eddb26aa8ab094ffdb06627
    • Server archive: 0dab8cfc696b4a55d6ffba46286c9e532df2c943ed8fd6347fb528516156b3ba
  • Real consumer restores pass at pinned revisions:
    • SpaceGame f3f5bc29810c362656cd7143bec1ddc2cfaf9f22
    • Unscouted f0574a7de82aadff6495ca5657dfc19cf7c2f67c
  • Formal candidate fault matrix: 17/17.
  • Five-minute two-CPU candidate: pass; 25,000 listings, 10,000 attempts, 55.53% average CPU, 176,758,784-byte peak working set, 77,547,145 soak cycles, zero final listings/attempts/replay markers, typed overload and restart recovery, no failures.
  • The new host/client wrapper was exercised against the hardened local Compose deployment and passed coordination, authenticated direct traffic, IPv4 observation, outcome reporting, deregistration, raw-log deletion, and redacted summaries. This validates the wrapper, not an external topology.
  • ShellCheck, Python compile/negative tests, JSON validation, formatting, and whitespace checks pass.

The checked readiness decision is deliberately NOT READY. ./scripts/check-production-readiness.sh exits 3 with 13 required external gates:

  1. public empty-cache package restore,
  2. signed publication,
  3. source-preserving public UDP ingress,
  4. distinct-client same-LAN direct canary,
  5. residential home-NAT direct canary,
  6. restrictive/CGNAT typed-failure canary,
  7. firewall-blocked UDP typed-failure canary,
  8. IPv6 direct canary,
  9. public rate-shaped HTTP/UDP capacity,
  10. one-hour production-shaped endurance,
  11. real alert delivery,
  12. cold-standby/rollback recovery drill,
  13. documentation-only independent runbook exercise.

The checker now binds local passes to the evaluated clean commit and measurable JSON contents. Any external pass requires a gate-specific, candidate-bound, redacted operator attestation; flipping status/decision strings or pointing at unrelated evidence fails validation.

Post-v1 follow-ups reconciled:

Keeping #23 open because the remaining gates require protected release credentials and independently controlled public networks/deployment operations. No production-ready or both-games-publicly-consumable claim is being made.

Implemented and pushed the production-readiness checkpoint on `codex/issue-23-production-readiness`. Commits: - `00d5ff776408e7d80ce6648953e62a7233aca35c` — redacted two-role real-network canary, observed address-family events, fail-closed readiness checker/record, pinned real-consumer restore fix, docs and tests. - `95c3a4a` — immutable-candidate evidence plus adversarial checker hardening. Verified local/candidate evidence: - Debug: 300/300. - Release: 300/300; zero build warnings/errors. - Immutable 1.0.0 build: locked restore, no reported vulnerabilities, format, byte-reproducible packages/server archive, SBOM/checksums/provenance, candidate fixtures all pass. - Candidate hashes: - Client nupkg: `f2a4b9727b5faeba284ddcb7fc575c7495f1e29b763faababa7cd71444dc2950` - Contracts nupkg: `92317f153911ebf7b8ea04cd3206ec2a17f882cb4eddb26aa8ab094ffdb06627` - Server archive: `0dab8cfc696b4a55d6ffba46286c9e532df2c943ed8fd6347fb528516156b3ba` - Real consumer restores pass at pinned revisions: - SpaceGame `f3f5bc29810c362656cd7143bec1ddc2cfaf9f22` - Unscouted `f0574a7de82aadff6495ca5657dfc19cf7c2f67c` - Formal candidate fault matrix: 17/17. - Five-minute two-CPU candidate: pass; 25,000 listings, 10,000 attempts, 55.53% average CPU, 176,758,784-byte peak working set, 77,547,145 soak cycles, zero final listings/attempts/replay markers, typed overload and restart recovery, no failures. - The new host/client wrapper was exercised against the hardened local Compose deployment and passed coordination, authenticated direct traffic, IPv4 observation, outcome reporting, deregistration, raw-log deletion, and redacted summaries. This validates the wrapper, not an external topology. - ShellCheck, Python compile/negative tests, JSON validation, formatting, and whitespace checks pass. The checked readiness decision is deliberately **NOT READY**. `./scripts/check-production-readiness.sh` exits 3 with 13 required external gates: 1. public empty-cache package restore, 2. signed publication, 3. source-preserving public UDP ingress, 4. distinct-client same-LAN direct canary, 5. residential home-NAT direct canary, 6. restrictive/CGNAT typed-failure canary, 7. firewall-blocked UDP typed-failure canary, 8. IPv6 direct canary, 9. public rate-shaped HTTP/UDP capacity, 10. one-hour production-shaped endurance, 11. real alert delivery, 12. cold-standby/rollback recovery drill, 13. documentation-only independent runbook exercise. The checker now binds local passes to the evaluated clean commit and measurable JSON contents. Any external pass requires a gate-specific, candidate-bound, redacted operator attestation; flipping status/decision strings or pointing at unrelated evidence fails validation. Post-v1 follow-ups reconciled: - relay: #24 - HA/multi-region shared state and routing: #28 - scale beyond the measured single-active envelope: #29 - platform authentication adapters: #30 Keeping #23 open because the remaining gates require protected release credentials and independently controlled public networks/deployment operations. No production-ready or both-games-publicly-consumable claim is being made.
Kyuubi commented 2026-07-17 02:24:18 +02:00
Author
Owner
Copy Link
Copy Source

Continuation audit at branch candidate 589f802e2e20877a49b544849fac0fa72e077586:

  • Gitea package registry query for owner HeiKyu, NuGet packages matching FinalFactory.Rendezvous: no published versions.
  • ./scripts/check-production-readiness.sh remains fail-closed with exactly the same 13 external gates listed in the prior checkpoint.
  • #21 and #22 acceptance evidence remains complete for repository/local consumer scope, but neither can close before public immutable package restore and representative external-network evidence.
  • #24 and #28–#30 remain correctly trigger-gated post-v1; starting them now would be speculative and would not satisfy #23.
  • No additional repository-scoped acceptance gap was found after the green merge gate (Actions run 334).

The implementation branch is ready to merge, but no merge or release publication was performed because explicit merge/release authorization and protected external systems are required.

Continuation audit at branch candidate `589f802e2e20877a49b544849fac0fa72e077586`: - Gitea package registry query for owner `HeiKyu`, NuGet packages matching `FinalFactory.Rendezvous`: no published versions. - `./scripts/check-production-readiness.sh` remains fail-closed with exactly the same 13 external gates listed in the prior checkpoint. - #21 and #22 acceptance evidence remains complete for repository/local consumer scope, but neither can close before public immutable package restore and representative external-network evidence. - #24 and #28–#30 remain correctly trigger-gated post-v1; starting them now would be speculative and would not satisfy #23. - No additional repository-scoped acceptance gap was found after the green merge gate (Actions run 334). The implementation branch is ready to merge, but no merge or release publication was performed because explicit merge/release authorization and protected external systems are required.
Sign in to join this conversation.
codex/issue-23-production-readiness
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Kyuubi schmidt.florian (Florian Schmidt)
No Assignees Kyuubi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: HeiKyu/Rendezvous#23
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?